R-Dash v1.4.0 ships ProtectedRoute with imperative useNavigate+useEffect (ref+pathname guards) and tools/bootstrap_admin_mfa.py to close first-admin MFA chicken-and-egg.

Decision

R-Dash v1.4.0 ships ProtectedRoute with imperative useNavigate+useEffect (ref+pathname guards) and tools/bootstrap_admin_mfa.py to close first-admin MFA chicken-and-egg.

Rationale

Three stacked render-time bugs (TypeError object/primitive, React #185 max-update-depth, escalating-next URL loop) plus first-admin enrollment chicken-and-egg in seed_admin path. Component-level guards in ProtectedRoute touch one file, gate all 20 protected routes. Bootstrap tool uses MFAEnrollmentService directly with same service layer the API uses, gated to platform-admin+mfa_not_enrolled, audit-logged. Validated end-to-end on staging via CLI: login + workspace + DataSource register + Snowflake connection test + agent message all return correct envelopes including ADR-0027 RDASH-AGENT-PROVIDER for missing LLM key.

Alternatives Rejected

Outcome

Pending