---
created_by: "Generated by AI gpt-5-codex on 2026-06-06T00:00:00Z. Human review required."
---

# First-Launch Web Provisioning

## Status

The MVP now treats the web-based setup page as the supported first-launch provisioning path for Apache / OVHcloud-style deployments.

## Current Behavior

- `public/setup.php` is reachable before provisioning is complete.
- `app/bootstrap.php` redirects unauthenticated requests to `/setup.php` until `config/auth.local.php` exists.
- `app/provisioning.php` writes the initial trusted auth config once.
- `config/auth.local.php` remains outside web root and out of version control.

## Notes

- The CLI provisioning script remains available as a fallback for local environments.
- The browser provisioning flow is intentionally one-time and refuses rerun after success.
- No upload/download/file mutation work is included in this slice.