# Task ID: 116

**Title:** One-shot RBAC binding backfill migration

**Status:** pending

**Dependencies:** 115

**Priority:** high

**Description:** Implement guarded startup migration to rewrite existing 'tasks' bindings to 'inference-tasks' so pre-existing grants continue authorizing inference endpoints

**Details:**

In src/mcpd/src/main.ts or a new bootstrap module:
1. Read system settings from SYSTEM_SETTINGS_SECRET (see src/mcpd/src/bootstrap/system-settings.ts pattern)
2. Check for boolean key 'rbacTasksBackfillComplete'
3. If false/missing: iterate rbacRepo.findAll(), for each RbacDefinition row, rewrite roleBindings where resource === 'tasks' to resource: 'inference-tasks'
4. Use rbacRepo.update() to persist changes
5. Set 'rbacTasksBackfillComplete': true in system settings after completion
6. Wildcard bindings (resource: '*') are untouched
7. Model on migrateAdminRole pattern in main.ts

**Test Strategy:**

Unit test: create RbacDefinition with resource:'tasks', run backfill, verify resource changed to 'inference-tasks'. Test idempotency: run twice, verify no duplicate rewrites. Test wildcard unchanged.