Two parallel QA agents (fe-qa-006-relsec, fe-qa-007-evidops) independently
hit the same bootstrap bug on 2026-04-22: fresh Authority DBs lack the
`default` tenant row, so setup-wizard Admin creation fails with
users_tenant_id_fkey and admin/connect/token returns invalid_grant.
The gap appeared because SPRINT_20260422_003 (Authority §2.7 compliance,
archived) correctly trimmed 04-authority-schema.sql to "seeds only" — but
the guarded tenant seed runs only when the schema exists at init-script
time, which it doesn't for migration-owned schemas.
Both agents worked around it in-session by manually inserting `default` +
`installation` tenants and calling POST /api/v1/setup/sessions/{id}/
steps/admin/execute. This sprint puts the seed on the migration path so
the fix converges automatically.
Three tasks: add seed migration (AUTH-SEED-001), verify fresh-volume
bootstrap works without manual SQL (AUTH-SEED-002), document the contract
(AUTH-SEED-003).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
51f9b798ed