8. Complete administrator browser sign-in

Collect the packaged release inputs

• Obtain the matching release-manifest.json and detached release-manifest.sig. The manifest binds the package and immutable image digests to the release.
• Obtain the release and SDK public keys independently through the publisher's trust channel. Point EPM_RELEASE_TRUST_ROOT_FILE and EPM_SDK_TRUST_ROOT_FILE at those protected host files. The installer also accepts the signature path in EPM_RELEASE_MANIFEST_SIGNATURE_FILE.
• Use the package's matching openepm.env and supply its protected secrets and TLS files. Once those inputs are ready, use the packaged epmctl doctor, epmctl install, and epmctl status in that order.

Verify the sign-in path

1. Check that the HTTPS gateway uses the intended OIDC authorization-code flow and approved callback. In the packaged profile it stores the browser session server-side, replaces client-supplied Authorization with the web-audience access token and forwards to the private web service. In a development deployment, the independently configured gateway reaches the loopback web listener.
2. Open the configured EPM_PUBLIC_WEB_ORIGIN and authenticate at the configured issuer. For a packaged deployment with a bootstrapped native user, use that username and temporary password. Complete the password update if the identity provider prompts for it.
3. Verify that the active identity matches the issuer and subject enrolled by bootstrap. Confirm Server Administration or platform access for the intended role.
4. Create or choose an authorized workspace through the platform workflow. Grant workspace and application roles explicitly before testing application operations. Verify a scoped read with the granted identity.

For a failed sign-in, check the callback, certificate trust, issuer, token audience and enrolled subject before changing a role. If the gateway or signed release artifacts are unavailable, stop at the development access checkpoint and record that administrator sign-in is pending.