fix(org): applyPack requires the secret check on every write (starter packs SP3 security P2-1)

A board, workflow or pack write without assertClean now refuses
definition-secret-check-required, and the scan covers every key and
string in the plan before the writer reads any of it.

docs/TOOLS.md

@@ -313,6 +313,15 @@ scripts/mosaic bus start <business> [--pm | --no-launch] [--dev-local-owner] [--
 scripts/mosaic console start [--dev-local-owner [--dev-insecure-bind ADDR --dev-allow-host NAME[,NAME...]]] [--detach] [--port auto|N]
 scripts/mosaic console stop | status | restart
 scripts/mosaic org reload <org>
+scripts/mosaic org role-templates <org> [--json]
+scripts/mosaic org hire|change <org> --name <name> --template <template> --harness <harness> --model <model> [--thinking <level>] [--level org|project|root] [--project <project>] --reason <text> [--json]
+scripts/mosaic org fire <org> --name <name> [--level org|project|root] [--project <project>] --reason <text> [--json]
+scripts/mosaic org autonomy <org> [--json]
+scripts/mosaic org autonomy <org> set --revision <rev> [--cross-role|--merge|--policy|--authority in|near|out] [--notices on|off] [--reverse-window-hours 1-168] [--authority-resolver <name>|""] [--json]
+scripts/mosaic org autonomy <org> review cross-role|merge|policy|authority [--json]
+scripts/mosaic tasks create --title <text> --requirement <REQ-X-N> [--project <name>] [--state <state>] [--assignees <role,...>] [--priority 0-5] [--due <iso>|none] --business <id> [--json]
+scripts/mosaic tasks edit task:<n> --expect <digest> [--title ...] [--state ...] [--assignees ...] [--priority ...] [--due ...] --business <id> [--json]
+scripts/mosaic tasks archive task:<n> --expect <digest> --business <id> [--json]
 scripts/mosaic talk <role> <text> [--wait SECONDS] [--business <id>]
 scripts/mosaic project create <name> [--repo <repo>] | list [--json]
 scripts/mosaic threads [--project <project>] [--json] [--tester]
@@ -335,7 +344,9 @@ For local development on a named instance only, `mosaic bus start BUSINESS --dev
 
 `mosaic console restart` and `mosaic org reload ORG` are the Console's Settings controls (F3) from a terminal (U1, #1873). Each sends one request to the running Console named in the instance's console state, as the page sends it (the Console's own Host and Origin, `Sec-Fetch-Site: same-origin`, a JSON `{}` body), so the Console applies the same owner, `--send` and origin checks and writes the same action trail, `<dataRoot>/console/actions.jsonl`. Both refuse inside an agent run (exit 3) before reading anything, and refuse with exit 3 when no Console runs. `console restart` works only for a Console started in the foreground by `mosaic console start`, or by `mosaic console start --dev-local-owner --detach`, which leaves a detached supervisor (`packages/cli/src/console-supervisor.mjs`, its own session) running the Console as the foreground start does; its receipt adds the supervisor's `supervisor` pid, and its later warnings go to `console/supervisor-*.log` under the data root. `mosaic console stop` stops that Console, and its supervisor then exits. `mosaic console start` refuses inside an agent run (exit 3), with or without `--dev-local-owner` or `--detach`, checking the starting process's own environment as well as the one given for the Console (agent-guard, #1873). A detached start whose supervisor does not reply within 60 seconds signals the supervisor's process group, then kills it, and clears `console/start.lock` only when the lock names that supervisor (pid and start time) and it is gone. Any other Console answers `not-supervised`. `console restart` waits up to 30 seconds for the relaunched Console to answer and prints `{"outcome":"restarted","from":OLD,"boot":NEW}`. `org reload ORG` restarts a running bus or starts a stopped one and prints the Console's done receipt. A request that left but got no answer is reported as outcome unknown (exit 1) and is never retried; check `mosaic console status`, `mosaic bus status ORG` and the trail. `mosaic bus restart ORG` remains the trail-less host verb.
 
-The bus and Console lifecycle verbs refuse inside an agent run (agent-guard, #1873): `mosaic bus start`, `bus stop`, `bus restart` and `bus recover`, and `mosaic console start`, `console stop` and `console restart`, and `mosaic org archive` and `org delete`, which stop the organization's bus. Each exits 3 with `refused: this runs only from a human shell, outside any agent run (found MARKER in the environment)` before it reads anything. It checks the environment it is given and its own process environment, so a sanitized environment does not hide a marker. A usage error (a missing or extra argument, `--pm` with `--no-launch`, or a bad `--dev-insecure-bind`/`--dev-allow-host`) still comes first (exit 4). `mosaic bus status` and `mosaic console status` stay open to agents. The Console's Restart bus and Restart Console controls keep working: the Console starts its bus host with its own environment, which carries no marker, and Restart Console relaunches the Console under its supervisor without going through the CLI. The markers are the ones `packages/cli/src/transport.mjs` lists. The check is cooperative: a process that drops the markers from its environment is not stopped by it.
+The hire form and the autonomy panel from a terminal (E2, #1873, P1-3). `mosaic org role-templates|hire|fire|change ORG` and `mosaic org autonomy ORG [set|review]` send the page's own request to the running Console's org route (`/api/orgs/ORG/decisions/hire/templates|start`, `/api/orgs/ORG/autonomy[/review]`), as `org reload` does, so the Console applies the same owner, `--send`, origin, body and live-session checks and the same bus verbs run (`hire.templates.console`, `hire.start.console`, `autonomy.get.console`, `autonomy.set.console`, `autonomy.review.console`). `hire` and `change` read the templates first and send the chosen template's name and sha256, as the form does. `autonomy set` needs the 64-hex `--revision` from `mosaic org autonomy ORG` and sends every setting the panel sends, with only the named ones changed; a stale revision is refused `revision-conflict`; an empty `--authority-resolver ""` clears the resolver, as emptying the panel's field does. These verbs need a named instance (`MOSAIC_CONFIG` set to `~/.config/mosaic-NAME/config.json`) whose Console runs with `--dev-local-owner`; the default instance is refused with exit 3. A Console refusal exits 3 with the Console's code and message; `outcome-unknown` exits 1; an unknown template exits 2. Every one of these verbs, reads included, refuses inside an agent run. `mosaic tasks create|edit|archive` are the task board's three writes: the arguments pass the board's own check (`workspace-tasks.mjs parseTaskWrite`) and go to the bus as the person (`tasks.create|edit|archive`, human transport), so the bus runs its human, field, digest and archive checks. A stale `--expect` is refused `task-conflict`; read the digest with `mosaic tasks --json`.
+
+The bus and Console lifecycle verbs refuse inside an agent run (agent-guard, #1873): `mosaic bus start`, `bus stop`, `bus restart` and `bus recover`, and `mosaic console start`, `console stop` and `console restart`, and `mosaic org archive` and `org delete`, which stop the organization's bus, and `mosaic org restore`, which starts it (`org restore --no-bus` starts nothing and is not refused), and `mosaic org role-templates`, `hire`, `fire`, `change` and `autonomy` (E2). Each exits 3 with `refused: this runs only from a human shell, outside any agent run (found MARKER in the environment)` before it reads anything. It checks the environment it is given and its own process environment, so a sanitized environment does not hide a marker. A usage error (a missing or extra argument, `--pm` with `--no-launch`, or a bad `--dev-insecure-bind`/`--dev-allow-host`) still comes first (exit 4). `mosaic bus status` and `mosaic console status` stay open to agents. The Console's Restart bus and Restart Console controls keep working: the Console starts its bus host with its own environment, which carries no marker, and Restart Console relaunches the Console under its supervisor without going through the CLI. The markers are the ones `packages/cli/src/transport.mjs` lists. The check is cooperative: a process that drops the markers from its environment is not stopped by it.
 
 The instance processing switch is separate from per-business launches off/on.
 `mosaic halt` durably stops managed processing across every business in the
@@ -1347,6 +1358,23 @@ input; error on stderr, never a clean verdict).
 problem. Scripts print diagnostics on stderr; model responses (and only
 model responses) on stdout.
 
+## Model proxy setup (`scripts/mosaic proxy`, #1873)
+
+Human-shell verbs that match the Console's Proxy setup panel; each refuses
+`human-required` in an agent shell or with `--tester`, and prints no key or
+absolute path. `proxy fetch` (existing output unchanged) now prints the
+page's progress steps on stderr and writes the same fetch receipt to
+`<dataRoot>/state/proxy-admin.jsonl`. `proxy status [--json]` shows release, init, unit, fence, init
+lock, own proxy and the next step. `proxy init --generate-key [--port N]
+[--rotate-grace-minutes N] [--first-output-seconds N] --business ID` has the
+bus generate the management key (no prompt, no TTY). `proxy unit
+render|status|install|start|stop|restart` manages the proxy user unit.
+`proxy fence clear --restart --business ID` restarts the unit, requires a
+confirmed new process listening on the port, then clears the fence with that
+evidence (`proxy-restart-unconfirmed` otherwise). `proxy init-lock
+status|clear` clears a stale init lock only when every bus is stopped and no
+proxy state exists. Details: `packages/model-proxy/README.md`.
+
 ## Agent limits (`scripts/mosaic limits`)
 
 View: `scripts/mosaic limits --business ID --json`. Set: `scripts/mosaic limits

docs/plans/2026-11-10_system-type-toolsets-design.md

@@ -1,5 +1,7 @@
 # System-type toolsets at launch
 
+Superseded 2026-11-12 by `docs/plans/2026-11-12_starter-packs-design.md` under Jason's starter-packs ruling; do not build this design.
+
 Status: design only. Nothing here is built and no `roles/` or contract file is
 changed. Prepared 2026-11-10 against `refactor` `8630b8dfc` for phase P2 of
 #1873 (unified workspace). PRD requirement: REQ-SYS-2, "An agent working in a

packages/bus/src/broker.mjs

@@ -606,6 +606,7 @@ export class Broker {
   #pluginService;
   #credentialVerbs;
   #proxyInit;
+  #proxyFenceClear;
   #proxyPage;
   #project;
   #library;
@@ -641,6 +642,9 @@ export class Broker {
   // Row 236 (#436b): giteaGrant and giteaKeys from gitea-grant.mjs, or null, and the remote halves of
   // section 5's restart rows and of revokes a restart cut short, for reconcileGitea.
   #giteaGrant;
+  #copyGrant;
+  // #1873 CB3: copy-launch.mjs's gate, or null. It answers for a copy the boot left needing a binding.
+  #copyLaunch;
   #giteaKeys;
   #giteaUndo = [];
   // Row 281 (#1786, d6 section 3b): each tracked Gitea promise and the business/agent it acts for, or
@@ -666,7 +670,7 @@ export class Broker {
   #processing;
   #taskTracker;
   // credentialStatus is the runtime's metadata-only Credentials.status(); the broker never gets use().
-  constructor({ store, businesses, pluginService = null, secretCheck = () => {}, credentialStatus = () => [], organization = null, hires = null, autonomy = null, project = null, library = null, usage = null, limits = null, harnessOn = null, credentialVerbs = null, proxyInit = null, proxyPage = null, hostGrant = null, hostKeys = null, processing = null, testerOn = null, grantScope = null, roleFile = null, giteaGrant = null, giteaKeys = null, access = null, accessStamp = null, compactions = null, requestLifecycle = null, requirementsHost = null, workspaceRead = null, taskTracker = null }) {
+  constructor({ store, businesses, pluginService = null, secretCheck = () => {}, credentialStatus = () => [], organization = null, hires = null, autonomy = null, project = null, library = null, usage = null, limits = null, harnessOn = null, credentialVerbs = null, proxyInit = null, proxyFenceClear = null, proxyPage = null, hostGrant = null, hostKeys = null, processing = null, testerOn = null, grantScope = null, roleFile = null, giteaGrant = null, copyGrant = null, copyLaunch = null, giteaKeys = null, access = null, accessStamp = null, compactions = null, requestLifecycle = null, requirementsHost = null, workspaceRead = null, taskTracker = null }) {
     if (!object(businesses) || !Object.keys(businesses).length) fail('invalid-business');
     // Row 194 b15 (sage-2501): the function-argument checks come before anything reads the store.
     if (harnessOn !== null && typeof harnessOn !== 'function') throw new TypeError('harnessOn must be a function');
@@ -695,10 +699,13 @@ export class Broker {
     // Row 199: the runtime's credential lifecycle (credential-verbs.mjs); it holds the store, not the broker.
     this.#credentialVerbs = credentialVerbs;
     this.#proxyInit = proxyInit;
+    this.#proxyFenceClear = proxyFenceClear;
     this.#proxyPage = proxyPage;
     this.#hostGrant = hostGrant;
     this.#hostKeys = hostKeys;
     this.#giteaGrant = giteaGrant;
+    this.#copyGrant = copyGrant;
+    this.#copyLaunch = copyLaunch;
     this.#giteaKeys = giteaKeys;
     this.#access = access;
     this.#accessStamp = accessStamp;
@@ -1562,15 +1569,32 @@ export class Broker {
   // #1873 A3: a root or project copy the boot left unbound or refused isn't in `roles`. Its refusal
   // names the agent and the missing services or the reason, never a value (organization
   // agent-copies.mjs copyRefusal; inlined because this module also loads in the sandbox client).
-  #copyRefused(b, instance) {
+  #copyRefused(b, instance, session = null) {
     const copy = b.copies && Object.hasOwn(b.copies, instance) ? b.copies[instance] : null;
     if (b.roles[instance]?.unbound?.length) throw new BusError('credential-unbound', `${instance} has no binding for ${b.roles[instance].unbound.join(', ')}`);
     if(copy?.level==='root') {
       const refusal=this.#hires?.rootRefusal ? this.#hires.rootRefusal(copy.name) : this.#hires?.rootActive && !this.#hires.rootActive(copy.name) ? 'instance-fired' : null;
       if(refusal)fail(refusal);
     }
+    // #1873 CB3: a copy bound at boot holds only while the gate's launch authority does, and a run
+    // only while it is the authority bindLaunch admitted for it. Without a gate it is unavailable.
+    if (b.roles[instance]?.copyBound?.length) {
+      if (!this.#copyLaunch) fail('credential-unavailable');
+      const { authority } = this.#copyLaunch.authority(b.id, instance);
+      if (session && session.copyAuthority !== authority) fail('copy-authority-changed');
+    }
     if (!copy || copy.state === 'instance') return;
-    if (copy.state === 'unbound') throw new BusError('credential-unbound', `${instance} has no binding in ${b.id} for ${copy.missing.join(', ')}`);
+    if (copy.state === 'unbound') {
+      // A binding approved after boot is restart-required, a failed boot check keeps its code.
+      if (this.#copyLaunch) {
+        try {
+          this.#copyLaunch.authority(b.id, instance);
+        } catch (e) {
+          if (!(e instanceof BusError) || e.code !== 'credential-unbound') throw e;
+        }
+      }
+      throw new BusError('credential-unbound', `${instance} has no binding in ${b.id} for ${copy.missing.join(', ')}`);
+    }
     throw new BusError(copy.project === null ? 'copy-refused' : 'project-refused', `${instance} can't launch in ${b.id}: ${copy.reason}`);
   }
   // #1873 A3: why `instance` can't work in code project `repo`, as a BusError, or null when it can
@@ -1856,7 +1880,7 @@ export class Broker {
     if (s.tester) fail('tester-refused');
     if (s.reader) fail('read-only');
     if (s.human) fail('agent-required');
-    this.#copyRefused(this.#business(s.business),s.role);
+    this.#copyRefused(this.#business(s.business),s.role,s);
     const h = this.#own(s);
     if (h?.op !== 'claim' || (s.thread ? h.generation !== this.#runGeneration(s) : h.holder_run !== s.run))
       fail(this.#launcherReleased.has(s.business + ':' + s.run) ? 'launcher-released'
@@ -2117,7 +2141,7 @@ export class Broker {
   #launchProof(record) {
     keys(
       record,
-      ['business', 'role', 'run', 'harness', 'address', 'pid', 'startTime', 'thread', 'session', 'provider', 'model', 'account', 'transcript'],
+      ['business', 'role', 'run', 'harness', 'address', 'pid', 'startTime', 'thread', 'session', 'provider', 'model', 'account', 'transcript', 'copyAuthority', 'revision'],
       ['business', 'role', 'run', 'harness'],
     );
     const b = this.#business(identifier(record.business));
@@ -2182,6 +2206,14 @@ export class Broker {
     if (!old && !this.#harnessOn(record.business, record.harness)) fail('invalid-harness');
     if (!old && record.thread !== undefined && this.#archived(record.business, this.#threadRow(session, record.thread).project)) fail('project-archived');
     if (!old && record.thread !== undefined && this.#threadLost(record.business, record.thread)) fail('thread-revoked');
+    // #1873 CB3: a bound copy's run carries the launch authority its prepare and final admission
+    // checked, and the organization file revision (A3) the launch resolved; both must still hold
+    // now, and the session keeps the authority for every later use.
+    if (launchRole.copyBound?.length) {
+      if (!this.#copyLaunch) fail('credential-unavailable');
+      if (typeof record.copyAuthority !== 'string') fail('copy-authority-changed');
+      this.#copyLaunch.admit(record.business, record.role, record.copyAuthority, record.revision ?? null);
+    } else if (record.copyAuthority !== undefined || record.revision !== undefined) fail('invalid-request');
     if (!old) this.#store.transaction(() => this.#event(session, 'session.launched', body, record.run));
     this.#runs.set(key, session);
     return this.#cap(session);
@@ -5483,6 +5515,20 @@ export class Broker {
   }
   // Design D5: the only key the git socket's gitea token use gets is the agent checkPublish checked
   // (#agent: a run holding its claim, never a tester, reader or human). Trusted host only.
+  // #1873 CB3: who a copy credential call is for, from the capability's own live run: business,
+  // role, run and the launch authority bindLaunch admitted. Never a human, tester or reader, never an
+  // ended run, and only while the copy's authority is still the one the run was admitted on.
+  // Trusted host only; no socket verb returns it.
+  copySession(cap) {
+    const s = this.#session(cap);
+    if (s.human || s.tester || s.reader) fail('copy-request-refused');
+    const key = s.business + ':' + s.run;
+    if (this.#runs.get(key) !== s || this.#ended.has(key)) fail('run-ended');
+    const b = this.#business(s.business);
+    if (!b.roles[s.role]?.copyBound?.length || typeof s.copyAuthority !== 'string') fail('copy-request-refused');
+    this.#copyRefused(b, s.role, s);
+    return Object.freeze({ business: s.business, role: s.role, run: s.run, copyAuthority: s.copyAuthority });
+  }
   publishSession(ticket) {
     const { s } = this.#publish(ticket);
     return Object.freeze({ business: s.business, role: s.role });
@@ -5971,6 +6017,19 @@ export class Broker {
         return Promise.resolve().then(() => this.#proxyPage(request.verb, args, { business: s.business, human: s.human }))
           .catch(error => { throw this.#refused(s, new BusError(PROXY_PAGE_CODES.includes(error.code) ? error.code : 'proxy-down'), { verb: request.verb }); });
       }
+      // #1873: the fence clear takes restart evidence, which the runtime re-proves on the host
+      // before the lock clears. Owner only, before every other gate, like the proxy page verbs.
+      if (request.verb === 'proxy.fence.clear') {
+        this.#human(s);
+        if (!this.#proxyFenceClear) fail('not-configured');
+        const args = request.args ?? {};
+        keys(args, ['evidence'], ['evidence']);
+        return Promise.resolve().then(() => this.#proxyFenceClear(args)).then(result => {
+          if (!object(result) || typeof result.cleared !== 'boolean') fail('proxy-down');
+          this.#store.transaction(() => this.#event(s, 'action.allowed', { call: 'proxy.fence.clear', cleared: result.cleared, pid: result.evidence?.after?.pid ?? null }, null));
+          return result;
+        }).catch(error => { throw this.#refused(s, new BusError(/^proxy-[a-z-]+$/.test(error.code ?? '') ? error.code : 'proxy-down'), { verb: request.verb }); });
+      }
       // FED R3 (design 3.5, 3.7 trigger 1): a user reaches the collaborator list only, and each
       // request reads the access file again, so a removed or expired grant refuses the next one.
       let grants = null;
@@ -5991,19 +6050,24 @@ export class Broker {
       if (request.verb === 'proxy.init') {
         this.#human(s);
         if (!this.#proxyInit) fail('not-configured');
-        keys(args, ['key', 'port', 'rotateGraceMinutes', 'firstOutputSeconds'], ['key']);
-        if (!validManagementKey(args.key)) fail('proxy-key-invalid');
+        keys(args, ['key', 'generate', 'port', 'rotateGraceMinutes', 'firstOutputSeconds']);
+        // #1873: exactly one of a key or generate:true. A generated key is made here, stored by
+        // init where a typed key goes, and never returned, logged or put in an event.
+        if (Object.hasOwn(args, 'generate') ? args.generate !== true || Object.hasOwn(args, 'key') : !Object.hasOwn(args, 'key')) fail('invalid-request');
+        if (!Object.hasOwn(args, 'generate') && !validManagementKey(args.key)) fail('proxy-key-invalid');
         if (Object.hasOwn(args, 'port') && (!Number.isInteger(args.port) || args.port < 1024 || args.port > 65535 || args.port === 8317)) fail('proxy-config-invalid');
         try { proxyTiming(args); } catch (error) { fail(error.code); }
         // Async initialization is outside the store transaction. Refusals retain codes only.
-        return Promise.resolve().then(() => this.#proxyInit(args)).then(result => {
+        const { generate, ...given } = args;
+        const initArgs = generate ? { ...given, key: randomBytes(48).toString('base64url') } : given;
+        return Promise.resolve().then(() => this.#proxyInit(initArgs)).then(result => {
           if (!object(result) || Object.keys(result).some(k => !['binary', 'port', 'rotateGraceMinutes', 'firstOutputSeconds'].includes(k))
               || !Number.isInteger(result.port) || result.port < 1024 || result.port > 65535 || result.port === 8317
               || typeof result.binary !== 'string' || !result.binary.startsWith('/')) fail('proxy-init-failed');
           try { proxyTiming(result); } catch (error) { fail(error.code); }
-          this.#store.transaction(() => this.#event(s, 'action.allowed', { call: 'proxy.init', port: result.port }, null));
+          this.#store.transaction(() => this.#event(s, 'action.allowed', { call: 'proxy.init', port: result.port, ...(generate ? { generated: true } : {}) }, null));
           return result;
-        }).catch(error => { throw this.#refused(s, new BusError(/^proxy-[a-z-]+$/.test(error.code ?? '') ? error.code : 'proxy-init-failed'), request); });
+        }).catch(error => { throw this.#refused(s, new BusError(/^proxy-[a-z-]+$/.test(error.code ?? '') ? error.code : 'proxy-init-failed'), { verb: request.verb }); });
       }
       this.#secretCheck(args);
       if (request.verb === 'plugin.tool') {
@@ -6349,6 +6413,11 @@ export class Broker {
     if (a.token !== undefined) string(a.token, 16384);
     if (a.date !== undefined) string(a.date, 10);
     if (a.reason !== undefined) string(a.reason, 500);
+    // #1873 CB2: an issue for a copy this bus booted with goes to the copy verifier (copy-grant.mjs).
+    // The boot's copies view leaves out a name the file's own roles hold; a copy that needs no
+    // credential joins the roles but is still a copy. Any other unknown name answers credential-unknown.
+    const booted = this.#business(s.business);
+    if (verb === 'credentials.issue' && this.#copyGrant && booted.copies && Object.hasOwn(booted.copies, a.agent)) return this.#issueCopyGrant(s, a);
     if (!Object.hasOwn(this.#business(s.business).roles, a.agent)) fail('credential-unknown');
     // A running agent keeps its tokens until its runs end: delete waits for every claim to end.
     if (verb === 'credentials.delete' && (this.#holder(s.business, a.agent)?.op === 'claim' || this.#threadHolders(s.business, a.agent).length))
@@ -6379,6 +6448,33 @@ export class Broker {
     }
     return result;
   }
+  // #1873 CB2: owner only, as every binding decision (design Q1): not the tester, a reader or an
+  // org.hire member. The recheck runs after the remote work and again under the writer's locks.
+  #copyOwner(s) {
+    if (s.tester || s.reader || !s.human) fail(s.tester ? 'tester-refused' : 'human-required');
+    if (s.hireMembership ? s.hireMembership.owner !== true : s.human !== this.#business(s.business).human) fail('human-required');
+  }
+  // #1873 CB3: a write that changes a copy's binding or grant runs inside the gate's fence, so no
+  // launch is admitted and no call goes out while it runs; an unknown outcome keeps the fence.
+  #copyFence(business, instance, fn) {
+    return this.#copyLaunch && typeof instance === 'string' ? this.#copyLaunch.fence(business, instance, fn) : Promise.resolve().then(fn);
+  }
+  #issueCopyGrant(s, a) {
+    this.#copyOwner(s);
+    const passed = (e) => e instanceof BusError && (e.code.startsWith('credential-') || ['copy-unavailable', 'human-required',
+      'definition-holds-credential', 'definition-scan-unreadable'].includes(e.code));
+    return this.#copyFence(s.business, a.agent, () => this.#copyGrant(s.business, a, { actor: s.human, owner: true, recheck: () => this.#copyOwner(s) }))
+      .then((result) => {
+        this.#secretCheck(result);
+        if (JSON.stringify(result).includes(a.token)) fail('credential-leak');
+        return result;
+      }, (e) => {
+        if (passed(e)) throw e;
+        if (['revision-conflict', 'decision-stale'].includes(e?.code) || e?.code?.startsWith('organization-')) fail(e.code);
+        if (e?.name === 'BusinessError') fail('invalid-request');
+        throw new BusError('outcome-unknown');
+      });
+  }
   async #autonomyConsole(s,verb,a) {
     if(verb==='autonomy.get.console') {
       keys(a,[]);
@@ -6607,7 +6703,7 @@ export class Broker {
     if(!this.#hires)fail('not-configured');
     try {
       if(p.op==='fire' && p.level!=='org')await this.#stopCopyApproved(s,p);
-      const result=p.op==='fire' && p.level==='org' ? await this.#fireApproved(s,p) : await this.#hires.apply(s.business,d.id,{...caller,digest:p.digest,adjust:a.adjust});
+      const result=p.op==='fire' && p.level==='org' ? await this.#fireApproved(s,p) : await this.#copyFence(s.business,p.binding?.instance,()=>this.#hires.apply(s.business,d.id,{...caller,digest:p.digest,adjust:a.adjust}));
       if(p.op==='fire' && p.level!=='org')this.#store.transaction(()=>this.#event(s,'action.allowed',{action:'fire.done',decision:d.id},p.level==='project'?`${p.name}.${p.project}`:p.name));
       this.#store.transaction(()=>this.#event(s,'action.allowed',{operation:result.done===false?'hire.started':'hire.apply',decision:d.id,transaction:result.transaction??null},d.id));
       return {...result,id:d.id,op:'resolved',choice:a.choice,transaction:result.transaction??null};

packages/bus/src/copy-grant.mjs

@@ -0,0 +1,233 @@
+// #1873 CB2 (design section 5 steps 4 to 6): credentials.issue for an agent copy's bound service.
+// Gitea is the only service with a verifier in this slice. A copy token is accepted only after the
+// Gitea server it belongs to proves the whole grant live: the token's scopes, the account it belongs
+// to (the copy's own dedicated account, never an administrator or another copy's or agent's), every
+// repository that account can reach and the token's expiry, against the owner-approved binding. A
+// Vikunja binding refuses credential-scope-unverified: that is the shipped behaviour.
+//
+// Order (no lock is held across the remote work):
+//   1. checks that need nothing written: owner, service, date, token form, definition scan, the
+//      record and the boot snapshot, the bound projects' remotes and the approved scopes;
+//   2. stage: the writer deactivates the record (pending, the service's grant fields gone), then the
+//      token goes to the copy's slot in the self-only store;
+//   3. the slot is read back by the identity the stage wrote, and Gitea is asked;
+//   4. commit: the writer rechecks registry incarnation, document revision, binding generation,
+//      copyId, decision and definition pin under its locks; its beforeWrite reads the slot back by
+//      identity again and runs the caller's session recheck. Only then do the grant metadata and the
+//      receipt land.
+// Any refusal after the stage removes the slot it wrote and leaves the record pending. A lost reply
+// or a crash leaves the record pending too; nothing resolves a pending record, and recovery is a
+// new verified issue. A token a crash left staged goes at the next start (sweepCopySlots). Nothing here logs, and no result, receipt or refusal holds the token, the
+// slot's path, a request or anything derived from the token.
+import { lstatSync, readdirSync, unlinkSync } from 'node:fs';
+import { join } from 'node:path';
+import { BusError } from './broker.mjs';
+import { Credentials, assertNotHeld, day, privateDir } from './credentials.mjs';
+import { send, versionAtLeast, REPO_PAGE, REPO_PAGES } from './gitea-grant.mjs';
+import { scanOrganizations } from './definition-scan.mjs';
+import { parseGiteaUrl, GITEA_SCOPE_CATEGORIES, ID_PATTERN, SERVICES } from '../../organization/src/vocabulary.mjs';
+import { copyBotLogin, scopesWithin } from '../../organization/src/copy-bindings.mjs';
+
+const deny = (code, reason) => {
+  throw new BusError(code, reason);
+};
+const unverified = (reason) => deny('credential-scope-unverified', reason);
+const DAY_MS = 86400000;
+// A copy credential's rotation date is after today and at most this many days ahead.
+export const MAX_ROTATE_DAYS = 366;
+const object = (x) => x !== null && typeof x === 'object' && !Array.isArray(x);
+const positive = (n) => Number.isSafeInteger(n) && n > 0;
+const lower = (s) => (typeof s === 'string' ? s.toLowerCase() : null);
+
+// The scopes a Gitea token reports, as {category: level}. Gitea writes write:X as implying read:X and
+// may list both; the higher level wins. "all", any admin category, a category Gitea added that this
+// bus doesn't know, or anything that doesn't parse returns null: such a token is broader than any
+// binding can approve.
+export function tokenLevels(scopes) {
+  if (!Array.isArray(scopes) || scopes.length === 0) return null;
+  const out = {};
+  for (const scope of scopes) {
+    const m = typeof scope === 'string' ? /^(read|write):([a-z]+)$/.exec(scope) : null;
+    if (!m || !GITEA_SCOPE_CATEGORIES.includes(m[2])) return null;
+    if (out[m[2]] !== 'write') out[m[2]] = m[1];
+  }
+  return out;
+}
+const asList = (levels) => Object.entries(levels).map(([c, l]) => `${l}:${c}`).sort();
+
+// The approved Gitea repositories of a copy's binding: one https origin, lower-cased "owner/repo"
+// names, from each bound project's remote. A project with no Gitea remote, two remotes that disagree
+// or two servers cannot be proved.
+export function boundRepositories(doc, projects) {
+  let origin = null;
+  const repos = new Set();
+  for (const project of projects ?? []) {
+    const entry = doc.projects?.[project];
+    if (!object(entry)) unverified('remote');
+    const remotes = [entry.remote, entry.git?.mode === 'remote' ? entry.git.remote : undefined].filter((r) => r !== undefined);
+    if (remotes.length === 0 || remotes.some((r) => r !== remotes[0])) unverified('remote');
+    const parsed = parseGiteaUrl(remotes[0], { repo: true });
+    if (!parsed.url) unverified('remote');
+    if (origin !== null && parsed.url.origin !== origin) unverified('remote');
+    origin = parsed.url.origin;
+    repos.add(`${parsed.owner}/${parsed.repo}`.toLowerCase());
+  }
+  if (origin === null) unverified('remote');
+  return { origin, repos };
+}
+
+// Live introspection of one Gitea token against an approved binding. Returns { userId, tokenId,
+// login } or throws the refusal. `approved` is the binding's Gitea scopes; `repos` the lower-cased
+// names it may reach; `login` the account this copy's grant must belong to; `rotateBy` the date the
+// owner gave. Every call is GET with the token; a missing or ambiguous answer is unverified.
+export async function verifyGiteaToken({ transport = send, url, ca, timeoutMs, token, approved, repos, login, rotateBy }) {
+  const call = (path) => transport({ url, method: 'GET', path, auth: { token }, ca, timeoutMs });
+  const version = await call('/api/v1/version');
+  if (version.status !== 200 || !object(version.json) || !versionAtLeast(version.json.version)) unverified('version');
+  const info = await call('/api/v1/token');
+  if (info.status === 401 || info.status === 403 || info.status === 404) unverified('token');
+  if (info.status !== 200 || !object(info.json) || !positive(info.json.id) || !object(info.json.user) || !positive(info.json.user.id)
+    || typeof info.json.user.login !== 'string') unverified('token');
+  if (lower(info.json.user.login) !== lower(login)) deny('credential-identity-refused', login);
+  const levels = tokenLevels(info.json.scopes);
+  if (!levels || !scopesWithin('gitea', asList(levels), approved)) deny('credential-scope-exceeded');
+  if (!levels.user) unverified('scopes');
+  // An expiry Gitea reports must not come before the owner's rotation date ends.
+  if (info.json.expires_at !== undefined && info.json.expires_at !== null) {
+    const at = typeof info.json.expires_at === 'string' ? Date.parse(info.json.expires_at) : NaN;
+    if (Number.isNaN(at)) unverified('token');
+    if (at < Date.parse(rotateBy + 'T00:00:00Z') + DAY_MS) deny('credential-date');
+  }
+  const user = await call('/api/v1/user');
+  if (user.status !== 200 || !object(user.json) || typeof user.json.is_admin !== 'boolean') unverified('user');
+  if (user.json.id !== info.json.user.id || lower(user.json.login) !== lower(login) || user.json.is_admin !== false)
+    deny('credential-identity-refused', login);
+  // Every repository the account can reach: owned, collaborator and team access. One unrelated
+  // repository, an admin permission, or push where the binding approved read refuses. Push is the
+  // account's right, so it is held to what the binding approved, not to the token's own level.
+  const write = tokenLevels(approved)?.repository === 'write';
+  const seen = new Map();
+  let total = null;
+  for (let page = 1; ; page++) {
+    if (page > REPO_PAGES) unverified('repositories');
+    const r = await call(`/api/v1/user/repos?limit=${REPO_PAGE}&page=${page}`);
+    if (r.status !== 200 || !Array.isArray(r.json) || r.total === null || (total !== null && r.total !== total)) unverified('repositories');
+    total = r.total;
+    if (total > REPO_PAGE * REPO_PAGES) unverified('repositories');
+    for (const repo of r.json) {
+      if (!object(repo) || typeof repo.full_name !== 'string' || !object(repo.permissions)) unverified('repositories');
+      const name = repo.full_name.toLowerCase();
+      if (!repos.has(name)) deny('credential-scope-exceeded');
+      const p = repo.permissions;
+      if (p.admin !== false || typeof p.push !== 'boolean' || p.pull !== true || (p.push && !write)) deny('credential-scope-exceeded');
+      seen.set(name, true);
+    }
+    if (seen.size >= total || r.json.length === 0) break;
+  }
+  if (seen.size !== total) unverified('repositories');
+  for (const name of repos) if (!seen.has(name)) unverified('repositories');
+  // An organization scope reaches organizations' own settings: the account must belong to none.
+  if (levels.organization) {
+    const orgs = await call(`/api/v1/user/orgs?limit=${REPO_PAGE}&page=1`);
+    if (orgs.status !== 200 || !Array.isArray(orgs.json)) unverified('organizations');
+    if (orgs.json.length) deny('credential-scope-exceeded');
+  }
+  return { userId: info.json.user.id, tokenId: info.json.id, login };
+}
+
+// The issue for one copy's service. `copies` is the bus's boot snapshot ({ org, copies,
+// definitions }); `writer` the organization writer; `credentials` the bus's store. `hooks` are the
+// tests' crash points (afterStage, afterRemote, beforeCommit), never set at runtime.
+export function copyGrant({ credentials, writer, copies = null, organizations = null, transport = send, ca = undefined, timeoutMs = undefined, now = () => new Date(), hooks = {} }) {
+  return async (business, args, { actor, owner = false, recheck = () => {} } = {}) => {
+    const { agent: instance, service, token, date } = args;
+    if (owner !== true || actor === 'tester') deny('human-required');
+    if (service === 'vikunja') unverified('service');
+    if (service !== 'gitea') deny('credential-unknown');
+    const today = now().toISOString().slice(0, 10);
+    if (!day(date) || date <= today || Date.parse(date) - Date.parse(today) > MAX_ROTATE_DAYS * DAY_MS) deny('credential-date');
+    const value = Credentials.checkFormat(service, token);
+    const { document: doc, revision } = writer.read(business);
+    scanOrganizations({ organizations: organizations?.() ?? [business], own: { id: business, document: doc }, readRaw: (b) => writer.readRaw(b),
+      boot: copies?.definitions ? { org: copies.org, definitions: copies.definitions } : null }, (v) => assertNotHeld(v, [value]));
+    const record = doc.copyBindings?.[instance];
+    if (!object(record) || record.state === 'unbound' || !object(record.services?.[service])) deny('credential-unbound');
+    const copy = copies?.org === business && Object.hasOwn(copies.copies ?? {}, instance) ? copies.copies[instance] : null;
+    if (!copy || copy.state === 'refused' || Object.hasOwn(doc.roles ?? {}, instance)) deny('copy-unavailable');
+    if (copy.level !== record.source?.level || copy.name !== record.source?.name || (copy.project ?? null) !== (record.source?.project ?? null)
+      || copy.definition !== record.definition?.ref) deny('credential-binding-changed');
+    const approved = record.services[service];
+    if (!Array.isArray(approved.scopes) || !approved.scopes.some((s) => /^(read|write):user$/.test(s))) unverified('scopes');
+    const { origin, repos } = boundRepositories(doc, approved.resources?.projects);
+    const login = copyBotLogin(record.orgIncarnation, record.copyId, service);
+    if (!login) deny('credential-binding-changed');
+    const op = { instance, service, copyId: record.copyId, generation: record.generation, decision: record.decision, incarnation: record.orgIncarnation };
+    const definitions = copies?.org === business ? copies.definitions ?? {} : {};
+    const staged = writer.stageCopyGrant(business, op, { revision, actor, owner, definitions });
+    const slot = business + '/' + instance;
+    let identity = null;
+    try {
+      identity = credentials.stageCopy(slot, service, value.token);
+      await hooks.afterStage?.();
+      // An inode number can be reused after an unlink, so the read-back must also be the staged token.
+      const read = credentials.readCopy(slot, service, identity);
+      if (read.token !== value.token) deny('credential-file');
+      const grant = await verifyGiteaToken({ transport, url: origin, ca, timeoutMs, token: read.token, approved: approved.scopes, repos, login, rotateBy: date });
+      await hooks.afterRemote?.();
+      await recheck();
+      const grantId = `gitea:${grant.userId}:${grant.tokenId}`;
+      const after = { ...op, generation: staged.generation };
+      const committed = writer.commitCopyGrant(business, after, {
+        grantId, rotateBy: date, revision: staged.revision, actor, owner, definitions,
+        beforeWrite: () => {
+          hooks.beforeCommit?.();
+          const again = credentials.readCopy(slot, service, identity);
+          if (again.token !== read.token) deny('credential-file');
+          recheck();
+        },
+      });
+      return { agent: instance, service, verb: 'issue', date, state: committed.state, account: login, generation: committed.generation };
+    } catch (e) {
+      if (identity) {
+        try {
+          credentials.unlinkCopy(slot, service, identity);
+        } catch {}
+      }
+      throw e;
+    }
+  };
+}
+
+// Security review P2: at start, before Credentials loads and before any issue can run, each staged
+// file of a copy's service whose binding holds no grant for that service goes, and so does any
+// interrupted write's temp file. An issue killed after its stage leaves the record pending and the
+// token on disk; nothing resolves a pending record and no reference loads a copy slot, so the file
+// only keeps a secret nothing will use. `documents` is [business, validated organization document]
+// for each loaded business (null when unreadable: nothing of it is touched). Only names the document
+// binds as copies are looked at, never a name its own roles hold or a slot a loaded reference names.
+// A store dir that isn't private refuses credential-file, as Credentials would. Returns
+// [{ instance, service }], never a path.
+export function sweepCopySlots(storeRoot, documents, references = {}) {
+  const removed = [];
+  if (!storeRoot || !privateDir(storeRoot, { missing: true })) return removed;
+  for (const [business, doc] of documents) {
+    if (!object(doc) || !object(doc.copyBindings) || !ID_PATTERN.test(business)) continue;
+    const dir = join(storeRoot, business);
+    if (!privateDir(dir, { missing: true })) continue;
+    for (const [copy, record] of Object.entries(doc.copyBindings)) {
+      if (!ID_PATTERN.test(copy) || Object.hasOwn(doc.roles ?? {}, copy)) continue;
+      const copyDir = join(dir, copy);
+      if (!privateDir(copyDir, { missing: true })) continue;
+      const instance = business + '/' + copy;
+      for (const name of readdirSync(copyDir)) {
+        const service = name.endsWith('.tmp') ? name.slice(0, -4) : name;
+        if (!SERVICES.includes(service) || references[instance]?.[service] !== undefined) continue;
+        if (name === service && typeof record?.services?.[service]?.grantId === 'string') continue;
+        if (lstatSync(join(copyDir, name)).isDirectory()) continue;
+        unlinkSync(join(copyDir, name));
+        removed.push({ instance, service });
+      }
+    }
+  }
+  return removed;
+}

packages/bus/src/copy-launch.mjs

@@ -0,0 +1,320 @@
+// #1873 CB3: launch admission for an agent copy's bound service, and the one checked call a copy
+// session makes with it (design docs/plans/2026-11-11_copy-credential-binding-design.md section 5
+// steps 7 and 8). Gitea is the only service with a verifier.
+//
+// Boot: each copy the boot left unbound whose record is bound with every service granted is
+// re-resolved (role, definition pin, admitted projects, incarnation) and its slot's token is proved
+// live at the service again. Only a copy that passes all of it is materialized (promoteCopies). A
+// binding approved after boot is never launched: it answers restart-required until the next boot.
+//
+// Every launch (prepare, final admission and bindLaunch) recomputes the launch authority: a digest
+// of the organization, copy, definition pin, copyId, incarnation, binding generation, each grant's
+// id and generation, the services and projects the copy reaches now, and their repositories at the
+// one origin the boot proved the token at. Every check reads the registry entry again: an
+// organization no longer active, or with another incarnation, admits and sends nothing. Prepare
+// proves the slot live again; the digest before and after must agree. The
+// session keeps the digest bindLaunch admitted, and each call recomputes it before and after the
+// request: a revoke, a re-issue, a role change or a project change in between denies the call.
+//
+// A revoke of a copy's binding runs inside fence(): while one is in flight the copy admits nothing
+// and a call refuses credential-revoking. A revoke whose outcome is unknown keeps the fence until
+// the next boot. The token is never held: each call reads the slot by the identity the boot proved
+// and checks it against a keyed MAC of the token the boot proved. Nothing here logs, and no result
+// or refusal holds the token, the slot's path or anything derived from the token.
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { BusError } from './broker.mjs';
+import { assertNotHeld } from './credentials.mjs';
+import { send } from './gitea-grant.mjs';
+import { boundRepositories, tokenLevels, verifyGiteaToken } from './copy-grant.mjs';
+import { readOrgEntrySync } from '../../organization/src/org-registry.mjs';
+import { allGranted, copyBotLogin, definitionPin, resolveCopyBinding } from '../../organization/src/copy-bindings.mjs';
+import { COPY_BINDABLE } from '../../organization/src/agent-copies.mjs';
+import { checkDefinitions, readTemplate } from '../../organization/src/definitions.mjs';
+import { loadRole } from '../../organization/src/role.mjs';
+import { resolveAgentLevels } from '../../organization/src/agent-levels.mjs';
+import { canonicalJson, sha256 } from '../../organization/src/util.mjs';
+
+const deny = (code) => {
+  throw new BusError(code);
+};
+const object = (x) => x !== null && typeof x === 'object' && !Array.isArray(x);
+// The repository API a copy session may call: /api/v1/repos/<owner>/<repo>[/<rest>], ASCII names,
+// no dot segment, no encoded separator, no query beyond plain pairs.
+const REPO_PATH = /^\/api\/v1\/repos\/([A-Za-z0-9_.-]{1,100})\/([A-Za-z0-9_.-]{1,100})((?:\/[A-Za-z0-9_.-]{1,200}){0,8})(\?[A-Za-z0-9_=&.-]{0,200})?$/;
+const READ = ['GET', 'HEAD'];
+const WRITE = ['POST', 'PUT', 'PATCH', 'DELETE'];
+// Codes a boot check keeps for the copy; anything else (a thrown bug, a transport surprise) is
+// credential-unavailable.
+const KEPT = /^(credential-|copy-)/;
+
+// The launcher waits on its host channel for prepare, and the host stops on a reply later than its
+// request timeout (10 s); the boot runs inside the host's boot timeout (30 s). Each proof is held to
+// a budget well under those: a service slower than that answers no answer, so it is not proved.
+export const PREPARE_BUDGET_MS = 8000;
+export const BOOT_BUDGET_MS = 20000;
+
+export function copyLaunchGate({ credentials, writer, configDir, rolesDir, snapshot, transport = send, ca = undefined, timeoutMs = undefined, now = () => new Date(),
+  prepareMs = PREPARE_BUDGET_MS, bootMs = BOOT_BUDGET_MS }) {
+  const org = snapshot?.org ?? null;
+  const key = randomBytes(32);
+  const mac = (token) => createHmac('sha256', key).update(token).digest();
+  const verified = new Map();
+  const failed = new Map();
+  const fences = new Map();
+  const today = () => now().toISOString().slice(0, 10);
+  // The organization's registry incarnation as the registry stands now, or null when the entry is
+  // gone, carries none, or is not active (reserved, deleting, archived). Read on every check, never
+  // cached: an organization archived while the bus runs admits and sends nothing. An unreadable or
+  // unsafe registry refuses credential-unavailable.
+  const liveIncarnation = () => {
+    let entry;
+    try {
+      entry = readOrgEntrySync(configDir, org);
+    } catch {
+      return deny('credential-unavailable');
+    }
+    return entry?.state === 'active' ? entry.incarnation : null;
+  };
+  // The organization file is still the revision the launch resolved its bundle from (#1873 A3).
+  const sameRevision = (business, revision) => {
+    if (revision === undefined) return;
+    let now;
+    try {
+      now = writer.read(business);
+    } catch {
+      deny('organization-unreadable');
+    }
+    if (typeof revision !== 'string' || now?.revision !== revision) deny('organization-changed');
+  };
+  const read = (business) => {
+    try {
+      return writer.read(business).document;
+    } catch {
+      return deny('credential-unavailable');
+    }
+  };
+  // The copy, its pin, role and admitted projects as the file stands now (hire-decisions.mjs
+  // bindingFacts, without the refusals that function makes for a proposal).
+  const facts = (business, instance, doc) => {
+    const copy = snapshot?.org === business && Object.hasOwn(snapshot.copies ?? {}, instance) ? snapshot.copies[instance] : null;
+    if (!copy || copy.state === 'refused' || Object.hasOwn(doc.roles ?? {}, instance)) deny('copy-unavailable');
+    const definitions = { ...(snapshot.definitions ?? {}), ...(doc.definitions ?? {}) };
+    const pin = definitionPin(copy.definition, { definitions, rolesDir, readTemplate });
+    let role = null;
+    try {
+      role = copy.definition.startsWith('org:') ? checkDefinitions(definitions, 'copy definitions')[copy.definition] : loadRole(rolesDir, copy.definition);
+    } catch {
+      role = null;
+    }
+    if (!pin || !role) deny('credential-role-changed');
+    const code = Object.keys(doc.projects ?? {}).filter((p) => doc.projects[p]?.kind !== 'library');
+    let projects = code;
+    if (copy.level === 'root') {
+      let levels;
+      try {
+        levels = resolveAgentLevels({ orgId: business, doc: { ...doc, definitions }, root: { agents: snapshot.rootAgents ?? {} }, rolesDir });
+      } catch {
+        deny('copy-unavailable');
+      }
+      projects = code.filter((p) => levels.unions[p]?.ok && levels.unions[p].agents.some((a) => a.level === 'root' && a.name === copy.name));
+    }
+    return { copy, pin, role, projects };
+  };
+  const resolve = (business, instance, doc, record, inc) => {
+    const f = facts(business, instance, doc);
+    const res = resolveCopyBinding({ orgId: business, incarnation: inc, snapshot, instance, record, pin: f.pin, role: f.role, projects: f.projects });
+    if (!res.ok) deny(res.code);
+    if (Object.keys(res.services).some((s) => !COPY_BINDABLE.includes(s))) deny('credential-scope-unverified');
+    return { ...f, res };
+  };
+  const grantsOf = (record) => Object.fromEntries(Object.keys(record.services).sort()
+    .map((s) => [s, { grantId: record.services[s].grantId, grantGeneration: record.services[s].grantGeneration }]));
+  const slot = (instance) => org + '/' + instance;
+  // Live proof of one slot token against the record: the service's own answer, the grant id the
+  // verifier committed, and a rotation date not yet passed.
+  // The transport held to a deadline: each call gets what is left, and none starts after it.
+  const within = (deadline) => (req) => {
+    const left = deadline - Date.now();
+    if (left <= 0) return Promise.resolve({ status: 0, json: null, total: null });
+    return transport({ ...req, timeoutMs: Math.min(req.timeoutMs ?? left, left) });
+  };
+  const prove = async (doc, record, token, inc, deadline) => {
+    const approved = record.services.gitea;
+    if (approved.rotateBy < today()) deny('credential-expired');
+    const { origin, repos } = boundRepositories(doc, approved.resources.projects);
+    const login = copyBotLogin(inc, record.copyId, 'gitea');
+    if (!login) deny('credential-revoked');
+    const grant = await verifyGiteaToken({ transport: within(deadline), url: origin, ca, timeoutMs, token, approved: approved.scopes, repos, login, rotateBy: approved.rotateBy });
+    if (`gitea:${grant.userId}:${grant.tokenId}` !== approved.grantId) deny('credential-revoked');
+  };
+
+  async function boot(business) {
+    if (business !== org) return;
+    const deadline = Date.now() + bootMs;
+    // An inactive or unreadable registry entry leaves null: the resolver refuses every copy with its
+    // own code.
+    let incarnation = null;
+    try {
+      incarnation = liveIncarnation();
+    } catch {
+      incarnation = null;
+    }
+    let doc;
+    try {
+      doc = writer.read(business).document;
+    } catch {
+      return;
+    }
+    for (const [instance, copy] of Object.entries(snapshot.copies ?? {})) {
+      if (copy.state !== 'unbound') continue;
+      const record = doc.copyBindings?.[instance];
+      if (!object(record) || record.state !== 'bound' || !allGranted(record.services)) continue;
+      try {
+        if ((copy.missing ?? []).some((s) => !COPY_BINDABLE.includes(s))) deny('credential-scope-unverified');
+        const { pin, res } = resolve(business, instance, doc, record, incarnation);
+        const identity = credentials.copyIdentity(slot(instance), 'gitea');
+        if (!identity) deny('credential-unavailable');
+        const { token } = credentials.readCopy(slot(instance), 'gitea', identity);
+        await prove(doc, record, token, incarnation, deadline);
+        // The origin the token was proved at is the only one a call goes to.
+        const { origin } = boundRepositories(doc, res.services.gitea.projects);
+        verified.set(instance, Object.freeze({
+          copyId: record.copyId, incarnation, generation: record.generation, pin, grants: grantsOf(record),
+          identity, mac: mac(token), services: Object.keys(res.services), origin,
+        }));
+      } catch (e) {
+        failed.set(instance, e instanceof BusError && KEPT.test(e.code) ? e.code : 'credential-unavailable');
+      }
+    }
+  }
+
+  // The current authority of a copy, or the refusal. `withToken` also returns the slot's token,
+  // read now by the boot's identity and checked against the boot's MAC; only call() asks for it.
+  function current(business, instance, { withToken = false } = {}) {
+    if (business !== org || typeof instance !== 'string') deny('copy-unavailable');
+    if (fences.get(instance)) deny('credential-revoking');
+    const doc = read(business);
+    const record = doc.copyBindings?.[instance];
+    const v = verified.get(instance);
+    if (!v) {
+      if (object(record) && record.state === 'bound' && allGranted(record.services))
+        deny(failed.get(instance) ?? 'restart-required');
+      // Not bound: the resolver's own code (credential-unbound, a role change, a refused copy). This
+      // branch always refuses and holds no credential, so an unreadable registry is no incarnation.
+      let known = null;
+      try { known = liveIncarnation(); } catch { known = null; }
+      resolve(business, instance, doc, record, known);
+      deny('restart-required');
+    }
+    // A verified copy holds only while its organization is active under the incarnation boot proved.
+    const incarnation = liveIncarnation();
+    if (!object(record) || record.state !== 'bound' || record.copyId !== v.copyId || record.orgIncarnation !== v.incarnation
+      || incarnation !== v.incarnation) deny('credential-revoked');
+    if (record.generation !== v.generation || canonicalJson(grantsOf(record)) !== canonicalJson(v.grants)) deny('restart-required');
+    const { res } = resolve(business, instance, doc, record, incarnation);
+    if (canonicalJson(Object.keys(res.services)) !== canonicalJson(v.services)) deny('restart-required');
+    // A project's remote moved to another server is a new binding: the token never goes there.
+    const reach = boundRepositories(doc, res.services.gitea.projects);
+    if (reach.origin !== v.origin) deny('restart-required');
+    if (record.services.gitea.rotateBy < today()) deny('credential-expired');
+    const identity = credentials.copyIdentity(slot(instance), 'gitea');
+    if (!identity || identity.dev !== v.identity.dev || identity.ino !== v.identity.ino) deny('credential-unavailable');
+    let token;
+    try {
+      token = credentials.readCopy(slot(instance), 'gitea', v.identity).token;
+    } catch {
+      deny('credential-unavailable');
+    }
+    if (!timingSafeEqual(mac(token), v.mac)) deny('credential-unavailable');
+    const authority = sha256(canonicalJson({
+      org, instance, pin: v.pin, copyId: v.copyId, incarnation: v.incarnation, generation: v.generation, grants: v.grants, services: res.services,
+      origin: v.origin, repos: [...reach.repos].sort(),
+    }));
+    return { authority, services: v.services, record, res, reach, ...(withToken ? { doc, token } : {}) };
+  }
+
+  const gate = {
+    // { instance: [services] } of the copies the boot proved, for promoteCopies.
+    bound: () => Object.fromEntries([...verified].map(([instance, v]) => [instance, [...v.services]])),
+    verified: (business, instance) => business === org && verified.has(instance),
+    boot,
+    // Sync: the launch authority now, or the refusal.
+    authority(business, instance) {
+      const { authority, services } = current(business, instance);
+      return { authority, services: [...services] };
+    },
+    // The launcher's prepare: the authority, a live proof of the slot at the service, a fresh
+    // registry read, and the authority again; any change in between refuses.
+    // With `revision` (the launcher's, from the bundle it resolved) the organization file must still
+    // be that revision before and after the proof.
+    async prepare(business, instance, revision = undefined) {
+      sameRevision(business, revision);
+      const before = current(business, instance, { withToken: true });
+      await prove(before.doc, before.record, before.token, before.record.orgIncarnation, Date.now() + prepareMs);
+      const after = current(business, instance);
+      if (after.authority !== before.authority) deny('copy-authority-changed');
+      sameRevision(business, revision);
+      return { authority: after.authority, services: [...after.services] };
+    },
+    // Final admission and bindLaunch: the digest the launcher carries must still be the authority,
+    // and with `revision` the organization file still the one the launch resolved.
+    admit(business, instance, digest, revision = undefined) {
+      if (typeof digest !== 'string') deny('copy-authority-changed');
+      if (current(business, instance).authority !== digest) deny('copy-authority-changed');
+      sameRevision(business, revision);
+    },
+    revoking: (business, instance) => business === org && Boolean(fences.get(instance)),
+    // A write that can take a copy's grant away runs inside the fence. A definite answer (success,
+    // or a refusal the writer gave before any change) lifts it; an unknown outcome keeps it.
+    async fence(business, instance, fn) {
+      if (business !== org || typeof instance !== 'string') return fn();
+      fences.set(instance, (fences.get(instance) ?? 0) + 1);
+      let release = true;
+      try {
+        return await fn();
+      } catch (e) {
+        // A refusal code (lowercase, the bus's and the organization writer's) is a definite answer
+        // given before any change. outcome-unknown, a system error (ENOSPC, EIO) or an error with no
+        // code may have changed the binding or the slot, so the fence stays.
+        if (typeof e?.code !== 'string' || !/^[a-z][a-z0-9-]{1,80}$/.test(e.code) || e.code.startsWith('outcome-unknown')) release = false;
+        throw e;
+      } finally {
+        if (release) {
+          const n = fences.get(instance) - 1;
+          if (n > 0) fences.set(instance, n);
+          else fences.delete(instance);
+        }
+      }
+    },
+    // One checked Gitea request for a copy session: { business, role, copyAuthority } from the
+    // session the bus bound, never from the caller's arguments. Returns { status, json }.
+    async call(session, request) {
+      if (!object(session) || !object(request)) deny('copy-request-refused');
+      const { business, role: instance, copyAuthority } = session;
+      if (typeof copyAuthority !== 'string') deny('copy-authority-changed');
+      const { service = 'gitea', method, path, body } = request;
+      if (service !== 'gitea' || typeof method !== 'string' || typeof path !== 'string' || path.length > 1024) deny('copy-request-refused');
+      const m = REPO_PATH.exec(path);
+      if (!m || [m[1], m[2], ...m[3].split('/').slice(1)].some((x) => x === '.' || x === '..')) deny('copy-request-refused');
+      const before = current(business, instance, { withToken: true });
+      if (before.authority !== copyAuthority) deny('copy-authority-changed');
+      // Gitea's own semantics, enforced here: a read needs read:repository or write:repository, a
+      // write needs write:repository. A binding with neither sends no repository request.
+      const level = tokenLevels(before.res.services.gitea.scopes)?.repository;
+      if (READ.includes(method) ? !['read', 'write'].includes(level) : !(WRITE.includes(method) && level === 'write')) deny('copy-request-refused');
+      if (READ.includes(method) && body !== undefined) deny('copy-request-refused');
+      const { origin, repos } = before.reach;
+      if (!repos.has(`${m[1]}/${m[2]}`.toLowerCase())) deny('copy-request-refused');
+      const r = await transport({ url: origin, method, path, auth: { token: before.token }, ...(body === undefined ? {} : { body }), ca, timeoutMs });
+      // The answer is the session's only while the authority still holds.
+      const after = current(business, instance);
+      if (after.authority !== copyAuthority) deny('credential-revoked');
+      if (!object(r) || !Number.isSafeInteger(r.status) || r.status === 0) deny('credential-unavailable');
+      if (r.status >= 300 && r.status < 400) deny('copy-redirect-refused');
+      const out = { status: r.status, json: r.json ?? null };
+      assertNotHeld(out, [{ token: before.token }]);
+      return out;
+    },
+  };
+  return Object.freeze(gate);
+}

packages/bus/src/credentials.mjs

@@ -6,7 +6,7 @@ import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { createHash } from 'node:crypto';
 import { isDeepStrictEqual } from 'node:util';
 import { BusError } from './broker.mjs';
-import { credentialKind, isHostKind, ID_PATTERN } from '../../organization/src/vocabulary.mjs';
+import { credentialKind, isHostKind, ID_PATTERN, SERVICES } from '../../organization/src/vocabulary.mjs';
 const deny = (code) => {
   throw new BusError(code);
 };
@@ -90,7 +90,7 @@ export function parseHostKey(text) {
 // Credentials.assertClean's test: credential-leak when the value's JSON text holds an entry's token
 // or one of its retiring model keys. org-defscan (#1873): issue's check runs it on the value it is
 // about to hold.
-function assertNotHeld(value, entries) {
+export function assertNotHeld(value, entries) {
   let encoded;
   try {
     encoded = JSON.stringify(value);
@@ -479,6 +479,18 @@ export class Credentials {
     const value = Credentials.#format(service, token);
     check((v) => assertNotHeld(v, [value]));
     this.#invalidateModelProof(instance, service);
+    this.#writeSlot(instance, service, service === 'model' ? JSON.stringify(value.model) + '\n' : value.key ? value.token : value.token + '\n');
+    const file = this.#storePath(instance, service);
+    commit();
+    this.#refs.set(instance + ':' + service, { ref: { service, store: true, file, [service === 'vikunja' ? 'expires' : 'rotateBy']: date }, date });
+    this.#tokens.set(instance + ':' + service, { ...value, date });
+    this.#revoked.delete(instance + ':' + service);
+    this.#held.delete(instance + ':' + service);
+    return this.status().find((e) => e.instance === instance && e.service === service);
+  }
+  // The store slot write issue and stageCopy share: tmp (O_EXCL, O_NOFOLLOW, 0600), fsync, rename
+  // over the slot, fsync the dir. Returns the identity of the file it wrote.
+  #writeSlot(instance, service, text, { undo = false } = {}) {
     const file = this.#storePath(instance, service);
     const agentDir = dirname(file);
     mkdirSync(this.#storeRoot, { recursive: true, mode: 0o700 });
@@ -493,27 +505,118 @@ export class Credentials {
     } catch (e) {
       if (e.code !== 'ENOENT') deny('credential-file');
     }
-    let fd;
+    // A write that fails leaves no token behind: the temp file this call made goes, and with `undo`
+    // (stageCopy) so does the slot it renamed into place.
+    let fd, identity;
     try {
-      fd = openSync(tmp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
-      writeSync(fd, service === 'model' ? JSON.stringify(value.model) + '\n' : value.key ? value.token : value.token + '\n');
-      fsyncSync(fd);
+      try {
+        fd = openSync(tmp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+        const st = fstatSync(fd);
+        identity = { dev: st.dev, ino: st.ino };
+        writeSync(fd, text);
+        fsyncSync(fd);
+      } finally {
+        if (fd !== undefined) closeSync(fd);
+      }
+      renameSync(tmp, file);
+    } catch (e) {
+      if (identity) {
+        try {
+          const st = lstatSync(tmp);
+          if (st.isFile() && st.dev === identity.dev && st.ino === identity.ino) unlinkSync(tmp);
+        } catch {}
+      }
+      throw e;
+    }
+    try {
+      const dirFd = openSync(agentDir, constants.O_RDONLY);
+      try {
+        fsyncSync(dirFd);
+      } finally {
+        closeSync(dirFd);
+      }
+    } catch (e) {
+      if (undo) {
+        try {
+          this.unlinkCopy(instance, service, identity);
+        } catch {}
+      }
+      throw e;
+    }
+    return identity;
+  }
+  // #1873 CB2 (design section 5 step 4): a copy's service slot, <store>/<business>/<copy>/<service>.
+  // The bus stages it while the copy's binding is inactive, and afterwards reads back or removes only
+  // the file with the identity (dev, ino) it wrote. Memory and references never hold a copy's token
+  // in this slice; launch admission (CB3) reads the slot. A name a loaded reference uses refuses.
+  static checkFormat(service, token) {
+    return Credentials.#format(service, token);
+  }
+  stageCopy(instance, service, token) {
+    if (this.#refs.has(instance + ':' + service) || !SERVICES.includes(service)) deny('credential-reference');
+    const value = Credentials.#format(service, token);
+    return this.#writeSlot(instance, service, value.token + '\n', { undo: true });
+  }
+  // The staged token, read back with the store's checks plus one link only and the exact identity the
+  // stage wrote: a symlink, a hard link, a replaced or a stale file refuses credential-file.
+  readCopy(instance, service, identity) {
+    const file = this.#storePath(instance, service);
+    privateDir(this.#storeRoot);
+    privateDir(dirname(dirname(file)));
+    privateDir(dirname(file));
+    const same = (st) => st.dev === identity?.dev && st.ino === identity?.ino;
+    let original;
+    try {
+      original = lstatSync(file);
+    } catch {
+      deny('credential-file');
+    }
+    if (original.isSymbolicLink() || !original.isFile() || original.nlink !== 1 || !same(original)) deny('credential-file');
+    let fd, text;
+    try {
+      fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+      const st = fstatSync(fd);
+      if (!st.isFile() || st.uid !== process.getuid() || (st.mode & 0o777) !== 0o600 || st.size > 16384 || st.nlink !== 1 || !same(st))
+        deny('credential-file');
+      text = readFileSync(fd, 'utf8');
+    } catch (e) {
+      if (e instanceof BusError) throw e;
+      deny('credential-file');
     } finally {
       if (fd !== undefined) closeSync(fd);
     }
-    renameSync(tmp, file);
-    const dirFd = openSync(agentDir, constants.O_RDONLY);
+    return Credentials.#format(service, text);
+  }
+  // #1873 CB3: the identity (dev, ino) of a copy's slot as it is now, for the launch gate's boot check,
+  // or null when there is no single-link, self-owned 0600 regular file under private directories.
+  // The gate then reads the token by this identity (readCopy) and proves it at the service.
+  copyIdentity(instance, service) {
+    if (this.#refs.has(instance + ':' + service) || !SERVICES.includes(service)) return null;
     try {
-      fsyncSync(dirFd);
-    } finally {
-      closeSync(dirFd);
+      const file = this.#storePath(instance, service);
+      privateDir(this.#storeRoot);
+      privateDir(dirname(dirname(file)));
+      privateDir(dirname(file));
+      const st = lstatSync(file);
+      if (st.isSymbolicLink() || !st.isFile() || st.nlink !== 1 || st.uid !== process.getuid() || (st.mode & 0o777) !== 0o600) return null;
+      return { dev: st.dev, ino: st.ino };
+    } catch {
+      return null;
     }
-    commit();
-    this.#refs.set(instance + ':' + service, { ref: { service, store: true, file, [service === 'vikunja' ? 'expires' : 'rotateBy']: date }, date });
-    this.#tokens.set(instance + ':' + service, { ...value, date });
-    this.#revoked.delete(instance + ':' + service);
-    this.#held.delete(instance + ':' + service);
-    return this.status().find((e) => e.instance === instance && e.service === service);
+  }
+  // Removes the slot only while it is still the file the stage wrote; another file is left alone.
+  unlinkCopy(instance, service, identity) {
+    const file = this.#storePath(instance, service);
+    let st;
+    try {
+      st = lstatSync(file);
+    } catch (e) {
+      if (e.code === 'ENOENT') return false;
+      deny('credential-file');
+    }
+    if (!st.isFile() || st.dev !== identity?.dev || st.ino !== identity?.ino) return false;
+    unlinkSync(file);
+    return true;
   }
   // Row 236 (#436b section 5, settle forward): memory takes the store file as it is now, with the
   // constructor's checks, and `date` becomes the entry's date. A held entry refuses.

packages/bus/src/process.mjs

@@ -40,6 +40,7 @@ const LAUNCH_OPS = new Set([
   'sessionClearUncertain',
   'sessionClearRetire',
   'sessionClearStart',
+  'copyLaunch',
   'request.admission', 'request.launches', 'request.launchResult', 'request.release', 'request.chief', 'request.manifest',
 ]);
 function launchOp(m) {
@@ -90,7 +91,9 @@ function launchOp(m) {
   if (m.op === 'request.release') return runtime.requestRelease(m.cap, m.record);
   if (m.op === 'request.manifest') return runtime.requestManifest(m.record);
   if (m.op === 'request.chief') return runtime.requestChief(m.business);
-  if (m.op === 'request.admission') return runtime.admission({ business: m.business, project: m.project, projects: m.projects, instance: m.instance, revision: m.revision, thread: m.thread, session: m.session });
+  if (m.op === 'request.admission') return runtime.admission({ business: m.business, project: m.project, projects: m.projects, instance: m.instance, revision: m.revision, thread: m.thread, session: m.session, authority: m.authority });
+  // #1873 CB3: a copy's launch prepare: the launch authority after a live proof at the service.
+  if (m.op === 'copyLaunch') return runtime.copyLaunch({ business: m.business, instance: m.instance, revision: m.revision });
   if (m.op === 'credentialStatus') return runtime.credentialStatus(m.business, m.role);
   // #1873 T1 follow-up (org-defscan): the launcher's held-secret check of an org: definition.
   if (m.op === 'definitionScan') return runtime.definitionScan({ business: m.business, definition: m.definition, entry: m.entry });
@@ -165,7 +168,7 @@ if (!process.send) {
         await runtime.close();
         return;
       }
-      process.send({ ok: true, path: runtime.path, launches: runtime.launches, readers: runtime.readers });
+      process.send({ ok: true, path: runtime.path, launches: runtime.launches, readers: runtime.readers, copyBound: runtime.copyBound });
     } catch (e) {
       // org-defscan: a held credential in a definition says which definition and key, never the text.
       const reason = e instanceof BusError && e.code === DEFINITION_HOLDS_CREDENTIAL && typeof e.reason === 'string' ? { reason: e.reason } : {};

packages/bus/src/proxy-lock.mjs

@@ -98,16 +98,19 @@ export function createProxyLock({ stateDir, identity, waitMs = 5000 }) {
     fs.renameSync(temp, generationFile); syncDir(stateDir);
     fs.unlinkSync(fenceFile); syncDir(stateDir);
   }
-  async function clear({ restarted, read }) {
+  // `verify(previous)` (optional) re-proves a restart against the fence it would clear, inside
+  // the lock, and returns the evidence the receipt records.
+  async function clear({ restarted, read, verify }) {
     if (restarted !== true) fail('proxy-restart-required');
     return run(async () => {
       const previous = status();
+      const evidence = verify ? await verify(previous) : undefined;
       await read();
       const fd = fs.openSync(receiptFile, 'a', 0o600);
-      try { fs.writeFileSync(fd, JSON.stringify({ op: 'fence.clear', time: new Date().toISOString(), previous }) + '\n'); fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
+      try { fs.writeFileSync(fd, JSON.stringify({ op: 'fence.clear', time: new Date().toISOString(), previous, ...(evidence === undefined ? {} : { evidence }) }) + '\n'); fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
       syncDir(stateDir);
       if (previous) confirm();
-      return { cleared: Boolean(previous) };
+      return { cleared: Boolean(previous), ...(evidence === undefined ? {} : { evidence }) };
     }, { allowUncertain: true });
   }
   async function run(operation, { allowUncertain = false } = {}) {

packages/bus/src/refusals.mjs

@@ -22,6 +22,21 @@ group("organization-bindings-protected", "R1/R8: copy bindings change only throu
 group("credential-binding-changed credential-role-changed credential-definition-unpinned", "R1/R8: binding approval pinned to the current copy, definition and generation", "Read the copy's current binding and definition, then ask the chief to raise a fresh binding decision for the owner; an old approval never carries over.");
 group("credential-scope-exceeded", "R1/R8: effective access is the role intersected with the approval", "Narrow the requested scopes and projects to what the copy's role and admitted projects allow, or change the role through its own decision first.");
 group("credential-unbound", "R1/R8: launch needs an approved, verified binding", "Ask the chief to raise a binding decision for the missing service; the owner approves it. A pending binding is not usable until verification exists.");
+// #1873 CB2: a copy's service credential is accepted only after live verification at the service.
+group("credential-scope-unverified", "R1/R8: a copy credential is accepted only when the service proves its whole grant", "Gitea: approve read:user in the copy's binding (its role must declare it) so the account's repositories can be listed, give every bound project a Gitea remote on one server, and retry when the server answers. Vikunja has no verifier yet; its copy bindings stay unusable.");
+group("credential-identity-refused", "R1/R8: one dedicated service account per organization, copy and service", "Create the account the refusal names on the copy's Gitea server, not an administrator, with access to the bound projects' repositories only, and issue a token from that account. Never reuse another copy's or agent's account or token.");
+group("credential-date credential-format", "R1/R8: well-formed credentials with a future rotation date", "Supply the token on standard input alone, and a rotation date after today in YYYY-MM-DD form, no more than a year ahead for a copy credential.");
+// #1873 CB3: a copy launches only on a binding this bus verified at boot, and each use rechecks it.
+group("restart-required", "R1/R3/R8: a copy's binding is materialized only at boot, after live verification", "Ask the instance owner to restart the organization bus so it verifies the copy's newly approved or re-issued binding, then launch the copy again.");
+group("credential-revoked", "R1/R8: a revoked or replaced binding grants nothing, with no cached token", "Read the copy's binding. Ask the chief to raise a fresh binding decision for the owner, have the credential issued again, then restart the organization bus.");
+group("credential-revoking", "R1/R8: a revoke in flight blocks every new launch and call", "Wait for the revoke to finish and read its receipt. If its outcome stays unknown, ask the instance owner to restart the organization bus before launching the copy again.");
+group("credential-unavailable", "R1/R8: a copy credential is used only while the service and the stored slot prove it", "Check that the copy's Gitea server answers, then ask the owner to issue the copy's credential again and restart the organization bus. A slot changed outside the bus is never trusted.");
+group("credential-expired", "R1/R8: a copy credential stops at its rotation date", "Ask the owner to issue a fresh credential for the copy with a new rotation date, then restart the organization bus.");
+group("copy-authority-changed", "R1/R3/R8: the launch authority admitted at prepare must hold through bind and every use", "The copy's role, projects or binding changed during the launch. Read the copy's current binding and launch it again; a running session from the old authority must be stopped and relaunched.");
+group("copy-request-refused", "R1/R8: a copy calls only its bound repositories with the methods its approved scopes allow", "Call a repository of a project the copy is bound to, with GET or HEAD when the binding approved read:repository or write:repository, or a write method only when it approved write:repository. Ask the chief for a binding decision to widen it.");
+group("organization-changed organization-unreadable", "R3/R8: a launch holds to the organization file revision it resolved", "The organization file changed, or could not be read, while the launch was in progress. Launch the agent again so it resolves the file as it stands now.");
+group("copy-redirect-refused", "R1/R8: a copy credential goes only to the approved Gitea origin", "The Gitea server answered with a redirect. Fix the bound project's remote to name the server's final address, then ask the owner to issue the credential again; redirects are never followed.");
+group("project-repo-bound", "R1/R8: a binding grants the repository its projects name when the owner approved it", "Revoke the copy binding that names the project first: the chief raises an unbind decision and the owner approves it. Then set the project repository, then ask the chief to raise a new binding decision for the owner.");
 group("copy-unavailable copy-refused", "R3/R8: one active, unambiguous copy identity", "Read the organization's copies. Ask the owner to resolve the definition collision or restore the copy's source before raising a binding decision.");
 group("copy-stale", "R3: root policy changed since this bus booted", "Ask the owner to restart the organization bus to load the approved root policy, then launch a fresh copy.");
 group("root-policy-unreadable", "R3: root policy evidence must be readable", "Ask the owner to inspect root agent receipt metadata and restart the bus after repairing the read failure.");
@@ -57,6 +72,18 @@ group(
   "R1/R3: owner-managed model and provider configuration",
   "Ask the owner to inspect the provider configuration through its supported controls; never put keys or callback contents in messages."
 );
+// #1873: proxy setup from the Console page and `mosaic proxy`. Each code has one owner next step.
+group("proxy-install-missing proxy-fetch-url proxy-fetch-failed proxy-fetch-redirect", "R1: pinned model proxy release", "Fetch the pinned release from the Proxy page or with mosaic proxy fetch. A download or redirect failure is retried as it stands; the release URL is fixed by the pin.");
+group("proxy-install-invalid proxy-fetch-hash proxy-fetch-archive proxy-fetch-existing", "R1: pinned release hashes must match", "A file does not match the pinned hash. Do not run it. Ask the owner to remove the pinned release directory named in the README and fetch again.");
+group("proxy-already-initialized proxy-port-in-use proxy-management-key-invalid", "R1/R4: proxy init is exclusive creation", "Init never rewrites proxy.json. Read the Proxy page status; pick a free port, or keep the existing setup and continue from the status's next step.");
+group("proxy-init-busy proxy-init-lock-held proxy-init-lock-absent", "R4: init lock clears only when provably stale", "Wait for a running init to finish. A stale lock clears from the Proxy page or with mosaic proxy init-lock clear only when the bus is stopped and no proxy.json, key file or proxy dir exists; the refusal lists what is still there.");
+group("proxy-key-transport", "R1/R6: a pasted key travels only over loopback or HTTPS", "Use the generated key, which never leaves the host, or open the Console over HTTPS or on this machine to paste one.");
+group("proxy-restart-required proxy-restart-unconfirmed proxy-lock-uncertain", "R4/R6: fence clears only after a confirmed proxy restart", "Restart the proxy from the Proxy page or with mosaic proxy fence clear --restart, so the new process is confirmed on the proxy port, then clear the fence. A fence file with no readable time cannot be proven against: restart the proxy service yourself and run mosaic proxy fence clear --proxy-restarted.");
+group("proxy-admin-busy", "R4: one proxy setup action at a time", "Wait for the running fetch, init or unit action to finish (the Proxy page status shows it), then retry.");
+group("proxy-key-mismatch", "R1: a pasted management key is confirmed before init", "Type the same key in both fields, or leave them empty to have the bus generate the key.");
+group("proxy-lock-busy proxy-lock-invalid", "R4: one proxy key write at a time", "Wait for the running proxy write to finish and retry. An invalid lock file needs the owner to inspect the proxy state directory.");
+group("proxy-not-configured proxy-unit-usage proxy-unit-exists proxy-unit-dropin proxy-unit-copy proxy-unit-path proxy-unit-missing proxy-unit-unhealthy proxy-unit-failed", "R1/R4: proxy user unit is explicit creation", "Initialize the proxy first, then install the unit from the Proxy page or with mosaic proxy unit install. An existing unit or drop-in is never replaced; remove it by hand. An unhealthy unit: read its journal by unit name and restart it.");
+group("proxy-client-invalid proxy-client-refused proxy-client-response", "R1: proxy management answers", "Check the proxy unit is running and its port answers on the Proxy page, then retry. Upstream bodies are never shown.");
 group(
   "block-recipient block-reply-required block-sender message-recipient-refused message-sender-refused tester-reply-required tester-thread-human user-reply-required user-thread-human",
   "Role messaging: permitted sender, recipient and reply context",

packages/bus/src/runtime.mjs

@@ -35,6 +35,7 @@ import { createModelCatalogue } from './model-catalogue.mjs';
 import { sha256 } from '../../model-proxy/src/common.mjs';
 import { initializeProxy } from '../../model-proxy/src/settings.mjs';
 import { createProxyLock } from './proxy-lock.mjs';
+import { verifyRestart } from '../../model-proxy/src/admin.mjs';
 import { ModelKeys, modelOrganization, stopModelRuns, MODEL_STOP_TIMEOUT_MS } from './model-keys.mjs';
 import { instanceSettings } from '../../organization/src/instance-settings.mjs';
 import { organizationWriter, OrganizationError, setReplyLimits } from '../../organization/src/organization.mjs';
@@ -44,7 +45,9 @@ import { DEFINITION_HOLDS_CREDENTIAL, heldPath, scanDefinitions } from './defini
 import { ROLE_RIGHTS } from '../../organization/src/org-rights.mjs';
 import { getProjectRemote } from '../../organization/src/project-remotes.mjs';
 import { credentialVerbs } from './credential-verbs.mjs';
-import { loadWithCopies } from '../../organization/src/agent-copies.mjs';
+import { loadWithCopies, promoteCopies } from '../../organization/src/agent-copies.mjs';
+import { copyGrant, sweepCopySlots } from './copy-grant.mjs';
+import { copyLaunchGate } from './copy-launch.mjs';
 import { loadRole } from '../../organization/src/role.mjs';
 import { resolveInstance } from '../../organization/src/resolve.mjs';
 import { canonicalJson } from '../../organization/src/util.mjs';
@@ -318,6 +321,9 @@ export async function startBroker({
   // #1873 A3: the boot's root and project agent copies (cli config.mjs copiesAtBoot), plain data. Every
   // reload of the organization file below re-applies this snapshot, never the root file.
   copies = null,
+  // #1873 CB3: the tests' Gitea transport and CA for the copy launch gate and copyGrant, { send, ca }.
+  // In-process only, like librarySync; production passes none.
+  copyTransport = null,
 }) {
   if (copies !== null && (typeof copies !== 'object' || Array.isArray(copies) || typeof copies.org !== 'string'
       || !Object.hasOwn(businesses ?? {}, copies.org) || copies.copies === null || typeof copies.copies !== 'object' || Array.isArray(copies.copies)))
@@ -334,10 +340,10 @@ export async function startBroker({
       || (Object.hasOwn(librarySync, 'intervalMs') && !(Number.isSafeInteger(librarySync.intervalMs) && librarySync.intervalMs > 0))
       || (Object.hasOwn(librarySync, 'configDir') && typeof librarySync.configDir !== 'string')))
     throw new BusError('invalid-host-request');
-  let modelProxyClient = null, proxyPage = null, proxyUsage = null, usageTimer = null, proxyLock = null;
+  let modelProxyClient = null, proxyPage = null, proxyUsage = null, usageTimer = null, proxyLock = null, proxyPort = null;
   let modelKeys = null, modelTimer = null, modelSweep = null, modelCatalogues = null;
   const modelRuns = new Map();
-  let store, credentials, server, adapter, processing, syncTimer = null, syncPass = null, accessTimer = null, requestTimer = null;
+  let store, credentials, server, adapter, processing, syncTimer = null, syncPass = null, accessTimer = null, requestTimer = null, copyLaunch = null;
   try {
     // Lifecycle Task 2 (#797): a product whose mapping is published but not yet activated is not part of
     // this process. A managed product is part of it only with both a committed activate receipt in the
@@ -383,6 +389,7 @@ export async function startBroker({
         proxyLock = createProxyLock({ stateDir: join(instanceDataRoot, 'proxy'), identity: `${instanceConfigDir}:${proxy.port}` });
       }
       modelProxyClient = await loadManagementClient({ configDir: org ? instanceConfigDir : organization.dir, proxy, receipt: proxyReceipt });
+      proxyPort = proxy.port;
     }
 
     // Row 234 (#1740, r6 X4 third bullet): each host grant record gives its agent a store reference to
@@ -401,6 +408,20 @@ export async function startBroker({
     // Row 236 (#1742, #436b r5 section 5): each gitea grant record gives its agent a store reference to
     // gitea, and `held` names the files memory must not load until reconcile or a revoke.
     const { held } = storeRoot ? giteaStart(store, storeRoot, businesses, references) : { held: [] };
+    // #1873 CB2 (security review P2): a copy slot an issue staged before a crash, whose binding holds
+    // no grant for it, goes before Credentials loads and before any issue can run.
+    if (storeRoot) {
+      const reader = organizationWriter({ dir: organization.dir, rolesDir: organization.rolesDir, dataRoot: instanceRoot ?? dataRoot });
+      const documents = Object.keys(businesses).map((id) => {
+        try {
+          return [id, reader.read(id).document];
+        } catch {
+          return [id, null];
+        }
+      });
+      for (const entry of sweepCopySlots(storeRoot, documents, references))
+        process.stderr.write(`copies: ${JSON.stringify({ event: 'copy-slot-swept', ...entry })}\n`);
+    }
     // #1886 (F3 defect l): a store reference with no file yet reads as no key (design D3a), but Credentials
     // refuses a missing store root, and only issue() made it. Start makes it the same way issue() does when
     // any reference names the store. A root that exists with loose modes or as a symlink still refuses.
@@ -420,6 +441,25 @@ export async function startBroker({
     }
     // The boot copy snapshot's definitions (the root agents file's, A4): every reload re-applies them.
     if (copies?.definitions !== undefined) scanDefinitions(copies.definitions, clean, { boot: true });
+    // #1873 CB3: each unbound copy whose binding is bound is re-resolved and its slot proved live at
+    // the service; only those that pass join the organization, now, before anything takes a copy of
+    // `businesses`. A binding approved later answers restart-required. copyGrant keeps the boot's own
+    // snapshot (bootCopies), and so does the gate: what it promotes is decided at boot only.
+    const bootCopies = copies;
+    if (organization && storeRoot && copies) {
+      copyLaunch = copyLaunchGate({ credentials, writer: organizationWriter({ dir: organization.dir, rolesDir: organization.rolesDir, dataRoot: instanceRoot ?? dataRoot }),
+        configDir: organization.dir, rolesDir: organization.rolesDir, snapshot: copies, ...(copyTransport ? { transport: copyTransport.send, ca: copyTransport.ca } : {}) });
+      await copyLaunch.boot(copies.org);
+      const verified = copyLaunch.bound();
+      if (Object.keys(verified).length) {
+        copies = promoteCopies(copies, verified);
+        const b = loadOrg(copies.org);
+        const resolved = {};
+        for (const instance of Object.keys(b.roles)) resolved[instance] = resolveInstance({ system: organization.system, business: b, instance });
+        businesses[copies.org] = withoutPending(copies.org, busOrganization(b, resolved));
+        if (proxy) for (const instance of Object.keys(verified)) if (Object.hasOwn(businesses[copies.org].roles, instance)) credentials.registerModel(copies.org + '/' + instance);
+      }
+    }
     if (proxy) {
       const inventory = modelRunInventory(dataRoot, modelRuns, credentials);
       modelKeys = new ModelKeys({ credentials, client: modelProxyClient, configDir: org ? instanceConfigDir : organization.dir, org: org?.id ?? null, lock: proxyLock,
@@ -611,6 +651,9 @@ export async function startBroker({
       && fixedAtStart(b).libraries === boot.libraries
       && Object.entries(fixedAtStart(b).roles).every(([role, f]) => f === (boot.roles[role] ?? fixedRole(null)));
     const booted = new Map(Object.entries(businesses).map(([id, b]) => [id, fixedAtStart(b)]));
+    // #1873 CB3: a copy the boot snapshot had unbound (whether the gate promoted it or not).
+    const copyNeedsAuthority = (id, instance) => copyLaunch !== null && bootCopies?.org === id
+      && Object.hasOwn(bootCopies.copies, instance) && bootCopies.copies[instance].state === 'unbound';
     const reloadLog = entry => process.stderr.write(`organization: ${JSON.stringify(entry)}\n`);
     function reload(id) {
       try {
@@ -676,7 +719,10 @@ export async function startBroker({
     // project as the business stands now: a project that excludes it, or whose union refuses, is not ready.
     // `instance` comes with `revision`, the organization file revision the launch resolved its bundle
     // from; a file that has changed since (a narrow, a project define's vars, an exclude) is not ready.
-    function admission({ business: id, project, projects, instance, revision: launched, thread, session }) {
+    // #1873 CB3: with `instance`, a copy the boot left needing a binding is admitted only on
+    // `authority`, the launch authority digest its prepare returned, still current now. Checked
+    // before the projects, so a launch with no project is held to it as well.
+    function admission({ business: id, project, projects, instance, revision: launched, thread, session, authority }) {
       if (projects !== undefined) {
         const no = code => ({ ready: false, revision: null, code });
         if (typeof id !== 'string' || !Object.hasOwn(businesses, id) || !Array.isArray(projects) || projects.some(p => typeof p !== 'string')) return no('project-unknown');
@@ -701,6 +747,9 @@ export async function startBroker({
             try { clean(name); held = heldPath(now.document.definitions?.[name], clean); } catch { held = 'name'; }
             if (held !== null) return no(DEFINITION_HOLDS_CREDENTIAL);
           }
+          if (copyNeedsAuthority(id, instance)) {
+            try { copyLaunch.admit(id, instance, authority); } catch (e) { return no(e?.code ?? 'copy-authority-changed'); }
+          }
         }
         for (const p of projects) {
           const result = admission({ business: id, project: p });
@@ -790,6 +839,12 @@ export async function startBroker({
       // Row 236 (#1742): the Gitea grant path. The admin slot is <configDir>/secrets/grants/<business>/gitea.
       giteaGrant: organization ? giteaGrant({ configDir: organization.dir }) : null,
       giteaKeys: storeRoot ? giteaKeys({ credentials, storeRoot }) : null,
+      // #1873 CB2: credentials.issue for an agent copy's bound Gitea service, verified live at the server.
+      copyGrant: organization && storeRoot
+        ? copyGrant({ credentials, writer: organizationWriter({ dir: organization.dir, rolesDir: organization.rolesDir, dataRoot: instanceRoot ?? dataRoot }),
+          copies: bootCopies, organizations: () => Object.keys(businesses), ...(copyTransport ? { transport: copyTransport.send, ca: copyTransport.ca } : {}) })
+        : null,
+      copyLaunch,
       usage,
       limits,
       store,
@@ -929,9 +984,18 @@ export async function startBroker({
       proxyInit: organization ? async args => {
         const settings = await initializeProxy({ configDir: organization.dir, dataRoot: instanceRoot ?? dataRoot, ...args });
         modelProxyClient = await loadManagementClient({ configDir: organization.dir, proxy: settings, receipt: proxyReceipt });
+        proxyPort = settings.port;
+        // #1873: an org bus that initializes the shared proxy also holds its write lock from now on.
+        if (org && !proxyLock) proxyLock = createProxyLock({ stateDir: join(instanceDataRoot, 'proxy'), identity: `${instanceConfigDir}:${settings.port}` });
         configureProxyPage();
         return settings;
       } : null,
+      // #1873: clear the uncertain-write fence only on restart evidence this host re-proves: the
+      // process on the proxy port is new, alive and started after the fence was set.
+      proxyFenceClear: organization ? async ({ evidence }) => {
+        if (!proxyLock || !modelProxyClient) throw new BusError('not-configured');
+        return proxyLock.clear({ restarted: true, read: () => modelProxyClient.getKeys(), verify: previous => verifyRestart(evidence, { fence: previous, port: proxyPort }) });
+      } : null,
       credentialVerbs: organization
         ? credentialVerbs({ credentials, writer: organizationWriter({ dir: organization.dir, rolesDir: organization.rolesDir, dataRoot:instanceRoot ?? dataRoot }),
           organizations: () => Object.keys(businesses), boot: copies?.definitions ? { org: copies.org, definitions: copies.definitions } : null })
@@ -1277,8 +1341,27 @@ export async function startBroker({
       credentials,
       // P2 consumes this inside the bus only. No process IPC/verb returns it.
       get modelProxy() { return modelProxyClient; },
+      // #1873 CB3: the copies the boot proved live, { instance: [service] }; names only.
+      copyBound: Object.freeze(copyLaunch ? copyLaunch.bound() : {}),
       path,
       bindLaunch,
+      // #1873 CB3: the launcher's prepare for a copy the boot left needing a binding: the launch
+      // authority { authority, services } after a live proof at the service, or the refusal. Any
+      // other instance needs none and gets { authority: null }.
+      // `revision` is the organization file revision the launch resolved its bundle from (A3); a
+      // copy's prepare holds the file to it.
+      copyLaunch: async ({ business, instance, revision }) => {
+        if (typeof business !== 'string' || typeof instance !== 'string') throw new BusError('invalid-request');
+        if (!copyNeedsAuthority(business, instance)) return { authority: null, services: [] };
+        if (typeof revision !== 'string') throw new BusError('invalid-request');
+        return copyLaunch.prepare(business, instance, revision);
+      },
+      // #1873 CB3: one checked Gitea request for a bound copy's run. Who it is for comes from the
+      // capability's session, never from the request. Returns { status, json }; nothing holds the token.
+      copyCall: async (cap, request) => {
+        if (!copyLaunch) throw new BusError('credential-unavailable');
+        return copyLaunch.call(broker.copySession(cap), request);
+      },
       recoverLaunch: ({ modelKeyId, ...record }) => broker.recoverLaunch(record),
       endLaunch: (r) => { const out = broker.endLaunch(r); modelRuns.delete(r.business + ':' + r.run); return out; },
       modelAdmission: async ({ business, instance, modelKey, harness, revision, entry: expected, provider, model, account, route, transport }) => {

packages/bus/tests/copy-grant-docker.test.mjs

@@ -0,0 +1,227 @@
+// #1873 CB2 live acceptance: credentials.issue for an agent copy's Gitea service against a scratch
+// gitea/gitea:1.27.1, a throwaway container on 127.0.0.1 over TLS with a scratch CA, removed after.
+// The test never pulls an image; without Docker or the image it skips. Every token here is a scratch
+// token this container made; none is printed, and nothing here reaches git.mosaicstack.dev or any
+// real service.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash, randomBytes } from 'node:crypto';
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { request } from 'node:https';
+import { createServer } from 'node:net';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+import { Broker, BusError } from '../src/broker.mjs';
+import { Store } from '../src/store.mjs';
+import { Credentials } from '../src/credentials.mjs';
+import { copyGrant } from '../src/copy-grant.mjs';
+import { hireDecisions } from '../../organization/src/hire-decisions.mjs';
+import { organizationWriter } from '../../organization/src/organization.mjs';
+import { loadBusiness } from '../../organization/src/organization-config.mjs';
+import { checkRootAgents } from '../../organization/src/agent-levels.mjs';
+import { materializeCopies, copiesView } from '../../organization/src/agent-copies.mjs';
+import { activateOrg, reserveOrg } from '../../organization/src/org-registry.mjs';
+import { copyBotLogin } from '../../organization/src/copy-bindings.mjs';
+import { businessDoc, rolesCopy, writeJson } from '../../organization/tests/helpers.mjs';
+import { scratchCa } from '../../seat/tests/fake-gitea.mjs';
+
+const IMAGE = 'gitea/gitea:1.27.1';
+const SUBJECT = { provider: 'test', iss: 'https://issuer.test', sub: 'owner' };
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const ahead = (days) => new Date(Date.now() + days * 86400000).toISOString().slice(0, 10);
+const sha = (s) => createHash('sha256').update(s).digest('hex');
+const docker = (...args) => spawnSync('docker', args, { encoding: 'utf8', timeout: 120000 });
+const skip = docker('image', 'inspect', IMAGE).status === 0 ? false : `no Docker or no local ${IMAGE}; this test never pulls`;
+
+const freePort = () =>
+  new Promise((resolve, reject) => {
+    const s = createServer();
+    s.once('error', reject);
+    s.listen(0, '127.0.0.1', () => {
+      const { port } = s.address();
+      s.close(() => resolve(port));
+    });
+  });
+
+// One HTTPS call to the scratch container, trusting only the scratch CA.
+function call(url, ca, method, path, { auth = null, body = null } = {}) {
+  return new Promise((resolve) => {
+    const data = body ? JSON.stringify(body) : null;
+    const headers = { accept: 'application/json', ...(data ? { 'content-type': 'application/json' } : {}), ...(auth ? { authorization: auth } : {}) };
+    const req = request(url + path, { method, ca, headers, timeout: 10000 }, (res) => {
+      let text = '';
+      res.on('data', (c) => (text += c));
+      res.on('end', () => {
+        let json = null;
+        try {
+          json = text ? JSON.parse(text) : null;
+        } catch {}
+        resolve({ status: res.statusCode, json });
+      });
+    });
+    req.on('timeout', () => req.destroy());
+    req.on('error', () => resolve({ status: 0, json: null }));
+    req.end(data ?? undefined);
+  });
+}
+
+test('CB2-D: on scratch 1.27.1 an owner-issued copy token is proved live: equal and narrower bind; broader, all, admin, foreign, unrelated and opaque refuse', { skip, timeout: 300000 }, async (t) => {
+  // Capture the child's complete TAP stdout/stderr before any of it reaches this runner, so the parent
+  // can search for the actual minted values without putting one in an assertion.
+  if (!process.env.CB2_COPY_CAPTURE) {
+    const capture = mkdtempSync(join(tmpdir(), 'cb2cap-'));
+    t.after(() => rmSync(capture, { recursive: true, force: true }));
+    const file = join(capture, 'minted');
+    const childEnv = { ...process.env, CB2_COPY_CAPTURE: file };
+    delete childEnv.NODE_TEST_CONTEXT;
+    const child = spawnSync(process.execPath, ['--test', '--test-name-pattern=^CB2-D:', fileURLToPath(import.meta.url)], {
+      encoding: 'utf8', timeout: 280000, env: childEnv,
+    });
+    const values = existsSync(file) ? JSON.parse(readFileSync(file, 'utf8')) : [];
+    const output = (child.stdout ?? '') + (child.stderr ?? '');
+    assert.ok(values.every((value) => !output.includes(value) && !output.includes(sha(value))), 'complete TAP stdout/stderr contain no minted token');
+    t.diagnostic(output);
+    t.diagnostic(`minted ${values.length}, hits 0 (complete TAP stdout/stderr)`);
+    assert.equal(child.status, 0, 'Docker child passed');
+    assert.equal(values.length, 6, 'all six scratch tokens were minted: the acceptance actually ran');
+    return;
+  }
+
+  const dir = mkdtempSync(join(tmpdir(), 'cb2d-'));
+  t.after(() => rmSync(dir, { recursive: true, force: true }));
+  const tlsDir = join(dir, 'tls'), tls = scratchCa(tlsDir);
+  // The container's git user reads the scratch key; it is a throwaway key for this run only.
+  chmodSync(tlsDir, 0o755);
+  chmodSync(join(tlsDir, 'server.key'), 0o644);
+  const ca = readFileSync(tls.ca, 'utf8'), port = await freePort();
+  const url = `https://127.0.0.1:${port}`, name = 'cb2-' + randomBytes(6).toString('hex');
+  t.after(() => docker('rm', '-f', name));
+  const started = docker('run', '-d', '--rm', '--name', name, '-p', `127.0.0.1:${port}:3000`, '-v', `${tlsDir}:/certs:ro`,
+    '-e', 'GITEA__security__INSTALL_LOCK=true', '-e', 'GITEA__database__DB_TYPE=sqlite3',
+    '-e', 'GITEA__service__DISABLE_REGISTRATION=true', '-e', 'GITEA__server__PROTOCOL=https',
+    '-e', 'GITEA__server__CERT_FILE=/certs/server.pem', '-e', 'GITEA__server__KEY_FILE=/certs/server.key',
+    '-e', `GITEA__server__ROOT_URL=${url}/`, IMAGE);
+  assert.equal(started.status, 0, 'scratch container starts');
+  const end = Date.now() + 120000;
+  while ((await call(url, ca, 'GET', '/api/v1/version')).status !== 200) {
+    assert.ok(Date.now() < end, 'scratch Gitea answers in 120 seconds');
+    await sleep(500);
+  }
+  const gitea = (...args) => docker('exec', '-u', 'git', name, 'gitea', ...args);
+  const minted = [];
+  const createUser = (user, admin = false) => {
+    const r = gitea('admin', 'user', 'create', '--username', user, '--email', `${user}@example.test`,
+      '--password', randomBytes(16).toString('base64url'), '--must-change-password=false', ...(admin ? ['--admin'] : []));
+    assert.equal(r.status, 0, `create scratch ${user}`);
+  };
+  const mint = (user, scopes) => {
+    const r = gitea('admin', 'user', 'generate-access-token', '--username', user, '--token-name', 'cb2-' + randomBytes(4).toString('hex'),
+      '--scopes', scopes.join(','), '--raw');
+    assert.equal(r.status, 0, `mint scratch ${user}`);
+    const value = r.stdout.trim();
+    assert.ok(/^[0-9a-f]{40}$/.test(value), 'minted token shape');
+    minted.push(value);
+    writeFileSync(process.env.CB2_COPY_CAPTURE, JSON.stringify(minted), { mode: 0o600 });
+    return value;
+  };
+  createUser('scratch-admin', true);
+  createUser('owner');
+  const admin = 'token ' + mint('scratch-admin', ['write:admin', 'write:repository', 'write:user']);
+  for (const repo of ['stack', 'other']) {
+    const made = await call(url, ca, 'POST', '/api/v1/admin/users/owner/repos', { auth: admin, body: { name: repo, auto_init: true, private: true } });
+    assert.equal(made.status, 201, `create owner/${repo}`);
+  }
+
+  // The organization: one root agent "rev" whose copy binding approves write:repository and
+  // read:user on project stack, whose remote is the scratch owner/stack.
+  const root = mkdtempSync(join(tmpdir(), 'cb2o-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const rolesDir = rolesCopy(root);
+  const doc = { ...businessDoc(root, 'demo'), plugins: { harness: ['pi'] }, vars: { 'bus.tester': true } };
+  doc.projects.stack.remote = `${url}/owner/stack`;
+  const file = writeJson(join(root, 'businesses/demo.json'), doc);
+  const dataRoot = join(root, 'data');
+  mkdirSync(dataRoot, { mode: 0o700 });
+  const ctx = { configDir: root, dataRoot, instance: 'test' };
+  await reserveOrg(ctx, 'demo');
+  await activateOrg(ctx, 'demo');
+  const snapshot = materializeCopies({ orgId: 'demo', doc, root: { state: 'ok', ...checkRootAgents({ agentsVersion: 1, agents: { rev: { definition: 'reviewer' } } }, { rolesDir }) }, rolesDir });
+  const writer = organizationWriter({ dir: root, rolesDir }), store = new Store(dataRoot);
+  t.after(() => store.close());
+  const service = hireDecisions({ writer, rolesDir, dataRoot, configDir: root, assertClean: () => {}, copies: (id) => (snapshot.org === id ? snapshot : null) });
+  const loaded = () => {
+    const d = loadBusiness('demo', { dir: root, rolesDir });
+    // The boot's copies view, as the runtime's loadWithCopies gives the broker.
+    return { ...d, roles: Object.fromEntries(Object.entries(d.roles).map(([n, e]) => [n, { ...d.definitions[e.definition], ...e }])), copies: copiesView(snapshot.copies) };
+  };
+  const storeRoot = join(root, 'secrets', 'agents');
+  mkdirSync(storeRoot, { recursive: true, mode: 0o700 });
+  chmodSync(join(root, 'secrets'), 0o700);
+  const credentials = new Credentials({ references: {}, storeRoot, repoRoots: [], dataRoot: '/nonexistent-data' });
+  const issue = copyGrant({ credentials, writer, copies: snapshot, organizations: () => ['demo'], ca, timeoutMs: 10000 });
+  const b = new Broker({
+    store, businesses: { demo: loaded() },
+    hires: { ...service, apply: async (...args) => { const r = await service.apply(...args); b.reloadBusiness('demo', loaded()); return r; } },
+    credentialVerbs: () => { throw new BusError('credential-unknown'); }, copyGrant: (...a) => issue(...a),
+  });
+  const consoleCap = b.bindConsole({ business: 'demo', human: 'jason', subject: SUBJECT });
+  const human = b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+  const request_ = (cap, verb, args) => Promise.resolve().then(() => b.request(cap, { verb, args }));
+  await request_(consoleCap, 'hire.start.console', { op: 'change', level: 'root', name: 'rev', reason: 'Bind the copy',
+    binding: { services: { gitea: { scopes: ['write:repository', 'read:user'], projects: ['stack'] } } } });
+  const rec = () => JSON.parse(readFileSync(file, 'utf8')).copyBindings.rev;
+  assert.equal(rec().state, 'pending');
+  const slot = join(storeRoot, 'demo', 'rev', 'gitea');
+  const issueToken = (token) => request_(human, 'credentials.issue', { agent: 'rev', service: 'gitea', date: ahead(30), token });
+
+  // The copy's dedicated account: a read collaborator on owner/stack only.
+  const login = copyBotLogin(rec().orgIncarnation, rec().copyId, 'gitea');
+  createUser(login);
+  const collaborate = (repo, permission) => call(url, ca, 'PUT', `/api/v1/repos/owner/${repo}/collaborators/${login}`, { auth: admin, body: { permission } });
+  assert.equal((await collaborate('stack', 'read')).status, 204, 'bot is a read collaborator on owner/stack');
+
+  const refused = async (token, code, label) => {
+    await assert.rejects(issueToken(token), { code }, label);
+    assert.equal(rec().state, 'pending', label);
+    assert.equal(rec().services.gitea.grantId, undefined, label);
+    assert.ok(!existsSync(slot), `${label}: a refused token leaves no slot`);
+  };
+
+  // Equal: the approved scopes exactly.
+  const equal = mint(login, ['write:repository', 'read:user']);
+  const self = await call(url, ca, 'GET', '/api/v1/token', { auth: 'token ' + equal });
+  assert.equal(self.status, 200);
+  assert.equal(self.json.user.login, login, 'Gitea 1.27.1 names the token owner on /api/v1/token');
+  const one = await issueToken(equal);
+  assert.equal(one.state, 'bound');
+  assert.equal(one.account, login);
+  assert.deepEqual([rec().state, rec().services.gitea.grantId, rec().services.gitea.grantGeneration], ['bound', `gitea:${self.json.user.id}:${self.json.id}`, 1]);
+  assert.equal(statSync(slot).mode & 0o777, 0o600);
+  assert.equal(readFileSync(slot, 'utf8'), equal + '\n');
+
+  // Narrower: read within the approved write.
+  const narrow = mint(login, ['read:repository', 'read:user']);
+  await issueToken(narrow);
+  assert.deepEqual([rec().state, rec().services.gitea.grantGeneration], ['bound', 2]);
+  assert.equal(readFileSync(slot, 'utf8'), narrow + '\n');
+
+  // Broader in one category, and "all": exceeded; a failed re-issue deactivates the binding.
+  await refused(mint(login, ['write:repository', 'write:user']), 'credential-scope-exceeded', 'write:user beyond read:user');
+  await refused(mint(login, ['all']), 'credential-scope-exceeded', 'all');
+  // The administrator's own token, inside the approved scopes: not the copy's account.
+  await refused(mint('scratch-admin', ['read:repository', 'read:user']), 'credential-identity-refused', 'admin account');
+  // A token Gitea never issued.
+  await refused(randomBytes(20).toString('hex'), 'credential-scope-unverified', 'opaque token');
+  // An unrelated repository the account can also reach.
+  assert.equal((await collaborate('other', 'read')).status, 204);
+  await refused(narrow, 'credential-scope-exceeded', 'unrelated repository');
+
+  // Nothing kept names a token, its digest, the slot path or a request.
+  const kept = [file, join(root, 'businesses/.history/demo/changes.jsonl')].filter(existsSync).map((p) => readFileSync(p, 'utf8')).join('\n')
+    + ['events', 'decisions'].map((tb) => JSON.stringify(store.all(`SELECT * FROM ${tb}`))).join('\n');
+  for (const value of minted) assert.ok(!kept.includes(value) && !kept.includes(sha(value)) && !kept.includes(sha(value + '\n')), 'kept text holds no token');
+  for (const bad of [slot, storeRoot, '/api/v1', 'authorization']) assert.ok(!kept.includes(bad), 'kept text holds no path or request');
+  t.diagnostic(`minted ${minted.length}`);
+});

packages/bus/tests/copy-grant.test.mjs

@@ -0,0 +1,558 @@
+// #1873 CB2 (design section 5 steps 4 to 6, section 8 row CB2): credentials.issue for an agent copy's
+// bound Gitea service, verified live against a fake Gitea before any grant metadata lands. The
+// organization writer's half is packages/organization/tests/copy-grant-writer.test.mjs; the real
+// server acceptance is copy-grant-docker.test.mjs.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { chmodSync, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Broker, BusError } from '../src/broker.mjs';
+import { Store } from '../src/store.mjs';
+import { Credentials } from '../src/credentials.mjs';
+import { REFUSALS } from '../src/refusals.mjs';
+import { copyGrant, tokenLevels, verifyGiteaToken, boundRepositories, MAX_ROTATE_DAYS, sweepCopySlots } from '../src/copy-grant.mjs';
+import { fakeGiteaApi } from './fake-gitea-api.mjs';
+import { hireDecisions } from '../../organization/src/hire-decisions.mjs';
+import { organizationWriter } from '../../organization/src/organization.mjs';
+import { loadBusiness } from '../../organization/src/organization-config.mjs';
+import { checkRootAgents } from '../../organization/src/agent-levels.mjs';
+import { materializeCopies, copiesView } from '../../organization/src/agent-copies.mjs';
+import { activateOrg, reserveOrg } from '../../organization/src/org-registry.mjs';
+import { copyBotLogin } from '../../organization/src/copy-bindings.mjs';
+import { businessDoc, rolesCopy, writeJson } from '../../organization/tests/helpers.mjs';
+
+const SUBJECT = { provider: 'test', iss: 'https://issuer.test', sub: 'owner' };
+const READ = { gitea: { scopes: ['read:repository', 'read:user'], projects: ['stack'] } };
+const ahead = (days) => new Date(Date.now() + days * 86400000).toISOString().slice(0, 10);
+const present = (p) => { try { lstatSync(p); return true; } catch { return false; } };
+const sha = (s) => createHash('sha256').update(s).digest('hex');
+
+async function fixture(t, { services = READ, edit = (d) => d } = {}) {
+  const root = mkdtempSync(join(tmpdir(), 'cb2-')), rolesDir = rolesCopy(root);
+  const api = await fakeGiteaApi(t, root);
+  const base = { ...businessDoc(root, 'demo'), plugins: { harness: ['pi'] }, vars: { 'bus.tester': true } };
+  base.projects.stack.agents = { checker: { definition: 'reviewer' } };
+  base.projects.stack.remote = `${api.url}/owner/stack`;
+  const doc = edit(base);
+  const file = writeJson(join(root, 'businesses/demo.json'), doc);
+  const dataRoot = join(root, 'data'); mkdirSync(dataRoot, { mode: 0o700 });
+  const ctx = { configDir: root, dataRoot, instance: 'test' };
+  await reserveOrg(ctx, 'demo'); await activateOrg(ctx, 'demo');
+  const snapshot = materializeCopies({ orgId: 'demo', doc, root: { state: 'ok', ...checkRootAgents({ agentsVersion: 1, agents: { rev: { definition: 'reviewer' } } }, { rolesDir }) }, rolesDir });
+  const writer = organizationWriter({ dir: root, rolesDir }), store = new Store(dataRoot);
+  const service = hireDecisions({ writer, rolesDir, dataRoot, configDir: root, assertClean: () => {}, copies: (id) => snapshot.org === id ? snapshot : null });
+  const loaded = () => { const d = loadBusiness('demo', { dir: root, rolesDir }); return { ...d, roles: Object.fromEntries(Object.entries(d.roles).map(([n, e]) => [n, { ...d.definitions[e.definition], ...e }])), copies: copiesView((opts.copies ?? snapshot).copies) }; };
+  const storeRoot = join(root, 'secrets', 'agents');
+  mkdirSync(storeRoot, { recursive: true, mode: 0o700 }); chmodSync(join(root, 'secrets'), 0o700);
+  const credentials = new Credentials({ references: {}, storeRoot, repoRoots: [], dataRoot: '/nonexistent-data' });
+  const hooks = {};
+  const opts = { timeoutMs: 3000 };
+  const issue = (...a) => copyGrant({ credentials, writer, copies: opts.copies ?? snapshot, organizations: () => ['demo'], ca: api.ca, timeoutMs: opts.timeoutMs, hooks })(...a);
+  const direct = (args, ctx) => issue('demo', args, ctx);
+  const b = new Broker({ store, businesses: { demo: loaded() }, hires: { ...service, apply: async (...args) => { const r = await service.apply(...args); b.reloadBusiness('demo', loaded()); return r; } },
+    credentialVerbs: () => { throw new BusError('credential-unknown'); }, copyGrant: (...a) => issue(...a) });
+  const owner = b.bindConsole({ business: 'demo', human: 'jason', subject: SUBJECT });
+  const human = b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+  const chief = b.bindLaunch({ business: 'demo', role: 'chief', run: 'chief-run', harness: 'pi' });
+  b.request(chief, { verb: 'role.claim' });
+  const call = (cap, verb, args = {}) => Promise.resolve().then(() => b.request(cap, { verb, args }));
+  const bind = (name = 'rev', svc = services, extra = {}) => call(owner, 'hire.start.console', { op: 'change', level: 'root', name, reason: 'Bind the copy', binding: { services: svc }, ...extra });
+  await bind();
+  t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
+  const rec = (name = 'rev') => JSON.parse(readFileSync(file, 'utf8')).copyBindings?.[name];
+  const repo = api.addRepo('owner', 'stack');
+  // The copy's dedicated account, a read collaborator on owner/stack, and one token from it.
+  const bot = (name = 'rev', { perm = 'read', admin = false } = {}) => {
+    const r = rec(name);
+    const login = copyBotLogin(r.orgIncarnation, r.copyId, 'gitea');
+    const u = api.users.get(login) ?? api.addUser(login, { is_admin: admin }).user;
+    repo.collaborators.push(login); repo.permissions[login] = perm;
+    return u;
+  };
+  const token = (u, scopes = ['read:repository', 'read:user'], o) => api.addToken(u.login, `t${api.issued.length}`, scopes, o);
+  const slot = (name = 'rev') => join(storeRoot, 'demo', name, 'gitea');
+  const issueAs = (cap, args) => call(cap, 'credentials.issue', { agent: 'rev', service: 'gitea', date: ahead(30), ...args });
+  return { root, file, api, b, store, writer, credentials, hooks, opts, direct, owner, human, chief, call, bind, rec, bot, token, slot, repo, storeRoot, issueAs, loaded, snapshot };
+}
+
+// Everything the bus or the organization keeps after an issue: the document, the receipts, the store.
+function kept(f) {
+  const files = [f.file, join(f.root, 'businesses/.history/demo/changes.jsonl')].filter(existsSync).map((p) => readFileSync(p, 'utf8'));
+  const rows = ['events', 'decisions'].map((tb) => JSON.stringify(f.store.all(`SELECT * FROM ${tb}`)));
+  return files.join('\n') + rows.join('\n');
+}
+
+test('CB2 an owner-issued copy token is verified live, staged and bound; nothing kept names the token or its path', async (t) => {
+  const f = await fixture(t);
+  assert.equal(f.rec().state, 'pending');
+  const u = f.bot();
+  const tok = f.token(u);
+  const date = ahead(30);
+  const result = await f.issueAs(f.human, { token: tok.sha1, date });
+  assert.deepEqual(result, { agent: 'rev', service: 'gitea', verb: 'issue', date, state: 'bound', account: u.login, generation: result.generation });
+  const r = f.rec();
+  assert.equal(r.state, 'bound');
+  assert.deepEqual(r.services.gitea, { slot: 'self', scopes: ['read:repository', 'read:user'], resources: { projects: ['stack'] }, rotateBy: date, grantId: `gitea:${u.id}:${tok.id}`, grantGeneration: 1 });
+  assert.equal(statSync(f.slot()).mode & 0o777, 0o600);
+  assert.equal(readFileSync(f.slot(), 'utf8'), tok.sha1 + '\n');
+  // Only GETs went to Gitea, every one as the copy's account.
+  assert.ok(f.api.requests.length > 0);
+  for (const req of f.api.requests) {
+    assert.equal(req.method, 'GET');
+    if (req.path !== '/api/v1/version') assert.equal(req.as, u.login);
+  }
+  const text = kept(f) + JSON.stringify(result);
+  for (const bad of [tok.sha1, sha(tok.sha1), sha(tok.sha1 + '\n'), f.slot(), f.storeRoot, '/api/v1', 'authorization']) assert.ok(!text.includes(bad), 'kept text holds a secret, path or request');
+  // Copies still cannot launch in CB2: the snapshot does not resolve a gitea-only copy (CB3 owns launch).
+});
+
+test('CB2 narrower and equal scopes are accepted; any broader token is exceeded and leaves the record inactive', async (t) => {
+  const f = await fixture(t, { services: { gitea: { scopes: ['write:repository', 'read:user'], projects: ['stack'] } } });
+  const u = f.bot('rev', { perm: 'write' });
+  for (const scopes of [['write:repository', 'write:user'], ['all'], ['write:admin', 'read:user'], ['read:repository', 'read:user', 'read:issue'], ['read:user', 'read:misc']]) {
+    const tok = f.token(u, scopes);
+    await assert.rejects(f.issueAs(f.human, { token: tok.sha1 }), { code: 'credential-scope-exceeded' }, scopes.join());
+    assert.equal(f.rec().state, 'pending', scopes.join());
+    assert.equal(f.rec().services.gitea.grantId, undefined);
+    assert.ok(!existsSync(f.slot()), 'a refused token leaves no slot');
+  }
+  // Equal.
+  await f.issueAs(f.human, { token: f.token(u, ['write:repository', 'read:user']).sha1 });
+  assert.equal(f.rec().state, 'bound');
+  // Narrower (read within the approved write) re-issues; the grant generation counts up.
+  f.repo.permissions[u.login] = 'read';
+  const narrow = f.token(u, ['read:repository', 'read:user']);
+  await f.issueAs(f.human, { token: narrow.sha1 });
+  assert.deepEqual([f.rec().state, f.rec().services.gitea.grantGeneration, f.rec().services.gitea.grantId], ['bound', 2, `gitea:${u.id}:${narrow.id}`]);
+  // A failed re-issue after bound deactivates the binding and removes its slot.
+  await assert.rejects(f.issueAs(f.human, { token: f.token(u, ['all']).sha1 }), { code: 'credential-scope-exceeded' });
+  assert.deepEqual([f.rec().state, f.rec().services.gitea.grantId, existsSync(f.slot())], ['pending', undefined, false]);
+});
+
+test('CB2 read is narrower than write within a category; categories are independent; push needs write', async (t) => {
+  assert.deepEqual(tokenLevels(['read:repository', 'write:repository', 'read:user']), { repository: 'write', user: 'read' });
+  assert.deepEqual(tokenLevels(['write:issue', 'read:issue']), { issue: 'write' });
+  for (const bad of [['all'], ['write:admin'], ['read:admin'], ['read:sudo'], ['repository'], [], null, [7]]) assert.equal(tokenLevels(bad), null, JSON.stringify(bad));
+  const f = await fixture(t);
+  // The binding approved read:repository; the account can push, so the token reaches more than read.
+  const u = f.bot('rev', { perm: 'write' });
+  await assert.rejects(f.issueAs(f.human, { token: f.token(u).sha1 }), { code: 'credential-scope-exceeded' });
+  // write:issue is another category: read:repository never approves it.
+  f.repo.permissions[u.login] = 'read';
+  await assert.rejects(f.issueAs(f.human, { token: f.token(u, ['read:repository', 'read:user', 'write:issue']).sha1 }), { code: 'credential-scope-exceeded' });
+  await f.issueAs(f.human, { token: f.token(u).sha1 });
+  assert.equal(f.rec().state, 'bound');
+});
+
+test('CB2 push is held to the binding, not the token: a narrower token binds for a push account on a write binding', async () => {
+  const push = { '/api/v1/user/repos': { status: 200, json: [{ full_name: 'owner/stack', permissions: { admin: false, push: true, pull: true } }], total: 1 } };
+  await assert.rejects(V(scripted(push).transport), { code: 'credential-scope-exceeded' });
+  const write = { approved: ['write:repository', 'read:user'] };
+  assert.deepEqual(await V(scripted(push).transport, write), { userId: 5, tokenId: 9, login: 'bot' });
+  const writeToken = { '/api/v1/token': { status: 200, json: { id: 9, scopes: ['write:repository', 'read:user'], user: { id: 5, login: 'bot' } } } };
+  assert.deepEqual(await V(scripted({ ...push, ...writeToken }).transport, write), { userId: 5, tokenId: 9, login: 'bot' });
+  await assert.rejects(V(scripted({ ...push, ...writeToken }).transport), { code: 'credential-scope-exceeded' });
+});
+
+test('CB2 the boot copy must still match the record: a missing, refused or changed copy refuses before anything is staged or sent', async (t) => {
+  const f = await fixture(t);
+  const tok = f.token(f.bot());
+  const rev = f.snapshot.copies.rev;
+  const cases = [
+    [{ ...f.snapshot, copies: {} }, 'copy-unavailable'],
+    [{ ...f.snapshot, org: 'other' }, 'copy-unavailable'],
+    [{ ...f.snapshot, copies: { rev: { ...rev, state: 'refused' } } }, 'copy-unavailable'],
+    [{ ...f.snapshot, copies: { rev: { ...rev, level: 'project', project: 'stack' } } }, 'credential-binding-changed'],
+    [{ ...f.snapshot, copies: { rev: { ...rev, name: 'other' } } }, 'credential-binding-changed'],
+    [{ ...f.snapshot, copies: { rev: { ...rev, definition: 'coder' } } }, 'credential-binding-changed'],
+  ];
+  const before = kept(f), sent = f.api.requests.length;
+  for (const [copies, code] of cases) {
+    f.opts.copies = copies;
+    await assert.rejects(f.direct({ agent: 'rev', service: 'gitea', token: tok.sha1, date: ahead(30) }, { actor: 'jason', owner: true }), { code }, JSON.stringify(copies.copies?.rev ?? copies.org));
+  }
+  f.opts.copies = null;
+  // No record for the name, or a name the organization's own roles hold.
+  await assert.rejects(f.direct({ agent: 'nobody', service: 'gitea', token: tok.sha1, date: ahead(30) }, { actor: 'jason', owner: true }), { code: 'credential-unbound' });
+  f.opts.copies = { ...f.snapshot, copies: { ...f.snapshot.copies, chief: { ...rev, name: 'chief' } } };
+  const { document } = f.writer.read('demo');
+  const shadow = { ...f.writer, read: () => ({ ...f.writer.read('demo'), document: { ...document, copyBindings: { ...document.copyBindings, chief: document.copyBindings.rev } } }) };
+  await assert.rejects(copyGrant({ credentials: f.credentials, writer: shadow, copies: f.opts.copies, organizations: () => ['demo'] })('demo', { agent: 'chief', service: 'gitea', token: tok.sha1, date: ahead(30) }, { actor: 'jason', owner: true }), { code: 'copy-unavailable' });
+  f.opts.copies = null;
+  assert.deepEqual([kept(f) === before, f.api.requests.length, present(join(f.storeRoot, 'demo'))], [true, sent, false]);
+  await f.issueAs(f.human, { token: tok.sha1 });
+  assert.equal(f.rec().state, 'bound');
+});
+
+test('CB2 stageCopy refuses a name a loaded reference holds and an unknown service, leaving the file alone', async (t) => {
+  const root = mkdtempSync(join(tmpdir(), 'cb2-ref-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const storeRoot = join(root, 'agents');
+  mkdirSync(join(storeRoot, 'demo', 'rev'), { recursive: true, mode: 0o700 }); chmodSync(storeRoot, 0o700); chmodSync(join(storeRoot, 'demo'), 0o700);
+  const file = join(storeRoot, 'demo', 'rev', 'gitea');
+  writeFileSync(file, 'r'.repeat(40) + '\n', { mode: 0o600 });
+  const credentials = new Credentials({ references: { 'demo/rev': { gitea: { service: 'gitea', store: true, file, rotateBy: ahead(30) } } }, storeRoot, repoRoots: [], dataRoot: '/nonexistent-data' });
+  assert.throws(() => credentials.stageCopy('demo/rev', 'gitea', 'a'.repeat(40)), { code: 'credential-reference' });
+  assert.equal(readFileSync(file, 'utf8'), 'r'.repeat(40) + '\n');
+  assert.throws(() => credentials.stageCopy('demo/other', 'model', 'a'.repeat(40)), { code: 'credential-reference' });
+  assert.equal(present(join(storeRoot, 'demo', 'other')), false);
+});
+
+test('CB2 a Vikunja binding refuses credential-scope-unverified before anything is staged or sent', async (t) => {
+  const vik = { tasks: ['read_one'] };
+  const f = await fixture(t, { services: { gitea: READ.gitea, vikunja: { scopes: vik, projects: ['stack'] } } });
+  const before = readFileSync(f.file, 'utf8');
+  await assert.rejects(f.issueAs(f.human, { service: 'vikunja', token: 'v'.repeat(40) }), { code: 'credential-scope-unverified' });
+  assert.equal(readFileSync(f.file, 'utf8'), before);
+  assert.equal(f.api.requests.length, 0);
+  assert.ok(!existsSync(join(f.storeRoot, 'demo', 'rev')));
+  // With a Gitea grant the record still waits on Vikunja: pending, never bound.
+  await f.issueAs(f.human, { token: f.token(f.bot()).sha1 });
+  assert.equal(f.rec().state, 'pending');
+  assert.ok(f.rec().services.gitea.grantId);
+  assert.ok(REFUSALS['credential-scope-unverified'].nextStep.includes('Vikunja'));
+});
+
+test('CB2 unrelated repositories, admin rights or a missing bound repository refuse', async (t) => {
+  const f = await fixture(t);
+  const u = f.bot();
+  const tok = f.token(u);
+  const other = f.api.addRepo('someone', 'private', { collaborators: [u.login] });
+  other.permissions[u.login] = 'read';
+  await assert.rejects(f.issueAs(f.human, { token: tok.sha1 }), { code: 'credential-scope-exceeded' });
+  other.collaborators.length = 0;
+  const own = f.api.addRepo(u.login, 'scratch');
+  await assert.rejects(f.issueAs(f.human, { token: tok.sha1 }), { code: 'credential-scope-exceeded' });
+  f.api.repos.splice(f.api.repos.indexOf(own), 1);
+  f.repo.collaborators.length = 0;
+  await assert.rejects(f.issueAs(f.human, { token: tok.sha1 }), { code: 'credential-scope-unverified' });
+  assert.equal(f.rec().state, 'pending');
+  f.repo.collaborators.push(u.login);
+  await f.issueAs(f.human, { token: tok.sha1 });
+  assert.equal(f.rec().state, 'bound');
+});
+
+// A scripted Gitea for the verifier's own branches: paging, organizations and malformed answers.
+function scripted(over = {}) {
+  const base = {
+    '/api/v1/version': { status: 200, json: { version: '1.27.1' } },
+    '/api/v1/token': { status: 200, json: { id: 9, scopes: ['read:repository', 'read:user'], user: { id: 5, login: 'bot' } } },
+    '/api/v1/user': { status: 200, json: { id: 5, login: 'bot', is_admin: false } },
+    '/api/v1/user/repos': { status: 200, json: [{ full_name: 'owner/stack', permissions: { admin: false, push: false, pull: true } }], total: 1 },
+    '/api/v1/user/orgs': { status: 200, json: [], total: 0 },
+    ...over,
+  };
+  const seen = [];
+  const transport = async ({ path, method }) => {
+    seen.push(`${method} ${path}`);
+    const key = path.split('?')[0];
+    const a = base[key];
+    return typeof a === 'function' ? a(path) : { total: null, ...a };
+  };
+  return { transport, seen };
+}
+const V = (transport, extra = {}) => verifyGiteaToken({ transport, url: 'https://127.0.0.1:1', token: 'x'.repeat(40), approved: ['read:repository', 'read:user', 'read:organization'], repos: new Set(['owner/stack']), login: 'bot', rotateBy: ahead(30), ...extra });
+
+test('CB2 verifier: paging must agree, organizations are refused with an organization scope', async () => {
+  assert.deepEqual(await V(scripted().transport), { userId: 5, tokenId: 9, login: 'bot' });
+  const pages = (p1, p2) => (path) => (path.includes('page=1') ? p1 : p2);
+  const repo = (n) => ({ full_name: `owner/${n}`, permissions: { admin: false, push: false, pull: true } });
+  const two = new Set(['owner/stack', 'owner/b']);
+  const many = Array.from({ length: 50 }, (_, i) => repo(`r${i}`));
+  const fifty = new Set(many.map((r) => r.full_name.toLowerCase()));
+  // A total that changes between pages, a page that comes back short, and no total at all.
+  await assert.rejects(V(scripted({ '/api/v1/user/repos': pages({ status: 200, json: many, total: 51 }, { status: 200, json: [repo('x')], total: 52 }) }).transport, { repos: fifty }), { code: 'credential-scope-unverified' });
+  await assert.rejects(V(scripted({ '/api/v1/user/repos': pages({ status: 200, json: many, total: 52 }, { status: 200, json: [], total: 52 }) }).transport, { repos: fifty }), { code: 'credential-scope-unverified' });
+  await assert.rejects(V(scripted({ '/api/v1/user/repos': { status: 200, json: [repo('stack')], total: null } }).transport), { code: 'credential-scope-unverified' });
+  await assert.rejects(V(scripted({ '/api/v1/user/repos': { status: 200, json: [repo('stack'), repo('b')], total: 2 } }).transport), { code: 'credential-scope-exceeded' });
+  assert.ok(await V(scripted({ '/api/v1/user/repos': { status: 200, json: [repo('stack'), repo('b')], total: 2 } }).transport, { repos: two }));
+  await assert.rejects(V(scripted({ '/api/v1/user/repos': { status: 200, json: [{ full_name: 'owner/stack', permissions: { push: false, pull: true } }], total: 1 } }).transport), { code: 'credential-scope-exceeded' });
+  await assert.rejects(V(scripted({ '/api/v1/user/repos': { status: 200, json: [{ full_name: 'owner/stack' }], total: 1 } }).transport), { code: 'credential-scope-unverified' });
+  // Organizations: only asked when the token has an organization level.
+  const plain = scripted({ '/api/v1/user/orgs': { status: 200, json: [{ id: 1, username: 'acme' }], total: 1 } });
+  assert.ok(await V(plain.transport));
+  assert.ok(!plain.seen.some((s) => s.includes('/user/orgs')));
+  const orgTok = { '/api/v1/token': { status: 200, json: { id: 9, scopes: ['read:organization', 'read:repository', 'read:user'], user: { id: 5, login: 'bot' } } } };
+  assert.ok(await V(scripted(orgTok).transport));
+  await assert.rejects(V(scripted({ ...orgTok, '/api/v1/user/orgs': { status: 200, json: [{ id: 1, username: 'acme' }], total: 1 } }).transport), { code: 'credential-scope-exceeded' });
+  await assert.rejects(V(scripted({ ...orgTok, '/api/v1/user/orgs': { status: 500, json: null } }).transport), { code: 'credential-scope-unverified' });
+  // The bound projects' remotes: one https Gitea origin, agreeing remotes.
+  const doc = (projects) => ({ projects });
+  assert.deepEqual([...boundRepositories(doc({ a: { remote: 'https://127.0.0.1:9/Owner/Stack' } }), ['a']).repos], ['owner/stack']);
+  for (const [d, ps] of [[doc({ a: { remote: 'http://127.0.0.1:9/o/r' } }), ['a']], [doc({ a: {} }), ['a']], [doc({}), ['a']], [doc({ a: { remote: 'https://127.0.0.1:9/o/r' }, b: { remote: 'https://127.0.0.2:9/o/r' } }), ['a', 'b']], [doc({}), []],
+    [doc({ a: { remote: 'https://127.0.0.1:9/o/r', git: { mode: 'remote', remote: 'https://127.0.0.1:9/o/s' } } }), ['a']]])
+    assert.throws(() => boundRepositories(d, ps), { code: 'credential-scope-unverified' });
+});
+
+test('CB2 a foreign account, an administrator or another copy\'s token is identity-refused', async (t) => {
+  const f = await fixture(t);
+  const u = f.bot();
+  const foreign = f.api.addUser('someone-else').user;
+  f.repo.collaborators.push('someone-else');
+  for (const tok of [f.token(foreign), { sha1: f.api.adminToken }]) {
+    await assert.rejects(f.issueAs(f.human, { token: tok.sha1 }), { code: 'credential-identity-refused' });
+    assert.deepEqual([f.rec().state, existsSync(f.slot())], ['pending', false]);
+  }
+  // The copy's own login, made an administrator.
+  u.is_admin = true;
+  await assert.rejects(f.issueAs(f.human, { token: f.token(u).sha1 }), { code: 'credential-identity-refused' });
+  u.is_admin = false;
+  // /user names another account than /token did.
+  const undo = f.api.rule((e) => e.path === '/api/v1/user', { status: 200, json: { id: u.id + 1000, login: u.login, is_admin: false } });
+  await assert.rejects(f.issueAs(f.human, { token: f.token(u).sha1 }), { code: 'credential-identity-refused' });
+  undo();
+  // Another copy's account and token: checker.stack is bound in the same organization.
+  await f.call(f.owner, 'hire.start.console', { op: 'change', level: 'project', project: 'stack', name: 'checker', reason: 'Bind', binding: { services: READ } });
+  const checker = f.bot('checker.stack');
+  const theirs = f.token(checker);
+  await assert.rejects(f.issueAs(f.human, { token: theirs.sha1 }), { code: 'credential-identity-refused' });
+  await f.issueAs(f.human, { agent: 'checker.stack', token: theirs.sha1 });
+  assert.equal(f.rec('checker.stack').state, 'bound');
+  assert.equal(f.rec().state, 'pending');
+  assert.notEqual(checker.login, u.login);
+});
+
+test('CB2 an opaque or unverifiable token refuses unverified; a malformed one refuses credential-format', async (t) => {
+  const f = await fixture(t);
+  const u = f.bot();
+  // A malformed token refuses before anything is staged or sent (build review 2): the bound record is
+  // unchanged, nothing reached Gitea and no slot exists.
+  const before = kept(f), sent = f.api.requests.length;
+  await assert.rejects(f.issueAs(f.human, { token: 'short' }), { code: 'credential-format' });
+  await assert.rejects(f.issueAs(f.human, { token: 'has space ' + 'x'.repeat(30) }), { code: 'credential-format' });
+  assert.deepEqual([kept(f) === before, f.api.requests.length, present(join(f.storeRoot, 'demo', 'rev'))], [true, sent, false]);
+  await assert.rejects(f.issueAs(f.human, { token: 'f'.repeat(40) }), { code: 'credential-scope-unverified' });
+  const tok = f.token(u);
+  for (const answer of [{ status: 200, json: { id: tok.id, scopes: tok.scopes } }, { status: 200, json: { id: tok.id, scopes: tok.scopes, user: { login: u.login } } }, { status: 500, json: null }, { drop: true }]) {
+    const undo = f.api.rule((e) => e.path === '/api/v1/token', answer);
+    await assert.rejects(f.issueAs(f.human, { token: tok.sha1 }), { code: 'credential-scope-unverified' }, JSON.stringify(answer));
+    undo();
+  }
+  f.opts.timeoutMs = 300;
+  const hang = f.api.rule((e) => e.path.startsWith('/api/v1/user/repos'), { hang: true });
+  await assert.rejects(f.issueAs(f.human, { token: tok.sha1 }), { code: 'credential-scope-unverified' });
+  hang();
+  f.opts.timeoutMs = 3000;
+  f.api.state.version = '1.26.0';
+  await assert.rejects(f.issueAs(f.human, { token: tok.sha1 }), { code: 'credential-scope-unverified' });
+  f.api.state.version = '1.27.1';
+  // The token lacks read:user, which the binding approved: its repositories cannot be listed.
+  await assert.rejects(f.issueAs(f.human, { token: f.token(u, ['read:repository']).sha1 }), { code: 'credential-scope-unverified' });
+  assert.deepEqual([f.rec().state, existsSync(f.slot())], ['pending', false]);
+  await f.issueAs(f.human, { token: tok.sha1 });
+  assert.equal(f.rec().state, 'bound');
+});
+
+test('CB2 a token any definition already holds refuses before anything is staged or sent', async (t) => {
+  const f = await fixture(t);
+  const tok = f.token(f.bot());
+  const before = readFileSync(f.file, 'utf8');
+  // The boot copy snapshot's definitions are live text for the bus's lifetime.
+  f.opts.copies = { ...f.snapshot, definitions: { ...f.snapshot.definitions, leaky: { note: `see ${tok.sha1}` } } };
+  await assert.rejects(f.issueAs(f.human, { token: tok.sha1 }), { code: 'definition-holds-credential' });
+  assert.deepEqual([readFileSync(f.file, 'utf8') === before, existsSync(f.slot()), f.api.requests.length], [true, false, 0]);
+  f.opts.copies = null;
+  await f.issueAs(f.human, { token: tok.sha1 });
+  assert.equal(f.rec().state, 'bound');
+});
+
+test('CB2 a binding without read:user is unverifiable before anything is staged', async (t) => {
+  const f = await fixture(t, { services: { gitea: { scopes: ['read:repository'], projects: ['stack'] } } });
+  const before = readFileSync(f.file, 'utf8');
+  await assert.rejects(f.issueAs(f.human, { token: f.token(f.bot()).sha1 }), { code: 'credential-scope-unverified' });
+  assert.equal(readFileSync(f.file, 'utf8'), before);
+  assert.equal(f.api.requests.length, 0);
+});
+
+test('CB2 dates: the rotation date is after today, at most a year ahead, and not after the token expires', async (t) => {
+  const f = await fixture(t);
+  const u = f.bot();
+  const tok = f.token(u);
+  const before = readFileSync(f.file, 'utf8');
+  for (const date of [ahead(0), ahead(-1), ahead(MAX_ROTATE_DAYS + 1), '2099-02-30', '2099-1-01', 'tomorrow'])
+    await assert.rejects(f.issueAs(f.human, { token: tok.sha1, date }), { code: 'credential-date' }, date);
+  assert.equal(readFileSync(f.file, 'utf8'), before);
+  assert.equal(f.api.requests.length, 0);
+  const soon = f.token(u, undefined, { expires: `${ahead(10)}T00:00:00Z` });
+  await assert.rejects(f.issueAs(f.human, { token: soon.sha1, date: ahead(10) }), { code: 'credential-date' });
+  await assert.rejects(f.issueAs(f.human, { token: soon.sha1, date: ahead(30) }), { code: 'credential-date' });
+  const odd = f.token(u, undefined, { expires: 'not-a-date' });
+  await assert.rejects(f.issueAs(f.human, { token: odd.sha1 }), { code: 'credential-scope-unverified' });
+  assert.deepEqual([f.rec().state, existsSync(f.slot())], ['pending', false]);
+  await f.issueAs(f.human, { token: soon.sha1, date: ahead(9) });
+  assert.equal(f.rec().services.gitea.rotateBy, ahead(9));
+  await f.issueAs(f.human, { token: f.token(u, undefined, { expires: `${ahead(400)}T00:00:00Z` }).sha1, date: ahead(MAX_ROTATE_DAYS) });
+  assert.equal(f.rec().state, 'bound');
+});
+
+test('CB2 the slot is read back by identity: symlinks, hard links, stale and replaced files refuse credential-file', async (t) => {
+  const f = await fixture(t);
+  const u = f.bot();
+  const tok = f.token(u);
+  const other = f.token(u);
+  const elsewhere = join(f.root, 'elsewhere');
+  const cases = {
+    symlink: ['afterStage', () => { writeFileSync(elsewhere, tok.sha1 + '\n', { mode: 0o600 }); unlinkSync(f.slot()); symlinkSync(elsewhere, f.slot()); }],
+    hardlink: ['afterStage', () => { rmSync(elsewhere, { force: true }); linkSync(f.slot(), elsewhere); }],
+    stale: ['afterStage', () => { renameSync(f.slot(), elsewhere); writeFileSync(f.slot(), tok.sha1 + '\n', { mode: 0o600 }); }],
+    mode: ['afterStage', () => chmodSync(f.slot(), 0o644)],
+    // A writer replaces a file by renaming a new one over it, as the store does.
+    replacedAfterRemote: ['afterRemote', () => { writeFileSync(elsewhere, other.sha1 + '\n', { mode: 0o600 }); renameSync(elsewhere, f.slot()); }],
+    replacedBeforeCommit: ['beforeCommit', () => { writeFileSync(elsewhere, other.sha1 + '\n', { mode: 0o600 }); renameSync(elsewhere, f.slot()); }],
+    // Unlinked and written again: the inode number may be reused, the content still differs.
+    reusedInode: ['afterStage', () => { unlinkSync(f.slot()); writeFileSync(f.slot(), other.sha1 + '\n', { mode: 0o600 }); }],
+    rewrittenInPlace: ['beforeCommit', () => writeFileSync(f.slot(), other.sha1 + '\n')],
+  };
+  for (const [name, [hook, act]] of Object.entries(cases)) {
+    rmSync(elsewhere, { force: true });
+    f.hooks[hook] = act;
+    await assert.rejects(f.issueAs(f.human, { token: tok.sha1 }), { code: 'credential-file' }, name);
+    delete f.hooks[hook];
+    assert.equal(f.rec().state, 'pending', name);
+    assert.equal(f.rec().services.gitea.grantId, undefined, name);
+    // The bus removes only the file it wrote; a file someone else put there stays.
+    if (['symlink', 'stale', 'replacedAfterRemote', 'replacedBeforeCommit'].includes(name)) assert.ok(present(f.slot()), name);
+    if (['hardlink', 'mode', 'rewrittenInPlace'].includes(name)) assert.ok(!present(f.slot()), name);
+    rmSync(f.slot(), { force: true });
+  }
+  await f.issueAs(f.human, { token: tok.sha1 });
+  assert.equal(f.rec().state, 'bound');
+});
+
+test('CB2 crash points leave the record pending and the slot removed; a new verified issue recovers', async (t) => {
+  const f = await fixture(t);
+  const u = f.bot();
+  const tok = f.token(u);
+  for (const hook of ['afterStage', 'afterRemote', 'beforeCommit']) {
+    f.hooks[hook] = () => { throw new Error('crash'); };
+    await assert.rejects(f.issueAs(f.human, { token: tok.sha1 }), { code: 'outcome-unknown' }, hook);
+    delete f.hooks[hook];
+    assert.deepEqual([f.rec().state, f.rec().services.gitea.grantId, existsSync(f.slot())], ['pending', undefined, false], hook);
+  }
+  // A hard crash after the stage (security review P2): the record is pending and the staged token is
+  // on disk. The next start's sweep removes it before anything loads; the record stays pending and
+  // only a fresh verified issue binds.
+  const r = f.rec();
+  const { revision } = f.writer.read('demo');
+  f.writer.stageCopyGrant('demo', { instance: 'rev', service: 'gitea', copyId: r.copyId, generation: r.generation, decision: r.decision, incarnation: r.orgIncarnation }, { revision, actor: 'jason', owner: true });
+  f.credentials.stageCopy('demo/rev', 'gitea', tok.sha1);
+  assert.equal(f.rec().state, 'pending');
+  assert.deepEqual(sweepCopySlots(f.storeRoot, [['demo', f.writer.read('demo').document]], {}), [{ instance: 'demo/rev', service: 'gitea' }]);
+  assert.deepEqual([f.rec().state, present(f.slot())], ['pending', false]);
+  await f.issueAs(f.human, { token: tok.sha1 });
+  assert.deepEqual([f.rec().state, f.rec().services.gitea.grantGeneration], ['bound', 1]);
+  // A lost reply: the commit landed but the caller never heard. Issuing again re-verifies.
+  await f.issueAs(f.human, { token: tok.sha1 });
+  assert.deepEqual([f.rec().state, f.rec().services.gitea.grantGeneration], ['bound', 2]);
+});
+
+test('CB2 the start sweep removes only ungranted copy slots and staged temp files', async (t) => {
+  const f = await fixture(t);
+  const u = f.bot();
+  const tok = f.token(u);
+  await f.issueAs(f.human, { token: tok.sha1 });
+  assert.equal(f.rec().state, 'bound');
+  const doc = () => [['demo', f.writer.read('demo').document]];
+  const copyDir = join(f.storeRoot, 'demo', 'rev');
+  // A granted slot stays; an interrupted write's temp file goes; a name that is no service stays.
+  writeFileSync(join(copyDir, 'gitea.tmp'), 'x', { mode: 0o600 });
+  writeFileSync(join(copyDir, 'notes'), 'x', { mode: 0o600 });
+  assert.deepEqual(sweepCopySlots(f.storeRoot, doc(), {}), [{ instance: 'demo/rev', service: 'gitea' }]);
+  assert.deepEqual([present(f.slot()), present(join(copyDir, 'gitea.tmp')), present(join(copyDir, 'notes'))], [true, false, true]);
+  // An ungranted service of a bound copy goes; a slot a loaded reference names stays.
+  writeFileSync(join(copyDir, 'vikunja'), 'x', { mode: 0o600 });
+  assert.deepEqual(sweepCopySlots(f.storeRoot, doc(), { 'demo/rev': { vikunja: { service: 'vikunja' } } }), []);
+  assert.deepEqual(sweepCopySlots(f.storeRoot, doc(), {}), [{ instance: 'demo/rev', service: 'vikunja' }]);
+  // A role's own slots and an unreadable organization are never touched.
+  const roleDir = join(f.storeRoot, 'demo', 'chief');
+  mkdirSync(roleDir, { mode: 0o700 }); writeFileSync(join(roleDir, 'gitea'), 'x', { mode: 0o600 });
+  const edited = { ...f.writer.read('demo').document };
+  edited.copyBindings = { ...edited.copyBindings, chief: { ...edited.copyBindings.rev, services: {} } };
+  assert.deepEqual(sweepCopySlots(f.storeRoot, [['demo', edited]], {}), []);
+  assert.equal(present(join(roleDir, 'gitea')), true);
+  writeFileSync(join(copyDir, 'gitea.tmp'), 'x', { mode: 0o600 });
+  assert.deepEqual(sweepCopySlots(f.storeRoot, [['demo', null]], {}), []);
+  assert.equal(present(join(copyDir, 'gitea.tmp')), true);
+  // No store, a missing org dir: nothing. A store dir that isn't private refuses as Credentials would.
+  assert.deepEqual(sweepCopySlots(null, doc(), {}), []);
+  assert.deepEqual(sweepCopySlots(f.storeRoot, [['other', f.writer.read('demo').document]], {}), []);
+  chmodSync(copyDir, 0o755);
+  assert.throws(() => sweepCopySlots(f.storeRoot, doc(), {}), /credential-file/);
+  chmodSync(copyDir, 0o700);
+});
+
+test('CB2 a stage write that fails leaves no staged token behind', async (t) => {
+  const f = await fixture(t);
+  // The slot path is a non-empty directory: the rename fails after the temp file holds the token.
+  mkdirSync(join(f.slot(), 'x'), { recursive: true, mode: 0o700 });
+  assert.throws(() => f.credentials.stageCopy('demo/rev', 'gitea', 'a'.repeat(40)));
+  assert.deepEqual(readdirSync(join(f.storeRoot, 'demo', 'rev')), ['gitea']);
+});
+
+test('CB2 a rebind, a failed owner recheck or a concurrent issue during the remote work refuses the commit', async (t) => {
+  const f = await fixture(t);
+  const u = f.bot();
+  const tok = f.token(u);
+  // The owner approves a new binding while Gitea is being asked.
+  f.hooks.afterRemote = () => f.bind('rev', { gitea: { scopes: ['read:user', 'read:repository'], projects: ['stack'] } });
+  // The document moved under the commit: its revision check refuses before the binding fence.
+  await assert.rejects(f.issueAs(f.human, { token: tok.sha1 }), { code: 'revision-conflict' });
+  delete f.hooks.afterRemote;
+  assert.deepEqual([f.rec().state, existsSync(f.slot())], ['pending', false]);
+  // The caller's owner recheck fails after the remote work (the broker's #copyOwner), and again
+  // when it fails only under the writer's locks.
+  for (const at of [1, 2]) {
+    let n = 0;
+    await assert.rejects(f.direct({ agent: 'rev', service: 'gitea', token: tok.sha1, date: ahead(30) }, { actor: 'jason', owner: true, recheck: () => { if (++n >= at) throw new BusError('human-required'); } }), { code: 'human-required' });
+    assert.deepEqual([f.rec().state, existsSync(f.slot())], ['pending', false]);
+  }
+  // Not the owner, or the tester's name, never reaches the writer.
+  for (const ctx of [{ actor: 'jason', owner: false }, { actor: 'tester', owner: true }])
+    await assert.rejects(f.direct({ agent: 'rev', service: 'gitea', token: tok.sha1, date: ahead(30) }, ctx), { code: 'human-required' });
+  // Two issues: the first is held after its remote work while the second binds.
+  const second = f.token(u);
+  let release, first = true;
+  const held = new Promise((r) => { release = r; });
+  f.hooks.afterRemote = () => { if (first) { first = false; return held; } };
+  const a = f.issueAs(f.human, { token: tok.sha1 });
+  await new Promise((r) => setTimeout(r, 50));
+  while (f.hooks.afterRemote && first) await new Promise((r) => setTimeout(r, 10));
+  await f.issueAs(f.human, { token: second.sha1 });
+  release();
+  await assert.rejects(a, (e) => ['revision-conflict', 'credential-binding-changed', 'credential-file'].includes(e.code));
+  delete f.hooks.afterRemote;
+  assert.equal(f.rec().state, 'bound');
+  assert.equal(f.rec().services.gitea.grantId, `gitea:${u.id}:${second.id}`);
+  assert.equal(readFileSync(f.slot(), 'utf8'), second.sha1 + '\n', 'the second issue\'s slot stays');
+});
+
+test('CB2 only the organization owner issues: the chief, the tester, a reader and an org.hire member are refused before staging', async (t) => {
+  const f = await fixture(t);
+  const tok = f.token(f.bot());
+  const before = readFileSync(f.file, 'utf8');
+  const member = (owner) => f.b.bindHireConsole({ business: 'demo', actor: 'member', subject: { ...SUBJECT, sub: 'member' }, rights: ['org.hire', 'decide'], owner, instanceOwner: true });
+  const got = [];
+  for (const cap of [f.chief, f.b.bindTester({ business: 'demo' }), f.b.bindReader({ business: 'demo' }), member(false), member(true), f.owner]) {
+    await assert.rejects(f.issueAs(cap, { token: tok.sha1 }), (e) => { got.push(e.code); return !String(e.message).includes(tok.sha1); });
+  }
+  // The Console caps, the owner's included, never reach credentials.issue: the token comes from the
+  // owner's CLI on standard input.
+  assert.deepEqual(got, ['human-required', 'tester-refused', 'human-required', 'human-required', 'human-required', 'human-required']);
+  assert.equal(readFileSync(f.file, 'utf8'), before);
+  assert.equal(f.api.requests.length, 0);
+  assert.ok(!existsSync(join(f.storeRoot, 'demo')));
+  // Only a name the boot's copies view holds goes to the copy verifier; any other unknown name
+  // answers credential-unknown as before, and nothing is staged or sent.
+  await assert.rejects(f.issueAs(f.human, { agent: 'nobody', token: tok.sha1 }), { code: 'credential-unknown' });
+  assert.deepEqual([readFileSync(f.file, 'utf8') === before, f.api.requests.length, existsSync(join(f.storeRoot, 'demo'))], [true, 0, false]);
+});
+
+test('CB2 refusal table: the new codes have rails and next steps that name no path', () => {
+  for (const code of ['credential-scope-unverified', 'credential-identity-refused', 'credential-date', 'credential-format', 'credential-file', 'copy-unavailable']) {
+    const g = REFUSALS[code];
+    assert.ok(g && g.rail.length && g.nextStep.length, code);
+    assert.doesNotMatch(g.nextStep, /\/|~|\.json\b|secrets/, code);
+  }
+});

packages/bus/tests/copy-launch-docker.test.mjs

@@ -0,0 +1,238 @@
+// #1873 CB3 live acceptance: a bound copy's launch gate against a scratch gitea/gitea:1.27.1, a
+// throwaway container on 127.0.0.1 over TLS with a scratch CA, removed after. The boot proves the
+// slot live, a launch carries its authority to the bound session, one checked call reads the bound
+// repository, and a reissue denies the next call before any request. The test never pulls an image;
+// without Docker or the image it skips. Every token here is a scratch token this container made;
+// none is printed, and nothing here reaches git.mosaicstack.dev or any real service.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash, randomBytes } from 'node:crypto';
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { request } from 'node:https';
+import { createServer } from 'node:net';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+import { Broker, BusError } from '../src/broker.mjs';
+import { Store } from '../src/store.mjs';
+import { Credentials } from '../src/credentials.mjs';
+import { copyGrant } from '../src/copy-grant.mjs';
+import { copyLaunchGate } from '../src/copy-launch.mjs';
+import { send } from '../src/gitea-grant.mjs';
+import { hireDecisions } from '../../organization/src/hire-decisions.mjs';
+import { organizationWriter } from '../../organization/src/organization.mjs';
+import { checkRootAgents } from '../../organization/src/agent-levels.mjs';
+import { loadWithCopies, materializeCopies, promoteCopies } from '../../organization/src/agent-copies.mjs';
+import { activateOrg, reserveOrg } from '../../organization/src/org-registry.mjs';
+import { copyBotLogin } from '../../organization/src/copy-bindings.mjs';
+import { businessDoc, rolesCopy, writeJson } from '../../organization/tests/helpers.mjs';
+import { scratchCa } from '../../seat/tests/fake-gitea.mjs';
+
+const IMAGE = 'gitea/gitea:1.27.1';
+const SUBJECT = { provider: 'test', iss: 'https://issuer.test', sub: 'owner' };
+const READ = { gitea: { scopes: ['read:repository', 'read:user'], projects: ['stack'] } };
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const ahead = (days) => new Date(Date.now() + days * 86400000).toISOString().slice(0, 10);
+const sha = (s) => createHash('sha256').update(s).digest('hex');
+const docker = (...args) => spawnSync('docker', args, { encoding: 'utf8', timeout: 120000 });
+const skip = docker('image', 'inspect', IMAGE).status === 0 ? false : `no Docker or no local ${IMAGE}; this test never pulls`;
+
+const freePort = () =>
+  new Promise((resolve, reject) => {
+    const s = createServer();
+    s.once('error', reject);
+    s.listen(0, '127.0.0.1', () => {
+      const { port } = s.address();
+      s.close(() => resolve(port));
+    });
+  });
+
+// One HTTPS call to the scratch container as its administrator, trusting only the scratch CA.
+function call(url, ca, method, path, { auth = null, body = null } = {}) {
+  return new Promise((resolve) => {
+    const data = body ? JSON.stringify(body) : null;
+    const headers = { accept: 'application/json', ...(data ? { 'content-type': 'application/json' } : {}), ...(auth ? { authorization: auth } : {}) };
+    const req = request(url + path, { method, ca, headers, timeout: 10000 }, (res) => {
+      let text = '';
+      res.on('data', (c) => (text += c));
+      res.on('end', () => {
+        let json = null;
+        try {
+          json = text ? JSON.parse(text) : null;
+        } catch {}
+        resolve({ status: res.statusCode, json });
+      });
+    });
+    req.on('timeout', () => req.destroy());
+    req.on('error', () => resolve({ status: 0, json: null }));
+    req.end(data ?? undefined);
+  });
+}
+
+test('CB3-D: on scratch 1.27.1 a bound copy boots proved, launches with its authority, reads only its repository, refuses a redirect, and a reissue denies the next call unsent', { skip, timeout: 300000 }, async (t) => {
+  // The child's complete TAP output is captured before any of it reaches this runner, so the parent
+  // can search it for the minted values without putting one in an assertion.
+  if (!process.env.CB3_COPY_CAPTURE) {
+    const capture = mkdtempSync(join(tmpdir(), 'cb3cap-'));
+    t.after(() => rmSync(capture, { recursive: true, force: true }));
+    const file = join(capture, 'minted');
+    const childEnv = { ...process.env, CB3_COPY_CAPTURE: file };
+    delete childEnv.NODE_TEST_CONTEXT;
+    const child = spawnSync(process.execPath, ['--test', '--test-name-pattern=^CB3-D:', fileURLToPath(import.meta.url)], {
+      encoding: 'utf8', timeout: 280000, env: childEnv,
+    });
+    const values = existsSync(file) ? JSON.parse(readFileSync(file, 'utf8')) : [];
+    const output = (child.stdout ?? '') + (child.stderr ?? '');
+    assert.ok(values.every((value) => !output.includes(value) && !output.includes(sha(value))), 'complete TAP stdout/stderr contain no minted token');
+    t.diagnostic(output);
+    t.diagnostic(`minted ${values.length}, hits 0 (complete TAP stdout/stderr)`);
+    assert.equal(child.status, 0, 'Docker child passed');
+    assert.equal(values.length, 3, 'all three scratch tokens were minted: the acceptance actually ran');
+    return;
+  }
+
+  const dir = mkdtempSync(join(tmpdir(), 'cb3d-'));
+  t.after(() => rmSync(dir, { recursive: true, force: true }));
+  const tlsDir = join(dir, 'tls'), tls = scratchCa(tlsDir);
+  // The container's git user reads the scratch key; it is a throwaway key for this run only.
+  chmodSync(tlsDir, 0o755);
+  chmodSync(join(tlsDir, 'server.key'), 0o644);
+  const ca = readFileSync(tls.ca, 'utf8'), port = await freePort();
+  const url = `https://127.0.0.1:${port}`, name = 'cb3-' + randomBytes(6).toString('hex');
+  t.after(() => docker('rm', '-f', name));
+  const started = docker('run', '-d', '--rm', '--name', name, '-p', `127.0.0.1:${port}:3000`, '-v', `${tlsDir}:/certs:ro`,
+    '-e', 'GITEA__security__INSTALL_LOCK=true', '-e', 'GITEA__database__DB_TYPE=sqlite3',
+    '-e', 'GITEA__service__DISABLE_REGISTRATION=true', '-e', 'GITEA__server__PROTOCOL=https',
+    '-e', 'GITEA__server__CERT_FILE=/certs/server.pem', '-e', 'GITEA__server__KEY_FILE=/certs/server.key',
+    '-e', `GITEA__server__ROOT_URL=${url}/`, IMAGE);
+  assert.equal(started.status, 0, 'scratch container starts');
+  const end = Date.now() + 120000;
+  while ((await call(url, ca, 'GET', '/api/v1/version')).status !== 200) {
+    assert.ok(Date.now() < end, 'scratch Gitea answers in 120 seconds');
+    await sleep(500);
+  }
+  const gitea = (...args) => docker('exec', '-u', 'git', name, 'gitea', ...args);
+  const minted = [];
+  const createUser = (user, admin = false) => {
+    const r = gitea('admin', 'user', 'create', '--username', user, '--email', `${user}@example.test`,
+      '--password', randomBytes(16).toString('base64url'), '--must-change-password=false', ...(admin ? ['--admin'] : []));
+    assert.equal(r.status, 0, `create scratch ${user}`);
+  };
+  const mint = (user, scopes) => {
+    const r = gitea('admin', 'user', 'generate-access-token', '--username', user, '--token-name', 'cb3-' + randomBytes(4).toString('hex'),
+      '--scopes', scopes.join(','), '--raw');
+    assert.equal(r.status, 0, `mint scratch ${user}`);
+    const value = r.stdout.trim();
+    assert.ok(/^[0-9a-f]{40}$/.test(value), 'minted token shape');
+    minted.push(value);
+    writeFileSync(process.env.CB3_COPY_CAPTURE, JSON.stringify(minted), { mode: 0o600 });
+    return value;
+  };
+  createUser('scratch-admin', true);
+  createUser('owner');
+  const admin = 'token ' + mint('scratch-admin', ['write:admin', 'write:repository', 'write:user']);
+  for (const repo of ['stack', 'other']) {
+    const made = await call(url, ca, 'POST', '/api/v1/admin/users/owner/repos', { auth: admin, body: { name: repo, auto_init: true, private: true } });
+    assert.equal(made.status, 201, `create owner/${repo}`);
+  }
+
+  // The organization: one root agent "rev" (research, Gitea alone) bound read-only to project stack.
+  const root = mkdtempSync(join(tmpdir(), 'cb3o-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const rolesDir = rolesCopy(root);
+  const doc = { ...businessDoc(root, 'demo'), plugins: { harness: ['pi'] }, vars: { 'bus.tester': true } };
+  doc.projects.stack.remote = `${url}/owner/stack`;
+  writeJson(join(root, 'businesses/demo.json'), doc);
+  const dataRoot = join(root, 'data');
+  mkdirSync(dataRoot, { mode: 0o700 });
+  const ctx = { configDir: root, dataRoot, instance: 'test' };
+  await reserveOrg(ctx, 'demo');
+  await activateOrg(ctx, 'demo');
+  const snapshot = materializeCopies({ orgId: 'demo', doc, root: { state: 'ok', ...checkRootAgents({ agentsVersion: 1, agents: { rev: { definition: 'research' } } }, { rolesDir }) }, rolesDir });
+  const writer = organizationWriter({ dir: root, rolesDir }), store = new Store(dataRoot);
+  t.after(() => store.close());
+  const service = hireDecisions({ writer, rolesDir, dataRoot, configDir: root, assertClean: () => {}, copies: (id) => (snapshot.org === id ? snapshot : null) });
+  const storeRoot = join(root, 'secrets', 'agents');
+  mkdirSync(storeRoot, { recursive: true, mode: 0o700 });
+  chmodSync(join(root, 'secrets'), 0o700);
+  const credentials = new Credentials({ references: {}, storeRoot, repoRoots: [], dataRoot: '/nonexistent-data' });
+  // Every request the gate sends, by op only.
+  const sent = [];
+  const transport = (req) => { sent.push(`${req.method} ${req.path.split('?')[0]}`); return send(req); };
+  const gate = copyLaunchGate({ credentials, writer, configDir: root, rolesDir, snapshot, transport, ca, timeoutMs: 10000 });
+  let promoted = snapshot;
+  const business = () => {
+    const d = loadWithCopies('demo', { dir: root, rolesDir, snapshot: promoted });
+    return { ...d, roles: Object.fromEntries(Object.entries(d.roles).map(([n, e]) => [n, { ...d.definitions?.[e.definition], ...e }])) };
+  };
+  const issue = copyGrant({ credentials, writer, copies: snapshot, organizations: () => ['demo'], ca, timeoutMs: 10000 });
+  const b = new Broker({
+    store, businesses: { demo: business() }, copyLaunch: gate,
+    hires: { ...service, apply: async (...args) => { const r = await service.apply(...args); b.reloadBusiness('demo', business()); return r; } },
+    credentialVerbs: () => { throw new BusError('credential-unknown'); }, copyGrant: (...a) => issue(...a),
+  });
+  const consoleCap = b.bindConsole({ business: 'demo', human: 'jason', subject: SUBJECT });
+  const human = b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+  const request_ = (cap, verb, args) => Promise.resolve().then(() => b.request(cap, { verb, args }));
+  await request_(consoleCap, 'hire.start.console', { op: 'change', level: 'root', name: 'rev', reason: 'Bind the copy', binding: { services: READ } });
+  const rec = () => JSON.parse(readFileSync(join(root, 'businesses/demo.json'), 'utf8')).copyBindings.rev;
+  const login = copyBotLogin(rec().orgIncarnation, rec().copyId, 'gitea');
+  createUser(login);
+  const collaborate = (repo) => call(url, ca, 'PUT', `/api/v1/repos/owner/${repo}/collaborators/${login}`, { auth: admin, body: { permission: 'read' } });
+  assert.equal((await collaborate('stack')).status, 204, 'bot is a read collaborator on owner/stack');
+  const issueToken = (token) => request_(human, 'credentials.issue', { agent: 'rev', service: 'gitea', date: ahead(30), token });
+  assert.equal((await issueToken(mint(login, ['read:repository', 'read:user']))).state, 'bound');
+
+  // Bound after this gate was made: restart-required until a boot proves it.
+  await assert.rejects(gate.prepare('demo', 'rev'), { code: 'restart-required' });
+  assert.deepEqual(sent, []);
+  await gate.boot('demo');
+  assert.deepEqual(gate.bound(), { rev: ['gitea'] });
+  assert.ok(sent.includes('GET /api/v1/token'), 'the boot proved the slot live at the service');
+  promoted = promoteCopies(snapshot, gate.bound());
+  b.reloadBusiness('demo', business());
+
+  // A launch: prepare proves the slot again, bindLaunch carries the authority to the session.
+  const project = (await request_(human, 'project.create', { name: 'stack work', repo: 'stack' })).id;
+  const thread = (await request_(human, 'thread.create', { project, name: 'one', instance: 'rev' })).id;
+  const proofs = sent.length;
+  const revision = writer.read('demo').revision;
+  const { authority } = await gate.prepare('demo', 'rev', revision);
+  assert.ok(sent.slice(proofs).includes('GET /api/v1/token'));
+  const cap = b.bindLaunch({ business: 'demo', role: 'rev', run: 'rev-run', harness: 'pi', thread, copyAuthority: authority, revision });
+  const use = (req) => Promise.resolve().then(() => gate.call(b.copySession(cap), req));
+  const own = await use({ method: 'GET', path: '/api/v1/repos/owner/stack' });
+  assert.equal(own.status, 200);
+  assert.equal(own.json.full_name, 'owner/stack');
+  // A repository outside the binding, and a write on a read binding: refused before any request.
+  const before = sent.length;
+  await assert.rejects(use({ method: 'GET', path: '/api/v1/repos/owner/other' }), { code: 'copy-request-refused' });
+  await assert.rejects(use({ method: 'POST', path: '/api/v1/repos/owner/stack/issues', body: { title: 'x' } }), { code: 'copy-request-refused' });
+  assert.equal(sent.length, before);
+
+  // A reissue (a new generation) while the session is live: the next call refuses, none is sent.
+  await issueToken(mint(login, ['read:repository', 'read:user']));
+  assert.equal(rec().services.gitea.grantGeneration, 2);
+  const afterIssue = sent.length;
+  await assert.rejects(use({ method: 'GET', path: '/api/v1/repos/owner/stack' }), { code: 'restart-required' });
+  assert.equal(sent.length, afterIssue, 'no request after the reissue');
+
+  // Gitea answers a renamed repository's old path with a redirect. A fresh boot and launch on the
+  // second token; the bound path now redirects, and the gate refuses it without following.
+  const gate2 = copyLaunchGate({ credentials, writer, configDir: root, rolesDir, snapshot, transport, ca, timeoutMs: 10000 });
+  await gate2.boot('demo');
+  assert.deepEqual(gate2.bound(), { rev: ['gitea'] });
+  const { authority: authority2 } = await gate2.prepare('demo', 'rev');
+  // The broker's session for the old launch is gone with its authority; this one is gate2's own.
+  assert.throws(() => b.copySession(cap), { code: 'restart-required' });
+  const session = { business: 'demo', role: 'rev', copyAuthority: authority2 };
+  assert.equal((await gate2.call(session, { method: 'GET', path: '/api/v1/repos/owner/stack' })).status, 200);
+  assert.equal((await call(url, ca, 'PATCH', '/api/v1/repos/owner/stack', { auth: admin, body: { name: 'moved' } })).status, 200, 'rename owner/stack');
+  const viaOld = await call(url, ca, 'GET', '/api/v1/repos/owner/stack', { auth: admin });
+  assert.equal(viaOld.status, 301, 'Gitea 1.27.1 redirects a renamed repository\'s old path');
+  const n = sent.length;
+  await assert.rejects(gate2.call(session, { method: 'GET', path: '/api/v1/repos/owner/stack' }), { code: 'copy-redirect-refused' });
+  assert.equal(sent.length, n + 1, 'one request, never followed');
+  t.diagnostic(`minted ${minted.length}`);
+});

packages/bus/tests/copy-launch.test.mjs

@@ -0,0 +1,567 @@
+// #1873 CB3 (design section 5 steps 7 and 8, section 8 row CB3): a bound agent copy launches only
+// when the bus's boot proved its binding live at the service, every launch carries a launch
+// authority the bus checks again at prepare, final admission and bindLaunch, and each credential
+// call is checked against the session's authority before and after the request. The fake Gitea is
+// fake-gitea-api.mjs on 127.0.0.1; the runtime and launcher halves are runtime tests below and
+// packages/cli/tests/agent-copies.test.mjs.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, unlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Broker, BusError } from '../src/broker.mjs';
+import { Store } from '../src/store.mjs';
+import { Credentials } from '../src/credentials.mjs';
+import { REFUSALS } from '../src/refusals.mjs';
+import { copyGrant } from '../src/copy-grant.mjs';
+import { copyLaunchGate } from '../src/copy-launch.mjs';
+import { send } from '../src/gitea-grant.mjs';
+import { fakeGiteaApi } from './fake-gitea-api.mjs';
+import { hireDecisions } from '../../organization/src/hire-decisions.mjs';
+import { organizationWriter } from '../../organization/src/organization.mjs';
+import { checkRootAgents } from '../../organization/src/agent-levels.mjs';
+import { loadWithCopies, materializeCopies, promoteCopies } from '../../organization/src/agent-copies.mjs';
+import { activateOrg, reserveOrg } from '../../organization/src/org-registry.mjs';
+import { copyBotLogin } from '../../organization/src/copy-bindings.mjs';
+import { businessDoc, rolesCopy, writeJson } from '../../organization/tests/helpers.mjs';
+
+const SUBJECT = { provider: 'test', iss: 'https://issuer.test', sub: 'owner' };
+const READ = { gitea: { scopes: ['read:repository', 'read:user'], projects: ['stack'] } };
+const WRITE = { gitea: { scopes: ['read:user', 'write:repository'], projects: ['stack'] } };
+const ahead = (days) => new Date(Date.now() + days * 86400000).toISOString().slice(0, 10);
+const CODES = ['restart-required', 'credential-revoked', 'credential-revoking', 'credential-unavailable', 'credential-expired',
+  'copy-authority-changed', 'copy-request-refused', 'copy-redirect-refused', 'organization-changed', 'organization-unreadable'];
+
+// demo with the project stack on the fake Gitea and the root copy rev (research, which needs gitea
+// alone; a binding may be narrower than the role). The
+// owner binds rev with `services` and, unless `issue` is false, issues one live token for it (CB2).
+// `gate` is the CB3 gate on the boot snapshot; `boot()` runs its boot check and returns the broker's
+// business with the copies it proved promoted, as runtime.mjs does.
+async function fixture(t, { services = READ, perm = 'read', issue = true, definition = 'research', budgets = {} } = {}) {
+  let clock = Date.now();
+  const root = mkdtempSync(join(tmpdir(), 'cb3-')), rolesDir = rolesCopy(root);
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const api = await fakeGiteaApi(t, root);
+  const doc = { ...businessDoc(root, 'demo'), plugins: { harness: ['pi'] }, vars: { 'bus.tester': true } };
+  doc.projects.stack.remote = `${api.url}/owner/stack`;
+  const file = writeJson(join(root, 'businesses/demo.json'), doc);
+  const dataRoot = join(root, 'data'); mkdirSync(dataRoot, { mode: 0o700 });
+  const ctx = { configDir: root, dataRoot, instance: 'test' };
+  await reserveOrg(ctx, 'demo'); await activateOrg(ctx, 'demo');
+  const snapshot = materializeCopies({ orgId: 'demo', doc, root: { state: 'ok', ...checkRootAgents({ agentsVersion: 1, agents: { rev: { definition } } }, { rolesDir }) }, rolesDir });
+  const writer = organizationWriter({ dir: root, rolesDir }), store = new Store(dataRoot);
+  t.after(() => store.close());
+  const service = hireDecisions({ writer, rolesDir, dataRoot, configDir: root, assertClean: () => {}, copies: (id) => snapshot.org === id ? snapshot : null });
+  const storeRoot = join(root, 'secrets', 'agents');
+  mkdirSync(storeRoot, { recursive: true, mode: 0o700 }); chmodSync(join(root, 'secrets'), 0o700);
+  const credentials = new Credentials({ references: {}, storeRoot, repoRoots: [], dataRoot: '/nonexistent-data' });
+  // Every request the gate sends, with what the test lets through; `hold` parks one until released.
+  const sent = [];
+  const transport = async (req) => { sent.push(`${req.method} ${req.path.split('?')[0]}`); return send(req); };
+  const gate = copyLaunchGate({ credentials, writer, configDir: root, rolesDir, snapshot, transport, ca: api.ca, timeoutMs: 3000, now: () => new Date(clock), ...budgets });
+  const advance = (days) => { clock += days * 86400000; };
+  let promoted = snapshot;
+  const business = () => {
+    const d = loadWithCopies('demo', { dir: root, rolesDir, snapshot: promoted });
+    return { ...d, roles: Object.fromEntries(Object.entries(d.roles).map(([n, e]) => [n, { ...d.definitions?.[e.definition], ...e }])) };
+  };
+  const issueGrant = (...a) => copyGrant({ credentials, writer, copies: snapshot, organizations: () => ['demo'], ca: api.ca, timeoutMs: 3000 })(...a);
+  const b = new Broker({ store, businesses: { demo: business() }, copyLaunch: gate,
+    hires: { ...service, apply: async (...args) => { const r = await service.apply(...args); b.reloadBusiness('demo', business()); return r; } },
+    credentialVerbs: () => { throw new BusError('credential-unknown'); }, copyGrant: (...a) => issueGrant(...a) });
+  const owner = b.bindConsole({ business: 'demo', human: 'jason', subject: SUBJECT });
+  const human = b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+  const call = (cap, verb, args = {}) => Promise.resolve().then(() => b.request(cap, { verb, args }));
+  const rec = () => JSON.parse(readFileSync(file, 'utf8')).copyBindings?.rev;
+  const repo = api.addRepo('owner', 'stack');
+  api.addRepo('owner', 'other');
+  await call(owner, 'hire.start.console', { op: 'change', level: 'root', name: 'rev', reason: 'Bind the copy', binding: { services } });
+  const r = rec();
+  const login = copyBotLogin(r.orgIncarnation, r.copyId, 'gitea');
+  const bot = api.addUser(login).user;
+  repo.collaborators.push(login); repo.permissions[login] = perm;
+  const scopes = services.gitea.scopes;
+  const reissue = (scopesNow = scopes) => call(human, 'credentials.issue', { agent: 'rev', service: 'gitea', date: ahead(30), token: api.addToken(login, `t${api.issued.length}`, scopesNow).sha1 });
+  if (issue) await reissue();
+  const boot = async () => {
+    await gate.boot('demo');
+    promoted = promoteCopies(snapshot, gate.bound());
+    b.reloadBusiness('demo', business());
+  };
+  const slot = join(storeRoot, 'demo', 'rev', 'gitea');
+  // A run of rev, bound with the authority the launcher's prepare returned.
+  // rev is a thread instance, so each run takes a thread of its own in the stack project.
+  let project = null;
+  const threadFor = async (run) => {
+    project ??= (await call(human, 'project.create', { name: 'stack work', repo: 'stack' })).id;
+    return (await call(human, 'thread.create', { project, name: run, instance: 'rev' })).id;
+  };
+  const launch = async (run = 'rev-run') => {
+    const thread = await threadFor(run);
+    const revision = writer.read('demo').revision;
+    const { authority } = await gate.prepare('demo', 'rev', revision);
+    return { authority, thread, cap: b.bindLaunch({ business: 'demo', role: 'rev', run, harness: 'pi', thread, copyAuthority: authority, revision }) };
+  };
+  const use = (cap, request) => Promise.resolve().then(() => gate.call(b.copySession(cap), request));
+  const GET = { method: 'GET', path: '/api/v1/repos/owner/stack' };
+  // The organization file edited in place, as an owner's editor would.
+  const edit = (fn) => {
+    const d = JSON.parse(readFileSync(file, 'utf8'));
+    fn(d);
+    writeFileSync(file, JSON.stringify(d, null, 2) + '\n');
+  };
+  // The next request matching `match` waits at the fake server until release() lets it through.
+  const hold = (match) => {
+    let release, arrived;
+    const go = new Promise((r) => { release = r; });
+    const seen = new Promise((r) => { arrived = r; });
+    const unrule = api.rule((e, body) => match(e, body), async () => { unrule(); arrived(); await go; return { pass: true }; });
+    return { release: () => release(), arrived: seen };
+  };
+  // Gate requests to the copy's repositories (the proof's /version, /token and /user routes aside).
+  const repoCalls = () => sent.filter((x) => x.includes('/api/v1/repos/')).length;
+  return { root, rolesDir, edit, hold, advance, repoCalls, file, api, b, gate, threadFor, writer, credentials, owner, human, call, rec, bot, login, repo, reissue, boot, slot, launch, use, sent, GET, storeRoot, snapshot, business };
+}
+
+const refuses = (code) => (e) => { assert.ok(e instanceof BusError, String(e?.stack ?? e)); assert.equal(e.code, code); return true; };
+
+test('CB3 every new refusal code is in the refusal table with a rail and a next step naming no path', () => {
+  for (const code of CODES) {
+    const entry = REFUSALS[code];
+    assert.ok(entry, code);
+    assert.match(entry.rail, /^R\d+[/:]/, code);
+    assert.ok(entry.nextStep.length > 20, code);
+    assert.ok(!/(^|\s)(\/|~\/)\S/.test(entry.nextStep), `${code} names a path`);
+  }
+});
+
+test('CB3 a copy bound before boot is proved live at boot and launches; prepare, admission and bindLaunch carry one authority', async (t) => {
+  const f = await fixture(t);
+  assert.equal(f.rec().state, 'bound');
+  await f.boot();
+  assert.deepEqual(f.gate.bound(), { rev: ['gitea'] });
+  const role = f.b.taskRoles('demo').rev;
+  assert.deepEqual([role.copyBound, role.credentials], [['gitea'], {}]);
+  const { authority, cap } = await f.launch();
+  assert.match(authority, /^[0-9a-f]{64}$/);
+  assert.equal(f.gate.authority('demo', 'rev').authority, authority);
+  // The live proof at prepare went to the bound origin as the copy's account.
+  assert.ok(f.sent.includes('GET /api/v1/token'));
+  const r = await f.use(cap, f.GET);
+  assert.equal(r.status, 200);
+  assert.equal(r.json.full_name, 'owner/stack');
+  assert.ok(!JSON.stringify(r).includes(f.api.issued.at(-1)));
+  // bindLaunch refuses a bound copy without the authority, or with another one.
+  const r2 = await f.threadFor('r2'), r3 = await f.threadFor('r3');
+  assert.throws(() => f.b.bindLaunch({ business: 'demo', role: 'rev', run: 'r2', harness: 'pi', thread: r2 }), refuses('copy-authority-changed'));
+  assert.throws(() => f.b.bindLaunch({ business: 'demo', role: 'rev', run: 'r3', harness: 'pi', thread: r3, copyAuthority: 'f'.repeat(64) }), refuses('copy-authority-changed'));
+  // A non-copy never carries one.
+  assert.throws(() => f.b.bindLaunch({ business: 'demo', role: 'chief', run: 'c1', harness: 'pi', copyAuthority: authority }), refuses('invalid-request'));
+});
+
+test('CB3 a binding approved after boot answers restart-required at every launch step and sends nothing', async (t) => {
+  const f = await fixture(t, { issue: false });
+  assert.notEqual(f.rec().state, 'bound');
+  await f.boot();
+  assert.deepEqual([f.gate.bound(), f.sent], [{}, []]);
+  // The owner issues the grant now: the record is bound and granted, but the boot didn't prove it.
+  await f.reissue();
+  assert.equal(f.rec().state, 'bound');
+  assert.equal(f.b.taskRoles('demo').rev, undefined);
+  assert.throws(() => f.gate.authority('demo', 'rev'), refuses('restart-required'));
+  await assert.rejects(f.gate.prepare('demo', 'rev'), refuses('restart-required'));
+  assert.throws(() => f.gate.admit('demo', 'rev', 'f'.repeat(64)), refuses('restart-required'));
+  // The verb says so too, before its own unbound refusal.
+  await assert.rejects(f.call(f.human, 'instance.launch', { instance: 'rev' }), refuses('restart-required'));
+  assert.deepEqual(f.sent, []);
+});
+
+test('CB3 a partial binding (a role needing gitea and vikunja, bound for gitea alone) never launches and its boot sends nothing', async (t) => {
+  const f = await fixture(t, { definition: 'reviewer' });
+  assert.equal(f.rec().state, 'bound');
+  await f.boot();
+  assert.deepEqual([f.gate.bound(), f.sent], [{}, []]);
+  assert.throws(() => f.gate.authority('demo', 'rev'), refuses('credential-scope-unverified'));
+  await assert.rejects(f.gate.prepare('demo', 'rev'), refuses('credential-scope-unverified'));
+  await assert.rejects(f.call(f.human, 'instance.launch', { instance: 'rev' }), refuses('credential-scope-unverified'));
+  assert.deepEqual(f.sent, []);
+});
+
+test('CB3 a redirect from the bound origin is refused and never followed', async (t) => {
+  const f = await fixture(t);
+  await f.boot();
+  const { cap } = await f.launch();
+  f.api.rule((e) => e.path === '/api/v1/repos/owner/stack', { status: 302 });
+  await assert.rejects(f.use(cap, f.GET), refuses('copy-redirect-refused'));
+  assert.equal(f.api.requests.filter((e) => e.path.startsWith('/api/v1/repos/')).length, 1);
+});
+
+test('CB3 a call reaches only the admitted repositories, by the methods the binding allows, with no body on a read', async (t) => {
+  const f = await fixture(t);
+  await f.boot();
+  const { cap } = await f.launch();
+  for (const request of [
+    { method: 'GET', path: '/api/v1/repos/owner/other' },
+    { method: 'GET', path: '/api/v1/repos/owner/stack/../other' },
+    { method: 'GET', path: '/api/v1/repos/owner/stack/%2e%2e/other' },
+    { method: 'GET', path: '/api/v1/user' },
+    { method: 'GET', path: 'https://evil.test/api/v1/repos/owner/stack' },
+    { method: 'GET', path: '//evil.test/api/v1/repos/owner/stack' },
+    { method: 'GET', path: '/api/v1/repos/owner/stack', body: { x: 1 } },
+    { method: 'POST', path: '/api/v1/repos/owner/stack/issues', body: { title: 'x' } },
+    { method: 'TRACE', path: '/api/v1/repos/owner/stack' },
+    { service: 'vikunja', method: 'GET', path: '/api/v1/repos/owner/stack' },
+  ]) await assert.rejects(f.use(cap, request), refuses('copy-request-refused'), JSON.stringify(request));
+  assert.equal(f.repoCalls(), 0);
+  // The session, never the arguments, names who the call is for.
+  await assert.rejects(f.gate.call({ business: 'demo', role: 'rev', copyAuthority: 'f'.repeat(64) }, f.GET), refuses('copy-authority-changed'));
+  assert.throws(() => f.b.copySession(f.human), refuses('copy-request-refused'));
+  assert.equal(f.repoCalls(), 0);
+});
+
+test('CB3 a write binding reaches its repository by POST as the copy\'s account (a READ binding is refused above)', async (t) => {
+  const f = await fixture(t, { services: WRITE, perm: 'write' });
+  await f.boot();
+  const { cap } = await f.launch();
+  f.api.rule((e) => e.method === 'POST' && e.path === '/api/v1/repos/owner/stack/issues', { status: 201, json: { number: 1 } });
+  const r = await f.use(cap, { method: 'POST', path: '/api/v1/repos/owner/stack/issues', body: { title: 'x' } });
+  assert.deepEqual(r, { status: 201, json: { number: 1 } });
+  const seen = f.api.requests.filter((e) => e.path === '/api/v1/repos/owner/stack/issues');
+  assert.deepEqual(seen.map((e) => [e.method, e.as]), [['POST', f.login]]);
+});
+
+test('CB3 a re-issue, a replaced slot or rewritten token bytes deny the next call with no request and no cached token', async (t) => {
+  for (const [name, change, code] of [
+    ['re-issue', (f) => f.reissue(), 'restart-required'],
+    ['slot replaced', (f) => { writeFileSync(f.slot + '.n', 'x'.repeat(40), { mode: 0o600 }); renameSync(f.slot + '.n', f.slot); }, 'credential-unavailable'],
+    ['bytes rewritten', (f) => writeFileSync(f.slot, readFileSync(f.slot, 'utf8').replace(/[0-9a-f]{40}/, '0'.repeat(40))), 'credential-unavailable'],
+    ['slot removed', (f) => unlinkSync(f.slot), 'credential-unavailable'],
+    ['mode widened', (f) => chmodSync(f.slot, 0o644), 'credential-unavailable'],
+  ]) {
+    await t.test(name, async (t) => {
+      const f = await fixture(t);
+      await f.boot();
+      const { cap } = await f.launch();
+      assert.equal((await f.use(cap, f.GET)).status, 200);
+      const before = f.sent.length;
+      await change(f);
+      // The bus's session lookup refuses the run itself, before the gate's own check.
+      assert.throws(() => f.b.copySession(cap), refuses(code));
+      await assert.rejects(f.use(cap, f.GET), refuses(code));
+      // No new launch either.
+      await assert.rejects(f.gate.prepare('demo', 'rev'), refuses(code));
+      assert.deepEqual(f.sent.slice(before), []);
+    });
+  }
+});
+
+test('CB3 a revoke while a call is in flight denies that call\'s answer and the next call', async (t) => {
+  const f = await fixture(t);
+  await f.boot();
+  const { cap } = await f.launch();
+  const h = f.hold((e) => e.path === '/api/v1/repos/owner/stack');
+  const pending = f.use(cap, f.GET);
+  await h.arrived;
+  await f.reissue();
+  h.release();
+  await assert.rejects(pending, refuses('restart-required'));
+  const before = f.sent.length;
+  await assert.rejects(f.use(cap, f.GET), refuses('restart-required'));
+  assert.equal(f.sent.length, before);
+});
+
+test('CB3 a grant change in flight fences the copy: nothing is admitted or sent until it ends, and an unknown outcome keeps the fence', async (t) => {
+  const f = await fixture(t);
+  await f.boot();
+  const { cap } = await f.launch();
+  const r2 = await f.threadFor('r2');
+  const authority = f.gate.authority('demo', 'rev').authority;
+  // The owner's re-issue holds at its live proof; the copy is fenced meanwhile.
+  const h = f.hold((e) => e.path === '/api/v1/version');
+  const issuing = f.reissue();
+  await h.arrived;
+  const before = f.sent.length;
+  assert.equal(f.gate.revoking('demo', 'rev'), true);
+  assert.throws(() => f.gate.authority('demo', 'rev'), refuses('credential-revoking'));
+  assert.throws(() => f.gate.admit('demo', 'rev', authority), refuses('credential-revoking'));
+  await assert.rejects(f.gate.prepare('demo', 'rev'), refuses('credential-revoking'));
+  assert.throws(() => f.b.bindLaunch({ business: 'demo', role: 'rev', run: 'r2', harness: 'pi', thread: r2, copyAuthority: authority }), refuses('credential-revoking'));
+  await assert.rejects(f.use(cap, f.GET), refuses('credential-revoking'));
+  assert.equal(f.sent.length, before);
+  h.release();
+  await issuing;
+  assert.equal(f.gate.revoking('demo', 'rev'), false);
+  assert.throws(() => f.gate.authority('demo', 'rev'), refuses('restart-required'));
+  // A definite refusal lifts the fence; an unknown outcome, a system error or a codeless throw keeps it.
+  await assert.rejects(f.gate.fence('demo', 'rev', () => { throw new BusError('credential-date'); }), refuses('credential-date'));
+  assert.equal(f.gate.revoking('demo', 'rev'), false);
+  for (const thrown of [new BusError('outcome-unknown'), Object.assign(new Error('disk'), { code: 'ENOSPC' }), new Error('bug')]) {
+    const g = await fixture(t);
+    await g.boot();
+    await assert.rejects(g.gate.fence('demo', 'rev', () => { throw thrown; }));
+    assert.equal(g.gate.revoking('demo', 'rev'), true, String(thrown.code));
+    await assert.rejects(g.gate.prepare('demo', 'rev'), refuses('credential-revoking'));
+    assert.deepEqual(g.sent.filter((x) => !x.startsWith('GET /api/v1/version') && !x.startsWith('GET /api/v1/token') && !x.startsWith('GET /api/v1/user')), []);
+  }
+});
+
+// Each change lands while prepare's live proof is at the server (between the authority before and
+// after), then again between prepare and bindLaunch, then between bindLaunch and the first use. None
+// may end in a request to the copy's repositories.
+const RACES = [
+  ['role definition changed', (f) => writeFileSync(join(f.rolesDir, 'research.md'), readFileSync(join(f.rolesDir, 'research.md'), 'utf8') + '\nChanged.\n')],
+  ['binding generation moved', (f) => f.edit((d) => { d.copyBindings.rev.generation += 1; })],
+  ['binding unbound', (f) => f.edit((d) => { d.copyBindings.rev.state = 'unbound'; })],
+  ['grant scopes narrowed', (f) => f.edit((d) => { d.copyBindings.rev.services.gitea.scopes = ['read:user']; })],
+  ['token bytes rewritten', (f) => writeFileSync(f.slot, readFileSync(f.slot, 'utf8').replace(/[0-9a-f]{40}/, '0'.repeat(40)))],
+  ['project remote moved', (f) => f.edit((d) => { d.projects.stack.remote = 'https://elsewhere.test/owner/stack'; })],
+  ['project removed', (f) => f.edit((d) => { delete d.projects.stack; })],
+  ['project excludes the copy', (f) => f.edit((d) => { d.projects.stack.agents = { ...d.projects.stack.agents, rev: { exclude: true } }; })],
+];
+
+test('CB3 a change during prepare\'s live proof refuses the launch with no repository request', async (t) => {
+  for (const [name, change] of RACES) {
+    await t.test(name, async (t) => {
+      const f = await fixture(t);
+      await f.boot();
+      const h = f.hold((e) => e.path === '/api/v1/token');
+      const preparing = f.gate.prepare('demo', 'rev');
+      await h.arrived;
+      await change(f);
+      h.release();
+      await assert.rejects(preparing, (e) => e instanceof BusError && /^(copy-|credential-|restart-)/.test(e.code));
+      assert.equal(f.repoCalls(), 0);
+    });
+  }
+});
+
+test('CB3 a change between prepare and bindLaunch, or between bindLaunch and use, refuses with no repository request', async (t) => {
+  for (const [name, change] of RACES) {
+    await t.test(`${name} before bind`, async (t) => {
+      const f = await fixture(t);
+      await f.boot();
+      const thread = await f.threadFor('r1');
+      const { authority } = await f.gate.prepare('demo', 'rev');
+      await change(f);
+      assert.throws(() => f.b.bindLaunch({ business: 'demo', role: 'rev', run: 'r1', harness: 'pi', thread, copyAuthority: authority }),
+        (e) => e instanceof BusError && /^(copy-|credential-|restart-)/.test(e.code));
+      assert.equal(f.repoCalls(), 0);
+    });
+    await t.test(`${name} before use`, async (t) => {
+      const f = await fixture(t);
+      await f.boot();
+      const { cap } = await f.launch();
+      await change(f);
+      await assert.rejects(f.use(cap, f.GET), (e) => e instanceof BusError && /^(copy-|credential-|restart-|run-)/.test(e.code));
+      assert.equal(f.repoCalls(), 0);
+    });
+  }
+});
+
+// The organization's registry entry rewritten in place (mode kept), as a lifecycle change would.
+const registryEdit = (f, fn) => {
+  const file = join(f.root, 'org-runtime.json');
+  const d = JSON.parse(readFileSync(file, 'utf8'));
+  fn(d.orgs.demo, d);
+  writeFileSync(file, JSON.stringify(d, null, 2) + '\n');
+};
+
+test('CB3 an organization no longer active admits and sends nothing, with the binding and incarnation unchanged', async (t) => {
+  for (const state of ['archived', 'deleting', 'reserved']) {
+    await t.test(`${state} after launch`, async (t) => {
+      const f = await fixture(t);
+      await f.boot();
+      const { cap, authority } = await f.launch();
+      registryEdit(f, (e) => { e.state = state; });
+      const before = f.sent.length;
+      assert.throws(() => f.gate.authority('demo', 'rev'), refuses('credential-revoked'));
+      assert.throws(() => f.gate.admit('demo', 'rev', authority), refuses('credential-revoked'));
+      await assert.rejects(f.gate.prepare('demo', 'rev'), refuses('credential-revoked'));
+      await assert.rejects(f.use(cap, f.GET), refuses('credential-revoked'));
+      assert.equal(f.sent.length, before);
+      assert.equal(f.repoCalls(), 0);
+    });
+  }
+  await t.test('archived while prepare\'s proof is at the server', async (t) => {
+    const f = await fixture(t);
+    await f.boot();
+    const h = f.hold((e) => e.path === '/api/v1/token');
+    const preparing = f.gate.prepare('demo', 'rev');
+    await h.arrived;
+    registryEdit(f, (e) => { e.state = 'archived'; });
+    h.release();
+    await assert.rejects(preparing, refuses('credential-revoked'));
+    assert.equal(f.repoCalls(), 0);
+  });
+  await t.test('archived before boot', async (t) => {
+    const f = await fixture(t);
+    registryEdit(f, (e) => { e.state = 'archived'; });
+    await f.boot();
+    assert.deepEqual([f.gate.bound(), f.sent], [{}, []]);
+  });
+  await t.test('registry unsafe after launch', async (t) => {
+    const f = await fixture(t);
+    await f.boot();
+    const { cap } = await f.launch();
+    chmodSync(join(f.root, 'org-runtime.json'), 0o644);
+    const before = f.sent.length;
+    await assert.rejects(f.use(cap, f.GET), refuses('credential-unavailable'));
+    assert.equal(f.sent.length, before);
+  });
+});
+
+test('CB3 an organization recreated under the same id (a new incarnation) admits and sends nothing for the old copy', async (t) => {
+  const f = await fixture(t);
+  await f.boot();
+  const { cap, authority } = await f.launch();
+  registryEdit(f, (e) => { e.incarnation = 'f'.repeat(32); });
+  const before = f.sent.length;
+  assert.throws(() => f.gate.admit('demo', 'rev', authority), refuses('credential-revoked'));
+  await assert.rejects(f.gate.prepare('demo', 'rev'), refuses('credential-revoked'));
+  await assert.rejects(f.use(cap, f.GET), refuses('credential-revoked'));
+  assert.equal(f.sent.length, before);
+});
+
+// The project points at another repository on the same server: origin, binding and slot are as
+// boot proved them, only the repositories the launch authority covers move.
+const repointed = (f) => f.edit((d) => { d.projects.stack.remote = d.projects.stack.remote.replace('/owner/stack', '/owner/other'); });
+
+test('CB3 a change while a call is in flight denies that call\'s answer, including one that moves only the launch authority', async (t) => {
+  for (const [name, change, code] of [['repository repointed', repointed, 'credential-revoked'],
+    ...RACES.filter(([n]) => ['role definition changed', 'project excludes the copy'].includes(n)).map(([n, c]) => [n, c, null])]) {
+    await t.test(name, async (t) => {
+      const f = await fixture(t);
+      await f.boot();
+      const { cap } = await f.launch();
+      const h = f.hold((e) => e.path === '/api/v1/repos/owner/stack');
+      const pending = f.use(cap, f.GET);
+      await h.arrived;
+      await change(f);
+      h.release();
+      await assert.rejects(pending, code ? refuses(code) : (e) => e instanceof BusError && /^(copy-|credential-|restart-)/.test(e.code));
+    });
+  }
+});
+
+test('CB3 a running copy session whose launch authority moved answers no agent verb', async (t) => {
+  const f = await fixture(t);
+  await f.boot();
+  const { cap } = await f.launch();
+  // Past the copy check to the holder check: the session holds no claim yet.
+  await assert.rejects(f.call(cap, 'inbox'), refuses('not-holder'));
+  repointed(f);
+  assert.doesNotThrow(() => f.gate.authority('demo', 'rev'));
+  await assert.rejects(f.call(cap, 'inbox'), refuses('copy-authority-changed'));
+});
+
+test('CB3 a binding with no repository scope sends no repository request, read or write', async (t) => {
+  const f = await fixture(t, { services: { gitea: { scopes: ['read:user'], projects: ['stack'] } } });
+  await f.boot();
+  assert.deepEqual(f.gate.bound(), { rev: ['gitea'] });
+  const { cap } = await f.launch();
+  for (const method of ['GET', 'HEAD', 'POST'])
+    await assert.rejects(f.use(cap, { method, path: '/api/v1/repos/owner/stack' }), refuses('copy-request-refused'), method);
+  assert.equal(f.repoCalls(), 0);
+});
+
+test('CB3 the organization file revision the launch resolved holds through prepare, final admission and bindLaunch', async (t) => {
+  // Same document, other bytes: the launch authority is unchanged, only the revision moves.
+  const rewrite = (f) => writeFileSync(f.file, JSON.stringify(JSON.parse(readFileSync(f.file, 'utf8'))) + '\n');
+  await t.test('changed before prepare', async (t) => {
+    const f = await fixture(t);
+    await f.boot();
+    const revision = f.writer.read('demo').revision;
+    rewrite(f);
+    const before = f.sent.length;
+    await assert.rejects(f.gate.prepare('demo', 'rev', revision), refuses('organization-changed'));
+    assert.equal(f.sent.length, before);
+  });
+  await t.test('changed during prepare\'s proof', async (t) => {
+    const f = await fixture(t);
+    await f.boot();
+    const revision = f.writer.read('demo').revision;
+    const h = f.hold((e) => e.path === '/api/v1/token');
+    const preparing = f.gate.prepare('demo', 'rev', revision);
+    await h.arrived;
+    rewrite(f);
+    h.release();
+    await assert.rejects(preparing, refuses('organization-changed'));
+  });
+  await t.test('changed after final admission, before bindLaunch', async (t) => {
+    const f = await fixture(t);
+    await f.boot();
+    const thread = await f.threadFor('r1');
+    const revision = f.writer.read('demo').revision;
+    const { authority } = await f.gate.prepare('demo', 'rev', revision);
+    f.gate.admit('demo', 'rev', authority, revision);
+    rewrite(f);
+    assert.equal(f.gate.authority('demo', 'rev').authority, authority);
+    assert.throws(() => f.gate.admit('demo', 'rev', authority, revision), refuses('organization-changed'));
+    const bind = (extra) => f.b.bindLaunch({ business: 'demo', role: 'rev', run: 'r1', harness: 'pi', thread, copyAuthority: authority, ...extra });
+    assert.throws(() => bind({ revision }), refuses('organization-changed'));
+    assert.throws(() => bind({}), refuses('organization-changed'));
+    assert.equal(f.repoCalls(), 0);
+    // The same authority on the file as it stands now binds: the refusal above was the revision's.
+    assert.ok(bind({ revision: f.writer.read('demo').revision }));
+  });
+  await t.test('a non-copy never carries a revision', async (t) => {
+    const f = await fixture(t);
+    await f.boot();
+    assert.throws(() => f.b.bindLaunch({ business: 'demo', role: 'chief', run: 'c1', harness: 'pi', revision: f.writer.read('demo').revision }), refuses('invalid-request'));
+  });
+});
+
+test('CB3 a copy past its rotation date refuses credential-expired at prepare and at the next call', async (t) => {
+  const f = await fixture(t);
+  await f.boot();
+  const { cap } = await f.launch();
+  f.advance(31);
+  const before = f.sent.length;
+  await assert.rejects(f.gate.prepare('demo', 'rev'), refuses('credential-expired'));
+  await assert.rejects(f.use(cap, f.GET), refuses('credential-expired'));
+  assert.equal(f.sent.length, before);
+});
+
+test('CB3 a boot that cannot verify proves nothing: the service unreachable, the token refused, the slot missing', async (t) => {
+  for (const [name, setup, code] of [
+    // The verifier answers an unreachable service as unverified (copy-grant.mjs verifyGiteaToken).
+    ['service down', (f) => f.api.rule(() => true, { drop: true }), 'credential-scope-unverified'],
+    ['token revoked at the service', (f) => f.api.rule((e) => e.path === '/api/v1/token', { status: 401, json: { message: 'no' } }), 'credential-scope-unverified'],
+    ['slot missing', (f) => unlinkSync(f.slot), 'credential-unavailable'],
+  ]) {
+    await t.test(name, async (t) => {
+      const f = await fixture(t);
+      setup(f);
+      await f.boot();
+      assert.deepEqual(f.gate.bound(), {});
+      assert.throws(() => f.gate.authority('demo', 'rev'), refuses(code));
+      await assert.rejects(f.call(f.human, 'instance.launch', { instance: 'rev' }), refuses(code));
+      assert.equal(f.repoCalls(), 0);
+    });
+  }
+});
+
+// The launcher's host stops on a reply later than 10 s, so a slow service must not hold prepare past
+// its budget: the proof gets no answer, the launch is refused, and nothing more is sent.
+test('CB3: a service that does not answer within the budget fails prepare and boot closed, inside the budget', { timeout: 60000 }, async (t) => {
+  await t.test('prepare', async (t) => {
+    const f = await fixture(t, { budgets: { prepareMs: 400 } });
+    await f.boot();
+    const unrule = f.api.rule((e) => e.path === '/api/v1/token', { hang: true });
+    t.after(unrule);
+    const at = Date.now();
+    await assert.rejects(f.gate.prepare('demo', 'rev'), (e) => e.code === 'credential-scope-unverified');
+    assert.ok(Date.now() - at < 2500, `prepare took ${Date.now() - at} ms`);
+    assert.equal(f.repoCalls(), 0);
+  });
+  await t.test('boot', async (t) => {
+    const f = await fixture(t, { budgets: { bootMs: 400 } });
+    const unrule = f.api.rule((e) => e.path === '/api/v1/token', { hang: true });
+    t.after(unrule);
+    const at = Date.now();
+    await f.boot();
+    assert.ok(Date.now() - at < 2500, `boot took ${Date.now() - at} ms`);
+    assert.deepEqual(f.gate.bound(), {});
+    await assert.rejects(f.gate.prepare('demo', 'rev'), (e) => e.code === 'credential-scope-unverified');
+  });
+});

packages/bus/tests/credential-verbs.test.mjs

@@ -4,13 +4,15 @@
 // scratch root only.
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { chmodSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, statSync } from 'node:fs';
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { startBroker } from '../src/runtime.mjs';
 import { Broker, CREDENTIAL_VERBS } from '../src/broker.mjs';
 import { Store } from '../src/store.mjs';
 import { businessDoc, rolesCopy, systemFor, writeJson } from '../../organization/tests/helpers.mjs';
+import { definitionPin } from '../../organization/src/copy-bindings.mjs';
+import { readTemplate } from '../../organization/src/definitions.mjs';
 
 const TOKEN = 'fake_issued_token_0123456789';
 const ROTATED = 'fake_rotated_token_9876543210';
@@ -18,16 +20,18 @@ const OTHER = 'fake_other_token_5555555555';
 const DATE = '2099-01-01';
 const role = { authority: { withinRole: ['message.send'], crossRole: [] } };
 
-async function setup(t, { storeRoot = true } = {}) {
+async function setup(t, { storeRoot = true, before = () => {}, edit = () => {} } = {}) {
   const root = mkdtempSync(join(tmpdir(), 'bus-cred-verbs-'));
   t.after(() => rmSync(root, { recursive: true, force: true }));
   const rolesDir = rolesCopy(root);
   const doc = { ...businessDoc(root, 'demo'), plugins: { harness: ['pi'] } };
+  edit(doc, rolesDir);
   doc.roles.coder.credentials.gitea = { store: true, rotateBy: DATE };
   writeJson(join(root, 'businesses/demo.json'), doc);
   mkdirSync(join(root, 'data'), { mode: 0o700 });
   if (storeRoot) mkdirSync(join(root, 'secrets', 'agents'), { mode: 0o700 });
   const store = (agent, service) => join(root, 'secrets', 'agents', 'demo', agent, service);
+  before(store);
   // The bus's resolved business carries the same references; a store one names its derived file.
   const demo = {
     id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, vars: { 'bus.tester': true },
@@ -187,3 +191,26 @@ test('#1886: a store root that exists with loose modes still refuses start', asy
   };
   await assert.rejects(startBroker({ dataRoot: join(root, 'data'), businesses: { demo }, organization: { dir: root, rolesDir, system: systemFor(root) } }), /credential-file/);
 });
+
+test('CB2 security review P2: the start sweep removes a copy slot a crashed issue left staged', async (t) => {
+  // A copy binding left pending by an issue killed after its stage, its token and a temp file on disk.
+  const pending = (doc, rolesDir) => {
+    doc.copyBindings = { rev: {
+      copyId: 'c'.repeat(32), orgIncarnation: 'a'.repeat(32), source: { level: 'root', name: 'rev', project: null },
+      definition: definitionPin('reviewer', { definitions: {}, rolesDir, readTemplate }), generation: 2, state: 'pending',
+      services: { gitea: { slot: 'self', scopes: ['read:repository', 'read:user'], resources: { projects: ['stack'] } } },
+      decision: '11111111-1111-4111-8111-111111111111' } };
+  };
+  const staged = (store) => {
+    mkdirSync(join(store('rev', 'gitea'), '..'), { recursive: true, mode: 0o700 });
+    chmodSync(join(store('rev', 'gitea'), '..', '..'), 0o700);
+    for (const name of ['gitea', 'gitea.tmp']) writeFileSync(store('rev', name), TOKEN + '\n', { mode: 0o600 });
+    mkdirSync(join(store('coder', 'gitea'), '..'), { recursive: true, mode: 0o700 });
+    writeFileSync(store('coder', 'gitea'), TOKEN + '\n', { mode: 0o600 });
+  };
+  const c = await setup(t, { edit: pending, before: staged });
+  assert.equal(c.file().copyBindings.rev.state, 'pending');
+  assert.deepEqual(readdirSync(join(c.store('rev', 'gitea'), '..')), []);
+  // A role's own store slot is the store's, not the sweep's.
+  assert.equal(existsSync(c.store('coder', 'gitea')), true);
+});

packages/bus/tests/fake-gitea-api.mjs

@@ -38,13 +38,14 @@ export async function fakeGiteaApi(t, dir, { version = '1.27.1', admin = 'mosaic
     issued: [],
     // A user and, with `scopes`, one token named `tokenName`. Returns the user and that token or null.
     addUser(login, { is_admin = false, prohibit_login = false, full_name = login, email = `${login}@example.test`, scopes = null, tokenName = 'test' } = {}) {
-      const u = { id: nextId++, login, email, full_name, is_admin, prohibit_login, tokens: [] };
+      const u = { id: nextId++, login, email, full_name, is_admin, prohibit_login, tokens: [], orgs: [] };
       users.set(lower(login), u);
       return { user: u, token: scopes ? api.addToken(login, tokenName, scopes) : null };
     },
-    addToken(login, name, scopes) {
+    // #1873 CB2: `expires` (an ISO instant) is reported as the token's expires_at.
+    addToken(login, name, scopes, { expires = null } = {}) {
       const u = users.get(lower(login));
-      const tok = { id: nextId++, name, sha1: fakeToken(), scopes: [...scopes].sort() };
+      const tok = { id: nextId++, name, sha1: fakeToken(), scopes: [...scopes].sort(), expires };
       u.tokens.push(tok);
       api.issued.push(tok.sha1);
       return tok;
@@ -96,7 +97,10 @@ export async function fakeGiteaApi(t, dir, { version = '1.27.1', admin = 'mosaic
     if (!who) return [401, { message: 'unauthorized' }];
     const me = who.user;
     if (method === 'GET' && path === '/api/v1/user') return [200, userJson(me)];
-    if (method === 'GET' && path === '/api/v1/token') return [200, { id: who.token.id, name: who.token.name, scopes: who.token.scopes }];
+    // Gitea 1.27 names the token's owner; #1873 CB2's verifier needs it.
+    if (method === 'GET' && path === '/api/v1/token')
+      return [200, { id: who.token.id, name: who.token.name, scopes: who.token.scopes, user: { id: me.id, login: me.login }, ...(who.token.expires ? { expires_at: who.token.expires } : {}) }];
+    if (method === 'GET' && path === '/api/v1/user/orgs') return [200, (me.orgs ?? []).map((name, i) => ({ id: 1000 + i, username: name })), (me.orgs ?? []).length];
     if (method === 'GET' && path === '/api/v1/user/repos') {
       const all = reachable(me);
       const limit = Number(query.get('limit') ?? 30);

packages/bus/tests/proxy-setup.test.mjs

@@ -0,0 +1,109 @@
+// #1873 bus side of the Console proxy setup: proxy.init with a bus-generated key, the owner-only
+// proxy.fence.clear verb, and a lock clear that re-proves restart evidence before it clears.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Broker } from '../src/broker.mjs';
+import { Store } from '../src/store.mjs';
+import { createProxyLock } from '../src/proxy-lock.mjs';
+import { REFUSALS } from '../src/refusals.mjs';
+import { validManagementKey } from '../../model-proxy/src/common.mjs';
+
+const role = { authority: { withinRole: ['message.send'], crossRole: [] } };
+const code = name => error => error.code === name;
+function fixture(t, { proxyInit = null, proxyFenceClear = null } = {}) {
+  const store = new Store(fs.mkdtempSync(join(tmpdir(), 'ps-bus-')));
+  t.after(() => store.close());
+  const b = new Broker({ store, proxyInit, proxyFenceClear, businesses: { demo: { id: 'demo', human: 'owner', arbiters: { technical: 'chief', delivery: 'chief' }, vars: { 'bus.tester': true }, roles: { chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } }, coder: role } } } });
+  return {
+    store, b,
+    human: b.bindHuman({ business: 'demo', human: 'owner', via: 'cli', outsideAgent: true }),
+    tester: b.bindTester({ business: 'demo' }), reader: b.bindReader({ business: 'demo' }),
+    agent: b.bindLaunch({ business: 'demo', role: 'coder', run: 'ps-run', harness: 'pi' }),
+  };
+}
+const events = store => JSON.stringify(store.all('SELECT body FROM events'));
+const bodies = store => store.all('SELECT body FROM events').map(r => JSON.parse(r.body));
+
+test('proxy.init generate:true makes a valid key on the bus, hands it only to init, and never returns or records it', async t => {
+  const seen = [];
+  const f = fixture(t, { proxyInit: async args => { seen.push(args); return { port: args.port ?? 18432, binary: '/fixture' }; } });
+  const result = await f.b.request(f.human, { verb: 'proxy.init', args: { generate: true, port: 18440, rotateGraceMinutes: 5 } });
+  assert.deepEqual(result, { port: 18440, binary: '/fixture' });
+  assert.equal(seen.length, 1);
+  assert.deepEqual(Object.keys(seen[0]).sort(), ['key', 'port', 'rotateGraceMinutes']);
+  assert.equal(validManagementKey(seen[0].key), true);
+  assert.match(seen[0].key, /^[A-Za-z0-9_-]{64}$/, '48 CSPRNG bytes as base64url');
+  assert.equal(JSON.stringify(result).includes(seen[0].key), false);
+  assert.equal(events(f.store).includes(seen[0].key), false);
+  assert.deepEqual(bodies(f.store).filter(b => b.call === 'proxy.init'), [{ call: 'proxy.init', port: 18440, generated: true }]);
+  await f.b.request(f.human, { verb: 'proxy.init', args: { generate: true } });
+  assert.notEqual(seen[1].key, seen[0].key, 'each init generates a fresh key');
+});
+
+test('proxy.init generate refuses agents and testers, and refuses a key with generate or generate other than true', async t => {
+  let calls = 0;
+  const f = fixture(t, { proxyInit: async () => { calls++; return { port: 18432, binary: '/fixture' }; } });
+  for (const cap of [f.agent, f.tester]) assert.throws(() => f.b.request(cap, { verb: 'proxy.init', args: { generate: true } }), code('human-required'));
+  assert.throws(() => f.b.request(f.reader, { verb: 'proxy.init', args: { generate: true } }), code('read-only'));
+  for (const args of [{ generate: true, key: 'ps-sentinel-key-0001' }, { generate: false }, { generate: 'yes' }, {}])
+    assert.throws(() => f.b.request(f.human, { verb: 'proxy.init', args }), code('invalid-request'), JSON.stringify(args));
+  assert.equal(calls, 0);
+  assert.equal(events(f.store).includes('ps-sentinel-key-0001'), false);
+  // The same verb the refusals guard does run for the owner.
+  await f.b.request(f.human, { verb: 'proxy.init', args: { generate: true } });
+  assert.equal(calls, 1);
+});
+
+test('proxy.fence.clear is owner-only, passes the evidence through, and records only the pid', async t => {
+  const seen = [];
+  const evidence = { unit: 'mosaic-proxy.service', confirmed: true, before: { pid: 1 }, after: { pid: 2 }, observedAt: new Date(0).toISOString() };
+  const f = fixture(t, { proxyFenceClear: async args => { seen.push(args); return { cleared: true, evidence: { after: { pid: 2 } } }; } });
+  for (const cap of [f.agent, f.tester]) assert.throws(() => f.b.request(cap, { verb: 'proxy.fence.clear', args: { evidence } }), code('human-required'));
+  assert.throws(() => f.b.request(f.reader, { verb: 'proxy.fence.clear', args: { evidence } }), code('read-only'));
+  assert.throws(() => f.b.request(f.human, { verb: 'proxy.fence.clear', args: {} }), code('invalid-request'));
+  assert.throws(() => f.b.request(f.human, { verb: 'proxy.fence.clear', args: { evidence, restarted: true } }), code('invalid-request'));
+  assert.equal(seen.length, 0);
+  assert.deepEqual(await f.b.request(f.human, { verb: 'proxy.fence.clear', args: { evidence } }), { cleared: true, evidence: { after: { pid: 2 } } });
+  assert.deepEqual(seen, [{ evidence }]);
+  assert.deepEqual(bodies(f.store).filter(b => b.call === 'proxy.fence.clear'), [{ call: 'proxy.fence.clear', cleared: true, pid: 2 }]);
+});
+
+test('proxy.fence.clear maps a refusal to its proxy code and a missing runtime to not-configured', async t => {
+  const f = fixture(t, { proxyFenceClear: async () => { throw Object.assign(Error('/home/x detail'), { code: 'proxy-restart-unconfirmed' }); } });
+  await assert.rejects(f.b.request(f.human, { verb: 'proxy.fence.clear', args: { evidence: {} } }), e => e.code === 'proxy-restart-unconfirmed' && !e.message.includes('/home/x'));
+  const g = fixture(t);
+  assert.throws(() => g.b.request(g.human, { verb: 'proxy.fence.clear', args: { evidence: {} } }), code('not-configured'));
+});
+
+test('a lock clear with verify: the fence an uncertain write set clears only on proof, and the receipt holds the evidence', async t => {
+  const dir = fs.mkdtempSync(join(tmpdir(), 'ps-lock-'));
+  t.after(() => fs.rmSync(dir, { recursive: true, force: true }));
+  const lock = createProxyLock({ stateDir: dir, identity: 'instance-one' });
+  await assert.rejects(lock.run(async () => { lock.fence({ org: 'acme', op: 'apikey.add' }); throw Error('outcome unknown'); }));
+  assert.throws(() => lock.assertCertain(), code('proxy-uncertain'));
+  let read = 0;
+  await assert.rejects(lock.clear({ restarted: true, read: async () => { read++; }, verify: () => { throw Object.assign(Error('no'), { code: 'proxy-restart-unconfirmed' }); } }), code('proxy-restart-unconfirmed'));
+  assert.equal(read, 0, 'an unproved restart never reads or clears');
+  assert.throws(() => lock.assertCertain(), code('proxy-uncertain'));
+  const seenFence = [];
+  const result = await lock.clear({ restarted: true, read: async () => { read++; }, verify: previous => { seenFence.push(previous); return { after: { pid: 42 } }; } });
+  assert.deepEqual(result, { cleared: true, evidence: { after: { pid: 42 } } });
+  assert.equal(seenFence[0].org, 'acme'); assert.equal(seenFence[0].op, 'apikey.add');
+  lock.assertCertain();
+  const receipt = fs.readFileSync(join(dir, 'mosaic-keys.receipts.jsonl'), 'utf8').trim().split('\n').map(JSON.parse).at(-1);
+  assert.deepEqual(receipt.evidence, { after: { pid: 42 } });
+  assert.equal(receipt.previous.org, 'acme');
+});
+
+test('every #1873 refusal code has a refusal-table entry with a next step', () => {
+  for (const c of ['proxy-admin-busy', 'proxy-key-transport', 'proxy-key-mismatch', 'proxy-restart-required', 'proxy-restart-unconfirmed', 'proxy-init-lock-held', 'proxy-init-lock-absent', 'proxy-unit-missing', 'proxy-unit-unhealthy', 'proxy-unit-failed', 'proxy-unit-exists', 'proxy-unit-path', 'proxy-unit-usage', 'proxy-install-missing', 'proxy-install-invalid', 'proxy-fetch-hash']) {
+    const entry = REFUSALS[c];
+    assert.ok(entry, c);
+    assert.equal(typeof entry.nextStep, 'string', c);
+    assert.ok(entry.nextStep.length > 20, c);
+    assert.equal(/\/(home|mnt|srv|tmp)\//.test(entry.nextStep), false, `${c} names no absolute path`);
+  }
+});

packages/business/src/repo-remote.mjs

@@ -0,0 +1,2 @@
+// Old path of packages/organization/src/repo-remote.mjs (rename design r2, stage B).
+export * from "../../organization/src/repo-remote.mjs";

packages/cli/README.md

@@ -28,6 +28,9 @@ mosaic inbox [--business <id>] [--json]
 mosaic inbox --read <id>... | --read-all [--business <id>]
 mosaic decide <decision> <option> [--note <text>] [--yes] [--business <id>]
 mosaic tasks [--business <id>] [--json]
+mosaic tasks create --title <text> --requirement <REQ-X-N> [--project <name>] [--state <state>] [--assignees <role,...>] [--priority 0-5] [--due <iso>|none] --business <id> [--json]
+mosaic tasks edit task:<n> --expect <digest> [--title <text>] [--state <state>] [--assignees <role,...>] [--priority 0-5] [--due <iso>|none] --business <id> [--json]
+mosaic tasks archive task:<n> --expect <digest> --business <id> [--json]
 mosaic agents [--business <id>] [--json] [--tester]
 mosaic trail <task|decision> [--business <id>] [--json]
 mosaic talk <role> <text> [--wait <seconds> | --follow] [--business <id>]
@@ -1276,8 +1279,15 @@ its checkout; `mosaic org project repo init ID PROJECT --local-only
 URL` selects remote mode instead. These commands never push or overwrite an
 existing repository. Local-only acceptance records the risk of losing the only
 copy. Read back with `mosaic org queue show ID [--json]` or `mosaic org project
-repo show ID PROJECT [--json]`. See `packages/organization/README.md` for the
-layout and scope. On existing CLI commands, `--org ID` is an alias for `--business ID`;
+repo show ID PROJECT [--json]`. `mosaic org project repo set ID PROJECT
+(--local-only --accept-local-loss-risk | --remote URL) --if-revision N [--json]`
+changes a project's repository later; it is refused with `project-repo-bound`
+(exit 2) while an approved or active copy binding names the project. A remote is https or ssh; its checkout's
+`origin` is set and checked once with `git ls-remote`, without credentials, and
+the receipt says `reachable`, `needs-credential` or `unreachable`. An ssh check
+does not verify the host key and says so. A copy
+credential binding supplies credentials for https Gitea remotes only. See
+`packages/organization/README.md` for the URL rules, layout and scope. On existing CLI commands, `--org ID` is an alias for `--business ID`;
 if both are supplied they must name the same ID.
 
 `mosaic org delete ID --confirm ID --if-revision N [--json]` stops the
@@ -1299,7 +1309,51 @@ require the source and deleted folder to be on the same filesystem.
 
 `mosaic org archive` and `mosaic org delete` stop the organization bus, so like
 `bus stop` they refuse inside an agent run (exit 3, agent-guard #1873), after
-their usage checks and before any config is read. `org restore` is unchanged.
+their usage checks and before any config is read.
+
+`mosaic org restore ID --if-revision N` makes the organization active and starts
+its bus, as `mosaic bus start ID --dev-local-owner --detach` does (E1, P1-4). It
+makes that verb's checks before the restore, so a stamped build or an instance
+that refuses `--dev-local-owner` refuses the restore before anything changes
+(exit 3). Starting a bus is a human action, so inside an agent run `org restore`
+refuses like `bus start` (exit 3) before any config is read. The receipt's `bus`
+names the outcome: `started` with the host pid, or `failed` with the message and
+the verb that starts it (after `mosaic bus recover ID` when a host that died left a
+stale lock). A bus that does not start leaves the restore in place;
+the command prints the receipt and exits 3. `org restore ID --if-revision N
+--no-bus` restores without starting the bus, as before, and stays open to agents.
+
+The hire form and the autonomy panel from a terminal (E2, #1873, P1-3):
+
+```
+mosaic org role-templates ORG [--json]
+mosaic org hire|change ORG --name NAME --template TEMPLATE --harness H --model M [--thinking T] [--level org|project|root] [--project P] --reason TEXT [--json]
+mosaic org fire ORG --name NAME [--level org|project|root] [--project P] --reason TEXT [--json]
+mosaic org autonomy ORG [--json]
+mosaic org autonomy ORG set --revision REV [--cross-role|--merge|--policy|--authority in|near|out] [--notices on|off] [--reverse-window-hours 1-168] [--authority-resolver NAME|""] [--json]
+mosaic org autonomy ORG review cross-role|merge|policy|authority [--json]
+```
+
+Each sends the page's own request to the running Console's org route, as
+`org reload` does, so the Console runs the same owner, `--send`, origin, body
+and session checks and the same bus verbs. `hire` and `change` read the role
+templates first and send the chosen template's name and sha256. `autonomy set`
+needs the 64-hex `--revision` that `mosaic org autonomy ORG` prints and sends every
+setting the panel sends, changing only the named ones; a stale revision is
+refused `revision-conflict`. `--authority-resolver ""` clears the resolver, as
+emptying the panel's field does, and `--reverse-window-hours` takes 1 to 168.
+These verbs need a named instance whose Console runs with `--dev-local-owner`;
+the default instance is refused with exit 3. A Console refusal exits 3 with its code and
+message, an answer that never came exits 1, an unknown template exits 2. All of
+these verbs, reads included, refuse inside an agent run (exit 3) after their
+usage checks (exit 4) and before any config is read.
+
+`mosaic tasks create|edit|archive` are the task board's three writes. The
+arguments pass the board's own check, then go to the bus as the person
+(`tasks.create`, `tasks.edit`, `tasks.archive`), so the bus runs its human,
+field, digest and archive checks. Edit and archive need the task's digest from
+`mosaic tasks --json` as `--expect`; a stale one is refused `task-conflict`
+(exit 2) and nothing is written. They refuse inside an agent run.
 
 System types are installed plug-ins. `mosaic org system-types installed` prints
 module metadata; `mosaic org system-types enabled ID` prints an organization's enabled

packages/cli/src/cli.mjs

@@ -55,6 +55,7 @@ import { agentsRootCommand, AGENTS_ROOT_USAGE, projectAgentsCommand, PROJECT_AGE
 import { ORG_CONFIG, runConfigCommand } from "../../organization/src/config-command.mjs";
 import { devCommand, DEV_USAGE, fixtureLaunchEnv, fixtureLauncherOptions } from "./dev-fixture.mjs";
 import { runCommand, RUN_USAGE } from "./run-evidence.mjs";
+import { tasksWriteCommand, TASKS_WRITE_OPS, TASKS_WRITE_USAGE } from "./tasks-write.mjs";
 
 export const USAGE = `usage:
   ${ACCOUNTS_USAGE}
@@ -63,7 +64,8 @@ export const USAGE = `usage:
   ${LIMITS_USAGE}
   ${PLUGINS_USAGE}
   ${CREDENTIALS_USAGE}
-  mosaic proxy fetch | fence status [--json] | fence clear --proxy-restarted | init [--port N] [--business ID] [--rotate-grace-minutes N] [--first-output-seconds N]
+  mosaic proxy fetch | status [--json] | fence status [--json] | fence clear --proxy-restarted | fence clear --restart [--business ID] | init [--generate-key] [--port N] [--business ID] [--rotate-grace-minutes N] [--first-output-seconds N]
+  mosaic proxy unit render|install|start|stop|restart|status [--json] | init-lock status|clear
   ${HOSTS_USAGE}
   ${GRANTS_USAGE}
   ${ORG_INSTANCES_USAGE}
@@ -81,6 +83,7 @@ export const USAGE = `usage:
   mosaic inbox --read <id>... | --read-all [--business <id>]
   mosaic decide <decision> <option> [--note <text>] [--yes] [--business <id>]
   mosaic tasks [--business <id>] [--json] [--tester]
+  ${TASKS_WRITE_USAGE}
   mosaic agents [--business <id>] [--json] [--tester]
   mosaic trail <task|decision> [--business <id>] [--json] [--tester]
   mosaic talk <role> <text> [--wait <seconds> | --follow] [--business <id>] [--tester]
@@ -770,6 +773,8 @@ export async function main(argv, io = { env: process.env, stdin: process.stdin,
   // A2 (#1873): the owner's root and project agent levels. `mosaic agents` without `root` stays the bus read.
   if (verb === "agents" && rest[0] === "root") return agentsRootCommand(rest.slice(1), io);
   if (verb === "project" && rest[0] === "agents") return projectAgentsCommand(rest.slice(1), io);
+  // E2 (#1873, P1-3): the task board's create, edit and archive, as the person (tasks-write.mjs).
+  if (verb === "tasks" && TASKS_WRITE_OPS.includes(rest[0])) return tasksWriteCommand(rest, io, (p) => callFor(p, io, deps));
   if (["inbox", "decide", "tasks", "agents", "trail"].includes(verb)) return human(verb, rest, io, deps);
   if (verb === "project" && rest[0] === "north-star") return northStarCommand(rest.slice(1), io, (p) => callFor(p, io, deps));
   if (verb === "project" && rest[0] === "interview") return interviewCommand(rest.slice(1), io);
@@ -795,7 +800,7 @@ export async function main(argv, io = { env: process.env, stdin: process.stdin,
   }
   if (verb === "plugins") return pluginsCommand(rest, io, (p) => callFor(p, io, deps));
   // Row 199 (#1697): issue and rotate read the token on stdin.
-  if (verb === "proxy") return proxyCommand(rest, io, { system: () => deps.system ?? loadSystem({ env: io.env }), callFor: p => callFor(p, io, deps), prompt: deps.promptProxyKey });
+  if (verb === "proxy") return proxyCommand(rest, io, { system: () => deps.system ?? loadSystem({ env: io.env }), callFor: p => callFor(p, io, deps), prompt: deps.promptProxyKey, ...(deps.proxyAdmin ? { admin: deps.proxyAdmin } : {}) });
   if (verb === "credentials") return credentialsCommand(rest, io, (p) => callFor(p, io, deps));
   // Row 234 (#1740, r6 E4): the host records.
   if (verb === "hosts") return hostsCommand(rest, io, (p) => callFor(p, io, deps));

packages/cli/src/host.mjs

@@ -367,7 +367,12 @@ export async function startHost({ boot, business, notifier = null, options = nul
     close(1);
   });
 
-  return Object.freeze({ path: ready.path, dataRoot, business, bindLaunch, op, beforeClose, close, done, pids: Object.freeze({ broker: broker.pid, notifier: notify?.pid ?? null }) });
+  // #1873 CB3: the copies the broker's boot proved live, names only; anything malformed counts as none.
+  const copyBound = {};
+  if (ready.copyBound && typeof ready.copyBound === "object" && !Array.isArray(ready.copyBound))
+    for (const [instance, services] of Object.entries(ready.copyBound))
+      if (Array.isArray(services) && services.every((s) => typeof s === "string")) copyBound[instance] = Object.freeze([...services]);
+  return Object.freeze({ path: ready.path, dataRoot, business, bindLaunch, op, beforeClose, close, done, copyBound: Object.freeze(copyBound), pids: Object.freeze({ broker: broker.pid, notifier: notify?.pid ?? null }) });
 }
 
 // `mosaic bus stop`: SIGTERM to the recorded host, after checking that the

packages/cli/src/launcher.mjs

@@ -147,7 +147,7 @@ import { configDir, resolveInstance, systemVars } from "../../organization/src/i
 import { organizationWriter } from "../../organization/src/organization.mjs";
 import { quietMessage } from "../../organization/src/org-registry.mjs";
 import { businessFilePath } from "../../organization/src/organization-config.mjs";
-import { copyOf, copyRefusal, loadWithCopies, projectRefusal, withCopies } from "../../organization/src/agent-copies.mjs";
+import { copyOf, copyRefusal, loadWithCopies, projectRefusal, promoteCopies, withCopies } from "../../organization/src/agent-copies.mjs";
 import { selectModelProvider } from "../../plugins/src/model-provider-selection.mjs";
 import { THREAD_DEFINITIONS } from "../../organization/src/vocabulary.mjs";
 import { limitHit } from "../../organization/src/launch.mjs";
@@ -264,6 +264,9 @@ export function createLauncher({
   if (testProxy !== null && system.proxy)
     throw Object.assign(new Error("testProxy skips P2 admission, so it is refused with system.proxy set"), { code: "test-proxy-refused" });
   const dataRoot = system.dataRoot;
+  // #1873 CB3: a copy the bus's boot proved live at its service launches as bound; the bus decides
+  // which, and admits each launch again on its own launch authority. The rest stay as booted.
+  if (copies && host.copyBound) copies = promoteCopies(copies, host.copyBound);
   function admission(generation = null) {
     try { return assertProcessing(dataRoot, generation); }
     catch (e) {
@@ -827,7 +830,19 @@ export function createLauncher({
     // asynchronous preparation read. Admission is the launch boundary; bindLaunch remains a fence.
     // #1873 A3: `revision` is the organization file check() resolved the bundle from; a file that
     // changed since (a narrow, a define's vars, an exclude) refuses, and the next launch resolves anew.
-    const finalAdmission = await host.op({ op: "request.admission", business: b.id, projects: Object.keys(codeProjects), instance, revision, thread, session });
+    // #1873 CB3: a bound copy's launch authority, after the bus re-resolved its binding and proved the
+    // slot live at the service. The final admission and bindLaunch each check it is still current.
+    let copyAuthority = null;
+    if (copyOf(b, instance)?.bound?.length) {
+      // The bus's refusal is the launch's: its code goes to the log and the thread as given.
+      let prepared;
+      try { prepared = await host.op({ op: "copyLaunch", business: b.id, instance, revision }); }
+      catch (e) { throw new Refusal(typeof e?.code === "string" && /^[a-z][a-z0-9-]*$/.test(e.code) ? e.code : "credential-unavailable", `${instance}'s bound services can't be proved live`); }
+      if (typeof prepared?.authority !== "string") throw new Refusal("credential-unavailable", `${instance}'s bound services can't be proved live`);
+      copyAuthority = prepared.authority;
+      admission(admissionGeneration);
+    }
+    const finalAdmission = await host.op({ op: "request.admission", business: b.id, projects: Object.keys(codeProjects), instance, revision, thread, session, ...(copyAuthority ? { authority: copyAuthority } : {}) });
     if (finalAdmission?.ready !== true) throw new Refusal(finalAdmission?.code ?? "project-pending");
     const managed = registerRuntime(dataRoot, { kind: 'session', business: b.id, run });
     let child;
@@ -856,7 +871,7 @@ export function createLauncher({
       admission(admissionGeneration);
       if (!outerStart) throw new Error("the session process exited at once");
       lock?.update({ run, runPid: child.pid, runStartTime: outerStart });
-      const launch = await host.bindLaunch({ business: b.id, role: instance, run, harness: model.harness, provider: model.provider, model: model.model, account, transcript, pid: child.pid, startTime: outerStart, ...(thread ? { thread, session } : {}), ...(admittedProxy ? { modelKeyId } : {}) });
+      const launch = await host.bindLaunch({ business: b.id, role: instance, run, harness: model.harness, provider: model.provider, model: model.model, account, transcript, pid: child.pid, startTime: outerStart, ...(thread ? { thread, session } : {}), ...(admittedProxy ? { modelKeyId } : {}), ...(copyAuthority ? { copyAuthority, revision } : {}) });
       bound = true;
       admission(admissionGeneration);
       entry = {

packages/cli/src/model-proxy.mjs

@@ -7,6 +7,9 @@ import { orgSelector } from './org-selector.mjs';
 import { refuseInsideAgent } from './transport.mjs';
 import { fetchPinned } from '../../model-proxy/src/fetch.mjs';
 import { validManagementKey, proxyTiming } from '../../model-proxy/src/common.mjs';
+import { createProxyAdmin } from '../../model-proxy/src/admin-control.mjs';
+import { listOrgs } from '../../organization/src/org-registry.mjs';
+import { busesStopped, instanceFromConfig } from './proxy-admin-host.mjs';
 const failure = (code, exitCode = 2) => Object.assign(new CliError(code, exitCode), { code });
 // A raw terminal suppresses echo; input is never argv, env, readline history or stdout.
 export function promptProxyKey(io, label) {
@@ -34,12 +37,90 @@ export function promptProxyKey(io, label) {
     io.stdin.setRawMode(true); io.stdin.on('data', data); io.stdin.once('end', end); io.stdin.once('error', failed); io.stdin.resume();
   });
 }
-export async function proxyCommand(args, io, { system, callFor, prompt = promptProxyKey, fetch = fetchPinned }) {
+// #1873: the setup controller the Console's Proxy page uses, for this instance. `admin` is a
+// test seam; the default runs proxy-service.sh, systemctl and the pinned fetch for real.
+function adminFor(io, system, deps) {
+  if (deps.admin) return deps.admin;
+  const config = typeof system === 'function' ? system() : system;
+  const dir = configDir(io.env);
+  return createProxyAdmin({
+    dataRoot: config.dataRoot, configDir: dir, instance: instanceFromConfig(io.env), env: io.env, fetch: deps.fetch ?? fetchPinned,
+    unitDir: deps.unitDir ?? null,
+    buses: () => busesStopped({ dataRoot: config.dataRoot, configDir: dir }),
+    orgs: async () => (await listOrgs({ configDir: dir, dataRoot: config.dataRoot })).filter(org => org.state === 'active').map(org => ({ id: org.id, proxy: 'shared', catalogue: null })),
+  });
+}
+const print = (io, value) => io.stdout.write(JSON.stringify(value) + '\n');
+const hostCode = (error, fallback) => (/^proxy-[a-z-]+$/.test(error?.code ?? '') ? error.code : fallback);
+
+// `mosaic proxy status | unit ... | init-lock ...`: host facts and actions, labels only.
+async function setupCommand(verb, rest, io, { system, deps }) {
+  const admin = adminFor(io, system, deps);
+  try {
+    if (verb === 'status') {
+      if (!(rest.length === 0 || (rest.length === 1 && rest[0] === '--json'))) throw failure('proxy-usage', 4);
+      const status = await admin.status();
+      if (rest[0] === '--json') return print(io, status);
+      const { release, init, unit, fence, initLock } = status;
+      io.stdout.write([
+        `release: ${release.fetched ? `${release.version} (panel ${release.panelVersion}) ${release.verified ? 'hashes verified' : `not verified: ${release.problem}`}` : `not fetched (pinned ${release.version})`}`,
+        `initialized: ${init.initialized ? `yes, port ${init.settings?.port}` : init.partial ? `partly (${init.files.filter(f => f.present).map(f => f.label).join(', ')})` : 'no'}`,
+        `unit: ${unit.unit} ${unit.installed ? 'installed' : 'not installed'}, ${unit.active}${unit.pid ? ` pid ${unit.pid}` : ''}${unit.port ? `, port ${unit.port} ${unit.listening ? 'answering' : 'not answering'}` : ''}`,
+        `fence: ${fence.set ? `set${fence.op ? ` after ${fence.op}` : ''}${fence.time ? ` at ${fence.time}` : ''}` : 'clear'}`,
+        `init lock: ${initLock.present ? (initLock.clearable ? 'stale, clearable' : `held: ${initLock.blockers.join('; ')}`) : 'none'}`,
+        `own proxy: ${status.ownProxy.state}`,
+        `next: ${status.next.join(', ')}`,
+      ].join('\n') + '\n');
+      return;
+    }
+    if (verb === 'unit') {
+      const [op, ...flags] = rest;
+      if (op === 'render' && flags.length === 0) { io.stdout.write((await admin.render()).text); return; }
+      if (op === 'status' && (flags.length === 0 || (flags.length === 1 && flags[0] === '--json'))) { print(io, (await admin.status()).unit); return; }
+      if (['install', 'start', 'stop', 'restart'].includes(op) && flags.length === 0) { print(io, await admin.unitAction(op)); return; }
+      throw failure('proxy-usage', 4);
+    }
+    if (verb === 'init-lock') {
+      const [op, ...flags] = rest;
+      if (flags.length !== 0) throw failure('proxy-usage', 4);
+      if (op === 'status') { print(io, (await admin.status()).initLock); return; }
+      if (op === 'clear') { print(io, await admin.initLockClear()); return; }
+      throw failure('proxy-usage', 4);
+    }
+  } catch (error) { if (error instanceof CliError) throw error; throw failure(hostCode(error, 'proxy-unit-failed')); }
+  throw failure('proxy-usage', 4);
+}
+
+export async function proxyCommand(args, io, { system, callFor, prompt = promptProxyKey, fetch = fetchPinned, ...deps }) {
   const [verb, ...rest] = args;
   if (args.includes('--tester')) throw failure('human-required', 3);
-  if (verb === 'init' || verb === 'fetch' || verb === 'fence') {
+  // #1873: every proxy verb, read or write, runs only from a human shell.
+  if (['init', 'fetch', 'fence', 'status', 'unit', 'init-lock'].includes(verb)) {
     try { refuseInsideAgent(io.env); } catch { throw failure('human-required', 3); }
   }
+  if (['status', 'unit', 'init-lock'].includes(verb)) return setupCommand(verb, rest, io, { system, deps: { ...deps, fetch } });
+  if (verb === 'fence' && rest[0] === 'clear' && rest.includes('--restart')) {
+    // #1873: restart the proxy unit, then send the restart evidence to the bus, which re-proves it
+    // on the host before it clears the fence. --business/--org names the bus.
+    const parsed = { flags: new Set(), values: {} };
+    const selector = orgSelector(() => failure('proxy-usage', 4));
+    const flags = rest.slice(1);
+    let restart = false;
+    for (let i = 0; i < flags.length; i++) {
+      if (flags[i] === '--restart' && !restart) { restart = true; continue; }
+      if (selector.owns(flags[i])) { selector.take(flags[i], flags[i + 1]); i++; continue; }
+      throw failure('proxy-usage', 4);
+    }
+    if (selector.given) parsed.values['--business'] = selector.value;
+    const call = callFor(parsed);
+    const admin = adminFor(io, system, { ...deps, fetch });
+    try {
+      const restarted = await admin.unitAction('restart');
+      if (restarted.evidence?.confirmed !== true) throw failure('proxy-restart-unconfirmed');
+      print(io, { restart: restarted.receipt, ...(await admin.fenceClear(call)) });
+      return;
+    } catch (error) { if (error instanceof CliError) throw error; throw failure(hostCode(error, 'proxy-down')); }
+  }
   if (verb === 'fence') {
     const [action, ...flags] = rest;
     if (action === 'clear' && flags.length === 0) throw failure('proxy-restart-required');
@@ -66,6 +147,7 @@ export async function proxyCommand(args, io, { system, callFor, prompt = promptP
   for (let i = 0; i < rest.length; i++) {
     const flag = rest[i];
     if (verb === 'init' && selector.owns(flag)) { selector.take(flag, rest[i + 1]); i++; continue; }
+    if (verb === 'init' && flag === '--generate-key' && !parsed.flags.has(flag)) { parsed.flags.add(flag); continue; }
     if (verb !== 'init' || !['--port', '--rotate-grace-minutes', '--first-output-seconds'].includes(flag) || parsed.values[flag] !== undefined || !rest[i + 1]) throw failure('proxy-usage', 4);
     parsed.values[flag] = rest[++i];
   }
@@ -81,7 +163,23 @@ export async function proxyCommand(args, io, { system, callFor, prompt = promptP
   try { proxyTiming(timing); } catch (error) { throw failure(error.code); }
   try {
     const config = typeof system === 'function' ? system() : system;
-    if (verb === 'fetch') { const result = await fetch({ dataRoot: config.dataRoot }); io.stdout.write(JSON.stringify({ binary: result.binary, panel: result.panel }) + '\n'); return; }
+    if (verb === 'fetch') {
+      // #1873: the page's fetch, with its progress on stderr and its receipt in proxy-admin.jsonl;
+      // stdout keeps its existing line.
+      const { result, receipt } = await adminFor(io, system, { ...deps, fetch }).fetchRun({ progress: step => io.stderr.write(`fetch: ${step}\n`) });
+      io.stderr.write(`receipt: ${JSON.stringify(receipt)}\n`);
+      io.stdout.write(JSON.stringify({ binary: result.binary, panel: result.panel }) + '\n'); return;
+    }
+    // #1873: the bus generates the key and stores it where init stores a typed key; no prompt,
+    // no terminal needed, and the key is never printed or returned.
+    if (parsed.flags.has('--generate-key')) {
+      // Through the page's controller, so the same init receipt lands in proxy-admin.jsonl.
+      const call = callFor(parsed);
+      const { settings, receipt } = await adminFor(io, system, deps).init(call, { generate: true, ...(port === undefined ? {} : { port }), ...timing });
+      io.stderr.write(`receipt: ${JSON.stringify(receipt)}\n`);
+      print(io, { ...settings, generated: true });
+      return;
+    }
     if (!io.stdin.isTTY || !io.stdout.isTTY) throw failure('proxy-terminal-required', 3);
     // Establish that the CLI is eligible before reading sensitive input. The bus verifies the proof.
     const call = callFor(parsed);

packages/cli/src/org-console.mjs

@@ -318,9 +318,10 @@ function consoleTarget(ctx) {
   const address = s.bind && s.bind !== '0.0.0.0' ? s.bind : '127.0.0.1';
   return { address, port, host: `${address}:${port}` };
 }
-function consoleCall(target, { method = 'GET', path, timeoutMs }) {
+function consoleCall(target, { method = 'GET', path, timeoutMs, body = {} }) {
   return new Promise((resolve, reject) => {
-    const headers = { host: target.host, ...(method === 'POST' ? { origin: `http://${target.host}`, 'sec-fetch-site': 'same-origin', 'content-type': 'application/json', 'content-length': 2 } : {}) };
+    const payload = method === 'POST' ? JSON.stringify(body) : undefined;
+    const headers = { host: target.host, ...(method === 'POST' ? { origin: `http://${target.host}`, 'sec-fetch-site': 'same-origin', 'content-type': 'application/json', 'content-length': Buffer.byteLength(payload) } : {}) };
     let sent = false;
     const req = httpRequest({ host: target.address, port: target.port, method, path, headers, timeout: timeoutMs }, res => {
       let text = '';
@@ -332,14 +333,14 @@ function consoleCall(target, { method = 'GET', path, timeoutMs }) {
     req.on('timeout', () => req.destroy(Object.assign(new Error('timed out'), { code: 'timeout' })));
     req.on('finish', () => { sent = true; });
     req.on('error', e => reject(Object.assign(e, { sent })));
-    req.end(method === 'POST' ? '{}' : undefined);
+    req.end(payload);
   });
 }
 // A refused connection never reached the Console. Anything else after the request left may have
 // changed something, so it is outcome-unknown and nothing is retried.
-async function consolePost(target, path, { timeoutMs, unknown }) {
+async function consolePost(target, path, { timeoutMs, unknown, body }) {
   let answer;
-  try { answer = await consoleCall(target, { method: 'POST', path, timeoutMs }); }
+  try { answer = await consoleCall(target, { method: 'POST', path, timeoutMs, body }); }
   catch (e) {
     if (e.code === 'ECONNREFUSED' && !e.sent) fail('the Console refused the connection; see mosaic console status');
     throw new CliError(`outcome unknown: ${unknown}`, 1);
@@ -374,3 +375,19 @@ export async function consoleBusRestart(ctx, id, { timeoutMs = 120000 } = {}) {
   if (answer.status !== 200 || answer.body?.outcome !== 'done' || answer.body.step !== 'bus-restart') throw refusal(answer, 'org reload');
   return answer.body;
 }
+// E2 (#1873, P1-3): the owner's org page actions from a terminal (org-owner.mjs): the hire form and
+// the autonomy page, each through the running Console's own org route, sent as the page sends it.
+// The route applies its owner, --send, origin, body and live-session checks and asks the org's own
+// bus; nothing here decides or writes anything. A GET that fails changed nothing, so it is exit 1
+// with no outcome-unknown wording; a POST that fails after it left is outcome-unknown.
+export async function consoleOrgRequest(ctx, id, { method = 'GET', path, body, timeoutMs = 30000, unknown }) {
+  if (typeof id !== 'string' || !ORG_ID.test(id)) throw new CliError('invalid organization id', 4);
+  const target = consoleTarget(ctx);
+  const route = `/api/orgs/${id}/${path}`;
+  if (method === 'POST') return consolePost(target, route, { timeoutMs, unknown, body });
+  try { return await consoleCall(target, { path: route, timeoutMs }); }
+  catch (e) {
+    if (e.code === 'ECONNREFUSED' && !e.sent) fail('the Console refused the connection; see mosaic console status');
+    throw new CliError('the Console did not answer; see mosaic console status', 1);
+  }
+}

packages/cli/src/org-owner.mjs

@@ -0,0 +1,213 @@
+// E2 (#1873, P1-3, org ruling 6): the owner's org page actions from a terminal. Each verb sends the
+// request the WebUI page sends, to the running Console's own org route (org-console.mjs
+// consoleOrgRequest), so the same route checks the owner, --send, the origin, the body and the live
+// session, and the same bus verb runs on the organization's own bus:
+//   - role-templates, hire, fire, change: the inbox hire form (public/bus.js hireSubmit), the routes
+//     /api/orgs/ID/decisions/hire/templates and /start (decision-http.mjs), the bus verbs
+//     hire.templates.console and hire.start.console.
+//   - autonomy, autonomy set, autonomy review: the org Autonomy panel (public/autonomy.js), the
+//     route /api/orgs/ID/autonomy[/review] (autonomy-http.mjs), the bus verbs autonomy.get.console,
+//     autonomy.set.console (with its revision check) and autonomy.review.console.
+// No new authority: a Console that is not the owner's, not started with --send, or not signed in
+// refuses exactly as it refuses the page. Usage errors (exit 4) come first; then every verb refuses
+// inside an agent run, before any config is read, as `org archive|delete` do (agent guard #1942).
+import { configDir } from '../../organization/src/organization-config.mjs';
+import { DEV_OWNER, devOwnerInstance } from './dev-local-owner.mjs';
+import { loadSystem } from './config.mjs';
+import { CliError } from './errors.mjs';
+import { consoleOrgRequest } from './org-console.mjs';
+import { refuseInsideAgent } from './transport.mjs';
+
+export const ORG_OWNER_VERBS = Object.freeze(['role-templates', 'hire', 'fire', 'change', 'autonomy']);
+export const ORG_OWNER_USAGE = 'mosaic org role-templates ID [--json] | hire|change ID --name NAME --template TEMPLATE --harness HARNESS --model MODEL [--thinking LEVEL] [--level org|project|root] [--project PROJECT] --reason TEXT [--json] | fire ID --name NAME [--level org|project|root] [--project PROJECT] --reason TEXT [--json] | autonomy ID [--json] | autonomy ID set --revision REV [--cross-role|--merge|--policy|--authority in|near|out] [--notices on|off] [--reverse-window-hours N] [--authority-resolver NAME|""] [--json] | autonomy ID review cross-role|merge|policy|authority [--json]';
+
+const usage = why => new CliError(`${why}\nusage: ${ORG_OWNER_USAGE}`, 4);
+const ORG_ID = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+const CLASSES = Object.freeze(['cross-role', 'merge', 'policy', 'authority']);
+const LEVELS = Object.freeze({ in: 'in the loop', near: 'near the loop', out: 'out of the loop' });
+const HIRE_VALUES = ['--name', '--template', '--harness', '--model', '--thinking', '--level', '--project', '--reason'];
+const AUTONOMY_VALUES = ['--revision', ...CLASSES.map(c => `--${c}`), '--notices', '--reverse-window-hours', '--authority-resolver'];
+
+function parse(args, values) {
+  const pos = [], got = {}, flags = new Set();
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === '--json') { if (flags.has(a)) throw usage('duplicate --json'); flags.add(a); }
+    else if (values.includes(a)) {
+      if (Object.hasOwn(got, a)) throw usage(`duplicate ${a}`);
+      if (i + 1 >= args.length || args[i + 1].startsWith('--')) throw usage(`${a} needs one value`);
+      got[a] = args[++i];
+    } else if (a.startsWith('--')) throw usage(`unknown option ${a}`);
+    else pos.push(a);
+  }
+  return { pos, values: got, json: flags.has('--json') };
+}
+
+// The hire form's body (bus.js hireSubmit), from flags. The bus's proposal checks (hire-decisions.mjs
+// prepare) run on it unchanged; these checks only refuse what the form itself would not send.
+function hireBody(op, v) {
+  const need = key => { if (!v[key]?.trim()) throw usage(`${op} needs ${key}`); return v[key]; };
+  const level = v['--level'] ?? 'org';
+  if (!['org', 'project', 'root'].includes(level)) throw usage('--level takes org, project or root');
+  if (level === 'project' ? !v['--project']?.trim() : v['--project'] !== undefined) throw usage(level === 'project' ? '--level project needs --project' : '--project goes with --level project');
+  const reason = need('--reason');
+  if (reason.length > 500) throw usage('--reason takes at most 500 characters');
+  if (op === 'fire') for (const k of ['--template', '--harness', '--model', '--thinking']) if (v[k] !== undefined) throw usage(`fire takes no ${k}`);
+  const hire = { op, level, name: need('--name'), reason, ...(level === 'project' ? { project: v['--project'] } : {}) };
+  if (op === 'fire') return { hire, template: null };
+  const template = need('--template');
+  const thinking = v['--thinking']?.trim();
+  return { hire: { ...hire, route: { harness: need('--harness'), model: need('--model'), ...(thinking ? { thinking } : {}) } }, template };
+}
+
+function autonomyChanges(v) {
+  const revision = v['--revision'];
+  if (revision === undefined) throw usage('autonomy set needs --revision, the revision mosaic org autonomy ID shows');
+  // The panel's revision is the bus's 64-hex digest of the organization (autonomy.set.console).
+  if (!/^[a-f0-9]{64}$/.test(revision)) throw usage('--revision takes the 64-hex revision mosaic org autonomy ID shows');
+  const changes = {};
+  for (const c of CLASSES) {
+    const value = v[`--${c}`];
+    if (value === undefined) continue;
+    if (!Object.hasOwn(LEVELS, value)) throw usage(`--${c} takes in, near or out`);
+    changes[c] = LEVELS[value];
+  }
+  if (v['--notices'] !== undefined) {
+    if (!['on', 'off'].includes(v['--notices'])) throw usage('--notices takes on or off');
+    changes.notices = v['--notices'] === 'on';
+  }
+  if (v['--reverse-window-hours'] !== undefined) {
+    if (!/^[1-9][0-9]{0,2}$/.test(v['--reverse-window-hours']) || Number(v['--reverse-window-hours']) > 168) throw usage('--reverse-window-hours takes a whole number of hours from 1 to 168');
+    changes.reverseWindowHours = Number(v['--reverse-window-hours']);
+  }
+  if (v['--authority-resolver'] !== undefined) changes.authorityResolver = v['--authority-resolver'];
+  if (!Object.keys(changes).length) throw usage('autonomy set needs a setting to change');
+  return { revision, changes };
+}
+
+// The panel's save sends every class with the level it shows, notices, the reverse window (24 when
+// none is set) and the resolver when one is set (autonomy.js). The terminal sends the same document
+// with the named settings changed, so an unchanged field keeps the value the page would send.
+export function autonomyDocument(current, changes) {
+  const shown = current?.autonomy ?? {};
+  const doc = Object.fromEntries(CLASSES.map(c => [c, current?.levels?.[c]]));
+  doc.notices = shown.notices === true;
+  doc.reverseWindowHours = shown.reverseWindowHours ?? 24;
+  if (shown.authorityResolver) doc.authorityResolver = shown.authorityResolver;
+  const out = { ...doc, ...changes };
+  // An empty --authority-resolver clears it: the panel leaves an emptied field out of its save.
+  if (out.authorityResolver === '') delete out.authorityResolver;
+  return out;
+}
+
+// Autonomy codes carry no message from the route; these are the panel's own words (autonomy.js).
+const AUTONOMY_GUIDANCE = {
+  'revision-conflict': 'the organization changed; read it again with mosaic org autonomy ID',
+  'autonomy-precondition': 'this move needs a separate resolver, a tested reverse, owner notices and an enforced budget covering new agents for authority; out of the loop needs a near-loop decision followed by your review of its trail',
+  'policy-reverse-unavailable': 'policy has no near-loop setting until a reverse exists',
+  'authority-limits-unavailable': 'authority cannot move out of the loop',
+  'owner-only': 'only the owner changes autonomy',
+  'read-only': 'start the Console with --send to make changes',
+  'sign-in-required': 'sign in to the Console',
+};
+// A refusal is exit 3 and changed nothing. outcome-unknown (and a 5xx the route did not name) may
+// have changed something, so it is exit 1 and nothing is retried.
+function refused(answer, what, unknown, guidance = {}) {
+  const raw = answer.body?.error;
+  const code = typeof raw === 'string' && /^[a-z-]{1,64}$/.test(raw) ? raw : `http ${answer.status}`;
+  if (code === 'outcome-unknown' || (answer.status >= 500 && !raw)) return new CliError(`outcome unknown: ${unknown}`, 1);
+  const said = typeof answer.body?.message === 'string' ? answer.body.message.slice(0, 500) : guidance[code];
+  return new CliError(`${what} refused (${code})${said ? `: ${said}` : ''}`, 3);
+}
+
+function ok(answer) { return answer.status === 200 && answer.body && typeof answer.body === 'object'; }
+
+export async function orgOwnerCommand(args, io, deps = {}) {
+  const verb = args[0];
+  const autonomy = verb === 'autonomy';
+  const p = parse(args.slice(1), autonomy ? AUTONOMY_VALUES : verb === 'role-templates' ? [] : HIRE_VALUES);
+  const id = p.pos[0];
+  if (id === undefined) throw usage(`org ${verb} takes an organization id`);
+  if (!ORG_ID.test(id)) throw usage('invalid organization id');
+  let run;
+  if (verb === 'role-templates') {
+    if (p.pos.length !== 1) throw usage('role-templates takes one organization id');
+    run = async ctx => {
+      const answer = await consoleOrgRequest(ctx, id, { method: 'POST', path: 'decisions/hire/templates', body: { business: id }, unknown: 'the templates read did not finish; nothing was changed' });
+      if (!ok(answer) || !Array.isArray(answer.body.templates)) throw answer.status === 200 ? new CliError('the Console answered without templates', 1) : refused(answer, 'role-templates', 'the templates read did not finish; nothing was changed');
+      return { value: answer.body, text: b => b.templates.length ? b.templates.map(t => `${t.name}  ${String(t.sha256 ?? '').slice(0, 12)}\n`).join('') : 'role templates: none\n' };
+    };
+  } else if (['hire', 'fire', 'change'].includes(verb)) {
+    if (p.pos.length !== 1) throw usage(`${verb} takes one organization id`);
+    const { hire, template } = hireBody(verb, p.values);
+    run = async ctx => {
+      let body = hire;
+      // The form chooses a template from the ones it read and sends its name and sha256.
+      if (template !== null) {
+        const read = await consoleOrgRequest(ctx, id, { method: 'POST', path: 'decisions/hire/templates', body: { business: id }, unknown: 'the templates read did not finish; nothing was changed' });
+        if (!ok(read) || !Array.isArray(read.body.templates)) throw refused(read, verb, 'the templates read did not finish; nothing was changed');
+        const chosen = read.body.templates.find(t => t?.name === template);
+        if (!chosen) throw new CliError(`${verb}: no role template ${JSON.stringify(template)}; see mosaic org role-templates ${id}`, 2);
+        const { route, ...rest } = hire;
+        body = { ...rest, role: { template: chosen.name, sha256: chosen.sha256 }, route };
+      }
+      const unknown = `the ${verb} may have been recorded; check mosaic inbox --business ${id} and mosaic trail before trying again`;
+      const answer = await consoleOrgRequest(ctx, id, { method: 'POST', path: 'decisions/hire/start', body: { business: id, hire: body }, timeoutMs: 120000, unknown });
+      if (!ok(answer)) throw refused(answer, verb, unknown);
+      if (typeof answer.body.id !== 'string' || answer.body.op !== 'resolved') throw new CliError(`outcome unknown: ${unknown}`, 1);
+      return { value: answer.body, text: b => `recorded decision ${b.id}: ${verb} ${hire.name} (${b.op} ${b.choice})\n` };
+    };
+  } else if (autonomy) {
+    const step = p.pos[1] ?? null;
+    if (step === null) {
+      if (p.pos.length !== 1 || Object.keys(p.values).length) throw usage('autonomy ID reads; use autonomy ID set to change it');
+      run = async ctx => {
+        const answer = await consoleOrgRequest(ctx, id, { path: 'autonomy' });
+        if (!ok(answer)) throw refused(answer, 'autonomy', 'the autonomy read did not finish; nothing was changed', AUTONOMY_GUIDANCE);
+        return { value: answer.body, text: formatAutonomy };
+      };
+    } else if (step === 'set') {
+      if (p.pos.length !== 2) throw usage('autonomy ID set takes options only');
+      const { revision, changes } = autonomyChanges(p.values);
+      run = async ctx => {
+        const read = await consoleOrgRequest(ctx, id, { path: 'autonomy' });
+        if (!ok(read)) throw refused(read, 'autonomy set', 'the autonomy read did not finish; nothing was changed', AUTONOMY_GUIDANCE);
+        const unknown = `the setting may have been saved; check mosaic org autonomy ${id} before trying again`;
+        const answer = await consoleOrgRequest(ctx, id, { method: 'POST', path: 'autonomy', body: { revision, autonomy: autonomyDocument(read.body, changes) }, unknown });
+        if (!ok(answer)) throw refused(answer, 'autonomy set', unknown, AUTONOMY_GUIDANCE);
+        return { value: answer.body, text: b => `saved autonomy for ${id}: revision ${b.revision ?? 'unknown'}${b.transaction ? `, receipt ${b.transaction}` : ''}\n` };
+      };
+    } else if (step === 'review') {
+      if (p.pos.length !== 3 || !CLASSES.includes(p.pos[2])) throw usage(`autonomy ID review takes one class: ${CLASSES.join(', ')}`);
+      if (Object.keys(p.values).length) throw usage('autonomy ID review takes no options but --json');
+      run = async ctx => {
+        const unknown = `the review may have been recorded; check mosaic trail before trying again`;
+        const answer = await consoleOrgRequest(ctx, id, { method: 'POST', path: 'autonomy/review', body: { decisionClass: p.pos[2] }, unknown });
+        if (!ok(answer)) throw refused(answer, 'autonomy review', unknown, AUTONOMY_GUIDANCE);
+        return { value: answer.body, text: () => `recorded your trail review for ${p.pos[2]} on ${id}\n` };
+      };
+    } else throw usage(`autonomy takes set or review, not ${JSON.stringify(step)}`);
+  } else throw usage(`unknown org verb ${verb}`);
+  // agent-guard (#1873): after the usage checks, before any config is read; this process's own
+  // environment as well as io.env, as org archive|delete check.
+  refuseInsideAgent(process.env);
+  refuseInsideAgent(io.env);
+  let instance;
+  try { instance = devOwnerInstance(io.env); }
+  catch (e) { throw new CliError(`${e.message}; these verbs need a named instance whose Console runs with --dev-local-owner`, 3); }
+  const system = deps.system ?? loadSystem({ env: io.env, instance });
+  const ctx = { configDir: configDir(io.env), dataRoot: system.dataRoot, instance, principal: DEV_OWNER };
+  const { value, text } = await run(ctx);
+  io.stdout.write(p.json ? `${JSON.stringify(value, null, 2)}\n` : text(value));
+}
+
+function formatAutonomy(b) {
+  const a = b.autonomy ?? {};
+  return [
+    `revision ${b.revision}${b.writable ? '' : ' (read-only: this Console takes no changes)'}`,
+    ...CLASSES.map(c => `${c}: ${b.levels?.[c] ?? 'unknown'}`),
+    `notices: ${a.notices === true ? 'on' : 'off'}`,
+    `reverse window: ${a.reverseWindowHours === undefined ? 'not set (the page offers 24 hours)' : `${a.reverseWindowHours} hours`}`,
+    `authority resolver: ${a.authorityResolver ?? 'none'}`,
+  ].join('\n') + '\n';
+}

packages/cli/src/org.mjs

@@ -1,28 +1,40 @@
 import { readFile, writeFile } from 'node:fs/promises';
 import { configDir } from '../../organization/src/organization-config.mjs';
 import { listOrgs, orgLock } from '../../organization/src/org-registry.mjs';
-import { templateRender, validateOrg, createOrg, showOrg, updateOrg, queueInit, queueShow, projectRepoInit, projectRepoShow, deleteOrg, archiveOrg, restoreOrg } from '../../organization/src/org-service.mjs';
+import { templateRender, validateOrg, createOrg, showOrg, updateOrg, queueInit, queueShow, projectRepoInit, projectRepoShow, projectRepoSet, deleteOrg, archiveOrg, restoreOrg } from '../../organization/src/org-service.mjs';
 import { installedSystemTypes } from '../../plugins/src/system-types.mjs';
 import { DEV_OWNER, devOwnerInstance } from './dev-local-owner.mjs';
 import { loadSystem } from './config.mjs';
 import { CliError } from './errors.mjs';
-import { busStopForDelete } from './org-bus.mjs';
+import { busStart, busStopForDelete } from './org-bus.mjs';
+import { assertBuildStart, assertDevInstance } from './deployment.mjs';
 import { consoleBusRestart } from './org-console.mjs';
 import { refuseInsideAgent } from './transport.mjs';
 import { definitionsCommand, DEFINITIONS_USAGE } from './org-definitions.mjs';
-export const ORG_USAGE = 'mosaic org system-types installed | system-types enabled ID | lock show|clear ID | reload ID | archive ID --if-revision N [--json] | restore ID --if-revision N [--json] | delete ID --confirm ID [--if-revision N] [--json] | template render ID [--fixture local] --output FILE | validate FILE | create ID --from FILE | show ID [--json] | list [--json] | update ID --from FILE --if-revision N | queue init ID (--local-only --accept-local-loss-risk | --remote URL) | queue show ID [--json] | project repo init ID PROJECT (--local-only --accept-local-loss-risk | --remote URL) | project repo show ID PROJECT [--json] | ' + DEFINITIONS_USAGE.slice('mosaic org '.length) + ' | config validate ID | config resolve ID INSTANCE [--project ID]';
-function parse(args) { const pos = [], values = {}, flags = new Set(); for (let i = 0; i < args.length; i++) { const a = args[i]; if (['--json', '--local-only', '--accept-local-loss-risk'].includes(a)) { if (flags.has(a)) throw new CliError(`duplicate ${a}`, 4); flags.add(a); } else if (['--fixture', '--output', '--from', '--if-revision', '--remote', '--confirm'].includes(a)) { if (values[a] !== undefined || !args[i+1] || args[i+1].startsWith('--')) throw new CliError(`${a} needs one value`, 4); values[a] = args[++i]; } else if (a.startsWith('--')) throw new CliError(`unknown option ${a}`, 4); else pos.push(a); } return { pos, values, flags }; }
+import { orgOwnerCommand, ORG_OWNER_USAGE, ORG_OWNER_VERBS } from './org-owner.mjs';
+export const ORG_USAGE = 'mosaic org system-types installed | system-types enabled ID | lock show|clear ID | reload ID | archive ID --if-revision N [--json] | restore ID --if-revision N [--no-bus] [--json] | delete ID --confirm ID [--if-revision N] [--json] | template render ID [--fixture local] --output FILE | validate FILE | create ID --from FILE | show ID [--json] | list [--json] | update ID --from FILE --if-revision N | queue init ID (--local-only --accept-local-loss-risk | --remote URL) | queue show ID [--json] | project repo init ID PROJECT (--local-only --accept-local-loss-risk | --remote URL) | project repo show ID PROJECT [--json] | project repo set ID PROJECT (--local-only --accept-local-loss-risk | --remote URL) --if-revision N [--json] | ' + DEFINITIONS_USAGE.slice('mosaic org '.length) + ' | ' + ORG_OWNER_USAGE.slice('mosaic org '.length) + ' | config validate ID | config resolve ID INSTANCE [--project ID]';
+function parse(args) { const pos = [], values = {}, flags = new Set(); for (let i = 0; i < args.length; i++) { const a = args[i]; if (['--json', '--local-only', '--accept-local-loss-risk', '--no-bus'].includes(a)) { if (flags.has(a)) throw new CliError(`duplicate ${a}`, 4); flags.add(a); } else if (['--fixture', '--output', '--from', '--if-revision', '--remote', '--confirm'].includes(a)) { if (values[a] !== undefined || !args[i+1] || args[i+1].startsWith('--')) throw new CliError(`${a} needs one value`, 4); values[a] = args[++i]; } else if (a.startsWith('--')) throw new CliError(`unknown option ${a}`, 4); else pos.push(a); } return { pos, values, flags }; }
 // A refusal names the document by label and the error by its code, never by host path or bytes (PR #1916).
 const errorCode = e => typeof e?.code === 'string' && /^E[A-Z0-9]+$/.test(e.code) ? e.code : 'unreadable';
 async function document(file) { try { return JSON.parse(await readFile(file, 'utf8')); } catch (e) { throw new CliError(`cannot read organization document: ${e instanceof SyntaxError ? 'not valid JSON' : errorCode(e)}`, 2); } }
 // agent-guard (#1873): archive and delete stop the organization's bus, so an agent run is refused
 // as it is for `mosaic bus stop`: after the usage checks, before any config is read, and checking
-// this process's own environment as well as io.env. Restore starts nothing and stays as it was.
+// this process's own environment as well as io.env. Restore starts the organization's bus (E1, P1-4),
+// so it is refused the same way unless --no-bus is given; `restore --no-bus` starts nothing.
 function refuseAgentRun(io) { refuseInsideAgent(process.env); refuseInsideAgent(io.env); }
+// E1 (P1-4): the bus a restore starts is the one `mosaic bus start ID --dev-local-owner --detach`
+// starts, after that verb's checks. The checks run before the restore, so a refusal changes nothing.
+function restoreBusCheck(system, env) {
+  try { assertBuildStart({ devOwner: true }); assertDevInstance(system, env); }
+  catch (e) { throw new CliError(`restore starts the bus as the local dev owner, and ${e.message}; restore with --no-bus, then start the bus with mosaic bus start`, 3); }
+}
+const busStartVerb = id => `mosaic bus start ${id} --dev-local-owner --detach`;
 export async function orgCommand(args, io, deps = {}) {
  try {
   // #1873 T1: the definitions verbs take their own options.
   if (args[0] === 'definitions') return await definitionsCommand(args.slice(1), io, deps);
+  // E2 (#1873, P1-3): the hire form and the autonomy panel, through the running Console (org-owner.mjs).
+  if (ORG_OWNER_VERBS.includes(args[0])) return await orgOwnerCommand(args, io, deps);
   const p = parse(args); const words = p.pos; let result; let accepted = [];
   const allowed = (flags, values) => { for (const f of p.flags) if (!flags.includes(f)) throw new CliError(`unexpected ${f}`, 4); for (const f of Object.keys(p.values)) if (!values.includes(f)) throw new CliError(`unexpected ${f}`, 4); };
   const need = key => { if (!p.values[key]) throw new CliError(`${key} is required`, 4); return p.values[key]; };
@@ -32,7 +44,7 @@ export async function orgCommand(args, io, deps = {}) {
   if (words[0] === 'reload') refuseInsideAgent(io.env);
   const revision = (r, required) => { if (r === undefined && !required) return undefined; if (!/^[1-9][0-9]*$/.test(r ?? '')) throw new CliError(r === undefined ? '--if-revision is required' : 'invalid revision', 4); return Number(r); };
   let lifecycle = null;
-  if (['archive', 'restore'].includes(words[0]) && words.length === 2) { allowed(['--json'], ['--if-revision']); lifecycle = { ifRevision: revision(p.values['--if-revision'], true) }; if (words[0] === 'archive') refuseAgentRun(io); }
+  if (['archive', 'restore'].includes(words[0]) && words.length === 2) { allowed(['--json', ...(words[0] === 'restore' ? ['--no-bus'] : [])], ['--if-revision']); lifecycle = { ifRevision: revision(p.values['--if-revision'], true) }; if (words[0] === 'archive' || !p.flags.has('--no-bus')) refuseAgentRun(io); }
   else if (words[0] === 'delete' && words.length === 2) { allowed(['--json'], ['--confirm', '--if-revision']); const ifRevision = revision(p.values['--if-revision'], false); lifecycle = { confirm: need('--confirm'), ifRevision }; refuseAgentRun(io); }
   if (words[0] === 'system-types' && words[1] === 'installed' && words.length === 2) { allowed(['--json'], []); io.stdout.write(JSON.stringify(await installedSystemTypes(), null, 2) + '\n'); return; }
   const instance = devOwnerInstance(io.env); const system = deps.system ?? loadSystem({ env: io.env, instance }); const ctx = { configDir: configDir(io.env), dataRoot: system.dataRoot, instance, principal: DEV_OWNER };
@@ -40,7 +52,24 @@ export async function orgCommand(args, io, deps = {}) {
   else if (words[0] === 'lock' && ['show', 'clear'].includes(words[1]) && words.length === 3) { allowed([], []); result = await orgLock(ctx, words[2], { clear: words[1] === 'clear' }); }
   else if (words[0] === 'create' && words.length === 2) { allowed([], ['--from']); result = await createOrg(ctx, words[1], await document(need('--from'))); }
   else if (words[0] === 'update' && words.length === 2) { allowed([], ['--from', '--if-revision']); const r = need('--if-revision'); if (!/^[1-9][0-9]*$/.test(r)) throw new CliError('invalid revision', 4); result = await updateOrg(ctx, words[1], await document(need('--from')), { ifRevision: Number(r) }); }
-  else if (['archive', 'restore'].includes(words[0]) && words.length === 2) result = words[0] === 'archive' ? await archiveOrg(ctx, words[1], { ...lifecycle, busStop: busStopForDelete }) : await restoreOrg(ctx, words[1], lifecycle);
+  else if (words[0] === 'archive' && words.length === 2) result = await archiveOrg(ctx, words[1], { ...lifecycle, busStop: busStopForDelete });
+  else if (words[0] === 'restore' && words.length === 2) {
+   const startBus = !p.flags.has('--no-bus');
+   if (startBus) restoreBusCheck(system, io.env);
+   result = await restoreOrg(ctx, words[1], lifecycle);
+   // The restore stands whatever the bus does. A bus that does not start is said so, with the verb
+   // that starts it, and the command exits 3 after printing the restore receipt.
+   if (startBus) {
+    try { const started = await (deps.busStart ?? busStart)({ ...ctx, env: io.env }, words[1], { detach: true, devLocalOwner: true, pm: false }); result = { ...result, bus: { outcome: 'started', pid: started.pid } }; }
+    catch (e) {
+     // A host that died left its lock behind; `bus start` refuses it until `bus recover` clears it.
+     const message = e instanceof CliError ? e.message : 'the bus did not start', dead = /^stale /.test(message);
+     result = { ...result, bus: { outcome: 'failed', message, next: dead ? `mosaic bus recover ${words[1]}; ${busStartVerb(words[1])}` : busStartVerb(words[1]) } };
+     io.stdout.write(JSON.stringify(result, null, 2) + '\n');
+     throw new CliError(`${words[1]} was restored, but its bus did not start: ${message}; ${dead ? `clear the dead host with mosaic bus recover ${words[1]}, then start it with` : 'start it with'} ${busStartVerb(words[1])}`, 3);
+    }
+   }
+  }
   else if (words[0] === 'delete' && words.length === 2) result = await deleteOrg(ctx, words[1], { busStop: busStopForDelete, ...lifecycle });
   // U1 (#1873): the F3 bus control from a terminal, through the running Console's own route, which
   // checks the owner and writes the action trail (org-console.mjs consoleBusRestart).
@@ -51,6 +80,9 @@ export async function orgCommand(args, io, deps = {}) {
    const project = words[0] === 'project', op = words[project ? 2 : 1], id = words[project ? 3 : 2], name = project ? words[4] : null;
    if (op === 'show') { allowed(['--json'], []); result = project ? await projectRepoShow(ctx, id, name) : await queueShow(ctx, id); }
    else if (op === 'init') { allowed(['--local-only', '--accept-local-loss-risk'], ['--remote']); if (p.flags.has('--local-only') === Boolean(p.values['--remote'])) throw new CliError('select exactly one of --local-only or --remote', 4); const opts = { mode: p.flags.has('--local-only') ? 'local-only' : 'remote', remote: p.values['--remote'], acceptLocalLossRisk: p.flags.has('--accept-local-loss-risk') }; result = project ? await projectRepoInit(ctx, id, name, opts) : await queueInit(ctx, id, opts); }
+   // #1873 P1-7: change the project's repository (remote URL, or remote to local-only and back).
+   // The same URL rules and check as init; origin follows; nothing is pushed.
+   else if (op === 'set' && project) { allowed(['--json', '--local-only', '--accept-local-loss-risk'], ['--remote', '--if-revision']); if (p.flags.has('--local-only') === Boolean(p.values['--remote'])) throw new CliError('select exactly one of --local-only or --remote', 4); const ifRevision = revision(p.values['--if-revision'], true); result = await projectRepoSet(ctx, id, name, { mode: p.flags.has('--local-only') ? 'local-only' : 'remote', remote: p.values['--remote'], acceptLocalLossRisk: p.flags.has('--accept-local-loss-risk'), ifRevision }); }
    else throw new CliError(ORG_USAGE, 4);
   } else throw new CliError(ORG_USAGE, 4);
   io.stdout.write(JSON.stringify(result, null, 2) + '\n');

packages/cli/src/proxy-admin-host.mjs

@@ -0,0 +1,49 @@
+// #1873 proxy setup: host facts that `mosaic proxy` and the Console page share. Never reads a
+// key, proxy setting or bus record; labels only, never an absolute path.
+import net from 'node:net';
+import { hostStatus } from './host.mjs';
+import { socketPath, orgPaths } from './config.mjs';
+import { devOwnerInstance } from './dev-local-owner.mjs';
+import { listOrgs } from '../../organization/src/org-registry.mjs';
+
+// A socket that accepts a connection, or fails other than "absent"/"refused", counts as running.
+function socketLive(file, timeout = 1000) {
+  return new Promise(resolve => {
+    const socket = net.connect(file);
+    const done = value => { socket.destroy(); resolve(value); };
+    socket.setTimeout(timeout, () => done(true));
+    socket.once('connect', () => done(true));
+    socket.once('error', error => done(!['ENOENT', 'ECONNREFUSED'].includes(error.code)));
+  });
+}
+
+async function rootRunning(root, socket) {
+  try {
+    const status = hostStatus(root);
+    if (status.host?.live || status.writerLock?.live) return true;
+  } catch { return true; }
+  return socketLive(socket);
+}
+
+// The init-lock README condition "the bus is stopped", proved for the instance's own bus and
+// every registered organization's bus. Anything that cannot be examined counts as running.
+// `listOrgsFn` and `running` are for tests.
+export async function busesStopped({ dataRoot, configDir, listOrgsFn = listOrgs, running = rootRunning }) {
+  const out = [];
+  if (await running(dataRoot, socketPath(dataRoot))) out.push('the instance bus');
+  let orgs;
+  try { orgs = await listOrgsFn({ configDir }); }
+  catch { return { stopped: false, running: [...out, 'organization registry unreadable'] }; }
+  for (const org of orgs) {
+    const label = `organization ${typeof org?.id === 'string' ? org.id : '?'}`;
+    let paths;
+    try { paths = orgPaths(org.root); } catch { out.push(label); continue; }
+    if (await running(org.root, paths.socket)) out.push(label);
+  }
+  return { stopped: out.length === 0, running: out };
+}
+
+// The named instance MOSAIC_CONFIG selects, or null for the default (dev) instance.
+export function instanceFromConfig(env = process.env) {
+  try { return devOwnerInstance(env); } catch { return null; }
+}

packages/cli/src/tasks-write.mjs

@@ -0,0 +1,104 @@
+// E2 (#1873, P1-3, org ruling 6): the task board's writes from a terminal. `mosaic tasks create`,
+// `edit` and `archive` send the board's three ops (workspace-tasks.mjs) to the organization's bus as
+// the person, through the human transport (U4a: the bus's tasks.create, tasks.edit and tasks.archive
+// are the person's writes "from the terminal (human-cli)"). The arguments pass the board's own
+// check, parseTaskWrite, before anything is sent, so the terminal takes exactly what the board
+// takes; the bus then runs its own human, field, digest and archive checks, as it does for the
+// board. Writes take no --tester and refuse inside an agent run (callFor), and the bus refuses any
+// caller that is not the person (human-required).
+import { parseTaskWrite } from '../../webui/src/workspace-tasks.mjs';
+import { CliError } from './errors.mjs';
+import { orgSelector } from './org-selector.mjs';
+import { refuseInsideAgent } from './transport.mjs';
+
+export const TASKS_WRITE_OPS = Object.freeze(['create', 'edit', 'archive']);
+export const TASKS_WRITE_USAGE = 'mosaic tasks create --title TEXT --requirement REQ-X-N [--project NAME] [--state STATE] [--assignees ROLE,...] [--priority 0-5] [--due ISO|none] --business <id> [--json]\n' +
+  '  mosaic tasks edit task:N --expect DIGEST [--title TEXT] [--state STATE] [--assignees ROLE,...] [--priority 0-5] [--due ISO|none] --business <id> [--json]\n' +
+  '  mosaic tasks archive task:N --expect DIGEST --business <id> [--json]';
+
+const usage = why => new CliError(`${why}\nusage: ${TASKS_WRITE_USAGE}`, 4);
+// Each op's options, as the board's op takes its keys (workspace-tasks.mjs OPS).
+const OPTIONS = {
+  create: ['--title', '--requirement', '--project', '--state', '--assignees', '--priority', '--due'],
+  edit: ['--expect', '--title', '--state', '--assignees', '--priority', '--due'],
+  archive: ['--expect'],
+};
+const KEY = { '--title': 'title', '--requirement': 'requirement', '--project': 'group', '--state': 'state', '--assignees': 'assignees', '--priority': 'priority', '--due': 'due_date', '--expect': 'expect' };
+// The board's answer when the bus refuses, by code (workspace-tasks.mjs REFUSALS), so the terminal
+// reads the same next step.
+const GUIDANCE = {
+  'human-required': 'the bus takes task changes only from a person; nothing was written',
+  'tracker-not-store': 'this organization keeps its tasks in Vikunja; nothing was written',
+  'task-conflict': 'the task changed after you read it; nothing was written. Read it again with mosaic tasks --json',
+  'task-archived': 'the task is archived; nothing was written',
+  'task-already-archived': 'the task was already archived; nothing was written',
+  'task-not-found': 'the task is not on this organization\'s bus; nothing was written',
+  'task-position-full': 'this project has no room for another task position; nothing was written',
+  'invalid-state': 'the bus does not have that state; nothing was written',
+  'unknown-role': 'an assignee is not a role in this organization; nothing was written',
+  'invalid-request': 'the bus refused the change as invalid; nothing was written',
+  'credential-leak': 'the change holds part of a stored credential, so the bus refused it; nothing was written',
+};
+
+export function parseTasksWrite(args) {
+  const op = args[0];
+  if (!TASKS_WRITE_OPS.includes(op)) throw usage(`tasks takes create, edit or archive, not ${JSON.stringify(op)}`);
+  const selector = orgSelector(usage);
+  const values = {}, positional = [];
+  let json = false;
+  for (let i = 1; i < args.length; i++) {
+    const a = args[i];
+    if (selector.owns(a)) { selector.take(a, args[i + 1]); i++; }
+    else if (a === '--json') { if (json) throw usage('duplicate --json'); json = true; }
+    else if (OPTIONS[op].includes(a)) {
+      if (Object.hasOwn(values, a)) throw usage(`duplicate ${a}`);
+      if (i + 1 >= args.length || args[i + 1].startsWith('--')) throw usage(`${a} needs one value`);
+      values[a] = args[++i];
+    } else if (a.startsWith('--')) throw usage(`tasks ${op} does not take ${a}`);
+    else positional.push(a);
+  }
+  // The organization is named before anything else is checked, so a missing --business is a usage
+  // error (exit 4) inside an agent run too, as for the org owner verbs.
+  if (!selector.given) throw usage('name the organization with --business');
+  if (positional.length !== (op === 'create' ? 0 : 1)) throw usage(op === 'create' ? 'tasks create takes no task' : `tasks ${op} takes one task, task:N`);
+  const body = op === 'create' ? {} : { task_ref: positional[0] };
+  for (const [flag, raw] of Object.entries(values)) {
+    const key = KEY[flag];
+    if (key === 'assignees') body[key] = raw === '' ? [] : raw.split(',').map(r => r.trim());
+    else if (key === 'priority') body[key] = /^[0-9]$/.test(raw) ? Number(raw) : raw;
+    else if (key === 'due_date') body[key] = raw === 'none' ? null : raw;
+    else body[key] = raw;
+  }
+  // The board's own check. Its org is the page's; here the organization is checked by the selector
+  // and the bus, so a fixed valid id stands in for it.
+  let write;
+  try { write = parseTaskWrite({ op, org: 'terminal', ...body }); }
+  catch (e) { if (typeof e?.status === 'number') throw usage(`tasks ${op}: ${e.message}`); throw e; }
+  return { op, verb: write.verb, args: write.args, json, business: selector.given ? selector.value : undefined };
+}
+
+export async function tasksWriteCommand(args, io, callFor) {
+  const write = parseTasksWrite(args);
+  // agent-guard (#1873): this process's own environment as well as io.env (callFor checks io.env),
+  // as the org owner verbs check.
+  refuseInsideAgent(process.env);
+  const parsed = { positional: [], flags: new Set(), values: write.business === undefined ? {} : { '--business': write.business } };
+  const call = callFor(parsed);
+  let result;
+  try { result = await call(write.verb, write.args); }
+  catch (e) {
+    if (e?.code === 'outcome-unknown' || e?.exitCode === 1) throw new CliError(`outcome unknown: the task change may or may not have been written; read it with mosaic tasks --json before trying again`, 1);
+    if (typeof e?.code === 'string' && Object.hasOwn(GUIDANCE, e.code)) {
+      const refused = new CliError(`tasks ${write.op} refused (${e.code}): ${GUIDANCE[e.code]}`, e.exitCode ?? 2);
+      refused.code = e.code;
+      throw refused;
+    }
+    throw e;
+  }
+  const taskRef = typeof result?.task_ref === 'string' ? result.task_ref : write.args.task_ref ?? null;
+  const digest = typeof result?.digest === 'string' ? result.digest : null;
+  // The board's answer shape (workspace-tasks.mjs), with the organization the call went to.
+  const answer = { ok: true, org: parsed.business ?? write.business ?? null, op: write.op, task_ref: taskRef, digest };
+  const done = { create: 'created', edit: 'changed', archive: 'archived' }[write.op];
+  io.stdout.write(write.json ? `${JSON.stringify(answer, null, 2)}\n` : `${done} ${taskRef}${digest ? `, digest ${digest}` : ''}\n`);
+}

packages/cli/tests/agent-copies.test.mjs

@@ -9,7 +9,7 @@ import { test } from "node:test";
 import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
 import { DatabaseSync } from "node:sqlite";
-import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, symlinkSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, symlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { businessDoc, launchDoc, tokenFile, writeJson } from "../../organization/tests/helpers.mjs";
@@ -23,6 +23,11 @@ import { bootConfig, loadSystem } from "../src/config.mjs";
 import { startTimeOf } from "../src/host.mjs";
 import { createLauncher } from "../src/launcher.mjs";
 import { fakeHarnesses, fixture, tmp, withoutHostCredentials } from "./helpers.mjs";
+import { fakeGiteaApi } from "../../bus/tests/fake-gitea-api.mjs";
+import { send as giteaSend } from "../../bus/src/gitea-grant.mjs";
+import { organizationWriter } from "../../organization/src/organization.mjs";
+import { activateOrg, reserveOrg } from "../../organization/src/org-registry.mjs";
+import { copyBotLogin } from "../../organization/src/copy-bindings.mjs";
 
 const FAKE = fileURLToPath(new URL("../../harness/tests/fixtures/fake-adapter.mjs", import.meta.url));
 const skip = sandboxProblem() ?? false;
@@ -81,10 +86,10 @@ function prepare(t, edit = (doc) => doc) {
   return { root, f, adapter };
 }
 
-async function start(t, { f, adapter }, { businessId = "acme", orgRoot } = {}) {
+async function start(t, { f, adapter }, { businessId = "acme", orgRoot, copyTransport = null, beforeBind = null } = {}) {
   const system = loadSystem({ env: f.env });
   const { trackers, ...boot } = bootConfig({ system, businessId, env: f.env, ...(orgRoot ? { orgRoot } : {}) });
-  const runtime = await startBroker(boot);
+  const runtime = await startBroker({ ...boot, ...(copyTransport ? { copyTransport } : {}) });
   const dataRoot = boot.dataRoot;
   mkdirSync(join(dataRoot, "bus-host"), { recursive: true, mode: 0o700 });
   const ops = {
@@ -104,6 +109,7 @@ async function start(t, { f, adapter }, { businessId = "acme", orgRoot } = {}) {
     lifecycleTake: (m) => runtime.lifecycleTake(m.record),
     lifecycleDelete: (m) => runtime.lifecycleDelete(m.record),
     lifecycleDone: (m) => runtime.lifecycleDone(m.record),
+    copyLaunch: (m) => runtime.copyLaunch(m),
   };
   const refusing = (what, fn) => async (m) => {
     try {
@@ -123,8 +129,11 @@ async function start(t, { f, adapter }, { businessId = "acme", orgRoot } = {}) {
       if (!Object.hasOwn(ops, m.op)) throw new BusError("invalid-host-request");
       return ops[m.op](m);
     }),
-    bindLaunch: refusing("launch bind", (r) => runtime.bindLaunch(r)),
+    bindLaunch: beforeBind
+      ? async (r) => { await beforeBind(r); return refusing("launch bind", (x) => runtime.bindLaunch(x))(r); }
+      : refusing("launch bind", (r) => runtime.bindLaunch(r)),
     beforeClose: (fn) => void hooks.push(fn),
+    copyBound: runtime.copyBound,
   };
   const logs = [];
   const launcher = createLauncher({
@@ -593,3 +602,157 @@ test("A3: a second organization boots its own copies from the same root file and
   assert.equal(sessions(b.dataRoot).includes(run.run), false);
   assert.equal(b.running("gate").length, 0);
 });
+
+// #1873 CB3: the researcher copy (research, gitea alone) bound and granted on a fake Gitea, through
+// the real bus, its boot check and the launcher. `sent` is every request the bus sends to the service.
+async function boundCopy(t) {
+  const api = await fakeGiteaApi(t, tmp(t, "cb3-api-"));
+  const p = prepare(t, (doc) => {
+    doc.projects.stack.remote = `${api.url}/owner/stack`;
+    return doc;
+  });
+  const ctx = { configDir: join(p.root, "config"), dataRoot: p.f.dataRoot, instance: "test" };
+  chmodSync(ctx.configDir, 0o700);
+  await reserveOrg(ctx, "acme");
+  await activateOrg(ctx, "acme");
+  const sent = [];
+  const copyTransport = { ca: api.ca, send: (req) => { sent.push(`${req.method} ${req.path.split("?")[0]}`); return giteaSend(req); } };
+  const repo = api.addRepo("owner", "stack");
+  const writer = organizationWriter({ dir: join(p.root, "config"), rolesDir: p.f.roles });
+  const rec = () => writer.read("acme").document.copyBindings?.researcher;
+  const day = (n) => new Date(Date.now() + n * 86400000).toISOString().slice(0, 10);
+  // Bind (the owner's console) and issue (the human), on a bus that is already up.
+  const bind = async (s) => {
+    const owner = s.runtime.broker.bindConsole({ business: "acme", human: p.f.doc.human, subject: { provider: "test", iss: "https://issuer.test", sub: "owner" } });
+    await s.runtime.broker.request(owner, { verb: "hire.start.console", args: { op: "change", level: "root", name: "researcher", reason: "Bind the copy",
+      binding: { services: { gitea: { scopes: ["read:repository", "read:user"], projects: ["stack"] } } } } });
+    const r = rec();
+    const login = copyBotLogin(r.orgIncarnation, r.copyId, "gitea");
+    api.addUser(login);
+    repo.collaborators.push(login); repo.permissions[login] = "read";
+    await s.call("credentials.issue", { agent: "researcher", service: "gitea", date: day(30), token: api.addToken(login, "t1", ["read:repository", "read:user"]).sha1 });
+    return login;
+  };
+  return { ...p, api, sent, copyTransport, rec, bind };
+}
+
+const launchEvents = (s) => existsSync(launchLogFile(s.dataRoot, "acme"))
+  ? readFileSync(launchLogFile(s.dataRoot, "acme"), "utf8").trim().split("\n").map((l) => JSON.parse(l)) : [];
+// One message to a new researcher thread, and the launcher's tick that takes it: the launch or the refusal.
+async function threadLaunch(s, name) {
+  const project = s.call("project.list").find((x) => x.name === "stack work")?.id ?? s.call("project.create", { name: "stack work", repo: "stack" }).id;
+  const thread = s.call("thread.create", { project, name, instance: "researcher" }).id;
+  s.call("thread.send", { thread, body: "hello" });
+  await s.launcher.tick();
+  return until(() => launchEvents(s).find((e) => e.thread === thread && ["launch", "refused"].includes(e.event)));
+}
+
+test("CB3: a binding approved after boot answers restart-required; after a restart the bus proves it live, and the launcher carries one launch authority to bind", { skip, timeout: 120000 }, async (t) => {
+  const p = await boundCopy(t);
+  const first = await start(t, p, { copyTransport: p.copyTransport });
+  assert.deepEqual(first.runtime.copyBound, {});
+  const login = await p.bind(first);
+  assert.equal(p.rec().state, "bound");
+  // The issue's own check (CB2) is the last request this bus sends for the copy.
+  const issued = p.sent.length;
+  assert.ok(issued > 0);
+  // Bound and granted after this boot: restart-required at the verb, at the bus's prepare, and at its admission.
+  assert.equal(refusedAt(first, "researcher").code, "restart-required");
+  const revision = organizationWriter({ dir: join(p.root, "config"), rolesDir: p.f.roles }).read("acme").revision;
+  // A copy launch carries the revision its bundle came from; without one it is not a request.
+  await assert.rejects(first.runtime.copyLaunch({ business: "acme", instance: "researcher" }), (e) => e.code === "invalid-request");
+  await assert.rejects(first.runtime.copyLaunch({ business: "acme", instance: "researcher", revision }), (e) => e.code === "restart-required");
+  assert.equal(first.runtime.admission({ business: "acme", projects: [], instance: "researcher", revision }).code, "copy-authority-changed");
+  assert.deepEqual(first.runtime.admission({ business: "acme", projects: [], instance: "researcher", revision, authority: "0".repeat(64) }), { ready: false, revision: null, code: "restart-required" });
+  assert.equal(p.sent.length, issued);
+  await first.close();
+
+  // The next boot proves the slot live as the copy's account, and the launcher sees it bound.
+  const s = await start(t, p, { copyTransport: p.copyTransport });
+  assert.deepEqual(s.runtime.copyBound, { researcher: ["gitea"] });
+  assert.ok(p.sent.slice(issued).includes("GET /api/v1/token"));
+  assert.ok(p.api.requests.filter((e) => e.path === "/api/v1/token").every((e) => e.as === login));
+  // Final admission with an empty project list still needs the authority.
+  const rev2 = organizationWriter({ dir: join(p.root, "config"), rolesDir: p.f.roles }).read("acme").revision;
+  assert.equal(s.runtime.admission({ business: "acme", projects: [], instance: "researcher", revision: rev2 }).code, "copy-authority-changed");
+  const { authority } = await s.runtime.copyLaunch({ business: "acme", instance: "researcher", revision: rev2 });
+  assert.match(authority, /^[0-9a-f]{64}$/);
+  assert.deepEqual(s.runtime.admission({ business: "acme", projects: [], instance: "researcher", revision: rev2, authority }), { ready: true, revision: null, code: null });
+  // Any other instance has no authority to carry.
+  assert.deepEqual(await s.runtime.copyLaunch({ business: "acme", instance: "gate" }), { authority: null, services: [] });
+
+  const before = p.sent.length;
+  const launched = await threadLaunch(s, "one");
+  assert.equal(launched.event, "launch", JSON.stringify(launched));
+  // The launcher's prepare proved the slot live again at launch.
+  assert.ok(p.sent.slice(before).includes("GET /api/v1/token"));
+  assert.equal(s.running("researcher").length, 1);
+  assert.equal(p.sent.filter((x) => x.includes("/api/v1/repos/")).length, 0);
+});
+
+// A reissue is a new generation: the slot the launch proved is not the slot it would use.
+const reissue = (p, s, login, name) => s.call("credentials.issue", { agent: "researcher", service: "gitea",
+  date: new Date(Date.now() + 30 * 86400000).toISOString().slice(0, 10), token: p.api.addToken(login, name, ["read:repository", "read:user"]).sha1 });
+const restarted = async (t, p, opts = {}) => {
+  const first = await start(t, p, { copyTransport: p.copyTransport });
+  const login = await p.bind(first);
+  await first.close();
+  return { login, s: await start(t, p, { copyTransport: p.copyTransport, ...opts }) };
+};
+const repoCalls = (p) => p.sent.filter((x) => x.includes("/api/v1/repos/")).length;
+
+test("CB3 race: a reissue while the launcher's live proof is in flight refuses the launch restart-required; nothing runs and no credential call is made", { skip, timeout: 120000 }, async (t) => {
+  const p = await boundCopy(t);
+  const { login, s } = await restarted(t, p);
+  let go, arrived;
+  const held = new Promise((r) => { arrived = r; });
+  const unrule = p.api.rule((e) => e.path === "/api/v1/token", async () => { unrule(); arrived(); await new Promise((r) => { go = r; }); return { pass: true }; });
+  const launching = threadLaunch(s, "raced");
+  await held;
+  await reissue(p, s, login, "t2");
+  go();
+  const event = await launching;
+  assert.equal(event.event, "refused", JSON.stringify(event));
+  assert.equal(event.code, "restart-required");
+  assert.equal(s.running("researcher").length, 0);
+  assert.equal(repoCalls(p), 0);
+});
+
+test("CB3 race: a reissue between the launcher's admission and bind refuses at bind; the spawned run is stopped and makes no credential call", { skip, timeout: 120000 }, async (t) => {
+  const p = await boundCopy(t);
+  let s, login, raced = 0;
+  ({ login, s } = await restarted(t, p, { beforeBind: async (r) => { if (r.role === "researcher" && raced++ === 0) await reissue(p, s, login, "t3"); } }));
+  const event = await threadLaunch(s, "bindrace");
+  assert.equal(raced, 1);
+  await until(() => s.running("researcher").length === 0);
+  assert.equal(repoCalls(p), 0);
+  const events = launchEvents(s).filter((e) => e.instance === "researcher");
+  // The launcher reports any bind refusal as launch-failed, naming the bus's code.
+  assert.equal(event.event, "refused", JSON.stringify(event));
+  assert.ok(events.some((e) => e.event === "refused" && e.why === "launch bind refused: restart-required"), JSON.stringify(events));
+  assert.ok(!events.some((e) => e.event === "launch"), JSON.stringify(events));
+});
+
+test("CB3 race: an organization file change between the launcher's admission and bind refuses at bind, even with the copy authority unchanged; the spawned run is stopped and makes no credential call", { skip, timeout: 120000 }, async (t) => {
+  const p = await boundCopy(t);
+  const file = join(p.root, "config", "businesses", "acme.json");
+  let s, raced = 0, authority = null;
+  // Same document, other bytes: the revision moves, the launch authority does not.
+  ({ s } = await restarted(t, p, { beforeBind: async (r) => {
+    if (r.role !== "researcher" || raced++ !== 0) return;
+    authority = r.copyAuthority;
+    writeFileSync(file, JSON.stringify(JSON.parse(readFileSync(file, "utf8"))) + "\n", { mode: 0o600 });
+  } }));
+  const event = await threadLaunch(s, "revrace");
+  assert.equal(raced, 1);
+  assert.match(authority, /^[0-9a-f]{64}$/);
+  await until(() => s.running("researcher").length === 0);
+  assert.equal(repoCalls(p), 0);
+  // The refusal was the revision's: on the file as it stands the same authority comes back.
+  const fresh = organizationWriter({ dir: join(p.root, "config"), rolesDir: p.f.roles }).read("acme").revision;
+  assert.equal((await s.runtime.copyLaunch({ business: "acme", instance: "researcher", revision: fresh })).authority, authority);
+  const events = launchEvents(s).filter((e) => e.instance === "researcher");
+  assert.equal(event.event, "refused", JSON.stringify(event));
+  assert.ok(events.some((e) => e.event === "refused" && e.why === "launch bind refused: organization-changed"), JSON.stringify(events));
+  assert.ok(!events.some((e) => e.event === "launch"), JSON.stringify(events));
+});

packages/cli/tests/agent-guard.test.mjs

@@ -40,6 +40,16 @@ const GUARDED = [
   // archive and delete stop the organization's bus (review finding 2).
   ['org', 'archive', 'alpha', '--if-revision', '1'],
   ['org', 'delete', 'alpha', '--confirm', 'alpha'],
+  // E1 (P1-4): restore starts the organization's bus unless --no-bus is given.
+  ['org', 'restore', 'alpha', '--if-revision', '1'],
+  // E2 (#1873, P1-3): the hire form and the autonomy panel from a terminal, reads included.
+  ['org', 'role-templates', 'alpha'],
+  ['org', 'hire', 'alpha', '--name', 'ada', '--template', 'worker', '--harness', 'pi', '--model', 'glm', '--reason', 'r'],
+  ['org', 'change', 'alpha', '--name', 'ada', '--template', 'worker', '--harness', 'pi', '--model', 'glm', '--reason', 'r'],
+  ['org', 'fire', 'alpha', '--name', 'ada', '--reason', 'r'],
+  ['org', 'autonomy', 'alpha'],
+  ['org', 'autonomy', 'alpha', 'set', '--revision', 'a'.repeat(64), '--merge', 'near'],
+  ['org', 'autonomy', 'alpha', 'review', 'merge'],
 ];
 
 // The CLI in this process, with the given io.env; stdout and stderr are collected.
@@ -129,7 +139,7 @@ test('consoleStart refuses a marker in its own process whatever environment it i
 
 test('usage errors still come first, so an agent sees the usage line, not the refusal', async () => {
   const env = { ...NOWHERE(), MOSAIC_AGENT_RUN: '1' };
-  for (const args of [['bus', 'stop'], ['bus', 'start'], ['bus', 'start', 'alpha', '--pm', '--no-launch'], ['console', 'stop', 'extra'], ['console', 'restart', 'extra'], ['console', 'start', '--dev-insecure-bind', '0.0.0.0'], ['console', 'start', '--dev-allow-host', 'x'], ['console', 'start', 'extra'], ['org', 'archive', 'alpha'], ['org', 'delete', 'alpha'], ['org', 'delete', 'alpha', '--confirm', 'alpha', '--if-revision', 'x']]) {
+  for (const args of [['bus', 'stop'], ['bus', 'start'], ['bus', 'start', 'alpha', '--pm', '--no-launch'], ['console', 'stop', 'extra'], ['console', 'restart', 'extra'], ['console', 'start', '--dev-insecure-bind', '0.0.0.0'], ['console', 'start', '--dev-allow-host', 'x'], ['console', 'start', 'extra'], ['org', 'archive', 'alpha'], ['org', 'restore', 'alpha'], ['org', 'restore', 'alpha', '--if-revision', '1', '--no-bus', '--no-bus'], ['org', 'delete', 'alpha'], ['org', 'delete', 'alpha', '--confirm', 'alpha', '--if-revision', 'x'], ['org', 'hire', 'alpha', '--name', 'ada'], ['org', 'fire', 'alpha'], ['org', 'autonomy', 'alpha', 'set', '--merge', 'near'], ['org', 'autonomy', 'alpha', 'review'], ['org', 'role-templates']]) {
     const r = await mosaic(env, args, 30000);
     assert.equal(r.status, 4, `${args.join(' ')}: ${r.stderr}`);
   }
@@ -247,8 +257,29 @@ test("the Console's Restart bus works: the new host runs with the Console's envi
   // An archived organization has no bus status, so the old host's /proc entry shows it stopped.
   for (let i = 0; i < 100 && existsSync(`/proc/${after.pid}`); i++) await new Promise(r => setTimeout(r, 100));
   assert.ok(!existsSync(`/proc/${after.pid}`), 'archive from a human shell stops the bus host');
-  const restored = await mosaic(env, ['org', 'restore', 'alpha', '--if-revision', String(JSON.parse(archived.stdout).revision), '--json']);
+  // E1 (P1-4): restore starts the bus, so an agent run is refused before anything changes, and
+  // `--no-bus` (which starts nothing) is the only restore an agent run may make.
+  const archivedRevision = JSON.parse(archived.stdout).revision;
+  for (const marker of ['CLAUDECODE', 'MOSAIC_AGENT_RUN']) {
+    const r = await mosaic({ ...env, [marker]: '1' }, ['org', 'restore', 'alpha', '--if-revision', String(archivedRevision), '--json']);
+    assert.equal(r.status, 3, r.stderr); assert.match(r.stderr, REFUSED(marker)); assert.equal(r.stdout, '');
+  }
+  const listed = await mosaic(env, ['org', 'list', '--json']); assert.equal(listed.status, 0, listed.stderr);
+  assert.equal(JSON.parse(listed.stdout).find(o => o.id === 'alpha').state, 'archived', 'the refused restore changed nothing');
+  const quiet = await mosaic(agent, ['org', 'restore', 'alpha', '--if-revision', String(archivedRevision), '--no-bus', '--json']);
+  assert.equal(quiet.status, 0, quiet.stderr); assert.equal(JSON.parse(quiet.stdout).bus, null);
+  assert.equal((await busStatus(ctx, 'alpha')).healthy, false, 'restore --no-bus starts nothing');
+  // A person's restore starts the bus as the dev owner, with no agent marker in its host.
+  const again = await mosaic(env, ['org', 'archive', 'alpha', '--if-revision', String((await show()).revision), '--json']);
+  assert.equal(again.status, 0, again.stderr);
+  const restored = await mosaic(env, ['org', 'restore', 'alpha', '--if-revision', String(JSON.parse(again.stdout).revision), '--json']);
   assert.equal(restored.status, 0, restored.stderr);
+  const restoredBus = JSON.parse(restored.stdout).bus;
+  assert.equal(restoredBus.outcome, 'started');
+  const up = await busStatus(ctx, 'alpha'); assert.equal(up.healthy, true); assert.equal(up.pid, restoredBus.pid);
+  const hostNames = readFileSync(`/proc/${up.pid}/environ`, 'utf8').split('\0').map(l => l.split('=')[0]);
+  for (const marker of AGENT_MARKERS) assert.ok(!hostNames.includes(marker), marker);
+  await busStop({ ...ctx, env }, 'alpha');
   // A marker in the environment the host is started with stops it at the guarded entry.
   await assert.rejects(busStart({ ...ctx, env: { ...env, MOSAIC_AGENT_RUN: '1' } }, 'alpha', { detach: true, noLaunch: true }), e => e.exitCode === 3 && /bus failed to start/.test(e.message));
   assert.match(readFileSync(join(after.root ?? join(ctx.dataRoot, 'org-runtime/alpha'), 'bus-host/host.log'), 'utf8'), /outside any agent run \(found MOSAIC_AGENT_RUN/);

packages/cli/tests/cli-parity.test.mjs

@@ -0,0 +1,366 @@
+// E2 (#1873, P1-3, org ruling 6): the WebUI's task board, hire form and autonomy panel from a
+// terminal. Each test sends the CLI verb and the page's own request for the same input, and checks
+// that both reach the same bus verb with the same arguments and get the same answer, a refusal
+// included. Hire and autonomy run the real scripts/mosaic against an in-process dev-owner Console
+// whose organization transports are fakes, so no bus host starts; tasks run against a real broker
+// bound to the person, as the human transport binds it.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { spawn, spawnSync } from 'node:child_process';
+import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { request } from 'node:http';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { reserveOrg, activateOrg } from '../../organization/src/org-registry.mjs';
+import { processState } from '../../seat/src/process-state.mjs';
+import { startServer } from '../../webui/src/serve.mjs';
+import { createDevOwner } from '../../webui/src/dev-owner.mjs';
+import { BusReadError } from '../../webui/src/bus.mjs';
+import { parseTaskWrite } from '../../webui/src/workspace-tasks.mjs';
+import { close } from '../../webui/tests/fixture.mjs';
+import { main } from '../src/cli.mjs';
+import { CliError } from '../src/errors.mjs';
+import { orgCommand } from '../src/org.mjs';
+import { broker, humanEnv, io } from './helpers.mjs';
+
+const REPO = new URL('../../../', import.meta.url).pathname;
+const MOSAIC = join(REPO, 'scripts/mosaic');
+const FORBIDDEN = [7332, 7340, 7341, 33223, 17450, 17443, 44307, 7350];
+const SUBJECT = { provider: 'local-dev', iss: 'local-dev', sub: 'local-dev-owner' };
+const SHA = 'a'.repeat(64);
+
+async function instance(t) {
+  const home = mkdtempSync(join(tmpdir(), 'e2-'));
+  const env = humanEnv({ HOME: home, MOSAIC_CONFIG: join(home, '.config/mosaic-e2test/config.json') });
+  const setup = spawnSync(join(REPO, 'scripts/bootstrap.sh'), ['--instance', 'e2test'], { env, encoding: 'utf8' });
+  assert.equal(setup.status, 0, setup.stderr);
+  const ctx = { configDir: join(home, '.config/mosaic-e2test'), dataRoot: join(home, '.mosaic-e2test'), instance: 'e2test', env };
+  await reserveOrg(ctx, 'alpha'); await activateOrg(ctx, 'alpha');
+  t.after(() => rmSync(home, { recursive: true, force: true }));
+  return { ctx, env };
+}
+function mosaic(env, args, timeout = 60000) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(MOSAIC, args, { env, stdio: ['ignore', 'pipe', 'pipe'] });
+    let stdout = '', stderr = '';
+    child.stdout.setEncoding('utf8').on('data', c => { stdout += c; });
+    child.stderr.setEncoding('utf8').on('data', c => { stderr += c; });
+    const timer = setTimeout(() => child.kill('SIGKILL'), timeout);
+    child.on('error', reject);
+    child.on('close', status => { clearTimeout(timer); resolve({ status, stdout, stderr }); });
+  });
+}
+function recordConsole(ctx, url) {
+  const dir = join(ctx.dataRoot, 'console');
+  mkdirSync(dir, { recursive: true, mode: 0o700 }); chmodSync(dir, 0o700);
+  const file = join(dir, 'console.json');
+  writeFileSync(file, JSON.stringify({ pid: process.pid, startTime: processState(process.pid).startTime, url }), { mode: 0o600 }); chmodSync(file, 0o600);
+}
+// The page's own request: a same-origin fetch from the Console's page.
+function page(port, method, path, body) {
+  return new Promise((resolve, reject) => {
+    const payload = body === undefined ? undefined : JSON.stringify(body);
+    const headers = { host: `127.0.0.1:${port}`, ...(payload === undefined ? {} : { origin: `http://127.0.0.1:${port}`, 'sec-fetch-site': 'same-origin', 'content-type': 'application/json', 'content-length': Buffer.byteLength(payload) }) };
+    request({ host: '127.0.0.1', port, method, path, headers }, res => {
+      let text = ''; res.setEncoding('utf8'); res.on('data', c => { text += c; });
+      res.on('end', () => resolve({ status: res.statusCode, body: JSON.parse(text) }));
+    }).on('error', reject).end(payload);
+  });
+}
+// The bus's revision is a 64-hex digest; REV(n) stands in for the nth.
+const REV = n => n.toString(16).padStart(64, '0');
+const LOOP = { 'cross-role': 'in the loop', merge: 'in the loop', policy: 'in the loop', authority: 'in the loop' };
+// One organization, alpha, whose bus transports record each call. `send` false is a Console
+// started without --send.
+function organizations({ send = true } = {}) {
+  const calls = [];
+  let state = { revision: REV(3), levels: { ...LOOP }, autonomy: { notices: false } };
+  const org = {
+    busHealthy: true,
+    send: send ? async () => ({}) : null,
+    decisionWrite: async (verb, args, opts) => {
+      calls.push({ verb, args, opts });
+      if (verb === 'hire.templates.console') return { templates: [{ name: 'worker', sha256: SHA }] };
+      if (args.name === 'blocked') throw new BusReadError('definition-not-hireable');
+      return { id: `hire-${calls.length}`, op: 'resolved', choice: 'yes' };
+    },
+    requestRead: async (verb, args, opts) => { calls.push({ verb, args, opts }); return structuredClone(state); },
+    autonomyWrite: async (verb, args, opts) => {
+      calls.push({ verb, args, opts });
+      if (verb === 'autonomy.review.console') return { reviewed: args.decisionClass };
+      if (args.revision !== state.revision) throw new BusReadError('revision-conflict');
+      const { notices, reverseWindowHours, authorityResolver, ...levels } = args.autonomy;
+      state = { revision: REV(parseInt(state.revision, 16) + 1), levels, autonomy: { notices, reverseWindowHours, ...(authorityResolver ? { authorityResolver } : {}) } };
+      return { revision: state.revision, transaction: `tx-${parseInt(state.revision, 16)}` };
+    },
+  };
+  return { calls, organizations: { list: async () => [{ id: 'alpha' }], resolve: async id => (id === 'alpha' ? org : null) } };
+}
+async function consoleFor(t, ctx, options) {
+  const f = organizations(options);
+  const server = await startServer({ port: 0, board: 'http://127.0.0.1:9', sso: createDevOwner(), send: async () => ({}), organizations: f.organizations, log: () => {} });
+  t.after(() => close(server));
+  const port = server.address().port;
+  assert.ok(!FORBIDDEN.includes(port));
+  recordConsole(ctx, `http://127.0.0.1:${port}/`);
+  return { ...f, port, server };
+}
+
+const HIRE = ['--name', 'ada', '--template', 'worker', '--harness', 'pi', '--model', 'glm', '--reason', 'more hands'];
+const GUARDED = [
+  ['org', 'role-templates', 'alpha'],
+  ['org', 'hire', 'alpha', ...HIRE],
+  ['org', 'change', 'alpha', ...HIRE],
+  ['org', 'fire', 'alpha', '--name', 'ada', '--reason', 'done'],
+  ['org', 'autonomy', 'alpha'],
+  ['org', 'autonomy', 'alpha', 'set', '--revision', REV(3), '--merge', 'near'],
+  ['org', 'autonomy', 'alpha', 'review', 'merge'],
+];
+
+test('hire and autonomy verbs: usage errors first (exit 4), then refused inside an agent run before any config is read', async () => {
+  // The config path is not an instance config, so a read would refuse with another message.
+  const env = { ...humanEnv({ MOSAIC_CONFIG: '/nonexistent/e2/config.json' }), CLAUDECODE: '1' };
+  for (const args of GUARDED) {
+    const r = await mosaic(env, args);
+    assert.equal(r.status, 3, `${args.join(' ')}: ${r.stderr}`);
+    assert.match(r.stderr, /outside any agent run \(found CLAUDECODE/, args.join(' '));
+    assert.equal(r.stdout, '');
+  }
+  for (const args of [
+    ['org', 'hire', 'alpha', '--name', 'ada'],
+    ['org', 'fire', 'alpha', '--name', 'ada', '--reason', 'done', '--model', 'glm'],
+    ['org', 'hire', 'alpha', ...HIRE, '--level', 'project'],
+    ['org', 'autonomy', 'alpha', 'set', '--merge', 'near'],
+    ['org', 'autonomy', 'alpha', 'set', '--revision', REV(3), '--merge', 'sideways'],
+    ['org', 'autonomy', 'alpha', 'set', '--revision', '3', '--merge', 'near'],
+    ['org', 'autonomy', 'alpha', 'set', '--revision', REV(3), '--reverse-window-hours', '200'],
+    ['org', 'autonomy', 'alpha', 'review', 'everything'],
+    ['org', 'role-templates', 'Not An Id'],
+  ]) {
+    const r = await mosaic(env, args);
+    assert.equal(r.status, 4, `${args.join(' ')}: ${r.stderr}`);
+    assert.doesNotMatch(r.stderr, /agent run/);
+  }
+  // This process's own environment counts too, as for org archive|delete: the marker is only in
+  // process.env here, never in io.env.
+  const saved = process.env.CLAUDECODE;
+  process.env.CLAUDECODE = '1';
+  try {
+    for (const args of GUARDED) {
+      const x = io(humanEnv({ MOSAIC_CONFIG: '/nonexistent/e2/config.json' }));
+      delete x.env.CLAUDECODE;
+      await assert.rejects(orgCommand(args.slice(1), x, {}), e => e instanceof CliError && e.exitCode === 3 && /outside any agent run/.test(e.message), args.join(' '));
+    }
+  } finally { if (saved === undefined) delete process.env.CLAUDECODE; else process.env.CLAUDECODE = saved; }
+  // The default instance is a one-line refusal (exit 3), not an uncaught error.
+  const d = io(humanEnv());
+  delete d.env.MOSAIC_CONFIG;
+  await assert.rejects(orgCommand(['autonomy', 'alpha'], d, {}), e => e instanceof CliError && e.exitCode === 3 && /requires a named instance.*--dev-local-owner/.test(e.message));
+});
+
+test('role-templates, hire, change and fire send the hire form\'s request and get its answer, refusals included', { timeout: 120000 }, async t => {
+  const { ctx, env } = await instance(t);
+  const c = await consoleFor(t, ctx);
+  const opts = { subject: SUBJECT, business: 'alpha' };
+
+  let r = await mosaic(env, ['org', 'role-templates', 'alpha', '--json']);
+  assert.equal(r.status, 0, r.stderr);
+  const pageTemplates = await page(c.port, 'POST', '/api/orgs/alpha/decisions/hire/templates', { business: 'alpha' });
+  assert.deepEqual(JSON.parse(r.stdout), pageTemplates.body);
+  assert.deepEqual(c.calls.splice(0), [{ verb: 'hire.templates.console', args: {}, opts }, { verb: 'hire.templates.console', args: {}, opts }]);
+  r = await mosaic(env, ['org', 'role-templates', 'alpha']);
+  assert.equal(r.stdout, `worker  ${SHA.slice(0, 12)}\n`);
+  c.calls.splice(0);
+
+  // The form's body for this input (bus.js hireSubmit): the template it read, by name and sha256.
+  const form = (op, name, extra = {}) => ({ op, level: 'org', name, reason: 'more hands', ...extra, ...(op === 'fire' ? {} : { role: { template: 'worker', sha256: SHA }, route: { harness: 'pi', model: 'glm' } }) });
+  for (const op of ['hire', 'change']) {
+    r = await mosaic(env, ['org', op, 'alpha', ...HIRE, '--json']);
+    assert.equal(r.status, 0, r.stderr);
+    const cli = c.calls.splice(0);
+    assert.deepEqual(cli.map(x => x.verb), ['hire.templates.console', 'hire.start.console']);
+    const pageAnswer = await page(c.port, 'POST', '/api/orgs/alpha/decisions/hire/start', { business: 'alpha', hire: form(op, 'ada') });
+    const pageCall = c.calls.splice(0);
+    assert.deepEqual(cli[1], pageCall[0]);
+    assert.deepEqual(cli[1].args, form(op, 'ada'));
+    assert.equal(pageAnswer.status, 200);
+    // Each decision gets its own id; the rest of the answer is the page's.
+    assert.deepEqual({ ...JSON.parse(r.stdout), id: 'x' }, { ...pageAnswer.body, id: 'x' });
+  }
+  r = await mosaic(env, ['org', 'fire', 'alpha', '--name', 'ada', '--reason', 'more hands', '--level', 'project', '--project', 'site']);
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.stdout, /^recorded decision hire-1: fire ada \(resolved yes\)\n$/);
+  assert.deepEqual(c.calls.splice(0), [{ verb: 'hire.start.console', args: { op: 'fire', level: 'project', name: 'ada', reason: 'more hands', project: 'site' }, opts }]);
+
+  // A bus refusal reaches the terminal with the Console's code and message, as the form shows it.
+  r = await mosaic(env, ['org', 'hire', 'alpha', ...HIRE.map(a => (a === 'ada' ? 'blocked' : a))]);
+  const pageRefusal = await page(c.port, 'POST', '/api/orgs/alpha/decisions/hire/start', { business: 'alpha', hire: form('hire', 'blocked') });
+  assert.equal(pageRefusal.status, 409);
+  assert.equal(r.status, 3, r.stderr);
+  assert.ok(r.stderr.includes(`hire refused (definition-not-hireable): ${pageRefusal.body.message}`), r.stderr);
+  c.calls.splice(0);
+  // A template the Console did not offer is refused before anything is raised.
+  r = await mosaic(env, ['org', 'hire', 'alpha', ...HIRE.map(a => (a === 'worker' ? 'ghost' : a))]);
+  assert.equal(r.status, 2, r.stderr);
+  assert.match(r.stderr, /no role template "ghost"/);
+  assert.deepEqual(c.calls.splice(0).map(x => x.verb), ['hire.templates.console']);
+
+  // A Console without --send: the page's refusal, and nothing reaches the bus.
+  await close(c.server);
+  const ro = await consoleFor(t, ctx, { send: false });
+  r = await mosaic(env, ['org', 'hire', 'alpha', ...HIRE]);
+  const pageRo = await page(ro.port, 'POST', '/api/orgs/alpha/decisions/hire/templates', { business: 'alpha' });
+  assert.equal(r.status, 3, r.stderr);
+  assert.match(r.stderr, new RegExp(`hire refused \\(${pageRo.body.error}\\)`));
+  assert.equal(pageRo.body.error, 'read-only');
+  assert.deepEqual(ro.calls, []);
+  // An organization the Console does not know is refused as the page is.
+  r = await mosaic(env, ['org', 'role-templates', 'beta']);
+  assert.equal(r.status, 3, r.stderr);
+  assert.match(r.stderr, /role-templates refused \(org-unavailable\)/);
+});
+
+test('autonomy reads, saves with the panel\'s revision check and records a review through the panel\'s route', { timeout: 120000 }, async t => {
+  const { ctx, env } = await instance(t);
+  const c = await consoleFor(t, ctx);
+  const opts = { subject: SUBJECT };
+
+  let r = await mosaic(env, ['org', 'autonomy', 'alpha', '--json']);
+  assert.equal(r.status, 0, r.stderr);
+  assert.deepEqual(JSON.parse(r.stdout), (await page(c.port, 'GET', '/api/orgs/alpha/autonomy')).body);
+  r = await mosaic(env, ['org', 'autonomy', 'alpha']);
+  assert.equal(r.stdout, `revision ${REV(3)}\ncross-role: in the loop\nmerge: in the loop\npolicy: in the loop\nauthority: in the loop\nnotices: off\nreverse window: not set (the page offers 24 hours)\nauthority resolver: none\n`);
+  c.calls.splice(0);
+
+  // The panel's save for "merge near the loop" (autonomy.js): every class as shown, notices, the
+  // window it offers (24) and no resolver.
+  const panel = { ...LOOP, merge: 'near the loop', notices: false, reverseWindowHours: 24 };
+  // Imported here so that the other tests still run, and fail on their own, on a base without it.
+  const { autonomyDocument } = await import('../src/org-owner.mjs');
+  assert.deepEqual(autonomyDocument({ revision: REV(3), levels: LOOP, autonomy: { notices: false } }, { merge: 'near the loop' }), panel);
+  // An emptied resolver field: the panel leaves it out of the save, and so does the terminal.
+  assert.deepEqual(autonomyDocument({ revision: REV(3), levels: LOOP, autonomy: { notices: false, authorityResolver: 'ops' } }, { authorityResolver: '' }), { ...LOOP, notices: false, reverseWindowHours: 24 });
+  assert.equal(autonomyDocument({ revision: REV(3), levels: LOOP, autonomy: { notices: false, authorityResolver: 'ops' } }, {}).authorityResolver, 'ops');
+  r = await mosaic(env, ['org', 'autonomy', 'alpha', 'set', '--revision', REV(3), '--merge', 'near', '--json']);
+  assert.equal(r.status, 0, r.stderr);
+  assert.deepEqual(JSON.parse(r.stdout), { revision: REV(4), transaction: 'tx-4', writable: true });
+  assert.deepEqual(c.calls.splice(0), [{ verb: 'autonomy.get.console', args: {}, opts }, { verb: 'autonomy.set.console', args: { revision: REV(3), autonomy: panel }, opts }]);
+  // The page's save of the same document at revision 4 lands the same way.
+  const pageSave = await page(c.port, 'POST', '/api/orgs/alpha/autonomy', { revision: REV(4), autonomy: panel });
+  assert.deepEqual(pageSave.body, { revision: REV(5), transaction: 'tx-5', writable: true });
+  assert.deepEqual(c.calls.splice(0), [{ verb: 'autonomy.set.console', args: { revision: REV(4), autonomy: panel }, opts }]);
+
+  // A stale revision is the panel's revision-conflict, and nothing changes.
+  r = await mosaic(env, ['org', 'autonomy', 'alpha', 'set', '--revision', REV(3), '--policy', 'near']);
+  const pageStale = await page(c.port, 'POST', '/api/orgs/alpha/autonomy', { revision: REV(3), autonomy: panel });
+  assert.deepEqual(pageStale, { status: 409, body: { error: 'revision-conflict' } });
+  assert.equal(r.status, 3, r.stderr);
+  assert.match(r.stderr, /autonomy set refused \(revision-conflict\): the organization changed; read it again with mosaic org autonomy ID/);
+  assert.equal((await page(c.port, 'GET', '/api/orgs/alpha/autonomy')).body.revision, REV(5));
+  c.calls.splice(0);
+
+  r = await mosaic(env, ['org', 'autonomy', 'alpha', 'review', 'merge']);
+  assert.equal(r.status, 0, r.stderr);
+  assert.equal(r.stdout, 'recorded your trail review for merge on alpha\n');
+  await page(c.port, 'POST', '/api/orgs/alpha/autonomy/review', { decisionClass: 'merge' });
+  const [cli, pageReview] = c.calls.splice(0);
+  assert.deepEqual(cli, pageReview);
+  assert.deepEqual(cli, { verb: 'autonomy.review.console', args: { decisionClass: 'merge' }, opts });
+
+  // Without --send the read still answers and both writes are the page's read-only refusal.
+  await close(c.server);
+  const ro = await consoleFor(t, ctx, { send: false });
+  r = await mosaic(env, ['org', 'autonomy', 'alpha', '--json']);
+  assert.equal(r.status, 0, r.stderr);
+  assert.equal(JSON.parse(r.stdout).writable, false);
+  for (const args of [['set', '--revision', REV(3), '--merge', 'near'], ['review', 'merge']]) {
+    r = await mosaic(env, ['org', 'autonomy', 'alpha', ...args]);
+    assert.equal(r.status, 3, r.stderr);
+    assert.match(r.stderr, /refused \(read-only\): start the Console with --send/);
+  }
+  assert.deepEqual((await page(ro.port, 'POST', '/api/orgs/alpha/autonomy/review', { decisionClass: 'merge' })).body, { error: 'read-only' });
+  assert.deepEqual(ro.calls.map(x => x.verb), ['autonomy.get.console', 'autonomy.get.console']);
+});
+
+// mosaic tasks create|edit|archive with the person's transport over a real broker.
+async function run(argv, s) {
+  const x = io();
+  try { await main(argv, x, { system: { dataRoot: s.dataRoot }, transport: s.transport }); return { code: 0, out: x.out.text, err: '' }; }
+  catch (e) { if (!(e instanceof CliError)) throw e; return { code: e.exitCode, out: x.out.text, err: e.message }; }
+}
+
+test('tasks create, edit and archive send the board\'s writes to the bus as the person', async t => {
+  const b = broker(t);
+  const s = { ...b, dataRoot: mkdtempSync(join(tmpdir(), 'e2t-')) };
+  t.after(() => rmSync(s.dataRoot, { recursive: true, force: true }));
+  // The board's request for the same input, through the board's own check.
+  const board = body => { const w = parseTaskWrite({ org: 'demo', ...body }); return { verb: w.verb, args: w.args }; };
+
+  let r = await run(['tasks', 'create', '--title', 'Plan the store', '--requirement', 'REQ-TASK-1', '--assignees', 'coder', '--priority', '2', '--business', 'demo', '--json'], s);
+  assert.equal(r.code, 0, r.err);
+  const created = JSON.parse(r.out);
+  assert.deepEqual(s.calls.splice(0).map(({ verb, args }) => ({ verb, args })), [board({ op: 'create', title: 'Plan the store', requirement: 'REQ-TASK-1', assignees: ['coder'], priority: 2 })]);
+  assert.deepEqual({ ...created, digest: 'd' }, { ok: true, org: 'demo', op: 'create', task_ref: 'task:1', digest: 'd' });
+  const row = () => s.read('tasks').find(x => x.task_ref === 'task:1');
+  assert.equal(created.digest, row().digest);
+  assert.equal(row().fields.title, 'Plan the store');
+  assert.deepEqual(row().fields.assignees, ['coder']);
+
+  r = await run(['tasks', 'edit', 'task:1', '--expect', created.digest, '--state', 'in-progress', '--due', 'none', '--business', 'demo'], s);
+  assert.equal(r.code, 0, r.err);
+  assert.equal(r.out, `changed task:1, digest ${row().digest}\n`);
+  assert.deepEqual(s.calls.splice(0).map(({ verb, args }) => ({ verb, args })), [board({ op: 'edit', task_ref: 'task:1', expect: created.digest, state: 'in-progress', due_date: null })]);
+  assert.equal(row().fields.state, 'in-progress');
+
+  // A stale digest is the board's task-conflict, and nothing is written.
+  const before = row();
+  r = await run(['tasks', 'archive', 'task:1', '--expect', created.digest, '--business', 'demo'], s);
+  assert.equal(r.code, 2, r.err);
+  assert.match(r.err, /^tasks archive refused \(task-conflict\): the task changed after you read it/);
+  assert.deepEqual(row(), before);
+  s.calls.splice(0);
+
+  r = await run(['tasks', 'archive', 'task:1', '--expect', before.digest, '--business', 'demo'], s);
+  assert.equal(r.code, 0, r.err);
+  assert.deepEqual(s.calls.splice(0).map(({ verb, args }) => ({ verb, args })), [board({ op: 'archive', task_ref: 'task:1', expect: before.digest })]);
+  assert.match(r.out, /^archived task:1, digest [0-9a-f]{64}\n$/);
+
+  // What the board refuses with 400 the terminal refuses as usage (exit 4), with the board's words,
+  // before anything is sent.
+  for (const [argv, body] of [
+    [['tasks', 'create', '--title', 'x', '--business', 'demo'], { op: 'create', title: 'x' }],
+    [['tasks', 'edit', 'task:1', '--expect', 'nope', '--title', 'y', '--business', 'demo'], { op: 'edit', task_ref: 'task:1', expect: 'nope', title: 'y' }],
+    [['tasks', 'archive', 'task:1', '--business', 'demo'], { op: 'archive', task_ref: 'task:1' }],
+  ]) {
+    let boardError;
+    try { parseTaskWrite({ org: 'demo', ...body }); } catch (e) { boardError = e; }
+    assert.equal(boardError?.status, 400, JSON.stringify(body));
+    r = await run(argv, s);
+    assert.equal(r.code, 4, argv.join(' '));
+    assert.ok(r.err.includes(boardError.message), `${r.err} / ${boardError.message}`);
+  }
+  assert.deepEqual(s.calls, []);
+  // Terminal-only slips the board cannot make are usage too: an option-looking word is not a value,
+  // and the organization is named (exit 4 even inside an agent run).
+  for (const [argv, env] of [
+    [['tasks', 'create', '--title', '--json', '--requirement', 'REQ-TASK-1', '--business', 'demo'], humanEnv()],
+    [['tasks', 'create', '--title', 'x', '--requirement', 'REQ-TASK-1'], { ...humanEnv(), CLAUDECODE: '1' }],
+  ]) {
+    const y = io(env);
+    await assert.rejects(main(argv, y, { system: { dataRoot: s.dataRoot }, transport: s.transport }), e => e instanceof CliError && e.exitCode === 4, argv.join(' '));
+  }
+  assert.deepEqual(s.calls, []);
+  // A marker only in this process's own environment counts too.
+  const savedMarker = process.env.CLAUDECODE;
+  process.env.CLAUDECODE = '1';
+  try {
+    const y = io(humanEnv());
+    delete y.env.CLAUDECODE;
+    await assert.rejects(main(['tasks', 'create', '--title', 'x', '--requirement', 'REQ-TASK-1', '--business', 'demo'], y, { system: { dataRoot: s.dataRoot }, transport: s.transport }), e => e instanceof CliError && e.exitCode === 3 && /outside any agent run/.test(e.message));
+  } finally { if (savedMarker === undefined) delete process.env.CLAUDECODE; else process.env.CLAUDECODE = savedMarker; }
+  assert.deepEqual(s.calls, []);
+  // Inside an agent run the write is refused before anything is sent.
+  const x = io({ ...humanEnv(), CLAUDECODE: '1' });
+  await assert.rejects(main(['tasks', 'create', '--title', 'x', '--requirement', 'REQ-TASK-1', '--business', 'demo'], x, { system: { dataRoot: s.dataRoot }, transport: s.transport }), e => e instanceof CliError && e.exitCode === 3);
+  assert.deepEqual(s.calls, []);
+});

packages/cli/tests/org-repo-set.test.mjs

@@ -0,0 +1,91 @@
+// #1873 P1-6 and P1-7: `org project repo init --remote` sets and checks origin; `org project repo
+// set` changes the repository both ways. The remotes point at 127.0.0.1 port 1, which refuses at
+// once, so the check runs for real and answers "unreachable" without leaving the host.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { join, resolve } from 'node:path';
+import { tmpdir } from 'node:os';
+import { execFileSync, spawnSync } from 'node:child_process';
+const repo = resolve(import.meta.dirname, '../../..');
+const run = (env, ...args) => spawnSync(join(repo, 'scripts/mosaic'), args, { cwd: repo, env, encoding: 'utf8' });
+const git = (cwd, ...args) => execFileSync('git', ['-C', cwd, ...args], { env: { PATH: process.env.PATH, HOME: '/nonexistent', GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null' }, encoding: 'utf8' }).trim();
+
+test('org project repo init --remote and repo set: origin follows, the check is reported, refusals are plain', () => {
+  const home = mkdtempSync(join(tmpdir(), 'org-repo-')); const env = { ...process.env, HOME: home, MOSAIC_CONFIG: join(home, '.config/mosaic-orgtest/config.json') };
+  const boot = spawnSync(join(repo, 'scripts/bootstrap.sh'), ['--instance', 'orgtest'], { cwd: repo, env, encoding: 'utf8' }); assert.equal(boot.status, 0, boot.stderr);
+  const ok = (...args) => { const r = run(env, ...args); assert.equal(r.status, 0, r.stderr); return JSON.parse(r.stdout); };
+  const file = join(home, 'alpha.json');
+  run(env, 'org', 'template', 'render', 'alpha', '--fixture', 'local', '--output', file); ok('org', 'create', 'alpha', '--from', file);
+
+  const ssh = 'ssh://[email protected]:1/team/work.git';
+  const init = ok('org', 'project', 'repo', 'init', 'alpha', 'work', '--remote', ssh);
+  assert.equal(init.origin, ssh); assert.equal(init.check.result, 'unreachable'); assert.match(init.check.message, /port 1|refused/i);
+  assert.equal(git(init.root, 'remote', '-v'), `origin\t${ssh} (fetch)\norigin\t${ssh} (push)`);
+
+  // Usage errors come first and change nothing.
+  for (const args of [['--local-only', '--accept-local-loss-risk'], ['--remote', ssh, '--local-only', '--if-revision', '9'], ['--if-revision', '9'], ['--remote', ssh, '--if-revision', '0']]) {
+    const r = run(env, 'org', 'project', 'repo', 'set', 'alpha', 'work', ...args); assert.equal(r.status, 4, `${args}: ${r.stderr}`);
+  }
+  assert.equal(run(env, 'org', 'queue', 'set', 'alpha', '--local-only', '--accept-local-loss-risk', '--if-revision', '1').status, 4);
+  let rev = ok('org', 'show', 'alpha', '--json').revision;
+  for (const bad of ['ext::sh -c id', 'file:///etc', '/srv/repo', 'https://user:[email protected]:1/o/r', 'http://127.0.0.1:1/o/r']) {
+    const r = run(env, 'org', 'project', 'repo', 'set', 'alpha', 'work', '--remote', bad, '--if-revision', String(rev));
+    assert.equal(r.status, 2, bad); assert.match(r.stderr, /org-invalid/, bad);
+  }
+  const stale = run(env, 'org', 'project', 'repo', 'set', 'alpha', 'work', '--local-only', '--accept-local-loss-risk', '--if-revision', String(rev + 5));
+  assert.equal(stale.status, 2); assert.match(stale.stderr, /revision-conflict/);
+  assert.equal(git(init.root, 'remote', 'get-url', 'origin'), ssh);
+
+  const local = ok('org', 'project', 'repo', 'set', 'alpha', 'work', '--local-only', '--accept-local-loss-risk', '--if-revision', String(rev));
+  assert.equal(local.op, 'org.project.repo.set'); assert.equal(local.revision, rev + 1); assert.equal(local.origin, null); assert.equal(git(init.root, 'remote', '-v'), '');
+  rev = local.revision;
+  const https = 'https://127.0.0.1:1/team/work.git';
+  const back = ok('org', 'project', 'repo', 'set', 'alpha', 'work', '--remote', https, '--if-revision', String(rev), '--json');
+  assert.equal(back.revision, rev + 1); assert.equal(back.check.result, 'unreachable'); assert.match(back.check.message, /Failed to connect|Could not connect/);
+  assert.equal(git(init.root, 'remote', 'get-url', 'origin'), https);
+  assert.deepEqual(ok('org', 'project', 'repo', 'show', 'alpha', 'work', '--json').current, { mode: 'remote', remote: https, origin: https, revision: back.revision, check: back.check, changedAt: back.at });
+  assert.equal(back.check.url, https);
+
+  // The acceptance URL (#1873 P1-6): an .invalid host never resolves, so the check is unreachable
+  // and origin is still set to it.
+  const invalid = 'https://git.example.invalid/acme/work';
+  const named = ok('org', 'project', 'repo', 'set', 'alpha', 'work', '--remote', invalid, '--if-revision', String(back.revision), '--json');
+  assert.equal(named.origin, invalid); assert.equal(named.check.result, 'unreachable'); assert.equal(named.check.url, invalid);
+  assert.match(named.check.message, /resolve|timed out/i);
+  assert.equal(git(init.root, 'remote', '-v'), `origin\t${invalid} (fetch)\norigin\t${invalid} (push)`);
+});
+
+// #1873 F7: while a copy binding that names the project is approved or active, repo set is refused
+// with exit 2 and the next step; once the binding is unbound (revoked) the same set goes through.
+// The bindings are written into the document as the CB1 writer would leave them.
+test('org project repo set is refused under a copy binding that names the project, and allowed after revoke', () => {
+  const home = mkdtempSync(join(tmpdir(), 'org-repo-')); const env = { ...process.env, HOME: home, MOSAIC_CONFIG: join(home, '.config/mosaic-orgtest/config.json') };
+  const boot = spawnSync(join(repo, 'scripts/bootstrap.sh'), ['--instance', 'orgtest'], { cwd: repo, env, encoding: 'utf8' }); assert.equal(boot.status, 0, boot.stderr);
+  const ok = (...args) => { const r = run(env, ...args); assert.equal(r.status, 0, r.stderr); return JSON.parse(r.stdout); };
+  const file = join(home, 'alpha.json');
+  run(env, 'org', 'template', 'render', 'alpha', '--fixture', 'local', '--output', file); ok('org', 'create', 'alpha', '--from', file);
+  const init = ok('org', 'project', 'repo', 'init', 'alpha', 'work', '--local-only', '--accept-local-loss-risk');
+  const configDir = join(home, '.config/mosaic-orgtest');
+  const seed = (state) => {
+    const docFile = join(configDir, 'businesses/alpha.json'); const doc = JSON.parse(readFileSync(docFile, 'utf8'));
+    doc.copyBindings = { 'rev.work': { copyId: '1'.repeat(32), orgIncarnation: 'a'.repeat(32), source: { level: 'project', name: 'rev', project: 'work' },
+      definition: { ref: 'reviewer', rev: null, sha256: 'b'.repeat(64) }, generation: 1, state,
+      services: state === 'unbound' ? {} : { gitea: { slot: 'self', scopes: ['read:repository'], resources: { projects: ['work'] } } },
+      decision: '11111111-1111-4111-8111-111111111111' } };
+    const raw = JSON.stringify(doc, null, 2) + '\n'; writeFileSync(docFile, raw);
+    const regFile = join(configDir, 'org-runtime.json'); const reg = JSON.parse(readFileSync(regFile, 'utf8'));
+    reg.orgs.alpha.digest = createHash('sha256').update(raw).digest('hex'); writeFileSync(regFile, JSON.stringify(reg, null, 2) + '\n');
+  };
+  const invalid = 'https://git.example.invalid/acme/other';
+  seed('pending');
+  const rev = ok('org', 'show', 'alpha', '--json').revision;
+  const refused = run(env, 'org', 'project', 'repo', 'set', 'alpha', 'work', '--remote', invalid, '--if-revision', String(rev));
+  assert.equal(refused.status, 2, refused.stderr);
+  assert.match(refused.stderr, /project-repo-bound: project work is in a copy binding that still grants it: rev\.work \(approved, not yet verified\)\. Revoke that copy binding first/);
+  assert.equal(git(init.root, 'remote', '-v'), '');
+  seed('unbound');
+  const set = ok('org', 'project', 'repo', 'set', 'alpha', 'work', '--remote', invalid, '--if-revision', String(rev), '--json');
+  assert.equal(set.revision, rev + 1); assert.equal(git(init.root, 'remote', 'get-url', 'origin'), invalid);
+});

packages/cli/tests/org-restore-bus.test.mjs

@@ -0,0 +1,94 @@
+// E1 (P1-4): `mosaic org restore` brings the organization back running. It starts the bus as
+// `mosaic bus start ID --dev-local-owner --detach` would; a bus that does not start is said so with
+// that verb, and the restore stands. On an instance where that start is refused, the restore is
+// refused first and changes nothing. `--no-bus` keeps the old restore. The bus start itself is a
+// stand-in here; agent-guard.test.mjs and org.test.mjs start a real one.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import * as service from '../../organization/src/org-service.mjs';
+import { listOrgs } from '../../organization/src/org-registry.mjs';
+import { DEV_OWNER } from '../src/dev-local-owner.mjs';
+import { orgCommand } from '../src/org.mjs';
+import { io, humanEnv } from './helpers.mjs';
+
+// A named instance under a temporary HOME (the dev-owner checks read the instance from HOME), with
+// one archived organization.
+async function archived(t) {
+  const home = mkdtempSync(join(tmpdir(), 'e1-restore-')), saved = process.env.HOME;
+  process.env.HOME = home;
+  t.after(() => { process.env.HOME = saved; rmSync(home, { recursive: true, force: true }); });
+  const configDir = join(home, '.config', 'mosaic-e1test'), dataRoot = join(home, 'data');
+  mkdirSync(configDir, { recursive: true, mode: 0o700 }); mkdirSync(dataRoot, { mode: 0o700 });
+  const ctx = { configDir, dataRoot, instance: 'e1test', principal: DEV_OWNER };
+  const created = await service.createOrg(ctx, 'alpha', await service.templateRender('alpha'));
+  const gone = await service.archiveOrg(ctx, 'alpha', { ifRevision: created.revision, busStop: async () => ({ stopped: false }) });
+  const env = humanEnv({ HOME: home, MOSAIC_CONFIG: join(configDir, 'config.json') });
+  const state = async () => (await listOrgs(ctx)).find(e => e.id === 'alpha').state;
+  return { ctx, env, revision: gone.revision, state, system: { dataRoot } };
+}
+const restore = (f, deps, ...extra) => { const x = io(f.env); return orgCommand(['restore', 'alpha', '--if-revision', String(f.revision), '--json', ...extra], x, { system: f.system, ...deps }).then(() => x, e => { e.io = x; throw e; }); };
+
+test('E1: restore starts the bus as the dev owner and its receipt names the bus', async t => {
+  const f = await archived(t), calls = [];
+  const x = await restore(f, { busStart: async (ctx, id, opts) => { calls.push([ctx.dataRoot, ctx.env === f.env, id, opts]); return { org: id, pid: 4242, socket: '/s', root: '/r' }; } });
+  assert.deepEqual(calls, [[f.ctx.dataRoot, true, 'alpha', { detach: true, devLocalOwner: true, pm: false }]]);
+  const receipt = JSON.parse(x.out.text);
+  assert.equal(receipt.revision, f.revision + 1);
+  assert.deepEqual(receipt.bus, { outcome: 'started', pid: 4242 });
+  assert.equal(await f.state(), 'active');
+});
+
+test('E1: a bus that does not start after a good restore is said so, with the verb, and the restore stands', async t => {
+  const f = await archived(t);
+  const { CliError } = await import('../src/errors.mjs');
+  const busStart = async () => { throw new CliError('bus failed to start; see the bus log', 3); };
+  await assert.rejects(restore(f, { busStart }), e => {
+    assert.equal(e.exitCode, 3);
+    assert.equal(e.message, 'alpha was restored, but its bus did not start: bus failed to start; see the bus log; start it with mosaic bus start alpha --dev-local-owner --detach');
+    // The restore receipt is printed before the refusal.
+    const receipt = JSON.parse(e.io.out.text);
+    assert.equal(receipt.revision, f.revision + 1);
+    assert.deepEqual(receipt.bus, { outcome: 'failed', message: 'bus failed to start; see the bus log', next: 'mosaic bus start alpha --dev-local-owner --detach' });
+    return true;
+  });
+  assert.equal(await f.state(), 'active');
+});
+
+test('E1: a bus host that died leaves a stale lock; the receipt names bus recover before the start', async t => {
+  const f = await archived(t);
+  const { CliError } = await import('../src/errors.mjs');
+  const busStart = async () => { throw new CliError('stale bus host lock', 3); };
+  await assert.rejects(restore(f, { busStart }), e => {
+    assert.equal(e.exitCode, 3);
+    assert.equal(e.message, 'alpha was restored, but its bus did not start: stale bus host lock; clear the dead host with mosaic bus recover alpha, then start it with mosaic bus start alpha --dev-local-owner --detach');
+    assert.deepEqual(JSON.parse(e.io.out.text).bus, { outcome: 'failed', message: 'stale bus host lock', next: 'mosaic bus recover alpha; mosaic bus start alpha --dev-local-owner --detach' });
+    return true;
+  });
+  assert.equal(await f.state(), 'active');
+});
+
+test('E1: where a dev-owner bus start is refused, restore is refused before it changes anything, and --no-bus restores', async t => {
+  const f = await archived(t); let starts = 0;
+  const busStart = async () => { starts++; return { pid: 1 }; };
+  writeFileSync(join(f.ctx.dataRoot, '.deployed'), '{}\n');
+  await assert.rejects(restore(f, { busStart }), e => e.exitCode === 3 && /^restore starts the bus as the local dev owner, and --dev-local-owner refuses \.deployed; restore with --no-bus, then start the bus with mosaic bus start$/.test(e.message) && e.io.out.text === '');
+  assert.equal(await f.state(), 'archived');
+  const x = await restore(f, { busStart }, '--no-bus');
+  assert.equal(JSON.parse(x.out.text).bus, null);
+  assert.equal(starts, 0);
+  assert.equal(await f.state(), 'active');
+});
+
+test('E1: an agent run may restore only with --no-bus', async t => {
+  const f = await archived(t); let starts = 0;
+  const busStart = async () => { starts++; return { pid: 1 }; };
+  f.env = { ...f.env, MOSAIC_AGENT_RUN: '1' };
+  await assert.rejects(restore(f, { busStart }), e => e.exitCode === 3 && /MOSAIC_AGENT_RUN/.test(e.message));
+  assert.equal(await f.state(), 'archived');
+  await restore(f, { busStart }, '--no-bus');
+  assert.equal(starts, 0);
+  assert.equal(await f.state(), 'active');
+});

packages/cli/tests/org.test.mjs

@@ -21,6 +21,8 @@ test('organization CLI renders, validates, creates, updates and initializes git'
  info = JSON.parse(invoke('org', 'show', 'alpha', '--json')); const archived = JSON.parse(invoke('org', 'archive', 'alpha', '--if-revision', String(info.revision), '--json')); assert.equal(archived.revision, info.revision + 1);
  assert.equal(JSON.parse(invoke('org', 'list', '--json'))[0].state, 'archived');
  const restored = JSON.parse(invoke('org', 'restore', 'alpha', '--if-revision', String(archived.revision), '--json')); assert.equal(restored.revision, archived.revision + 1);
+ // E1 (P1-4): restore brings the organization back running; the delete below stops the bus again.
+ assert.equal(restored.bus.outcome, 'started'); assert.ok(Number.isInteger(restored.bus.pid)); assert.equal(JSON.parse(invoke('bus', 'status', 'alpha', '--json')).healthy, true);
  info = JSON.parse(invoke('org', 'show', 'alpha', '--json')); const receipt = JSON.parse(invoke('org', 'delete', 'alpha', '--confirm', 'alpha', '--if-revision', String(info.revision), '--json')); assert.equal(receipt.org, 'alpha'); assert.deepEqual(JSON.parse(invoke('org', 'list', '--json')), []);
 });
 test('business and org aliases conflict in either order', () => { for (const args of [['--business','alpha','--org','beta'], ['--org','beta','--business','alpha']]) { const r = run(process.env, 'tasks', ...args); assert.notEqual(r.status, 0); assert.match(r.stderr, /conflict/i); } });

packages/cli/tests/proxy-setup-cli.test.mjs

@@ -0,0 +1,130 @@
+// #1873 CLI parity for the Console's Proxy page: status, unit, init-lock, init --generate-key and
+// fence clear --restart. Every verb runs only from a human shell; nothing prints a key or a path.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, readFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { main } from '../src/cli.mjs';
+import { proxyCommand } from '../src/model-proxy.mjs';
+import { io } from './helpers.mjs';
+
+const code = c => e => e.code === c;
+const fakeSystem = () => ({ dataRoot: join(mkdtempSync(join(tmpdir(), 'ps-cli-')), 'data') });
+const STATUS = {
+  release: { fetched: true, version: '8.0.42', panelVersion: '1.26.7', verified: true },
+  init: { initialized: true, partial: false, settings: { port: 18432 }, files: [] },
+  unit: { unit: 'mosaic-proxy.service', installed: true, active: 'active', pid: 77, port: 18432, listening: true },
+  fence: { set: false }, initLock: { present: false, clearable: false, blockers: [] },
+  ownProxy: { available: false, state: 'not built' }, next: ['accounts'],
+};
+function fakeAdmin({ restart = { confirmed: true } } = {}) {
+  const calls = [];
+  return {
+    calls,
+    status: async () => { calls.push(['status']); return STATUS; },
+    render: async () => { calls.push(['render']); return { text: '[Unit]\nDescription=fixture\n' }; },
+    unitAction: async op => { calls.push(['unit', op]); return op === 'restart' ? { receipt: { op: 'unit.restart' }, evidence: restart } : { op, ok: true }; },
+    initLockClear: async () => { calls.push(['init-lock.clear']); return { cleared: true, receipt: { op: 'init-lock.clear' } }; },
+    fenceClear: async call => { calls.push(['fence.clear']); return call('proxy.fence.clear', { evidence: restart }); },
+  };
+}
+const human = () => io();
+
+test('every new setup verb refuses inside an agent shell and with --tester, before the controller runs', async () => {
+  const admin = fakeAdmin();
+  for (const args of [['proxy', 'status'], ['proxy', 'status', '--json'], ['proxy', 'unit', 'render'], ['proxy', 'unit', 'start'], ['proxy', 'unit', 'restart'],
+    ['proxy', 'init-lock', 'status'], ['proxy', 'init-lock', 'clear'], ['proxy', 'fence', 'clear', '--restart', '--business', 'demo'], ['proxy', 'init', '--generate-key', '--business', 'demo']]) {
+    await assert.rejects(main(args, io({ CODEX_THREAD_ID: 'fixture' }), { system: fakeSystem(), proxyAdmin: admin, transport: () => () => { throw Error('must not call'); } }), code('human-required'), args.join(' '));
+    await assert.rejects(main([...args, '--tester'], human(), { system: fakeSystem(), proxyAdmin: admin }), code('human-required'), `${args.join(' ')} --tester`);
+  }
+  assert.deepEqual(admin.calls, []);
+});
+
+test('proxy status prints the same facts the page shows, and --json the status object', async () => {
+  const admin = fakeAdmin();
+  const x = human();
+  await main(['proxy', 'status'], x, { system: fakeSystem(), proxyAdmin: admin });
+  assert.match(x.out.text, /^release: 8\.0\.42 \(panel 1\.26\.7\) hashes verified$/m);
+  assert.match(x.out.text, /^unit: mosaic-proxy\.service installed, active pid 77, port 18432 answering$/m);
+  assert.match(x.out.text, /^own proxy: not built$/m);
+  assert.match(x.out.text, /^next: accounts$/m);
+  const y = human();
+  await main(['proxy', 'status', '--json'], y, { system: fakeSystem(), proxyAdmin: admin });
+  assert.deepEqual(JSON.parse(y.out.text), STATUS);
+  await assert.rejects(main(['proxy', 'status', '--verbose'], human(), { system: fakeSystem(), proxyAdmin: admin }), code('proxy-usage'));
+});
+
+test('proxy unit and init-lock verbs map one to one onto the controller; bad usage refuses', async () => {
+  const admin = fakeAdmin();
+  const x = human();
+  await main(['proxy', 'unit', 'render'], x, { system: fakeSystem(), proxyAdmin: admin });
+  assert.equal(x.out.text, '[Unit]\nDescription=fixture\n');
+  for (const op of ['install', 'start', 'stop']) await main(['proxy', 'unit', op], human(), { system: fakeSystem(), proxyAdmin: admin });
+  await main(['proxy', 'unit', 'status'], human(), { system: fakeSystem(), proxyAdmin: admin });
+  await main(['proxy', 'init-lock', 'status'], human(), { system: fakeSystem(), proxyAdmin: admin });
+  const y = human();
+  await main(['proxy', 'init-lock', 'clear'], y, { system: fakeSystem(), proxyAdmin: admin });
+  assert.equal(JSON.parse(y.out.text).cleared, true);
+  assert.deepEqual(admin.calls, [['render'], ['unit', 'install'], ['unit', 'start'], ['unit', 'stop'], ['status'], ['status'], ['init-lock.clear']]);
+  for (const args of [['proxy', 'unit'], ['proxy', 'unit', 'reload'], ['proxy', 'unit', 'start', 'now'], ['proxy', 'init-lock'], ['proxy', 'init-lock', 'clear', '--force']])
+    await assert.rejects(main(args, human(), { system: fakeSystem(), proxyAdmin: admin }), code('proxy-usage'), args.join(' '));
+});
+
+test('a controller refusal reaches the shell as its proxy code only, with no path or detail', async () => {
+  const admin = fakeAdmin();
+  admin.unitAction = async () => { throw Object.assign(Error('/home/owner/.config/mosaic-dev/proxy.json pa-cli-sentinel'), { code: 'proxy-unit-missing' }); };
+  admin.status = async () => { throw Error('pa-cli-sentinel'); };
+  await assert.rejects(main(['proxy', 'unit', 'start'], human(), { system: fakeSystem(), proxyAdmin: admin }), e => e.code === 'proxy-unit-missing' && !e.message.includes('pa-cli-sentinel') && !e.message.includes('/home/'));
+  await assert.rejects(main(['proxy', 'status'], human(), { system: fakeSystem(), proxyAdmin: admin }), e => e.code === 'proxy-unit-failed' && !e.message.includes('pa-cli-sentinel'));
+});
+
+test('proxy init --generate-key needs no terminal, never prompts, and sends generate to the bus', async () => {
+  const x = human();
+  assert.notEqual(x.stdin.isTTY, true);
+  const calls = [], system = fakeSystem();
+  await main(['proxy', 'init', '--generate-key', '--business', 'demo', '--port', '18440', '--rotate-grace-minutes', '5'], x, {
+    system, promptProxyKey: () => { throw Error('must not prompt'); },
+    transport: b => async (verb, args) => { calls.push({ b, verb, args }); return { port: 18440, rotateGraceMinutes: 5, binary: '/fixture' }; } });
+  assert.deepEqual(calls, [{ b: 'demo', verb: 'proxy.init', args: { generate: true, port: 18440, rotateGraceMinutes: 5 } }]);
+  assert.deepEqual(JSON.parse(x.out.text), { port: 18440, rotateGraceMinutes: 5, firstOutputSeconds: null, generated: true });
+  // The same init receipt the page writes, settings only.
+  const [receipt] = readFileSync(join(system.dataRoot, 'state', 'proxy-admin.jsonl'), 'utf8').trim().split('\n').map(JSON.parse);
+  assert.deepEqual({ ...receipt, time: 'T' }, { time: 'T', op: 'init', generated: true, port: 18440, rotateGraceMinutes: 5, firstOutputSeconds: null });
+  assert.match(x.err.text, /^receipt: \{"time":/m);
+  await assert.rejects(main(['proxy', 'init', '--generate-key', '--generate-key', '--business', 'demo'], human(), { system: fakeSystem() }), code('proxy-usage'));
+  await assert.rejects(main(['proxy', 'init', '--generate-key', '--port', '8317', '--business', 'demo'], human(), { system: fakeSystem() }), code('proxy-config-invalid'));
+});
+
+test('proxy fence clear --restart restarts first and clears only on a confirmed restart', async () => {
+  const admin = fakeAdmin();
+  const calls = [];
+  const x = human();
+  await main(['proxy', 'fence', 'clear', '--restart', '--business', 'demo'], x, { system: fakeSystem(), proxyAdmin: admin,
+    transport: b => async (verb, args) => { calls.push({ b, verb, args }); return { cleared: true, evidence: { after: { pid: 2 } } }; } });
+  assert.deepEqual(admin.calls, [['unit', 'restart'], ['fence.clear']]);
+  assert.deepEqual(calls, [{ b: 'demo', verb: 'proxy.fence.clear', args: { evidence: { confirmed: true } } }]);
+  assert.deepEqual(JSON.parse(x.out.text), { restart: { op: 'unit.restart' }, cleared: true, evidence: { after: { pid: 2 } } });
+  const unconfirmed = fakeAdmin({ restart: { confirmed: false } });
+  await assert.rejects(main(['proxy', 'fence', 'clear', '--restart', '--business', 'demo'], human(), { system: fakeSystem(), proxyAdmin: unconfirmed,
+    transport: () => () => { throw Error('must not call'); } }), code('proxy-restart-unconfirmed'));
+  assert.deepEqual(unconfirmed.calls, [['unit', 'restart']]);
+  await assert.rejects(main(['proxy', 'fence', 'clear', '--restart', '--restart'], human(), { system: fakeSystem(), proxyAdmin: admin }), code('proxy-usage'));
+});
+
+test('proxy fetch shows the page\'s progress steps and writes the same fetch receipt; stdout keeps its line', async () => {
+  const system = fakeSystem();
+  const x = human();
+  await proxyCommand(['fetch'], x, { system, fetch: async ({ progress }) => { for (const step of ['download-archive', 'verify-archive', 'install']) progress(step); return { binary: 'fixture-binary', panel: 'fixture-panel' }; } });
+  assert.deepEqual(JSON.parse(x.out.text), { binary: 'fixture-binary', panel: 'fixture-panel' });
+  assert.match(x.err.text, /^fetch: download-archive\nfetch: verify-archive\nfetch: install\nreceipt: /);
+  const receipts = readFileSync(join(system.dataRoot, 'state', 'proxy-admin.jsonl'), 'utf8').trim().split('\n').map(JSON.parse);
+  assert.equal(receipts.length, 1);
+  assert.equal(receipts[0].op, 'fetch');
+  assert.equal(receipts[0].verified, true);
+  assert.match(receipts[0].archiveSha256, /^[0-9a-f]{64}$/);
+  // A failed hash check writes no receipt and keeps its code.
+  const failed = fakeSystem();
+  await assert.rejects(proxyCommand(['fetch'], human(), { system: failed, fetch: async () => { throw Object.assign(Error('mismatch'), { code: 'proxy-fetch-hash' }); } }), code('proxy-fetch-hash'));
+  assert.throws(() => readFileSync(join(failed.dataRoot, 'state', 'proxy-admin.jsonl')), { code: 'ENOENT' });
+});

packages/model-proxy/README.md

@@ -125,3 +125,54 @@ buses, the proxy's own panel, other holders of the management key, and the
 human `proxy fetch` and `proxy init` tools do not participate. Such writers can
 still race a whole-list write or alter proxy state. A server-side fence is a
 follow-up; do not run those writers concurrently with organization buses.
+
+### Setup from the Console (#1873)
+
+Settings > Model proxy has a Proxy setup panel for the instance owner: the
+`--dev-local-owner` owner on a dev Console, or the root owner under `--sso`.
+Agents, testers and grant holders get `human-required` on every setup route,
+read or write. The panel shows the release (pinned version, hashes verified),
+initialization, the unit (installed, active, pid, port), the fence, the init
+lock, each organization's proxy (shared) and catalogue, and own proxy. Each
+state offers its next step as one button. CLI parity:
+
+    mosaic proxy status [--json]
+    mosaic proxy fetch
+    mosaic proxy init --generate-key [--port N] [--rotate-grace-minutes N] [--first-output-seconds N] --business ID
+    mosaic proxy unit render|status|install|start|stop|restart
+    mosaic proxy fence clear --restart --business ID
+    mosaic proxy init-lock status|clear
+
+- Fetch runs the same PIN and hash checks as `mosaic proxy fetch`; the page
+  shows each step as it runs.
+- Init asks the bus to generate the management key (`proxy.init` with
+  `generate: true`, 48 CSPRNG bytes). The key goes to the key file only; no
+  response, event or receipt carries it. A pasted key with its confirmation is
+  accepted only when the page is on HTTPS or on loopback from a loopback
+  peer; a plain-HTTP LAN page gets the generated key only
+  (`proxy-key-transport`). Init keeps its exclusive-create rules and never
+  rewrites `config.json`. Restart the other buses afterwards.
+- The unit verbs install the same user unit as `scripts/proxy-service.sh`.
+  Health is the unit's main process tree listening on the configured port.
+- `fence clear --restart` (and the page's fence step) restarts the unit,
+  confirms a new process that started after the fence and listens on the port,
+  then clears the fence with that evidence under the lock. The receipt holds the
+  before and after pids. Without a confirmed restart it refuses
+  (`proxy-restart-unconfirmed`). A fence file with no readable time also refuses,
+  because a restart cannot be shown to come after it; restart the service
+  yourself and use `fence clear --proxy-restarted`, which is unchanged.
+- `proxy-admin-busy` (one setup action at a time) is per process: the Console
+  and a `mosaic proxy` command each hold their own. The writes that matter are
+  still serialized across processes: init by the bus's init lock and
+  exclusive create, key writes by the instance-wide proxy lock, and unit
+  actions by systemd.
+- The page and `status --json` carry the last ten receipts from
+  `proxy-admin.jsonl`, so they survive a reload. CLI `init --generate-key`
+  writes the same init receipt as the page.
+- The init lock clears only when every bus on the instance is stopped and no
+  `proxy.json`, key file or proxy state directory exists. Otherwise the panel
+  and `init-lock status` list why not.
+- Own proxy per organization is not built: the configuration has one proxy
+  per instance (ruling 8, deferred).
+
+Receipts: `<dataRoot>/state/proxy-admin.jsonl` (labels, pids and port only).

packages/model-proxy/src/admin-control.mjs

@@ -0,0 +1,140 @@
+// #1873 proxy setup controller shared by the Console page (webui proxy-admin.mjs) and
+// `mosaic proxy status|unit|init-lock|fence clear --restart`. Host actions run here; init and
+// the fence clear go to the bus, which decides them. Results and receipts carry labels, key IDs
+// and process ids only: never a key, token, absolute path or upstream text.
+import { homedir } from 'node:os';
+import { fetchPinned } from './fetch.mjs';
+import { PIN } from './common.mjs';
+import { releaseState, initState, fenceState, initLockStatus, clearInitLock, appendReceipt, recentReceipts, createUnitControl, FILE_LABELS } from './admin.mjs';
+
+export const proxyCode = (error, fallback) => (/^proxy-[a-z-]+$/.test(error?.code ?? '') ? error.code : fallback);
+const failure = code => Object.assign(new Error(code), { code });
+
+// `buses()` proves the init-lock condition "bus stopped" ({stopped, running:[label]}).
+// `orgs()` lists the organizations this proxy serves: [{id, catalogue}]. `unit` and `fetch` are
+// (and `pin`) seams for tests; the defaults run the real proxy-service.sh, systemctl and pinned fetch.
+export function createProxyAdmin({ dataRoot, configDir, instance = null, unitDir = null, unit = null, fetch = fetchPinned, buses, orgs = async () => [], now = () => new Date(), env = process.env, pin = PIN }) {
+  const port = () => { try { return initState(configDir, dataRoot).settings?.port ?? null; } catch { return null; } };
+  const control = unit ?? createUnitControl({ instance, unitDir, port, env });
+  let job = { state: 'idle', step: null, receipt: null, error: null };
+  // The last confirmed restart this page made. One fence clear may use it.
+  let restarted = null;
+  let busy = null;
+  const receipt = record => appendReceipt(dataRoot, { time: now().toISOString(), ...record });
+  const fetchRecord = () => ({ op: 'fetch', version: pin.version, panelVersion: pin.panel.version, archiveSha256: pin.archive.sha256, panelSha256: pin.panel.sha256, binarySha256: pin.binary.sha256, verified: true });
+  async function exclusive(name, action) {
+    if (busy) throw failure('proxy-admin-busy');
+    busy = name;
+    try { return await action(); } finally { busy = null; }
+  }
+  async function unitStatus() {
+    try { return await control.status(); } catch (error) { return { unit: control.unit, installed: false, active: 'unknown', healthy: false, error: proxyCode(error, 'proxy-unit-failed') }; }
+  }
+  function nextSteps({ release, init, unitState, fence, lock }) {
+    if (!release.fetched || release.problem) return ['fetch'];
+    if (lock.present) return lock.clearable ? ['init-lock-clear'] : ['init-lock-wait'];
+    if (init.partial || init.problem) return ['init-repair'];
+    if (!init.initialized) return ['init'];
+    if (!unitState.installed) return ['unit-install'];
+    if (unitState.active !== 'active') return ['unit-start'];
+    if (!unitState.healthy) return ['unit-restart'];
+    if (fence) return restarted ? ['fence-clear'] : ['unit-restart'];
+    return ['accounts'];
+  }
+  return {
+    unit: control.unit,
+    async status() {
+      // The job is read before the release: a fetch that ends during the awaits below then reads
+      // "running" (and the page polls again), never "done" next to a release read before it ended.
+      const fetchJob = { ...job };
+      const release = releaseState(dataRoot, pin);
+      const init = initState(configDir, dataRoot);
+      const unitState = await unitStatus();
+      const fence = fenceState(dataRoot);
+      const lock = init.lock ? initLockStatus({ configDir, dataRoot, buses: await buses() }) : { present: false, clearable: false, blockers: [] };
+      let organizations = null;
+      try { organizations = await orgs(); } catch { organizations = null; }
+      return {
+        release: { version: release.version, panelVersion: release.panelVersion, fetched: release.fetched, verified: release.verified, problem: release.problem },
+        init: {
+          initialized: init.initialized, partial: init.partial, problem: init.problem, settings: init.settings,
+          files: Object.entries(init.files).map(([name, found]) => ({ label: FILE_LABELS[name], present: found })),
+        },
+        unit: unitState,
+        fence: fence ? { set: true, org: fence.org ?? null, op: fence.op ?? null, time: fence.time ?? null, invalid: fence.invalid === true } : { set: false },
+        initLock: lock,
+        fetch: fetchJob,
+        restart: restarted ? { confirmed: true, observedAt: restarted.observedAt, pid: restarted.after.pid } : null,
+        busy,
+        receipts: recentReceipts(dataRoot),
+        organizations,
+        // Ruling 8: the system config holds one proxy per instance; an organization's own proxy
+        // needs a config format that does not exist yet.
+        ownProxy: { available: false, state: 'not built', reason: 'This instance has one shared proxy. A separate proxy per organization is not built yet.' },
+        next: nextSteps({ release, init, unitState, fence, lock }),
+      };
+    },
+    // Runs in the background; the page polls status for its step and receipt.
+    fetchStart() {
+      if (job.state === 'running' || busy) throw failure('proxy-admin-busy');
+      job = { state: 'running', step: 'start', receipt: null, error: null };
+      busy = 'fetch';
+      Promise.resolve()
+        .then(() => fetch({ dataRoot, pin, progress: step => { job.step = step; } }))
+        .then(() => {
+          job = { state: 'done', step: 'done', error: null, receipt: receipt(fetchRecord()) };
+        })
+        .catch(error => { job = { state: 'failed', step: job.step, receipt: null, error: proxyCode(error, 'proxy-fetch-failed') }; })
+        .finally(() => { busy = null; });
+      return { state: 'running' };
+    },
+    // The CLI's fetch: the same pinned fetch and receipt, in the foreground. Returns the fetch
+    // result (for the CLI's existing output) and the receipt.
+    async fetchRun({ progress = () => {} } = {}) {
+      if (job.state === 'running') throw failure('proxy-admin-busy');
+      return exclusive('fetch', async () => {
+        const result = await fetch({ dataRoot, pin, progress });
+        return { result, receipt: receipt(fetchRecord()) };
+      });
+    },
+    async init(call, args) {
+      return exclusive('init', async () => {
+        const result = await call('proxy.init', args);
+        const settings = { port: result.port, rotateGraceMinutes: result.rotateGraceMinutes ?? null, firstOutputSeconds: result.firstOutputSeconds ?? null };
+        return { settings, receipt: receipt({ op: 'init', generated: args.generate === true, ...settings }) };
+      });
+    },
+    async render() {
+      const text = await control.render();
+      const home = homedir();
+      return { unit: control.unit, text: home && home !== '/' ? text.split(home).join('~') : text };
+    },
+    async unitAction(op) {
+      return exclusive(`unit-${op}`, async () => {
+        if (op === 'restart') {
+          const { state, evidence } = await control.restart();
+          restarted = evidence.confirmed ? evidence : null;
+          return { state, evidence, receipt: receipt({ op: 'unit.restart', unit: control.unit, confirmed: evidence.confirmed, before: { pid: evidence.before.pid }, after: { pid: evidence.after.pid, listening: evidence.after.listening }, observedAt: evidence.observedAt }) };
+        }
+        const state = await control[op]();
+        // Any other unit action ends the restart this page confirmed.
+        restarted = null;
+        return { state, receipt: receipt({ op: `unit.${op}`, unit: control.unit, active: state.active, pid: state.pid ?? null, healthy: state.healthy === true }) };
+      });
+    },
+    // Only after this page restarted the proxy and saw the new process. The bus re-proves it.
+    async fenceClear(call) {
+      return exclusive('fence-clear', async () => {
+        if (!restarted) throw failure('proxy-restart-required');
+        const evidence = restarted;
+        // Kept until the bus answers: a bus that is down or busy leaves the confirmed restart for a retry.
+        const result = await call('proxy.fence.clear', { evidence });
+        if (restarted === evidence) restarted = null;
+        return { cleared: result.cleared === true, receipt: receipt({ op: 'fence.clear', cleared: result.cleared === true, evidence: result.evidence ?? null }) };
+      });
+    },
+    async initLockClear() {
+      return exclusive('init-lock-clear', async () => ({ receipt: clearInitLock({ configDir, dataRoot, buses: await buses(), now }) }));
+    },
+  };
+}

packages/model-proxy/src/admin.mjs

@@ -0,0 +1,310 @@
+// #1873 proxy setup state and host actions shared by `mosaic proxy` and the Console page.
+// Never imports the management client and never reads the management key file: state is
+// file presence, the pinned install hashes, the fence file and the proxy unit's systemd state.
+// Results and receipts name files by label, never by absolute path, and carry no key.
+import fs from 'node:fs';
+import path from 'node:path';
+import net from 'node:net';
+import { execFile } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { PIN, refuse } from './common.mjs';
+import { installPaths, loadProxy, verifyInstall } from './settings.mjs';
+
+const REPO = fileURLToPath(new URL('../../../', import.meta.url)).replace(/\/$/, '');
+export const INSTANCE_NAME = /^[a-z][a-z0-9]{1,15}$/;
+
+
+export const FILE_LABELS = Object.freeze({ settings: 'proxy.json', key: 'the management key file', proxyDir: 'the proxy state directory', lock: 'the init lock' });
+export function initFiles(configDir, dataRoot) {
+  return {
+    settings: path.join(configDir, 'proxy.json'),
+    key: path.join(configDir, 'secrets', 'proxy-management.key'),
+    proxyDir: path.join(dataRoot, 'proxy'),
+    lock: path.join(configDir, '.proxy-init.lock'),
+  };
+}
+// Presence only. A path that cannot be examined counts as present, so nothing clears on doubt.
+function present(file) { try { fs.lstatSync(file); return true; } catch (error) { return error.code !== 'ENOENT'; } }
+
+const verified = new Map();
+// The pinned release: hashes are checked once per file identity (dev, inode, size, mtime, ctime, mode),
+// in nanoseconds. mtime can be set back by the file's owner; ctime cannot, so an in-place rewrite re-hashes.
+export function releaseState(dataRoot, pin = PIN) {
+  const paths = installPaths(dataRoot, pin);
+  const out = { version: pin.version, panelVersion: pin.panel.version, fetched: false, verified: false, problem: null };
+  let stats;
+  try { stats = [paths.binary, paths.panel].map(file => fs.lstatSync(file, { bigint: true })); }
+  catch (error) { out.problem = error.code === 'ENOENT' ? 'proxy-install-missing' : 'proxy-install-invalid'; return out; }
+  out.fetched = true;
+  const identity = stats.map(s => `${s.dev}:${s.ino}:${s.size}:${s.mtimeNs}:${s.ctimeNs}:${s.mode}`).join('|');
+  if (verified.get(paths.dir) === identity) { out.verified = true; return out; }
+  try { verifyInstall(dataRoot, pin); verified.set(paths.dir, identity); out.verified = true; }
+  catch (error) { out.problem = /^proxy-install-(missing|invalid)$/.test(error.code ?? '') ? error.code : 'proxy-install-invalid'; }
+  return out;
+}
+
+export function initState(configDir, dataRoot) {
+  const files = initFiles(configDir, dataRoot);
+  const found = Object.fromEntries(Object.entries(files).map(([name, file]) => [name, present(file)]));
+  let settings = null, problem = null;
+  if (found.settings) {
+    try {
+      const proxy = loadProxy(configDir, dataRoot);
+      settings = { port: proxy.port, rotateGraceMinutes: proxy.rotateGraceMinutes ?? null, firstOutputSeconds: proxy.firstOutputSeconds ?? null };
+    } catch (error) { problem = /^proxy-[a-z-]+$/.test(error.code ?? '') ? error.code : 'proxy-config-invalid'; }
+  }
+  const initialized = found.settings && found.key && found.proxyDir && !problem;
+  const partial = !initialized && (found.settings || found.key || found.proxyDir);
+  return { initialized, partial, problem, settings, files: found, lock: found.lock };
+}
+
+// Read-only view of the uncertain-write fence. Never constructs a proxy lock, which writes.
+export function fenceState(dataRoot) {
+  const file = path.join(dataRoot, 'proxy', 'mosaic-keys.uncertain');
+  let stat;
+  try { stat = fs.lstatSync(file); } catch (error) { if (error.code === 'ENOENT') return null; return { invalid: true }; }
+  if (!stat.isFile() || stat.uid !== process.getuid() || (stat.mode & 0o077) || stat.size > 4096) return { invalid: true };
+  let entry;
+  try { entry = JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return { invalid: true }; }
+  if (!entry || typeof entry !== 'object' || Array.isArray(entry)) return { invalid: true };
+  return {
+    org: typeof entry.org === 'string' ? entry.org : null,
+    op: typeof entry.op === 'string' ? entry.op : null,
+    time: typeof entry.time === 'string' ? entry.time : null,
+    pid: Number.isSafeInteger(entry.pid) ? entry.pid : null,
+  };
+}
+
+// README conditions for a stale init lock: the bus is stopped (so no init is running), and
+// none of proxy.json, the key file or the proxy dir exists. `buses` is the caller's proof:
+// { stopped: boolean, running: [label] }.
+export function initLockStatus({ configDir, dataRoot, buses }) {
+  const state = initState(configDir, dataRoot);
+  const blockers = [];
+  if (!buses || buses.stopped !== true) blockers.push(`bus running: ${(buses?.running ?? ['unknown']).join(', ')}`);
+  for (const name of ['settings', 'key', 'proxyDir']) if (state.files[name]) blockers.push(`${FILE_LABELS[name]} exists`);
+  return { present: state.lock, clearable: state.lock && blockers.length === 0, blockers: state.lock ? blockers : [] };
+}
+
+export function clearInitLock({ configDir, dataRoot, buses, now = () => new Date() }) {
+  const status = initLockStatus({ configDir, dataRoot, buses });
+  if (!status.present) refuse('proxy-init-lock-absent');
+  if (!status.clearable) refuse('proxy-init-lock-held');
+  const lock = initFiles(configDir, dataRoot).lock;
+  const stat = fs.lstatSync(lock);
+  if (!stat.isFile() || stat.uid !== process.getuid()) refuse('proxy-init-lock-held');
+  fs.unlinkSync(lock);
+  return appendReceipt(dataRoot, { op: 'init-lock.clear', time: now().toISOString(), conditions: ['bus stopped', 'no proxy.json', 'no management key file', 'no proxy state directory'] });
+}
+
+// Append-only admin receipts beside the other state logs. Labels and key ids only.
+export function receiptFile(dataRoot) { return path.join(dataRoot, 'state', 'proxy-admin.jsonl'); }
+export function appendReceipt(dataRoot, record) {
+  const dir = path.join(dataRoot, 'state');
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const fd = fs.openSync(receiptFile(dataRoot), 'a', 0o600);
+  try { fs.writeFileSync(fd, JSON.stringify(record) + '\n'); fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
+  return record;
+}
+
+// The last few receipts, oldest first, for the page after a reload. Reads only the file's tail and
+// skips a line that does not parse (a torn last write). Receipts never hold a key or a body.
+export function recentReceipts(dataRoot, limit = 10) {
+  let fd;
+  try { fd = fs.openSync(receiptFile(dataRoot), 'r'); } catch { return []; }
+  try {
+    const size = fs.fstatSync(fd).size, length = Math.min(size, 65536), buffer = Buffer.alloc(length);
+    fs.readSync(fd, buffer, 0, length, size - length);
+    const lines = buffer.toString('utf8').split('\n').slice(size > length ? 1 : 0).filter(Boolean);
+    const out = [];
+    for (const line of lines) { try { const value = JSON.parse(line); if (value && typeof value === 'object' && typeof value.op === 'string') out.push(value); } catch { /* torn line */ } }
+    return out.slice(-limit);
+  } finally { fs.closeSync(fd); }
+}
+
+export function unitName(instance) {
+  if (instance !== null && instance !== undefined && instance !== 'dev' && !INSTANCE_NAME.test(instance)) refuse('proxy-unit-usage');
+  return instance && instance !== 'dev' ? `mosaic-proxy-${instance}.service` : 'mosaic-proxy.service';
+}
+
+export function defaultRun(command, args, { env, timeout = 60000 } = {}) {
+  return new Promise(resolve => {
+    execFile(command, args, { env, timeout, maxBuffer: 1024 * 1024, killSignal: 'SIGKILL' }, (error, stdout, stderr) => {
+      resolve({ code: error ? (typeof error.code === 'number' ? error.code : 1) : 0, stdout: String(stdout ?? ''), stderr: String(stderr ?? '') });
+    });
+  });
+}
+
+export function probePort(port, { host = '127.0.0.1', timeout = 1000 } = {}) {
+  return new Promise(resolve => {
+    if (!Number.isInteger(port)) return resolve(false);
+    const socket = net.connect({ host, port });
+    const done = value => { socket.destroy(); resolve(value); };
+    socket.setTimeout(timeout, () => done(false));
+    socket.once('connect', () => done(true));
+    socket.once('error', () => done(false));
+  });
+}
+
+const UNIT_CODES = ['proxy-unit-usage', 'proxy-unit-exists', 'proxy-unit-dropin', 'proxy-unit-copy', 'proxy-unit-path', 'proxy-not-configured'];
+const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
+
+// The proxy user unit for one instance. `port` is a function so a fresh init is seen.
+// `unitDir` is passed to proxy-service.sh --dir; null keeps that script's default.
+export function createUnitControl({ instance = null, port = () => null, unitDir = null, env = process.env, run = defaultRun, repo = REPO, probe = probePort, waitMs = 30000, pollMs = 250, now = () => new Date() } = {}) {
+  const unit = unitName(instance);
+  if (unitDir !== null && (typeof unitDir !== 'string' || !path.isAbsolute(unitDir))) refuse('proxy-unit-path');
+  const script = path.join(repo, 'scripts', 'proxy-service.sh');
+  const instanceArgs = instance && instance !== 'dev' ? ['--instance', instance] : [];
+  async function service(op) {
+    const result = await run('bash', [script, ...instanceArgs, op, ...(unitDir && op === 'install' ? ['--dir', unitDir] : [])], { env });
+    if (result.code === 0) return result;
+    const code = /^proxy-service: (proxy-[a-z-]+)$/m.exec(result.stderr)?.[1];
+    refuse(UNIT_CODES.includes(code) ? code : 'proxy-unit-failed');
+  }
+  async function status() {
+    const result = await run('systemctl', ['--user', 'show', unit, '--property=LoadState,ActiveState,SubState,MainPID,ExecMainStartTimestampMonotonic,NRestarts'], { env, timeout: 15000 });
+    if (result.code !== 0) refuse('proxy-unit-failed');
+    const fields = Object.fromEntries(result.stdout.split('\n').filter(Boolean).map(line => { const i = line.indexOf('='); return [line.slice(0, i), line.slice(i + 1)]; }));
+    const pid = /^[1-9][0-9]*$/.test(fields.MainPID ?? '') ? Number(fields.MainPID) : null;
+    const since = /^[1-9][0-9]*$/.test(fields.ExecMainStartTimestampMonotonic ?? '') ? Number(fields.ExecMainStartTimestampMonotonic) : null;
+    const p = port();
+    const listening = fields.ActiveState === 'active' && Number.isInteger(p) ? await probe(p) : false;
+    return {
+      unit,
+      installed: fields.LoadState === 'loaded',
+      load: fields.LoadState ?? 'unknown', active: fields.ActiveState ?? 'unknown', sub: fields.SubState ?? 'unknown',
+      pid, since, restarts: /^[0-9]+$/.test(fields.NRestarts ?? '') ? Number(fields.NRestarts) : null,
+      port: Number.isInteger(p) ? p : null, listening,
+      healthy: fields.ActiveState === 'active' && pid !== null && listening,
+    };
+  }
+  async function waitFor(test) {
+    const deadline = Date.now() + waitMs;
+    for (;;) {
+      const state = await status();
+      if (test(state)) return state;
+      if (Date.now() >= deadline) return state;
+      await sleep(pollMs);
+    }
+  }
+  async function systemctl(verb) {
+    const result = await run('systemctl', ['--user', verb, unit], { env, timeout: 90000 });
+    if (result.code !== 0) refuse('proxy-unit-failed');
+  }
+  return {
+    unit,
+    status,
+    async render() { return (await service('render')).stdout; },
+    async install() { await service('install'); return status(); },
+    async start() {
+      const before = await status();
+      if (!before.installed) refuse('proxy-unit-missing');
+      await systemctl('start');
+      const after = await waitFor(s => s.healthy);
+      if (!after.healthy) refuse('proxy-unit-unhealthy');
+      return after;
+    },
+    async stop() {
+      const before = await status();
+      if (!before.installed) refuse('proxy-unit-missing');
+      await systemctl('stop');
+      return waitFor(s => s.active === 'inactive' || s.active === 'failed');
+    },
+    // Restart evidence is what a fence clear needs: a new main process, started after the old
+    // one, active and answering on the proxy port. Anything less is not a confirmed restart.
+    async restart() {
+      const before = await status();
+      if (!before.installed) refuse('proxy-unit-missing');
+      await systemctl('restart');
+      const changed = s => s.healthy && s.pid !== null && s.pid !== before.pid && s.since !== null && (before.since === null || s.since > before.since);
+      const after = await waitFor(changed);
+      const confirmed = changed(after);
+      return {
+        state: after,
+        evidence: {
+          unit, confirmed,
+          before: { pid: before.pid, since: before.since, active: before.active },
+          after: { pid: after.pid, since: after.since, active: after.active, listening: after.listening },
+          observedAt: now().toISOString(),
+        },
+      };
+    },
+  };
+}
+
+// Process start time as wall-clock milliseconds, from /proc (start ticks since boot + btime).
+export function processStartMs(pid, { proc = '/proc' } = {}) {
+  try {
+    const stat = fs.readFileSync(path.join(proc, String(pid), 'stat'), 'utf8');
+    const fields = stat.slice(stat.lastIndexOf(')') + 2).split(' ');
+    const ticks = Number(fields[19]);
+    const btime = Number(/^btime ([0-9]+)$/m.exec(fs.readFileSync(path.join(proc, 'stat'), 'utf8'))?.[1]);
+    if (!Number.isFinite(ticks) || !Number.isFinite(btime)) return null;
+    return btime * 1000 + Math.floor(ticks * 10);
+  } catch { return null; }
+}
+// `pid` and every process descended from it, from each process's parent field in /proc.
+export function processTree(pid, { proc = '/proc' } = {}) {
+  const parents = new Map();
+  let names; try { names = fs.readdirSync(proc); } catch { return [pid]; }
+  for (const name of names) {
+    if (!/^[1-9][0-9]*$/.test(name)) continue;
+    try {
+      const stat = fs.readFileSync(path.join(proc, name, 'stat'), 'utf8');
+      const ppid = Number(stat.slice(stat.lastIndexOf(')') + 2).split(' ')[1]);
+      if (!parents.has(ppid)) parents.set(ppid, []);
+      parents.get(ppid).push(Number(name));
+    } catch { /* gone */ }
+  }
+  const out = [pid];
+  for (let i = 0; i < out.length && out.length < 256; i++) out.push(...(parents.get(out[i]) ?? []));
+  return out;
+}
+// True when `pid` or one of its descendants holds a listening TCP socket on `port` (IPv4 or
+// IPv6), read from /proc. The unit's main process is the node runner; the pinned binary it
+// spawns is the listener.
+export function pidListensOn(pid, port, { proc = '/proc' } = {}) {
+  const hex = port.toString(16).toUpperCase().padStart(4, '0');
+  const inodes = new Set();
+  for (const table of ['tcp', 'tcp6']) {
+    let text; try { text = fs.readFileSync(path.join(proc, 'net', table), 'utf8'); } catch { continue; }
+    for (const line of text.split('\n').slice(1)) {
+      const cols = line.trim().split(/\s+/);
+      if (cols.length > 9 && cols[1].endsWith(`:${hex}`) && cols[3] === '0A') inodes.add(cols[9]);
+    }
+  }
+  if (inodes.size === 0) return false;
+  for (const member of processTree(pid, { proc })) {
+    let fds; try { fds = fs.readdirSync(path.join(proc, String(member), 'fd')); } catch { continue; }
+    for (const fd of fds) {
+      let link; try { link = fs.readlinkSync(path.join(proc, String(member), 'fd', fd)); } catch { continue; }
+      const m = /^socket:\[([0-9]+)\]$/.exec(link);
+      if (m && inodes.has(m[1])) return true;
+    }
+  }
+  return false;
+}
+
+// A fence clear accepts restart evidence only after re-proving it here, on the host: the
+// evidence names a confirmed restart to a new process, and that process is alive now, started
+// after the fence was set, and is the one listening on the proxy port. Caller-supplied fields
+// are never trusted on their own.
+export function verifyRestart(evidence, { fence, port, startMs = processStartMs, listens = pidListensOn, now = () => Date.now() } = {}) {
+  const int = v => Number.isSafeInteger(v) && v > 0;
+  const plain = v => v !== null && typeof v === 'object' && !Array.isArray(v);
+  if (!plain(evidence) || Object.keys(evidence).sort().join(',') !== 'after,before,confirmed,observedAt,unit'
+      || typeof evidence.unit !== 'string' || !/^mosaic-proxy(-[a-z][a-z0-9]{1,15})?\.service$/.test(evidence.unit)
+      || typeof evidence.observedAt !== 'string' || Number.isNaN(Date.parse(evidence.observedAt))
+      || !plain(evidence.before) || !plain(evidence.after)) refuse('proxy-restart-unconfirmed');
+  const { before, after } = evidence;
+  if (evidence.confirmed !== true || !int(after.pid) || !int(after.since) || after.pid === before.pid) refuse('proxy-restart-unconfirmed');
+  const observed = Date.parse(evidence.observedAt);
+  if (observed > now() + 60000 || now() - observed > 10 * 60 * 1000) refuse('proxy-restart-unconfirmed');
+  const started = startMs(after.pid);
+  if (started === null) refuse('proxy-restart-unconfirmed');
+  const fenceTime = fence && typeof fence.time === 'string' ? Date.parse(fence.time) : NaN;
+  if (fence && !(Number.isFinite(fenceTime) && started > fenceTime)) refuse('proxy-restart-unconfirmed');
+  if (!Number.isInteger(port) || !listens(after.pid, port)) refuse('proxy-restart-unconfirmed');
+  return { unit: evidence.unit, before: { pid: int(before.pid) ? before.pid : null }, after: { pid: after.pid, startedAt: new Date(started).toISOString() }, observedAt: evidence.observedAt, listeningPort: port };
+}

packages/model-proxy/src/fetch.mjs

@@ -29,15 +29,21 @@ export async function downloadRelease(url, { testOrigin } = {}) {
   }
   refuse('proxy-fetch-redirect');
 }
-export async function fetchPinned({ dataRoot, pin = PIN, download = downloadRelease }) {
+// `progress(step)` names each stage for a caller that shows it (#1873 Console page); never a path.
+export async function fetchPinned({ dataRoot, pin = PIN, download = downloadRelease, progress = () => {} }) {
   safePath(dataRoot, 'proxy-fetch-existing');
   const paths = installPaths(dataRoot, pin);
   safePath(paths.dir, 'proxy-fetch-existing');
   // Fetch and verify both assets before any install filesystem mutation.
+  progress('download-archive');
   const archive = await download(pin.archive.url);
+  progress('verify-archive');
   if (sha256(archive) !== pin.archive.sha256) refuse('proxy-fetch-hash');
+  progress('download-panel');
   const panel = await download(pin.panel.url);
+  progress('verify-panel');
   if (sha256(panel) !== pin.panel.sha256) refuse('proxy-fetch-hash');
+  progress('extract-binary');
   let binary;
   try {
     const listing = execFileSync('tar', ['-tzf', '-'], { input: archive, maxBuffer: 1024 * 1024, stdio: ['pipe', 'pipe', 'pipe'] }).toString().split('\n').filter(Boolean);
@@ -45,7 +51,9 @@ export async function fetchPinned({ dataRoot, pin = PIN, download = downloadRele
     // Only the root executable is read to stdout. No archive path is extracted to disk.
     binary = execFileSync('tar', ['-xOzf', '-', 'cli-proxy-api'], { input: archive, maxBuffer: 256 * 1024 * 1024, stdio: ['pipe', 'pipe', 'pipe'] });
   } catch { refuse('proxy-fetch-archive'); }
+  progress('verify-binary');
   if (sha256(binary) !== pin.binary.sha256) refuse('proxy-fetch-hash');
+  progress('install');
   try {
     fs.lstatSync(paths.dir);
     if (fs.readdirSync(paths.dir).sort().join(',') !== 'cli-proxy-api,static'

packages/model-proxy/tests/admin-control.test.mjs

@@ -0,0 +1,229 @@
+// #1873 the setup controller the Console page and `mosaic proxy` share: next steps from state,
+// a fetch receipt with every pinned hash, init through the bus call, and the fence clear that
+// needs a restart this controller confirmed.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { createHash } from 'node:crypto';
+import { createProxyAdmin } from '../src/admin-control.mjs';
+import { initFiles, receiptFile } from '../src/admin.mjs';
+import { PIN } from '../src/common.mjs';
+
+const code = name => error => error.code === name;
+const SENTINEL = 'pa-sentinel-management-key-0123456789';
+const stopped = async () => ({ stopped: true, running: [] });
+
+function fixture(t, { unitState = { installed: false, active: 'inactive', healthy: false }, restart = null, fetch = null, pin = PIN, statusHook = null } = {}) {
+  const root = fs.mkdtempSync(join(tmpdir(), 'pc-'));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  const configDir = join(root, 'config'), dataRoot = join(root, 'data');
+  fs.mkdirSync(configDir, { mode: 0o700 }); fs.mkdirSync(dataRoot, { mode: 0o700 });
+  const ops = [];
+  const unit = {
+    unit: 'mosaic-proxy-zz.service',
+    status: async () => { await statusHook?.(); return { unit: 'mosaic-proxy-zz.service', ...unitState }; },
+    render: async () => `ExecStart=/usr/bin/node ${process.env.HOME ?? '/nohome'}/repo/run.mjs\n`,
+    install: async () => { ops.push('install'); return { ...unitState, installed: true }; },
+    start: async () => { ops.push('start'); return { ...unitState, active: 'active', pid: 11, healthy: true }; },
+    stop: async () => { ops.push('stop'); return { ...unitState, active: 'inactive', pid: null }; },
+    restart: async () => { ops.push('restart'); return restart ?? { state: unitState, evidence: { unit: 'mosaic-proxy-zz.service', confirmed: true, before: { pid: 10, since: 1, active: 'active' }, after: { pid: 11, since: 2, active: 'active', listening: true }, observedAt: new Date(0).toISOString() } }; },
+  };
+  const admin = createProxyAdmin({ dataRoot, configDir, unit, buses: stopped, fetch: fetch ?? (async () => ({})), now: () => new Date(0), orgs: async () => [{ id: 'acme', catalogue: 'ready' }], pin });
+  return { root, configDir, dataRoot, admin, ops, files: initFiles(configDir, dataRoot) };
+}
+const receipts = dataRoot => { try { return fs.readFileSync(receiptFile(dataRoot), 'utf8').trim().split('\n').filter(Boolean).map(JSON.parse); } catch { return []; } };
+
+test('a fresh instance says fetch first; status names files by label and offers no own proxy', async t => {
+  const { root, admin } = fixture(t);
+  const status = await admin.status();
+  assert.deepEqual(status.next, ['fetch']);
+  assert.equal(status.release.version, PIN.version);
+  assert.equal(status.release.fetched, false);
+  assert.deepEqual(status.init.files.map(f => f.label), ['proxy.json', 'the management key file', 'the proxy state directory', 'the init lock']);
+  assert.deepEqual(status.ownProxy, { available: false, state: 'not built', reason: 'This instance has one shared proxy. A separate proxy per organization is not built yet.' });
+  assert.deepEqual(status.organizations, [{ id: 'acme', catalogue: 'ready' }]);
+  assert.equal(JSON.stringify(status).includes(root), false);
+});
+
+test('fetch runs in the background, reports each step and writes a receipt with every pinned hash', async t => {
+  const steps = [];
+  let release;
+  const gate = new Promise(r => { release = r; });
+  const { dataRoot, admin } = fixture(t, { fetch: async ({ pin, progress }) => { assert.equal(pin, PIN); progress('verify-archive'); steps.push('called'); await gate; } });
+  assert.deepEqual(admin.fetchStart(), { state: 'running' });
+  await new Promise(r => setImmediate(r));
+  assert.throws(() => admin.fetchStart(), code('proxy-admin-busy'));
+  await assert.rejects(admin.unitAction('start'), code('proxy-admin-busy'));
+  const running = await admin.status();
+  assert.equal(running.fetch.state, 'running'); assert.equal(running.fetch.step, 'verify-archive'); assert.equal(running.busy, 'fetch');
+  release();
+  await new Promise(r => setTimeout(r, 10));
+  const done = await admin.status();
+  assert.equal(done.fetch.state, 'done');
+  assert.deepEqual(done.fetch.receipt, { time: new Date(0).toISOString(), op: 'fetch', version: PIN.version, panelVersion: PIN.panel.version, archiveSha256: PIN.archive.sha256, panelSha256: PIN.panel.sha256, binarySha256: PIN.binary.sha256, verified: true });
+  assert.deepEqual(receipts(dataRoot), [done.fetch.receipt]);
+});
+
+test('a fetch that ends while status is being read is never reported done with the release still not fetched', async t => {
+  // E2E finding: status read the release before its awaits and the job after them, so the page
+  // saw "done" next to "Not fetched", stopped polling and kept offering Fetch.
+  const sha = text => createHash('sha256').update(text).digest('hex');
+  const pin = { ...PIN, archive: { ...PIN.archive, sha256: sha('a') }, binary: { sha256: sha('b') }, panel: { ...PIN.panel, sha256: sha('p') } };
+  let release, during = null;
+  const gate = new Promise(r => { release = r; });
+  const f = fixture(t, { pin, statusHook: async () => { const d = during; during = null; await d?.(); }, fetch: async ({ dataRoot }) => {
+    await gate;
+    const dir = join(dataRoot, 'opt', 'cliproxyapi', PIN.version);
+    fs.mkdirSync(join(dir, 'static'), { recursive: true });
+    fs.writeFileSync(join(dir, 'cli-proxy-api'), 'b'); fs.writeFileSync(join(dir, 'static', 'management.html'), 'p');
+  } });
+  f.admin.fetchStart();
+  await new Promise(r => setImmediate(r));
+  during = async () => { release(); await new Promise(r => setTimeout(r, 10)); };
+  const racing = await f.admin.status();
+  assert.equal(during, null, 'the fetch ended inside this status read');
+  assert.equal(racing.fetch.state === 'done' && !racing.release.fetched, false, `fetch ${racing.fetch.state} with release fetched=${racing.release.fetched}`);
+  const after = await f.admin.status();
+  assert.equal(after.fetch.state, 'done'); assert.equal(after.release.verified, true); assert.equal(after.next[0], 'init');
+});
+
+test('a refused fetch keeps its code and writes no receipt', async t => {
+  const { dataRoot, admin } = fixture(t, { fetch: async () => { throw Object.assign(Error('/home/x upstream body'), { code: 'proxy-fetch-hash' }); } });
+  admin.fetchStart();
+  await new Promise(r => setTimeout(r, 10));
+  const status = await admin.status();
+  assert.equal(status.fetch.state, 'failed'); assert.equal(status.fetch.error, 'proxy-fetch-hash');
+  assert.equal(JSON.stringify(status).includes('upstream body'), false);
+  assert.deepEqual(receipts(dataRoot), []);
+});
+
+test('init sends the arguments to proxy.init and its receipt carries settings only', async t => {
+  const { dataRoot, admin } = fixture(t);
+  const calls = [];
+  const result = await admin.init(async (verb, args) => { calls.push([verb, args]); return { port: 18432, binary: '/fixture', rotateGraceMinutes: 5, firstOutputSeconds: 90 }; }, { generate: true, port: 18432 });
+  assert.deepEqual(calls, [['proxy.init', { generate: true, port: 18432 }]]);
+  assert.deepEqual(result.settings, { port: 18432, rotateGraceMinutes: 5, firstOutputSeconds: 90 });
+  assert.deepEqual(receipts(dataRoot), [{ time: new Date(0).toISOString(), op: 'init', generated: true, port: 18432, rotateGraceMinutes: 5, firstOutputSeconds: 90 }]);
+  await admin.init(async () => ({ port: 18433, binary: '/fixture' }), { key: SENTINEL });
+  assert.equal(fs.readFileSync(receiptFile(dataRoot), 'utf8').includes(SENTINEL), false);
+  assert.equal(JSON.stringify(receipts(dataRoot)).includes('/fixture'), false);
+});
+
+test('fence clear refuses without a restart, and after an unconfirmed one, before calling the bus', async t => {
+  const { admin, ops } = fixture(t, { restart: { state: {}, evidence: { unit: 'mosaic-proxy-zz.service', confirmed: false, before: { pid: 10 }, after: { pid: 10, listening: true }, observedAt: new Date(0).toISOString() } } });
+  const calls = [];
+  const call = async (verb, args) => { calls.push([verb, args]); return { cleared: true }; };
+  await assert.rejects(admin.fenceClear(call), code('proxy-restart-required'));
+  const restart = await admin.unitAction('restart');
+  assert.equal(restart.evidence.confirmed, false);
+  assert.equal(restart.receipt.confirmed, false);
+  await assert.rejects(admin.fenceClear(call), code('proxy-restart-required'));
+  assert.deepEqual(calls, []);
+  assert.deepEqual(ops, ['restart']);
+});
+
+test('fence clear after a confirmed restart sends that evidence once; another unit action ends it', async t => {
+  const { dataRoot, admin } = fixture(t, { unitState: { installed: true, active: 'active', healthy: true, pid: 11 } });
+  const calls = [];
+  const call = async (verb, args) => { calls.push([verb, args]); return { cleared: true, evidence: { after: { pid: 11 } } }; };
+  const restart = await admin.unitAction('restart');
+  assert.equal(restart.evidence.confirmed, true);
+  assert.deepEqual((await admin.status()).restart, { confirmed: true, observedAt: new Date(0).toISOString(), pid: 11 });
+  const cleared = await admin.fenceClear(call);
+  assert.deepEqual(calls, [['proxy.fence.clear', { evidence: restart.evidence }]]);
+  assert.equal(cleared.cleared, true);
+  assert.deepEqual(cleared.receipt.evidence, { after: { pid: 11 } });
+  await assert.rejects(admin.fenceClear(call), code('proxy-restart-required'), 'one restart, one clear');
+  await admin.unitAction('restart');
+  await admin.unitAction('stop');
+  await assert.rejects(admin.fenceClear(call), code('proxy-restart-required'), 'a stop ends the confirmed restart');
+  assert.deepEqual(receipts(dataRoot).map(r => r.op), ['unit.restart', 'fence.clear', 'unit.restart', 'unit.stop']);
+});
+
+test('a fence clear the bus did not answer keeps the confirmed restart for a retry', async t => {
+  const { admin } = fixture(t, { unitState: { installed: true, active: 'active', healthy: true, pid: 11 } });
+  let fail = true;
+  const call = async () => { if (fail) { fail = false; throw Object.assign(new Error('bus down'), { code: 'bus-unavailable' }); } return { cleared: true }; };
+  await admin.unitAction('restart');
+  await assert.rejects(admin.fenceClear(call), /bus down/);
+  assert.equal((await admin.status()).restart?.confirmed, true, 'the restart is still confirmed');
+  assert.equal((await admin.fenceClear(call)).cleared, true);
+  assert.equal((await admin.status()).restart, null);
+});
+
+test('next step walks fetch, init lock, repair, init, unit install, start, restart, fence and accounts', async t => {
+  const sha = text => createHash('sha256').update(text).digest('hex');
+  const pin = { ...PIN, archive: { ...PIN.archive, sha256: sha('a') }, binary: { sha256: sha('b') }, panel: { ...PIN.panel, sha256: sha('p') } };
+  const state = { installed: false, active: 'inactive', healthy: false, pid: null };
+  const f = fixture(t, { unitState: state, pin });
+  const next = async () => (await f.admin.status()).next[0];
+  assert.equal(await next(), 'fetch');
+  const binDir = join(f.dataRoot, 'opt', 'cliproxyapi', PIN.version);
+  fs.mkdirSync(join(binDir, 'static'), { recursive: true });
+  fs.writeFileSync(join(binDir, 'cli-proxy-api'), 'b'); fs.writeFileSync(join(binDir, 'static', 'management.html'), 'wrong');
+  assert.equal(await next(), 'fetch', 'a hash mismatch is not a fetched release');
+  fs.rmSync(join(binDir, 'static', 'management.html')); fs.writeFileSync(join(binDir, 'static', 'management.html'), 'p');
+  fs.mkdirSync(join(f.configDir, 'secrets'), { mode: 0o700 });
+  fs.writeFileSync(f.files.key, 'fixture', { mode: 0o600 });
+  fs.writeFileSync(f.files.lock, '', { mode: 0o600 });
+  assert.equal(await next(), 'init-lock-wait', 'a key file blocks the lock clear');
+  fs.rmSync(f.files.key);
+  assert.equal(await next(), 'init-lock-clear');
+  fs.rmSync(f.files.lock);
+  fs.writeFileSync(f.files.key, 'fixture', { mode: 0o600 });
+  assert.equal(await next(), 'init-repair');
+  fs.rmSync(f.files.key);
+  assert.equal(await next(), 'init');
+  fs.writeFileSync(f.files.key, 'fixture', { mode: 0o600 });
+  fs.mkdirSync(f.files.proxyDir, { mode: 0o700 });
+  fs.writeFileSync(f.files.settings, JSON.stringify({ binary: join(binDir, 'cli-proxy-api'), port: 18432 }), { mode: 0o600 });
+  const initialized = await f.admin.status();
+  assert.equal(initialized.init.initialized, true);
+  assert.deepEqual(initialized.init.settings, { port: 18432, rotateGraceMinutes: null, firstOutputSeconds: null });
+  assert.equal(initialized.next[0], 'unit-install');
+  state.installed = true;
+  assert.equal(await next(), 'unit-start');
+  state.active = 'active';
+  assert.equal(await next(), 'unit-restart', 'active but not answering');
+  state.healthy = true;
+  assert.equal(await next(), 'accounts');
+  fs.writeFileSync(join(f.files.proxyDir, 'mosaic-keys.uncertain'), JSON.stringify({ org: 'acme', op: 'write', time: new Date(0).toISOString(), pid: 1 }), { mode: 0o600 });
+  const fenced = await f.admin.status();
+  assert.deepEqual(fenced.fence, { set: true, org: 'acme', op: 'write', time: new Date(0).toISOString(), invalid: false });
+  assert.equal(fenced.next[0], 'unit-restart', 'a fence needs a restart first');
+  await f.admin.unitAction('restart');
+  assert.equal(await next(), 'fence-clear');
+});
+
+test('the init lock clears through the controller only on the README conditions', async t => {
+  const { dataRoot, admin, files } = fixture(t);
+  await assert.rejects(admin.initLockClear(), code('proxy-init-lock-absent'));
+  fs.writeFileSync(files.lock, '', { mode: 0o600 });
+  fs.mkdirSync(files.proxyDir, { mode: 0o700 });
+  await assert.rejects(admin.initLockClear(), code('proxy-init-lock-held'));
+  assert.deepEqual((await admin.status()).initLock, { present: true, clearable: false, blockers: ['the proxy state directory exists'] });
+  fs.rmdirSync(files.proxyDir);
+  const result = await admin.initLockClear();
+  assert.equal(result.receipt.op, 'init-lock.clear');
+  assert.equal(fs.existsSync(files.lock), false);
+  assert.deepEqual(receipts(dataRoot).map(r => r.op), ['init-lock.clear']);
+});
+
+test('render replaces the home directory with ~', async t => {
+  const { admin } = fixture(t);
+  const { unit, text } = await admin.render();
+  assert.equal(unit, 'mosaic-proxy-zz.service');
+  if (process.env.HOME && process.env.HOME !== '/') assert.equal(text.includes(process.env.HOME), false);
+});
+
+test('status carries the last receipts from proxy-admin.jsonl, so the page shows them after a reload', async t => {
+  const { dataRoot, admin } = fixture(t, { unitState: { installed: true, active: 'active', healthy: true, pid: 11 } });
+  assert.deepEqual((await admin.status()).receipts, []);
+  for (let i = 0; i < 12; i++) await admin.unitAction('stop');
+  fs.appendFileSync(receiptFile(dataRoot), '{"op":"torn');
+  const { receipts } = await admin.status();
+  assert.equal(receipts.length, 10);
+  assert.ok(receipts.every(r => r.op === 'unit.stop'));
+});

packages/model-proxy/tests/admin.test.mjs

@@ -0,0 +1,195 @@
+// #1873 proxy setup host helpers: restart proof from a fake /proc, the stale init-lock rules,
+// unit control over a fake systemctl, and receipts that carry no path or key.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { createHash } from 'node:crypto';
+import { PIN } from '../src/common.mjs';
+import { installPaths } from '../src/settings.mjs';
+import {
+  processTree, pidListensOn, processStartMs, verifyRestart, initLockStatus, clearInitLock, initFiles, initState,
+  fenceState, createUnitControl, releaseState, receiptFile, unitName,
+} from '../src/admin.mjs';
+
+const code = name => error => error.code === name;
+const scratch = t => { const dir = fs.mkdtempSync(join(tmpdir(), 'pa-')); t.after(() => fs.rmSync(dir, { recursive: true, force: true })); return dir; };
+
+// A fake /proc: runner pid 100 (start tick 500), its child 101 listens on `port` via socket inode 5555.
+function fakeProc(t, { port = 8080, listener = 101, start = 500 } = {}) {
+  const proc = join(scratch(t), 'proc');
+  const stat = (pid, ppid, ticks) => `${pid} (node) S ${ppid} 1 1 0 -1 0 0 0 0 0 0 0 0 0 20 0 1 0 ${ticks} 0 0\n`;
+  fs.mkdirSync(join(proc, 'net'), { recursive: true });
+  fs.writeFileSync(join(proc, 'stat'), 'cpu 0\nbtime 1000\n');
+  for (const [pid, ppid, ticks] of [[1, 0, 1], [100, 1, start], [101, 100, start + 1], [200, 1, 1]]) {
+    fs.mkdirSync(join(proc, String(pid), 'fd'), { recursive: true });
+    fs.writeFileSync(join(proc, String(pid), 'stat'), stat(pid, ppid, ticks));
+  }
+  fs.symlinkSync('socket:[5555]', join(proc, String(listener), 'fd', '3'));
+  fs.symlinkSync('/dev/null', join(proc, '100', 'fd', '0'));
+  const hex = port.toString(16).toUpperCase().padStart(4, '0');
+  fs.writeFileSync(join(proc, 'net', 'tcp'), '  sl  local_address rem_address   st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode\n'
+    + `   0: 0100007F:${hex} 00000000:0000 0A 00000000:00000000 00:00000000 00000000  1000        0 5555 1 0 100 0 0 10 0\n`
+    + `   1: 0100007F:${hex} 0100007F:9999 01 00000000:00000000 00:00000000 00000000  1000        0 7777 1 0 100 0 0 10 0\n`);
+  return proc;
+}
+
+test('processTree follows parent links; pidListensOn finds a listener in a child of the unit main pid', t => {
+  const proc = fakeProc(t);
+  assert.deepEqual(processTree(100, { proc }).sort(), [100, 101]);
+  assert.equal(pidListensOn(100, 8080, { proc }), true);
+  assert.equal(pidListensOn(200, 8080, { proc }), false, 'an unrelated process does not count');
+  assert.equal(pidListensOn(100, 8081, { proc }), false, 'another port does not count');
+  assert.equal(processStartMs(100, { proc }), 1000 * 1000 + 5000);
+  assert.equal(processStartMs(999, { proc }), null);
+});
+
+const evidence = (over = {}) => ({
+  unit: 'mosaic-proxy.service', confirmed: true,
+  before: { pid: 50, since: 10, active: 'active' }, after: { pid: 100, since: 20, active: 'active', listening: true },
+  observedAt: new Date(2000).toISOString(), ...over,
+});
+const proof = { fence: { time: new Date(1000).toISOString() }, port: 8080, startMs: () => 1500, listens: (pid, port) => pid === 100 && port === 8080, now: () => 2000 };
+
+test('verifyRestart accepts a confirmed restart to a new live listener started after the fence', () => {
+  const result = verifyRestart(evidence(), proof);
+  assert.deepEqual(result, { unit: 'mosaic-proxy.service', before: { pid: 50 }, after: { pid: 100, startedAt: new Date(1500).toISOString() }, observedAt: new Date(2000).toISOString(), listeningPort: 8080 });
+});
+
+test('verifyRestart refuses every unproved restart with proxy-restart-unconfirmed', () => {
+  const cases = [
+    ['not confirmed', evidence({ confirmed: false }), proof],
+    ['same pid', evidence({ before: { pid: 100, since: 10, active: 'active' } }), proof],
+    ['extra field', { ...evidence(), forged: true }, proof],
+    ['bad unit name', evidence({ unit: '../x.service' }), proof],
+    ['stale observation', evidence({ observedAt: new Date(2000).toISOString() }), { ...proof, now: () => 2000 + 11 * 60 * 1000 }],
+    ['process gone', evidence(), { ...proof, startMs: () => null }],
+    ['started before the fence', evidence(), { ...proof, startMs: () => 900 }],
+    ['fence without time', evidence(), { ...proof, fence: { invalid: true } }],
+    ['not listening', evidence(), { ...proof, listens: () => false }],
+    ['no port', evidence(), { ...proof, port: null }],
+    ['not an object', 'restarted', proof],
+  ];
+  for (const [name, value, options] of cases) assert.throws(() => verifyRestart(value, options), code('proxy-restart-unconfirmed'), name);
+});
+
+function dirs(t) {
+  const root = scratch(t);
+  const configDir = join(root, 'config'), dataRoot = join(root, 'data');
+  fs.mkdirSync(configDir, { recursive: true, mode: 0o700 }); fs.mkdirSync(dataRoot, { recursive: true, mode: 0o700 });
+  return { root, configDir, dataRoot, files: initFiles(configDir, dataRoot) };
+}
+
+test('init lock: absent refuses, held names each README blocker, clear needs every condition and writes a receipt', t => {
+  const { root, configDir, dataRoot, files } = dirs(t);
+  const stopped = { stopped: true, running: [] };
+  assert.deepEqual(initLockStatus({ configDir, dataRoot, buses: stopped }), { present: false, clearable: false, blockers: [] });
+  assert.throws(() => clearInitLock({ configDir, dataRoot, buses: stopped }), code('proxy-init-lock-absent'));
+  fs.writeFileSync(files.lock, '', { mode: 0o600 });
+  fs.mkdirSync(files.proxyDir, { mode: 0o700 });
+  const held = initLockStatus({ configDir, dataRoot, buses: { stopped: false, running: ['organization acme'] } });
+  assert.equal(held.clearable, false);
+  assert.deepEqual(held.blockers, ['bus running: organization acme', 'the proxy state directory exists']);
+  assert.equal(JSON.stringify(held).includes(root), false, 'blockers name labels, never paths');
+  assert.throws(() => clearInitLock({ configDir, dataRoot, buses: { stopped: false, running: ['the instance bus'] } }), code('proxy-init-lock-held'));
+  assert.throws(() => clearInitLock({ configDir, dataRoot, buses: stopped }), code('proxy-init-lock-held'));
+  assert.equal(fs.existsSync(files.lock), true);
+  fs.rmdirSync(files.proxyDir);
+  assert.throws(() => clearInitLock({ configDir, dataRoot, buses: undefined }), code('proxy-init-lock-held'), 'no bus proof counts as running');
+  const receipt = clearInitLock({ configDir, dataRoot, buses: stopped, now: () => new Date(0) });
+  assert.equal(fs.existsSync(files.lock), false);
+  assert.deepEqual(receipt, { op: 'init-lock.clear', time: new Date(0).toISOString(), conditions: ['bus stopped', 'no proxy.json', 'no management key file', 'no proxy state directory'] });
+  assert.deepEqual(fs.readFileSync(receiptFile(dataRoot), 'utf8').trim().split('\n').map(JSON.parse), [receipt]);
+  assert.equal((fs.statSync(receiptFile(dataRoot)).mode & 0o777), 0o600);
+});
+
+test('initState reports partial state from file presence and fenceState reads the fence without writing', t => {
+  const { configDir, dataRoot, files } = dirs(t);
+  assert.deepEqual(initState(configDir, dataRoot), { initialized: false, partial: false, problem: null, settings: null, files: { settings: false, key: false, proxyDir: false, lock: false }, lock: false });
+  fs.mkdirSync(files.proxyDir, { mode: 0o700 });
+  assert.equal(initState(configDir, dataRoot).partial, true);
+  assert.equal(fenceState(dataRoot), null);
+  fs.writeFileSync(join(files.proxyDir, 'mosaic-keys.uncertain'), JSON.stringify({ org: 'acme', op: 'apikey.add', time: '2026-11-11T00:00:00.000Z', pid: 7 }), { mode: 0o600 });
+  assert.deepEqual(fenceState(dataRoot), { org: 'acme', op: 'apikey.add', time: '2026-11-11T00:00:00.000Z', pid: 7 });
+  fs.chmodSync(join(files.proxyDir, 'mosaic-keys.uncertain'), 0o644);
+  assert.deepEqual(fenceState(dataRoot), { invalid: true });
+  assert.deepEqual(fs.readdirSync(files.proxyDir), ['mosaic-keys.uncertain']);
+});
+
+test('releaseState: nothing fetched names the next step without a path', t => {
+  const { root, dataRoot } = dirs(t);
+  const state = releaseState(dataRoot);
+  assert.equal(state.fetched, false); assert.equal(state.verified, false); assert.equal(state.problem, 'proxy-install-missing');
+  assert.equal(JSON.stringify(state).includes(root), false);
+});
+
+test('releaseState re-hashes a release file rewritten in place with its mtime set back', async t => {
+  const { dataRoot } = dirs(t);
+  const sha = bytes => createHash('sha256').update(bytes).digest('hex');
+  const binary = Buffer.from('made-up proxy binary 0001'), panel = Buffer.from('<html>made-up panel</html>');
+  const pin = { ...PIN, version: '0.0.0-test', binary: { ...PIN.binary, sha256: sha(binary) }, panel: { ...PIN.panel, sha256: sha(panel) } };
+  const paths = installPaths(dataRoot, pin);
+  fs.mkdirSync(join(paths.dir, 'static'), { recursive: true });
+  fs.writeFileSync(paths.binary, binary, { mode: 0o755 }); fs.writeFileSync(paths.panel, panel);
+  const when = 1700000000;
+  for (const file of [paths.binary, paths.panel]) fs.utimesSync(file, when, when);
+  assert.equal(releaseState(dataRoot, pin).verified, true);
+  await new Promise(resolve => setTimeout(resolve, 50));
+  const before = fs.statSync(paths.binary, { bigint: true });
+  fs.writeFileSync(paths.binary, Buffer.from('made-up proxy binary 0002'), { flag: 'r+' });
+  fs.utimesSync(paths.binary, when, when);
+  const after = fs.statSync(paths.binary, { bigint: true });
+  assert.deepEqual([after.ino, after.size, after.mtimeNs, after.mode], [before.ino, before.size, before.mtimeNs, before.mode], 'only ctime tells the files apart');
+  const state = releaseState(dataRoot, pin);
+  assert.equal(state.verified, false); assert.equal(state.problem, 'proxy-install-invalid');
+});
+
+test('unit names follow the instance and refuse a bad instance', () => {
+  assert.equal(unitName(null), 'mosaic-proxy.service');
+  assert.equal(unitName('dev'), 'mosaic-proxy.service');
+  assert.equal(unitName('uiorg'), 'mosaic-proxy-uiorg.service');
+  assert.throws(() => unitName('../x'), code('proxy-unit-usage'));
+});
+
+// A fake systemctl / proxy-service.sh. `states` is the sequence `systemctl show` reports.
+function fakeUnit(states, { install = { code: 0, stdout: '', stderr: '' }, verbs = [] } = {}) {
+  let i = 0;
+  const run = async (command, args) => {
+    if (command === 'systemctl' && args[1] === 'show') {
+      const s = states[Math.min(i++, states.length - 1)];
+      return { code: 0, stdout: `LoadState=${s.load ?? 'loaded'}\nActiveState=${s.active}\nSubState=running\nMainPID=${s.pid ?? 0}\nExecMainStartTimestampMonotonic=${s.since ?? 0}\nNRestarts=0\n`, stderr: '' };
+    }
+    if (command === 'systemctl') { verbs.push(args[1]); return { code: 0, stdout: '', stderr: '' }; }
+    verbs.push(args.filter(a => !a.endsWith('proxy-service.sh')).join(' '));
+    return install;
+  };
+  return createUnitControl({ instance: 'zz', port: () => 18432, run, probe: async () => true, waitMs: 0, pollMs: 0, now: () => new Date(0) });
+}
+
+test('unit restart is confirmed only when a new main process is active and listening', async () => {
+  const verbs = [];
+  const control = fakeUnit([{ active: 'active', pid: 10, since: 5 }, { active: 'active', pid: 11, since: 6 }], { verbs });
+  const { evidence: e } = await control.restart();
+  assert.equal(e.confirmed, true);
+  assert.deepEqual(e.before, { pid: 10, since: 5, active: 'active' });
+  assert.deepEqual(e.after, { pid: 11, since: 6, active: 'active', listening: true });
+  assert.equal(e.unit, 'mosaic-proxy-zz.service');
+  assert.deepEqual(verbs, ['restart']);
+  const same = await fakeUnit([{ active: 'active', pid: 10, since: 5 }, { active: 'active', pid: 10, since: 5 }]).restart();
+  assert.equal(same.evidence.confirmed, false, 'the same process is not a restart');
+  const down = await fakeUnit([{ active: 'active', pid: 10, since: 5 }, { active: 'failed', pid: 0, since: 0 }]).restart();
+  assert.equal(down.evidence.confirmed, false, 'a failed unit is not a restart');
+});
+
+test('unit actions map proxy-service refusals by code and refuse a missing unit', async () => {
+  await assert.rejects(fakeUnit([{ load: 'not-found', active: 'inactive' }]).start(), code('proxy-unit-missing'));
+  await assert.rejects(fakeUnit([{ load: 'not-found', active: 'inactive' }]).restart(), code('proxy-unit-missing'));
+  await assert.rejects(fakeUnit([{ active: 'inactive' }], { install: { code: 3, stdout: '', stderr: 'proxy-service: proxy-unit-exists\n' } }).install(), code('proxy-unit-exists'));
+  await assert.rejects(fakeUnit([{ active: 'inactive' }], { install: { code: 3, stdout: '', stderr: 'proxy-service: /home/x secret detail\n' } }).install(), code('proxy-unit-failed'));
+  await assert.rejects(fakeUnit([{ active: 'active', pid: 0 }, { active: 'failed', pid: 0 }]).start(), code('proxy-unit-unhealthy'));
+  const verbs = [];
+  const started = await fakeUnit([{ active: 'inactive' }, { active: 'active', pid: 9, since: 1 }], { verbs }).start();
+  assert.equal(started.healthy, true); assert.deepEqual(verbs, ['start']);
+  assert.throws(() => createUnitControl({ unitDir: 'relative' }), code('proxy-unit-path'));
+});

packages/organization/README.md

@@ -569,10 +569,45 @@ Initialize an organization checkout with `mosaic org queue init ID --local-only
 --accept-local-loss-risk` and a project repository with `mosaic org project repo
 init ID PROJECT --local-only --accept-local-loss-risk`. The explicit acceptance
 records that this machine may hold the only copy. Alternatively use `--remote
-https://HOST/OWNER/REPO` in place of both local-only flags. Both modes create a
-local repository and genesis commit; remote mode records the URL without a
-push. Existing paths are never overwritten. `mosaic org queue show ID --json`
-and `mosaic org project repo show ID PROJECT --json` read the receipts back.
+URL` in place of both local-only flags. Both modes create a local repository and
+genesis commit. Existing paths are never overwritten. `mosaic org queue show ID
+--json` and `mosaic org project repo show ID PROJECT --json` read the receipts
+back; the project form also reports the binding as it is now (`current`).
+
+Remote mode (#1873 P1-6) accepts `https://HOST/OWNER/REPO` and ssh
+(`ssh://[USER@]HOST[:PORT]/PATH` or `USER@HOST:PATH`) only. It refuses
+`ext::` and other transport helpers, `file://`, local paths, values that begin
+with `-`, any URL that carries a password or token, and any https URL that
+carries a user name (`src/vocabulary.mjs` `parseRepoRemote`). The checkout's `origin` is set to the
+URL and checked once with `git ls-remote` (`src/repo-remote.mjs`): no
+credential helper, no askpass, no terminal prompt, no redirects,
+`GIT_ALLOW_PROTOCOL=https:ssh`, no git or ssh config files, no ssh agent or key,
+and a 15 second limit. The receipt's `check.result` is `reachable`,
+`needs-credential` (the check sends none) or `unreachable` with git's error
+summarized. The ssh check accepts any host key, so an ssh answer shows only that
+something at that address speaks git; its message adds "the ssh host key was not
+verified". `check.url` names the URL it ran against, and `repo show` reports a
+check only for the URL recorded now. The check never refuses the setup, and
+nothing is pushed. A copy credential binding (CB lanes) supplies credentials
+for https Gitea remotes only; an ssh or other https remote that needs a
+credential gets none from it. Tests reach a local bare repository only through `repoRemoteTestSeam`,
+which no source module may import.
+
+`mosaic org project repo set ID PROJECT (--local-only --accept-local-loss-risk |
+--remote URL) --if-revision N [--json]` (#1873 P1-7) changes an initialized
+project's repository: a new URL, or remote to local only and back. It runs the
+same URL rules and check, sets or removes `origin`, records the binding in the
+organization file's `projects.PROJECT.git`, and writes an
+`org.project.repo.set` receipt. A stale `--if-revision` is `revision-conflict`.
+While a copy binding that names the project is approved (`pending`) or active
+(`bound`), repo set is refused with `project-repo-bound`, before any check or
+change to `origin`, even for the URL already recorded: the binding grants the
+repositories its projects name at credential issue, and its decision records
+only project names (#1873 F7). The message names the copies. Revoke the copy
+binding first (the chief raises an unbind decision and the owner approves it),
+then set the repository, then ask the chief to raise a new binding decision. An
+`unbound` binding, or none, does not refuse. A binding decision raised but not
+yet approved is not read here.
 Queue review transports and transitions are not provided by this setup.
 
 The local development owner is accepted only through the existing named-instance

packages/organization/src/agent-copies.mjs

@@ -115,11 +115,41 @@ export function materializeCopies({ orgId, doc, root, rolesDir }) {
 export function copiesView(copies) {
   return Object.fromEntries(Object.entries(copies ?? {}).map(([instance, c]) => [instance, {
     name: c.name, level: c.level, project: c.project, definition: c.definition, state: c.state,
-    ...(c.missing ? { missing: [...c.missing] } : {}), ...(c.reason ? { reason: c.reason } : {}),
+    ...(c.missing ? { missing: [...c.missing] } : {}), ...(c.bound ? { bound: [...c.bound] } : {}), ...(c.reason ? { reason: c.reason } : {}),
     ...(c.claims ? { claims: c.claims.map(({ name, project }) => ({ name, project })) } : {}),
   }]));
 }
 
+// #1873 CB3: the services a copy may have bound for it, through the store the bus checks at boot
+// and on every launch. Nothing else is bound for a copy (a tracker bot isn't).
+export const COPY_BINDABLE = Object.freeze(["gitea"]);
+
+// #1873 CB3: the snapshot with the copies the bus verified at boot made instances. `bound` is
+// { instance: [services] }, from copy-launch.mjs's boot check. A copy is promoted only when it is
+// unbound and its verified services are exactly the ones it misses, every one bindable: a partial
+// binding never joins, and an extra service is no promotion either. A promoted copy is
+// { ...copy, state: "instance", bound: [services] } with no `missing`. Anything else is unchanged.
+export function promoteCopies(snapshot, bound = {}) {
+  if (!snapshot) return snapshot;
+  const copies = { ...snapshot.copies };
+  for (const [instance, services] of Object.entries(bound ?? {})) {
+    const copy = Object.hasOwn(copies, instance) ? copies[instance] : null;
+    if (copy?.state !== "unbound" || !Array.isArray(services)) continue;
+    const want = [...copy.missing].sort();
+    const got = [...new Set(services)].sort();
+    if (want.length === 0 || want.join(",") !== got.join(",") || !want.every((s) => COPY_BINDABLE.includes(s))) continue;
+    const { missing: _, ...rest } = copy;
+    copies[instance] = { ...rest, state: "instance", bound: want };
+  }
+  return deepFreeze({ ...snapshot, copies });
+}
+
+// A stand-in date for a promoted copy's credential reference. The reference exists only so the
+// organization's own checks see the services the role needs; withCopies takes it out again, so no
+// path, date or file of it reaches the business. The copy's real date is its binding's rotateBy,
+// which copy-launch.mjs checks.
+const BOUND_PLACEHOLDER = "2999-12-31";
+
 // Every string the document or the copy holds as a var or a credential reference, longest first.
 function valuesOf(document, copy) {
   const out = new Set();
@@ -236,7 +266,8 @@ export function withCopies(document, file, { rolesDir, snapshot, dataRoot = null
     if (copy.state !== "instance") continue;
     const refused = copy.project === null ? null : projectCopyRefusal(copy, document, levels);
     if (refused) { view[instance] = { ...view[instance], state: "refused", reason: refused }; continue; }
-    const entry = entryOf(copy, copy.project === null && narrows[copy.name] ? narrowVars("root", copy.vars, narrows[copy.name]) : copy.vars);
+    const base = entryOf(copy, copy.project === null && narrows[copy.name] ? narrowVars("root", copy.vars, narrows[copy.name]) : copy.vars);
+    const entry = copy.bound?.length ? { ...base, credentials: Object.fromEntries(copy.bound.map((s) => [s, { store: true, rotateBy: BOUND_PLACEHOLDER }])) } : base;
     try {
       validateBusinessDocument({ ...narrowed, roles: { ...roles, [instance]: entry } }, file, { rolesDir, dataRoot });
       join[instance] = entry;
@@ -246,7 +277,15 @@ export function withCopies(document, file, { rolesDir, snapshot, dataRoot = null
     }
   }
   const business = validateBusinessDocument({ ...narrowed, roles: { ...roles, ...join } }, file, { rolesDir, dataRoot });
-  return deepFreeze({ ...business, ...(Object.keys(copies).length ? { copies: view } : {}), unions });
+  // #1873 CB3: a bound copy keeps no credential reference. Its token is read from the bus's copy
+  // store only for one checked call (copy-launch.mjs), so no path, store file or token goes to a
+  // launch, a sandbox or the bus's Credentials. `copyBound` names the services, never a value.
+  const out = { ...business, roles: { ...business.roles } };
+  for (const [instance, copy] of Object.entries(copies)) {
+    if (!copy.bound?.length || !Object.hasOwn(join, instance) || !Object.hasOwn(out.roles, instance)) continue;
+    out.roles[instance] = { ...out.roles[instance], credentials: {}, copyBound: [...copy.bound] };
+  }
+  return deepFreeze({ ...out, ...(Object.keys(copies).length ? { copies: view } : {}), unions });
 }
 
 // The organization with its copies, as a bus or launcher loads it. The plain load keeps
@@ -286,6 +325,9 @@ export function copyRefusal(business, instance) {
   if(business.roles?.[instance]?.unbound?.length)return {code:"credential-unbound",message:`${instance} has no binding for ${business.roles[instance].unbound.join(", ")}`};
   const copy = copyOf(business, instance);
   if (!copy || copy.state === "instance") return null;
+  // #1873 CB3: a copy whose binding was approved after the bus started waits for a restart. The bus
+  // answers restart-required for it at instance.launch and thread.create (copy-launch.mjs), before a
+  // launch reaches the launcher, so this view's credential-unbound is only its last word.
   if (copy.state === "unbound") {
     return { code: "credential-unbound", message: `${instance} has no binding in ${business.id} for ${copy.missing.join(", ")}` };
   }

packages/organization/src/copy-bindings.mjs

@@ -7,8 +7,8 @@
 // never a token, a token fragment or digest, a path or an environment name.
 //
 //   { copyId, orgIncarnation, source: { level, name, project }, definition: { ref, rev, sha256 },
-//     generation, state, services: { gitea?: { slot, scopes, resources }, vikunja?: {...} },
-//     decision, tracker? }
+//     generation, state, services: { gitea?: { slot, scopes, resources, rotateBy?, grantId?,
+//     grantGeneration? }, vikunja?: {...} }, decision, tracker? }
 //
 // copyId is 128 random bits minted on the first approval for that copy; it is kept, with the
 // generation counting up, through every later change and the unbound tombstone. orgIncarnation is
@@ -19,9 +19,15 @@
 // (composition, instructions and personality), a role template by the hash readTemplate takes over
 // its file and contract.
 //
-// States: `pending` is approved and not verified. Only a verifier (slice CB2, not built) may turn a
-// record `bound`, and only `bound` resolves. `unbound` is the tombstone an unbind leaves. Nothing
-// in CB1 writes `bound`, so no copy binding resolves and no copy launches with one.
+// States: `pending` is approved and not verified. Only a verifier (slice CB2) may turn a record
+// `bound`, and only `bound` resolves. `unbound` is the tombstone an unbind leaves.
+//
+// CB2 (grant metadata): a service the verifier proved carries `rotateBy` (the owner's rotation day),
+// `grantId` (the service's opaque grant id, `gitea:<user id>:<token id>`: ids the service assigned,
+// never token bytes) and `grantGeneration` (counts every verified grant of that service; it stays
+// when a new issue strips the other two). The verifier's commit writes `bound` only when every
+// service holds a grant, and no grant id appears twice across the organization's copies. Launch
+// admission, which re-proves each grant, is CB3.
 //
 // Everything here is pure: no file is read, no secret, no slot.
 
@@ -39,6 +45,11 @@ const BOT_NAME = /^bot-[a-z0-9][a-z0-9._-]{0,60}$/;
 const GITEA_SCOPE = /^(read|write):([a-z]+)$/;
 const RECORD_KEYS = ["copyId", "orgIncarnation", "source", "definition", "generation", "state", "services", "decision", "tracker"];
 const SERVICE_KEYS = ["slot", "scopes", "resources"];
+const GRANT_KEYS = ["rotateBy", "grantId", "grantGeneration"];
+const GRANT_ID = /^(gitea|vikunja):[1-9][0-9]{0,15}:[1-9][0-9]{0,15}$/;
+const DAY = /^\d{4}-\d{2}-\d{2}$/;
+const realDay = (value) => typeof value === "string" && DAY.test(value) && !Number.isNaN(Date.parse(value))
+  && new Date(value).toISOString().slice(0, 10) === value;
 export const BINDING_STATES = Object.freeze(["pending", "bound", "unbound"]);
 // CB1 binds the core services (vocabulary SERVICES) only. A plugin service has no verifier design yet.
 export const BINDABLE_SERVICES = SERVICES;
@@ -46,6 +57,18 @@ export const MAX_BINDINGS = 256;
 
 export const newCopyId = () => randomBytes(16).toString("hex");
 
+// CB2: the one service account a copy's binding may use, derived from the registry incarnation, the
+// copyId and the service, so another organization, another copy and another service never share
+// it. Gitea limits a login to 40 characters; this is 36. Not a secret and not token-derived.
+export function copyBotLogin(incarnation, copyId, service) {
+  if (typeof incarnation !== "string" || !INCARNATION.test(incarnation) || typeof copyId !== "string" || !COPY_ID.test(copyId)
+    || !BINDABLE_SERVICES.includes(service)) return null;
+  return `mosaic-copy-${sha256(`copy-bot\0${incarnation}\0${copyId}\0${service}`).slice(0, 24)}`;
+}
+// Whether every service of a binding record holds a verified grant (CB2).
+export const allGranted = (services) => isPlainObject(services) && Object.keys(services).length > 0
+  && Object.values(services).every((v) => isPlainObject(v) && typeof v.grantId === "string");
+
 // Fixed text for every binding refusal. `service` is a registered service label or null, never a
 // submitted value.
 const TEXT = {
@@ -53,6 +76,8 @@ const TEXT = {
   "credential-unbound": (s) => `credentials.${s} needs an owner-approved binding.`,
   "credential-scope-exceeded": (s) => `credentials.${s}.scopes exceeds the approved role.`,
   "credential-scope-unverified": (s) => `credentials.${s} permissions could not be verified.`,
+  "credential-identity-refused": (s) => `credentials.${s} is not this copy's own service account.`,
+  "credential-date": (s) => `credentials.${s} rotation date is invalid.`,
   "credential-binding-changed": (s) => `credentials.${s} changed; read and approve again.`,
   "credential-role-changed": (s) => `credentials.${s} no longer matches the approved definition; the owner must review the binding.`,
   "copy-unavailable": () => "copy is no longer active in this organization.",
@@ -195,7 +220,7 @@ export function validateCopyBindings(value, { trackers = [] } = {}) {
   if (!isPlainObject(value)) refuse("copyBindings field is invalid");
   const keys = Object.keys(value);
   if (keys.length > MAX_BINDINGS) refuse("copyBindings field is invalid");
-  const bots = new Set(trackers.map((t) => t.bot)), botIds = new Set(trackers.map((t) => t.botId)), copyIds = new Set();
+  const bots = new Set(trackers.map((t) => t.bot)), botIds = new Set(trackers.map((t) => t.botId)), copyIds = new Set(), grants = new Set();
   keys.forEach((instance, n) => {
     const i = n + 1, r = value[instance];
     if (!ID_PATTERN.test(instance)) refuse(`copyBindings entry ${i} name is invalid`);
@@ -225,8 +250,18 @@ export function validateCopyBindings(value, { trackers = [] } = {}) {
     if ((r.state === "unbound") !== (services.length === 0)) refuse(at(i, "services"));
     for (const service of services) {
       const v = r.services[service];
-      if (!BINDABLE_SERVICES.includes(service) || !isPlainObject(v) || Object.keys(v).sort().join(",") !== SERVICE_KEYS.slice().sort().join(",")
-        || v.slot !== "self" || !validScopes(service, v.scopes)) refuse(at(i, "services"));
+      const extra = isPlainObject(v) ? Object.keys(v).filter((k) => !SERVICE_KEYS.includes(k)) : [];
+      if (!BINDABLE_SERVICES.includes(service) || !isPlainObject(v) || SERVICE_KEYS.some((k) => !Object.hasOwn(v, k))
+        || extra.some((k) => !GRANT_KEYS.includes(k)) || v.slot !== "self" || !validScopes(service, v.scopes)) refuse(at(i, "services"));
+      // CB2: rotateBy and grantId come together; a grant id needs its generation; one grant id per organization.
+      if ((v.rotateBy === undefined) !== (v.grantId === undefined) || (v.grantId !== undefined && v.grantGeneration === undefined)
+        || (v.rotateBy !== undefined && !realDay(v.rotateBy))
+        || (v.grantId !== undefined && (typeof v.grantId !== "string" || !GRANT_ID.test(v.grantId) || v.grantId.split(":")[0] !== service))
+        || (v.grantGeneration !== undefined && (!Number.isSafeInteger(v.grantGeneration) || v.grantGeneration < 1))) refuse(at(i, "services"));
+      if (v.grantId !== undefined) {
+        if (grants.has(v.grantId)) refuse(`copyBindings entry ${i} services field uses a grant another binding uses`);
+        grants.add(v.grantId);
+      }
       const p = v.resources;
       if (!isPlainObject(p) || Object.keys(p).join(",") !== "projects" || !Array.isArray(p.projects) || p.projects.length === 0
         || p.projects.some((x) => typeof x !== "string" || !ID_PATTERN.test(x)) || new Set(p.projects).size !== p.projects.length

packages/organization/src/org-registry.mjs

@@ -63,6 +63,23 @@ export function orgIncarnation(registry, id) {
   const value = registry?.orgs && Object.hasOwn(registry.orgs, id) ? registry.orgs[id]?.incarnation : undefined;
   return typeof value === 'string' && INCARNATION.test(value) ? value : null;
 }
+// #1873 CB3: one organization's registry entry read now, without the registry lock (the writer
+// publishes by rename, so a read sees one whole file). For the copy launch gate, which checks the
+// entry on every admission and use. null when no registry or no such entry; throws when unsafe.
+export function readOrgEntrySync(configDir, id) {
+  const file = join(configDir, 'org-runtime.json');
+  let dir; try { dir = lstatSync(configDir); } catch (e) { throw quiet(e, CONFIG); }
+  if (!dir.isDirectory() || dir.isSymbolicLink() || dir.uid !== process.getuid() || (dir.mode & 0o077)) fail('org-mismatch', 'unsafe private directory', configDir);
+  let fd;
+  try { fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK); }
+  catch (e) { if (e.code === 'ENOENT') return null; throw quiet(e, 'the registry file'); }
+  try {
+    const st = fstatSync(fd);
+    if (!st.isFile() || st.uid !== process.getuid() || (st.mode & 0o777) !== 0o600) fail('org-mismatch', 'unsafe metadata file', file);
+    const registry = validateRegistry(parseJsonFileText(readFileSync(fd, 'utf8'), file, 'registry file'), file);
+    return Object.hasOwn(registry.orgs, id) ? { state: registry.orgs[id].state, incarnation: orgIncarnation(registry, id) } : null;
+  } finally { closeSync(fd); }
+}
 export async function readRegistry({ configDir }) {
   await safeDir(configDir, false, CONFIG); await privateDir(configDir, CONFIG); const file = join(configDir, 'org-runtime.json'); let doc;
   try { doc = await readPrivate(file); } catch (e) { if (e.code === 'ENOENT') return null; if (e instanceof OrgError) throw e; fail('org-mismatch', `invalid registry: ${e instanceof SyntaxError ? e.message : quiet(e, 'registry file').message}`); }

packages/organization/src/org-service.mjs

@@ -4,7 +4,8 @@ import { spawn } from 'node:child_process';
 import { createHash, randomBytes } from 'node:crypto';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { validateBusinessDocument, httpsUrl } from './organization-config.mjs';
+import { validateBusinessDocument } from './organization-config.mjs';
+import { checkRemote, parseRepoRemote, projectBindings, REPO_BOUND, repoBoundMessage } from './repo-remote.mjs';
 import { ID_PATTERN } from './vocabulary.mjs';
 import { OrgError, orgRoot, quiet, readRegistry, reserveOrg, resolveOrg, withRegistry, withOrgLifecycle } from './org-registry.mjs';
 import { loadInstalled } from '../../plugins/src/loader.mjs';
@@ -198,7 +199,8 @@ export async function updateOrg(ctx, id, input, { ifRevision } = {}) {
 }
 function options({ mode, remote, acceptLocalLossRisk }) {
   if (mode === 'local-only') { if (acceptLocalLossRisk !== true || remote !== undefined) fail('org-risk', 'local-only requires explicit loss-risk acceptance and no remote'); return { mode, riskAccepted: true }; }
-  if (mode === 'remote') { if (acceptLocalLossRisk || typeof remote !== 'string') fail('org-invalid', 'remote mode requires a remote URL'); try { httpsUrl(remote, 'remote', { repo: true }); } catch (e) { fail('org-invalid', e.message); } return { mode, remote }; }
+  // #1873 P1-6: https or ssh, and nothing that git could read as an option, a helper or a path.
+  if (mode === 'remote') { if (acceptLocalLossRisk || typeof remote !== 'string') fail('org-invalid', 'remote mode requires a remote URL'); const parsed = parseRepoRemote(remote); if (!parsed.ok) fail('org-invalid', parsed.message, '$.remote'); return { mode, remote: parsed.url }; }
   fail('org-invalid', 'select local-only or remote');
 }
 async function git(root, args) {
@@ -206,8 +208,23 @@ async function git(root, args) {
   return new Promise((resolve, reject) => { const p = spawn('git', ['-c', 'user.name=Mosaic Local', '-c', '[email protected]', '-c', 'core.hooksPath=/dev/null', '-C', root, ...args], { env, stdio: ['ignore', 'pipe', 'pipe'] }); let out = '', err = ''; p.stdout.on('data', d => out += d); p.stderr.on('data', d => err += d); p.on('error', reject); p.on('close', code => code === 0 ? resolve(out.trim()) : reject(new OrgError('org-git', `git ${args[0]} failed (exit ${code})`))); });
 }
 async function initGit(root) { await fs.mkdir(root, { mode: 0o700 }); await git(root, ['init', '--quiet', '--template=']); await git(root, ['commit', '--quiet', '--allow-empty', '-m', 'Genesis']); return git(root, ['rev-parse', 'HEAD']); }
+// The checkout's origin, or null when it has none.
+async function originOf(root) { try { return await git(root, ['config', '--get', 'remote.origin.url']); } catch (e) { if (e?.code === 'org-git') return null; throw e; } }
+// #1873 P1-6: point origin at the remote (or remove it for local-only). Never pushes or fetches.
+async function setOrigin(root, selection) {
+  const origin = await originOf(root);
+  if (selection.mode === 'remote') { if (origin === null) await git(root, ['remote', 'add', 'origin', selection.remote]); else if (origin !== selection.remote) await git(root, ['remote', 'set-url', 'origin', selection.remote]); }
+  else if (origin !== null) await git(root, ['remote', 'remove', 'origin']);
+  return originOf(root);
+}
+// The check names the URL it ran against, so a reader can tell a check of an earlier URL from one of
+// the URL recorded now (#1873 P1-7 review).
+const checkFields = (check) => check ? { check: { result: check.result, message: check.message, url: check.url } } : {};
 async function setup(ctx, id, project, opts) {
   authorize(ctx); const selection = options(opts); if (project !== null) checkId(project);
+  // The check talks to the network, so it runs before any lock is taken. Its result is reported,
+  // never a refusal: a repository that needs a credential is the usual case before binding.
+  const check = selection.mode === 'remote' ? await checkRemote(selection.remote) : null;
   return withOrgLifecycle(ctx, id, async () => {
     const current = await withRegistry(ctx, async () => {
       const current = await readCurrentUnlocked(ctx, id); if (project !== null && !Object.hasOwn(current.doc.projects, project)) fail('org-unknown', 'unknown project');
@@ -217,7 +234,7 @@ async function setup(ctx, id, project, opts) {
     }, { write: false });
     const parent = project === null ? current.root : join(current.root, 'projects'); if (project !== null) await ensurePrivateDir(parent);
     const root = project === null ? join(current.root, 'checkout') : projectPath(current.root, project);
-    const commit = await initGit(root); const fields = { ...selection, root, commit, ...(project === null ? {} : { project }) };
+    const commit = await initGit(root); const origin = await setOrigin(root, selection); const fields = { ...selection, root, commit, ...(project === null ? {} : { project }), origin, ...checkFields(check) };
     return withRegistry(ctx, async registry => {
       const latest = await readCurrentUnlocked(ctx, id);
       if (latest.revision !== current.revision) fail('revision-conflict', 'organization changed during setup; inspect the initialized repository before retrying');
@@ -236,7 +253,49 @@ async function showSetup(ctx, id, project) {
   if (!item || item.root !== root || !same(item.subject, current.principal)) fail('org-unavailable', 'setup receipt unavailable');
   if (project !== null) { const parent = await fs.lstat(join(current.root, 'projects')); if (!parent.isDirectory() || parent.isSymbolicLink() || parent.uid !== process.getuid() || (parent.mode & 0o077)) fail('org-mismatch', 'unsafe projects directory'); }
   const st = await fs.lstat(root); const dotgit = await fs.lstat(join(root, '.git')); if (!st.isDirectory() || st.isSymbolicLink() || !dotgit.isDirectory() || dotgit.isSymbolicLink()) fail('org-mismatch', 'unsafe git repository');
-  await git(root, ['rev-parse', '--verify', 'HEAD']); return item;
+  await git(root, ['rev-parse', '--verify', 'HEAD']);
+  if (project === null) return item;
+  // #1873 P1-7: the binding as it is now, which a later repo set may have changed since init.
+  const binding = current.doc.projects[project].git ?? { mode: item.mode, ...(item.remote ? { remote: item.remote } : {}) };
+  const last = records.findLast(r => r.op === 'org.project.repo.set' && r.project === project && same(r.subject, current.principal)) ?? null;
+  // The last check is reported only when it ran against the URL recorded now: a set whose receipt
+  // did not land must not lend its check to another URL.
+  const check = binding.mode === 'remote' ? (last ?? item).check : undefined;
+  return { ...item, current: { mode: binding.mode, ...(binding.mode === 'remote' ? { remote: binding.remote } : {}), origin: await originOf(root), revision: current.revision, ...(check && check.url === binding.remote ? { check } : {}), ...(last ? { changedAt: last.at } : {}) } };
+}
+// #1873 P1-7: change an initialized project's repository between remote and local-only, or to a
+// new URL. The same URL rules and check as init; origin follows; nothing is pushed. A receipt
+// records it. Setting the same URL again re-runs the check and repairs origin.
+export async function projectRepoSet(ctx, id, project, opts = {}) {
+  authorize(ctx); checkId(id); checkId(project); const selection = options(opts); const { ifRevision } = opts;
+  if (!Number.isSafeInteger(ifRevision)) fail('org-invalid', 'repo set needs --if-revision');
+  // Fail fast on the cheap checks before the network check, then again under the lock.
+  await projectRepoShow(ctx, id, project).then(r => { if (r.current.revision !== ifRevision) fail('revision-conflict', 'organization revision changed'); });
+  // #1873 F7: never under a copy binding that still grants this project; checked again under the lock.
+  const refuseBound = doc => { const bound = projectBindings(doc, project); if (bound.length) fail(REPO_BOUND, repoBoundMessage(project, bound)); };
+  refuseBound((await readCurrent(ctx, id)).doc);
+  const check = selection.mode === 'remote' ? await checkRemote(selection.remote) : null;
+  return withOrgLifecycle(ctx, id, () => withRegistry(ctx, async registry => {
+    const latest = await readCurrentUnlocked(ctx, id); if (!Object.hasOwn(latest.doc.projects, project)) fail('org-unknown', 'unknown project');
+    if (latest.revision !== ifRevision) fail('revision-conflict', 'organization revision changed');
+    refuseBound(latest.doc);
+    const root = projectPath(latest.root, project);
+    const init = (await receipts(latest.root)).findLast(r => r.op === 'org.project.repo.init' && r.project === project);
+    if (!init || init.root !== root || !same(init.subject, latest.principal)) fail('org-unavailable', 'setup receipt unavailable');
+    const st = await fs.lstat(root); const dotgit = await fs.lstat(join(root, '.git')); if (!st.isDirectory() || st.isSymbolicLink() || !dotgit.isDirectory() || dotgit.isSymbolicLink()) fail('org-mismatch', 'unsafe git repository');
+    const previous = latest.doc.projects[project].git ?? { mode: init.mode, ...(init.remote ? { remote: init.remote } : {}) };
+    const next = selection.mode === 'remote' ? { mode: 'remote', remote: selection.remote } : { mode: 'local-only' };
+    // origin first: a failure after it leaves the recorded binding as it was, and repeating the
+    // same set repairs origin.
+    const origin = await setOrigin(root, selection);
+    let revision = latest.revision;
+    if (canonicalJson(previous) !== canonicalJson(next)) {
+      if (!Number.isSafeInteger(revision + 1)) fail('org-mismatch', 'organization revision cannot be incremented');
+      latest.doc.projects[project].git = next; await checked(latest.doc); const raw = encode(latest.doc);
+      await atomic(join(ctx.configDir, 'businesses', `${id}.json`), raw); registry.orgs[id].digest = digest(raw); registry.orgs[id].revision = revision = latest.revision + 1;
+    }
+    return receipt(latest.root, 'org.project.repo.set', id, ctx.principal, { ...selection, root, project, previous, revision, origin, ...checkFields(check) });
+  }));
 }
 export async function queueShow(ctx, id) { return showSetup(ctx, id, null); }
 export async function projectRepoShow(ctx, id, project) { return showSetup(ctx, id, project); }

packages/organization/src/organization-config.mjs

@@ -11,9 +11,9 @@ import { checkModels, checkLimits, checkAccount } from "./launch.mjs";
 import { checkVars } from "./vars.mjs";
 import { parseCredentialRef } from "./credentials.mjs";
 import { loadRole } from "./role.mjs";
-import { checkDefinitions, checkDefinitionName, orgDefinitionName, ORG_PREFIX } from "./definitions.mjs";
-import { END_PROTECTED } from "./vocabulary.mjs";
-import { checkPlugins, checkUsageSettings } from "../../plugins/src/kinds.mjs";
+import { checkDefinition, checkDefinitions, checkDefinitionName, orgDefinitionName, ORG_PREFIX } from "./definitions.mjs";
+import { END_PROTECTED, parseRepoRemote } from "./vocabulary.mjs";
+import { checkPlugins, checkUsageSettings, NAME as KIND_NAME } from "../../plugins/src/kinds.mjs";
 import { hasModule } from "../../plugins/src/loader.mjs";
 import { readPluginLock } from "../../plugins/src/pinned.mjs";
 import { checkMapping } from "../../library/src/mapping.mjs";
@@ -29,7 +29,148 @@ const BOT_NAME = /^bot-[a-z0-9][a-z0-9._-]{0,60}$/;
 // How long a thread's session stays up with no turn before the launcher stops
 // it, when launch.threadIdleSeconds is absent (REQ-THREAD-2, row 121).
 export const THREAD_IDLE_SECONDS = 900;
-const TOP_KEYS = ["businessVersion", "id", "human", "arbiters", "projects", "vars", "tracker", "roles", "launch", "plugins", "hosts", "retired", "replyLimits", "usage", "appearance", "definitions", "autonomy", "copyBindings"];
+const TOP_KEYS = ["businessVersion", "id", "human", "arbiters", "projects", "vars", "tracker", "roles", "launch", "plugins", "hosts", "retired", "replyLimits", "usage", "appearance", "definitions", "autonomy", "copyBindings", "packs", "board", "workflows"];
+
+// Starter packs SP3 (design dd878cefc sections 2, 3 and 8): the board style, the workflows and the
+// record of each pack applied. The task tracker's states are fixed (REQ-TASK-1); a board names
+// each once, with a label and an order. These are the bus store's states (broker.mjs STORE_STATES).
+const STORE_STATES = Object.freeze(["todo", "in-progress", "in-review", "blocked", "done"]);
+const BOARD_LAYOUTS = Object.freeze(["kanban", "list"]);
+const PACK_ORIGINS = Object.freeze(["shipped", "installed", "saved"]);
+const PACK_KEYS = Object.freeze(["id", "version", "sha256", "origin", "scope", "project", "at", "by", "added", "proposedHires"]);
+const HEX64 = /^[0-9a-f]{64}$/;
+const SEMVER = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$/;
+// A workflow, step role or pack name: the plug-in kinds' NAME, at most 64 characters (ID_PATTERN's
+// length, so a step role can be read as a template or definition name at write time).
+const isKindName = (value) => typeof value === "string" && value.length <= 64 && KIND_NAME.test(value);
+// What a pack apply wrote, as item paths (design section 3, re-apply).
+const ADDED_PATH = /^(definitions\.[a-z0-9][a-z0-9._-]{0,63}|board|workflows\.[a-z][a-z0-9-]{0,63}|projects\.[a-z0-9][a-z0-9._-]{0,63}\.(board|workflows\.[a-z][a-z0-9-]{0,63}))$/;
+// A proposed hire's pin (design section 3): {template, sha256} for a template reference,
+// {definition, rev} for a definition the apply wrote, {inline, sha256} for a pack definition it did
+// not write (inline names it; sha256 is the canonical hash of the full entry stored beside the pin).
+const PIN_SHAPES = Object.freeze([["template", "sha256"], ["definition", "rev"], ["inline", "sha256"]]);
+
+// board: {columns: [{state, label}] x5, layout}. Returns a copy.
+export function checkBoard(board, where) {
+  requireObject(board, where);
+  rejectUnknownKeys(board, ["columns", "layout"], where);
+  if (!Array.isArray(board.columns) || board.columns.length !== STORE_STATES.length) refuse(`${where}.columns must list the ${STORE_STATES.length} task states`);
+  const seen = new Set();
+  const columns = board.columns.map((column, i) => {
+    const at = `${where}.columns[${i}]`;
+    requireObject(column, at);
+    rejectUnknownKeys(column, ["state", "label"], at);
+    if (!STORE_STATES.includes(column.state)) refuse(`${at}.state must be one of ${STORE_STATES.join(", ")}`);
+    if (seen.has(column.state)) refuse(`${where}.columns names ${column.state} twice`);
+    seen.add(column.state);
+    requireString(column.label, `${at}.label`, { max: 32 });
+    return { state: column.state, label: column.label };
+  });
+  if (!BOARD_LAYOUTS.includes(board.layout)) refuse(`${where}.layout must be ${BOARD_LAYOUTS.join(" or ")}`);
+  return { columns, layout: board.layout };
+}
+
+// workflows: {<name>: {title?, description?, steps: [{title, state, roles}]}}. The load checks each
+// step role's shape only: a role that no longer resolves (a definition removed, a template changed)
+// must not fail the whole organization. applyPack resolves the roles of the workflows it writes.
+export function checkWorkflows(workflows, where) {
+  requireObject(workflows, where);
+  const out = {};
+  Object.entries(workflows).forEach(([name, workflow], n) => {
+    if (!isKindName(name)) refuse(`${where} key ${n + 1} must be a workflow name matching ${KIND_NAME}, at most 64 characters`);
+    const at = `${where}.${name}`;
+    requireObject(workflow, at);
+    rejectUnknownKeys(workflow, ["title", "description", "steps"], at);
+    if (Object.hasOwn(workflow, "title")) requireString(workflow.title, `${at}.title`, { max: 120 });
+    if (Object.hasOwn(workflow, "description")) requireString(workflow.description, `${at}.description`, { max: 1000 });
+    if (!Array.isArray(workflow.steps) || workflow.steps.length < 1 || workflow.steps.length > 20) refuse(`${at}.steps must list 1 to 20 steps`);
+    const steps = workflow.steps.map((step, i) => {
+      const s = `${at}.steps[${i}]`;
+      requireObject(step, s);
+      rejectUnknownKeys(step, ["title", "state", "roles"], s);
+      requireString(step.title, `${s}.title`, { max: 120 });
+      if (!STORE_STATES.includes(step.state)) refuse(`${s}.state must be one of ${STORE_STATES.join(", ")}`);
+      if (!Array.isArray(step.roles) || step.roles.length < 1 || step.roles.length > 8) refuse(`${s}.roles must list 1 to 8 roles`);
+      const roles = requireDistinctList(step.roles, `${s}.roles`, (role) => {
+        if (!isKindName(role)) refuse(`${s}.roles entries must be role names matching ${KIND_NAME}, or human`);
+      });
+      return { title: step.title, state: step.state, roles };
+    });
+    out[name] = {
+      ...(Object.hasOwn(workflow, "title") ? { title: workflow.title } : {}),
+      ...(Object.hasOwn(workflow, "description") ? { description: workflow.description } : {}), steps,
+    };
+  });
+  return out;
+}
+
+function checkPin(pin, where) {
+  requireObject(pin, where);
+  const keys = Object.keys(pin);
+  const shape = PIN_SHAPES.find((s) => s.length === keys.length && s.every((k) => keys.includes(k)));
+  if (!shape) refuse(`${where} must be {template, sha256}, {definition, rev} or {inline}`);
+  if (shape[0] === "template") {
+    requireId(pin.template, `${where}.template`);
+    if (typeof pin.sha256 !== "string" || !HEX64.test(pin.sha256)) refuse(`${where}.sha256 must be 64 lowercase hex characters`);
+  } else if (shape[0] === "definition") {
+    checkDefinitionName(pin.definition, `${where}.definition`);
+    requirePositiveInt(pin.rev, `${where}.rev`);
+  } else {
+    checkDefinitionName(pin.inline, `${where}.inline`);
+    if (typeof pin.sha256 !== "string" || !HEX64.test(pin.sha256)) refuse(`${where}.sha256 must be 64 lowercase hex characters`);
+  }
+  return { ...pin };
+}
+
+// packs: the record of each pack applied, oldest first. Each entry is history: its project is not
+// checked against today's projects, and its proposals are pins, not hires.
+export function checkPacks(packs, where) {
+  if (!Array.isArray(packs)) refuse(`${where} must be a list`);
+  return packs.map((entry, i) => {
+    const at = `${where}[${i}]`;
+    requireObject(entry, at);
+    rejectUnknownKeys(entry, PACK_KEYS, at);
+    for (const key of PACK_KEYS) if (!Object.hasOwn(entry, key)) refuse(`${at} requires "${key}"`);
+    if (!isKindName(entry.id)) refuse(`${at}.id must match ${KIND_NAME}, at most 64 characters`);
+    if (typeof entry.version !== "string" || entry.version.length > 64 || !SEMVER.test(entry.version)) refuse(`${at}.version must be a semver version`);
+    if (typeof entry.sha256 !== "string" || !HEX64.test(entry.sha256)) refuse(`${at}.sha256 must be 64 lowercase hex characters`);
+    if (!PACK_ORIGINS.includes(entry.origin)) refuse(`${at}.origin must be one of ${PACK_ORIGINS.join(", ")}`);
+    if (entry.scope === "org") { if (entry.project !== null) refuse(`${at}.project must be null for an org pack`); }
+    else if (entry.scope === "project") requireId(entry.project, `${at}.project`);
+    else refuse(`${at}.scope must be org or project`);
+    if (typeof entry.at !== "string" || Number.isNaN(Date.parse(entry.at)) || new Date(entry.at).toISOString() !== entry.at) refuse(`${at}.at must be an ISO timestamp`);
+    requireId(entry.by, `${at}.by`);
+    const added = requireDistinctList(entry.added, `${at}.added`, (path) => {
+      if (typeof path !== "string" || !ADDED_PATH.test(path)) refuse(`${at}.added entries must be item paths`);
+    });
+    if (!Array.isArray(entry.proposedHires) || entry.proposedHires.length > 8) refuse(`${at}.proposedHires must list at most 8 hires`);
+    const names = new Set();
+    const proposedHires = entry.proposedHires.map((hire, j) => {
+      const h = `${at}.proposedHires[${j}]`;
+      requireObject(hire, h);
+      rejectUnknownKeys(hire, ["name", "reason", "pin", "entry"], h);
+      requireId(hire.name, `${h}.name`);
+      if (names.has(hire.name)) refuse(`${at}.proposedHires names ${hire.name} twice`);
+      names.add(hire.name);
+      if (Object.hasOwn(hire, "reason")) requireString(hire.reason, `${h}.reason`, { max: 500 });
+      if (!Object.hasOwn(hire, "pin")) refuse(`${h} requires "pin"`);
+      const pin = checkPin(hire.pin, `${h}.pin`);
+      // An inline proposal keeps the full role entry, so the raise can read it back and check its
+      // hash; no other pin carries one. It is bounded as a definition entry is (keys, then
+      // checkComposition), with no rev of its own required. The hash is not checked here: a stale
+      // proposal is the raise's refusal, not a reason the organization fails to load.
+      if (Object.hasOwn(pin, "inline") !== Object.hasOwn(hire, "entry")) refuse(`${h} carries an entry exactly when its pin is inline`);
+      let entry;
+      if (Object.hasOwn(hire, "entry")) {
+        requireObject(hire.entry, `${h}.entry`);
+        checkDefinition(pin.inline, Object.hasOwn(hire.entry, "rev") ? hire.entry : { ...hire.entry, rev: 1 }, { where: `${h}.entry` });
+        entry = structuredClone(hire.entry);
+      }
+      return { name: hire.name, ...(Object.hasOwn(hire, "reason") ? { reason: hire.reason } : {}), pin, ...(entry === undefined ? {} : { entry }) };
+    });
+    return { id: entry.id, version: entry.version, sha256: entry.sha256, origin: entry.origin, scope: entry.scope, project: entry.project, at: entry.at, by: entry.by, added, proposedHires };
+  });
+}
 
 // The config directory: next to the system config, $MOSAIC_CONFIG or
 // ~/.config/mosaic-dev/config.json, the same rule mosaic-config.mjs uses.
@@ -303,7 +444,7 @@ export function validateOrganizationDocument(document, file, { rolesDir, dataRoo
       projects[id] = checkMapping(entry, `${file} projects.${id}`, { fail: (code, message) => refuse(`${code}: ${message}`) });
       continue;
     }
-    rejectUnknownKeys(entry, ["root", "repo", "remote", "git", "agents"], `${file} projects.${id}`);
+    rejectUnknownKeys(entry, ["root", "repo", "remote", "git", "agents", "board", "workflows"], `${file} projects.${id}`);
     // #1873 A1: the project's own agent entries. Checked so a bad entry refuses the whole file, but
     // not copied below: nothing a bus loads sees them; only the Console's agent-levels read does.
     if (Object.hasOwn(entry, "agents")) checkProjectAgents(entry.agents, { rolesDir, where: `projects.${id}.agents`, definitions:document.definitions });
@@ -320,12 +461,16 @@ export function validateOrganizationDocument(document, file, { rolesDir, dataRoo
       requireObject(entry.git, `${file} projects.${id}.git`);
       rejectUnknownKeys(entry.git, ["mode", "remote"], `${file} projects.${id}.git`);
       if (!['local-only', 'remote'].includes(entry.git.mode)) refuse(`${file} projects.${id}.git.mode must be local-only or remote`);
-      if (entry.git.mode === 'remote') httpsUrl(entry.git.remote, `${file} projects.${id}.git.remote`, { repo: true });
+      // #1873 P1-6: the checkout's origin may be https or ssh (repo-remote.mjs's rules). The Row 199
+      // upstream, projects.<p>.remote, stays https only.
+      if (entry.git.mode === 'remote') { const remote = parseRepoRemote(entry.git.remote); if (!remote.ok) refuse(`${file} projects.${id}.git.remote: ${remote.message}`); }
       else if (Object.hasOwn(entry.git, 'remote')) refuse(`${file} projects.${id}.git.remote is not allowed for local-only`);
     }
     projects[id] = { root: entry.root, ...(Object.hasOwn(entry, "repo") ? { repo: entry.repo } : {}),
       ...(Object.hasOwn(entry, "remote") ? { remote: entry.remote } : {}),
-      ...(Object.hasOwn(entry, "git") ? { git: { ...entry.git } } : {}) };
+      ...(Object.hasOwn(entry, "git") ? { git: { ...entry.git } } : {}),
+      ...(Object.hasOwn(entry, "board") ? { board: checkBoard(entry.board, `${file} projects.${id}.board`) } : {}),
+      ...(Object.hasOwn(entry, "workflows") ? { workflows: checkWorkflows(entry.workflows, `${file} projects.${id}.workflows`) } : {}) };
   }
   for (const [instance, role] of Object.entries(roles)) {
     for (const project of role.publish ?? []) {
@@ -373,11 +518,15 @@ export function validateOrganizationDocument(document, file, { rolesDir, dataRoo
   }
   const appearance = checkAppearance(document.appearance, `${file} appearance`);
   const retired = document.retired === undefined ? undefined : checkRetired(document.retired, roles, file);
+  const board = document.board === undefined ? undefined : checkBoard(document.board, `${file} board`);
+  const workflows = document.workflows === undefined ? undefined : checkWorkflows(document.workflows, `${file} workflows`);
+  const packs = document.packs === undefined ? undefined : checkPacks(document.packs, `${file} packs`);
 
   return deepFreeze({
     businessVersion: 1, id: document.id, file, human, arbiters, projects, vars, tracker, roles, launch, plugins, definitions,
     ...(autonomy === undefined ? {} : { autonomy }), ...(retired ? { retired } : {}), ...(usage === undefined ? {} : { usage }), ...(appearance === undefined ? {} : { appearance }),
     ...(copyBindings === undefined ? {} : { copyBindings }),
+    ...(board === undefined ? {} : { board }), ...(workflows === undefined ? {} : { workflows }), ...(packs === undefined ? {} : { packs }),
   });
 }
 

packages/organization/src/organization.mjs

@@ -13,7 +13,7 @@ import { checkReplyLimits } from "../../library/src/limits.mjs";
 import { ADDITION_VERB, additionProblem } from "./project-bootstrap.mjs";
 import { remoteProblem, remoteTarget } from "./project-remotes.mjs";
 import { orgIncarnation, withRegistryWriter } from "./org-registry.mjs";
-import { bindingText, definitionPin, samePin } from "./copy-bindings.mjs";
+import { allGranted, bindingText, definitionPin, samePin } from "./copy-bindings.mjs";
 import { entryForm, projectAgentProblem, rootForProjectCheck } from "./agent-levels-write.mjs";
 import { checkDefinition, checkDefinitionName, instancesNaming, readTemplate } from "./definitions.mjs";
 
@@ -441,6 +441,199 @@ export function organizationWriter({ dir, rolesDir, dataRoot = null, barrier = (
     return { ...out, rev: logged.rev };
   }
 
+  // Starter packs SP3 (design dd878cefc sections 3 and 8): the one writer of `board`, `workflows`,
+  // each code project's `board` and `workflows`, and `packs`, and a pack's way to add definitions.
+  // Plan keys, and nothing else (invalid-request):
+  //   definitions             {name: entry without rev}: adds only, at rev 1; needs a packs entry
+  //   board                   a board, or null to remove it
+  //   workflows               {name: workflow, or null to remove it}, merged by name
+  //   projects.<p>.board      as board, for code project p
+  //   projects.<p>.workflows  as workflows, for code project p
+  //   packs                   the one entry to append, without at, by and added: this writer stamps them
+  // A plan with a packs entry only adds: it overwrites and removes nothing, an org pack writes no
+  // project key, and a project pack writes only its own project's keys. A board or workflow write is
+  // a plan holding that key alone. One commit: a refusal or a fault leaves all of it or none.
+  // setDefinition's rules hold for each definition: an agent or the tester never writes one
+  // (human-required), a name an instance uses refuses definition-in-use, the credential store's
+  // check is required and checkDefinition runs it with checkComposition. An agent never applies a
+  // saved template either. The rest is organization.change's, with no decision (Jason, 11-12).
+  // assertClean, the credential store's check, is required on every call and runs on every key and
+  // string in the plan before anything else reads it: workflow text reaches agents' prompts and a
+  // pack's inline proposals are role entries. Each workflow written must name
+  // roles that resolve now: an org definition (after this plan), a V2 template, or human. The load
+  // checks only their shape, so a later removal never fails the file.
+  const PLAN_TOP = ["definitions", "board", "workflows", "packs"];
+  const PLAN_PROJECT = /^projects\.([a-z0-9][a-z0-9._-]{0,63})\.(board|workflows)$/;
+  const PLAN_PACK_KEYS = ["id", "version", "sha256", "origin", "scope", "project", "proposedHires"];
+  const PLAN_NAME = /^[a-z][a-z0-9-]{0,63}$/;
+  const planObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v) && [Object.prototype, null].includes(Object.getPrototypeOf(v));
+  function applyPack(id, plan, { revision, actor, assertClean, detail }) {
+    if (typeof assertClean !== "function") fail("definition-secret-check-required", "a pack, board or workflow write needs the credential store's secret check; write it through the bus");
+    if (!planObject(plan) || Object.keys(plan).length === 0) fail("invalid-request", "a pack plan is an object naming at least one item");
+    const scan = (value) => {
+      if (typeof value === "string") assertClean(value);
+      else if (value !== null && typeof value === "object") for (const [k, v] of Object.entries(value)) { assertClean(k); scan(v); }
+    };
+    scan(plan);
+    const projectKeys = [];
+    Object.keys(plan).forEach((key, i) => {
+      const match = PLAN_PROJECT.exec(key);
+      if (match) projectKeys.push({ key, project: match[1], item: match[2] });
+      else if (!PLAN_TOP.includes(key)) fail("invalid-request", `plan key ${i + 1} is not one a pack writes (definitions, board, workflows, projects.<p>.board, projects.<p>.workflows, packs)`);
+    });
+    const pack = plan.packs;
+    if (pack !== undefined) {
+      if (!planObject(pack)) fail("invalid-request", "plan packs must be one entry");
+      for (const key of Object.keys(pack)) {
+        if (["at", "by", "added"].includes(key)) fail("invalid-request", `plan packs carries ${key}, which the writer stamps`);
+        if (!PLAN_PACK_KEYS.includes(key)) fail("invalid-request", "plan packs carries an unknown key");
+      }
+      if (pack.scope === "project") {
+        if (Object.hasOwn(plan, "board") || Object.hasOwn(plan, "workflows")) fail("invalid-request", "a project pack writes only its project's board and workflows");
+        if (projectKeys.some((k) => k.project !== pack.project)) fail("invalid-request", "a project pack writes only its own project's keys");
+      } else if (projectKeys.length) fail("invalid-request", "an org pack writes no project key");
+    } else if (Object.hasOwn(plan, "definitions")) {
+      fail("invalid-request", "definitions arrive only with a packs entry; write one definition through setDefinition");
+    }
+    const at = new Date().toISOString();
+    const logged = { ...detail, verb: pack ? "pack.apply" : "organization.layout", pack: pack ? pack.id : null, added: null };
+    const build = (old) => {
+      const agents = Object.entries(old.roles ?? {}).flatMap(([n, role]) => [n, `${role?.definition}.${n}`]);
+      const agent = actor === "tester" || agents.includes(actor) || (old.retired ?? []).includes(actor);
+      if (agent && (Object.hasOwn(plan, "definitions") || pack?.origin === "saved")) fail("human-required");
+      const next = structuredClone(old);
+      const added = [];
+      const written = [];
+      if (Object.hasOwn(plan, "definitions")) {
+        if (!planObject(plan.definitions) || Object.keys(plan.definitions).length === 0) fail("invalid-request", "plan definitions must name at least one definition");
+        const definitions = { ...(old.definitions ?? {}) };
+        for (const [name, entry] of Object.entries(plan.definitions)) {
+          checkDefinitionName(name, "plan definition name");
+          if (Object.hasOwn(definitions, name)) {
+            const users = instancesNaming(old, name);
+            if (users.length) fail("definition-in-use", `definition ${name} is named by ${users.join(", ")}; a change to a hired agent's role is a change decision`);
+            fail("definition-exists", `definitions already declares ${name}; a pack apply overwrites nothing`);
+          }
+          if (!planObject(entry)) fail("invalid-request", `plan definition ${name} must be an object`);
+          if (Object.hasOwn(entry, "rev")) fail("definition-rev-conflict", `a pack definition carries no rev; apply writes ${name} at rev 1`);
+          const value = { ...structuredClone(entry), rev: 1 };
+          checkDefinition(name, value, { assertClean });
+          definitions[name] = value;
+          added.push(`definitions.${name}`);
+        }
+        next.definitions = definitions;
+      }
+      const setBoard = (target, value, path) => {
+        if (value === null) {
+          if (pack) fail("invalid-request", "a pack apply removes nothing");
+          if (!Object.hasOwn(target, "board")) fail("invalid-request", `${path} is not set`);
+          delete target.board;
+          return;
+        }
+        if (pack && Object.hasOwn(target, "board")) fail("invalid-request", `${path} is already set; a pack apply overwrites nothing`);
+        target.board = structuredClone(value);
+        added.push(path);
+      };
+      const setWorkflows = (target, value, path) => {
+        if (!planObject(value) || Object.keys(value).length === 0) fail("invalid-request", `${path} must name at least one workflow`);
+        const workflows = { ...(target.workflows ?? {}) };
+        for (const [name, workflow] of Object.entries(value)) {
+          if (!PLAN_NAME.test(name)) fail("invalid-request", `${path} keys must be workflow names matching ${PLAN_NAME}`);
+          const exists = Object.hasOwn(workflows, name);
+          if (workflow === null) {
+            if (pack) fail("invalid-request", "a pack apply removes nothing");
+            if (!exists) fail("invalid-request", `${path}.${name} is not set`);
+            delete workflows[name];
+            continue;
+          }
+          if (pack && exists) fail("invalid-request", `${path}.${name} is already set; a pack apply overwrites nothing`);
+          workflows[name] = structuredClone(workflow);
+          added.push(`${path}.${name}`);
+          written.push({ path: `${path}.${name}`, workflow: workflows[name] });
+        }
+        if (Object.keys(workflows).length) target.workflows = workflows;
+        else delete target.workflows;
+      };
+      if (Object.hasOwn(plan, "board")) setBoard(next, plan.board, "board");
+      if (Object.hasOwn(plan, "workflows")) setWorkflows(next, plan.workflows, "workflows");
+      for (const { key, project, item } of projectKeys) {
+        const entry = Object.hasOwn(next.projects ?? {}, project) ? next.projects[project] : null;
+        if (!planObject(entry) || entry.kind === "library") fail("invalid-request", `projects declares no code project ${project}`);
+        if (item === "board") setBoard(entry, plan[key], `projects.${project}.board`);
+        else setWorkflows(entry, plan[key], `projects.${project}.workflows`);
+      }
+      // Each role a written workflow names resolves now. A role that isn't a name is left to the
+      // file check, which refuses it; only a name reaches readTemplate.
+      const templates = new Map();
+      const template = (name) => {
+        if (!templates.has(name)) {
+          try { readTemplate(rolesDir, name); templates.set(name, true); } catch (error) {
+            if (error?.name !== "BusinessError") throw error;
+            templates.set(name, false);
+          }
+        }
+        return templates.get(name);
+      };
+      for (const { path, workflow } of written) {
+        (Array.isArray(workflow?.steps) ? workflow.steps : []).forEach((step, i) => {
+          for (const role of Array.isArray(step?.roles) ? step.roles : []) {
+            if (role === "human" || typeof role !== "string" || !PLAN_NAME.test(role)) continue;
+            if (Object.hasOwn(next.definitions ?? {}, role) || template(role)) continue;
+            fail("invalid-request", `${path} step ${i + 1} names ${role}, which is not an org definition, a V2 template or human`);
+          }
+        });
+      }
+      if (pack) {
+        // A {definition, rev} pin names a definition this apply wrote; an {inline, sha256} pin is the
+        // canonical hash of the entry stored beside it (design section 3). The file check bounds the
+        // entry's shape; this is the write's own check that the pin means what it says.
+        for (const hire of Array.isArray(pack.proposedHires) ? pack.proposedHires : []) {
+          const pin = hire?.pin;
+          if (planObject(pin) && Object.hasOwn(pin, "definition") && !(added.includes(`definitions.${pin.definition}`) && pin.rev === 1)) {
+            fail("invalid-request", "a {definition, rev} proposal pins a definition this apply writes, at rev 1");
+          }
+          if (planObject(pin) && Object.hasOwn(pin, "inline") && planObject(hire.entry) && pin.sha256 !== sha256(canonicalJson(hire.entry))) {
+            fail("invalid-request", "an {inline, sha256} proposal's sha256 is the canonical hash of its entry");
+          }
+        }
+        next.packs = [...(old.packs ?? []), {
+          id: pack.id, version: pack.version, sha256: pack.sha256, origin: pack.origin, scope: pack.scope, project: pack.project,
+          at, by: actor, added, proposedHires: structuredClone(pack.proposedHires),
+        }];
+      }
+      logged.added = added;
+      return { next, added };
+    };
+    let result;
+    const guard = (old, document) => {
+      if (canonicalJson(document) !== canonicalJson(build(old).next)) fail("invalid-request", "the document is not the plan's");
+      // The key fence itself, whatever build does: only the plan's keys change, definitions and
+      // packs only grow, and a project changes only in a planned board or workflows.
+      for (const key of new Set([...Object.keys(old), ...Object.keys(document)])) {
+        if (key === "projects" || PLAN_TOP.includes(key)) continue;
+        if (canonicalJson(old[key] ?? null) !== canonicalJson(document[key] ?? null)) fail("invalid-request", "a pack plan changes only definitions, board, workflows, packs and project boards and workflows");
+      }
+      for (const [name, entry] of Object.entries(old.definitions ?? {})) {
+        if (canonicalJson(entry) !== canonicalJson(document.definitions?.[name] ?? null)) fail("organization-definitions-only", "a pack apply changes no existing definition");
+      }
+      const oldPacks = old.packs ?? [];
+      if (canonicalJson(oldPacks) !== canonicalJson((document.packs ?? []).slice(0, oldPacks.length))) fail("invalid-request", "a pack apply keeps every earlier packs entry");
+      const planned = new Set(projectKeys.map((k) => `${k.project}.${k.item}`));
+      const projects = (doc) => doc?.projects ?? {};
+      for (const project of new Set([...Object.keys(projects(old)), ...Object.keys(projects(document))])) {
+        const a = projects(old)[project] ?? null;
+        const b = projects(document)[project] ?? null;
+        const rest = (e) => (planObject(e) ? Object.fromEntries(Object.entries(e).filter(([k]) => k !== "board" && k !== "workflows")) : e);
+        if (canonicalJson(rest(a)) !== canonicalJson(rest(b))) fail("organization-projects-protected");
+        for (const item of ["board", "workflows"]) {
+          if (canonicalJson(a?.[item] ?? null) !== canonicalJson(b?.[item] ?? null) && !planned.has(`${project}.${item}`)) fail("organization-projects-protected");
+        }
+      }
+    };
+    const out = commit(id, (old) => { result = build(old); return result.next; }, { revision, actor, guard, pathsOnly: true, detail: logged });
+    return { ...out, added: result.added };
+  }
+
   // Lifecycle Task 2: the only writer that adds a project mapping, and only the exact bootstrap
   // addition: one new key under the managed product layout, a receipt naming the request and plan, and
   // no other change. It compares both the document it built and the bytes it will publish. A stale
@@ -594,6 +787,86 @@ export function organizationWriter({ dir, rolesDir, dataRoot = null, barrier = (
     });
   }
 
+  // #1873 CB2 (design section 5 steps 4 to 6): a copy's service credential is issued in two writes
+  // around the remote work; no lock is held across it. stageCopyGrant deactivates first: the record
+  // goes pending, the service loses its grantId and rotateBy (grantGeneration stays) and the binding
+  // generation counts up. Only then does the bus write the slot and ask the service. commitCopyGrant
+  // rechecks under the locks everything the stage pinned (registry incarnation, document revision,
+  // generation, copyId, decision, source and definition pin), runs `beforeWrite` (the bus's slot and
+  // session recheck), then writes the grant: grantGeneration counts up, and the record is `bound` once
+  // every service holds a grant. A refusal or a crash between the two leaves the record pending and
+  // nothing resolves it; recovery is a new verified issue. Owner only, as a binding decision.
+  // `op` is { instance, service, copyId, generation, decision, incarnation } as the bus read it.
+  function copyGrantFence(old, op, { actor, owner, definitions }) {
+    const { instance, service } = op;
+    const agents = [
+      ...Object.entries(old.roles ?? {}).flatMap(([n, e]) => [n, `${e?.definition}.${n}`]),
+      ...Object.entries(old.projects ?? {}).flatMap(([p, v]) => Object.entries(v?.agents ?? {}).flatMap(([n, e]) => [n, `${n}.${p}`, `${e?.definition}.${n}.${p}`])),
+      ...Object.keys(old.copyBindings ?? {}), ...Object.keys(definitions ?? {}), ...(old.retired ?? []),
+    ];
+    if (owner !== true || actor === "tester" || agents.includes(actor)) fail("human-required", bindingText("human-required"));
+    const current = old.copyBindings?.[instance];
+    if (!current || current.copyId !== op.copyId || current.generation !== op.generation || current.orgIncarnation !== op.incarnation
+      || current.decision !== op.decision || current.state === "unbound" || !Object.hasOwn(current.services ?? {}, service)
+      || Object.hasOwn(old.roles ?? {}, instance)) fail("credential-binding-changed", bindingText("credential-binding-changed", service));
+    const pin = definitionPin(current.definition.ref, { definitions: { ...(definitions ?? {}), ...(old.definitions ?? {}) }, rolesDir, readTemplate });
+    if (!samePin(pin, current.definition)) fail("credential-role-changed", bindingText("credential-role-changed", service));
+    return current;
+  }
+  const grantOp = (op) => {
+    if (!op || typeof op.instance !== "string" || typeof op.service !== "string" || !Number.isSafeInteger(op.generation)
+      || typeof op.copyId !== "string" || typeof op.decision !== "string" || typeof op.incarnation !== "string") fail("invalid-request");
+  };
+  function stageCopyGrant(id, op, { revision, actor, owner = false, definitions = {} }) {
+    grantOp(op);
+    if (owner !== true || actor === "tester") fail("human-required", bindingText("human-required"));
+    const build = old => {
+      const current = copyGrantFence(old, op, { actor, owner, definitions });
+      const services = structuredClone(current.services);
+      delete services[op.service].grantId;
+      delete services[op.service].rotateBy;
+      const record = { ...structuredClone(current), generation: current.generation + 1, state: "pending", services };
+      return { ...structuredClone(old), copyBindings: { ...old.copyBindings, [op.instance]: record } };
+    };
+    const result = commit(id, build, {
+      revision, actor, pathsOnly: true, capability: BINDING_WRITE, incarnation: op.incarnation,
+      guard: (old, next) => {
+        if (canonicalJson(next) !== canonicalJson(build(old))) fail("organization-bindings-protected", "copyBindings change only through an owner-approved binding decision");
+        projectsProtected(old, next);
+        definitionsProtected(old, next);
+      },
+      detail: { verb: "binding.stage", agent: op.instance, kind: [op.service], generation: op.generation + 1 },
+    });
+    return { ...result, generation: op.generation + 1 };
+  }
+  function commitCopyGrant(id, op, { grantId, rotateBy, revision, actor, owner = false, definitions = {}, beforeWrite = null }) {
+    grantOp(op);
+    if (owner !== true || actor === "tester") fail("human-required", bindingText("human-required"));
+    const build = old => {
+      const current = copyGrantFence(old, op, { actor, owner, definitions });
+      if (current.state !== "pending" || current.services[op.service].grantId !== undefined) fail("credential-binding-changed", bindingText("credential-binding-changed", op.service));
+      // One grant per organization: another copy's or another service's grant id never moves here.
+      for (const [name, r] of Object.entries(old.copyBindings ?? {}))
+        for (const [service, v] of Object.entries(r?.services ?? {}))
+          if (v?.grantId === grantId && !(name === op.instance && service === op.service)) fail("credential-identity-refused", bindingText("credential-identity-refused", op.service));
+      const services = structuredClone(current.services);
+      services[op.service] = { ...services[op.service], rotateBy, grantId, grantGeneration: (services[op.service].grantGeneration ?? 0) + 1 };
+      const record = { ...structuredClone(current), generation: current.generation + 1, state: allGranted(services) ? "bound" : "pending", services };
+      return { ...structuredClone(old), copyBindings: { ...old.copyBindings, [op.instance]: record } };
+    };
+    let state = null;
+    const result = commit(id, (old) => { const next = build(old); state = next.copyBindings[op.instance].state; return next; }, {
+      revision, actor, beforeWrite, pathsOnly: true, capability: BINDING_WRITE, incarnation: op.incarnation,
+      guard: (old, next) => {
+        if (canonicalJson(next) !== canonicalJson(build(old))) fail("organization-bindings-protected", "copyBindings change only through an owner-approved binding decision");
+        projectsProtected(old, next);
+        definitionsProtected(old, next);
+      },
+      detail: { verb: "binding.grant", agent: op.instance, kind: [op.service], generation: op.generation + 1 },
+    });
+    return { ...result, generation: op.generation + 1, state };
+  }
+
   // AU inverse, from an immutable private proposal. It touches only the named instance and
   // definition; writer validation, fresh revision and owner fence still apply. Bindings never restore.
   function reverseHireDecision(id,p,{actor,beforeWrite,beforePublish}) {
@@ -699,5 +972,5 @@ export function organizationWriter({ dir, rolesDir, dataRoot = null, barrier = (
     });
   }
 
-  return { logFile, read, readRaw, write, addProject, setProjectRemote, setProjectAgent, setDefinition, applyHireDecision, reverseHireDecision, applyCopyBindingDecision, hold, holdAsync, findAddition, record, recover: id => withLock(id, () => recover(id)) };
+  return { logFile, read, readRaw, write, addProject, setProjectRemote, setProjectAgent, setDefinition, applyPack, applyHireDecision, reverseHireDecision, applyCopyBindingDecision, stageCopyGrant, commitCopyGrant, hold, holdAsync, findAddition, record, recover: id => withLock(id, () => recover(id)) };
 }

packages/organization/src/repo-remote.mjs

@@ -0,0 +1,132 @@
+// #1873 P1-6 and P1-7: the project repository's remote URL, and the one check it gets.
+//
+// parseRepoRemote decides which URLs may become a checkout's origin: https (the Gitea form the
+// loader already uses) and ssh, nothing else. checkRemote runs `git ls-remote` against that URL with
+// no credential of any kind and a hard timeout, and says plainly whether the repository answered,
+// wants a credential, or could not be reached. Nothing here pushes, fetches objects or writes.
+import { spawn } from 'node:child_process';
+import { parseRepoRemote } from './vocabulary.mjs';
+import { BINDING_STATES } from './copy-bindings.mjs';
+
+export { parseRepoRemote };
+
+// The ssh client for the check: no user or system config file, no agent, no key, no password, no
+// proxy or jump host, no multiplexing, no forwarding, no local command, and an unknown host key is
+// accepted for this one connection without being remembered (nothing secret is sent to it).
+export const CHECK_SSH_COMMAND = [
+  'ssh', '-F', '/dev/null',
+  ...['BatchMode=yes', 'ConnectTimeout=5', 'StrictHostKeyChecking=no', 'UserKnownHostsFile=/dev/null',
+    'GlobalKnownHostsFile=/dev/null', 'LogLevel=ERROR', 'IdentityFile=none', 'IdentitiesOnly=yes',
+    'IdentityAgent=none', 'PasswordAuthentication=no', 'KbdInteractiveAuthentication=no',
+    'HostbasedAuthentication=no', 'GSSAPIAuthentication=no', 'ProxyCommand=none', 'ProxyJump=none',
+    'ControlMaster=no', 'ControlPath=none', 'PermitLocalCommand=no', 'ForwardAgent=no',
+    'ClearAllForwardings=yes'].flatMap((o) => ['-o', o]),
+].join(' ');
+
+const PRODUCTION = Object.freeze({ protocols: 'https:ssh', timeoutMs: 15000 });
+const OUTPUT_CAP = 64 * 1024;
+
+// git's own message for "this needs a credential": a prompt it could not show, a 401 or 403, or
+// ssh refusing every (absent) key.
+const NEEDS_CREDENTIAL = [
+  /terminal prompts disabled/i, /could not read (username|password)/i, /authentication failed/i,
+  /returned error: 40[13]\b/, /permission denied \(/i,
+];
+
+// One plain line from git's stderr: the first line that says what went wrong, without "fatal: ",
+// control characters or more than 200 characters.
+// Plain and true for every remote: the check itself sends none. Whether a credential binding can
+// supply one later depends on the remote (copy bindings cover https Gitea remotes only), so this line
+// does not promise it.
+export const NEEDS_CREDENTIAL_MESSAGE = 'the repository needs a credential; this check uses none';
+
+export function summarizeGitError(stderr) {
+  const lines = String(stderr).split('\n').map((l) => l.replace(/[\0-\x1f\x7f]/g, '').trim()).filter(Boolean);
+  const line = lines.find((l) => /^(fatal|ssh|error):/i.test(l)) ?? lines[0] ?? '';
+  const text = line.replace(/^(fatal|error):\s*/i, '');
+  return text.length > 200 ? `${text.slice(0, 199)}…` : text || 'git gave no reason';
+}
+
+export function classifyCheck({ code, timedOut, spawnError, stderr }) {
+  if (spawnError) return { result: 'unreachable', message: 'git could not be started' };
+  if (timedOut) return { result: 'unreachable', message: 'no answer before the check timed out' };
+  if (code === 0) return { result: 'reachable', message: 'the repository answered' };
+  if (NEEDS_CREDENTIAL.some((p) => p.test(stderr))) return { result: 'needs-credential', message: NEEDS_CREDENTIAL_MESSAGE };
+  return { result: 'unreachable', message: summarizeGitError(stderr) };
+}
+
+function lsRemote(url, { protocols, timeoutMs }) {
+  const env = {
+    PATH: process.env.PATH ?? '/usr/bin:/bin', HOME: '/nonexistent', LC_ALL: 'C',
+    GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null', GIT_CEILING_DIRECTORIES: '/',
+    GIT_TERMINAL_PROMPT: '0', GIT_ALLOW_PROTOCOL: protocols,
+    GIT_SSH_COMMAND: CHECK_SSH_COMMAND, GIT_SSH_VARIANT: 'ssh', GIT_PROTOCOL_FROM_USER: '0',
+  };
+  const args = [
+    '-c', 'credential.helper=', '-c', 'core.askPass=', '-c', 'http.followRedirects=false',
+    '-c', 'protocol.allow=never', ...protocols.split(':').flatMap((p) => ['-c', `protocol.${p}.allow=always`]),
+    'ls-remote', '--', url, 'HEAD',
+  ];
+  return new Promise((resolve) => {
+    let child;
+    try { child = spawn('git', args, { cwd: '/', env, stdio: ['ignore', 'pipe', 'pipe'], detached: true }); }
+    catch { resolve(classifyCheck({ spawnError: true })); return; }
+    let stderr = '', timedOut = false, done = false;
+    const kill = () => { try { process.kill(-child.pid, 'SIGKILL'); } catch { /* already gone */ } };
+    const timer = setTimeout(() => { timedOut = true; kill(); }, timeoutMs);
+    child.stdout.on('data', () => {});
+    child.stderr.on('data', (d) => { if (stderr.length < OUTPUT_CAP) stderr += d; });
+    const finish = (outcome) => { if (done) return; done = true; clearTimeout(timer); kill(); resolve(classifyCheck({ ...outcome, timedOut, stderr })); };
+    child.on('error', () => finish({ spawnError: true }));
+    child.on('close', (code) => finish({ code }));
+  });
+}
+
+let override = null;
+
+// The ssh check accepts any host key (nothing secret is sent to it), so an answer over ssh shows
+// that something at that address speaks git, not that it is the named host. Every ssh outcome that
+// came from an answer says so; https verifies the host's certificate as usual.
+export const SSH_HOST_UNVERIFIED = 'the ssh host key was not verified';
+
+// The check for a URL parseRepoRemote accepted: https and ssh only, 15 second limit. Returns
+// {result: 'reachable'|'needs-credential'|'unreachable', message, url}. A URL that does not parse
+// is refused by the caller first; here it is reported unreachable without running git.
+export async function checkRemote(url) {
+  const parsed = parseRepoRemote(url);
+  if (!parsed.ok) return { result: 'unreachable', message: parsed.message, url };
+  const outcome = override ? await override(parsed.url) : await lsRemote(parsed.url, PRODUCTION);
+  const message = parsed.kind === 'ssh' && outcome.result !== 'unreachable' ? `${outcome.message}; ${SSH_HOST_UNVERIFIED}` : outcome.message;
+  return { result: outcome.result, message, url: parsed.url };
+}
+
+// #1873 F7: a copy binding grants the repositories its projects' remotes name when a credential is
+// issued (bus copy-grant boundRepositories), and the decision records only project names. So a
+// project's repository does not change under a binding that still grants. These are the copies
+// whose binding names `project` and still grants: `pending` (approved, not yet verified) and
+// `bound` (active). The `unbound` tombstone an unbind leaves grants nothing and holds no services.
+// `doc` is the organization document as the loader validated it (copy-bindings.mjs schema).
+export const REPO_BOUND = 'project-repo-bound';
+const GRANTING = BINDING_STATES.filter((s) => s !== 'unbound');
+export function projectBindings(doc, project) {
+  const out = [];
+  for (const [instance, record] of Object.entries(doc?.copyBindings ?? {})) {
+    if (!GRANTING.includes(record?.state)) continue;
+    const names = record.source?.project === project
+      || Object.values(record.services ?? {}).some((v) => v?.resources?.projects?.includes(project));
+    if (names) out.push({ instance, state: record.state });
+  }
+  return out.sort((a, b) => (a.instance < b.instance ? -1 : a.instance > b.instance ? 1 : 0));
+}
+export function repoBoundMessage(project, bindings) {
+  const list = bindings.map((b) => `${b.instance} (${b.state === 'bound' ? 'active' : 'approved, not yet verified'})`).join(', ');
+  return `project ${project} is in a copy binding that still grants it: ${list}. Revoke that copy binding first (the chief raises an unbind decision and the owner approves it), then set the repository, then ask the chief to raise a new binding decision`;
+}
+
+// TEST SEAM. Tests reach a local bare repository through this and nothing else: lsRemote with a
+// widened protocol list, and a stand-in for checkRemote's git call. No module under packages/*/src
+// may import or name it; tests/repo-remote.test.mjs enforces that by scanning the sources.
+export const repoRemoteTestSeam = Object.freeze({
+  lsRemote: (url, { protocols, timeoutMs = 5000 }) => lsRemote(url, { protocols, timeoutMs }),
+  useCheck(fn) { override = typeof fn === 'function' ? fn : null; },
+});

packages/organization/src/vocabulary.mjs

@@ -236,6 +236,62 @@ export function parseGiteaUrl(value, { repo = false } = {}) {
   return { url, owner: segments[0], repo: name };
 }
 
+// #1873 P1-6: a project repository's remote, https or ssh. It lives here, beside parseGiteaUrl,
+// because the loader validates projects.<p>.git.remote with it and this file imports nothing.
+const REPO_REMOTE_MAX = 512;
+// A host name or IPv4 address: labels of letters, digits and "-", starting with a letter or digit.
+const REMOTE_HOST = '[A-Za-z0-9](?:[A-Za-z0-9-]{0,62})(?:\\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,62}))*';
+// A login name. It never starts with "-" so ssh can't read it as an option.
+const REMOTE_USER = '[A-Za-z0-9_][A-Za-z0-9_.-]{0,63}';
+// Path segments: letters, digits, "_", ".", "-" and "~", never starting with "-", never "." or "..".
+const REMOTE_SEGMENT = '[A-Za-z0-9_.~][A-Za-z0-9_.~-]{0,99}';
+const REMOTE_SSH_URL = new RegExp(`^ssh://(?:(${REMOTE_USER})@)?(${REMOTE_HOST})(?::([0-9]{1,5}))?(/${REMOTE_SEGMENT}(?:/${REMOTE_SEGMENT})*)$`);
+const REMOTE_SCP_LIKE = new RegExp(`^(${REMOTE_USER})@(${REMOTE_HOST}):(/?${REMOTE_SEGMENT}(?:/${REMOTE_SEGMENT})*)$`);
+
+const REMOTE_PROBLEMS = Object.freeze({
+  form: 'the repository URL must be an https or ssh URL',
+  option: 'the repository URL must not start with "-"',
+  transport: 'the repository URL must not name a git transport helper (such as ext::)',
+  local: 'the repository URL must not be a local path or a file:// URL',
+  scheme: 'the repository URL must use https or ssh',
+  credentials: 'the repository URL must not carry a password or token, or a user name in an https URL; a URL never holds a credential',
+  https: 'an https repository URL must be normalized and name a repository, https://HOST/OWNER/REPO',
+  ssh: 'an ssh repository URL must be ssh://[USER@]HOST[:PORT]/PATH or USER@HOST:PATH, with no "." or ".." segment',
+});
+
+// Returns {ok: true, kind: 'https'|'ssh', url} or {ok: false, problem, message}. The URL that is
+// checked and stored is exactly the value given; nothing is rewritten.
+export function parseRepoRemote(value) {
+  const no = (problem) => ({ ok: false, problem, message: REMOTE_PROBLEMS[problem] });
+  if (typeof value !== 'string' || value.length === 0 || value.length > REPO_REMOTE_MAX) return no('form');
+  if (value.startsWith('-')) return no('option');
+  if (value.includes('::')) return no('transport');
+  if (/[\s\0-\x1f\x7f]/.test(value)) return no('form');
+  if (/^file:/i.test(value) || /^[/.~\\]/.test(value)) return no('local');
+  const scheme = /^([A-Za-z][A-Za-z0-9+.-]*):\/\//.exec(value)?.[1]?.toLowerCase();
+  if (scheme === 'https') {
+    let url = null;
+    try { url = new URL(value); } catch { return no('https'); }
+    if (url.username || url.password) return no('credentials');
+    return parseGiteaUrl(value, { repo: true }).url ? { ok: true, kind: 'https', url: value } : no('https');
+  }
+  if (scheme === 'ssh') {
+    if (/^ssh:\/\/[^/@]*:[^/@]*@/.test(value)) return no('credentials');
+    const m = REMOTE_SSH_URL.exec(value);
+    if (!m || remoteDotSegment(m[4]) || (m[3] !== undefined && !(Number(m[3]) >= 1 && Number(m[3]) <= 65535 && !m[3].startsWith('0')))) return no('ssh');
+    return { ok: true, kind: 'ssh', url: value };
+  }
+  if (scheme !== undefined) return no('scheme');
+  // No "scheme://": git reads HOST:PATH as ssh only when the colon comes before any slash.
+  const colon = value.indexOf(':'), slash = value.indexOf('/');
+  if (colon < 0 || (slash >= 0 && slash < colon)) return no('local');
+  if (/^[^@]*:[^@]*@/.test(value)) return no('credentials');
+  const m = REMOTE_SCP_LIKE.exec(value);
+  if (!m || remoteDotSegment(m[3])) return no('ssh');
+  return { ok: true, kind: 'ssh', url: value };
+}
+const remoteDotSegment = (path) => path.split('/').some((s) => s === '.' || s === '..');
+
 // Design D9 step 2: the agent's fork of an upstream, https://HOST[:PORT]/<user>/REPO, or null for an
 // upstream that doesn't parse. The owner is always the agent's own Gitea user; nothing else names it.
 // URL.host drops a default port, so 443 counts the same on both sides.

packages/organization/tests/agent-copies.test.mjs

@@ -327,3 +327,34 @@ test("A3: a project narrowing a root copy narrows that copy; an organization wit
   assert.deepEqual(plain.roles.coder.vars["limits.tools"], ["read"]);
   assert.equal(Object.hasOwn(plain, "copies"), false);
 });
+
+// #1873 CB3: a copy the bus verified at boot joins as an instance with no credential reference, only
+// the services it was bound for; a partial or extra binding never promotes.
+test("CB3: a verified copy joins with copyBound and no reference; a partial or extra binding stays unbound", async () => {
+  const { promoteCopies } = await import("../src/agent-copies.mjs");
+  const dir = tmp();
+  const doc = org(dir, "acme");
+  const r = root({ researcher: { definition: "research" }, reviewer2: { definition: "reviewer" } });
+  const snapshot = materializeCopies({ orgId: "acme", doc, root: r, rolesDir });
+  const promoted = promoteCopies(snapshot, { researcher: ["gitea"], reviewer2: ["gitea"], nobody: ["gitea"] });
+  assert.equal(promoted.copies.researcher.state, "instance");
+  assert.deepEqual(promoted.copies.researcher.bound, ["gitea"]);
+  assert.equal(Object.hasOwn(promoted.copies.researcher, "missing"), false);
+  // reviewer needs gitea and vikunja: gitea alone is a partial binding.
+  assert.equal(promoted.copies.reviewer2.state, "unbound");
+  assert.equal(promoteCopies(snapshot, { researcher: ["gitea", "vikunja"] }).copies.researcher.state, "unbound", "an extra service is no promotion");
+  assert.equal(promoteCopies(snapshot, { reviewer2: ["gitea", "vikunja"] }).copies.reviewer2.state, "unbound", "vikunja has no copy verifier");
+  assert.ok(Object.isFrozen(promoted.copies.researcher));
+  assert.equal(snapshot.copies.researcher.state, "unbound", "the boot snapshot is unchanged");
+  const business = withCopies(doc, businessFilePath("acme", dir), { rolesDir, snapshot: promoted });
+  assert.deepEqual(business.roles.researcher.credentials, {});
+  assert.deepEqual(business.roles.researcher.copyBound, ["gitea"]);
+  assert.equal(business.copies.researcher.state, "instance");
+  assert.deepEqual(business.copies.researcher.bound, ["gitea"]);
+  assert.equal(copyRefusal(business, "researcher"), null);
+  assert.equal(copyRefusal(business, "reviewer2").code, "credential-unbound");
+  assert.equal(JSON.stringify(business).includes(join("secrets", "agents")), false, "no store path reaches the business");
+  assert.equal(JSON.stringify(business.roles.researcher).includes(dir), false);
+  const resolved = resolveInstance({ system: systemFor(dir), business, instance: "researcher" });
+  assert.deepEqual(resolved.credentials, {});
+});

packages/organization/tests/copy-grant-writer.test.mjs

@@ -0,0 +1,215 @@
+// #1873 CB2 (design section 5 steps 4 to 6, section 8 row CB2): the grant metadata a verified copy
+// credential leaves on its binding record, and the writer's two writes around the remote work. The
+// bus side (verifier, slot, broker) is packages/bus/tests/copy-grant.test.mjs.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { hireDecisions } from '../src/hire-decisions.mjs';
+import { organizationWriter } from '../src/organization.mjs';
+import { checkRootAgents } from '../src/agent-levels.mjs';
+import { materializeCopies } from '../src/agent-copies.mjs';
+import { readTemplate } from '../src/definitions.mjs';
+import { activateOrg, reserveOrg } from '../src/org-registry.mjs';
+import * as bindings from '../src/copy-bindings.mjs';
+import { businessDoc, rolesCopy, writeJson } from './helpers.mjs';
+
+const { definitionPin, validateCopyBindings } = bindings;
+const OWNER = { actor: 'jason', agent: false, rights: ['org.hire'], owner: true, instanceOwner: true, subject: { provider: 'test', iss: 'https://test', sub: 'owner' } };
+const FUTURE = '2099-01-01T00:00:00.000Z';
+const ID1 = '11111111-1111-4111-8111-111111111111', ID2 = '22222222-2222-4222-8222-222222222222', ID3 = '33333333-3333-4333-8333-333333333333';
+const GITEA = { gitea: { scopes: ['read:repository', 'read:user'], projects: ['stack'] } };
+const SECRET = 'sk-test-NOT-A-SECRET-1234';
+const repoRoles = join(new URL('../../..', import.meta.url).pathname, 'roles');
+const INC = 'a'.repeat(32);
+
+const granted = (over = {}) => ({
+  copyId: 'c'.repeat(32), orgIncarnation: INC, source: { level: 'root', name: 'rev', project: null },
+  definition: definitionPin('reviewer', { rolesDir: repoRoles, readTemplate }), generation: 3, state: 'bound',
+  services: {
+    gitea: { slot: 'self', scopes: ['read:repository'], resources: { projects: ['stack'] }, rotateBy: '2099-01-01', grantId: 'gitea:5:7', grantGeneration: 1 },
+    vikunja: { slot: 'self', scopes: { tasks: ['read_one'] }, resources: { projects: ['stack'] }, rotateBy: '2099-01-01', grantId: 'vikunja:2:9', grantGeneration: 2 },
+  },
+  decision: ID1, ...over,
+});
+const withGitea = (patch, over = {}) => { const r = granted(over); r.services.gitea = { ...r.services.gitea, ...patch }; for (const k of Object.keys(patch)) if (patch[k] === undefined) delete r.services.gitea[k]; return r; };
+
+test('CB2 schema: grant fields come together, name their own service and are ids only', () => {
+  assert.doesNotThrow(() => validateCopyBindings({ rev: granted() }));
+  // After a stage: pending, the grant gone, its generation kept.
+  assert.doesNotThrow(() => validateCopyBindings({ rev: withGitea({ rotateBy: undefined, grantId: undefined }, { state: 'pending' }) }));
+  const refused = [
+    withGitea({ grantId: undefined }),
+    withGitea({ rotateBy: undefined }),
+    withGitea({ grantGeneration: undefined }),
+    withGitea({ grantId: 'vikunja:5:7' }),
+    withGitea({ grantId: 'gitea:5' }),
+    withGitea({ grantId: 'gitea:0:7' }),
+    withGitea({ grantId: `gitea:${SECRET}` }),
+    withGitea({ grantId: 'gitea:5:7:' + 'f'.repeat(40) }),
+    withGitea({ grantGeneration: 0 }),
+    withGitea({ grantGeneration: 1.5 }),
+    withGitea({ rotateBy: '2099-02-30' }),
+    withGitea({ rotateBy: '2099-1-01' }),
+    withGitea({ token: SECRET }),
+    withGitea({ account: 'mosaic-copy-x' }),
+    withGitea({ sha256: 'f'.repeat(64) }),
+  ];
+  for (const r of refused) assert.throws(() => validateCopyBindings({ rev: r }), e => e.name === 'BusinessError' && !e.message.includes(SECRET) && !e.message.includes('/'), JSON.stringify(r.services.gitea));
+});
+
+test('CB2 schema: grant fields are optional per service; one grant id per organization', () => {
+  // The schema keeps CB0's shape: a service without a grant is valid in any state. Only the
+  // verifier's commit writes bound, and only when every service holds a grant (bus copy-grant tests).
+  assert.doesNotThrow(() => validateCopyBindings({ rev: withGitea({ rotateBy: undefined, grantId: undefined }) }));
+  assert.throws(() => validateCopyBindings({ rev: granted({ services: {} }) }));
+  const other = { ...granted({ copyId: 'd'.repeat(32), source: { level: 'root', name: 'other', project: null } }) };
+  other.services = structuredClone(other.services);
+  other.services.vikunja.grantId = 'vikunja:3:3';
+  assert.throws(() => validateCopyBindings({ rev: granted(), other }), /grant another binding uses/);
+  other.services.gitea.grantId = 'gitea:5:8';
+  assert.doesNotThrow(() => validateCopyBindings({ rev: granted(), other }));
+});
+
+test('CB2 the login a copy grant must belong to is per organization, copy and service', () => {
+  const { copyBotLogin } = bindings;
+  assert.equal(typeof copyBotLogin, 'function');
+  const a = copyBotLogin(INC, 'c'.repeat(32), 'gitea');
+  assert.match(a, /^mosaic-copy-[0-9a-f]{24}$/);
+  assert.ok(a.length <= 40);
+  assert.equal(copyBotLogin(INC, 'c'.repeat(32), 'gitea'), a);
+  for (const other of [copyBotLogin('b'.repeat(32), 'c'.repeat(32), 'gitea'), copyBotLogin(INC, 'd'.repeat(32), 'gitea'), copyBotLogin(INC, 'c'.repeat(32), 'vikunja')])
+    assert.notEqual(other, a);
+  for (const bad of [[null, 'c'.repeat(32), 'gitea'], [INC, 'x', 'gitea'], [INC, 'c'.repeat(32), 'host.ops'], [INC, 'c'.repeat(32), 'model']])
+    assert.equal(copyBotLogin(...bad), null);
+});
+
+function setup(t) {
+  const root = mkdtempSync(join(tmpdir(), 'cb2o-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const roles = rolesCopy(root);
+  const doc = { ...businessDoc(root, 'demo'), plugins: { harness: ['pi'] } };
+  doc.projects.stack.agents = { checker: { definition: 'reviewer' } };
+  const file = writeJson(join(root, 'businesses/demo.json'), doc);
+  const dataRoot = join(root, 'data'); mkdirSync(dataRoot, { mode: 0o700 });
+  const ctx = { configDir: root, dataRoot, instance: 'test' };
+  const ready = (async () => { await reserveOrg(ctx, 'demo'); await activateOrg(ctx, 'demo'); })();
+  const snapshot = materializeCopies({ orgId: 'demo', doc, root: { state: 'ok', ...checkRootAgents({ agentsVersion: 1, agents: { rev: { definition: 'reviewer' } } }, { rolesDir: roles }) }, rolesDir: roles });
+  const writer = organizationWriter({ dir: root, rolesDir: roles });
+  const service = hireDecisions({ writer, rolesDir: roles, configDir: root, dataRoot, assertClean: () => {}, copies: id => snapshot.org === id ? snapshot : null });
+  const bind = async (input, id) => {
+    await ready;
+    const p = await service.prepare('demo', { op: 'change', reason: 'Bind', binding: { services: GITEA }, ...input }, { id, expiresAt: FUTURE });
+    await service.apply('demo', p.id, { ...OWNER, digest: p.digest });
+  };
+  const rec = name => writer.read('demo').document.copyBindings[name];
+  const opFor = (name, service = 'gitea') => { const r = rec(name); return { instance: name, service, copyId: r.copyId, generation: r.generation, decision: r.decision, incarnation: r.orgIncarnation }; };
+  const log = () => readFileSync(join(root, 'businesses/.history/demo/changes.jsonl'), 'utf8');
+  return { root, roles, file, writer, bind, rec, opFor, log, revision: () => writer.read('demo').revision };
+}
+const AS = { actor: 'jason', owner: true };
+
+test('CB2 writer: the stage deactivates, the commit binds; the receipts name the verbs, never a grant', async t => {
+  const f = setup(t);
+  await f.bind({ level: 'root', name: 'rev' }, ID1);
+  const op = f.opFor('rev');
+  assert.equal(f.rec('rev').state, 'pending');
+  const staged = f.writer.stageCopyGrant('demo', op, { revision: f.revision(), ...AS });
+  assert.equal(staged.generation, op.generation + 1);
+  assert.deepEqual({ state: f.rec('rev').state, generation: f.rec('rev').generation }, { state: 'pending', generation: op.generation + 1 });
+  const done = f.writer.commitCopyGrant('demo', { ...op, generation: staged.generation }, { grantId: 'gitea:5:9', rotateBy: '2099-01-01', revision: staged.revision, ...AS });
+  assert.equal(done.state, 'bound');
+  const r = f.rec('rev');
+  assert.deepEqual({ state: r.state, generation: r.generation, gitea: r.services.gitea }, {
+    state: 'bound', generation: op.generation + 2,
+    gitea: { slot: 'self', scopes: ['read:repository', 'read:user'], resources: { projects: ['stack'] }, rotateBy: '2099-01-01', grantId: 'gitea:5:9', grantGeneration: 1 },
+  });
+  const log = f.log();
+  assert.ok(log.includes('binding.stage') && log.includes('binding.grant'));
+  assert.ok(!log.includes('gitea:5:9') && !log.includes('2099-01-01'), 'the receipts are paths only');
+  // A new issue stages again: use closes before any remote work, the grant generation stays.
+  f.writer.stageCopyGrant('demo', f.opFor('rev'), { revision: f.revision(), ...AS });
+  assert.deepEqual({ state: f.rec('rev').state, gitea: f.rec('rev').services.gitea }, {
+    state: 'pending', gitea: { slot: 'self', scopes: ['read:repository', 'read:user'], resources: { projects: ['stack'] }, grantGeneration: 1 },
+  });
+  const again = f.writer.commitCopyGrant('demo', f.opFor('rev'), { grantId: 'gitea:5:10', rotateBy: '2099-02-01', revision: f.revision(), ...AS });
+  assert.equal(again.state, 'bound');
+  assert.equal(f.rec('rev').services.gitea.grantGeneration, 2);
+});
+
+test('CB2 writer: a stale generation, revision, decision, copy or incarnation, and a second commit, write nothing', async t => {
+  const f = setup(t);
+  await f.bind({ level: 'root', name: 'rev' }, ID1);
+  const op = f.opFor('rev');
+  const rev0 = f.revision();
+  const staged = f.writer.stageCopyGrant('demo', op, { revision: rev0, ...AS });
+  const after = { ...op, generation: staged.generation };
+  const grant = { grantId: 'gitea:5:9', rotateBy: '2099-01-01', ...AS };
+  const before = readFileSync(f.file);
+  for (const [bad, code] of [
+    [{ ...after, generation: op.generation }, 'credential-binding-changed'],
+    [{ ...after, copyId: 'e'.repeat(32) }, 'credential-binding-changed'],
+    [{ ...after, decision: ID3 }, 'credential-binding-changed'],
+    [{ ...after, instance: 'checker.stack' }, 'credential-binding-changed'],
+    [{ ...after, service: 'vikunja' }, 'credential-binding-changed'],
+    [{ ...after, incarnation: 'b'.repeat(32) }, 'decision-stale'],
+  ]) assert.throws(() => f.writer.commitCopyGrant('demo', bad, { ...grant, revision: staged.revision }), { code }, JSON.stringify(bad));
+  assert.throws(() => f.writer.commitCopyGrant('demo', after, { ...grant, revision: rev0 }), { code: 'revision-conflict' });
+  assert.deepEqual(readFileSync(f.file), before);
+  f.writer.commitCopyGrant('demo', after, { ...grant, revision: staged.revision });
+  const bound = readFileSync(f.file);
+  assert.throws(() => f.writer.commitCopyGrant('demo', after, { ...grant, revision: f.revision() }), { code: 'credential-binding-changed' });
+  assert.throws(() => f.writer.commitCopyGrant('demo', { ...after, generation: after.generation + 1 }, { ...grant, grantId: 'gitea:5:10', revision: f.revision() }), { code: 'credential-binding-changed' });
+  assert.deepEqual(readFileSync(f.file), bound);
+  // A new binding decision between the stage and the commit wins: the commit refuses.
+  f.writer.stageCopyGrant('demo', f.opFor('rev'), { revision: f.revision(), ...AS });
+  const pinned = f.opFor('rev');
+  await f.bind({ level: 'root', name: 'rev', binding: { services: { gitea: { scopes: ['read:user'], projects: ['stack'] } } } }, ID2);
+  assert.throws(() => f.writer.commitCopyGrant('demo', pinned, { ...grant, grantId: 'gitea:5:11', revision: f.revision() }), { code: 'credential-binding-changed' });
+  assert.deepEqual(f.rec('rev').services.gitea, { slot: 'self', scopes: ['read:user'], resources: { projects: ['stack'] } });
+  assert.equal(f.rec('rev').state, 'pending');
+});
+
+test('CB2 writer: only the owner stages or commits; no agent, tester or member identity', async t => {
+  const f = setup(t);
+  await f.bind({ level: 'root', name: 'rev' }, ID1);
+  const op = f.opFor('rev');
+  const before = readFileSync(f.file);
+  for (const who of [{ actor: 'jason', owner: false }, { actor: 'tester', owner: true }, { actor: 'rev', owner: true }, { actor: 'chief', owner: true }, { actor: 'checker.stack', owner: true }, { actor: 'reviewer.checker.stack', owner: true }]) {
+    assert.throws(() => f.writer.stageCopyGrant('demo', op, { revision: f.revision(), ...who }), { code: 'human-required' }, who.actor);
+    assert.throws(() => f.writer.commitCopyGrant('demo', op, { grantId: 'gitea:5:9', rotateBy: '2099-01-01', revision: f.revision(), ...who }), { code: 'human-required' }, who.actor);
+  }
+  assert.throws(() => f.writer.stageCopyGrant('demo', { ...op, generation: 'x' }, { revision: f.revision(), ...AS }), { code: 'invalid-request' });
+  assert.deepEqual(readFileSync(f.file), before);
+});
+
+test('CB2 writer: another copy\'s grant id never moves here; a definition change refuses the commit', async t => {
+  const f = setup(t);
+  await f.bind({ level: 'root', name: 'rev' }, ID1);
+  await f.bind({ level: 'project', project: 'stack', name: 'checker' }, ID2);
+  const a = f.writer.stageCopyGrant('demo', f.opFor('rev'), { revision: f.revision(), ...AS });
+  f.writer.commitCopyGrant('demo', { ...f.opFor('rev') }, { grantId: 'gitea:5:9', rotateBy: '2099-01-01', revision: f.revision(), ...AS });
+  assert.ok(a);
+  f.writer.stageCopyGrant('demo', f.opFor('checker.stack'), { revision: f.revision(), ...AS });
+  const before = readFileSync(f.file);
+  assert.throws(() => f.writer.commitCopyGrant('demo', f.opFor('checker.stack'), { grantId: 'gitea:5:9', rotateBy: '2099-01-01', revision: f.revision(), ...AS }), { code: 'credential-identity-refused' });
+  assert.deepEqual(readFileSync(f.file), before);
+  // The reviewer template changes between the stage and the commit: its pin no longer matches.
+  const template = join(f.roles, 'reviewer.json');
+  const role = JSON.parse(readFileSync(template, 'utf8'));
+  writeFileSync(template, JSON.stringify({ ...role, title: role.title + ' changed' }, null, 2));
+  assert.throws(() => f.writer.commitCopyGrant('demo', f.opFor('checker.stack'), { grantId: 'gitea:6:1', rotateBy: '2099-01-01', revision: f.revision(), ...AS }), { code: 'credential-role-changed' });
+  assert.deepEqual(readFileSync(f.file), before);
+});
+
+test('CB2 writer: a generic write never adds or changes grant fields', async t => {
+  const f = setup(t);
+  await f.bind({ level: 'root', name: 'rev' }, ID1);
+  const { document, revision } = f.writer.read('demo');
+  const next = structuredClone(document);
+  next.copyBindings.rev.services.gitea = { ...next.copyBindings.rev.services.gitea, rotateBy: '2099-01-01', grantId: 'gitea:5:9', grantGeneration: 1 };
+  next.copyBindings.rev.state = 'bound';
+  assert.throws(() => f.writer.write('demo', next, { revision, actor: 'jason' }), { code: 'organization-bindings-protected' });
+  assert.equal(f.rec('rev').state, 'pending');
+});

packages/organization/tests/repo-remote.test.mjs

@@ -0,0 +1,352 @@
+// #1873 P1-6 and P1-7: the remote URL rules, the ls-remote check, and repo set.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createServer } from 'node:http';
+import { createServer as createTcpServer } from 'node:net';
+import { execFileSync } from 'node:child_process';
+import { chmodSync, mkdtempSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { tmpdir } from 'node:os';
+import { createHash } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { parseRepoRemote, checkRemote, classifyCheck, summarizeGitError, CHECK_SSH_COMMAND, NEEDS_CREDENTIAL_MESSAGE, SSH_HOST_UNVERIFIED, repoRemoteTestSeam } from '../src/repo-remote.mjs';
+import { createOrg, templateRender, projectRepoInit, projectRepoShow, projectRepoSet, queueInit, showOrg, updateOrg } from '../src/org-service.mjs';
+import { loadBusiness } from '../src/organization-config.mjs';
+import { REPO_ROLES } from './helpers.mjs';
+
+const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), '../../..');
+const seam = repoRemoteTestSeam;
+const gitEnv = { PATH: process.env.PATH, HOME: '/nonexistent', GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null', LC_ALL: 'C' };
+const git = (cwd, ...args) => execFileSync('git', ['-C', cwd, ...args], { env: gitEnv, encoding: 'utf8' }).trim();
+function bare() { const dir = mkdtempSync(join(tmpdir(), 'bare-')); git(dir, 'init', '--quiet', '--bare', '--template='); return dir; }
+function context() { const root = mkdtempSync(join(tmpdir(), 'repo-remote-')); const configDir = join(root, 'config'), dataRoot = join(root, 'data'); mkdirSync(configDir, { mode: 0o700 }); mkdirSync(dataRoot, { mode: 0o700 }); return { configDir, dataRoot, instance: 'test', principal: { provider: 'local-dev', iss: 'local-dev', sub: 'local-dev-owner' } }; }
+const listen = (server) => new Promise((r) => server.listen(0, '127.0.0.1', () => r(server.address().port)));
+
+test('remote URL rules: https and ssh only, nothing git could read as an option, helper, path or credential', () => {
+  for (const ok of ['https://git.example.com/owner/repo', 'https://git.example.com/owner/repo.git', 'https://git.example.com:8443/o/r',
+    'ssh://[email protected]/owner/repo.git', 'ssh://git.example.com:2222/srv/git/repo.git', '[email protected]:owner/repo.git', '[email protected]:/srv/repo']) {
+    assert.equal(parseRepoRemote(ok).ok, true, ok);
+  }
+  const refused = {
+    'ext::sh -c touch% /tmp/pwned': 'transport', 'fd::17': 'transport', 'file:///srv/repo.git': 'local', 'FILE:///srv/r': 'local',
+    '/srv/repo.git': 'local', './repo': 'local', '../repo': 'local', '~/repo': 'local', 'repo/sub:x': 'local', 'plainword': 'local',
+    '--upload-pack=touch /tmp/x': 'option', '-oProxyCommand=x': 'option',
+    'https://user:[email protected]/o/r': 'credentials', 'https://[email protected]/o/r': 'credentials',
+    'ssh://git:[email protected]/o/r': 'credentials', 'git:[email protected]:o/r': 'credentials',
+    'http://git.example.com/o/r': 'scheme', 'git://git.example.com/o/r': 'scheme', 'ftp://x/o/r': 'scheme', 'ssh+git://x/o/r': 'scheme',
+    'https://git.example.com/o/r?x=1': 'https', 'https://git.example.com/o/../r': 'https', 'https://git.example.com/o': 'https', 'HTTPS://git.example.com/o/r': 'https',
+    'ssh://-oProxyCommand=x/o/r': 'ssh', 'ssh://git@-host/o/r': 'ssh', 'ssh://-user@host/o/r': 'ssh', 'ssh://host/../etc': 'ssh',
+    'ssh://host:0/r': 'ssh', 'ssh://host:65536/r': 'ssh', 'ssh://host/-r': 'ssh', 'git@host:-r': 'ssh', 'git@host:a/../b': 'ssh', 'host:repo': 'ssh',
+    'ssh://host/a b': 'form', 'https://x/o/r\n': 'form', '': 'form',
+  };
+  for (const [value, problem] of Object.entries(refused)) {
+    const result = parseRepoRemote(value);
+    assert.equal(result.ok, false, value); assert.equal(result.problem, problem, value); assert.ok(result.message.length > 0);
+  }
+  assert.equal(parseRepoRemote(42).ok, false); assert.equal(parseRepoRemote('x'.repeat(600)).ok, false);
+});
+
+test('check outcomes are classified from git\'s own messages', () => {
+  assert.equal(classifyCheck({ code: 0, stderr: '' }).result, 'reachable');
+  assert.equal(classifyCheck({ code: 128, stderr: "fatal: could not read Username for 'https://git.example.com': terminal prompts disabled\n" }).result, 'needs-credential');
+  // An ssh remote that wants a key: the line says the check sent none and promises no binding,
+  // because copy credential bindings cover https Gitea remotes only (#1873 review F1).
+  assert.deepEqual(classifyCheck({ code: 128, stderr: '[email protected]: Permission denied (publickey,password).\nfatal: Could not read from remote repository.\n' }),
+    { result: 'needs-credential', message: 'the repository needs a credential; this check uses none' });
+  assert.equal(classifyCheck({ code: 128, stderr: "fatal: unable to access 'https://h/o/r/': The requested URL returned error: 403\n" }).result, 'needs-credential');
+  const dns = classifyCheck({ code: 128, stderr: "fatal: unable to access 'https://git.example.invalid/o/r.git/': Could not resolve host: git.example.invalid\n" });
+  assert.deepEqual(dns, { result: 'unreachable', message: "unable to access 'https://git.example.invalid/o/r.git/': Could not resolve host: git.example.invalid" });
+  const ssh = classifyCheck({ code: 128, stderr: 'ssh: Could not resolve hostname git.example.invalid: Name or service not known\r\nfatal: Could not read from remote repository.\n\nPlease make sure you have the correct access rights\n' });
+  assert.equal(ssh.message, 'ssh: Could not resolve hostname git.example.invalid: Name or service not known');
+  assert.equal(classifyCheck({ timedOut: true, stderr: '' }).message, 'no answer before the check timed out');
+  assert.equal(classifyCheck({ spawnError: true }).result, 'unreachable');
+  assert.equal(summarizeGitError(`fatal: ${'x'.repeat(400)}\u001b[31m`).length, 200);
+  assert.equal(summarizeGitError(''), 'git gave no reason');
+});
+
+test('the ssh client for the check reads no config, key, agent or proxy', () => {
+  for (const option of ['-F /dev/null', 'BatchMode=yes', 'IdentityFile=none', 'IdentitiesOnly=yes', 'IdentityAgent=none', 'PasswordAuthentication=no',
+    'KbdInteractiveAuthentication=no', 'ProxyCommand=none', 'ProxyJump=none', 'ControlPath=none', 'PermitLocalCommand=no', 'ForwardAgent=no', 'UserKnownHostsFile=/dev/null']) {
+    assert.ok(CHECK_SSH_COMMAND.includes(option), option);
+  }
+});
+
+test('production check refuses local and helper URLs without running git, and file is not an allowed transport', async () => {
+  const repo = bare();
+  for (const url of [`file://${repo}`, repo, 'ext::sh -c id', '--upload-pack=id']) assert.equal((await checkRemote(url)).result, 'unreachable', url);
+  // The production protocol list, through the seam: git itself refuses the file transport.
+  const refused = await seam.lsRemote(`file://${repo}`, { protocols: 'https:ssh' });
+  assert.equal(refused.result, 'unreachable'); assert.match(refused.message, /transport 'file' not allowed/);
+  assert.equal((await seam.lsRemote(`file://${repo}`, { protocols: 'file' })).result, 'reachable');
+});
+
+test('the check ignores the caller\'s git config and environment', async () => {
+  const repo = bare(); const home = mkdtempSync(join(tmpdir(), 'home-'));
+  // A user config that would rewrite the URL to the local repository, and a credential helper.
+  writeFileSync(join(home, '.gitconfig'), `[url "file://${repo}"]\n\tinsteadOf = https://git.example.invalid/o/r\n[credential]\n\thelper = !echo username=x; echo password=y\n`);
+  const saved = { HOME: process.env.HOME, GIT_CONFIG_PARAMETERS: process.env.GIT_CONFIG_PARAMETERS, GIT_CONFIG_GLOBAL: process.env.GIT_CONFIG_GLOBAL };
+  process.env.HOME = home; process.env.GIT_CONFIG_GLOBAL = join(home, '.gitconfig'); process.env.GIT_CONFIG_PARAMETERS = `'url.file://${repo}.insteadof'='https://git.example.invalid/o/r'`;
+  try {
+    const result = await seam.lsRemote('https://git.example.invalid/o/r', { protocols: 'https:ssh:file', timeoutMs: 10000 });
+    assert.equal(result.result, 'unreachable'); assert.match(result.message, /git\.example\.invalid/);
+  } finally { for (const [k, v] of Object.entries(saved)) if (v === undefined) delete process.env[k]; else process.env[k] = v; }
+});
+
+test('a 401 is needs-credential and no credential is sent', async () => {
+  const seen = [];
+  const server = createServer((req, res) => { seen.push(req.headers.authorization ?? null); res.writeHead(401, { 'WWW-Authenticate': 'Basic realm="git"' }); res.end(); });
+  const port = await listen(server);
+  try {
+    const result = await seam.lsRemote(`http://127.0.0.1:${port}/o/r.git`, { protocols: 'http' });
+    assert.equal(result.result, 'needs-credential'); assert.equal(result.message, NEEDS_CREDENTIAL_MESSAGE); assert.doesNotMatch(result.message, /binding/);
+    assert.ok(seen.length >= 1); assert.deepEqual(seen.filter(Boolean), []);
+  } finally { server.close(); }
+});
+
+test('a redirect is not followed, so the check reaches only the named URL', async () => {
+  let elsewhere = 0;
+  const other = createServer((req, res) => { elsewhere++; res.writeHead(404); res.end(); });
+  const otherPort = await listen(other);
+  const server = createServer((req, res) => { res.writeHead(302, { Location: `http://127.0.0.1:${otherPort}${req.url}` }); res.end(); });
+  const port = await listen(server);
+  try {
+    const result = await seam.lsRemote(`http://127.0.0.1:${port}/o/r.git`, { protocols: 'http' });
+    assert.equal(result.result, 'unreachable'); assert.match(result.message, /302/); assert.equal(elsewhere, 0);
+  } finally { server.close(); other.close(); }
+});
+
+test('a silent server times out and the check reports it', async () => {
+  const sockets = []; const server = createTcpServer((s) => sockets.push(s)); const port = await listen(server);
+  try {
+    const started = Date.now();
+    const result = await seam.lsRemote(`http://127.0.0.1:${port}/o/r.git`, { protocols: 'http', timeoutMs: 600 });
+    assert.deepEqual(result, { result: 'unreachable', message: 'no answer before the check timed out' }); assert.ok(Date.now() - started < 5000);
+  } finally { for (const s of sockets) s.destroy(); server.close(); }
+});
+
+test('no production source reaches the test seam', () => {
+  const offenders = [];
+  for (const pkg of readdirSync(join(repoRoot, 'packages'))) {
+    const walk = (dir) => { let entries; try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return; } for (const e of entries) { const p = join(dir, e.name); if (e.isDirectory()) { if (e.name !== 'node_modules') walk(p); } else if (/\.(m?js|cjs)$/.test(e.name) && readFileSync(p, 'utf8').includes('repoRemoteTestSeam') && !p.endsWith(join('organization', 'src', 'repo-remote.mjs'))) offenders.push(p); } };
+    walk(join(repoRoot, 'packages', pkg, 'src'));
+  }
+  assert.deepEqual(offenders, []);
+});
+
+// #1873 security review P2: the ssh check accepts any host key, so an ssh answer cannot say the
+// named host answered. Every ssh outcome that came from an answer says the key was not verified;
+// https and an unreachable ssh host do not carry the note.
+test('an ssh answer says the host key was not verified; https does not', async () => {
+  const answer = { reachable: { result: 'reachable', message: 'the repository answered' }, needs: { result: 'needs-credential', message: NEEDS_CREDENTIAL_MESSAGE }, down: { result: 'unreachable', message: 'ssh: Could not resolve hostname h.invalid' } };
+  try {
+    for (const url of ['[email protected]:team/work.git', 'ssh://[email protected]:2222/team/work.git']) {
+      seam.useCheck(async () => answer.reachable);
+      assert.deepEqual(await checkRemote(url), { result: 'reachable', message: `the repository answered; ${SSH_HOST_UNVERIFIED}`, url });
+      seam.useCheck(async () => answer.needs);
+      assert.equal((await checkRemote(url)).message, `${NEEDS_CREDENTIAL_MESSAGE}; ${SSH_HOST_UNVERIFIED}`);
+      seam.useCheck(async () => answer.down);
+      assert.equal((await checkRemote(url)).message, answer.down.message);
+    }
+    seam.useCheck(async () => answer.reachable);
+    assert.equal((await checkRemote('https://git.example.com/team/work.git')).message, 'the repository answered');
+  } finally { seam.useCheck(null); }
+});
+
+async function orgWithRepo(c, opts = { mode: 'local-only', acceptLocalLossRisk: true }) {
+  await createOrg(c, 'alpha', await templateRender('alpha')); return projectRepoInit(c, 'alpha', 'work', opts);
+}
+
+test('remote init sets origin and records the check; nothing is pushed', async () => {
+  const c = context(); const repo = bare(); const url = 'https://git.example.com/team/work.git';
+  seam.useCheck((u) => { assert.equal(u, url); return seam.lsRemote(`file://${repo}`, { protocols: 'file' }); });
+  try {
+    const r = await orgWithRepo(c, { mode: 'remote', remote: url });
+    assert.equal(r.origin, url); assert.deepEqual(r.check, { result: 'reachable', message: 'the repository answered', url });
+    assert.equal(git(r.root, 'remote', '-v'), `origin\t${url} (fetch)\norigin\t${url} (push)`);
+    assert.equal(git(repo, 'for-each-ref').length, 0, 'nothing pushed');
+    const shown = await projectRepoShow(c, 'alpha', 'work');
+    assert.deepEqual(shown.current, { mode: 'remote', remote: url, origin: url, revision: shown.current.revision, check: r.check });
+  } finally { seam.useCheck(null); }
+});
+
+test('repo set switches remote to local-only and back, with receipts and the revision fence', async () => {
+  const c = context(); const r = await orgWithRepo(c);
+  assert.equal(git(r.root, 'remote', '-v'), '');
+  let rev = (await showOrg(c, 'alpha')).revision;
+  seam.useCheck(async () => ({ result: 'needs-credential', message: NEEDS_CREDENTIAL_MESSAGE }));
+  try {
+    const ssh = '[email protected]:team/work.git';
+    await assert.rejects(projectRepoSet(c, 'alpha', 'work', { mode: 'remote', remote: ssh, ifRevision: rev + 1 }), { code: 'revision-conflict' });
+    await assert.rejects(projectRepoSet(c, 'alpha', 'work', { mode: 'remote', remote: ssh }), { code: 'org-invalid' });
+    const set = await projectRepoSet(c, 'alpha', 'work', { mode: 'remote', remote: ssh, ifRevision: rev });
+    assert.equal(set.op, 'org.project.repo.set'); assert.equal(set.revision, rev + 1); assert.deepEqual(set.previous, { mode: 'local-only' });
+    assert.equal(set.check.result, 'needs-credential'); assert.equal(set.check.url, ssh); assert.equal(git(r.root, 'remote', 'get-url', 'origin'), ssh);
+    assert.deepEqual(loadBusiness('alpha', { dir: c.configDir, rolesDir: REPO_ROLES }).projects.work.git, { mode: 'remote', remote: ssh });
+    rev = set.revision;
+    const https = 'https://git.example.com/team/work';
+    const moved = await projectRepoSet(c, 'alpha', 'work', { mode: 'remote', remote: https, ifRevision: rev });
+    assert.equal(git(r.root, 'remote', 'get-url', 'origin'), https); assert.equal(moved.revision, rev + 1); rev = moved.revision;
+    // The same URL again re-checks and repairs origin without a new revision.
+    git(r.root, 'remote', 'set-url', 'origin', 'https://elsewhere.example/x/y');
+    const again = await projectRepoSet(c, 'alpha', 'work', { mode: 'remote', remote: https, ifRevision: rev });
+    assert.equal(again.revision, rev); assert.equal(git(r.root, 'remote', 'get-url', 'origin'), https);
+    await assert.rejects(projectRepoSet(c, 'alpha', 'work', { mode: 'local-only', ifRevision: rev }), { code: 'org-risk' });
+    const local = await projectRepoSet(c, 'alpha', 'work', { mode: 'local-only', acceptLocalLossRisk: true, ifRevision: rev });
+    assert.equal(local.revision, rev + 1); assert.equal(local.check, undefined); assert.equal(git(r.root, 'remote', '-v'), '');
+    const shown = await projectRepoShow(c, 'alpha', 'work');
+    assert.deepEqual(shown.current, { mode: 'local-only', origin: null, revision: local.revision, changedAt: local.at });
+    const ops = readFileSync(join(r.root, '../../receipts.jsonl'), 'utf8').trim().split('\n').map((l) => JSON.parse(l).op);
+    assert.deepEqual(ops.filter((o) => o.startsWith('org.project.repo')), ['org.project.repo.init', 'org.project.repo.set', 'org.project.repo.set', 'org.project.repo.set', 'org.project.repo.set']);
+    // A whole-document update still can't change the binding.
+    const current = await showOrg(c, 'alpha'); const doc = structuredClone(current.doc); doc.projects.work.git = { mode: 'remote', remote: https };
+    await assert.rejects(updateOrg(c, 'alpha', doc, { ifRevision: current.revision }), { code: 'org-invalid' });
+  } finally { seam.useCheck(null); }
+});
+
+// #1873 review F2: origin is set before the document is written. When that write fails, the
+// checkout's origin and the recorded binding differ; show reports both as they are, keeps the
+// last check only for the URL it ran against, and the same set again repairs it.
+test('a set whose document write fails leaves origin ahead of the record, and show says so', async () => {
+  const c = context(); const r = await orgWithRepo(c);
+  seam.useCheck(async () => ({ result: 'reachable', message: 'the repository answered' }));
+  const businesses = join(c.configDir, 'businesses');
+  try {
+    let rev = (await showOrg(c, 'alpha')).revision;
+    const a = 'https://git.example.com/team/a', b = 'https://git.example.com/team/b';
+    rev = (await projectRepoSet(c, 'alpha', 'work', { mode: 'remote', remote: a, ifRevision: rev })).revision;
+    chmodSync(businesses, 0o500);
+    try { await assert.rejects(projectRepoSet(c, 'alpha', 'work', { mode: 'remote', remote: b, ifRevision: rev })); }
+    finally { chmodSync(businesses, 0o700); }
+    assert.equal(git(r.root, 'remote', 'get-url', 'origin'), b);
+    let shown = (await projectRepoShow(c, 'alpha', 'work')).current;
+    assert.deepEqual(shown, { mode: 'remote', remote: a, origin: b, revision: rev, check: { result: 'reachable', message: 'the repository answered', url: a }, changedAt: shown.changedAt });
+    // Repeating the recorded URL repairs origin.
+    await projectRepoSet(c, 'alpha', 'work', { mode: 'remote', remote: a, ifRevision: rev });
+    shown = (await projectRepoShow(c, 'alpha', 'work')).current;
+    assert.equal(shown.origin, a); assert.equal(shown.check.url, a);
+    // A recorded check for another URL is not lent to the current one.
+    const receipts = join(r.root, '../../receipts.jsonl');
+    const lines = readFileSync(receipts, 'utf8').trim().split('\n').map((l) => JSON.parse(l));
+    lines.at(-1).check.url = b; writeFileSync(receipts, lines.map((l) => JSON.stringify(l)).join('\n') + '\n');
+    shown = (await projectRepoShow(c, 'alpha', 'work')).current;
+    assert.equal(shown.check, undefined); assert.equal(shown.remote, a);
+  } finally { seam.useCheck(null); chmodSync(businesses, 0o700); }
+});
+
+// #1873 F7: a copy binding grants the repositories its projects' remotes name when a credential is
+// issued, and its decision records only project names. While a binding that names the project is
+// approved (pending) or active (bound), repo set refuses before any check or origin change, and
+// names the next step. An unbound (revoked) binding, or none, leaves repo set as it was.
+// Bindings are seeded into the document directly, as the CB1 writer would leave them; the registry
+// digest is updated so the read fences accept the document.
+function seedBindings(c, bindings) {
+  const file = join(c.configDir, 'businesses', 'alpha.json');
+  const doc = JSON.parse(readFileSync(file, 'utf8')); doc.copyBindings = bindings;
+  const raw = JSON.stringify(doc, null, 2) + '\n'; writeFileSync(file, raw, { mode: 0o600 });
+  const registryFile = join(c.configDir, 'org-runtime.json'); const registry = JSON.parse(readFileSync(registryFile, 'utf8'));
+  registry.orgs.alpha.digest = createHash('sha256').update(raw).digest('hex'); writeFileSync(registryFile, JSON.stringify(registry, null, 2) + '\n', { mode: 0o600 });
+}
+function binding(instance, state, { project = null, projects = ['work'], n = 1 } = {}) {
+  const name = project ? instance.slice(0, -(project.length + 1)) : instance;
+  const gitea = { slot: 'self', scopes: ['read:repository'], resources: { projects } };
+  if (state === 'bound') Object.assign(gitea, { rotateBy: '2099-01-01', grantId: `gitea:5:${n}`, grantGeneration: 1 });
+  return { copyId: String(n).repeat(32), orgIncarnation: 'a'.repeat(32),
+    source: { level: project ? 'project' : 'root', name, project }, definition: { ref: 'reviewer', rev: null, sha256: 'b'.repeat(64) },
+    generation: 1, state, services: state === 'unbound' ? {} : { gitea }, decision: `1111111${n}-1111-4111-8111-111111111111` };
+}
+async function refusedUnderBinding(bindings, expect) {
+  const c = context(); const r = await orgWithRepo(c);
+  const before = readFileSync(join(r.root, '../../receipts.jsonl'), 'utf8');
+  seedBindings(c, bindings);
+  let checks = 0; seam.useCheck(async () => { checks++; return { result: 'reachable', message: 'the repository answered' }; });
+  try {
+    const rev = (await showOrg(c, 'alpha')).revision;
+    for (const selection of [{ mode: 'remote', remote: 'https://git.example.com/team/other' }, { mode: 'local-only', acceptLocalLossRisk: true }]) {
+      await assert.rejects(projectRepoSet(c, 'alpha', 'work', { ...selection, ifRevision: rev }), (e) => {
+        assert.equal(e.code, 'project-repo-bound');
+        for (const text of expect) assert.ok(e.message.includes(text), `${text} in ${e.message}`);
+        assert.match(e.message, /Revoke that copy binding first .*then set the repository, then ask the chief to raise a new binding decision/);
+        return true;
+      });
+    }
+    assert.equal(checks, 0, 'no check ran'); assert.equal(git(r.root, 'remote', '-v'), '', 'origin unchanged');
+    assert.equal((await showOrg(c, 'alpha')).revision, rev); assert.equal(readFileSync(join(r.root, '../../receipts.jsonl'), 'utf8'), before, 'no receipt');
+    assert.deepEqual(loadBusiness('alpha', { dir: c.configDir, rolesDir: REPO_ROLES }).projects.work.git, { mode: 'local-only' });
+  } finally { seam.useCheck(null); }
+}
+
+test('repo set is refused while an approved (pending) copy binding names the project', async () => {
+  await refusedUnderBinding({ 'rev.work': binding('rev.work', 'pending', { project: 'work' }) }, ['rev.work (approved, not yet verified)']);
+});
+
+test('repo set is refused while an active (bound) copy binding names the project', async () => {
+  // A root copy whose gitea resources name the project, beside a binding for another project that does not count.
+  await refusedUnderBinding({ rev: binding('rev', 'bound', { projects: ['other', 'work'] }), dev: binding('dev', 'bound', { projects: ['other'], n: 2 }) },
+    ['rev (active)']);
+  await refusedUnderBinding({ rev: binding('rev', 'bound', { projects: ['work'] }), 'qa.work': binding('qa.work', 'pending', { project: 'work', n: 2 }) },
+    ['qa.work (approved, not yet verified), rev (active)']);
+});
+
+test('repo set is allowed after the binding is revoked (unbound)', async () => {
+  const c = context(); const r = await orgWithRepo(c);
+  seam.useCheck(async () => ({ result: 'reachable', message: 'the repository answered' }));
+  try {
+    const url = 'https://git.example.com/team/other';
+    seedBindings(c, { 'rev.work': binding('rev.work', 'bound', { project: 'work' }) });
+    const rev = (await showOrg(c, 'alpha')).revision;
+    await assert.rejects(projectRepoSet(c, 'alpha', 'work', { mode: 'remote', remote: url, ifRevision: rev }), { code: 'project-repo-bound' });
+    // The unbind leaves the tombstone; a binding for another project does not count.
+    const revoked = { 'rev.work': binding('rev.work', 'unbound', { project: 'work' }), dev: binding('dev', 'bound', { projects: ['other'], n: 2 }) };
+    seedBindings(c, revoked);
+    const set = await projectRepoSet(c, 'alpha', 'work', { mode: 'remote', remote: url, ifRevision: rev });
+    assert.equal(set.op, 'org.project.repo.set'); assert.equal(set.revision, rev + 1); assert.equal(git(r.root, 'remote', 'get-url', 'origin'), url);
+    assert.deepEqual(loadBusiness('alpha', { dir: c.configDir, rolesDir: REPO_ROLES }).copyBindings, revoked, 'bindings untouched');
+  } finally { seam.useCheck(null); }
+});
+
+// Unchanged behaviour: it passes on a source that never refuses, and guards against refusing too much.
+test('repo set is allowed with no copy binding', async () => {
+  const c = context(); const r = await orgWithRepo(c);
+  seam.useCheck(async () => ({ result: 'reachable', message: 'the repository answered' }));
+  try {
+    const rev = (await showOrg(c, 'alpha')).revision; const url = 'https://git.example.com/team/other';
+    const set = await projectRepoSet(c, 'alpha', 'work', { mode: 'remote', remote: url, ifRevision: rev });
+    assert.equal(set.revision, rev + 1); assert.equal(git(r.root, 'remote', 'get-url', 'origin'), url);
+  } finally { seam.useCheck(null); }
+});
+
+test('repo set refuses bad URLs before any check, and needs an initialized repository', async () => {
+  const c = context(); await createOrg(c, 'alpha', await templateRender('alpha'));
+  let checks = 0; seam.useCheck(async () => { checks++; return { result: 'reachable', message: 'x' }; });
+  try {
+    const rev = (await showOrg(c, 'alpha')).revision;
+    await assert.rejects(projectRepoSet(c, 'alpha', 'work', { mode: 'remote', remote: 'https://git.example.com/o/r', ifRevision: rev }), { code: 'org-unavailable' });
+    await projectRepoInit(c, 'alpha', 'work', { mode: 'local-only', acceptLocalLossRisk: true });
+    const rev2 = (await showOrg(c, 'alpha')).revision;
+    for (const remote of ['ext::sh -c id', `file://${bare()}`, '/srv/x', '--upload-pack=id', 'https://u:[email protected]/o/r', 'http://git.example.com/o/r']) {
+      await assert.rejects(projectRepoSet(c, 'alpha', 'work', { mode: 'remote', remote, ifRevision: rev2 }), { code: 'org-invalid' }, remote);
+      await assert.rejects(projectRepoInit(c, 'alpha', 'other', { mode: 'remote', remote }), { code: 'org-invalid' }, remote);
+    }
+    assert.equal(checks, 0);
+  } finally { seam.useCheck(null); }
+});
+
+test('queue init with a remote also sets origin', async () => {
+  const c = context(); await createOrg(c, 'alpha', await templateRender('alpha'));
+  seam.useCheck(async () => ({ result: 'unreachable', message: 'Could not resolve host: git.example.invalid' }));
+  try {
+    const q = await queueInit(c, 'alpha', { mode: 'remote', remote: 'ssh://[email protected]/team/queue.git' });
+    assert.equal(git(q.root, 'remote', 'get-url', 'origin'), 'ssh://[email protected]/team/queue.git'); assert.equal(q.check.result, 'unreachable');
+  } finally { seam.useCheck(null); }
+});
+
+test('the loader accepts an ssh git remote and refuses a helper URL', async () => {
+  const c = context(); await createOrg(c, 'alpha', await templateRender('alpha'));
+  const file = join(c.configDir, 'businesses', 'alpha.json');
+  const doc = JSON.parse(readFileSync(file, 'utf8'));
+  const { validateOrg } = await import('../src/org-service.mjs');
+  doc.projects.work.git = { mode: 'remote', remote: '[email protected]:team/work.git' };
+  assert.deepEqual(await validateOrg(doc), { ok: true, errors: [] });
+  doc.projects.work.git = { mode: 'remote', remote: 'ext::sh -c id' };
+  assert.equal((await validateOrg(doc)).ok, false);
+});

packages/organization/tests/starter-pack-keys.test.mjs

@@ -0,0 +1,425 @@
+// Starter packs SP3 (design dd878cefc sections 3 and 8, fix round 3 c0a60ed3a): the organization file's packs, board and
+// workflows keys, each project's board and workflows, and the writer's applyPack operation.
+// Fixtures live in a temp directory; nothing reads the real config.
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { organizationWriter } from "../src/organization.mjs";
+import { validateBusinessDocument } from "../src/organization-config.mjs";
+import { businessDoc, rolesCopy, tmp, writeJson } from "./helpers.mjs";
+import { canonicalJson, sha256 } from "../src/util.mjs";
+
+const SECRET = "sk-test-NOT-A-SECRET-1234";
+const assertClean = (value) => { if (String(value).includes(SECRET)) throw new Error("credential-leak"); };
+const HASH = "a".repeat(64);
+const PLAIN = { role: { tools: ["read"], network: "none", authority: { withinRole: [], crossRole: [] }, credentials: [] }, instructions: "Read and report.\n" };
+// An inline proposal: a pack definition the apply did not write, kept whole beside its pin.
+const WRITER = { ...PLAIN, instructions: "Write the docs.\n" };
+const WRITER_HASH = sha256(canonicalJson(WRITER));
+const BOARD = {
+  columns: [
+    { state: "todo", label: "Backlog" }, { state: "in-progress", label: "Building" },
+    { state: "in-review", label: "Review" }, { state: "blocked", label: "Blocked" }, { state: "done", label: "Merged" },
+  ],
+  layout: "kanban",
+};
+const LIST_BOARD = { ...structuredClone(BOARD), layout: "list" };
+const WORKFLOWS = {
+  change: {
+    title: "Change", description: "One change from task to merge.",
+    steps: [
+      { title: "Write the task", state: "todo", roles: ["pm"] },
+      { title: "Implement", state: "in-progress", roles: ["coder"] },
+      { title: "Approve the merge", state: "done", roles: ["human"] },
+    ],
+  },
+};
+const PACK = {
+  id: "coding", version: "1.0.0", sha256: HASH, origin: "shipped", scope: "org", project: null,
+  at: "2026-11-12T20:00:00.000Z", by: "jason", added: ["definitions.scout", "board", "workflows.change"],
+  proposedHires: [
+    { name: "coder-1", reason: "writes the code", pin: { template: "coder", sha256: HASH } },
+    { name: "scout-1", pin: { definition: "scout", rev: 1 } },
+    { name: "writer-1", pin: { inline: "writer", sha256: WRITER_HASH }, entry: WRITER },
+  ],
+};
+
+function fixture(t, edit = (doc) => doc, barrier) {
+  const root = tmp();
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const dir = join(root, "config");
+  const rolesDir = rolesCopy(root);
+  const document = edit(businessDoc(root));
+  const file = writeJson(join(dir, "businesses/acme.json"), document);
+  return { root, dir, file, rolesDir, document, writer: organizationWriter({ dir, rolesDir, barrier }) };
+}
+const rev = (f) => f.writer.read("acme").revision;
+const doc = (f) => JSON.parse(readFileSync(f.file, "utf8"));
+const bytes = (f) => readFileSync(f.file, "utf8");
+const load = (f, document) => validateBusinessDocument(document, f.file, { rolesDir: f.rolesDir });
+const without = (object, ...keys) => Object.fromEntries(Object.entries(object).filter(([k]) => !keys.includes(k)));
+// An undefined value in `extra` drops that key from the plan.
+const packPlan = (extra = {}) => Object.fromEntries(Object.entries({
+  definitions: { scout: PLAIN }, board: BOARD, workflows: WORKFLOWS,
+  packs: without({ ...PACK, proposedHires: PACK.proposedHires.slice(0, 2) }, "at", "by", "added"), ...extra,
+}).filter(([, value]) => value !== undefined));
+
+test("SP3 red before: a file with a board key loads, and the loaded organization keeps it", (t) => {
+  const f = fixture(t);
+  const loaded = load(f, { ...f.document, board: BOARD });
+  assert.deepEqual(loaded.board, BOARD);
+});
+
+test("SP3 valid packs, board and workflows load, and the organization and each project keep them", (t) => {
+  const f = fixture(t);
+  const document = {
+    ...f.document, board: BOARD, workflows: WORKFLOWS, packs: [PACK, { ...PACK, origin: "saved", scope: "project", project: "stack", added: ["projects.stack.board", "projects.stack.workflows.change"], proposedHires: [] }],
+    projects: { stack: { ...f.document.projects.stack, board: LIST_BOARD, workflows: WORKFLOWS } },
+  };
+  const loaded = load(f, document);
+  assert.deepEqual(loaded.board, BOARD);
+  assert.deepEqual(loaded.workflows, WORKFLOWS);
+  assert.deepEqual(loaded.packs, document.packs);
+  assert.deepEqual(loaded.projects.stack.board, LIST_BOARD);
+  assert.deepEqual(loaded.projects.stack.workflows, WORKFLOWS);
+  assert.ok(Object.isFrozen(loaded.projects.stack.board));
+  // Title and description are optional; the absent keys stay absent.
+  const bare = load(f, { ...f.document, workflows: { quick: { steps: [{ title: "Do it", state: "done", roles: ["human"] }] } } });
+  assert.deepEqual(bare.workflows, { quick: { steps: [{ title: "Do it", state: "done", roles: ["human"] }] } });
+  // A file without the keys loads as it did, with none of them on the loaded object.
+  const plain = load(f, f.document);
+  for (const key of ["board", "workflows", "packs"]) assert.ok(!Object.hasOwn(plain, key), key);
+  assert.ok(!Object.hasOwn(plain.projects.stack, "board"));
+});
+
+test("SP3 a workflow naming a role that does not exist still loads (the load checks shape only)", (t) => {
+  const f = fixture(t);
+  const ghost = { change: { steps: [{ title: "Haunt", state: "todo", roles: ["ghost-role", "no-such-template"] }] } };
+  assert.deepEqual(load(f, { ...f.document, workflows: ghost }).workflows, ghost);
+  assert.deepEqual(load(f, { ...f.document, projects: { stack: { ...f.document.projects.stack, workflows: ghost } } }).projects.stack.workflows, ghost);
+});
+
+test("SP3 a definition a workflow names can still be removed, and the file then still loads", (t) => {
+  // Design c0a60ed3a SP3 acceptance: "an org file whose step names a definition removed since loads,
+  // and removing that definition succeeds".
+  const f = fixture(t);
+  const scouting = { scouting: { steps: [{ title: "Scout", state: "todo", roles: ["scout", "human"] }] } };
+  const packs = { ...packPlan().packs, proposedHires: [] };
+  f.writer.applyPack("acme", { definitions: { scout: PLAIN }, workflows: scouting, packs }, { revision: rev(f), actor: "jason", assertClean });
+  f.writer.applyPack("acme", { "projects.stack.workflows": scouting }, { revision: rev(f), actor: "jason", assertClean });
+  assert.deepEqual(doc(f).definitions.scout, { ...PLAIN, rev: 1 });
+  f.writer.setDefinition("acme", "scout", () => null, { revision: rev(f), actor: "jason", assertClean });
+  const after = doc(f);
+  assert.equal(after.definitions?.scout, undefined);
+  assert.deepEqual(after.workflows, scouting);
+  assert.deepEqual(after.projects.stack.workflows, scouting);
+  const loaded = load(f, after);
+  assert.deepEqual(loaded.workflows, scouting);
+  assert.deepEqual(loaded.projects.stack.workflows, scouting);
+  // The writer reads it back too; only a new write of that workflow resolves its roles again.
+  assert.equal(f.writer.read("acme").revision, rev(f));
+  assert.throws(() => f.writer.applyPack("acme", { workflows: { again: scouting.scouting } }, { revision: rev(f), actor: "jason", assertClean }), { code: "invalid-request" });
+});
+
+test("SP3 each invalid shape refuses", (t) => {
+  const f = fixture(t);
+  const col = (i, patch) => ({ ...BOARD, columns: BOARD.columns.map((c, j) => (j === i ? { ...c, ...patch } : c)) });
+  const step = (patch) => ({ change: { ...WORKFLOWS.change, steps: [{ ...WORKFLOWS.change.steps[0], ...patch }] } });
+  const pack = (patch) => [{ ...PACK, ...patch }];
+  const steps = (n) => Array.from({ length: n }, () => ({ title: "Step", state: "todo", roles: ["human"] }));
+  const cases = {
+    "board not an object": { board: [] },
+    "board unknown key": { board: { ...BOARD, colour: "red" } },
+    "board missing layout": { board: without(BOARD, "layout") },
+    "board four columns": { board: { ...BOARD, columns: BOARD.columns.slice(0, 4) } },
+    "board six columns": { board: { ...BOARD, columns: [...BOARD.columns, BOARD.columns[0]] } },
+    "board duplicate state": { board: col(1, { state: "todo" }) },
+    "board unknown state": { board: col(0, { state: "backlog" }) },
+    "board column unknown key": { board: col(0, { colour: "red" }) },
+    "board label empty": { board: col(0, { label: "" }) },
+    "board label 33 characters": { board: col(0, { label: "x".repeat(33) }) },
+    "board layout grid": { board: { ...BOARD, layout: "grid" } },
+    "workflows not an object": { workflows: [] },
+    "workflow name not NAME": { workflows: { Change_1: WORKFLOWS.change } },
+    "workflow unknown key": { workflows: { change: { ...WORKFLOWS.change, owner: "pm" } } },
+    "workflow no steps": { workflows: { change: { ...WORKFLOWS.change, steps: [] } } },
+    "workflow 21 steps": { workflows: { change: { steps: steps(21) } } },
+    "workflow title 121 characters": { workflows: { change: { ...WORKFLOWS.change, title: "x".repeat(121) } } },
+    "workflow description 1001 characters": { workflows: { change: { ...WORKFLOWS.change, description: "x".repeat(1001) } } },
+    "step unknown key": { workflows: step({ id: "plan" }) },
+    "step missing roles": { workflows: { change: { steps: [{ title: "Step", state: "todo" }] } } },
+    "step title 121 characters": { workflows: step({ title: "x".repeat(121) }) },
+    "step unknown state": { workflows: step({ state: "doing" }) },
+    "step roles empty": { workflows: step({ roles: [] }) },
+    "step nine roles": { workflows: step({ roles: ["a", "b", "c", "d", "e", "f", "g", "h", "i"] }) },
+    "step role not NAME": { workflows: step({ roles: ["Coder_1"] }) },
+    "step duplicate role": { workflows: step({ roles: ["pm", "pm"] }) },
+    "packs not a list": { packs: {} },
+    "pack unknown key": { packs: pack({ hires: [] }) },
+    "pack missing key": { packs: [without(PACK, "sha256")] },
+    "pack origin unknown": { packs: pack({ origin: "borrowed" }) },
+    "pack scope root": { packs: pack({ scope: "root" }) },
+    "org pack with project": { packs: pack({ project: "stack" }) },
+    "project pack without project": { packs: pack({ scope: "project", project: null }) },
+    "pack id not NAME": { packs: pack({ id: "Coding" }) },
+    "pack version not semver": { packs: pack({ version: "v1" }) },
+    "pack sha256 not hex": { packs: pack({ sha256: "A".repeat(64) }) },
+    "pack at not a timestamp": { packs: pack({ at: "yesterday" }) },
+    "pack by not an id": { packs: pack({ by: "Not An Id" }) },
+    "pack added bad path": { packs: pack({ added: ["plugins.theme"] }) },
+    "pack nine proposed hires": { packs: pack({ proposedHires: Array.from({ length: 9 }, (_, i) => ({ name: `coder-${i}`, pin: { template: "coder", sha256: HASH } })) }) },
+    "proposed hire two pins": { packs: pack({ proposedHires: [{ name: "coder-1", pin: { template: "coder", sha256: HASH, inline: "writer" } }] }) },
+    "proposed hire no pin": { packs: pack({ proposedHires: [{ name: "coder-1" }] }) },
+    "proposed hire unknown key": { packs: pack({ proposedHires: [{ name: "coder-1", level: "org", pin: { template: "coder", sha256: HASH } }] }) },
+    "proposed hire duplicate name": { packs: pack({ proposedHires: [{ name: "c", pin: { template: "coder", sha256: HASH } }, { name: "c", pin: { template: "coder", sha256: HASH } }] }) },
+    "inline pin old hash-only shape": { packs: pack({ proposedHires: [{ name: "w", pin: { inline: HASH }, entry: WRITER }] }) },
+    "inline pin without entry": { packs: pack({ proposedHires: [{ name: "w", pin: { inline: "writer", sha256: WRITER_HASH } }] }) },
+    "inline pin name not an id": { packs: pack({ proposedHires: [{ name: "w", pin: { inline: "Writer One", sha256: WRITER_HASH }, entry: WRITER }] }) },
+    "inline pin sha256 not hex": { packs: pack({ proposedHires: [{ name: "w", pin: { inline: "writer", sha256: "x" }, entry: WRITER }] }) },
+    "template pin with entry": { packs: pack({ proposedHires: [{ name: "w", pin: { template: "coder", sha256: HASH }, entry: WRITER }] }) },
+    "inline entry not an object": { packs: pack({ proposedHires: [{ name: "w", pin: { inline: "writer", sha256: WRITER_HASH }, entry: "Write the docs." }] }) },
+    "inline entry unknown key": { packs: pack({ proposedHires: [{ name: "w", pin: { inline: "writer", sha256: WRITER_HASH }, entry: { ...WRITER, level: "org" } }] }) },
+    "inline entry unknown tool": { packs: pack({ proposedHires: [{ name: "w", pin: { inline: "writer", sha256: WRITER_HASH }, entry: { ...WRITER, role: { ...WRITER.role, tools: ["teleport"] } } }] }) },
+    "inline entry without role": { packs: pack({ proposedHires: [{ name: "w", pin: { inline: "writer", sha256: WRITER_HASH }, entry: without(WRITER, "role") }] }) },
+    "inline entry rev zero": { packs: pack({ proposedHires: [{ name: "w", pin: { inline: "writer", sha256: WRITER_HASH }, entry: { ...WRITER, rev: 0 } }] }) },
+    "proposed hire rev zero": { packs: pack({ proposedHires: [{ name: "c", pin: { definition: "scout", rev: 0 } }] }) },
+  };
+  for (const [name, patch] of Object.entries(cases)) {
+    assert.throws(() => load(f, { ...f.document, ...patch }), { name: "BusinessError" }, name);
+  }
+  // The project keys refuse the same shapes, and other project keys still refuse.
+  const project = (patch) => ({ ...f.document, projects: { stack: { ...f.document.projects.stack, ...patch } } });
+  for (const [name, patch] of Object.entries({
+    "project board layout": { board: { ...BOARD, layout: "grid" } },
+    "project workflow 0 steps": { workflows: { change: { steps: [] } } },
+    "project unknown key": { packs: [] },
+  })) assert.throws(() => load(f, project(patch)), { name: "BusinessError" }, name);
+});
+
+test("SP3 applyPack writes definitions, board, workflows and the packs entry in one commit", (t) => {
+  const f = fixture(t);
+  const before = doc(f);
+  const out = f.writer.applyPack("acme", packPlan(), { revision: rev(f), actor: "jason", assertClean });
+  assert.deepEqual(out.added, ["definitions.scout", "board", "workflows.change"]);
+  assert.equal(out.revision, rev(f));
+  const after = doc(f);
+  assert.deepEqual(after.definitions.scout, { ...PLAIN, rev: 1 });
+  assert.deepEqual(after.board, BOARD);
+  assert.deepEqual(after.workflows, WORKFLOWS);
+  assert.equal(after.packs.length, 1);
+  const entry = after.packs[0];
+  assert.deepEqual(without(entry, "at"), { ...without(PACK, "at"), by: "jason", added: out.added, proposedHires: PACK.proposedHires.slice(0, 2) });
+  assert.match(entry.at, /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/);
+  // Nothing else changed.
+  assert.deepEqual(without(after, "definitions", "board", "workflows", "packs"), without(before, "definitions", "board", "workflows", "packs"));
+  // One prepared and one committed receipt, and the receipt logs paths, not values.
+  const log = readFileSync(f.writer.logFile("acme"), "utf8").trim().split("\n").map((l) => JSON.parse(l));
+  assert.deepEqual(log.map((e) => e.state), ["prepared", "committed"]);
+  assert.ok(!JSON.stringify(log).includes("Backlog"));
+  // A second pack appends; the first entry stays.
+  const second = { packs: { ...packPlan().packs, id: "review", proposedHires: [] }, workflows: { review: WORKFLOWS.change } };
+  f.writer.applyPack("acme", second, { revision: rev(f), actor: "jason", assertClean });
+  assert.deepEqual(doc(f).packs.map((p) => p.id), ["coding", "review"]);
+  assert.deepEqual(doc(f).packs[0], entry);
+  assert.deepEqual(doc(f).packs[1].added, ["workflows.review"]);
+});
+
+test("SP3 applyPack writes everything or nothing", (t) => {
+  // A plan item after the definitions is bad: the valid definition is not written either.
+  const f = fixture(t);
+  const original = bytes(f);
+  const bad = packPlan({ workflows: { change: { steps: [{ title: "Haunt", state: "todo", roles: ["ghost-role"] }] } } });
+  assert.throws(() => f.writer.applyPack("acme", bad, { revision: rev(f), actor: "jason", assertClean }), { code: "invalid-request" });
+  assert.equal(bytes(f), original);
+  const badBoard = packPlan({ board: { ...BOARD, layout: "grid" } });
+  assert.throws(() => f.writer.applyPack("acme", badBoard, { revision: rev(f), actor: "jason", assertClean }), { name: "BusinessError" });
+  assert.equal(bytes(f), original);
+  // A fault after the candidate is prepared, with every item checked, leaves the file unchanged.
+  const crash = organizationWriter({ dir: f.dir, rolesDir: f.rolesDir, barrier: (stage) => { if (stage === "prepared") throw new Error("fixture crash"); } });
+  assert.throws(() => crash.applyPack("acme", packPlan(), { revision: rev(f), actor: "jason", assertClean }), /fixture crash/);
+  assert.equal(bytes(f), original);
+  f.writer.recover("acme");
+  assert.equal(bytes(f), original);
+  assert.equal(JSON.parse(readFileSync(f.writer.logFile("acme"), "utf8").trim().split("\n").at(-1)).state, "aborted");
+  // The same plan then lands whole.
+  f.writer.applyPack("acme", packPlan(), { revision: rev(f), actor: "jason", assertClean });
+  assert.ok(doc(f).definitions.scout && doc(f).board && doc(f).workflows && doc(f).packs);
+});
+
+test("SP3 an agent actor with a definition in the plan refuses human-required; board and workflow writes pass", (t) => {
+  const f = fixture(t);
+  const original = bytes(f);
+  for (const actor of ["coder", "chief-of-staff.chief", "tester"]) {
+    assert.throws(() => f.writer.applyPack("acme", packPlan(), { revision: rev(f), actor, assertClean }), { code: "human-required" }, actor);
+  }
+  // A saved template carries invented roles; an agent never applies one.
+  const saved = { packs: { ...packPlan().packs, origin: "saved", proposedHires: [] }, board: BOARD };
+  assert.throws(() => f.writer.applyPack("acme", saved, { revision: rev(f), actor: "chief-of-staff.chief", assertClean }), { code: "human-required" });
+  assert.equal(bytes(f), original);
+  // The non-definition half of a pack, and a board write, need no human (Jason's answer 2).
+  const half = { packs: { ...packPlan().packs, proposedHires: [{ name: "coder-1", pin: { template: "coder", sha256: HASH } }] }, workflows: WORKFLOWS };
+  f.writer.applyPack("acme", half, { revision: rev(f), actor: "chief-of-staff.chief", assertClean });
+  assert.equal(doc(f).packs[0].by, "chief-of-staff.chief");
+  f.writer.applyPack("acme", { board: BOARD }, { revision: rev(f), actor: "chief-of-staff.chief", assertClean });
+  assert.deepEqual(doc(f).board, BOARD);
+});
+
+test("SP3 a plan holding any other key refuses", (t) => {
+  const f = fixture(t);
+  const original = bytes(f);
+  for (const [name, plan] of Object.entries({
+    plugins: { plugins: { theme: ["dark"] } },
+    roles: { roles: { pm: { definition: "pm" } } },
+    limits: { limits: { total: 3 } },
+    credentials: { credentials: { gitea: { file: "/x" } } },
+    launch: { launch: {} },
+    copyBindings: { copyBindings: {} },
+    autonomy: { autonomy: "near" },
+    "projects whole": { projects: { stack: { root: "/x" } } },
+    "projects root": { "projects.stack.root": "/x" },
+    "projects agents": { "projects.stack.agents": {} },
+    "board beside plugins": { board: BOARD, plugins: {} },
+    "dotted workflow item": { "workflows.change": WORKFLOWS.change },
+    "empty plan": {},
+    "not an object": [],
+  })) {
+    assert.throws(() => f.writer.applyPack("acme", plan, { revision: rev(f), actor: "jason", assertClean }), { code: "invalid-request" }, name);
+  }
+  assert.equal(bytes(f), original);
+});
+
+test("SP3 a board-only plan changes only board, and a project board only that project's board", (t) => {
+  const f = fixture(t);
+  const before = doc(f);
+  f.writer.applyPack("acme", { board: BOARD }, { revision: rev(f), actor: "jason", assertClean });
+  assert.deepEqual(without(doc(f), "board"), before);
+  assert.deepEqual(doc(f).board, BOARD);
+  // board.set replaces a board, and null removes it.
+  f.writer.applyPack("acme", { board: LIST_BOARD }, { revision: rev(f), actor: "jason", assertClean });
+  assert.deepEqual(doc(f).board, LIST_BOARD);
+  f.writer.applyPack("acme", { board: null }, { revision: rev(f), actor: "jason", assertClean });
+  assert.deepEqual(doc(f), before);
+  // A project's board.
+  f.writer.applyPack("acme", { "projects.stack.board": BOARD }, { revision: rev(f), actor: "jason", assertClean });
+  assert.deepEqual(doc(f).projects.stack, { ...before.projects.stack, board: BOARD });
+  assert.deepEqual(without(doc(f), "projects"), without(before, "projects"));
+  assert.deepEqual(f.writer.read("acme").document.projects.stack.board, BOARD);
+  // Workflows merge by name; null removes one; a project's workflows likewise.
+  f.writer.applyPack("acme", { workflows: WORKFLOWS }, { revision: rev(f), actor: "jason", assertClean });
+  f.writer.applyPack("acme", { workflows: { review: WORKFLOWS.change } }, { revision: rev(f), actor: "jason", assertClean });
+  assert.deepEqual(Object.keys(doc(f).workflows), ["change", "review"]);
+  f.writer.applyPack("acme", { workflows: { change: null } }, { revision: rev(f), actor: "jason", assertClean });
+  assert.deepEqual(Object.keys(doc(f).workflows), ["review"]);
+  f.writer.applyPack("acme", { workflows: { review: null } }, { revision: rev(f), actor: "jason", assertClean });
+  assert.ok(!Object.hasOwn(doc(f), "workflows"));
+  f.writer.applyPack("acme", { "projects.stack.workflows": WORKFLOWS }, { revision: rev(f), actor: "jason", assertClean });
+  assert.deepEqual(doc(f).projects.stack.workflows, WORKFLOWS);
+  // Removing what isn't there refuses.
+  assert.throws(() => f.writer.applyPack("acme", { board: null }, { revision: rev(f), actor: "jason", assertClean }), { code: "invalid-request" });
+  assert.throws(() => f.writer.applyPack("acme", { workflows: { nope: null } }, { revision: rev(f), actor: "jason", assertClean }), { code: "invalid-request" });
+});
+
+test("SP3 a workflow in the plan must name an org definition, a V2 template or human", (t) => {
+  const f = fixture(t);
+  const original = bytes(f);
+  const flow = (roles) => ({ workflows: { change: { steps: [{ title: "Step", state: "todo", roles }] } } });
+  for (const roles of [["ghost-role"], ["pm", "ghost-role"], ["conductor-policy"]]) {
+    assert.throws(() => f.writer.applyPack("acme", flow(roles), { revision: rev(f), actor: "jason", assertClean }), { code: "invalid-request" }, roles.join());
+    assert.throws(() => f.writer.applyPack("acme", { "projects.stack.workflows": flow(roles).workflows }, { revision: rev(f), actor: "jason", assertClean }), { code: "invalid-request" });
+  }
+  assert.equal(bytes(f), original);
+  // A template, human, and a definition the same plan adds.
+  f.writer.applyPack("acme", flow(["pm", "human"]), { revision: rev(f), actor: "jason", assertClean });
+  f.writer.applyPack("acme", packPlan({ board: undefined, workflows: { scouting: { steps: [{ title: "Scout", state: "todo", roles: ["scout"] }] } } }), { revision: rev(f), actor: "jason", assertClean });
+  assert.deepEqual(Object.keys(doc(f).workflows), ["change", "scouting"]);
+});
+
+test("SP3 applyPack keeps setDefinition's definition rules", (t) => {
+  const f = fixture(t, (d) => ({ ...d, definitions: { scout: { ...PLAIN, rev: 1 }, spare: { ...PLAIN, rev: 2 } }, roles: { ...d.roles, looker: { definition: "org:scout" } } }));
+  const original = bytes(f);
+  const plan = (definitions) => packPlan({ definitions, board: undefined, workflows: undefined });
+  assert.throws(() => f.writer.applyPack("acme", plan({ scout: PLAIN }), { revision: rev(f), actor: "jason", assertClean }), { code: "definition-in-use" });
+  assert.throws(() => f.writer.applyPack("acme", plan({ spare: PLAIN }), { revision: rev(f), actor: "jason", assertClean }), { code: "definition-exists" });
+  assert.throws(() => f.writer.applyPack("acme", plan({ fresh: { ...PLAIN, rev: 1 } }), { revision: rev(f), actor: "jason", assertClean }), { code: "definition-rev-conflict" });
+  // The credential store's check is required on every apply, not only one that writes definitions.
+  assert.throws(() => f.writer.applyPack("acme", plan({ fresh: PLAIN }), { revision: rev(f), actor: "jason" }), { code: "definition-secret-check-required" });
+  for (const bare of [{ board: BOARD }, { workflows: WORKFLOWS }, { "projects.stack.board": BOARD }, { packs: { ...packPlan().packs, proposedHires: [] }, workflows: WORKFLOWS }]) {
+    assert.throws(() => f.writer.applyPack("acme", bare, { revision: rev(f), actor: "jason" }), { code: "definition-secret-check-required" }, Object.keys(bare).join());
+  }
+  // A secret in workflow text, a plan key or an inline proposal's entry refuses before anything is written.
+  const leak = { ...WORKFLOWS.change, description: SECRET };
+  assert.throws(() => f.writer.applyPack("acme", { workflows: { change: leak } }, { revision: rev(f), actor: "jason", assertClean }), /credential-leak/);
+  assert.throws(() => f.writer.applyPack("acme", { [SECRET]: BOARD }, { revision: rev(f), actor: "jason", assertClean }), /credential-leak/);
+  assert.throws(() => f.writer.applyPack("acme", plan({ fresh: { ...PLAIN, instructions: `token ${SECRET}\n` } }), { revision: rev(f), actor: "jason", assertClean }), /credential-leak/);
+  assert.throws(() => f.writer.applyPack("acme", plan({ fresh: { ...PLAIN, role: { ...PLAIN.role, tools: ["no-such-tool"] } } }), { revision: rev(f), actor: "jason", assertClean }), { name: "BusinessError" });
+  // checkComposition runs: a hired composition never holds role.hire.
+  const hiring = { ...PLAIN, role: { ...PLAIN.role, authority: { withinRole: [], crossRole: ["role.hire"] } } };
+  assert.throws(() => f.writer.applyPack("acme", plan({ fresh: hiring }), { revision: rev(f), actor: "jason", assertClean }));
+  // A definition needs a packs entry, and a {definition, rev} pin names a definition this apply writes at rev 1.
+  assert.throws(() => f.writer.applyPack("acme", { definitions: { fresh: PLAIN } }, { revision: rev(f), actor: "jason", assertClean }), { code: "invalid-request" });
+  const pin = (p) => ({ ...plan({ fresh: PLAIN }), packs: { ...packPlan().packs, proposedHires: [{ name: "x-1", pin: p }] } });
+  assert.throws(() => f.writer.applyPack("acme", pin({ definition: "spare", rev: 2 }), { revision: rev(f), actor: "jason", assertClean }), { code: "invalid-request" });
+  assert.throws(() => f.writer.applyPack("acme", pin({ definition: "fresh", rev: 2 }), { revision: rev(f), actor: "jason", assertClean }), { code: "invalid-request" });
+  // A held secret in a board label or workflow text refuses when the caller passes the check.
+  assert.throws(() => f.writer.applyPack("acme", { board: { ...BOARD, columns: [{ state: "todo", label: SECRET }, ...BOARD.columns.slice(1)] } }, { revision: rev(f), actor: "jason", assertClean }), /credential-leak/);
+  assert.equal(bytes(f), original);
+  f.writer.applyPack("acme", pin({ definition: "fresh", rev: 1 }), { revision: rev(f), actor: "jason", assertClean });
+  assert.deepEqual(doc(f).definitions.fresh, { ...PLAIN, rev: 1 });
+});
+
+test("SP3 a pack apply only adds, and its scope fences the project keys", (t) => {
+  const f = fixture(t, (d) => ({ ...d, board: BOARD, workflows: WORKFLOWS }));
+  const original = bytes(f);
+  // No definitions in these plans, so no {definition, rev} pin: each refusal below is the one named.
+  const packs = { ...packPlan().packs, proposedHires: PACK.proposedHires.slice(0, 1) };
+  const go = (plan) => f.writer.applyPack("acme", plan, { revision: rev(f), actor: "jason", assertClean });
+  // Nothing is overwritten or removed by an apply.
+  assert.throws(() => go({ packs, board: LIST_BOARD }), { code: "invalid-request" });
+  assert.throws(() => go({ packs, workflows: { change: WORKFLOWS.change } }), { code: "invalid-request" });
+  assert.throws(() => go({ packs, workflows: { other: null } }), { code: "invalid-request" });
+  // The writer stamps at, by and added.
+  for (const key of ["at", "by", "added"]) assert.throws(() => go({ packs: { ...packs, [key]: PACK[key] }, workflows: { other: WORKFLOWS.change } }), { code: "invalid-request" }, key);
+  // An org pack writes no project key; a project pack writes only its project's keys.
+  assert.throws(() => go({ packs, "projects.stack.board": BOARD }), { code: "invalid-request" });
+  const projectPack = { ...packs, scope: "project", project: "stack" };
+  assert.throws(() => go({ packs: projectPack, workflows: { other: WORKFLOWS.change } }), { code: "invalid-request" });
+  assert.throws(() => go({ packs: { ...projectPack, project: "nowhere" }, "projects.nowhere.board": BOARD }), { code: "invalid-request" });
+  assert.throws(() => go({ "projects.nowhere.board": BOARD }), { code: "invalid-request" });
+  assert.equal(bytes(f), original);
+  go({ packs: projectPack, "projects.stack.board": BOARD, "projects.stack.workflows": WORKFLOWS });
+  assert.deepEqual(doc(f).packs[0].added, ["projects.stack.board", "projects.stack.workflows.change"]);
+  assert.deepEqual(doc(f).projects.stack.board, BOARD);
+});
+
+test("SP3 the generic writer still refuses project board changes", (t) => {
+  const f = fixture(t);
+  const next = structuredClone(f.document);
+  next.projects.stack.board = BOARD;
+  assert.throws(() => f.writer.write("acme", next, { revision: rev(f), actor: "jason" }), { code: "organization-projects-protected" });
+});
+
+test("SP3 an inline proposal keeps its full role entry beside the pin, and the pin is the entry's hash", (t) => {
+  const f = fixture(t);
+  const inline = PACK.proposedHires[2];
+  // The loaded organization keeps the entry, so the raise can read it back.
+  const loaded = load(f, { ...f.document, packs: [{ ...PACK, proposedHires: [inline] }] });
+  assert.deepEqual(loaded.packs[0].proposedHires[0], inline);
+  // A recorded hash that no longer matches still loads: staleness is the raise's refusal.
+  const stale = { ...inline, pin: { ...inline.pin, sha256: HASH } };
+  assert.deepEqual(load(f, { ...f.document, packs: [{ ...PACK, proposedHires: [stale] }] }).packs[0].proposedHires[0], stale);
+  // An apply records the entry, and refuses a pin that is not the entry's canonical hash.
+  const original = bytes(f);
+  const plan = (hire) => ({ packs: { ...packPlan().packs, proposedHires: [hire] }, workflows: WORKFLOWS });
+  assert.throws(() => f.writer.applyPack("acme", plan(stale), { revision: rev(f), actor: "chief-of-staff.chief", assertClean }), { code: "invalid-request" });
+  assert.throws(() => f.writer.applyPack("acme", plan({ ...inline, entry: { ...WRITER, instructions: "Something else.\n" } }), { revision: rev(f), actor: "chief-of-staff.chief", assertClean }), { code: "invalid-request" });
+  // A held secret in the entry refuses when the caller passes the check.
+  const leaky = { ...WRITER, instructions: SECRET };
+  assert.throws(() => f.writer.applyPack("acme", plan({ ...inline, pin: { ...inline.pin, sha256: sha256(canonicalJson(leaky)) }, entry: leaky }), { revision: rev(f), actor: "chief-of-staff.chief", assertClean }), /credential-leak/);
+  assert.equal(bytes(f), original);
+  // An agent apply writes no definition, so its hires are template or inline pins.
+  f.writer.applyPack("acme", plan(inline), { revision: rev(f), actor: "chief-of-staff.chief", assertClean });
+  assert.deepEqual(doc(f).packs[0].proposedHires, [inline]);
+  assert.equal(doc(f).definitions?.writer, undefined);
+  assert.deepEqual(load(f, doc(f)).packs[0].proposedHires, [inline]);
+});

packages/webui/README.md

@@ -16,13 +16,16 @@ baseline CLI.
 | Create organization | `mosaic org create <id> --from <file>` | S6 integration hook |
 | Save organization or theme | `mosaic org update <id> --from <file> --if-revision <revision>` | S6 integration hook |
 | Initialize organization checkout | `mosaic org queue init <id> --local-only --accept-local-loss-risk` or `--remote <url>` | S6 integration hook |
-| Initialize project Git | `mosaic org project repo init <id> <project> --local-only --accept-local-loss-risk` or `--remote <url>` | S6 integration hook |
+| Initialize project Git | `mosaic org project repo init <id> <project> --local-only --accept-local-loss-risk` or `--remote <url>` | S6 integration hook; remote mode sets and checks `origin` (#1873 P1-6) |
+| Change a project's repository | `mosaic org project repo set <id> <project> (--local-only --accept-local-loss-risk \| --remote <url>) --if-revision <revision>` | Enabled (#1873 P1-7): the owner's Repository section on an organization project's Settings tab, `/api/orgs/<id>/repo/project/<project>`; needs send mode; refused (409 `project-repo-bound`) while an approved or active copy binding names the project |
 | Recover a stopped bus with stale host state | `mosaic bus recover <id>` | CLI only |
 | Inspect or clear a dead lifecycle lock | `mosaic org lock show <id>` / `mosaic org lock clear <id>` | CLI only |
 | Start, stop or restart a bus | `mosaic bus start <id>` / `mosaic bus stop <id>` / `mosaic bus restart <id>` | S6 integration hook |
 | Restart (or first start) an organization's bus | `mosaic bus restart <id>`, or `mosaic bus start <id>` for a bus never started | Enabled (F3): the owner's **Restart bus** control, offered where a page says the bus is down or a change needs a restart; trailed |
 | Restart the Console | Stop and run `mosaic console start` again | Enabled (F3) when `mosaic console start` runs it in the foreground, or with `--dev-local-owner --detach` under a detached supervisor (D1): Settings > Console; the owner only; trailed. Other Consoles answer `not-supervised` |
-| Save, review, confirm or reverse an organization's autonomy | Save only: edit the autonomy block and run `mosaic org update ORG --from FILE --if-revision N`; no autonomy verb yet (readiness P1-3) | Enabled (D1) on a `--dev-local-owner` Console: the owner only, on the selected organization's bus, behind a fence that passes only the four console verbs `autonomy.set.console`, `autonomy.review.console`, `decision.confirm.console` and `decision.reverse.console` |
+| Save, review, confirm or reverse an organization's autonomy | Read, save and review: `mosaic org autonomy ORG`, `mosaic org autonomy ORG set --revision REV [--cross-role|--merge|--policy|--authority in|near|out] [--notices on|off] [--reverse-window-hours 1-168] [--authority-resolver NAME|""]`, `mosaic org autonomy ORG review CLASS` (E2, through this route and its revision check); confirm and reverse act on inbox decisions and have no verb yet | Enabled (D1) on a `--dev-local-owner` Console: the owner only, on the selected organization's bus, behind a fence that passes only the four console verbs `autonomy.set.console`, `autonomy.review.console`, `decision.confirm.console` and `decision.reverse.console` |
+| Hire, fire or change an agent; read role templates | `mosaic org role-templates ORG`; `mosaic org hire|change ORG --name NAME --template TEMPLATE --harness H --model M [--thinking T] [--level org|project|root] [--project P] --reason TEXT`; `mosaic org fire ORG --name NAME [--level ...] --reason TEXT` (E2, through this route) | Enabled (D4) for the owner on a selected organization's bus: one decision raised and approved through `hire.start.console`, with the bus's hire checks |
+| Create, edit or archive a board task | `mosaic tasks create --title T --requirement REQ [--project P] [--state S] [--assignees R,...] [--priority 0-5] [--due ISO|none]`; `mosaic tasks edit task:N --expect DIGEST ...`; `mosaic tasks archive task:N --expect DIGEST` (E2: the board's own check, then the person's `tasks.create|edit|archive` on the bus) | Enabled for the owner on an organization with the built-in task store |
 | Create chat project linked to a configured repository | `mosaic project create <name> --repo <project> --org <id>` | Enabled |
 | Create a thread | `mosaic thread create <project> <name> --org <id>` | Planned enabled |
 | Open a thread | `mosaic thread open <thread> --org <id>` | Planned enabled |

packages/webui/src/cli.mjs

@@ -30,6 +30,8 @@ import { fileURLToPath } from 'node:url';
 import { isAbsolute, join } from 'node:path';
 import { actionTrail } from './action-trail.mjs';
 import { reviveBuses } from './bus-revive.mjs';
+import { createProxyAdmin, orgCatalogue } from './proxy-admin.mjs';
+import { busesStopped } from '../../cli/src/proxy-admin-host.mjs';
 import { agentLevelsWriteRoutes } from './agent-levels-write.mjs';
 import { RESTART_EXIT } from '../../cli/src/org-console.mjs';
 import { ID_PATTERN } from '../../organization/src/vocabulary.mjs';
@@ -49,7 +51,7 @@ if (process.platform === 'linux') {
   }
 }
 const args = process.argv.slice(2);
-const usage = 'node packages/webui/src/cli.mjs serve [--port N] [--tester-socket] [--checkout PATH] [--board http://127.0.0.1:7331] [--business ID] [--sso | --dev-local-owner [--dev-insecure-bind ADDR --dev-allow-host NAME[,NAME...]]] [--send] [--supervised] [--public-host NAME --auth-header HEADER --allow-user ID [--proof-header NAME --proof-file PATH]]';
+const usage = 'node packages/webui/src/cli.mjs serve [--port N] [--tester-socket] [--checkout PATH] [--board http://127.0.0.1:7331] [--business ID] [--sso | --dev-local-owner [--dev-insecure-bind ADDR --dev-allow-host NAME[,NAME...]]] [--send] [--supervised] [--proxy-unit-dir PATH] [--public-host NAME --auth-header HEADER --allow-user ID [--proof-header NAME --proof-file PATH]]';
 try {
   if (args.length === 1 && ['--help', '-h'].includes(args[0])) { console.log(usage); process.exit(0); }
   if (args.shift() !== 'serve') throw new Error(usage);
@@ -100,6 +102,11 @@ try {
       if (devBind !== null) throw new Error('--dev-insecure-bind takes one address');
       devBind = value;
     } else if (flag === '--dev-allow-host') devNames.push(value);
+    // #1873: where the Proxy page installs the proxy user unit; proxy-service.sh's default otherwise.
+    else if (flag === '--proxy-unit-dir') {
+      if (!isAbsolute(value)) throw new Error('--proxy-unit-dir must be an absolute path');
+      options.proxyUnitDir = value;
+    }
     else throw new Error(`unknown option: ${flag}`);
   }
   const stamp = assertBuildStart({ serve: true, sso: ssoOn, devOwner, devBind, devNames });
@@ -194,6 +201,23 @@ try {
   }) : null;
   // #1873 A1: the root agent level, read fresh on each request; the Agents grid's only new read.
   const agentLevels = organizations ? { loadRoot: () => loadRootAgents(configDir(), { rolesDir: rolesDir() }), rolesDir: rolesDir(), ctx: { configDir: configDir(), dataRoot: system.dataRoot, instance } } : null;
+  // #1873: proxy setup for the instance owner (dev local owner, or the root owner under --sso).
+  // Instance-wide: one pinned release, one proxy.json, one unit. Each organization uses it (shared).
+  const proxyAdmin = system && (devOwner || ssoOn) ? createProxyAdmin({
+    dataRoot: system.dataRoot, configDir: configDir(), instance, unitDir: options.proxyUnitDir ?? null,
+    buses: () => busesStopped({ dataRoot: system.dataRoot, configDir: configDir() }),
+    orgs: async () => {
+      const catalogue = orgCatalogue;
+      if (!organizations) return [{ id: options.business ?? null, proxy: 'shared', catalogue: await catalogue(ownerCall ?? (async () => { throw new Error(); })) }];
+      const out = [];
+      for (const org of await listOrgs({ configDir: configDir(), dataRoot: system.dataRoot, instance })) {
+        if (org.state !== 'active') continue;
+        let paths; try { paths = orgPaths(org.root); } catch { out.push({ id: org.id, proxy: 'shared', catalogue: { status: 'bus-unavailable', models: null } }); continue; }
+        out.push({ id: org.id, proxy: 'shared', catalogue: await catalogue(busCaller({ dataRoot: org.root, socket: paths.socket, business: org.id, timeoutMs: 5000 })) });
+      }
+      return out;
+    },
+  }) : null;
   let server, testerServer = null;
   // F3: the restart route closes every listener and connection, then exits RESTART_EXIT for the
   // supervisor to relaunch. Without --supervised the route answers not-supervised.
@@ -207,7 +231,7 @@ try {
   // #1873 A2: Settings > Agents writes for the root and project levels, beside the levels read.
   const agentLevelRoutes = organizations ? [agentLevelsWriteRoutes({ configDir: configDir(), rolesDir: rolesDir(), trail })] : [];
   try {
-    server = await startServer({ restart, trail, ...(lan ? { host: lan.bind, devAllowHosts: lan.allowHosts } : {}), board: options.board, port: options.port, bus, reads, preview: options.preview, sso, proof, send, settingsWrite, projectFiles, projectFile, libraryFile, libraryStatus, librarySync, libraryRevert, librarySave, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite, agentWrite, proxyCall, processing, decisionWrite, requestRead, requestWrite, userOptions, federation: system?.federation ?? null, organizations, agentLevels, routes: agentLevelRoutes, preselect: options.business ?? null });
+    server = await startServer({ restart, trail, ...(lan ? { host: lan.bind, devAllowHosts: lan.allowHosts } : {}), board: options.board, port: options.port, bus, reads, preview: options.preview, sso, proof, send, settingsWrite, projectFiles, projectFile, libraryFile, libraryStatus, librarySync, libraryRevert, librarySave, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite, agentWrite, proxyCall, proxyAdmin, processing, decisionWrite, requestRead, requestWrite, userOptions, federation: system?.federation ?? null, organizations, agentLevels, routes: agentLevelRoutes, preselect: options.business ?? null });
   } catch (err) { sso?.close(); throw err; }
   if (testerSocket) {
     const call = busCaller({ dataRoot: system.dataRoot, socket: socketPath(system.dataRoot), business: options.business ?? null, cli: TESTER_CLI });

packages/webui/src/console-bus.mjs

@@ -10,7 +10,9 @@ import { views } from '../../bus/src/views.mjs';
 export const AGENT_VERBS = ['instance.launch', 'instance.regenerate', 'instance.end', 'veto.set', 'instance.request'];
 // P4 owner transport only; the HTTP boundary and broker both refuse users/testers.
 export const PROXY_VERBS = Object.freeze(['proxy.accounts', 'proxy.login.start', 'proxy.login.submit',
-  'proxy.login.status', 'proxy.login.cancel', 'proxy.apikey.add', 'proxy.priority.set', 'proxy.group.models.set', 'proxy.keys', 'plugins', 'plugins.set']);
+  'proxy.login.status', 'proxy.login.cancel', 'proxy.apikey.add', 'proxy.priority.set', 'proxy.group.models.set', 'proxy.keys', 'plugins', 'plugins.set',
+  // #1873: proxy setup from the page. The broker gates both to the human owner.
+  'proxy.init', 'proxy.fence.clear']);
 export const TESTER_AGENT_VERBS = ['instance.launch', 'instance.end', 'instance.request'];
 // U4b (#1873): the task board's writes, the person's built-in store verbs (broker tasks.*). The
 // caller refuses any other, so the board's taskWrite never reaches unarchive or delete.

packages/webui/src/org-admin.mjs

@@ -15,7 +15,10 @@
 //   GET  /api/orgs/ID/setup                 read-back of every setup step (resume)
 //   POST /api/orgs/ID/setup/queue           C2 queueInit     mosaic org queue init
 //   POST /api/orgs/ID/setup/project/P       C2 projectRepoInit  mosaic org project repo init
+//   GET  /api/orgs/ID/repo/project/P        C2 projectRepoShow  mosaic org project repo show (#1873 P1-7)
+//   POST /api/orgs/ID/repo/project/P        C2 projectRepoSet   mosaic org project repo set --if-revision
 //   POST /api/orgs/ID/setup/bus             C3 busStart      mosaic bus start --detach
+//   POST /api/orgs/ID/restore               C2 restoreOrg, then C3 busStart (E1: the answer's `bus`)
 //   POST /api/orgs/ID/restart/bus           C3 busRestart    mosaic bus restart (F3; busStart when stopped;
 //                                           busRevive for a host that died, dev-local owner only, D2)
 //   POST /api/orgs/ID/stop/bus              C3 busStop       mosaic bus stop (a stopped bus answers state stopped)
@@ -31,12 +34,13 @@ import { join } from 'node:path';
 import { actor } from './action-trail.mjs';
 import { DEV_OWNER } from '../../cli/src/dev-local-owner.mjs';
 import { revivePending } from './bus-revive.mjs';
+import { parseRepoRemote } from '../../organization/src/vocabulary.mjs';
 
 const ID = /^[a-z0-9][a-z0-9._-]{0,63}$/;
 const KEY = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
 const ENV_NAME = /^[A-Z][A-Z0-9_]{0,63}$/;
 const MAX_BODY = 64 * 1024;
-const ROUTE = /^\/api\/orgs\/([^/]+)\/(admin|setup|delete|archive|restore|restart|stop)(?:\/(queue|bus|project\/([^/]+)|records\/([^/]+)))?$/;
+const ROUTE = /^\/api\/orgs\/([^/]+)\/(admin|setup|repo|delete|archive|restore|restart|stop)(?:\/(queue|bus|project\/([^/]+)|records\/([^/]+)))?$/;
 // The org-template placeholder (packages/organization/src/org-service.mjs templateRender).
 export const placeholderRoot = (id, project) => `/__mosaic_org__/${id}/projects/${project}`;
 // Project fields the server owns. The browser never sees or sends them. `agents` (#1873 A1) is
@@ -45,11 +49,12 @@ const SERVER_PROJECT_KEYS = ['root', 'repo', 'git', 'agents'];
 
 // The CLI verb each step equals (r4 section 2).
 export function verbFor(step, id, opts = {}) {
-  const tail = opts.mode === 'remote' ? `--remote ${opts.remote ?? '<https-url>'}` : '--local-only --accept-local-loss-risk';
+  const tail = opts.mode === 'remote' ? `--remote ${opts.remote ?? '<repository-url>'}` : '--local-only --accept-local-loss-risk';
   if (step === 'create') return `mosaic org create ${id} --from <file>`;
   if (step === 'update') return `mosaic org update ${id} --from <file> --if-revision ${opts.revision ?? '<revision>'}`;
   if (step === 'queue') return `mosaic org queue init ${id} ${tail}`;
   if (step === 'project') return `mosaic org project repo init ${id} ${opts.project} ${tail}`;
+  if (step === 'repo') return `mosaic org project repo set ${id} ${opts.project} ${tail} --if-revision ${opts.revision ?? '<revision>'}`;
   if (step === 'archive' || step === 'restore') return `mosaic org ${step} ${id} --if-revision ${opts.revision}`;
   if (step === 'delete') return `mosaic org delete ${id} --confirm ${id} --if-revision ${opts.revision}`;
   if (step === 'records') return `mosaic project init ${id} ${opts.project}`;
@@ -269,6 +274,8 @@ function refusal(res, error, { step, id, unknownOk = false }) {
   if (code === 'org-forbidden') return json(res, 403, { error: 'org-forbidden', step, message: String(error.message ?? code) });
   if (code === 'org-exists' || code === 'org-overlap' || code === 'exists') return json(res, 409, { error: code, step, message: 'it already exists; read it back instead of creating it again', readBack: id ? `/api/orgs/${id}/setup` : null });
   if (code === 'org-invalid' && (step === 'queue' || step === 'project')) return json(res, 422, { error: code, step, message: String(error.message), errors: [{ path: '$.remote', field: 'remote', message: String(error.message) }] });
+  // #1873 F7: a copy binding still grants this project; the message names the copies and the next step.
+  if (code === 'project-repo-bound') return json(res, 409, { error: code, step, message: String(error.message ?? code) });
   if (code === 'org-risk') return json(res, 422, { error: code, step, message: String(error.message), errors: [{ path: '$.acceptLocalLossRisk', field: 'acceptLocalLossRisk', message: String(error.message) }] });
   if (typeof code === 'string' && /^org-|invalid|refused|required/.test(code)) return json(res, 422, { error: code, step, message: String(error.message ?? code), errors: error.errors ? withField(error.errors) : [] });
   if (unknownOk) return json(res, 502, { error: 'outcome-unknown', step, message: 'the outcome is unknown. Read the step back before retrying.', readBack: id ? `/api/orgs/${id}/setup` : null });
@@ -384,15 +391,17 @@ function unreadable(res, error, step, id, log) {
   return json(res, 409, { error: 'readback-failed', step, message: `the ${step === 'queue' ? 'checkout' : 'repository'} could not be read back${error?.code ? ` (${error.code})` : ''}, so it was not retried. Inspect it with the show verb.`, readBack: `/api/orgs/${id}/setup` });
 }
 
-const gitOptions = (body, res, step) => {
-  strictKeys(body, ['mode', 'remote', 'acceptLocalLossRisk']);
+const gitOptions = (body, res, step, extra = []) => {
+  strictKeys(body, ['mode', 'remote', 'acceptLocalLossRisk', ...extra]);
   if (body.mode === 'local-only') {
     if (body.acceptLocalLossRisk !== true) { json(res, 422, { error: 'risk-not-accepted', step, errors: [{ path: '$.acceptLocalLossRisk', field: 'acceptLocalLossRisk', message: 'tick the box to accept that a local-only checkout has no copy anywhere else' }] }); return null; }
     if (body.remote !== undefined) { json(res, 422, { error: 'invalid', step, errors: [{ path: '$.remote', field: 'remote', message: 'local only takes no remote' }] }); return null; }
     return { mode: 'local-only', acceptLocalLossRisk: true };
   }
   if (body.mode === 'remote') {
-    if (typeof body.remote !== 'string' || body.remote.length > 2048 || !/^https:\/\/[^\s/]+\/\S+$/.test(body.remote) || isShellText(body.remote)) { json(res, 422, { error: 'invalid', step, errors: [{ path: '$.remote', field: 'remote', message: 'must be an https repository URL, such as https://git.example/owner/repo' }] }); return null; }
+    // #1873 P1-6: the service's own URL rules (https or ssh; no option, helper, path or credential).
+    const parsed = parseRepoRemote(body.remote);
+    if (!parsed.ok) { json(res, 422, { error: 'invalid', step, errors: [{ path: '$.remote', field: 'remote', message: parsed.message }] }); return null; }
     if (body.acceptLocalLossRisk !== undefined) { json(res, 422, { error: 'invalid', step, errors: [{ path: '$.acceptLocalLossRisk', field: 'acceptLocalLossRisk', message: 'applies to local only' }] }); return null; }
     return { mode: 'remote', remote: body.remote };
   }
@@ -465,7 +474,9 @@ async function route(req, res, { path, search, org, admin, principal, write, log
       const fn = kind === 'archive' ? service.archiveOrg : service.restoreOrg;
       if (typeof fn !== 'function') return json(res, 503, { error: 'not-configured', step: kind });
       const receipt = await fn(ctx, id, { ifRevision: body.revision, ...(busStop ? { busStop } : {}) });
-      return json(res, 200, { outcome: 'done', step: kind, receipt: forReceipt(ctx, receipt), verb: verbFor(kind, id, { revision: body.revision }) });
+      const done = { outcome: 'done', step: kind, receipt: forReceipt(ctx, receipt), verb: verbFor(kind, id, { revision: body.revision }) };
+      if (kind === 'archive') return json(res, 200, done);
+      return json(res, 200, { ...done, bus: await restoreBus({ id, ctx, admin, log, trail, by }) });
     } catch (e) { return refusal(res, e, { step: kind, id, unknownOk: true }); }
   }
   if (kind === 'delete' && !sub && write) {
@@ -523,6 +534,7 @@ async function route(req, res, { path, search, org, admin, principal, write, log
   if (kind === 'setup' && !sub && !write) {
     try { return json(res, 200, await readSetup(admin, ctx, id)); } catch (e) { return refusal(res, e, { step: 'setup', id }); }
   }
+  if (kind === 'repo' && sub?.startsWith('project/')) return repoSet(req, res, { project, write, id, ctx, service, log });
   if (kind === 'restart') return restartBus(req, res, { sub, write, id, ctx, service, admin, log, trail, by });
   if (kind === 'stop') return stopBus(req, res, { sub, write, id, ctx, service, admin, log, trail, by });
   if (kind !== 'setup' || !sub || !write) return json(res, 404, { error: 'not found' });
@@ -571,6 +583,74 @@ async function route(req, res, { path, search, org, admin, principal, write, log
   return json(res, 404, { error: 'not found' });
 }
 
+// E1 (P1-4): Restore brings the organization back running. After a good restore the bus starts as
+// Restart bus starts a stopped one: the owner, origin and --send checks were made for the restore,
+// the trail line is written first, and a trail that cannot be written starts nothing. The restore
+// stands whatever happens here; the answer's `bus` says what did, and the page offers Restart bus
+// when the bus did not start. Never throws.
+async function restoreBus({ id, ctx, admin, log, trail, by }) {
+  const verb = verbFor('bus', id);
+  const notStarted = (error, message) => ({ outcome: 'not-started', error, message, verb });
+  let bus = null;
+  try { bus = await admin.bus(); } catch { /* reported as not configured */ }
+  if (!bus || typeof bus.busStart !== 'function' || typeof bus.busStatus !== 'function') return notStarted('not-configured', 'bus control is not available on this Console, so the bus was not started');
+  if (!trail) return notStarted('trail-unavailable', 'this Console has no action trail, so it does not start buses');
+  let root = null;
+  try {
+    const status = await bus.busStatus(ctx, id);
+    if (status?.healthy) return { outcome: 'done', existing: true, healthy: true, receipt: forReceipt(ctx, status), verb };
+    root = status?.root ?? null;
+  } catch (e) {
+    if (!isCliError(e)) { log(`org-admin: ${id} restore: bus status: ${e?.code ?? e?.name ?? 'error'}`); return notStarted('bus-refused', 'the bus state could not be read, so the bus was not started'); }
+    return notStarted('bus-refused', `${plainMessage(ctx, e.message)}. Inspect it with mosaic bus status ${id}; mosaic bus recover ${id} clears a host that died.`);
+  }
+  try { trail({ by, action: 'bus.start', org: id, outcome: 'requested', after: 'restore' }); }
+  catch { return notStarted('trail-unavailable', 'the action trail could not be written, so the bus was not started'); }
+  const note = outcome => { try { trail({ by, action: 'bus.start', org: id, outcome, after: 'restore' }); } catch { log(`org-admin: ${id} restore bus start: trail write failed after ${outcome}`); } };
+  let receipt;
+  try { receipt = await bus.busStart(ctx, id, { detach: true, devLocalOwner: by?.provider === 'local-dev', pm: false }); }
+  catch (e) {
+    const failed = isCliError(e) && /^bus failed to start\b/.test(e.message);
+    note(failed ? 'failed' : 'refused');
+    if (!isCliError(e)) { log(`org-admin: ${id} restore bus start: ${e?.code ?? e?.name ?? 'error'}`); return { outcome: 'failed', error: 'bus-failed', message: 'the bus did not start', verb }; }
+    const said = failed ? await hostRefusal(root) : null;
+    return { outcome: 'failed', error: failed ? 'bus-failed' : 'bus-refused', message: plainMessage(ctx, said ? `${e.message}. The bus host said: ${said}` : e.message), verb };
+  }
+  note('done');
+  log(`org-admin: ${id} bus started after restore`);
+  let healthy = null;
+  try { healthy = (await bus.busStatus(ctx, id)).healthy; } catch { /* the receipt still stands */ }
+  return { outcome: 'done', healthy, receipt: forReceipt(ctx, receipt), verb };
+}
+
+// #1873 P1-7: the project Settings tab reads and changes the project's repository. GET answers the
+// binding as it is now; POST is `mosaic org project repo set`: the same URL rules and check as setup,
+// origin follows, nothing is pushed, a receipt records it. A project not set up yet answers missing.
+async function repoSet(req, res, { project, write, id, ctx, service, log }) {
+  let name;
+  try { name = decodeURIComponent(project); } catch { return json(res, 404, { error: 'not found' }); }
+  if (!ID.test(name)) return json(res, 404, { error: 'not found' });
+  let body = null, opts = null;
+  if (write) { body = await readBody(req); opts = gitOptions(body, res, 'repo', ['ifRevision']); if (!opts) return; }
+  if (write && (!Number.isSafeInteger(body.ifRevision) || body.ifRevision < 1)) return json(res, 422, { error: 'invalid', step: 'repo', errors: [{ path: '$.ifRevision', field: 'ifRevision', message: 'reload the project; the revision you opened is missing' }] });
+  let shown;
+  try { shown = await service.showOrg(ctx, id); } catch (e) { return refusal(res, e, { step: 'repo', id }); }
+  if (!Object.hasOwn(shown.doc?.projects ?? {}, name) || shown.doc.projects[name]?.kind === 'library') return json(res, 404, { error: 'project-unknown', step: 'repo', message: `${id} declares no project ${name}` });
+  let existing;
+  try { existing = await receiptOf(() => service.projectRepoShow(ctx, id, name)); } catch (e) { return unreadable(res, e, 'project', id, log); }
+  // No new refusal code: a write to a project not set up yet is the existing 'invalid'.
+  if (!existing) return json(res, write ? 422 : 200, { state: 'missing', step: 'repo', project: name, revision: shown.revision, ...(write ? { error: 'invalid' } : {}), message: 'this project has no repository yet; set it up first', verb: verbFor('project', id, { project: name }) });
+  if (!write) {
+    const current = existing.current ?? { mode: existing.mode, ...(existing.remote ? { remote: existing.remote } : {}), revision: shown.revision };
+    return json(res, 200, { state: 'done', step: 'repo', project: name, current: forReceipt(ctx, current), receipt: forReceipt(ctx, existing), verb: verbFor('repo', id, { ...current, project: name, revision: current.revision }) });
+  }
+  if (typeof service.projectRepoSet !== 'function') return json(res, 503, { error: 'not-configured', step: 'repo', message: 'changing a project repository is not available on this Console yet' });
+  try {
+    const receipt = await service.projectRepoSet(ctx, id, name, { ...opts, ifRevision: body.ifRevision });
+    return json(res, 200, { outcome: 'done', step: 'repo', project: name, receipt: forReceipt(ctx, receipt), check: receipt?.check ?? null, verb: verbFor('repo', id, { ...opts, project: name, revision: body.ifRevision }) });
+  } catch (e) { return refusal(res, e, { step: 'repo', id, unknownOk: true }); }
+}
+
 // F3 (REQ-WEB-3): one control restarts an organization's bus and answers with a done receipt. A
 // running host restarts on the options it was started with (C3 busRestart keeps --dev-local-owner);
 // a stopped one starts as setup starts it. The trail line is written before anything changes, and

packages/webui/src/proxy-admin.mjs

@@ -0,0 +1,114 @@
+// #1873 model proxy setup from the Console: the owner-only HTTP routes. Same checks as
+// proxy-http.mjs. The controller (packages/model-proxy/src/admin-control.mjs) runs host
+// actions; init and the fence clear go to the bus, which decides them. No key, token, path or
+// upstream text reaches a response, receipt or log line.
+import { isIP } from 'node:net';
+import { validManagementKey, proxyTiming } from '../../model-proxy/src/common.mjs';
+import { createProxyAdmin, proxyCode } from '../../model-proxy/src/admin-control.mjs';
+
+export { createProxyAdmin };
+
+// #1873: one organization's catalogue row for the setup page. A count is shown only when the bus
+// answered with a model list; otherwise models is null and the page shows a dash, never a made-up 0.
+export async function orgCatalogue(call) {
+  try {
+    const value = await call('routes');
+    return { status: value?.catalogue?.status ?? 'unknown', models: Array.isArray(value?.catalogue?.models) ? value.catalogue.models.length : null };
+  } catch { return { status: 'bus-unavailable', models: null }; }
+}
+
+const ROUTES = Object.freeze({
+  '/api/proxy/admin/status': ['GET', []],
+  '/api/proxy/admin/unit/render': ['GET', []],
+  '/api/proxy/admin/fetch': ['POST', []],
+  '/api/proxy/admin/init': ['POST', null],
+  '/api/proxy/admin/unit/install': ['POST', []],
+  '/api/proxy/admin/unit/start': ['POST', []],
+  '/api/proxy/admin/unit/stop': ['POST', []],
+  '/api/proxy/admin/unit/restart': ['POST', []],
+  '/api/proxy/admin/fence/clear': ['POST', []],
+  '/api/proxy/admin/init-lock/clear': ['POST', []],
+});
+export const PROXY_ADMIN_PATHS = Object.freeze(Object.keys(ROUTES));
+const INIT_KEYS = ['generate', 'key', 'confirm', 'port', 'rotateGraceMinutes', 'firstOutputSeconds'];
+const json = (res, status, value) => {
+  res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store' }); res.end(JSON.stringify(value));
+};
+const loopbackName = name => name === 'localhost' || name === '[::1]' || name === '::1' || (isIP(name) === 4 && name.startsWith('127.'));
+const loopbackAddress = address => typeof address === 'string' && (address === '::1' || /^(::ffff:)?127\./.test(address));
+// A pasted management key crosses only HTTPS or loopback. A plain-HTTP LAN page gets the generated key.
+export function keyTransportOk(origin, remoteAddress) {
+  let url; try { url = new URL(origin); } catch { return false; }
+  if (url.protocol === 'https:') return true;
+  return url.protocol === 'http:' && loopbackName(url.hostname) && loopbackAddress(remoteAddress);
+}
+const STATUS = { 'human-required': 403, 'proxy-key-transport': 403, 'not-configured': 503, 'proxy-down': 503, 'outcome-unknown': 503, 'proxy-admin-busy': 409 };
+
+// `owner` is true only for the instance owner's session (the dev local owner, or the root owner
+// signed in under --sso). `call` is the owner's transport to the selected bus, or null.
+export async function proxyAdminHTTP(req, res, { path, admin, call, named, tester, granted, owner, send, origin, user, log }) {
+  const route = ROUTES[path];
+  const done = (status, value) => {
+    // Path, method and status only: never a body, key, evidence or exception text.
+    log(`${new Date().toISOString()} ${route?.[0] ?? req.method} ${route ? path : '/api/proxy/admin/unknown'} ${status} user=${JSON.stringify(user ?? '')}`);
+    return json(res, status, value);
+  };
+  const refuse = code => done(STATUS[code] ?? 400, { error: code });
+  if (tester || granted || !named || owner !== true) return refuse('human-required');
+  if (!route) return done(404, { error: 'not found' });
+  if (req.method !== route[0]) return done(405, { error: 'method not allowed' });
+  if (req.method === 'POST') {
+    if (!send) return done(403, { error: 'read-only' });
+    if (req.headersDistinct.origin?.length !== 1 || req.headers.origin !== origin) return done(403, { error: 'cross-origin request refused' });
+    if (req.headersDistinct['sec-fetch-site']?.length !== 1 || req.headers['sec-fetch-site'] !== 'same-origin') return done(403, { error: 'cross-site request refused' });
+  }
+  if (!admin) return refuse('not-configured');
+  let args = {};
+  if (req.method === 'POST') {
+    try {
+      if ((req.headers['content-type'] ?? '').split(';')[0].trim().toLowerCase() !== 'application/json') throw Error();
+      const chunks = []; let size = 0;
+      for await (const chunk of req) { size += chunk.length; if (size > 16384) throw Error(); chunks.push(chunk); }
+      args = JSON.parse(Buffer.concat(chunks));
+      if (!args || typeof args !== 'object' || Array.isArray(args)) throw Error();
+      const allowed = route[1] ?? INIT_KEYS;
+      if (Object.keys(args).some(k => !allowed.includes(k))) throw Error();
+    } catch { return refuse('invalid-request'); }
+  }
+  try {
+    switch (path) {
+      case '/api/proxy/admin/status': return done(200, await admin.status());
+      case '/api/proxy/admin/unit/render': return done(200, await admin.render());
+      case '/api/proxy/admin/fetch': return done(202, admin.fetchStart());
+      case '/api/proxy/admin/init': {
+        const timing = {};
+        for (const field of ['port', 'rotateGraceMinutes', 'firstOutputSeconds']) if (Object.hasOwn(args, field)) timing[field] = args[field];
+        if (Object.hasOwn(timing, 'port') && (!Number.isInteger(timing.port) || timing.port < 1024 || timing.port > 65535 || timing.port === 8317)) return refuse('proxy-config-invalid');
+        try { proxyTiming(timing); } catch (error) { return refuse(proxyCode(error, 'proxy-config-invalid')); }
+        let initArgs;
+        if (args.generate === true && !Object.hasOwn(args, 'key') && !Object.hasOwn(args, 'confirm')) initArgs = { generate: true, ...timing };
+        else if (!Object.hasOwn(args, 'generate') && Object.hasOwn(args, 'key')) {
+          // The transport check comes before the key is examined, so a refused key is never judged.
+          if (!keyTransportOk(origin, req.socket?.remoteAddress)) return refuse('proxy-key-transport');
+          if (typeof args.key !== 'string' || args.key !== args.confirm) return refuse('proxy-key-mismatch');
+          if (!validManagementKey(args.key)) return refuse('proxy-key-invalid');
+          initArgs = { key: args.key, ...timing };
+        } else return refuse('invalid-request');
+        if (!call) return refuse('not-configured');
+        return done(200, await admin.init(call, initArgs));
+      }
+      case '/api/proxy/admin/unit/install': return done(200, await admin.unitAction('install'));
+      case '/api/proxy/admin/unit/start': return done(200, await admin.unitAction('start'));
+      case '/api/proxy/admin/unit/stop': return done(200, await admin.unitAction('stop'));
+      case '/api/proxy/admin/unit/restart': return done(200, await admin.unitAction('restart'));
+      case '/api/proxy/admin/fence/clear':
+        if (!call) return refuse('not-configured');
+        return done(200, await admin.fenceClear(call));
+      case '/api/proxy/admin/init-lock/clear': return done(200, await admin.initLockClear());
+    }
+  } catch (error) {
+    const code = ['human-required', 'not-configured', 'invalid-request'].includes(error?.code) ? error.code : proxyCode(error, 'outcome-unknown');
+    return refuse(code);
+  }
+  return done(404, { error: 'not found' });
+}

packages/webui/src/public/bus.js

@@ -1923,7 +1923,8 @@
     if (path.startsWith('/chat')||path.startsWith('/projects')||path.startsWith('/inbox')||path.startsWith('/settings')||path.startsWith('/docs/')||wsPage(path)) render(false); else if (window.MosaicOrg ? path === '/board' : path === '/' || path === '') paintHeld(heldErr);
   };
   configRead = fetch('/api/config', { cache: 'no-store', redirect: 'manual' }).then(r => { if (r.type === 'opaqueredirect') { signOut(); return null; } return r.json(); }).then(applyConfig).catch(() => {});
-  document.addEventListener('mosaic-config', e => { if (e.detail && typeof e.detail === 'object') applyConfig(e.detail); });
+  // E1 (P1-5): after Restart bus the organization dashboard draws its bus line and system types now, not at the next poll.
+  document.addEventListener('mosaic-config', e => { if (e.detail && typeof e.detail === 'object') { applyConfig(e.detail); if (window.MosaicOrg && routeOf().split('?')[0] === '/organization') render(false); } });
   // The cross-organization pages ask for a repaint after a filter, sort or selection change,
   // and report the inbox count across organizations for the sidebar.
   document.addEventListener('mosaic-workspace-render', () => { if (wsPage(routeOf().split('?')[0])) render(false); });

packages/webui/src/public/chat.js

@@ -683,7 +683,10 @@
     refreshRequestData(c, false);
     const remote = c.container.querySelector('[data-chat-remote]');
     const project = c.projects.find(p => p.id === c.id);
-    if (remote && roomOwner() && typeof window.MosaicProjectRemote?.mount === 'function') { remote.replaceChildren(); window.MosaicProjectRemote.mount({ container: remote, projectId: c.id, repositoryKey: project?.repo ?? null, projectArchived: !!c.projectArchived, preserve: true }); }
+    // #1873 P1-7: an organization project's repository is editable through the organization's own route,
+    // which names the project as the organization file does: the chat project's repo key.
+    if (remote && roomOwner() && window.MosaicOrg && typeof window.MosaicProjectRepo?.mount === 'function') window.MosaicProjectRepo.mount({ container: remote, project: project?.repo ?? null, archived: !!c.projectArchived });
+    else if (remote && roomOwner() && typeof window.MosaicProjectRemote?.mount === 'function') { remote.replaceChildren(); window.MosaicProjectRemote.mount({ container: remote, projectId: c.id, repositoryKey: project?.repo ?? null, projectArchived: !!c.projectArchived, preserve: true }); }
     // Phase P2 (#1873): the project's System types selection, the owner's, mounted like the remote.
     const types = c.container.querySelector('[data-chat-system-types]');
     if (types && roomOwner() && typeof window.MosaicSystemTypes?.mount === 'function') window.MosaicSystemTypes.mount({ container: types, projectId: c.id, archived: !!c.projectArchived });

packages/webui/src/public/display.js

@@ -120,7 +120,31 @@ if (document.documentElement.hasAttribute('data-settings-proxy-document') && !lo
 // No browser storage, request/body logging, key reveal, or automatic write retry.
 (() => {
   'use strict';
-  const markup = '<button id="proxy-refresh" type="button">Refresh</button><p id="proxy-message" role="status" aria-live="polite">Reading accounts…</p>\n<p id="proxy-readonly" class="muted" hidden>This Console is read-only. Sign-in and account changes are unavailable.</p>\n<section class="panel" aria-labelledby="proxy-accounts-title"><h2 id="proxy-accounts-title">Accounts</h2>\n<p>Higher priority is used first. Account names are stable identifiers; credential values are never displayed.</p>\n<div class="table-wrap" tabindex="0" role="region" aria-label="Accounts"><table><thead><tr><th>Account</th><th>Provider</th><th>Status</th><th>Priority</th><th>Models</th></tr></thead><tbody id="proxy-accounts"></tbody></table></div></section>\n<section class="panel" aria-labelledby="proxy-signin-title"><h2 id="proxy-signin-title">Sign in to an account</h2>\n<form id="proxy-login-start"><fieldset data-write disabled><legend>Subscription account</legend><label>Provider <select name="provider"><option value="claude">Claude</option><option value="codex">Codex</option></select></label><button type="submit">Start sign-in</button></fieldset></form>\n<p id="proxy-login-message" role="status" aria-live="polite"></p>\n<p><a id="proxy-authorize" target="_blank" rel="noopener noreferrer" hidden>Open account sign-in in a new tab</a></p>\n<form id="proxy-login-submit"><fieldset data-write disabled><legend>Finish sign-in</legend><p>If the sign-in tab does not return, copy its full address and paste it here.</p><label>Callback address <input name="redirect_url" type="url" autocomplete="off" spellcheck="false" maxlength="8192" required></label><button type="submit">Submit address</button><button id="proxy-login-cancel" type="button">Cancel sign-in</button></fieldset></form></section>\n<section class="panel" aria-labelledby="proxy-apikey-title"><h2 id="proxy-apikey-title">Add an API key</h2>\n<form id="proxy-apikey"><fieldset data-write disabled><legend>z.ai</legend><label>API key <input name="key" type="password" autocomplete="off" spellcheck="false" maxlength="4096" required></label><p>The key is sent once and cleared from this field. It will never be shown again.</p><button type="submit">Add key</button></fieldset><p id="proxy-apikey-message" role="status"></p></form></section>\n<section class="panel" aria-labelledby="proxy-keys-title"><h2 id="proxy-keys-title">Client keys</h2><p>Only key IDs are shown. Hire and fire manage agent keys.</p>\n<div class="table-wrap" tabindex="0" role="region" aria-label="Client keys"><table><thead><tr><th>Key ID</th><th>Managed by</th><th>Agent</th><th>Issued</th><th>State</th></tr></thead><tbody id="proxy-keys"></tbody></table></div></section>\n';
+  // #1873: setup from nothing to a working proxy. Shown only to the instance owner (config.proxyAdmin).
+  const setupMarkup = '<section id="proxy-setup" class="panel" aria-labelledby="proxy-setup-title" hidden><h2 id="proxy-setup-title">Proxy setup</h2>'
+    + '<p>Each step is checked on the host. Files are named by label; keys are never shown.</p>'
+    + '<dl id="proxy-setup-state" class="proxy-setup-state"></dl>'
+    + '<div id="proxy-setup-next" class="proxy-setup-next" role="status" aria-live="polite"></div>'
+    + '<p id="proxy-setup-message" role="status" aria-live="polite"></p>'
+    + '<p id="proxy-setup-bus"></p>'
+    + '<details id="proxy-setup-init-box"><summary>Initialize the proxy</summary><form id="proxy-setup-init"><fieldset data-setup-write disabled><legend>Management key</legend>'
+    + '<label><input type="radio" name="keySource" value="generate" checked> Generate a key on the host (recommended). It is stored where init stores keys and never shown.</label>'
+    + '<label id="proxy-setup-paste-choice" hidden><input type="radio" name="keySource" value="paste"> Use my own key</label>'
+    + '<p id="proxy-setup-paste-note" class="muted" hidden>Your own key can be pasted only over HTTPS or on this machine (loopback). This page uses the generated key.</p>'
+    + '<div id="proxy-setup-paste" hidden><label>Management key <input name="key" type="password" autocomplete="off" spellcheck="false" maxlength="4096"></label>'
+    + '<label>Confirm key <input name="confirm" type="password" autocomplete="off" spellcheck="false" maxlength="4096"></label></div></fieldset>'
+    + '<fieldset data-setup-write disabled><legend>Settings (leave empty for the defaults)</legend><div class="filters">'
+    + '<label>Port <input name="port" type="number" min="1024" max="65535" step="1" inputmode="numeric"></label>'
+    + '<label>Key rotation grace (minutes) <input name="rotateGraceMinutes" type="number" min="1" max="1440" step="1" inputmode="numeric"></label>'
+    + '<label>First output timeout (seconds) <input name="firstOutputSeconds" type="number" min="1" max="3600" step="1" inputmode="numeric"></label>'
+    + '</div><button type="submit">Initialize</button></fieldset></form></details>'
+    + '<div class="proxy-setup-unit"><h3>Proxy service</h3><p class="muted">Install renders the unit the same way as <code>mosaic proxy unit install</code>.</p>'
+    + '<div class="proxy-setup-buttons"><button type="button" data-unit="install" data-setup-write disabled>Install</button><button type="button" data-unit="start" data-setup-write disabled>Start</button><button type="button" data-unit="restart" data-setup-write disabled>Restart</button><button type="button" data-unit="stop" data-setup-write disabled>Stop</button><button type="button" id="proxy-setup-render">Show unit file</button></div>'
+    + '<pre id="proxy-setup-unit-file" hidden></pre></div>'
+    + '<div class="proxy-setup-orgs"><h3>Organizations</h3><div class="table-wrap" tabindex="0" role="region" aria-label="Organizations using the proxy"><table><thead><tr><th>Organization</th><th>Proxy</th><th>Catalogue</th><th>Models</th></tr></thead><tbody id="proxy-setup-orgs"></tbody></table></div>'
+    + '<p id="proxy-setup-own" class="muted"></p></div>'
+    + '<div class="proxy-setup-receipts"><h3>Receipts</h3><ol id="proxy-setup-receipts"><li class="muted">No setup actions on this page yet.</li></ol></div></section>\n';
+  const markup = setupMarkup + '<button id="proxy-refresh" type="button">Refresh</button><p id="proxy-message" role="status" aria-live="polite">Reading accounts…</p>\n<p id="proxy-readonly" class="muted" hidden>This Console is read-only. Sign-in and account changes are unavailable.</p>\n<section class="panel" aria-labelledby="proxy-accounts-title"><h2 id="proxy-accounts-title">Accounts</h2>\n<p>Higher priority is used first. Account names are stable identifiers; credential values are never displayed.</p>\n<div class="table-wrap" tabindex="0" role="region" aria-label="Accounts"><table><thead><tr><th>Account</th><th>Provider</th><th>Status</th><th>Priority</th><th>Models</th></tr></thead><tbody id="proxy-accounts"></tbody></table></div></section>\n<section class="panel" aria-labelledby="proxy-signin-title"><h2 id="proxy-signin-title">Sign in to an account</h2>\n<form id="proxy-login-start"><fieldset data-write disabled><legend>Subscription account</legend><label>Provider <select name="provider"><option value="claude">Claude</option><option value="codex">Codex</option></select></label><button type="submit">Start sign-in</button></fieldset></form>\n<p id="proxy-login-message" role="status" aria-live="polite"></p>\n<p><a id="proxy-authorize" target="_blank" rel="noopener noreferrer" hidden>Open account sign-in in a new tab</a></p>\n<form id="proxy-login-submit"><fieldset data-write disabled><legend>Finish sign-in</legend><p>If the sign-in tab does not return, copy its full address and paste it here.</p><label>Callback address <input name="redirect_url" type="url" autocomplete="off" spellcheck="false" maxlength="8192" required></label><button type="submit">Submit address</button><button id="proxy-login-cancel" type="button">Cancel sign-in</button></fieldset></form></section>\n<section class="panel" aria-labelledby="proxy-apikey-title"><h2 id="proxy-apikey-title">Add an API key</h2>\n<form id="proxy-apikey"><fieldset data-write disabled><legend>z.ai</legend><label>API key <input name="key" type="password" autocomplete="off" spellcheck="false" maxlength="4096" required></label><p>The key is sent once and cleared from this field. It will never be shown again.</p><button type="submit">Add key</button></fieldset><p id="proxy-apikey-message" role="status"></p></form></section>\n<section class="panel" aria-labelledby="proxy-keys-title"><h2 id="proxy-keys-title">Client keys</h2><p>Only key IDs are shown. Hire and fire manage agent keys.</p>\n<div class="table-wrap" tabindex="0" role="region" aria-label="Client keys"><table><thead><tr><th>Key ID</th><th>Managed by</th><th>Agent</th><th>Issued</th><th>State</th></tr></thead><tbody id="proxy-keys"></tbody></table></div></section>\n';
   function mount() {
   const $ = id => document.getElementById(id);
   let canWrite = false, login = null, poll = null;
@@ -138,6 +162,7 @@ if (document.documentElement.hasAttribute('data-settings-proxy-document') && !lo
     if (!response.ok) {
       if (response.status === 401) throw new Error('Sign in to the Console again.');
       if (value.error === 'not-configured') throw new Error('The model proxy is not configured for this instance.');
+      if (value.error === 'proxy-down') throw Object.assign(new Error('The model proxy is not answering.'), { code: 'proxy-down' });
       if (value.error === 'login-state-unknown') throw new Error('This sign-in has ended. Start a new sign-in.');
       if (value.error === 'apikey-invalid') throw new Error('Enter a nonempty API key, with no spaces or line breaks.');
       throw new Error('The operation could not be confirmed. Nothing was retried. Refresh before trying again.');
@@ -239,9 +264,187 @@ if (document.documentElement.hasAttribute('data-settings-proxy-document') && !lo
     catch (error) { message(error.message);receipt('proxy-apikey-message',error.message,'error'); }
     finally { busy.delete('apikey');formBusy(form,false); }
   });
-  const cleanup = () => { clearTimeout(poll); login = null; const redirect=$('proxy-login-submit')?.elements.redirect_url, key=$('proxy-apikey')?.elements.key; if(redirect)redirect.value='';if(key)key.value=''; };
+  // #1873 setup controller. Every action is a POST the server checks again (owner, Origin,
+  // Fetch Metadata); this code only offers the next step. Pasted keys stay in their fields
+  // until submit, which clears them before the request is answered.
+  const setup = (() => {
+    const box = $('proxy-setup'), form = $('proxy-setup-init');
+    let state = null, timer = null, enabled = false, sendOk = false, seenFetch = null, loading = false;
+    const pasteAllowed = location.protocol === 'https:' || ['localhost', '[::1]'].includes(location.hostname) || /^127\./.test(location.hostname);
+    const STEPS = { start: 'Starting', 'download-archive': 'Downloading the release archive', 'verify-archive': 'Checking the archive hash', 'download-panel': 'Downloading the panel', 'verify-panel': 'Checking the panel hash', 'extract-binary': 'Extracting the executable', 'verify-binary': 'Checking the executable hash', install: 'Installing', done: 'Done' };
+    const REASONS = {
+      'human-required': 'Only the instance owner can set up the proxy.',
+      'read-only': 'This Console is read-only.',
+      'proxy-admin-busy': 'Another setup action is running. Wait for it to finish.',
+      'proxy-key-transport': 'A pasted key travels only over HTTPS or loopback. Use the generated key.',
+      'proxy-key-mismatch': 'The two key fields differ. Type the same key in both.',
+      'proxy-key-invalid': 'The key must be 1 to 4096 printable characters with no spaces.',
+      'proxy-config-invalid': 'The port must be 1024 to 65535 and not 8317.',
+      'proxy-rotate-grace-invalid': 'Key rotation grace must be 1 to 1440 minutes.',
+      'proxy-first-output-invalid': 'First output timeout must be 1 to 3600 seconds.',
+      'proxy-already-initialized': 'The proxy is already initialized. Init never overwrites it.',
+      'proxy-port-in-use': 'That port is in use. Choose another or leave it empty.',
+      'proxy-init-busy': 'An init lock is held. See Init lock above.',
+      'proxy-install-missing': 'The pinned release is not fetched yet.',
+      'proxy-install-invalid': 'The fetched release failed its hash check. Fetch again.',
+      'proxy-restart-required': 'Restart the proxy from this page first.',
+      'proxy-restart-unconfirmed': 'The restart could not be confirmed on the host. Restart again.',
+      'proxy-init-lock-held': 'The init lock cannot be cleared yet.',
+      'proxy-init-lock-absent': 'There is no init lock.',
+      'proxy-unit-exists': 'A different proxy unit file is installed. Check it with mosaic proxy unit render.',
+      'proxy-unit-missing': 'The proxy service is not installed.',
+      'proxy-unit-unhealthy': 'The proxy service started but does not answer on its port.',
+      'proxy-unit-failed': 'systemd refused the action.',
+      'not-configured': 'Proxy setup is not available on this Console.',
+      'outcome-unknown': 'The outcome is unknown. Check the status before retrying.',
+    };
+    const explain = code => `${REASONS[code] ?? 'The action was refused.'} (${code})`;
+    async function admin(path, args) {
+      const response = await fetch('/api/proxy/admin/' + path, { cache: 'no-store', credentials: 'same-origin', redirect: 'manual',
+        method: args === undefined ? 'GET' : 'POST',
+        ...(args === undefined ? {} : { headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(args) }) });
+      if (response.type === 'opaqueredirect' || response.status === 401) throw new Error('Sign in to the Console again.');
+      let value = null; try { value = await response.json(); } catch { /* refused below */ }
+      if (!response.ok) { const code = typeof value?.error === 'string' && /^[a-z -]+$/.test(value.error) ? value.error : 'outcome-unknown'; const error = new Error(explain(code)); error.code = code; throw error; }
+      return value;
+    }
+    const say = (text, kind) => receipt('proxy-setup-message', text, kind);
+    const human = value => value === null || value === undefined ? '—' : typeof value === 'object' ? JSON.stringify(value) : String(value);
+    function addReceipt(record) {
+      if (!record || typeof record !== 'object') return;
+      const list = $('proxy-setup-receipts'); list.querySelector('li.muted')?.remove();
+      const li = document.createElement('li'), op = document.createElement('strong'); op.textContent = record.op ?? 'action';
+      const details = Object.entries(record).filter(([k]) => k !== 'op' && k !== 'time').map(([k, v]) => `${k}: ${human(v)}`).join(', ');
+      li.append(op, ` ${window.MosaicLocalTime(record.time)}${details ? ' — ' + details : ''}`);
+      list.prepend(li);
+    }
+    // #1873: receipts survive a reload: status carries the last few from proxy-admin.jsonl.
+    function paintReceipts() {
+      if (!Array.isArray(state.receipts) || !state.receipts.length) return;
+      $('proxy-setup-receipts').replaceChildren(); state.receipts.forEach(addReceipt);
+    }
+    function row(dl, term, text) { const dt = document.createElement('dt'), dd = document.createElement('dd'); dt.textContent = term; dd.textContent = text; dl.append(dt, dd); }
+    function paintState() {
+      const { release, init, unit, fence, initLock } = state, dl = $('proxy-setup-state'); dl.replaceChildren();
+      row(dl, 'Release', !release.fetched ? `Not fetched (pinned ${release.version}, panel ${release.panelVersion})` : release.verified ? `Fetched ${release.version}, panel ${release.panelVersion}, hashes verified` : `Fetched ${release.version}, hashes not verified (${release.problem})`);
+      const files = init.files.filter(f => f.present).map(f => f.label).join(', ') || 'none';
+      row(dl, 'Initialized', init.initialized ? `Yes, port ${init.settings?.port ?? '—'}` : init.partial ? `Partly (${init.problem ?? 'incomplete'}). Present: ${files}` : init.problem ? `No (${init.problem})` : 'No');
+      row(dl, 'Service', `${unit.unit}: ${unit.installed ? 'installed' : 'not installed'}, ${unit.active}${unit.pid ? `, pid ${unit.pid}` : ''}${unit.port ? `, port ${unit.port} ${unit.listening ? 'answering' : 'not answering'}` : ''}${unit.error ? ` (${unit.error})` : ''}`);
+      row(dl, 'Fence', !fence.set ? 'Clear' : fence.invalid ? 'Set (unreadable fence file)' : `Set after ${fence.op ?? 'a key write'}${fence.org ? ` for ${fence.org}` : ''}${fence.time ? ` at ${window.MosaicLocalTime(fence.time)}` : ''}`);
+      row(dl, 'Init lock', !initLock.present ? 'None' : initLock.clearable ? 'Stale: the bus is stopped and no proxy files exist' : `Held: ${initLock.blockers.join('; ')}`);
+      if (state.restart?.confirmed) row(dl, 'Last restart', `Confirmed at ${window.MosaicLocalTime(state.restart.observedAt)}, new pid ${state.restart.pid}`);
+    }
+    function paintNext() {
+      const next = state.next?.[0], box = $('proxy-setup-next');
+      const steps = {
+        fetch: ['Fetch the pinned release', `Next: fetch CLIProxyAPI ${state.release.version}. Every file is checked against its pinned SHA-256 before it is installed.`, fetchRelease],
+        'init-lock-clear': ['Clear the stale init lock', 'Next: an init lock is left from an init that did not finish. The bus is stopped and no proxy files exist, so it can be cleared.', clearLock],
+        'init-lock-wait': ['Check again', `An init lock is held and cannot be cleared: ${state.initLock.blockers.join('; ')}. Stop the bus and remove partial state as the model-proxy README says, then check again.`, load],
+        'init-repair': ['Check again', 'Setup is partly done. Init never overwrites existing proxy files; resolve them as the model-proxy README says, then check again.', load],
+        init: ['Initialize the proxy', 'Next: initialize. The bus generates the management key unless you paste your own.', () => { $('proxy-setup-init-box').open = true; form.elements.port.focus(); }],
+        'unit-install': ['Install the proxy service', `Next: install ${state.unit.unit}.`, () => unitAction('install')],
+        'unit-start': ['Start the proxy service', `Next: start ${state.unit.unit}.`, () => unitAction('start')],
+        'unit-restart': ['Restart the proxy service', state.fence.set ? (fence => fence.invalid || !fence.time ? 'A key write had an uncertain outcome, so key writes are fenced. The fence file has no readable time, so a restart from this page cannot be proven against it: restart the proxy service, confirm it answers, then run mosaic proxy fence clear --proxy-restarted.' : 'A key write had an uncertain outcome, so key writes are fenced. Restart the proxy; after this page confirms the new process, clear the fence.')(state.fence) : 'The service is running but does not answer on its port. Restart it.', () => unitAction('restart')],
+        'fence-clear': ['Clear the fence', 'The proxy was restarted from this page and the new process answers on its port. Clear the fence with that evidence.', clearFence],
+        accounts: ['Add an account', 'The proxy is running. Sign in to an account or add an API key below.', () => $('proxy-signin-title')?.scrollIntoView({ block: 'start' })],
+      };
+      const [label, text, action] = steps[next] ?? ['Check again', 'Status read.', load];
+      const p = document.createElement('p'); p.textContent = text;
+      const button = document.createElement('button'); button.type = 'button'; button.className = 'btn primary'; button.id = 'proxy-setup-go'; button.dataset.next = next ?? '';
+      button.textContent = state.busy ? 'Working…' : label;
+      const write = !['init-lock-wait', 'init-repair', 'accounts', 'init'].includes(next);
+      button.disabled = Boolean(state.busy) || (write && !sendOk);
+      button.addEventListener('click', () => { if (!button.disabled) action(); });
+      box.replaceChildren(p, button);
+    }
+    function paintControls() {
+      const { release, init, unit, initLock, busy } = state;
+      const canInit = sendOk && !busy && release.fetched && release.verified && !init.initialized && !init.partial && !initLock.present;
+      form.querySelectorAll('[data-setup-write]').forEach(el => { el.disabled = !canInit; });
+      $('proxy-setup-paste-choice').hidden = !pasteAllowed; $('proxy-setup-paste-note').hidden = pasteAllowed;
+      const allow = { install: !unit.installed, start: unit.installed && unit.active !== 'active', restart: unit.installed && unit.active === 'active', stop: unit.installed && unit.active === 'active' };
+      box.querySelectorAll('[data-unit]').forEach(button => { button.disabled = !sendOk || Boolean(busy) || !init.initialized || !allow[button.dataset.unit]; });
+      const orgs = $('proxy-setup-orgs');
+      if (!Array.isArray(state.organizations)) orgs.replaceChildren(Object.assign(document.createElement('tr'), { innerHTML: '<td colspan="4">Organizations could not be read.</td>' }));
+      else if (!state.organizations.length) orgs.replaceChildren(Object.assign(document.createElement('tr'), { innerHTML: '<td colspan="4">No organizations.</td>' }));
+      else orgs.replaceChildren(...state.organizations.map(org => { const tr = document.createElement('tr'); tr.append(cell(org.id), cell(org.proxy === 'shared' ? 'Shared (this instance)' : org.proxy), cell(org.catalogue?.status ?? org.error ?? 'unknown'), cell(Number.isInteger(org.catalogue?.models) ? String(org.catalogue.models) : '—')); return tr; }));
+      $('proxy-setup-own').textContent = state.ownProxy?.available ? 'An organization can run its own proxy.' : `Own proxy per organization: ${state.ownProxy?.state ?? 'not built'}. ${state.ownProxy?.reason ?? ''}`;
+    }
+    function paint() {
+      paintState(); paintNext(); paintControls(); paintReceipts();
+      // An initialized proxy keeps the init form folded after a reload too.
+      if (state.init.initialized) $('proxy-setup-init-box').open = false;
+      const job = state.fetch;
+      if (job.state === 'running') say(`Fetching: ${STEPS[job.step] ?? job.step ?? 'starting'}…`);
+      else if (job.state === 'failed' && seenFetch !== 'failed') { say(`Fetch failed. ${explain(job.error)}`, 'error'); seenFetch = 'failed'; }
+      else if (job.state === 'done' && job.receipt && seenFetch !== job.receipt.time) { seenFetch = job.receipt.time; if (!state.receipts?.some(r => r.op === 'fetch' && r.time === job.receipt.time)) addReceipt(job.receipt); say(`Fetched ${job.receipt.version}; archive, panel and executable hashes verified.`, 'success'); }
+      clearTimeout(timer); timer = null;
+      if (enabled && (job.state === 'running' || state.busy)) timer = setTimeout(load, 1000);
+    }
+    async function load() {
+      if (!enabled || loading) return; loading = true;
+      try { state = await admin('status'); paint(); if (state.init.initialized) await accountsReady(); }
+      catch (error) { say(error.message, 'error'); }
+      finally { loading = false; }
+    }
+    async function act(label, action) {
+      if (!sendOk || state?.busy) return;
+      state = { ...state, busy: label }; paintNext(); paintControls(); say('Working…');
+      try { await action(); } catch (error) { say(error.message, 'error'); } finally { if (state) state = { ...state, busy: null }; await load(); }
+    }
+    const fetchRelease = () => act('fetch', async () => { await admin('fetch', {}); seenFetch = null; say('Fetch started.'); });
+    const clearLock = () => act('init-lock-clear', async () => { const result = await admin('init-lock/clear', {}); addReceipt(result.receipt); say('Stale init lock cleared.', 'success'); });
+    const unitAction = op => act(`unit-${op}`, async () => {
+      const result = await admin(`unit/${op}`, {}); addReceipt(result.receipt);
+      if (op === 'restart' && result.evidence?.confirmed !== true) say('The service restarted but the new process could not be confirmed. The fence stays set.', 'error');
+      else say({ install: 'Proxy service installed.', start: 'Proxy service started and answering.', stop: 'Proxy service stopped.', restart: 'Proxy service restarted; the new process answers.' }[op], 'success');
+    });
+    const clearFence = () => act('fence-clear', async () => { const result = await admin('fence/clear', {}); addReceipt(result.receipt); say(result.cleared ? 'Fence cleared.' : 'The fence was not set.', 'success'); });
+    form.elements.keySource.forEach?.(radio => radio.addEventListener('change', () => { $('proxy-setup-paste').hidden = form.elements.keySource.value !== 'paste'; }));
+    form.addEventListener('submit', event => {
+      event.preventDefault();
+      const f = form.elements, args = {};
+      const pasted = pasteAllowed && f.keySource.value === 'paste', key = f.key.value, confirm = f.confirm.value;
+      f.key.value = ''; f.confirm.value = '';
+      if (!sendOk || state?.busy) return;
+      for (const name of ['port', 'rotateGraceMinutes', 'firstOutputSeconds']) if (f[name].value !== '') args[name] = Number(f[name].value);
+      if (pasted) {
+        if (!key) return say('Type the key in both fields, or choose the generated key.', 'error');
+        if (key !== confirm) return say(explain('proxy-key-mismatch'), 'error');
+        args.key = key; args.confirm = confirm;
+      } else args.generate = true;
+      act('init', async () => {
+        const result = await admin('init', args); addReceipt(result.receipt);
+        $('proxy-setup-init-box').open = false;
+        say(`Initialized on port ${result.settings.port}${args.generate ? ' with a generated key' : ''}. Install and start the service next. Other organizations' buses read the proxy settings when they start: restart a bus before its agents use the proxy.`, 'success');
+        window.MosaicConsole?.attachBus?.($('proxy-setup-bus'), 'Restart this organization\'s bus');
+      });
+    });
+    $('proxy-setup-render').addEventListener('click', async () => {
+      const pre = $('proxy-setup-unit-file');
+      if (!pre.hidden) { pre.hidden = true; return; }
+      try { const result = await admin('unit/render'); pre.textContent = result.text; pre.hidden = false; } catch (error) { say(error.message, 'error'); }
+    });
+    box.querySelectorAll('[data-unit]').forEach(button => button.addEventListener('click', () => { if (!button.disabled) unitAction(button.dataset.unit); }));
+    return {
+      start(config) { enabled = true; sendOk = config.proxyAdminSend === true; box.hidden = false; return load(); },
+      stop() { enabled = false; clearTimeout(timer); timer = null; const f = form.elements; f.key.value = ''; f.confirm.value = ''; },
+    };
+  })();
+  // Panels the not-configured state hides come back once the proxy answers.
+  let accountsShown = true;
+  async function accountsReady() {
+    if (accountsShown) return;
+    try { await refresh(); } catch { return; }
+    accountsShown = true; $('proxy-message').classList.remove('empty');
+    document.querySelectorAll('.settings-model-proxy .panel:not(#proxy-setup), #proxy-refresh').forEach(el => { el.hidden = false; });
+    if (!canWrite) document.querySelectorAll('[aria-labelledby=proxy-signin-title],[aria-labelledby=proxy-apikey-title]').forEach(el => { el.hidden = true; });
+    $('proxy-readonly').hidden = canWrite;
+    message('Accounts and client keys loaded.');
+  }
+  const cleanup = () => { setup.stop(); clearTimeout(poll); login = null; const redirect=$('proxy-login-submit')?.elements.redirect_url, key=$('proxy-apikey')?.elements.key; if(redirect)redirect.value='';if(key)key.value=''; };
   window.addEventListener('pagehide', cleanup, {once:true});
-  let devOwner = false;
+  let devOwner = false, proxyAdmin = false;
   fetch('/api/config', { cache: 'no-store' }).then(r => r.json()).then(config => {
     // F3: an organization's settings writes go with settingsSend (the org Console has no global send).
     canWrite = (config.send === true || config.settingsSend === true) && config.tester !== true && config.user !== true;
@@ -249,8 +452,18 @@ if (document.documentElement.hasAttribute('data-settings-proxy-document') && !lo
     document.querySelectorAll('[data-write]').forEach(fieldset => { fieldset.disabled = !canWrite; });
     $('proxy-readonly').hidden = canWrite;
     if (!canWrite) document.querySelectorAll('[aria-labelledby=proxy-signin-title],[aria-labelledby=proxy-apikey-title]').forEach(el=>el.hidden=true);
+    proxyAdmin = config.proxyAdmin === true;
+    if (proxyAdmin) setup.start(config);
     return refresh();
-  }).then(() => message('Accounts and client keys loaded.')).catch(error => { message(error.message); if(error.message==='The model proxy is not configured for this instance.') { $('proxy-message').classList.add('empty'); $('proxy-readonly').hidden=true; document.querySelectorAll('.settings-model-proxy .panel, #proxy-refresh').forEach(el=>el.hidden=true);
+  }).then(() => message('Accounts and client keys loaded.')).catch(error => { message(error.message);
+    // #1873: on the setup page a stopped proxy hides the account panels like an unconfigured one,
+    // and the setup load brings them back once the service answers.
+    // Any failed read hides them, not only proxy-down: a proxy that is initialized but not yet answering
+    // can fail with another code, and a stale error over an empty table would stay after Start.
+    if (proxyAdmin && error.message !== 'The model proxy is not configured for this instance.') { accountsShown = false; $('proxy-message').classList.add('empty'); $('proxy-readonly').hidden=true; document.querySelectorAll('.settings-model-proxy .panel:not(#proxy-setup), #proxy-refresh').forEach(el=>el.hidden=true); message(error.code === 'proxy-down' ? 'The model proxy is not running yet. Follow the next step under Proxy setup.' : `Accounts could not be read${error.code ? ` (${error.code})` : ''}. Follow the next step under Proxy setup; the account panels return once the proxy answers.`); return; }
+    if(error.message==='The model proxy is not configured for this instance.') { accountsShown = false; $('proxy-message').classList.add('empty'); $('proxy-readonly').hidden=true; document.querySelectorAll('.settings-model-proxy .panel:not(#proxy-setup), #proxy-refresh').forEach(el=>el.hidden=true);
+    // #1873: the owner sets the proxy up on this page (Proxy setup above); no terminal note.
+    if (proxyAdmin) { message('The model proxy is not set up yet. Follow the next step under Proxy setup.'); return; }
     // F3: on a dev instance, say plainly why this page cannot set the proxy up and what does.
     // Setup takes a management key typed twice at a terminal and writes the proxy's credentials;
     // this page never handles that key. Account sign-in (a provider's own OAuth) then runs here.

packages/webui/src/public/org-create.js

@@ -4,6 +4,9 @@
 (() => {
   const $ = id => document.getElementById(id);
   const txt = v => String(v ?? '').replace(/[&<>"']/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
+  // #1873 P1-6: the remote check a repository receipt records, in one plain line.
+  const CHECKED = { reachable: 'reachable', 'needs-credential': 'needs a credential', unreachable: 'unreachable' };
+  const checkLine = r => `Remote check: ${CHECKED[r.check.result] ?? 'unknown'}, ${r.check.message}. Origin: ${r.origin ?? 'none'}.`;
   const ID = /^[a-z0-9][a-z0-9._-]{0,63}$/;
   const markup = `<div id="org-admin" class="org-admin">
 <section class="panel" aria-labelledby="org-start-title" id="org-start">
@@ -34,7 +37,7 @@
 <section id="org-quick" class="panel" hidden aria-labelledby="org-quick-title">
   <h3 id="org-quick-title">Quick Setup</h3>
   <div class="org-field"><label for="org-project">First project name</label><input id="org-project" value="work" autocomplete="off"><span class="org-help">Lowercase letters, digits, dot, dash or underscore.</span></div>
-  <div class="org-field"><label for="org-project-remote">Project remote URL (optional)</label><input id="org-project-remote" type="url" placeholder="https://git.example/team/project"><span class="org-help">Leave blank for local only. The organization checkout is local only.</span></div>
+  <div class="org-field"><label for="org-project-remote">Project remote URL (optional)</label><input id="org-project-remote" type="text" inputmode="url" autocomplete="off" spellcheck="false" placeholder="https://git.example/team/project or git@git.example:team/project.git"><span class="org-help">https or ssh. The project checkout's origin is set to it and checked without a credential; nothing is pushed. Leave blank for local only. The organization checkout is local only.</span></div>
   <label class="org-quick-risk"><input id="org-risk-accept" type="checkbox"> I understand local-only repositories have no copy elsewhere and can be lost.</label>
   <div class="settings-actions"><button type="button" id="org-quick-run">Create and set up organization</button></div>
   <ol id="org-quick-steps" class="org-steps" aria-live="polite"></ol>
@@ -68,13 +71,13 @@
   <button type="button" id="org-archive-open" data-write>Archive organization</button>
   <div id="org-archive-confirm" tabindex="-1" hidden aria-labelledby="org-archive-confirm-title">
     <h4 id="org-archive-confirm-title">Review archive</h4>
-    <ul><li>The organization's bus stops.</li><li>All files stay where they are.</li><li>The organization leaves the switcher.</li><li>Restore brings it back without starting the bus.</li></ul>
+    <ul><li>The organization's bus stops.</li><li>All files stay where they are.</li><li>The organization leaves the switcher.</li><li>Restore brings it back and starts its bus.</li></ul>
     <div class="settings-actions"><button type="button" id="org-archive-cancel" class="org-secondary">Cancel</button><button type="button" id="org-archive-final" data-write>Archive</button></div>
   </div>
 </section>
 <section id="org-archived" class="panel" tabindex="-1" hidden aria-labelledby="org-archived-title">
   <h3 id="org-archived-title">Organization archived</h3>
-  <p>Editing and setup are unavailable while archived. Files remain in place; restoring does not start the bus.</p>
+  <p>Editing and setup are unavailable while archived. Files remain in place; restoring starts the bus again.</p>
   <p id="org-restore-verb" class="org-verb"></p>
   <button type="button" id="org-restore" data-write>Restore organization</button>
 </section>
@@ -302,7 +305,8 @@
       const project = $('org-project').value.trim(), remote = $('org-project-remote').value.trim();
       if (!ID.test(project)) { $('org-project').setAttribute('aria-invalid', 'true'); banner('Enter a valid project name.'); $('org-project').focus(); return; }
       $('org-project').removeAttribute('aria-invalid');
-      if (remote && !/^https:\/\/[^\s/]+\/\S+$/.test(remote)) { banner('Enter an https repository URL or leave it blank.'); $('org-project-remote').focus(); return; }
+      // The server applies the full URL rules (parseRepoRemote); this only catches an obvious slip.
+      if (remote && (/\s/.test(remote) || !/^(https:\/\/|ssh:\/\/|[A-Za-z0-9_][A-Za-z0-9_.-]*@[^/:]+:)/.test(remote))) { banner('Enter an https or ssh repository URL, or leave it blank.'); $('org-project-remote').focus(); return; }
       if (!$('org-risk-accept').checked) { banner('Accept the risk of local-only repositories to continue.'); $('org-risk-accept').focus(); return; }
       const id = st.id, enc = encodeURIComponent, local = { mode: 'local-only', acceptLocalLossRisk: true };
       const steps = [
@@ -340,9 +344,11 @@
           if (step === 'chat-project') quickDone = { org: id, chatProject: result.body.id, repo: project };
           card.querySelector('.org-pill').textContent = 'Done'; card.classList.add('org-step-done');
           if (result.body.verb) card.querySelector('code').textContent = result.body.verb;
+          if (step === 'project' && result.body.receipt?.check) card.querySelector('.org-verb').insertAdjacentHTML('afterend', `<p class="org-help" data-remote-check>${txt(checkLine(result.body.receipt))}</p>`);
         }
         editorDirty = false; $('org-new-id').value = ''; $('org-quick-open-org').hidden = false; $('org-quick-interview').hidden = !window.MosaicOnboarding; status('Organization setup complete.');
-        await refreshList();
+        // E1 (P1-5): the sidebar and header list the new organization without a reload.
+        await refreshOrganizations();
       } catch (e) {
         const card = list.children[Math.min(current, steps.length - 1)];
         card.querySelector('.org-pill').textContent = 'Stopped'; card.querySelector('.org-field-err').textContent = current === 4
@@ -350,7 +356,7 @@
           : `${e.message} Open the organization to inspect and continue; do not repeat a step whose outcome is unknown.`;
         if (current >= 4) { editorDirty = false; $('org-new-id').value = ''; $('org-quick-open-org').hidden = false; }
         card.classList.add('org-step-warn'); card.focus(); status('Setup stopped.');
-        await refreshList();
+        await refreshOrganizations();
       }
     }
     async function openExisting(id, { toSetup = false } = {}) {
@@ -450,13 +456,14 @@
           <div class="org-step-head"><h4 id="org-step-${i}-title"><span class="org-step-n">${i + 1}</span> ${txt(title)}</h4><span class="org-pill ${cls}">${txt(stateLabel)}</span></div>
           <p class="org-verb">Same as <code>${txt(s.verb || '')}</code></p>
           ${s.message ? `<p class="org-help">${txt(s.message)}</p>` : ''}
+          ${key.startsWith('project:') && s.receipt?.check ? `<p class="org-help" data-remote-check>${txt(checkLine(s.receipt))}</p>` : ''}
           ${s.lastError ? `<p class="org-field-err" role="alert">${txt(s.lastError)}</p>` : ''}
           ${s.receipt ? `<details${s.state === 'done' ? '' : ' open'}><summary>${key === 'bus' ? 'Bus status' : 'Receipt'}</summary><pre class="org-pre">${txt(JSON.stringify(s.receipt, null, 2))}</pre></details>` : ''}
           ${s.state === 'unknown' ? `<div class="settings-actions"><button type="button" class="org-secondary" data-readback="${txt(key)}">Read back</button><span class="org-help">Retry stays off until the step is read back.</span></div>` : ''}
           ${s.state !== 'done' && s.state !== 'unknown' && git ? `<fieldset class="org-git" ${ready && canWrite ? '' : 'disabled'}><legend>Where the history lives</legend>
               <label><input type="radio" name="${name}" value="local-only"${remote ? '' : ' checked'}> Local only, on this machine</label>
               <label><input type="radio" name="${name}" value="remote"${remote ? ' checked' : ''}> Remote</label>
-              <div class="org-remote"${remote ? '' : ' hidden'}><label for="${name}-remote">Remote repository URL</label><input id="${name}-remote" type="url" inputmode="url" data-remote autocomplete="off" spellcheck="false" placeholder="https://git.example/owner/repo" value="${txt(c.remote || '')}" aria-describedby="${name}-remote-help"${remote && s.lastError ? ' aria-invalid="true"' : ''}><span id="${name}-remote-help" class="org-help">An https URL. It is recorded in the receipt and the organization file; nothing is pushed.</span></div>
+              <div class="org-remote"${remote ? '' : ' hidden'}><label for="${name}-remote">Remote repository URL</label><input id="${name}-remote" type="text" inputmode="url" data-remote autocomplete="off" spellcheck="false" placeholder="https://git.example/owner/repo or git@git.example:owner/repo.git" value="${txt(c.remote || '')}" aria-describedby="${name}-remote-help"${remote && s.lastError ? ' aria-invalid="true"' : ''}><span id="${name}-remote-help" class="org-help">An https or ssh URL. The checkout's origin is set to it and checked without a credential; the result is in the receipt. Nothing is pushed.</span></div>
               <label class="org-risk"${remote ? ' hidden' : ''}><input type="checkbox" data-risk${c.risk ? ' checked' : ''}${!remote && s.lastError && !c.risk ? ' aria-invalid="true"' : ''}> I accept that a local-only history has no copy anywhere else and is lost with this disk.</label>
               <div class="settings-actions"><button type="button" data-run="${txt(key)}">${busy ? 'Working… <span class="settings-spinner" aria-hidden="true"></span>' : key === 'queue' ? 'Set up checkout' : 'Set up repository'}</button></div>
             </fieldset>` : ''}
@@ -513,7 +520,7 @@
     // The "Same as" line follows the choice in the card.
     function showVerb(card) {
       const key = card.dataset.step; if (key === 'bus') return;
-      const o = stepOptions(card), tail = o.mode === 'remote' ? `--remote ${o.remote || '<https-url>'}` : '--local-only --accept-local-loss-risk';
+      const o = stepOptions(card), tail = o.mode === 'remote' ? `--remote ${o.remote || '<repository-url>'}` : '--local-only --accept-local-loss-risk';
       const code = card.querySelector('.org-verb code'); if (!code) return;
       code.textContent = key === 'queue' ? `mosaic org queue init ${st.id} ${tail}` : `mosaic org project repo init ${st.id} ${key.slice(8)} ${tail}`;
     }
@@ -549,6 +556,37 @@
       const hash = next ? `#/orgs/${encodeURIComponent(next.id)}/settings/organizations` : '#/settings/organizations';
       history.replaceState(null, '', hash); location.reload(); return true;
     }
+    // E1 (P1-4): a restore also starts the bus (org-admin.mjs restoreBus). One receipt names both
+    // results; a bus that did not start says why and offers Restart bus for this organization.
+    const RESTORED = 'mosaic-org-restored:';
+    function keepRestored(id, bus) { try { sessionStorage.setItem(RESTORED + id, JSON.stringify(bus ?? null)); } catch { /* the reloaded page shows the bus state only */ } }
+    function takeRestored(id) {
+      try { const v = sessionStorage.getItem(RESTORED + id); sessionStorage.removeItem(RESTORED + id); return v === null ? undefined : JSON.parse(v); } catch { return undefined; }
+    }
+    function restoredReceipt(id, bus) {
+      const check = `mosaic bus status ${id}`, known = bus && typeof bus === 'object';
+      const line = !known ? `The bus outcome is unknown. Check it with ${check}.`
+        : bus.outcome === 'done' ? (bus.existing ? 'Its bus was already running.' : `Bus started. ${bus.healthy ? 'It answers.' : `It has not answered yet. Check it with ${check}.`}`)
+        : `The bus did not start: ${bus.message || 'no reason was given.'}`;
+      const offer = (!known || bus.outcome !== 'done') && canWrite;
+      const box = $('org-archive-success');
+      box.innerHTML = `<p>Organization restored. ${txt(line)}</p>${known && bus.verb ? `<p class="org-verb">Same as <code>${txt(bus.verb)}</code></p>` : ''}${offer ? `<p><button type="button" data-restore-bus="${txt(id)}">Restart bus</button> <span role="status" data-restore-bus-receipt></span></p>` : ''}`;
+      box.hidden = false; box.focus();
+    }
+    // Restart bus for the restored organization, the same route as the dashboard's (console-restart.js).
+    async function restartRestored(e) {
+      const button = e.target.closest('[data-restore-bus]'); if (!button || button.disabled) return;
+      const id = button.dataset.restoreBus, out = button.parentElement.querySelector('[data-restore-bus-receipt]');
+      button.disabled = true; button.textContent = 'Restarting…'; out.textContent = '';
+      let r = null; try { r = await api('POST', `/api/orgs/${encodeURIComponent(id)}/restart/bus`, {}); } catch { r = null; }
+      if (!alive) return;
+      const done = r?.status === 200 && r.body.outcome === 'done' && r.body.step === 'bus-restart';
+      out.textContent = !r ? `Outcome unknown. Check the bus with mosaic bus status ${id} before retrying.`
+        : done ? `${r.body.recovered ? 'Dead bus host cleared; bus started' : r.body.restarted ? 'Bus restarted' : 'Bus started'}. ${r.body.healthy ? 'It answers.' : `It has not answered yet. Check it with mosaic bus status ${id}.`}`
+        : (r.body.message || 'The restart was refused. Nothing was retried.');
+      button.textContent = 'Restart bus'; button.disabled = done && r.body.healthy === true;
+      if (done) await refreshOrganizations();
+    }
     async function runLifecycle(step) {
       const id = st.id, revision = st.revision, button = $(step === 'archive' ? 'org-archive-final' : 'org-restore');
       button.disabled = true; if (step === 'archive') button.textContent = 'Archiving…'; $('org-archive-error').textContent = '';
@@ -558,11 +596,11 @@
         if (!verifiedReply(reply, step)) throw Error('unknown lifecycle outcome');
         const rows = await refreshOrganizations();
         if (step === 'archive' && switchIfCurrentRemoved(id, rows)) return;
-        if (step === 'restore' && !window.MosaicOrg) { history.replaceState(null, '', `#/orgs/${encodeURIComponent(id)}/settings/organizations`); location.reload(); return; }
+        // The page reloads into the restored organization; its receipt is kept for that page to show.
+        if (step === 'restore' && !window.MosaicOrg) { keepRestored(id, reply.body.bus); history.replaceState(null, '', `#/orgs/${encodeURIComponent(id)}/settings/organizations?org=${encodeURIComponent(id)}`); location.reload(); return; }
         await openExisting(id);
-        if (step === 'restore') {
-          const box = $('org-archive-success'); box.textContent = 'Organization restored. The bus remains stopped.'; box.hidden = false; box.focus();
-        } else $('org-archived').focus();
+        if (step === 'restore') restoredReceipt(id, reply.body.bus);
+        else $('org-archived').focus();
         status(`Organization ${step === 'archive' ? 'archived' : 'restored'}.`);
       } catch {
         if (step === 'archive') button.textContent = 'Archive';
@@ -615,6 +653,7 @@
       [$('org-archive-cancel'), 'click', () => { resetArchive(); $('org-archive-open').focus(); }],
       [$('org-archive-final'), 'click', () => runLifecycle('archive')],
       [$('org-restore'), 'click', () => runLifecycle('restore')],
+      [$('org-archive-success'), 'click', restartRestored],
       [$('org-delete-open'), 'click', () => { $('org-delete-open').hidden = true; $('org-delete-first').hidden = false; $('org-delete-first').focus(); }],
       [$('org-delete-cancel'), 'click', cancelDelete],
       [$('org-delete-cancel-second'), 'click', cancelDelete],
@@ -643,6 +682,9 @@
       [$('org-steps'), 'input', e => { const card = e.target.closest('.org-step'); if (card && e.target.matches('[data-remote]')) { keepChoice(card); showVerb(card); } }],
     ];
     for (const [el, ev, fn] of handlers) el.addEventListener(ev, fn);
+    // A restore receipt carried across the reload is taken now, before anything below can fail, so a
+    // later visit never shows it again.
+    const carried = (() => { const o = query().get('org'); return o && ID.test(o) ? takeRestored(o) : undefined; })();
     fetch(new URL('/api/config', location.href), { cache: 'no-store' }).then(r => r.json()).then(async config => {
       if (!alive) return;
       canWrite = (config.orgSetup === true || config.send === true) && config.tester !== true && config.user !== true;
@@ -655,6 +697,7 @@
       // Resume: ?org=ID reopens the organization and its setup, read back from the server.
       if (org && ID.test(org)) {
         await openExisting(org, { toSetup: setup });
+        if (carried !== undefined) restoredReceipt(org, carried);
         if (created && st.setup?.notifications?.receipt) showReceipt('Organization created', st.setup.notifications);
         if (setup) focusFirstOpen();
       }

packages/webui/src/public/project-remote.css

@@ -3,3 +3,17 @@
 .project-remote input { box-sizing: border-box; width: 100%; min-height: 44px; }
 .project-remote button { min-height: 44px; justify-self: start; }
 .project-remote [role="status"] { overflow-wrap: anywhere; }
+/* #1873 P1-7: an organization project's repository (project-remote.js MosaicProjectRepo). */
+.project-repo fieldset { border: 0; margin: 0; padding: 0; display: grid; gap: .5rem; }
+.project-repo legend { font-weight: 600; margin-bottom: .25rem; }
+.project-repo-option { display: flex; align-items: flex-start; gap: .5rem; min-height: 44px; }
+.project-repo-option input { margin-top: .2rem; width: 20px; height: 20px; flex: none; }
+.project-repo-option span { display: flex; flex-direction: column; min-width: 0; }
+.project-repo-option small { color: var(--muted, inherit); }
+.project-repo-facts { display: grid; grid-template-columns: max-content minmax(0, 1fr); gap: .25rem 1rem; margin: 0 0 1rem; }
+.project-repo-facts dt { font-weight: 600; }
+.project-repo-facts dd { margin: 0; overflow-wrap: anywhere; }
+.project-repo-drift { margin: 0 0 1rem; padding: .5rem .75rem; border-left: 3px solid var(--warning, currentColor); }
+.project-repo [role="status"]:empty { display: none; }
+.project-repo [role="status"]:focus { outline: none; }
+@media (max-width: 480px) { .project-repo-facts { grid-template-columns: minmax(0, 1fr); } .project-repo-facts dd { margin-bottom: .5rem; } }

packages/webui/src/public/project-remote.js

@@ -103,3 +103,143 @@
   }
   window.MosaicProjectRemote = { mount };
 })();
+
+/* #1873 P1-7: an organization project's repository on its Settings tab, the owner's. It reads and
+   changes the binding through /api/orgs/ORG/repo/project/P, which is `mosaic org project repo set`:
+   https or ssh, the same check as setup, origin follows, nothing is pushed, a receipt records it.
+   The server and the organization service recheck every write; a control shown here grants nothing. */
+(() => {
+  'use strict';
+  const esc = value => String(value ?? '').replace(/[&<>"']/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+  const enc = encodeURIComponent;
+  const ID = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+  const LINES = {
+    'sign-in-required': 'Sign in again to see or change the repository.',
+    'owner-only': "The repository setting is the organization owner's.",
+    'read-only': 'This Console only reads. Changing the repository needs signed-in send mode.',
+    'revision-conflict': 'The organization changed after this page read it. The setting was read again; your entry is kept. Check it and save again.',
+    'risk-not-accepted': 'Tick the box to accept that a local-only repository has no copy anywhere else.',
+    'org-risk': 'Tick the box to accept that a local-only repository has no copy anywhere else.',
+    'org-inactive': 'This organization is not active, so its repository cannot be changed.',
+    'org-unavailable': 'This organization is not available.',
+    'project-unknown': 'This project was not found in the organization.',
+    'not-configured': 'Changing the repository is not available on this Console.',
+    'readback-failed': 'The repository could not be read back, so nothing was changed. Inspect it with the show command.',
+    'project-repo-bound': 'A copy binding still grants this project. Revoke that copy binding first, then set the repository, then ask the chief to raise a new binding decision.',
+    'outcome-unknown': 'The outcome is unknown. The setting was read again; check it before you retry.',
+  };
+  const CHECK = { reachable: 'Reachable', 'needs-credential': 'Needs a credential', unreachable: 'Unreachable' };
+  const checkLine = check => check && CHECK[check.result] ? `${CHECK[check.result]}: ${check.message}.` : null;
+
+  async function call(path, body) {
+    const init = body === undefined ? { cache: 'no-store', redirect: 'manual' }
+      : { method: 'POST', cache: 'no-store', redirect: 'manual', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) };
+    let response;
+    try { response = await fetch(path, init); } catch { return { ok: false, code: 'outcome-unknown' }; }
+    if (response.type === 'opaqueredirect') return { ok: false, code: 'sign-in-required' };
+    const value = await response.json().catch(() => null);
+    if (!response.ok) return { ok: false, code: typeof value?.error === 'string' ? value.error : 'outcome-unknown', message: value?.errors?.[0]?.message || value?.message || null };
+    return value && typeof value === 'object' ? { ok: true, value } : { ok: false, code: 'outcome-unknown' };
+  }
+  // A refusal the server explained (the URL rules, a missing setup) keeps its own words.
+  const refusalLine = r => (['invalid', 'org-invalid', 'project-repo-bound'].includes(r.code) && r.message) ? r.message : LINES[r.code] || LINES['outcome-unknown'];
+
+  let active = null;
+  document.addEventListener('mosaic-signed-out', () => { active?.dispose(); active = null; });
+  window.addEventListener('hashchange', () => { if (active) active.stale = true; });
+  function mount({ container, project, archived = false }) {
+    if (!(container instanceof Element)) return;
+    const org = window.MosaicOrg?.id ?? null;
+    if (active && active.org === org && active.project === project) {
+      container.replaceChildren(active.section);
+      if (active.archived !== archived) { active.archived = archived; active.paint(); }
+      if (active.stale) { active.stale = false; active.refresh(); }
+      return;
+    }
+    active?.dispose();
+    const section = document.createElement('section');
+    section.className = 'project-remote project-repo';
+    section.setAttribute('data-project-repo', '');
+    container.replaceChildren(section);
+    let value = null, code = null, outcome = '', saving = false, disposed = false, generation = 0;
+    let draft = null; // { mode, remote, risk } once the owner touches the form
+    const state = { org, project, section, archived, stale: false, paint, refresh: () => refresh(), dispose: () => { disposed = true; generation++; section.replaceChildren(); } };
+    active = state;
+    const path = () => `/api/orgs/${enc(org)}/repo/project/${enc(project)}`;
+    function form() {
+      const cur = value.current;
+      const d = draft ?? { mode: cur.mode, remote: cur.remote ?? '', risk: false };
+      const off = saving ? ' disabled' : '';
+      const remote = d.mode === 'remote';
+      return `<form data-project-repo-form><fieldset><legend>Where the repository lives</legend>`
+        + `<label class="project-repo-option"><input type="radio" name="repo-mode" value="remote"${remote ? ' checked' : ''}${off}><span><strong>Remote</strong><small>The checkout's origin points at this URL and is checked. Nothing is pushed.</small></span></label>`
+        + `<label class="project-repo-option"><input type="radio" name="repo-mode" value="local-only"${remote ? '' : ' checked'}${off}><span><strong>Local only</strong><small>No origin. The repository has no copy anywhere else.</small></span></label></fieldset>`
+        + (remote
+          ? `<label for="project-repo-url">Repository URL (https or ssh)</label><input id="project-repo-url" name="repo-url" type="text" inputmode="url" autocomplete="off" spellcheck="false" maxlength="512" placeholder="https://git.example/owner/repo or [email protected]:owner/repo.git" value="${esc(d.remote)}"${off}>`
+          : `<label class="project-repo-option"><input type="checkbox" name="repo-risk"${d.risk ? ' checked' : ''}${off}><span>I accept that a local-only repository has no copy anywhere else.</span></label>`)
+        + `<button type="submit" class="btn"${off}>${saving ? 'Saving…' : 'Save repository'}</button></form>`;
+    }
+    function paint() {
+      if (disposed) return;
+      const head = '<h2 tabindex="-1">Repository</h2>';
+      const status = `<p role="status" tabindex="-1" data-project-repo-status>${esc(outcome)}</p>`;
+      if (!org || !ID.test(project ?? '')) { section.innerHTML = `${head}<p>${org && !project ? 'This project is not linked to a repository in the organization.' : 'Repository setting unavailable.'}</p>`; return; }
+      if (!value) { section.innerHTML = `${head}<p>${esc(code ? `Repository setting unavailable. ${LINES[code] || LINES['outcome-unknown']}` : 'Reading the repository setting…')}</p>${status}`; return; }
+      if (value.state === 'missing') { section.innerHTML = `${head}<p>This project has no repository yet. Set it up from the organization's Quick Setup, or with <code>${esc(value.verb)}</code>.</p>${status}`; return; }
+      const cur = value.current;
+      const facts = `<dl class="project-repo-facts"><dt>Mode</dt><dd data-repo-mode>${cur.mode === 'remote' ? 'Remote' : 'Local only'}</dd>`
+        + `<dt>Repository URL</dt><dd data-repo-url>${cur.mode === 'remote' ? esc(cur.remote) : 'None (local only)'}</dd>`
+        + `<dt>Git origin</dt><dd data-repo-origin>${cur.origin ? esc(cur.origin) : 'None'}</dd>`
+        + `<dt>Last check</dt><dd data-repo-check>${cur.mode === 'remote' ? esc((cur.check?.url === cur.remote && checkLine(cur.check)) || 'Not recorded for this URL') : 'None (local only has no remote)'}</dd></dl>`;
+      // origin and the recorded binding disagree when a save stopped between setting origin and
+      // recording it; saving again repairs it.
+      const drift = (cur.mode === 'remote' ? cur.origin !== cur.remote : cur.origin != null)
+        ? '<p class="project-repo-drift" role="note" data-repo-drift>Git origin differs from the recorded repository; save it again to repair.</p>' : '';
+      const verb = `<p class="muted">Same as <code data-repo-verb>${esc(value.verb)}</code></p>`;
+      const why = state.archived ? '<p class="muted">This project is archived; its repository is shown read only.</p>' : '';
+      section.innerHTML = `${head}${facts}${drift}${state.archived ? '' : form()}${why}${status}${verb}`;
+    }
+    async function refresh() {
+      if (!org || !ID.test(project ?? '')) return;
+      const turn = ++generation;
+      const result = await call(path());
+      if (disposed || turn !== generation) return;
+      if (result.ok && (result.value.state === 'missing' || (result.value.state === 'done' && result.value.current))) { value = result.value; code = null; } else { value = null; code = result.ok ? 'outcome-unknown' : result.code; }
+      paint();
+    }
+    const focusUrl = () => section.querySelector('#project-repo-url')?.focus();
+    section.addEventListener('change', e => {
+      if (!value?.current) return;
+      const d = draft ?? { mode: value.current.mode, remote: value.current.remote ?? '', risk: false };
+      if (e.target.name === 'repo-mode') { draft = { ...d, mode: e.target.value }; paint(); section.querySelector(`input[name="repo-mode"][value="${e.target.value}"]`)?.focus(); }
+      else if (e.target.name === 'repo-risk') draft = { ...d, risk: e.target.checked };
+    });
+    section.addEventListener('input', e => {
+      if (e.target.name !== 'repo-url' || !value?.current) return;
+      draft = { ...(draft ?? { mode: value.current.mode, remote: '', risk: false }), remote: e.target.value };
+    });
+    section.addEventListener('submit', async e => {
+      e.preventDefault();
+      if (saving || !value?.current || state.archived) return;
+      const d = draft ?? { mode: value.current.mode, remote: value.current.remote ?? '', risk: false };
+      const remote = d.mode === 'remote' ? d.remote.trim() : '';
+      if (d.mode === 'remote' && !remote) { outcome = 'Enter a repository URL, or choose Local only.'; paint(); focusUrl(); return; }
+      if (d.mode === 'local-only' && !d.risk) { outcome = LINES['risk-not-accepted']; paint(); section.querySelector('input[name="repo-risk"]')?.focus(); return; }
+      const body = d.mode === 'remote' ? { mode: 'remote', remote, ifRevision: value.current.revision } : { mode: 'local-only', acceptLocalLossRisk: true, ifRevision: value.current.revision };
+      saving = true; outcome = ''; paint();
+      const result = await call(path(), body);
+      if (disposed) return;
+      saving = false;
+      if (result.ok && result.value.receipt) {
+        const r = result.value.receipt, check = checkLine(result.value.check);
+        outcome = `Saved${r.at ? ` at ${r.at}` : ''}. ${r.mode === 'remote' ? `Origin is ${r.origin ?? 'not set'}.` : r.origin == null ? 'Origin removed; local only.' : `Origin is still ${r.origin}.`}${check ? ` Check: ${check}` : ''} Nothing was pushed.`;
+        draft = null;
+      } else outcome = refusalLine(result);
+      await refresh();
+      section.querySelector('[data-project-repo-status]')?.focus({ preventScroll: true });
+    });
+    paint();
+    if (org && ID.test(project ?? '')) refresh();
+  }
+  window.MosaicProjectRepo = Object.freeze({ mount });
+})();

packages/webui/src/public/shell.css

@@ -103,6 +103,13 @@ table.s1-table td code{font-size:12.5px;white-space:nowrap}
 .agent-restart{display:inline-flex;flex-wrap:wrap;gap:6px 10px;align-items:center;min-width:0}
 .agent-restart [role=status]:empty{display:none}
 #proxy-dev-setup pre{overflow-x:auto;max-width:100%}
+/* #1873 proxy setup */
+.proxy-setup-state{display:grid;grid-template-columns:max-content minmax(0,1fr);gap:6px 16px;margin:0 0 12px}.proxy-setup-state dt{color:var(--muted);font-weight:600}.proxy-setup-state dd{margin:0;overflow-wrap:anywhere}
+.proxy-setup-next{display:flex;flex-wrap:wrap;align-items:center;gap:8px 16px;margin:0 0 12px}.proxy-setup-next p{margin:0;flex:1 1 280px}
+.proxy-setup-buttons{display:flex;flex-wrap:wrap;gap:8px}.proxy-setup-buttons button{min-height:44px}
+#proxy-setup pre{overflow-x:auto;max-width:100%;font-size:12px}#proxy-setup h3{margin:16px 0 4px}#proxy-setup details{margin:0 0 12px}#proxy-setup summary{min-height:44px;display:flex;align-items:center;cursor:pointer}
+#proxy-setup-receipts{padding-left:20px;overflow-wrap:anywhere;font-size:13px}
+@media(max-width:479px){.proxy-setup-state{grid-template-columns:1fr}.proxy-setup-state dd{margin-bottom:6px}}
 /* Stream S4: which organization this is, in words. Colour (the theme) is never the only cue; the strip appears whenever the theme is not the built-in one. */
 .org-cue{margin:0 0 12px;padding:6px 10px;border:1px solid var(--line);border-left:4px solid var(--action);border-radius:var(--r-table);background:var(--raised);color:var(--text);font-size:13px;overflow-wrap:anywhere}.skel-rows{display:grid;gap:10px;padding:14px 12px;border:1px solid var(--line);border-radius:var(--r-table);background:var(--surface)}
 .skel{display:block;height:12px;border-radius:4px;background:var(--raised);animation:skel 1.4s ease-in-out infinite}

packages/webui/src/serve.mjs

@@ -1,5 +1,6 @@
 import { AUTONOMY_ROUTE, autonomyHTTP } from './autonomy-http.mjs';
 import { proxyHTTP } from './proxy-http.mjs';
+import { proxyAdminHTTP } from './proxy-admin.mjs';
 import { createServer } from 'node:http';
 import { bindTesterSocket, TESTER_ORIGIN } from './tester-socket.mjs';
 import { readFileSync, openSync, fstatSync, closeSync, constants } from 'node:fs';
@@ -795,7 +796,7 @@ async function libraryStatusRead(res, read, search) {
 // `log` takes one line per send attempt that got past sign-in; never the body. `fieldsFile` is for
 // tests; the field table is otherwise the committed packages/tasks/fields.json.
 // `agentWrite` (row 194, D7) is `(verb, args) => Promise` for the Agents section's verbs and instance.request.
-export async function startServer({ host = '127.0.0.1', port = 7330, board = DEFAULT_BOARD, timeout = 20000, bus = null, reads = null, preview = null, sso = null, tester = false, testerSocket = null, testerAuthHeader = null, proof = null, testerProofHeader = null, send = null, settingsWrite = null, projectFiles = null, projectFile = null, projectSave = null, libraryStatus = null, libraryRevert = null, chat = null, nameWrite = null, assistantStop = null, instancesWrite = null, routesWrite = null, agentWrite = null, proxyCall = null, processing = null, decisionWrite = null, requestRead = null, requestWrite = null, systemTypesWrite = null, userOptions = null, federation = null, organizations = null, preselect = null, routes = [], orgAdmin = null, devAllowHosts = [], log = line => console.log(line), fieldsFile = undefined, restart = null, trail = null, boot = randomUUID(), workspaceTimeoutMs = undefined, agentLevels = null } = {}) {
+export async function startServer({ host = '127.0.0.1', port = 7330, board = DEFAULT_BOARD, timeout = 20000, bus = null, reads = null, preview = null, sso = null, tester = false, testerSocket = null, testerAuthHeader = null, proof = null, testerProofHeader = null, send = null, settingsWrite = null, projectFiles = null, projectFile = null, projectSave = null, libraryStatus = null, libraryRevert = null, chat = null, nameWrite = null, assistantStop = null, instancesWrite = null, routesWrite = null, agentWrite = null, proxyCall = null, proxyAdmin = null, processing = null, decisionWrite = null, requestRead = null, requestWrite = null, systemTypesWrite = null, userOptions = null, federation = null, organizations = null, preselect = null, routes = [], orgAdmin = null, devAllowHosts = [], log = line => console.log(line), fieldsFile = undefined, restart = null, trail = null, boot = randomUUID(), workspaceTimeoutMs = undefined, agentLevels = null } = {}) {
   // org-lan-bind: the dev owner on the LAN is an explicit opt-in. `devAllowHosts` names the Host
   // names (without a port) a remote browser may use; only the dev owner takes them, and only with
   // them may it bind a non-loopback IPv4 address. SSO, preview and tester listeners stay loopback.
@@ -828,7 +829,7 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
   for (const registerRoutes of routes) registerRoutes(registered);
   registered.add('GET', '/api/themes', (req, res) => themesHTTP(req, res, { log }), { publicRead: true });
   const adminRoute = (req, res, context) => orgAdminHTTP(req, res, { ...context, admin: orgAdmin ??= defaultOrgAdmin(), log, trail });
-  for (const path of ['/api/org-template', '/api/org-presets', '/api/org-validate', '/api/org-admin', /^\/api\/orgs\/[^/]+\/(?:admin|setup|delete|archive|restore|restart|stop)(?:\/(?:queue|bus|project\/[^/]+|records\/[^/]+))?$/]) {
+  for (const path of ['/api/org-template', '/api/org-presets', '/api/org-validate', '/api/org-admin', /^\/api\/orgs\/[^/]+\/(?:admin|setup|repo|delete|archive|restore|restart|stop)(?:\/(?:queue|bus|project\/[^/]+|records\/[^/]+))?$/]) {
     for (const method of ['GET', 'POST']) registered.add(method, path, adminRoute);
   }
   registered.add('POST', '/api/orgs', adminRoute);
@@ -957,6 +958,8 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
         bus = reads = send = settingsWrite = projectFiles = projectFile = projectSave = libraryStatus = libraryRevert = chat = nameWrite = assistantStop = instancesWrite = routesWrite = agentWrite = proxyCall = processing = decisionWrite = requestRead = requestWrite = systemTypesWrite = autonomyWrite = upstream = null;
       }
       if (session?.user !== undefined && !session.rootOwner && !instanceAction) {
+        // #1873: proxy setup answers a grant holder the way the bus answers an agent.
+        if (path.startsWith('/api/proxy/admin/')) return json(res, 403, { error: 'human-required' });
         if (!organizations && !userRoute(path, req.method)) return json(res, 403, { error: 'owner-only', message: 'this part of the Console is the business owner\'s' });
         if (!organizations && userOptions === null) return json(res, 503, { error: 'not-configured', message: 'the Console has no user transport' });
         if (!organizations) ({ bus, send, settingsWrite, projectFiles, projectFile, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite, agentWrite, processing } = userOptions(session));
@@ -1022,6 +1025,11 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
         res.writeHead(303, { location: '/#/settings/model-proxy', 'cache-control': 'no-store' });
         return res.end();
       }
+      // #1873: proxy setup. Instance-wide host actions (fetch, unit) and the init and fence verbs on
+      // the selected bus; only the instance owner's own session reaches them, never an org owner.
+      if (path.startsWith('/api/proxy/admin/')) return proxyAdminHTTP(req, res, { path, admin: proxyAdmin, call: proxyCall, named, tester, granted,
+        owner: !tester && !granted && named && sso !== null && currentSession?.rootOwner === true, send: owner.send !== null,
+        origin: sso ? (localOrigin ?? sso.publicOrigin) : `https://${preview.host}`, user: signer?.user, log });
       if (path.startsWith('/api/proxy/')) return proxyHTTP(req, res, { path, call: proxyCall, named, tester, granted,
         send, origin: sso ? (localOrigin ?? sso.publicOrigin) : `https://${preview.host}`, user: signer?.user, log });
     }
@@ -1211,7 +1219,7 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
     // `send`: the page shows the composer only where a send can pass (the public name, --send on).
     // `edit`: the editor shows Save only where a save can pass, the same test as the route's.
     // `user` and `federation` (FED R6) only when there is one, so the owner's config is unchanged.
-    if (path === '/api/config') return json(res, 200, { board: upstream, ...(organizations && preselect ? { preselect } : {}), ...(tester ? { tester: true } : {}), ...(sso ? { sso: true } : {}), ...(sso?.devOwner ? { devOwner: true } : {}), ...(granted ? { user: true, chatGrants } : {}), ...(!tester && !granted && named && sso !== null && requestRead ? { requests: true, requestWrites: Boolean(send && requestWrite), workspaceFiles: true, projectRemotes: true, projectRemoteWrites: Boolean(send && requestWrite) } : {}), ...(hub ? { federation: hub } : {}), ...(organizations ? { orgSetup: !tester && !granted && named && sso !== null && owner.send !== null } : {}), send: !organizations && !tester && Boolean(send) && named, ...(organizations && orgId ? { chatSend: !tester && Boolean(send) && named && orgBusHealthy, settingsSend: !tester && !granted && Boolean(send) && named && orgBusHealthy } : {}), boot, consoleRestart: !tester && named && currentSession?.instanceRole === 'operator' && owner.send !== null && restart !== null && trail !== null, decide: (!organizations || (orgId !== null && orgBusHealthy)) && !tester && !granted && Boolean(send) && Boolean(decisionWrite) && named && sso !== null, edit: !organizations && !tester && !granted && Boolean(send) && Boolean(projectSave) && named, northStarApprove: (!organizations || (orgId !== null && orgBusHealthy)) && !tester && !granted && Boolean(send) && Boolean(projectSave) && Boolean(projectFile) && named });
+    if (path === '/api/config') return json(res, 200, { board: upstream, ...(organizations && preselect ? { preselect } : {}), ...(tester ? { tester: true } : {}), ...(sso ? { sso: true } : {}), ...(sso?.devOwner ? { devOwner: true } : {}), ...(granted ? { user: true, chatGrants } : {}), ...(!tester && !granted && named && sso !== null && requestRead ? { requests: true, requestWrites: Boolean(send && requestWrite), workspaceFiles: true, projectRemotes: true, projectRemoteWrites: Boolean(send && requestWrite) } : {}), ...(hub ? { federation: hub } : {}), ...(organizations ? { orgSetup: !tester && !granted && named && sso !== null && owner.send !== null } : {}), ...(proxyAdmin && !tester && !granted && named && sso !== null && currentSession?.rootOwner === true ? { proxyAdmin: true, proxyAdminSend: owner.send !== null } : {}), send: !organizations && !tester && Boolean(send) && named, ...(organizations && orgId ? { chatSend: !tester && Boolean(send) && named && orgBusHealthy, settingsSend: !tester && !granted && Boolean(send) && named && orgBusHealthy } : {}), boot, consoleRestart: !tester && named && currentSession?.instanceRole === 'operator' && owner.send !== null && restart !== null && trail !== null, decide: (!organizations || (orgId !== null && orgBusHealthy)) && !tester && !granted && Boolean(send) && Boolean(decisionWrite) && named && sso !== null, edit: !organizations && !tester && !granted && Boolean(send) && Boolean(projectSave) && named, northStarApprove: (!organizations || (orgId !== null && orgBusHealthy)) && !tester && !granted && Boolean(send) && Boolean(projectSave) && Boolean(projectFile) && named });
     if (path === '/healthz') return json(res, 200, { ok: true, ...(sso ? { sso: sso.health() } : {}) });
     if (path === '/favicon.ico') { res.writeHead(204); return res.end(); }
     const file = files.get(path);

packages/webui/tests/org-admin.test.mjs

@@ -31,6 +31,8 @@ function fakes() {
     queueInit: async (ctx, id, opts) => { calls.push(['queueInit', id, opts]); const o = get(id); if (o.queue) throw new OrgError('org-exists', 'repository was already initialized; inspect its receipt'); if (opts.mode === 'local-only' && opts.acceptLocalLossRisk !== true) throw new OrgError('org-risk', 'local-only needs the explicit risk'); o.queue = receipt('org.queue.init', id, { mode: opts.mode }); if (fail.queue) throw new Error('lost'); return o.queue; },
     projectRepoShow: async (ctx, id, project) => { const o = get(id); if (!o.doc.projects?.[project]) throw new OrgError('org-unknown', 'unknown project'); const r = o.repos[project]; if (!r) throw new OrgError('org-unavailable', 'setup receipt unavailable'); return r; },
     projectRepoInit: async (ctx, id, project, opts) => { calls.push(['projectRepoInit', id, project, opts]); const o = get(id); if (fail.project === 'before') throw new Error('crashed'); o.repos[project] = receipt('org.project.repo.init', id, { project, mode: opts.mode }); if (fail.project === 'after') throw new Error('timeout'); return o.repos[project]; },
+    // #1873 P1-7: like C2 projectRepoSet, the revision guards the change and origin follows the mode.
+    projectRepoSet: async (ctx, id, project, opts) => { calls.push(['projectRepoSet', id, project, opts]); const o = get(id); if (fail.repoSet) throw new Error('timeout'); if (o.revision !== opts.ifRevision) throw new OrgError('revision-conflict'); const r = o.repos[project]; o.revision++; const remote = opts.mode === 'remote' ? opts.remote : undefined; o.repos[project] = { ...r, current: { mode: opts.mode, ...(remote ? { remote } : {}), origin: remote ?? null, revision: o.revision, ...(remote ? { check: { result: 'needs-credential', message: 'the repository needs a credential; this check uses none' } } : {}) } }; return receipt('org.project.repo.set', id, { project, mode: opts.mode, ...(remote ? { remote } : {}), root: `/data/org-runtime/${id}/projects/${project}`, revision: o.revision, origin: remote ?? null, ...(remote ? { check: o.repos[project].current.check } : {}) }); },
   };
   const registry = { listOrgs: async () => [...orgs.keys()].map(id => ({ id, state: orgs.get(id).reserved ? 'reserved' : 'active' })) };
   let running = null;
@@ -198,10 +200,11 @@ test('setup resumes from the read-back and never overwrites a receipt', async t
   assert.equal(s.body.projects[0].verb, 'mosaic org project repo init acme work --local-only --accept-local-loss-risk');
   assert.equal(s.body.bus.verb, 'mosaic bus start acme --dev-local-owner --detach');
 
-  // Local only needs the explicit risk; remote needs an https URL.
+  // Local only needs the explicit risk; remote needs an https or ssh URL with no option, helper,
+  // path or credential in it (#1873 P1-6).
   let r = await c.call('POST', '/api/orgs/acme/setup/queue', { mode: 'local-only' });
   assert.equal(r.status, 422); assert.equal(r.body.error, 'risk-not-accepted'); assert.equal(r.body.errors[0].path, '$.acceptLocalLossRisk');
-  for (const remote of ['/srv/git', 'origin', 'ssh://git@host/acme/work', 'https://host/acme/$(id)', 'https://host/a b', 'file:///srv/git']) {
+  for (const remote of ['/srv/git', 'origin', 'https://host/acme/$(id)', 'https://host/a b', 'file:///srv/git', 'ext::sh -c id', '-uhost:x/y', '--upload-pack=touch /tmp/x', 'https://user:token@host/acme/work', 'ssh://git:pw@host/acme/work', 'http://host/acme/work', 'git://host/acme/work', 'ssh://-oProxyCommand=id/acme/work', 'git@host:../etc']) {
     r = await c.call('POST', '/api/orgs/acme/setup/queue', { mode: 'remote', remote });
     assert.equal(r.status, 422, remote); assert.equal(r.body.errors[0].path, '$.remote');
   }
@@ -239,6 +242,71 @@ test('setup resumes from the read-back and never overwrites a receipt', async t
   assert.deepEqual([s.body.queue.state, s.body.projects[0].state, s.body.bus.state], ['done', 'done', 'done']);
 });
 
+test('project repo set (#1873 P1-7): read, change both ways, refuse plainly, nothing before setup', async t => {
+  const c = await console_(t);
+  await c.call('POST', '/api/orgs', { id: 'acme', doc: browserDoc('acme') });
+  // Before setup: the read says so, and a write changes nothing.
+  let r = await c.call('GET', '/api/orgs/acme/repo/project/work');
+  assert.equal(r.status, 200); assert.equal(r.body.state, 'missing'); assert.equal(r.body.verb, 'mosaic org project repo init acme work --local-only --accept-local-loss-risk');
+  r = await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'local-only', acceptLocalLossRisk: true, ifRevision: 1 });
+  assert.equal(r.status, 422); assert.equal(r.body.error, 'invalid');
+  assert.equal(c.calls.filter(x => x[0] === 'projectRepoSet').length, 0);
+
+  assert.equal((await c.call('POST', '/api/orgs/acme/setup/project/work', { mode: 'local-only', acceptLocalLossRisk: true })).status, 201);
+  r = await c.call('GET', '/api/orgs/acme/repo/project/work');
+  assert.equal(r.status, 200, r.raw); assert.equal(r.body.state, 'done'); assert.equal(r.body.current.mode, 'local-only');
+  const rev = r.body.current.revision;
+  assert.equal(r.body.verb, `mosaic org project repo set acme work --local-only --accept-local-loss-risk --if-revision ${rev}`);
+
+  // The same URL rules as setup, before the service is called.
+  for (const remote of ['ext::sh -c id', '-uhost:x/y', 'file:///srv/git', '/srv/git', 'https://user:token@host/acme/work', 'http://host/acme/work']) {
+    r = await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'remote', remote, ifRevision: rev });
+    assert.equal(r.status, 422, remote); assert.equal(r.body.errors[0].path, '$.remote', remote);
+  }
+  for (const ifRevision of [undefined, 0, '1', 1.5]) {
+    r = await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'local-only', acceptLocalLossRisk: true, ...(ifRevision === undefined ? {} : { ifRevision }) });
+    assert.equal(r.status, 422, String(ifRevision)); assert.equal(r.body.errors[0].path, '$.ifRevision');
+  }
+  r = await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'local-only', ifRevision: rev });
+  assert.equal(r.status, 422); assert.equal(r.body.error, 'risk-not-accepted');
+  assert.equal((await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'local-only', acceptLocalLossRisk: true, ifRevision: rev, root: '/x' })).status, 400);
+  assert.equal(c.calls.filter(x => x[0] === 'projectRepoSet').length, 0, 'no refused body reached the service');
+
+  // Local only to ssh remote: the receipt, origin and the check come back.
+  const ssh = '[email protected]:acme/work.git';
+  r = await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'remote', remote: ssh, ifRevision: rev });
+  assert.equal(r.status, 200, r.raw); assert.equal(r.body.outcome, 'done'); assert.equal(r.body.receipt.op, 'org.project.repo.set');
+  assert.equal(r.body.receipt.origin, ssh); assert.equal(r.body.check.result, 'needs-credential');
+  assert.equal(r.body.receipt.root, '<data root>/org-runtime/acme/projects/work');
+  assert.equal(r.body.verb, `mosaic org project repo set acme work --remote ${ssh} --if-revision ${rev}`);
+  assert.deepEqual(c.calls.at(-1), ['projectRepoSet', 'acme', 'work', { mode: 'remote', remote: ssh, ifRevision: rev }]);
+  r = await c.call('GET', '/api/orgs/acme/repo/project/work');
+  assert.equal(r.body.current.mode, 'remote'); assert.equal(r.body.current.origin, ssh); assert.equal(r.body.current.revision, rev + 1);
+  // A stale revision is a plain conflict; then back to local only.
+  r = await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'local-only', acceptLocalLossRisk: true, ifRevision: rev });
+  assert.equal(r.status, 409); assert.equal(r.body.error, 'revision-conflict');
+  r = await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'local-only', acceptLocalLossRisk: true, ifRevision: rev + 1 });
+  assert.equal(r.status, 200, r.raw); assert.equal(r.body.receipt.origin, null); assert.equal(r.body.check, null);
+  // An unknown project or a crash: plain answers.
+  assert.equal((await c.call('GET', '/api/orgs/acme/repo/project/nope')).status, 404);
+  assert.equal((await c.call('POST', '/api/orgs/acme/repo/project/nope', { mode: 'local-only', acceptLocalLossRisk: true, ifRevision: rev + 2 })).body.error, 'project-unknown');
+  c.fail.repoSet = true;
+  r = await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'local-only', acceptLocalLossRisk: true, ifRevision: rev + 2 });
+  assert.equal(r.status, 502); assert.equal(r.body.error, 'outcome-unknown');
+  // The write fence holds: another site, or no --send, changes nothing.
+  c.fail.repoSet = false; const before = c.calls.length;
+  assert.equal((await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'local-only', acceptLocalLossRisk: true, ifRevision: rev + 2 }, { 'sec-fetch-site': 'cross-site' })).status, 403);
+  assert.equal(c.calls.length, before);
+});
+
+test('project repo set without --send or the owner is refused before the service', async t => {
+  for (const opts of [{ send: null }, { sso: null, send: null }]) {
+    const c = await console_(t, opts);
+    const r = await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'local-only', acceptLocalLossRisk: true, ifRevision: 1 });
+    assert.equal(r.status, 403, JSON.stringify(opts)); assert.equal(c.calls.length, 0);
+  }
+});
+
 test('a step whose receipt cannot be read back is never retried', async t => {
   const c = await console_(t);
   await c.call('POST', '/api/orgs', { id: 'acme', doc: browserDoc('acme') });
@@ -399,6 +467,11 @@ test('the Settings page ships the organization assets', async t => {
 test('against the real C2 service: create, set up, resume and refuse an overwrite', async t => {
   const service = await import('../../organization/src/org-service.mjs');
   const registry = await import('../../organization/src/org-registry.mjs');
+  // #1873 P1-6: the remote check goes through the test seam, so this test never leaves the host.
+  const { repoRemoteTestSeam } = await import('../../organization/src/repo-remote.mjs');
+  const checked = []; repoRemoteTestSeam.useCheck(async url => { checked.push(url); return { result: 'needs-credential', message: 'the repository needs a credential; this check uses none' }; });
+  t.after(() => repoRemoteTestSeam.useCheck(null));
+  const { execFileSync } = await import('node:child_process');
   const { mkdtempSync, mkdirSync, existsSync } = await import('node:fs');
   const { join } = await import('node:path'); const { tmpdir } = await import('node:os');
   const root = mkdtempSync(join(tmpdir(), 'oa')); const configDir = join(root, 'config'), dataRoot = join(root, 'data');
@@ -419,6 +492,10 @@ test('against the real C2 service: create, set up, resume and refuse an overwrit
   assert.equal(q.status, 201, q.raw); assert.equal(q.body.receipt.op, 'org.queue.init'); assert.ok(existsSync(join(dataRoot, 'org-runtime/acme/checkout/.git')));
   const p = await c.call('POST', '/api/orgs/acme/setup/project/work', { mode: 'remote', remote: 'https://git.example.invalid/acme/work' });
   assert.equal(p.status, 201, p.raw); assert.equal(p.body.receipt.remote, 'https://git.example.invalid/acme/work');
+  assert.equal(p.body.receipt.origin, 'https://git.example.invalid/acme/work'); assert.equal(p.body.receipt.check.result, 'needs-credential');
+  assert.deepEqual(checked, ['https://git.example.invalid/acme/work']);
+  const remotes = () => execFileSync('git', ['-C', join(dataRoot, 'org-runtime/acme/projects/work'), 'remote', '-v'], { env: { PATH: process.env.PATH, HOME: '/nonexistent', GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null' }, encoding: 'utf8' }).trim();
+  assert.equal(remotes(), 'origin\thttps://git.example.invalid/acme/work (fetch)\norigin\thttps://git.example.invalid/acme/work (push)');
   s = await c.call('GET', '/api/orgs/acme/setup');
   assert.deepEqual([s.body.queue.state, s.body.projects[0].state], ['done', 'done']);
   assert.equal(s.body.queue.receipt.root, '<data root>/org-runtime/acme/checkout');
@@ -433,9 +510,60 @@ test('against the real C2 service: create, set up, resume and refuse an overwrit
   assert.equal(stale.status, 409); assert.equal(stale.body.error, 'revision-conflict');
   const saved = await c.call('POST', '/api/orgs/acme/admin', { doc: shown.body.doc, ifRevision: shown.body.revision });
   assert.equal(saved.status, 200, saved.raw); assert.equal(saved.body.receipt.op, 'org.update');
+  // #1873 P1-7: the project's repository, changed from Settings: to local only and back to ssh.
+  let repo = await c.call('GET', '/api/orgs/acme/repo/project/work');
+  assert.equal(repo.status, 200, repo.raw); assert.equal(repo.body.current.mode, 'remote'); assert.equal(repo.body.current.origin, 'https://git.example.invalid/acme/work'); assert.equal(repo.body.current.check.result, 'needs-credential');
+  let set = await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'local-only', acceptLocalLossRisk: true, ifRevision: repo.body.current.revision });
+  assert.equal(set.status, 200, set.raw); assert.equal(set.body.receipt.op, 'org.project.repo.set'); assert.equal(set.body.receipt.origin, null); assert.equal(remotes(), '');
+  repo = await c.call('GET', '/api/orgs/acme/repo/project/work');
+  set = await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'remote', remote: 'ssh://[email protected]/acme/work.git', ifRevision: repo.body.current.revision });
+  assert.equal(set.status, 200, set.raw); assert.equal(set.body.check.result, 'needs-credential');
+  assert.equal(remotes(), 'origin\tssh://[email protected]/acme/work.git (fetch)\norigin\tssh://[email protected]/acme/work.git (push)');
+  assert.doesNotMatch(JSON.stringify([set.body, repo.body]), new RegExp(root.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')), 'no server path reaches the browser');
   assert.doesNotMatch(JSON.stringify([tpl.body, s.body, shown.body]), new RegExp(root.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')), 'no server path reaches the browser');
 });
 
+// #1873 F7: Settings cannot change the repository of a project an approved or active copy binding
+// names. The refusal is 409 with the copies and the next step; after revoke the same save goes through.
+test('against the real C2 service: repo set is refused under a copy binding and allowed after revoke', async t => {
+  const service = await import('../../organization/src/org-service.mjs');
+  const registry = await import('../../organization/src/org-registry.mjs');
+  const { repoRemoteTestSeam } = await import('../../organization/src/repo-remote.mjs');
+  let checks = 0; repoRemoteTestSeam.useCheck(async () => { checks++; return { result: 'reachable', message: 'the repository answered' }; });
+  t.after(() => repoRemoteTestSeam.useCheck(null));
+  const { createHash } = await import('node:crypto');
+  const root = mkdtempSync(join(tmpdir(), 'oa')); const configDir = join(root, 'config'), dataRoot = join(root, 'data');
+  mkdirSync(configDir, { mode: 0o700 }); mkdirSync(dataRoot, { mode: 0o700 });
+  const admin = createOrgAdmin({ service, registry, bus: null, context: async () => ({ configDir, dataRoot, instance: 'test' }) });
+  const c = await console_(t, { orgAdmin: admin });
+  const tpl = await c.call('GET', '/api/org-template?id=acme');
+  assert.equal((await c.call('POST', '/api/orgs', { id: 'acme', doc: tpl.body.doc })).status, 201);
+  assert.equal((await c.call('POST', '/api/orgs/acme/setup/project/work', { mode: 'local-only', acceptLocalLossRisk: true })).status, 201);
+  const seed = state => {
+    const docFile = join(configDir, 'businesses/acme.json'); const doc = JSON.parse(readFileSync(docFile, 'utf8'));
+    doc.copyBindings = { rev: { copyId: '1'.repeat(32), orgIncarnation: 'a'.repeat(32), source: { level: 'root', name: 'rev', project: null },
+      definition: { ref: 'reviewer', rev: null, sha256: 'b'.repeat(64) }, generation: 1, state,
+      services: state === 'unbound' ? {} : { gitea: { slot: 'self', scopes: ['read:repository'], resources: { projects: ['work'] }, ...(state === 'bound' ? { rotateBy: '2099-01-01', grantId: 'gitea:5:7', grantGeneration: 1 } : {}) } },
+      decision: '11111111-1111-4111-8111-111111111111' } };
+    const raw = JSON.stringify(doc, null, 2) + '\n'; writeFileSync(docFile, raw);
+    const regFile = join(configDir, 'org-runtime.json'); const reg = JSON.parse(readFileSync(regFile, 'utf8'));
+    reg.orgs.acme.digest = createHash('sha256').update(raw).digest('hex'); writeFileSync(regFile, JSON.stringify(reg, null, 2) + '\n');
+  };
+  const remote = 'https://git.example.invalid/acme/other';
+  for (const [state, label] of [['pending', 'approved, not yet verified'], ['bound', 'active']]) {
+    seed(state);
+    const rev = (await c.call('GET', '/api/orgs/acme/repo/project/work')).body.current.revision;
+    const r = await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'remote', remote, ifRevision: rev });
+    assert.equal(r.status, 409, r.raw); assert.equal(r.body.error, 'project-repo-bound'); assert.equal(r.body.step, 'repo');
+    assert.equal(r.body.message, `project work is in a copy binding that still grants it: rev (${label}). Revoke that copy binding first (the chief raises an unbind decision and the owner approves it), then set the repository, then ask the chief to raise a new binding decision`);
+  }
+  assert.equal(checks, 0);
+  seed('unbound');
+  const rev = (await c.call('GET', '/api/orgs/acme/repo/project/work')).body.current.revision;
+  const r = await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'remote', remote, ifRevision: rev });
+  assert.equal(r.status, 200, r.raw); assert.equal(r.body.receipt.origin, remote); assert.equal(checks, 1);
+});
+
 test('preset routes expose installed choices and refuse invalid queries', async t => {
   const service = await import('../../organization/src/org-service.mjs');
   const admin = createOrgAdmin({ service, context: async () => ({ configDir: '/cfg', dataRoot: '/data', instance: 'test' }) });
@@ -579,6 +707,60 @@ test('a bus that refuses to restart is a visible failure and the trail says refu
   assert.equal(c.calls.slice(before).filter(y => ['busStart', 'busRestart'].includes(y[0])).length, 0);
 });
 
+// E1 (P1-4): a restore brings the organization back running. The bus starts as Restart bus starts a
+// stopped one, the trail says it came after a restore, and the answer names both results.
+const restorable = c => { c.service.restoreOrg = async (ctx, id, opts) => { c.calls.push(['restoreOrg', id, opts.ifRevision]); return { op: 'org.restore', org: id, revision: 3 }; }; };
+
+test('E1: a restore starts the organization\'s bus and the answer names both results', async t => {
+  const tr = trailIn(t);
+  const c = await console_(t, { trail: tr.trail });
+  await c.call('POST', '/api/orgs', { id: 'acme', doc: browserDoc('acme') }); restorable(c);
+  const r = await c.call('POST', '/api/orgs/acme/restore', { revision: 2 });
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(r.body.outcome, 'done'); assert.equal(r.body.step, 'restore'); assert.equal(r.body.verb, 'mosaic org restore acme --if-revision 2');
+  assert.deepEqual(r.body.bus, { outcome: 'done', healthy: true, receipt: { org: 'acme', pid: 4242, socket: '<host path>', root: '<data root>/org-runtime/acme' }, verb: 'mosaic bus start acme --dev-local-owner --detach' });
+  assert.deepEqual(c.calls.filter(x => ['restoreOrg', 'busStart'].includes(x[0])).map(x => x.slice(0, 3)), [['restoreOrg', 'acme', 2], ['busStart', 'acme', { detach: true, devLocalOwner: true, pm: false }]]);
+  assert.deepEqual(tr.lines(), [
+    { by: DEV, action: 'bus.start', org: 'acme', outcome: 'requested', after: 'restore' },
+    { by: DEV, action: 'bus.start', org: 'acme', outcome: 'done', after: 'restore' },
+  ]);
+  // A bus that already answers is left as it is.
+  const again = await c.call('POST', '/api/orgs/acme/restore', { revision: 3 });
+  assert.deepEqual({ outcome: again.body.bus.outcome, existing: again.body.bus.existing, healthy: again.body.bus.healthy }, { outcome: 'done', existing: true, healthy: true });
+  assert.equal(c.calls.filter(x => x[0] === 'busStart').length, 1);
+});
+
+test('E1: a bus that does not start after a good restore is said so, with the verb, and the restore stands', async t => {
+  const tr = trailIn(t);
+  const c = await console_(t, { trail: tr.trail });
+  await c.call('POST', '/api/orgs', { id: 'acme', doc: browserDoc('acme') }); restorable(c);
+  const bus = await c.admin.bus();
+  bus.busStart = async () => { throw cliError('bus failed to start; see /data/org-runtime/acme/bus-host/host.log'); };
+  const r = await c.call('POST', '/api/orgs/acme/restore', { revision: 2 });
+  assert.equal(r.status, 200, r.raw); assert.equal(r.body.outcome, 'done'); assert.equal(r.body.step, 'restore');
+  assert.deepEqual(r.body.bus, { outcome: 'failed', error: 'bus-failed', message: 'bus failed to start; see <data root>/org-runtime/acme/bus-host/host.log', verb: 'mosaic bus start acme --dev-local-owner --detach' });
+  assert.doesNotMatch(r.raw, /\/data\//);
+  assert.deepEqual(tr.lines().map(e => e.outcome), ['requested', 'failed']);
+  // A bus whose state cannot be read is not started.
+  bus.busStatus = async () => { throw cliError('stale bus host lock'); };
+  const s = await c.call('POST', '/api/orgs/acme/restore', { revision: 3 });
+  assert.equal(s.status, 200); assert.equal(s.body.bus.outcome, 'not-started'); assert.equal(s.body.bus.error, 'bus-refused');
+  assert.equal(s.body.bus.message, 'stale bus host lock. Inspect it with mosaic bus status acme; mosaic bus recover acme clears a host that died.');
+  assert.equal(tr.lines().length, 2);
+});
+
+test('E1: a Console with no trail, or a trail that cannot be written, restores without starting the bus', async t => {
+  for (const trail of [undefined, () => { throw new Error('disk full'); }]) {
+    const c = await console_(t, trail ? { trail } : {});
+    await c.call('POST', '/api/orgs', { id: 'acme', doc: browserDoc('acme') }); restorable(c);
+    const r = await c.call('POST', '/api/orgs/acme/restore', { revision: 2 });
+    assert.equal(r.status, 200, r.raw); assert.equal(r.body.outcome, 'done');
+    assert.equal(r.body.bus.outcome, 'not-started'); assert.equal(r.body.bus.error, 'trail-unavailable');
+    assert.equal(r.body.bus.verb, 'mosaic bus start acme --dev-local-owner --detach');
+    assert.equal(c.calls.filter(x => x[0] === 'busStart').length, 0);
+  }
+});
+
 // D2 (P0-3): on the dev Console, Restart bus on a host that died (its state left behind by a
 // Console unit stop) clears that state through busRevive and starts the bus. busRevive's
 // busRecover is the proof; a live or unprovable host refuses and nothing starts.

packages/webui/tests/org-archive-browser.test.mjs

@@ -11,18 +11,23 @@ import * as service from '../../organization/src/org-service.mjs';
 import * as registry from '../../organization/src/org-registry.mjs';
 import { orgPaths } from '../../cli/src/config.mjs';
 import { busStopForDelete } from '../../cli/src/org-bus.mjs';
+import { CliError } from '../../cli/src/errors.mjs';
+import { actionTrail } from '../src/action-trail.mjs';
 import { browser } from './browser.mjs';
+import { systemTypesFake } from './helpers/system-types-fake.mjs';
 import { close } from './fixture.mjs';
 
-async function fixture(t, ids = ['alpha', 'beta'], { health = null } = {}) {
+// E1: `bus` adds verbs to the admin's bus (busStart for a restore); `trail` gives the Console its action trail;
+// `extra` adds to each organization's transports (the dashboard's bus reads and System types).
+async function fixture(t, ids = ['alpha', 'beta'], { health = null, bus = {}, trail = false, extra = () => ({}) } = {}) {
   const dir = await mkdtemp(join(tmpdir(), 'archive-browser-'));
   const configDir = join(dir, 'config'), dataRoot = join(dir, 'data'); await mkdir(configDir, { mode: 0o700 }); await mkdir(dataRoot, { mode: 0o700 });
   const ctx = { configDir, dataRoot, instance: 'test', principal: { provider: 'local-dev', iss: 'local-dev', sub: 'local-dev-owner' } };
   for (const id of ids) await service.createOrg(ctx, id, await service.templateRender(id));
   const busStatus = async () => ({ healthy: health ? health.up : false });
-  const organizations = organizationConsole({ ctx, listOrgs: registry.listOrgs, resolveOrg: registry.resolveOrg, showOrg: service.showOrg, orgPaths, busStatus, options: ({ id }) => ({ reads: { business: async () => ({ business: { id, projects: ['work'] } }), settings: async () => ({}) }, bus: {}, send: async () => ({}) }) });
-  const admin = createOrgAdmin({ service, registry, bus: { busStatus, busStopForDelete }, context: async () => ({ configDir, dataRoot, instance: 'test' }) });
-  const server = await startServer({ port: 0, sso: createDevOwner(), orgAdmin: admin, organizations, send: async () => ({}), board: 'http://127.0.0.1:9', log: () => {} });
+  const organizations = organizationConsole({ ctx, listOrgs: registry.listOrgs, resolveOrg: registry.resolveOrg, showOrg: service.showOrg, orgPaths, busStatus, options: ({ id }) => ({ reads: { business: async () => ({ business: { id, projects: ['work'] } }), settings: async () => ({}) }, bus: {}, send: async () => ({}), ...extra(id) }) });
+  const admin = createOrgAdmin({ service, registry, bus: { busStatus, busStopForDelete, ...bus }, context: async () => ({ configDir, dataRoot, instance: 'test' }) });
+  const server = await startServer({ port: 0, sso: createDevOwner(), orgAdmin: admin, organizations, send: async () => ({}), board: 'http://127.0.0.1:9', log: () => {}, ...(trail ? { trail: actionTrail(join(dir, 'console')) } : {}) });
   const b = await browser({ machine: false }); t.after(async () => { await b.close(); await close(server); await rm(dir, { recursive: true, force: true }); });
   const wait = async expression => { for (let i = 0; i < 400; i++) { try { if (await b.evaluate(expression)) return; } catch {} await new Promise(r => setTimeout(r, 30)); } throw Error(expression); };
   await b.navigate(`http://127.0.0.1:${server.address().port}/#/orgs/alpha/settings/organizations`);
@@ -36,7 +41,7 @@ async function fixture(t, ids = ['alpha', 'beta'], { health = null } = {}) {
       await b.screenshot(join(process.env.ORG_ARCHIVE_SHOTS, `${state}-${width}-${mode}.png`));
     }
   }
-  return { b, wait, open, shots, ctx, port: server.address().port };
+  return { b, wait, open, shots, ctx, port: server.address().port, dir };
 }
 
 test('archive and restore a non-current organization', { timeout: 45000 }, async t => {
@@ -88,6 +93,76 @@ test('opening another editor resets the archive confirmation and error', { timeo
   assert.deepEqual(await f.b.evaluate(`({trigger:document.querySelector('#org-archive-open').hidden,panel:document.querySelector('#org-archive-confirm').hidden,error:document.querySelector('#org-archive-error').textContent,disabled:document.querySelector('#org-archive-final').disabled})`), {trigger:false,panel:true,error:'',disabled:false});
 });
 
+// E1 (P1-4): one Restore restores the organization and starts its bus; the receipt names both.
+const startingBus = (health, fails = 0) => {
+  const starts = [];
+  return { starts, busStart: async (ctx, id, opts) => { starts.push([id, opts]); if (starts.length <= fails) throw new CliError('bus failed to start; see the bus log', 3); health.up = true; return { org: id, pid: 4242, socket: join(ctx.dataRoot, 'bus.sock'), root: join(ctx.dataRoot, 'org-runtime', id) }; } };
+};
+const archiveBeta = async f => { await f.open('beta'); await f.b.evaluate(`document.querySelector('#org-archive-open').click();document.querySelector('#org-archive-final').click()`); await f.wait(`!document.querySelector('#org-archived').hidden`); };
+
+test('E1 (P1-4): Restore restores the organization and starts its bus, with one receipt naming both', { timeout: 45000 }, async t => {
+  const health = { up: false }, bus = startingBus(health);
+  const f = await fixture(t, ['alpha', 'beta'], { health, bus, trail: true }); await archiveBeta(f);
+  await f.b.evaluate(`document.querySelector('#org-restore').click()`);
+  await f.wait(`!document.querySelector('#org-archive-success').hidden`);
+  assert.equal((await registry.listOrgs(f.ctx)).find(e => e.id === 'beta').state, 'active');
+  assert.deepEqual(bus.starts, [['beta', { detach: true, devLocalOwner: true, pm: false }]]);
+  const text = await f.b.evaluate(`document.querySelector('#org-archive-success').innerText`);
+  assert.match(text, /^Organization restored\. Bus started\. It answers\./);
+  assert.match(text, /Same as mosaic bus start beta --dev-local-owner --detach/);
+  assert.doesNotMatch(text, /remains stopped/);
+  assert.equal(await f.b.evaluate(`document.querySelector('[data-restore-bus]')`), null, 'a running bus needs no Restart bus');
+  assert.deepEqual(await f.b.evaluate(`window.MosaicOrg.list.then(rows=>rows.map(row=>[row.id,row.busHealthy]))`), [['alpha', true], ['beta', true]]);
+  await f.shots('e1-restored-started', '#org-archive-success');
+});
+
+test('E1 (P1-4): a bus that does not start after a good restore is said so, and Restart bus starts it', { timeout: 45000 }, async t => {
+  const health = { up: false }, bus = startingBus(health, 1);
+  const f = await fixture(t, ['alpha', 'beta'], { health, bus, trail: true }); await archiveBeta(f);
+  await f.b.evaluate(`document.querySelector('#org-restore').click()`);
+  await f.wait(`!document.querySelector('#org-archive-success').hidden`);
+  assert.equal((await registry.listOrgs(f.ctx)).find(e => e.id === 'beta').state, 'active', 'the restore stands');
+  assert.match(await f.b.evaluate(`document.querySelector('#org-archive-success').innerText`), /^Organization restored\. The bus did not start: bus failed to start; see the bus log/);
+  assert.equal(await f.b.evaluate(`document.querySelector('[data-restore-bus]').textContent`), 'Restart bus');
+  await f.shots('e1-restored-bus-failed', '#org-archive-success');
+  await f.b.evaluate(`document.querySelector('[data-restore-bus]').click()`);
+  await f.wait(`/It answers/.test(document.querySelector('[data-restore-bus-receipt]')?.textContent || '')`);
+  assert.equal(await f.b.evaluate(`document.querySelector('[data-restore-bus-receipt]').textContent`), 'Bus started. It answers.');
+  assert.equal(await f.b.evaluate(`document.querySelector('[data-restore-bus]').disabled`), true);
+  assert.deepEqual(bus.starts.map(([id]) => id), ['beta', 'beta']);
+  await f.shots('e1-restored-bus-restarted', '#org-archive-success');
+});
+
+test('E1 (P1-4): restoring the only organization reloads into it and still shows the restore and bus receipt', { timeout: 45000 }, async t => {
+  const health = { up: false }, bus = startingBus(health);
+  const f = await fixture(t, ['alpha'], { health, bus, trail: true }); await f.open('alpha');
+  await f.b.evaluate(`document.querySelector('#org-archive-open').click();document.querySelector('#org-archive-final').click()`);
+  await f.wait(`!window.MosaicOrg && document.querySelector('#org-open-id')?.value === 'alpha'`);
+  await f.open('alpha'); await f.b.evaluate(`document.querySelector('#org-restore').click()`);
+  await f.wait(`window.MosaicOrg?.id === 'alpha' && document.querySelector('#org-archive-success')?.hidden === false`);
+  assert.match(await f.b.evaluate(`document.querySelector('#org-archive-success').innerText`), /^Organization restored\. Bus started\. It answers\./);
+  assert.deepEqual(bus.starts.map(([id]) => id), ['alpha']);
+  // The kept receipt is shown once: a later visit does not repeat it.
+  assert.equal(await f.b.evaluate(`Object.keys(sessionStorage).filter(k=>k.startsWith('mosaic-org-restored:')).length`), 0);
+});
+
+test('E1 (P1-5): after restoring another organization, its dashboard shows the bus running and its System types', { timeout: 45000 }, async t => {
+  const health = { up: false }, bus = startingBus(health), st = await systemTypesFake({ enabled: ['coding'] });
+  const extra = id => ({
+    requestRead: st.requestRead,
+    reads: { business: async () => ({ business: { id, human: 'local-dev-owner', arbiters: [], projects: [], vars: {}, instances: [] } }), settings: async () => ({}), queue: async () => ({ rows: [] }), busStatus: async () => ({}) },
+    bus: { instances: async () => ({ business: id, revision: 'a'.repeat(64), launch: true, noHire: [], retired: [], definitions: {}, instances: {} }), messages: async () => ({ messages: [], unread: 0 }), agents: async () => [], 'thread.claims': async () => [], inbox: async () => [], tasks: async () => [] },
+  });
+  const f = await fixture(t, ['alpha', 'beta'], { health, bus, trail: true, extra }); await archiveBeta(f);
+  await f.b.evaluate(`document.querySelector('#org-restore').click()`);
+  await f.wait(`/Bus started\. It answers\./.test(document.querySelector('#org-archive-success')?.innerText || '')`);
+  await f.wait(`!!document.querySelector('#workspace-nav [data-workspace-org=beta]')`);
+  await f.b.evaluate(`location.hash = '#/orgs/beta/organization'`);
+  await f.wait(`/bus running, read/.test(document.querySelector('[data-org-dashboard]')?.innerText || '') && !!document.querySelector('[data-org-dashboard] [data-system-type-chips] .ws-chip')`);
+  assert.doesNotMatch(await f.b.evaluate(`document.querySelector('[data-org-dashboard] [data-system-type-chips]').textContent`), /unavailable/);
+  assert.deepEqual(bus.starts.map(([id]) => id), ['beta']);
+});
+
 test('restore does not announce success for an unexpected response', { timeout: 45000 }, async t => {
   const f = await fixture(t); await f.open('beta');
   await f.b.evaluate(`document.querySelector('#org-archive-open').click();document.querySelector('#org-archive-final').click()`);

packages/webui/tests/org-quick-browser.test.mjs

@@ -115,3 +115,44 @@ test('an unreadable success reply stops quick setup and a new draft gets fresh c
   assert.deepEqual(await controls(), [false, false, false]);
   assert.equal(await b.evaluate(`document.querySelector('#org-risk-accept').checked`), false);
 });
+
+// #1873 P1-6: Quick Setup in remote mode sets the project checkout's origin, checks it once (here
+// through the test seam, so nothing leaves the host) and shows the outcome on the project step.
+test('quick setup in remote mode sets origin and shows the check', { timeout: 45000 }, async t => {
+  const { mkdtempSync, mkdirSync, rmSync } = await import('node:fs');
+  const { tmpdir } = await import('node:os'); const { join } = await import('node:path'); const { execFileSync } = await import('node:child_process');
+  const registry = await import('../../organization/src/org-registry.mjs');
+  const { repoRemoteTestSeam } = await import('../../organization/src/repo-remote.mjs');
+  const remote = 'https://git.example.invalid/alpha/work';
+  const checked = []; repoRemoteTestSeam.useCheck(async url => { checked.push(url); return { result: 'unreachable', message: 'Could not resolve host: git.example.invalid' }; });
+  t.after(() => repoRemoteTestSeam.useCheck(null));
+  const dir = mkdtempSync(join(tmpdir(), 'quick-'));
+  const configDir = join(dir, 'config'), dataRoot = join(dir, 'data'); mkdirSync(configDir, { mode: 0o700 }); mkdirSync(dataRoot, { mode: 0o700 });
+  let starts = 0;
+  const bus = { busStatus: async () => ({ healthy: false }), busStart: async () => { starts++; return { healthy: true }; } };
+  const admin = createOrgAdmin({ service, registry, bus, context: async () => ({ configDir, dataRoot, instance: 'test' }) });
+  const projects = [];
+  const organizations = {
+    list: async () => starts ? [{ id: 'alpha', label: 'alpha', busHealthy: true }] : [],
+    resolve: async id => id === 'alpha' ? { send: async () => ({}), busHealthy: true, chat: {
+      projects: async () => projects, threads: async () => [],
+      createProject: async args => { const row = { id: '20000000-0000-4000-8000-000000000002', ...args }; projects.push(row); return row; },
+    } } : null,
+  };
+  const server = await startServer({ port: 0, sso: createDevOwner(), organizations, orgAdmin: admin, send: async () => ({}), board: 'http://127.0.0.1:9', log: () => {} }); t.after(() => close(server));
+  const b = await browser({ machine: false, args: ['--disable-extensions'] }); t.after(() => b.close());
+  t.after(() => rmSync(dir, { recursive: true, force: true }));
+  const wait = expression => b.evaluate(`(async()=>{for(let i=0;i<300;i++){if(${expression})return;await new Promise(r=>setTimeout(r,30))}throw Error(${JSON.stringify(expression)})})()`);
+  await b.navigate(`http://127.0.0.1:${server.address().port}/#/settings/organizations`);
+  await wait('document.querySelector("#org-new-form [data-write]") && !document.querySelector("#org-new-form [data-write]").disabled');
+  await b.evaluate(`document.querySelector('#org-new-id').value='alpha';document.querySelector('#org-new-form [data-write]').click()`);
+  await wait('document.querySelector("#org-quick-open") && !document.querySelector("#org-paths").hidden');
+  await b.evaluate(`document.querySelector('#org-quick-open').click();document.querySelector('#org-project-remote').value=${JSON.stringify(remote)};document.querySelector('#org-risk-accept').click();document.querySelector('#org-quick-run').click()`);
+  await wait(`document.querySelector('[data-quick-step="5"] .org-pill')?.textContent === 'Done'`);
+  assert.equal((await b.evaluate(`document.querySelector('[data-remote-check]')?.textContent ?? ''`)).trim(), `Remote check: unreachable, Could not resolve host: git.example.invalid. Origin: ${remote}.`);
+  assert.deepEqual(checked, [remote]);
+  const git = (...args) => execFileSync('git', ['-C', join(dataRoot, 'org-runtime/alpha/projects/work'), ...args], { env: { PATH: process.env.PATH, HOME: '/nonexistent', GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null' }, encoding: 'utf8' }).trim();
+  assert.equal(git('remote', '-v'), `origin\t${remote} (fetch)\norigin\t${remote} (push)`);
+  // The organization checkout stays local only.
+  assert.equal(execFileSync('git', ['-C', join(dataRoot, 'org-runtime/alpha/checkout'), 'remote', '-v'], { env: { PATH: process.env.PATH, HOME: '/nonexistent', GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null' }, encoding: 'utf8' }).trim(), '');
+});

packages/webui/tests/org-refresh-browser.test.mjs

@@ -0,0 +1,94 @@
+// E1 (P1-5): pages follow a state change without a reload. Restart bus redraws the organization
+// dashboard's bus line and System types at once, and Quick Setup puts the new organization in the
+// sidebar. Neither waits for the 10 s repaint: each check runs well inside that window.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, mkdirSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { startServer } from '../src/serve.mjs';
+import { createDevOwner } from '../src/dev-owner.mjs';
+import { createOrgAdmin } from '../src/org-admin.mjs';
+import { actionTrail } from '../src/action-trail.mjs';
+import * as service from '../../organization/src/org-service.mjs';
+import { browser } from './browser.mjs';
+import { close } from './fixture.mjs';
+import { systemTypesFake } from './helpers/system-types-fake.mjs';
+
+const waitFor = (b, tries = 150) => expression => b.evaluate(`(async()=>{for(let i=0;i<${tries};i++){if(${expression})return;await new Promise(r=>setTimeout(r,30))}throw Error(${JSON.stringify(expression)})})()`);
+
+// One organization whose bus state the fake bus below owns. A stopped bus has no reads, as
+// organizations.mjs resolves it; a running one answers the dashboard's reads and System types.
+async function westOrgs(state) {
+  const st = await systemTypesFake({ enabled: ['coding'] });
+  const running = () => ({
+    busHealthy: true, requestRead: st.requestRead, systemTypesWrite: null,
+    reads: { business: async () => ({ business: { id: 'west', human: 'jason', arbiters: [], projects: [], vars: {}, instances: [] } }), settings: async () => ({}), queue: async () => ({ rows: [] }), busStatus: async () => ({}) },
+    bus: { instances: async () => ({ business: 'west', revision: 'a'.repeat(64), launch: true, noHire: [], retired: [], definitions: {}, instances: {} }), messages: async () => ({ messages: [], unread: 0 }), agents: async () => [], 'thread.claims': async () => [], inbox: async () => [], tasks: async () => [] },
+    chat: { projects: async () => [], threads: async () => [] },
+  });
+  return {
+    list: async () => [{ id: 'west', label: 'West', busHealthy: state.running }],
+    resolve: async id => id !== 'west' ? null : state.running ? running() : { busHealthy: false, reads: null, bus: {}, chat: { projects: async () => [], threads: async () => [] } },
+  };
+}
+
+test('E1 (P1-5b): Restart bus redraws the dashboard bus line and System types without a reload or the 10 s repaint', { timeout: 45000 }, async t => {
+  const state = { running: false }; const starts = [];
+  const bus = {
+    busStatus: async (ctx, id) => ({ org: id, healthy: state.running, pid: state.running ? 4242 : null }),
+    busStart: async (ctx, id, opts) => { starts.push([id, opts]); state.running = true; return { org: id, pid: 4242, socket: '/data/s', root: '/data/org-runtime/west' }; },
+    busRestart: async () => { throw Error('not reached: the bus is stopped'); },
+  };
+  const orgAdmin = createOrgAdmin({ service: { showOrg: async (ctx, id) => ({ id, revision: 1, doc: {} }) }, registry: { listOrgs: async () => [] }, bus, context: async () => ({ configDir: '/cfg', dataRoot: '/data', instance: 'test' }) });
+  const root = mkdtempSync(join(tmpdir(), 'e1-refresh-')); t.after(() => rmSync(root, { recursive: true, force: true }));
+  const server = await startServer({ port: 0, sso: createDevOwner(), send: async () => ({}), organizations: await westOrgs(state), orgAdmin, trail: actionTrail(join(root, 'console')), log: () => {} }); t.after(() => close(server));
+  const b = await browser({ machine: false }); t.after(() => b.close());
+  const wait = waitFor(b);
+  await b.navigate(`http://127.0.0.1:${server.address().port}/#/orgs/west/organization`);
+  await wait('document.querySelector("[data-org-dashboard] [data-bus-restart]") && /bus unavailable, read/.test(document.querySelector("[data-org-dashboard]").innerText)');
+  assert.match(await b.evaluate('document.querySelector("[data-org-dashboard] [data-system-type-chips]").textContent'), /System types unavailable/);
+  // The page's own repaint is 10 s after its last draw; mark the draw this test starts from.
+  await b.evaluate('window.__drawn = Date.now(); window.__first = document.querySelector("[data-org-dashboard]")');
+  await b.evaluate('document.querySelector("[data-org-dashboard] [data-bus-restart]").click()');
+  await wait('/It answers/.test(document.querySelector("[data-org-dashboard] [data-bus-restart-receipt]")?.textContent || "")');
+  // No reload: the page keeps its globals, and the dashboard shows the running bus and the enabled type.
+  await wait('/bus running, read/.test(document.querySelector("[data-org-dashboard]")?.innerText || "") && !!document.querySelector("[data-org-dashboard] [data-system-type-chips] .ws-chip")');
+  assert.ok(await b.evaluate('Date.now() - window.__drawn') < 8000, 'the dashboard redrew before the 10 s repaint');
+  assert.equal(await b.evaluate('typeof window.__first'), 'object', 'the page was not reloaded');
+  assert.doesNotMatch(await b.evaluate('document.querySelector("[data-org-dashboard] [data-system-type-chips]").textContent'), /unavailable/);
+  assert.match(await b.evaluate('document.querySelector("[data-org-dashboard] [data-bus-restart-receipt]").textContent'), /^Bus started at .*It answers\./);
+  assert.deepEqual(starts.map(([id]) => id), ['west']);
+});
+
+test('E1 (P1-5a): Quick Setup from inside another organization lists the new one in the sidebar without a reload', { timeout: 60000 }, async t => {
+  const registry = await import('../../organization/src/org-registry.mjs');
+  const dir = mkdtempSync(join(tmpdir(), 'e1-quick-'));
+  const configDir = join(dir, 'config'), dataRoot = join(dir, 'data'); mkdirSync(configDir, { mode: 0o700 }); mkdirSync(dataRoot, { mode: 0o700 });
+  let started = false;
+  const bus = { busStatus: async () => ({ healthy: false }), busStart: async () => { started = true; return { healthy: true }; } };
+  const admin = createOrgAdmin({ service, registry, bus, context: async () => ({ configDir, dataRoot, instance: 'test' }) });
+  const projects = [];
+  const shell = { send: async () => ({}), busHealthy: true, chat: { projects: async () => projects, threads: async () => [], createProject: async args => { const row = { id: '20000000-0000-4000-8000-000000000002', ...args }; projects.push(row); return row; } } };
+  const organizations = {
+    list: async () => [{ id: 'east', label: 'East', busHealthy: true }, ...(started ? [{ id: 'alpha', label: 'alpha', busHealthy: true }] : [])],
+    resolve: async id => (id === 'east' || (id === 'alpha' && started)) ? shell : null,
+  };
+  const server = await startServer({ port: 0, sso: createDevOwner(), organizations, orgAdmin: admin, send: async () => ({}), board: 'http://127.0.0.1:9', log: () => {} }); t.after(() => close(server));
+  const b = await browser({ machine: false }); t.after(() => b.close());
+  t.after(() => rmSync(dir, { recursive: true, force: true }));
+  const wait = waitFor(b, 300);
+  await b.navigate(`http://127.0.0.1:${server.address().port}/#/orgs/east/settings/organizations`);
+  await wait('document.querySelector("[data-workspace-org=east]") && document.querySelector("#org-new-form [data-write]") && !document.querySelector("#org-new-form [data-write]").disabled');
+  assert.equal(await b.evaluate('document.querySelector("[data-workspace-org=alpha]")'), null);
+  await b.evaluate('window.__first = true');
+  await b.evaluate(`document.querySelector('#org-new-id').value='alpha';document.querySelector('#org-new-form [data-write]').click()`);
+  await wait('document.querySelector("#org-quick-open") && !document.querySelector("#org-paths").hidden');
+  await b.evaluate(`document.querySelector('#org-quick-open').click();document.querySelector('#org-risk-accept').click();document.querySelector('#org-quick-run').click()`);
+  await wait(`document.querySelector('[data-quick-step="5"] .org-pill')?.textContent === 'Done'`);
+  await b.evaluate('window.__done = Date.now()');
+  await wait('!!document.querySelector("[data-workspace-org=alpha]")');
+  assert.ok(await b.evaluate('Date.now() - window.__done') < 8000, 'the sidebar followed the setup, not a later poll');
+  assert.equal(await b.evaluate('window.__first'), true, 'the page was not reloaded');
+  assert.equal(started, true);
+});

packages/webui/tests/project-repo-browser.test.mjs

@@ -0,0 +1,242 @@
+// #1873 P1-7 (ruling 11): an organization project's Repository on its Settings tab is editable. The
+// Console, its per-organization routes, the org-admin route and the real organization service are
+// real; the organization's bus transports are a small fake, and the remote check goes through the
+// test seam, so nothing leaves the host. The page sets a remote, is refused a bad URL and a stale
+// revision, switches to local only and back, and `git remote -v` in the checkout follows each step.
+// MOSAIC_UX_SHOTS=<dir> also writes light and dark shots at 1440x900 and 390x844.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { startServer } from '../src/serve.mjs';
+import { createDevOwner } from '../src/dev-owner.mjs';
+import { createOrgAdmin } from '../src/org-admin.mjs';
+import * as service from '../../organization/src/org-service.mjs';
+import * as registry from '../../organization/src/org-registry.mjs';
+import { repoRemoteTestSeam } from '../../organization/src/repo-remote.mjs';
+import { browser } from './browser.mjs';
+import { close } from './fixture.mjs';
+
+const P = '10000000-0000-4000-8000-0000000000c1';
+const NEEDS = { result: 'needs-credential', message: 'the repository needs a credential; this check uses none' };
+const waitFor = b => expression => b.evaluate(`(async()=>{for(let i=0;i<300;i++){if(${expression})return true;await new Promise(r=>setTimeout(r,30))}throw Error(${JSON.stringify(expression)}+' | '+(document.querySelector('main')?.innerText||'').slice(0,1500))})()`);
+const text = (b, selector) => b.evaluate(`(document.querySelector(${JSON.stringify(selector)})?.innerText ?? '').replace(/\\s+/g, ' ').trim()`);
+const click = (b, selector) => b.evaluate(`(document.querySelector(${JSON.stringify(selector)}).click(), true)`);
+const fill = (b, selector, value) => b.evaluate(`(e => { e.value = ${JSON.stringify(value)}; e.dispatchEvent(new Event('input', { bubbles: true })); return true; })(document.querySelector(${JSON.stringify(selector)}))`);
+// A same-origin call from the page, so the write fence sees a real browser request.
+const api = (b, path, body) => b.evaluate(`fetch(${JSON.stringify(path)}, ${body === undefined ? '{}' : `{ method: 'POST', headers: { 'content-type': 'application/json' }, body: ${JSON.stringify(JSON.stringify(body))} }`}).then(async r => ({ status: r.status, body: await r.json() }))`);
+
+// One running organization whose chat project "Work" is the organization project `work`.
+function organizations() {
+  const business = { business: { id: 'acme', human: 'local-dev-owner', arbiters: [], projects: [P], vars: {}, instances: [], appearance: { theme: null } } };
+  return {
+    list: async () => [{ id: 'acme', label: 'Acme', theme: null, busHealthy: true }],
+    resolve: async id => id !== 'acme' ? null : ({
+      busHealthy: true, send: async () => ({}),
+      reads: { business: async () => business, settings: async () => ({}), queue: async () => ({ rows: [] }), busStatus: async () => ({}) },
+      bus: { instances: async () => ({ business: 'acme', revision: 'a'.repeat(64), launch: true, noHire: [], retired: [], definitions: {}, instances: {} }),
+        messages: async () => ({ messages: [], unread: 0 }), agents: async () => [], 'thread.claims': async () => [], inbox: async () => [], tasks: async () => [] },
+      chat: { projects: async () => [{ id: P, name: 'Work', repo: 'work' }], threads: async () => [] },
+    }),
+  };
+}
+
+async function console_(t, { send = true, width = 1440, height = 900, root = null } = {}) {
+  const fresh = root === null; root ??= mkdtempSync(join(tmpdir(), 'prb')); const configDir = join(root, 'config'), dataRoot = join(root, 'data');
+  if (fresh) { mkdirSync(configDir, { mode: 0o700 }); mkdirSync(dataRoot, { mode: 0o700 }); }
+  const orgAdmin = createOrgAdmin({ service, registry, bus: null, context: async () => ({ configDir, dataRoot, instance: 'test' }) });
+  const server = await startServer({ port: 0, sso: createDevOwner(), ...(send ? { send: async () => ({}) } : {}), organizations: organizations(), orgAdmin, log: () => {} });
+  t.after(() => close(server));
+  const b = await browser({ machine: false, args: ['--disable-extensions'] }); t.after(() => b.close());
+  const errors = [];
+  b.on('Runtime.exceptionThrown', p => errors.push(p.exceptionDetails?.exception?.description ?? p.exceptionDetails?.text ?? 'exception'));
+  await b.viewport(width, height);
+  const base = `http://127.0.0.1:${server.address().port}/`;
+  const checkout = join(dataRoot, 'org-runtime/acme/projects/work');
+  const git = (...args) => execFileSync('git', ['-C', checkout, ...args], { env: { PATH: process.env.PATH, HOME: '/nonexistent', GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null' }, encoding: 'utf8' }).trim();
+  const remotes = () => git('remote', '-v');
+  return { b, base, wait: waitFor(b), errors, root, remotes, git, receipts: join(dataRoot, 'org-runtime/acme/receipts.jsonl') };
+}
+
+// Create the organization and set the project up local-only, as Quick Setup does, through the routes.
+async function seed(p) {
+  await p.b.navigate(`${p.base}#/orgs/acme/organization`);
+  const tpl = await api(p.b, '/api/org-template?id=acme');
+  assert.equal(tpl.status, 200, JSON.stringify(tpl.body));
+  const made = await api(p.b, '/api/orgs', { id: 'acme', doc: tpl.body.doc });
+  assert.equal(made.status, 201, JSON.stringify(made.body));
+  const set = await api(p.b, '/api/orgs/acme/setup/project/work', { mode: 'local-only', acceptLocalLossRisk: true });
+  assert.equal(set.status, 201, JSON.stringify(set.body));
+}
+const settings = async ({ b, base, wait }) => {
+  await b.navigate(`${base}#/orgs/acme/projects/${P}/settings`);
+  await wait('document.querySelector("[data-project-repo]") && !/Reading the repository/.test(document.querySelector("[data-project-repo]").textContent)');
+};
+// A fresh page load, so the section reads the repository again rather than reusing its last view.
+const reread = async p => { await p.b.evaluate('location.reload(), true'); await new Promise(r => setTimeout(r, 200)); await settings(p); };
+const facts = b => b.evaluate(`['mode', 'url', 'origin', 'check'].map(k => document.querySelector('[data-repo-' + k + ']')?.textContent ?? null)`);
+const save = async ({ b, wait }, pattern) => {
+  await b.evaluate(`document.querySelector('[data-project-repo-status]').textContent = '', true`);
+  await click(b, '[data-project-repo-form] button[type=submit]');
+  await wait(`${pattern}.test(document.querySelector('[data-project-repo-status]')?.textContent)`);
+  return text(b, '[data-project-repo-status]');
+};
+
+test('the owner edits the repository on Settings: remote, refusals, local only and back, origin follows', { timeout: 90000 }, async t => {
+  const checked = []; repoRemoteTestSeam.useCheck(async url => { checked.push(url); return url.includes('down.invalid') ? { result: 'unreachable', message: 'Could not resolve host: down.invalid' } : NEEDS; });
+  t.after(() => repoRemoteTestSeam.useCheck(null));
+  const p = await console_(t); const { b } = p;
+  await seed(p);
+  assert.equal(p.remotes(), '');
+  await settings(p);
+  assert.deepEqual(await facts(b), ['Local only', 'None (local only)', 'None', 'None (local only has no remote)']);
+  assert.match(await text(b, '[data-repo-verb]'), /^mosaic org project repo set acme work --local-only --accept-local-loss-risk --if-revision \d+$/);
+
+  // Remote, https: origin is set, the check is reported in plain words, nothing is pushed.
+  await click(b, '[data-project-repo-form] input[name=repo-mode][value=remote]');
+  assert.equal(await b.evaluate('document.activeElement?.value'), 'remote', 'focus stays on the radio it changed');
+  const https = 'https://git.example.invalid/acme/work';
+  await fill(b, '#project-repo-url', https);
+  const saved = await save(p, '/Saved/');
+  assert.match(saved, new RegExp(`^Saved at \\S+\\. Origin is ${https.replace(/[.]/g, '\\.')}\\. Check: Needs a credential: the repository needs a credential; this check uses none\\. Nothing was pushed\\.$`));
+  assert.equal(await b.evaluate(`document.activeElement?.hasAttribute('data-project-repo-status')`), true);
+  assert.deepEqual(await facts(b), ['Remote', https, https, 'Needs a credential: the repository needs a credential; this check uses none.']);
+  assert.equal(p.remotes(), `origin\t${https} (fetch)\norigin\t${https} (push)`);
+  assert.deepEqual(checked, [https]);
+
+  // URLs the rules refuse never reach git, and origin stays as it was.
+  for (const [bad, why] of [['ext::sh -c id', /transport helper/], ['https://user:[email protected]/acme/work', /credential/], ['-uhost:x/y', /must not start with "-"/]]) {
+    await fill(b, '#project-repo-url', bad);
+    const line = await save(p, '/./');
+    assert.match(line, why, bad); assert.doesNotMatch(line, /Saved/, bad);
+    assert.equal(await b.evaluate(`document.querySelector('#project-repo-url').value`), bad, 'the entry is kept');
+  }
+  assert.deepEqual(checked, [https]);
+  assert.equal(p.remotes(), `origin\t${https} (fetch)\norigin\t${https} (push)`);
+
+  // An unreachable remote is still saved; the git error is summarized.
+  const down = 'ssh://[email protected]/acme/work.git';
+  await fill(b, '#project-repo-url', down);
+  assert.match(await save(p, '/Saved/'), /Check: Unreachable: Could not resolve host: down\.invalid\. Nothing was pushed\.$/);
+  assert.equal(p.remotes(), `origin\t${down} (fetch)\norigin\t${down} (push)`);
+
+  // Another write changed the organization meanwhile: the first try is refused, the second lands.
+  const shown = await api(b, '/api/orgs/acme/admin');
+  assert.equal((await api(b, '/api/orgs/acme/admin', { doc: shown.body.doc, ifRevision: shown.body.revision })).status, 200);
+  await click(b, '[data-project-repo-form] input[name=repo-mode][value=local-only]');
+  await click(b, '[data-project-repo-form] input[name=repo-risk]');
+  assert.match(await save(p, '/changed after this page read it/'), /your entry is kept/);
+  assert.equal(p.remotes(), `origin\t${down} (fetch)\norigin\t${down} (push)`);
+
+  // Local only needs the risk box; with it, origin is removed.
+  assert.equal(await b.evaluate(`document.querySelector('[data-project-repo-form] input[name=repo-risk]').checked`), true, 'the draft survived the refusal');
+  await click(b, '[data-project-repo-form] input[name=repo-risk]');
+  assert.equal(await save(p, '/Tick the box/'), 'Tick the box to accept that a local-only repository has no copy anywhere else.');
+  await click(b, '[data-project-repo-form] input[name=repo-risk]');
+  assert.match(await save(p, '/Saved/'), /^Saved at \S+\. Origin removed; local only\. Nothing was pushed\.$/);
+  assert.deepEqual(await facts(b), ['Local only', 'None (local only)', 'None', 'None (local only has no remote)']);
+  assert.equal(p.remotes(), '');
+
+  // And back to remote, scp-like ssh.
+  const scp = '[email protected]:acme/work.git';
+  await click(b, '[data-project-repo-form] input[name=repo-mode][value=remote]');
+  await fill(b, '#project-repo-url', scp);
+  assert.match(await save(p, '/Saved/'), new RegExp(`Origin is ${scp.replace(/[.]/g, '\\.')}\\.`));
+  assert.equal(p.remotes(), `origin\t${scp} (fetch)\norigin\t${scp} (push)`);
+  const receipts = (await api(b, '/api/orgs/acme/repo/project/work')).body;
+  assert.equal(receipts.current.mode, 'remote'); assert.equal(receipts.current.origin, scp);
+  assert.equal(await b.evaluate(`document.querySelector('[data-repo-drift]')`), null, 'origin matches: no drift line');
+
+  // #1873 review F2: origin moved away from the recorded URL (a save that stopped after setting
+  // origin). The page says so; saving the recorded URL again repairs it.
+  p.git('remote', 'set-url', 'origin', 'https://elsewhere.invalid/x/y');
+  await reread(p);
+  assert.deepEqual(await facts(b), ['Remote', scp, 'https://elsewhere.invalid/x/y', 'Needs a credential: the repository needs a credential; this check uses none; the ssh host key was not verified.']);
+  assert.equal(await text(b, '[data-repo-drift]'), 'Git origin differs from the recorded repository; save it again to repair.');
+  await save(p, '/Saved/');
+  assert.equal(p.remotes(), `origin\t${scp} (fetch)\norigin\t${scp} (push)`);
+  assert.equal(await b.evaluate(`document.querySelector('[data-repo-drift]')`), null);
+  // A recorded check of another URL is not shown as this URL's check.
+  const lines = readFileSync(p.receipts, 'utf8').trim().split('\n').map(l => JSON.parse(l));
+  lines.at(-1).check.url = 'https://git.example.invalid/acme/other'; writeFileSync(p.receipts, lines.map(l => JSON.stringify(l)).join('\n') + '\n');
+  await reread(p);
+  assert.equal((await facts(b))[3], 'Not recorded for this URL');
+  assert.doesNotMatch(await b.evaluate('document.body.innerText'), new RegExp(p.root.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')), 'no server path reaches the page');
+  assert.deepEqual(p.errors, []);
+});
+
+// #1873 F7: an active copy binding names the project, so Settings is refused with the copy and the
+// next step, the entry is kept and git is untouched; after the binding is revoked the same save lands.
+test('Settings refuses the repository change under an active copy binding and saves after revoke', { timeout: 60000 }, async t => {
+  repoRemoteTestSeam.useCheck(async () => NEEDS); t.after(() => repoRemoteTestSeam.useCheck(null));
+  const p = await console_(t); const { b } = p;
+  await seed(p);
+  const configDir = join(p.root, 'config');
+  const bind = state => {
+    const docFile = join(configDir, 'businesses/acme.json'); const doc = JSON.parse(readFileSync(docFile, 'utf8'));
+    doc.copyBindings = { rev: { copyId: '1'.repeat(32), orgIncarnation: 'a'.repeat(32), source: { level: 'root', name: 'rev', project: null },
+      definition: { ref: 'reviewer', rev: null, sha256: 'b'.repeat(64) }, generation: 1, state,
+      services: state === 'unbound' ? {} : { gitea: { slot: 'self', scopes: ['read:repository'], resources: { projects: ['work'] }, rotateBy: '2099-01-01', grantId: 'gitea:5:7', grantGeneration: 1 } },
+      decision: '11111111-1111-4111-8111-111111111111' } };
+    const raw = JSON.stringify(doc, null, 2) + '\n'; writeFileSync(docFile, raw);
+    const regFile = join(configDir, 'org-runtime.json'); const reg = JSON.parse(readFileSync(regFile, 'utf8'));
+    reg.orgs.acme.digest = createHash('sha256').update(raw).digest('hex'); writeFileSync(regFile, JSON.stringify(reg, null, 2) + '\n');
+  };
+  bind('bound');
+  await settings(p);
+  const url = 'https://git.example.invalid/acme/work';
+  await click(b, '[data-project-repo-form] input[name=repo-mode][value=remote]');
+  await fill(b, '#project-repo-url', url);
+  assert.equal(await save(p, '/copy binding/'), 'project work is in a copy binding that still grants it: rev (active). Revoke that copy binding first (the chief raises an unbind decision and the owner approves it), then set the repository, then ask the chief to raise a new binding decision');
+  assert.equal(await b.evaluate(`document.querySelector('#project-repo-url').value`), url, 'the entry is kept');
+  assert.equal(p.remotes(), '');
+  bind('unbound');
+  assert.match(await save(p, '/Saved/'), new RegExp(`Origin is ${url.replace(/[.]/g, '\\.')}\\.`));
+  assert.equal(p.remotes(), `origin\t${url} (fetch)\norigin\t${url} (push)`);
+  assert.deepEqual(p.errors, []);
+});
+
+test('a read-only Console shows the setting, refuses the change in plain words and git is untouched', { timeout: 60000 }, async t => {
+  repoRemoteTestSeam.useCheck(async () => NEEDS); t.after(() => repoRemoteTestSeam.useCheck(null));
+  // Seed through a send-mode Console, then open the same organization in one without send mode.
+  const p = await console_(t); await seed(p);
+  const q = await console_(t, { send: false, root: p.root }); const { b } = q;
+  await settings(q);
+  assert.deepEqual(await facts(b), ['Local only', 'None (local only)', 'None', 'None (local only has no remote)']);
+  await click(b, '[data-project-repo-form] input[name=repo-mode][value=remote]');
+  await fill(b, '#project-repo-url', 'https://git.example.invalid/acme/work');
+  assert.equal(await save(q, '/only reads/'), 'This Console only reads. Changing the repository needs signed-in send mode.');
+  assert.equal(p.remotes(), '');
+  assert.deepEqual(q.errors, []);
+});
+
+test('the Repository section fits 1440x900 and a phone in light and dark', { timeout: 90000 }, async t => {
+  repoRemoteTestSeam.useCheck(async () => NEEDS); t.after(() => repoRemoteTestSeam.useCheck(null));
+  const shots = process.env.MOSAIC_UX_SHOTS;
+  if (shots) mkdirSync(shots, { recursive: true });
+  for (const [width, height] of [[1440, 900], [390, 844]]) {
+    const p = await console_(t, { width, height }); const { b } = p;
+    await seed(p);
+    await settings(p);
+    await click(b, '[data-project-repo-form] input[name=repo-mode][value=remote]');
+    await fill(b, '#project-repo-url', 'https://git.example.invalid/acme/work');
+    await save(p, '/Saved/');
+    for (const mode of ['light', 'dark']) {
+      await b.call('Emulation.setEmulatedMedia', { features: [{ name: 'prefers-color-scheme', value: mode }] });
+      if (await b.evaluate(`document.getElementById('theme-switch').getAttribute('aria-checked')`) !== String(mode === 'dark')) {
+        await b.evaluate(`document.getElementById('theme-switch').click(), true`);
+        await p.wait(`document.getElementById('theme-switch').getAttribute('aria-checked') === '${mode === 'dark'}'`);
+      }
+      await b.evaluate(`document.querySelector('[data-project-repo]').scrollIntoView({ block: 'start' }), true`);
+      if (width === 390) assert.equal(await b.evaluate('document.documentElement.scrollWidth <= document.documentElement.clientWidth'), true, `page ${width} ${mode}`);
+      assert.equal(await b.evaluate(`(s => s.scrollWidth <= s.clientWidth && s.getBoundingClientRect().right <= document.documentElement.clientWidth)(document.querySelector('[data-project-repo]'))`), true, `section ${width} ${mode}`);
+      assert.equal(await b.evaluate(`[...document.querySelectorAll('[data-project-repo] .project-repo-option')].every(o => o.getBoundingClientRect().height >= 44)`), true, `targets ${width} ${mode}`);
+      assert.equal(await b.evaluate(`document.querySelector('#project-repo-url').getBoundingClientRect().height >= 44`), true, `url field ${width} ${mode}`);
+      if (shots) await b.screenshot(join(shots, `p1-7-project-repo-${width}-${mode}.png`));
+    }
+    assert.deepEqual(p.errors, []);
+  }
+});

packages/webui/tests/proxy-admin-http.test.mjs

@@ -0,0 +1,205 @@
+// #1873 Proxy setup routes over the real HTTP boundary: only the instance owner reaches them, a
+// pasted key crosses only loopback or HTTPS, and no key reaches a response or a log line.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { request } from 'node:http';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { startServer } from '../src/serve.mjs';
+import { createDevOwner } from '../src/dev-owner.mjs';
+import { PROXY_ADMIN_PATHS, keyTransportOk, orgCatalogue } from '../src/proxy-admin.mjs';
+import { consoleAccess } from '../src/access.mjs';
+import { createSsoSession } from './helpers/sso-session.mjs';
+import { REFUSALS } from '../../bus/src/refusals.mjs';
+
+const SENTINEL = 'pa-http-sentinel-key-0123456789abcdef';
+const ROUTES = [
+  ['status', 'GET'], ['unit/render', 'GET'], ['fetch', 'POST', {}], ['init', 'POST', { generate: true }],
+  ['unit/install', 'POST', {}], ['unit/start', 'POST', {}], ['unit/stop', 'POST', {}], ['unit/restart', 'POST', {}],
+  ['fence/clear', 'POST', {}], ['init-lock/clear', 'POST', {}],
+];
+
+function fakeAdmin() {
+  const calls = [];
+  const note = name => async (...args) => { calls.push([name, ...args.filter(a => typeof a !== 'function')]); return { ok: name }; };
+  return {
+    calls,
+    unit: 'mosaic-proxy.service',
+    status: note('status'), render: note('render'), unitAction: note('unitAction'), initLockClear: note('initLockClear'),
+    fetchStart: () => { calls.push(['fetchStart']); return { state: 'running' }; },
+    init: async (call, args) => { calls.push(['init', args]); await call('proxy.init', args); return { settings: { port: 18432 }, receipt: { op: 'init' } }; },
+    fenceClear: async call => { calls.push(['fenceClear']); return call('proxy.fence.clear', { evidence: {} }); },
+  };
+}
+const send = (port, path, { method = 'GET', headers = {}, body } = {}) => new Promise((resolve, reject) => {
+  const req = request({ host: '127.0.0.1', port, path, method, headers }, res => {
+    let text = ''; res.on('data', c => { text += c; }); res.on('end', () => resolve({ status: res.statusCode, text, json: (() => { try { return JSON.parse(text); } catch { return null; } })() }));
+  });
+  req.on('error', reject); req.end(body === undefined ? undefined : typeof body === 'string' ? body : JSON.stringify(body));
+});
+
+async function devServer(t, options = {}) {
+  const admin = fakeAdmin(), busCalls = [], logs = [];
+  const s = await startServer({ port: 0, board: 'http://127.0.0.1:9', sso: createDevOwner(), send: async () => ({}), proxyAdmin: admin,
+    proxyCall: async (verb, args) => { busCalls.push([verb, args]); return { cleared: true }; }, log: line => logs.push(line), ...options });
+  t.after(() => new Promise(r => s.close(r)));
+  const port = s.address().port;
+  const hostFor = name => `${name}:${port}`;
+  const headers = (name = '127.0.0.1') => ({ host: hostFor(name), origin: `http://${hostFor(name)}`, 'sec-fetch-site': 'same-origin', 'content-type': 'application/json' });
+  return { s, port, admin, busCalls, logs, headers };
+}
+const hit = (f, route, extra = {}) => send(f.port, `/api/proxy/admin/${route[0]}`, { method: route[1], headers: { ...f.headers(), ...extra }, body: route[2] });
+
+test('the route table is exactly the brief: status, render, fetch, init, four unit verbs, fence clear, lock clear', () => {
+  assert.deepEqual(PROXY_ADMIN_PATHS, ROUTES.map(([p]) => `/api/proxy/admin/${p}`));
+});
+
+test('the dev local owner reaches every route; init and fence clear go to the bus; the page config offers setup', async t => {
+  const f = await devServer(t);
+  for (const route of ROUTES) {
+    const r = await hit(f, route);
+    assert.equal(r.status, route[0] === 'fetch' ? 202 : 200, route[0]);
+  }
+  assert.deepEqual(f.admin.calls.map(c => c[0]), ['status', 'render', 'fetchStart', 'init', 'unitAction', 'unitAction', 'unitAction', 'unitAction', 'fenceClear', 'initLockClear']);
+  assert.deepEqual(f.admin.calls.filter(c => c[0] === 'unitAction').map(c => c[1]), ['install', 'start', 'stop', 'restart']);
+  assert.deepEqual(f.busCalls.map(c => c[0]), ['proxy.init', 'proxy.fence.clear']);
+  assert.deepEqual(f.busCalls[0][1], { generate: true });
+  const config = await send(f.port, '/api/config', { headers: { host: `127.0.0.1:${f.port}` } });
+  assert.equal(config.json.proxyAdmin, true);
+  assert.equal(config.json.proxyAdminSend, true);
+  for (const line of f.logs.filter(l => l.includes('/api/proxy/admin/'))) assert.match(line, /^\S+ (GET|POST) \/api\/proxy\/admin\/[a-z/-]+ \d{3} user=/);
+});
+
+test('without a proxy admin the config offers no setup and the routes answer not-configured', async t => {
+  const f = await devServer(t, { proxyAdmin: null });
+  const config = await send(f.port, '/api/config', { headers: { host: `127.0.0.1:${f.port}` } });
+  assert.equal(Object.hasOwn(config.json, 'proxyAdmin'), false);
+  assert.deepEqual((await hit(f, ROUTES[0])).json, { error: 'not-configured' });
+});
+
+test('writes refuse a foreign Origin, missing Fetch Metadata, a read-only Console and a wrong method', async t => {
+  const f = await devServer(t);
+  for (const route of ROUTES.filter(r => r[1] === 'POST')) {
+    assert.equal((await hit(f, route, { origin: 'http://evil.example' })).status, 403, `${route[0]} cross-origin`);
+    assert.equal((await hit(f, route, { 'sec-fetch-site': 'cross-site' })).status, 403, `${route[0]} cross-site`);
+    const noMeta = { ...f.headers() }; delete noMeta['sec-fetch-site'];
+    assert.equal((await send(f.port, `/api/proxy/admin/${route[0]}`, { method: 'POST', headers: noMeta, body: route[2] })).status, 403, `${route[0]} no fetch metadata`);
+    assert.equal((await send(f.port, `/api/proxy/admin/${route[0]}`, { method: 'GET', headers: f.headers() })).status, 405, `${route[0]} GET`);
+  }
+  assert.deepEqual(f.admin.calls, []);
+  const readOnly = await devServer(t, { send: null });
+  for (const route of ROUTES.filter(r => r[1] === 'POST')) assert.deepEqual((await hit(readOnly, route)).json, { error: 'read-only' }, route[0]);
+  assert.deepEqual(readOnly.admin.calls, []);
+  assert.equal((await hit(f, ['nope', 'GET'])).status, 404);
+});
+
+test('a pasted key: refused over plain-HTTP LAN before it is judged, accepted on loopback; mismatch and bad keys refuse', async t => {
+  const f = await devServer(t, { devAllowHosts: ['lan.example'] });
+  const lan = { ...f.headers('lan.example') }; delete lan['sec-fetch-site'];
+  const paste = { key: SENTINEL, confirm: SENTINEL };
+  const refused = await send(f.port, '/api/proxy/admin/init', { method: 'POST', headers: lan, body: paste });
+  assert.equal(refused.status, 403); assert.deepEqual(refused.json, { error: 'proxy-key-transport' });
+  const refusedMismatch = await send(f.port, '/api/proxy/admin/init', { method: 'POST', headers: lan, body: { key: SENTINEL, confirm: 'other' } });
+  assert.deepEqual(refusedMismatch.json, { error: 'proxy-key-transport' }, 'transport is checked before the key');
+  const generated = await send(f.port, '/api/proxy/admin/init', { method: 'POST', headers: lan, body: { generate: true } });
+  assert.equal(generated.status, 200, 'a LAN page still gets the generated key');
+  assert.deepEqual(f.busCalls.map(c => c[1]), [{ generate: true }]);
+  assert.deepEqual((await hit(f, ['init', 'POST', { key: SENTINEL, confirm: 'different' }])).json, { error: 'proxy-key-mismatch' });
+  assert.deepEqual((await hit(f, ['init', 'POST', { key: 'a\nb', confirm: 'a\nb' }])).json, { error: 'proxy-key-invalid' });
+  for (const body of [{ key: SENTINEL, confirm: SENTINEL, generate: true }, { generate: true, extra: 1 }, { generate: false }, {}])
+    assert.deepEqual((await hit(f, ['init', 'POST', body])).json, { error: 'invalid-request' }, JSON.stringify(body));
+  assert.deepEqual((await hit(f, ['init', 'POST', { generate: true, port: 8317 }])).json, { error: 'proxy-config-invalid' });
+  assert.deepEqual((await hit(f, ['init', 'POST', { generate: true, rotateGraceMinutes: 0 }])).json, { error: 'proxy-rotate-grace-invalid' });
+  assert.deepEqual((await hit(f, ['init', 'POST', { generate: true, firstOutputSeconds: 99999 }])).json, { error: 'proxy-first-output-invalid' });
+  const ok = await hit(f, ['init', 'POST', { ...paste, port: 18432, rotateGraceMinutes: 5, firstOutputSeconds: 60 }]);
+  assert.equal(ok.status, 200);
+  assert.deepEqual(f.busCalls.at(-1), ['proxy.init', { key: SENTINEL, port: 18432, rotateGraceMinutes: 5, firstOutputSeconds: 60 }]);
+  assert.equal(f.logs.join('\n').includes(SENTINEL), false, 'no key in a log line');
+  assert.equal(JSON.stringify(f.admin.calls.map(c => c[0])).includes(SENTINEL), false);
+});
+
+test('keyTransportOk: HTTPS anywhere, HTTP only on a loopback name from a loopback peer', () => {
+  assert.equal(keyTransportOk('https://console.example', '10.0.0.5'), true);
+  assert.equal(keyTransportOk('http://127.0.0.1:7330', '127.0.0.1'), true);
+  assert.equal(keyTransportOk('http://localhost:7330', '::ffff:127.0.0.1'), true);
+  assert.equal(keyTransportOk('http://127.0.0.1:7330', '10.0.0.5'), false, 'a forwarded peer');
+  assert.equal(keyTransportOk('http://lan.example:7330', '127.0.0.1'), false);
+  assert.equal(keyTransportOk('http://10.0.0.2:7330', '10.0.0.5'), false);
+  assert.equal(keyTransportOk('not a url', '127.0.0.1'), false);
+});
+
+test('a refusal from the controller or bus reaches the page as its code only', async t => {
+  const f = await devServer(t);
+  const leak = Object.assign(new Error(`${SENTINEL} /home/owner/.config/mosaic-dev/proxy.json upstream body`), { code: 'proxy-unit-failed' });
+  f.admin.unitAction = async () => { throw leak; };
+  f.admin.status = async () => { throw new Error(SENTINEL); };
+  const unit = await hit(f, ['unit/start', 'POST', {}]);
+  assert.deepEqual(unit.json, { error: 'proxy-unit-failed' });
+  const status = await hit(f, ROUTES[0]);
+  assert.deepEqual(status.json, { error: 'outcome-unknown' });
+  for (const text of [unit.text, status.text, f.logs.join('\n')]) { assert.equal(text.includes(SENTINEL), false); assert.equal(text.includes('/home/'), false); }
+  const big = await send(f.port, '/api/proxy/admin/init', { method: 'POST', headers: f.headers(), body: `{"key":"${SENTINEL}${'x'.repeat(17000)}"}` });
+  assert.deepEqual(big.json, { error: 'invalid-request' });
+  const broken = await send(f.port, '/api/proxy/admin/init', { method: 'POST', headers: f.headers(), body: `{"key":"${SENTINEL}` });
+  assert.deepEqual(broken.json, { error: 'invalid-request' });
+  assert.equal(f.logs.join('\n').includes(SENTINEL), false);
+});
+
+test('an SSO root owner reaches the routes and may paste over HTTPS; a granted user gets human-required on every route', async t => {
+  const access = { accessVersion: 1, revision: 1,
+    users: [{ id: 'alice', home: 'local', subjects: [{ provider: 'writer', sub: 'alice-sub' }] }],
+    grants: [{ id: 'g-1', user: 'alice', business: 'demo', projects: ['*'], instances: ['*'], level: 'collaborator' }] };
+  const auth = await createSsoSession(t, { host: 'console.example', users: consoleAccess({ load: () => access, business: () => 'demo' }) });
+  const admin = fakeAdmin(), busCalls = [];
+  let bound = 0;
+  const s = await startServer({ port: 0, sso: auth.sso, send: async () => ({}), proxyAdmin: admin, proxyCall: async (verb, args) => { busCalls.push([verb, args]); return {}; },
+    userOptions: () => { bound++; return {}; }, log: () => {} });
+  t.after(() => new Promise(r => s.close(r)));
+  const port = s.address().port;
+  const owner = auth.writeHeaders(await auth.signIn(port));
+  assert.equal((await send(port, '/api/proxy/admin/status', { headers: owner })).status, 200);
+  assert.equal((await send(port, '/api/config', { headers: owner })).json.proxyAdmin, true);
+  const pasted = await send(port, '/api/proxy/admin/init', { method: 'POST', headers: owner, body: { key: SENTINEL, confirm: SENTINEL } });
+  assert.equal(pasted.status, 200, 'HTTPS origin carries a pasted key');
+  assert.equal(pasted.text.includes(SENTINEL), false);
+  const before = admin.calls.length;
+  const alice = auth.writeHeaders(await auth.signIn(port, { sub: 'alice-sub' }));
+  for (const [route, method, body] of ROUTES) {
+    const r = await send(port, `/api/proxy/admin/${route}`, { method, headers: alice, body });
+    assert.equal(r.status, 403, route);
+    assert.deepEqual(r.json, { error: 'human-required' }, route);
+  }
+  assert.equal(bound, 0, 'refused before a user transport is bound');
+  assert.equal(Object.hasOwn((await send(port, '/api/config', { headers: alice })).json, 'proxyAdmin'), false);
+  assert.equal(admin.calls.length, before);
+});
+
+test('the tester listener gets human-required on every route, read or write', async t => {
+  const { startTesterSocket } = await import('../src/tester-socket.mjs');
+  const { testerRequest } = await import('../../cli/src/tester-http.mjs');
+  const root = mkdtempSync(join(tmpdir(), 'pa-tester-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const admin = fakeAdmin();
+  let calls = 0;
+  const s = await startTesterSocket({ dataRoot: root, proxyAdmin: admin, proxyCall: async () => { calls++; return {}; }, log: () => {} });
+  t.after(() => new Promise(r => s.close(r)));
+  for (const [route, method, body] of ROUTES) {
+    const r = await testerRequest({ dataRoot: root, path: `/api/proxy/admin/${route}`, method, body });
+    assert.equal(r.status, 403, route);
+  }
+  assert.equal(calls, 0);
+  assert.deepEqual(admin.calls, []);
+});
+
+test('every refusal code a setup route can answer has a refusal-table entry with a next step', () => {
+  for (const code of ['human-required', 'proxy-key-transport', 'proxy-key-mismatch', 'proxy-key-invalid', 'proxy-config-invalid', 'proxy-rotate-grace-invalid', 'proxy-first-output-invalid', 'proxy-admin-busy', 'proxy-restart-required', 'proxy-restart-unconfirmed', 'proxy-init-lock-held', 'proxy-init-lock-absent', 'proxy-unit-missing', 'proxy-unit-unhealthy', 'proxy-unit-failed', 'not-configured', 'outcome-unknown', 'invalid-request'])
+    assert.equal(typeof REFUSALS[code]?.nextStep, 'string', code);
+});
+
+test('an organization whose bus does not answer shows no model count, not a made-up 0', async () => {
+  assert.deepEqual(await orgCatalogue(async () => { throw new Error('down'); }), { status: 'bus-unavailable', models: null });
+  assert.deepEqual(await orgCatalogue(async () => ({ catalogue: { status: 'disabled' } })), { status: 'disabled', models: null });
+  assert.deepEqual(await orgCatalogue(async () => ({ catalogue: { status: 'enabled', models: [{ id: 'a' }, { id: 'b' }] } })), { status: 'enabled', models: 2 });
+  assert.deepEqual(await orgCatalogue(async () => ({ catalogue: { status: 'enabled', models: [] } })), { status: 'enabled', models: 0 });
+});

packages/webui/tests/proxy-setup-browser.test.mjs

@@ -0,0 +1,146 @@
+// #1873 the Proxy setup panel in a real browser: the next step is one button, init sends a
+// generated-key request unless the owner pastes a key on loopback, and pasted fields are cleared.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { w15Fixture } from './w15-fixture.mjs';
+
+const T = '2026-11-11T12:00:00.000Z';
+const base = {
+  release: { fetched: false, verified: false, version: '8.0.42', panelVersion: '1.26.7' },
+  init: { initialized: false, partial: false, files: [{ label: 'proxy settings', present: false }, { label: 'management key', present: false }] },
+  unit: { unit: 'mosaic-proxy.service', installed: false, active: 'inactive' },
+  fence: { set: false }, initLock: { present: false, clearable: false, blockers: [] },
+  fetch: { state: 'idle' }, restart: null, busy: null,
+  organizations: [{ id: 'acme', proxy: 'shared', catalogue: null }],
+  ownProxy: { available: false, state: 'not built', reason: 'The configuration has one proxy per instance.' },
+  next: ['fetch'],
+};
+const fetched = { ...base, release: { ...base.release, fetched: true, verified: true }, next: ['init'] };
+const fenced = { ...base, release: fetched.release, init: { initialized: true, partial: false, settings: { port: 18432 }, files: [] },
+  unit: { unit: 'mosaic-proxy.service', installed: true, active: 'active', pid: 4242, port: 18432, listening: true },
+  fence: { set: true, op: 'apikey.add', org: 'acme', time: T }, restart: { confirmed: true, pid: 4242, observedAt: T }, next: ['fence-clear'] };
+const unconfigured = { 'GET /api/proxy/accounts': { status: 503, body: { error: 'not-configured' } }, 'GET /api/proxy/keys': { status: 503, body: { error: 'not-configured' } } };
+const scenario = (status, config = {}) => ({ '/api/config': { send: true, devOwner: true, proxyAdmin: true, proxyAdminSend: true, ...config }, '/api/proxy/admin/status': status, ...unconfigured });
+const writes = b => b.evaluate('window.__writes.filter(w=>w.path.startsWith("/api/proxy/admin/")).map(w=>({path:w.path,body:JSON.parse(w.body)}))');
+
+test('a fresh instance shows the fetch step as one button, the not-built own proxy, and no terminal note', { timeout: 90000 }, async t => {
+  const { f, b, wait } = await w15Fixture(t, { scenario: { ...scenario(base), 'POST /api/proxy/admin/fetch': { status: 202, body: { state: 'running' } } } });
+  await b.navigate(f.base + '/#/settings/model-proxy');
+  await wait('document.querySelector("#proxy-setup-go")?.dataset.next==="fetch"');
+  assert.equal(await b.evaluate('document.querySelector("#proxy-setup").hidden'), false);
+  assert.equal(await b.evaluate('document.querySelector("#proxy-setup-go").textContent'), 'Fetch the pinned release');
+  assert.match(await b.evaluate('document.querySelector("#proxy-setup-next p").textContent'), /CLIProxyAPI 8\.0\.42/);
+  assert.match(await b.evaluate('document.querySelector("#proxy-setup-own").textContent'), /not built/);
+  assert.equal(await b.evaluate('document.querySelector("#proxy-setup-orgs td").textContent'), 'acme');
+  await wait('document.querySelector("#proxy-message")?.textContent.includes("Follow the next step under Proxy setup")');
+  assert.equal(await b.evaluate('!!document.querySelector("#proxy-dev-setup")'), false, 'the page replaces the terminal note');
+  assert.equal(await b.evaluate('document.querySelectorAll("#proxy-setup-init [data-setup-write]:not([disabled])").length'), 0, 'init waits for a verified release');
+  await b.evaluate('document.querySelector("#proxy-setup-go").click()');
+  await wait('window.__writes.some(w=>w.path==="/api/proxy/admin/fetch")');
+  assert.deepEqual(await writes(b), [{ path: '/api/proxy/admin/fetch', body: {} }]);
+  assert.deepEqual(await b.evaluate('window.__unexpected'), []);
+});
+
+test('without send the next-step button is disabled and nothing is posted', { timeout: 90000 }, async t => {
+  const { f, b, wait } = await w15Fixture(t, { scenario: scenario(base, { send: false, proxyAdminSend: false }) });
+  await b.navigate(f.base + '/#/settings/model-proxy');
+  await wait('document.querySelector("#proxy-setup-go")?.dataset.next==="fetch"');
+  assert.equal(await b.evaluate('document.querySelector("#proxy-setup-go").disabled'), true);
+  await b.evaluate('document.querySelector("#proxy-setup-go").click()');
+  assert.deepEqual(await writes(b), []);
+});
+
+test('init sends generate by default; a pasted key on loopback is sent with its confirmation and the fields are cleared', { timeout: 90000 }, async t => {
+  const { f, b, wait } = await w15Fixture(t, { scenario: { ...scenario(fetched), 'POST /api/proxy/admin/init': { body: { settings: { port: 18432 }, receipt: { op: 'init', time: T, port: 18432, generated: true } } } } });
+  await b.navigate(f.base + '/#/settings/model-proxy');
+  await wait('document.querySelector("#proxy-setup-go")?.dataset.next==="init"');
+  await b.evaluate('document.querySelector("#proxy-setup-go").click()');
+  await wait('document.querySelector("#proxy-setup-init-box").open===true');
+  assert.equal(await b.evaluate('document.querySelector("#proxy-setup-paste-choice").hidden'), false, 'loopback page offers the paste choice');
+  assert.equal(await b.evaluate('document.querySelector("#proxy-setup-paste").hidden'), true);
+  await b.evaluate('(()=>{const f=document.querySelector("#proxy-setup-init");f.elements.port.value="18432";f.requestSubmit();})()');
+  await wait('window.__writes.some(w=>w.path==="/api/proxy/admin/init")');
+  await wait('document.querySelector("#proxy-setup-message").textContent.includes("with a generated key")');
+  assert.deepEqual(await writes(b), [{ path: '/api/proxy/admin/init', body: { port: 18432, generate: true } }]);
+  assert.match(await b.evaluate('document.querySelector("#proxy-setup-receipts").textContent'), /init/);
+  await wait('!document.querySelector("#proxy-setup-init [data-setup-write]").disabled');
+  await b.evaluate('(()=>{const f=document.querySelector("#proxy-setup-init");f.elements.keySource.value="paste";f.querySelector("[value=paste]").dispatchEvent(new Event("change"));f.elements.port.value="";f.elements.key.value="pa-browser-sentinel-0001";f.elements.confirm.value="pa-browser-sentinel-0002";f.requestSubmit();})()');
+  await wait('document.querySelector("#proxy-setup-message").textContent.includes("proxy-key-mismatch")');
+  assert.equal((await writes(b)).length, 1, 'a mismatch is refused in the page');
+  assert.equal(await b.evaluate('document.querySelector("#proxy-setup-init").elements.key.value'), '', 'the key field is cleared on submit');
+  await b.evaluate('(()=>{const f=document.querySelector("#proxy-setup-init");f.elements.key.value="pa-browser-sentinel-0001";f.elements.confirm.value="pa-browser-sentinel-0001";f.requestSubmit();})()');
+  await wait('window.__writes.filter(w=>w.path==="/api/proxy/admin/init").length===2');
+  assert.deepEqual((await writes(b))[1], { path: '/api/proxy/admin/init', body: { key: 'pa-browser-sentinel-0001', confirm: 'pa-browser-sentinel-0001' } });
+  assert.equal(await b.evaluate('[...document.querySelectorAll("#proxy-setup-init input[type=password]")].every(i=>i.value==="")'), true);
+  assert.equal(await b.evaluate('document.body.innerText.includes("pa-browser-sentinel")'), false);
+});
+
+test('after a confirmed restart the next step clears the fence and shows the receipt', { timeout: 90000 }, async t => {
+  const { f, b, wait } = await w15Fixture(t, { scenario: { ...scenario(fenced), 'POST /api/proxy/admin/fence/clear': { body: { cleared: true, receipt: { op: 'fence.clear', time: T, pid: 4242 } } } } });
+  await b.navigate(f.base + '/#/settings/model-proxy');
+  await wait('document.querySelector("#proxy-setup-go")?.dataset.next==="fence-clear"');
+  assert.match(await b.evaluate('document.querySelector("#proxy-setup-state").textContent'), /new pid 4242/);
+  await b.evaluate('document.querySelector("#proxy-setup-go").click()');
+  await wait('document.querySelector("#proxy-setup-message").textContent.includes("Fence cleared")');
+  assert.deepEqual(await writes(b), [{ path: '/api/proxy/admin/fence/clear', body: {} }]);
+  assert.match(await b.evaluate('document.querySelector("#proxy-setup-receipts").textContent'), /fence\.clear.*pid: 4242/);
+});
+
+test('a stopped proxy hides the account panels with a setup note, and starting the service brings them back', { timeout: 90000 }, async t => {
+  const installed = { ...base, release: fetched.release, init: { initialized: true, partial: false, settings: { port: 18432 }, files: [] },
+    unit: { unit: 'mosaic-proxy.service', installed: true, active: 'inactive' }, next: ['unit-start'] };
+  const down = { 'GET /api/proxy/accounts': { status: 503, body: { error: 'proxy-down' } }, 'GET /api/proxy/keys': { status: 503, body: { error: 'proxy-down' } } };
+  const { f, b, wait } = await w15Fixture(t, { scenario: { ...scenario(installed), ...down, 'POST /api/proxy/admin/unit/start': { body: { receipt: { op: 'unit.start', time: T, pid: 4242 } } } } });
+  await b.navigate(f.base + '/#/settings/model-proxy');
+  await wait('document.querySelector("#proxy-setup-go")?.dataset.next==="unit-start"');
+  await wait('document.querySelector("#proxy-message").textContent.includes("not running yet")');
+  assert.equal(await b.evaluate('document.querySelector("[aria-labelledby=proxy-apikey-title]").hidden'), true);
+  await b.evaluate(`Object.assign(window.__scenario, {
+    'GET /api/proxy/accounts': { body: { accounts: [] } }, 'GET /api/proxy/keys': { body: { keys: [] } },
+    '/api/proxy/admin/status': ${JSON.stringify({ ...base, release: fetched.release, init: { initialized: true, partial: false, settings: { port: 18432 }, files: [] },
+      unit: { unit: 'mosaic-proxy.service', installed: true, active: 'active', pid: 4242, port: 18432, listening: true }, next: ['accounts'] })} })`);
+  await b.evaluate('document.querySelector("#proxy-setup-go").click()');
+  await wait('window.__writes.some(w=>w.path==="/api/proxy/admin/unit/start")');
+  await wait('document.querySelector("#proxy-message").textContent.includes("Accounts and client keys loaded")');
+  assert.equal(await b.evaluate('document.querySelector("[aria-labelledby=proxy-apikey-title]").hidden'), false);
+  assert.equal(await b.evaluate('document.querySelector("[aria-labelledby=proxy-accounts-title]").hidden'), false);
+});
+
+test('an initialized proxy whose accounts read fails with another code also hides the panels until it answers', { timeout: 90000 }, async t => {
+  const installed = { ...base, release: fetched.release, init: { initialized: true, partial: false, settings: { port: 18432 }, files: [] },
+    unit: { unit: 'mosaic-proxy.service', installed: true, active: 'inactive' }, next: ['unit-start'] };
+  const failing = { 'GET /api/proxy/accounts': { status: 503, body: { error: 'outcome-unknown' } }, 'GET /api/proxy/keys': { status: 503, body: { error: 'outcome-unknown' } } };
+  const { f, b, wait } = await w15Fixture(t, { scenario: { ...scenario(installed), ...failing, 'POST /api/proxy/admin/unit/start': { body: { receipt: { op: 'unit.start', time: T, pid: 4242 } } } } });
+  await b.navigate(f.base + '/#/settings/model-proxy');
+  await wait('document.querySelector("#proxy-setup-go")?.dataset.next==="unit-start"');
+  await wait('document.querySelector("#proxy-message").textContent.includes("the account panels return once the proxy answers")');
+  assert.equal(await b.evaluate('document.querySelector("[aria-labelledby=proxy-accounts-title]").hidden'), true);
+  await b.evaluate(`Object.assign(window.__scenario, {
+    'GET /api/proxy/accounts': { body: { accounts: [] } }, 'GET /api/proxy/keys': { body: { keys: [] } },
+    '/api/proxy/admin/status': ${JSON.stringify({ ...base, release: fetched.release, init: { initialized: true, partial: false, settings: { port: 18432 }, files: [] },
+      unit: { unit: 'mosaic-proxy.service', installed: true, active: 'active', pid: 4242, port: 18432, listening: true }, next: ['accounts'] })} })`);
+  await b.evaluate('document.querySelector("#proxy-setup-go").click()');
+  await wait('document.querySelector("#proxy-message").textContent.includes("Accounts and client keys loaded")');
+  assert.equal(await b.evaluate('document.querySelector("[aria-labelledby=proxy-accounts-title]").hidden'), false);
+});
+
+test('a fence with no readable time names the --proxy-restarted path instead of a page restart', { timeout: 90000 }, async t => {
+  const timeless = { ...fenced, fence: { set: true, invalid: true }, restart: null, next: ['unit-restart'] };
+  const { f, b, wait } = await w15Fixture(t, { scenario: scenario(timeless) });
+  await b.navigate(f.base + '/#/settings/model-proxy');
+  await wait('document.querySelector("#proxy-setup-go")?.dataset.next==="unit-restart"');
+  assert.match(await b.evaluate('document.querySelector("#proxy-setup-next p").textContent'), /no readable time.*mosaic proxy fence clear --proxy-restarted/);
+});
+
+test('after a reload the receipts come from status, and an initialized proxy folds the init form', { timeout: 90000 }, async t => {
+  const initialized = { ...base, release: fetched.release, init: { initialized: true, partial: false, settings: { port: 18432 }, files: [] },
+    receipts: [{ op: 'fetch', time: T, version: '8.0.42' }, { op: 'init', time: T, generated: true, port: 18432 }], next: ['unit-install'] };
+  const { f, b, wait } = await w15Fixture(t, { scenario: { ...scenario(initialized), 'POST /api/proxy/admin/unit/install': { body: { receipt: { op: 'unit.install', time: T } } } } });
+  await b.navigate(f.base + '/#/settings/model-proxy');
+  await wait('document.querySelector("#proxy-setup-go")?.dataset.next==="unit-install"');
+  assert.deepEqual(await b.evaluate('[...document.querySelectorAll("#proxy-setup-receipts li strong")].map(s=>s.textContent)'), ['init', 'fetch'], 'newest first, from proxy-admin.jsonl');
+  await b.evaluate('document.querySelector("#proxy-setup-init-box").open = true');
+  await b.evaluate('document.querySelector("#proxy-setup-go").click()');
+  await wait('window.__writes.some(w=>w.path==="/api/proxy/admin/unit/install")');
+  await wait('document.querySelector("#proxy-setup-init-box").open===false');
+});