fix(org): repo set refuses under a copy binding that still grants the project (#1873 F7)

A copy binding grants the repositories its projects' remotes name when a
credential is issued, and its decision records only project names. repo set
(CLI, route, Settings tab) is now refused with project-repo-bound while a
pending or bound copy binding names the project, before any check, origin
change or write, and again under the lock. The message names the copies and
the next step: revoke the binding, set the repository, raise a new binding
decision. An unbound binding, or none, behaves as before. Bindings are read
from the loader-validated document; binding, launcher and broker code are
unchanged. New refusal-table entry for project-repo-bound.

packages/bus/src/broker.mjs

@@ -643,6 +643,8 @@ export class Broker {
   // section 5's restart rows and of revokes a restart cut short, for reconcileGitea.
   #giteaGrant;
   #copyGrant;
+  // #1873 CB3: copy-launch.mjs's gate, or null. It answers for a copy the boot left needing a binding.
+  #copyLaunch;
   #giteaKeys;
   #giteaUndo = [];
   // Row 281 (#1786, d6 section 3b): each tracked Gitea promise and the business/agent it acts for, or
@@ -668,7 +670,7 @@ export class Broker {
   #processing;
   #taskTracker;
   // credentialStatus is the runtime's metadata-only Credentials.status(); the broker never gets use().
-  constructor({ store, businesses, pluginService = null, secretCheck = () => {}, credentialStatus = () => [], organization = null, hires = null, autonomy = null, project = null, library = null, usage = null, limits = null, harnessOn = null, credentialVerbs = null, proxyInit = null, proxyFenceClear = null, proxyPage = null, hostGrant = null, hostKeys = null, processing = null, testerOn = null, grantScope = null, roleFile = null, giteaGrant = null, copyGrant = null, giteaKeys = null, access = null, accessStamp = null, compactions = null, requestLifecycle = null, requirementsHost = null, workspaceRead = null, taskTracker = null }) {
+  constructor({ store, businesses, pluginService = null, secretCheck = () => {}, credentialStatus = () => [], organization = null, hires = null, autonomy = null, project = null, library = null, usage = null, limits = null, harnessOn = null, credentialVerbs = null, proxyInit = null, proxyFenceClear = null, proxyPage = null, hostGrant = null, hostKeys = null, processing = null, testerOn = null, grantScope = null, roleFile = null, giteaGrant = null, copyGrant = null, copyLaunch = null, giteaKeys = null, access = null, accessStamp = null, compactions = null, requestLifecycle = null, requirementsHost = null, workspaceRead = null, taskTracker = null }) {
     if (!object(businesses) || !Object.keys(businesses).length) fail('invalid-business');
     // Row 194 b15 (sage-2501): the function-argument checks come before anything reads the store.
     if (harnessOn !== null && typeof harnessOn !== 'function') throw new TypeError('harnessOn must be a function');
@@ -703,6 +705,7 @@ export class Broker {
     this.#hostKeys = hostKeys;
     this.#giteaGrant = giteaGrant;
     this.#copyGrant = copyGrant;
+    this.#copyLaunch = copyLaunch;
     this.#giteaKeys = giteaKeys;
     this.#access = access;
     this.#accessStamp = accessStamp;
@@ -1566,15 +1569,32 @@ export class Broker {
   // #1873 A3: a root or project copy the boot left unbound or refused isn't in `roles`. Its refusal
   // names the agent and the missing services or the reason, never a value (organization
   // agent-copies.mjs copyRefusal; inlined because this module also loads in the sandbox client).
-  #copyRefused(b, instance) {
+  #copyRefused(b, instance, session = null) {
     const copy = b.copies && Object.hasOwn(b.copies, instance) ? b.copies[instance] : null;
     if (b.roles[instance]?.unbound?.length) throw new BusError('credential-unbound', `${instance} has no binding for ${b.roles[instance].unbound.join(', ')}`);
     if(copy?.level==='root') {
       const refusal=this.#hires?.rootRefusal ? this.#hires.rootRefusal(copy.name) : this.#hires?.rootActive && !this.#hires.rootActive(copy.name) ? 'instance-fired' : null;
       if(refusal)fail(refusal);
     }
+    // #1873 CB3: a copy bound at boot holds only while the gate's launch authority does, and a run
+    // only while it is the authority bindLaunch admitted for it. Without a gate it is unavailable.
+    if (b.roles[instance]?.copyBound?.length) {
+      if (!this.#copyLaunch) fail('credential-unavailable');
+      const { authority } = this.#copyLaunch.authority(b.id, instance);
+      if (session && session.copyAuthority !== authority) fail('copy-authority-changed');
+    }
     if (!copy || copy.state === 'instance') return;
-    if (copy.state === 'unbound') throw new BusError('credential-unbound', `${instance} has no binding in ${b.id} for ${copy.missing.join(', ')}`);
+    if (copy.state === 'unbound') {
+      // A binding approved after boot is restart-required, a failed boot check keeps its code.
+      if (this.#copyLaunch) {
+        try {
+          this.#copyLaunch.authority(b.id, instance);
+        } catch (e) {
+          if (!(e instanceof BusError) || e.code !== 'credential-unbound') throw e;
+        }
+      }
+      throw new BusError('credential-unbound', `${instance} has no binding in ${b.id} for ${copy.missing.join(', ')}`);
+    }
     throw new BusError(copy.project === null ? 'copy-refused' : 'project-refused', `${instance} can't launch in ${b.id}: ${copy.reason}`);
   }
   // #1873 A3: why `instance` can't work in code project `repo`, as a BusError, or null when it can
@@ -1860,7 +1880,7 @@ export class Broker {
     if (s.tester) fail('tester-refused');
     if (s.reader) fail('read-only');
     if (s.human) fail('agent-required');
-    this.#copyRefused(this.#business(s.business),s.role);
+    this.#copyRefused(this.#business(s.business),s.role,s);
     const h = this.#own(s);
     if (h?.op !== 'claim' || (s.thread ? h.generation !== this.#runGeneration(s) : h.holder_run !== s.run))
       fail(this.#launcherReleased.has(s.business + ':' + s.run) ? 'launcher-released'
@@ -2121,7 +2141,7 @@ export class Broker {
   #launchProof(record) {
     keys(
       record,
-      ['business', 'role', 'run', 'harness', 'address', 'pid', 'startTime', 'thread', 'session', 'provider', 'model', 'account', 'transcript'],
+      ['business', 'role', 'run', 'harness', 'address', 'pid', 'startTime', 'thread', 'session', 'provider', 'model', 'account', 'transcript', 'copyAuthority', 'revision'],
       ['business', 'role', 'run', 'harness'],
     );
     const b = this.#business(identifier(record.business));
@@ -2186,6 +2206,14 @@ export class Broker {
     if (!old && !this.#harnessOn(record.business, record.harness)) fail('invalid-harness');
     if (!old && record.thread !== undefined && this.#archived(record.business, this.#threadRow(session, record.thread).project)) fail('project-archived');
     if (!old && record.thread !== undefined && this.#threadLost(record.business, record.thread)) fail('thread-revoked');
+    // #1873 CB3: a bound copy's run carries the launch authority its prepare and final admission
+    // checked, and the organization file revision (A3) the launch resolved; both must still hold
+    // now, and the session keeps the authority for every later use.
+    if (launchRole.copyBound?.length) {
+      if (!this.#copyLaunch) fail('credential-unavailable');
+      if (typeof record.copyAuthority !== 'string') fail('copy-authority-changed');
+      this.#copyLaunch.admit(record.business, record.role, record.copyAuthority, record.revision ?? null);
+    } else if (record.copyAuthority !== undefined || record.revision !== undefined) fail('invalid-request');
     if (!old) this.#store.transaction(() => this.#event(session, 'session.launched', body, record.run));
     this.#runs.set(key, session);
     return this.#cap(session);
@@ -5487,6 +5515,20 @@ export class Broker {
   }
   // Design D5: the only key the git socket's gitea token use gets is the agent checkPublish checked
   // (#agent: a run holding its claim, never a tester, reader or human). Trusted host only.
+  // #1873 CB3: who a copy credential call is for, from the capability's own live run: business,
+  // role, run and the launch authority bindLaunch admitted. Never a human, tester or reader, never an
+  // ended run, and only while the copy's authority is still the one the run was admitted on.
+  // Trusted host only; no socket verb returns it.
+  copySession(cap) {
+    const s = this.#session(cap);
+    if (s.human || s.tester || s.reader) fail('copy-request-refused');
+    const key = s.business + ':' + s.run;
+    if (this.#runs.get(key) !== s || this.#ended.has(key)) fail('run-ended');
+    const b = this.#business(s.business);
+    if (!b.roles[s.role]?.copyBound?.length || typeof s.copyAuthority !== 'string') fail('copy-request-refused');
+    this.#copyRefused(b, s.role, s);
+    return Object.freeze({ business: s.business, role: s.role, run: s.run, copyAuthority: s.copyAuthority });
+  }
   publishSession(ticket) {
     const { s } = this.#publish(ticket);
     return Object.freeze({ business: s.business, role: s.role });
@@ -6412,11 +6454,16 @@ export class Broker {
     if (s.tester || s.reader || !s.human) fail(s.tester ? 'tester-refused' : 'human-required');
     if (s.hireMembership ? s.hireMembership.owner !== true : s.human !== this.#business(s.business).human) fail('human-required');
   }
+  // #1873 CB3: a write that changes a copy's binding or grant runs inside the gate's fence, so no
+  // launch is admitted and no call goes out while it runs; an unknown outcome keeps the fence.
+  #copyFence(business, instance, fn) {
+    return this.#copyLaunch && typeof instance === 'string' ? this.#copyLaunch.fence(business, instance, fn) : Promise.resolve().then(fn);
+  }
   #issueCopyGrant(s, a) {
     this.#copyOwner(s);
     const passed = (e) => e instanceof BusError && (e.code.startsWith('credential-') || ['copy-unavailable', 'human-required',
       'definition-holds-credential', 'definition-scan-unreadable'].includes(e.code));
-    return this.#copyGrant(s.business, a, { actor: s.human, owner: true, recheck: () => this.#copyOwner(s) })
+    return this.#copyFence(s.business, a.agent, () => this.#copyGrant(s.business, a, { actor: s.human, owner: true, recheck: () => this.#copyOwner(s) }))
       .then((result) => {
         this.#secretCheck(result);
         if (JSON.stringify(result).includes(a.token)) fail('credential-leak');
@@ -6656,7 +6703,7 @@ export class Broker {
     if(!this.#hires)fail('not-configured');
     try {
       if(p.op==='fire' && p.level!=='org')await this.#stopCopyApproved(s,p);
-      const result=p.op==='fire' && p.level==='org' ? await this.#fireApproved(s,p) : await this.#hires.apply(s.business,d.id,{...caller,digest:p.digest,adjust:a.adjust});
+      const result=p.op==='fire' && p.level==='org' ? await this.#fireApproved(s,p) : await this.#copyFence(s.business,p.binding?.instance,()=>this.#hires.apply(s.business,d.id,{...caller,digest:p.digest,adjust:a.adjust}));
       if(p.op==='fire' && p.level!=='org')this.#store.transaction(()=>this.#event(s,'action.allowed',{action:'fire.done',decision:d.id},p.level==='project'?`${p.name}.${p.project}`:p.name));
       this.#store.transaction(()=>this.#event(s,'action.allowed',{operation:result.done===false?'hire.started':'hire.apply',decision:d.id,transaction:result.transaction??null},d.id));
       return {...result,id:d.id,op:'resolved',choice:a.choice,transaction:result.transaction??null};

packages/bus/src/copy-launch.mjs

@@ -0,0 +1,320 @@
+// #1873 CB3: launch admission for an agent copy's bound service, and the one checked call a copy
+// session makes with it (design docs/plans/2026-11-11_copy-credential-binding-design.md section 5
+// steps 7 and 8). Gitea is the only service with a verifier.
+//
+// Boot: each copy the boot left unbound whose record is bound with every service granted is
+// re-resolved (role, definition pin, admitted projects, incarnation) and its slot's token is proved
+// live at the service again. Only a copy that passes all of it is materialized (promoteCopies). A
+// binding approved after boot is never launched: it answers restart-required until the next boot.
+//
+// Every launch (prepare, final admission and bindLaunch) recomputes the launch authority: a digest
+// of the organization, copy, definition pin, copyId, incarnation, binding generation, each grant's
+// id and generation, the services and projects the copy reaches now, and their repositories at the
+// one origin the boot proved the token at. Every check reads the registry entry again: an
+// organization no longer active, or with another incarnation, admits and sends nothing. Prepare
+// proves the slot live again; the digest before and after must agree. The
+// session keeps the digest bindLaunch admitted, and each call recomputes it before and after the
+// request: a revoke, a re-issue, a role change or a project change in between denies the call.
+//
+// A revoke of a copy's binding runs inside fence(): while one is in flight the copy admits nothing
+// and a call refuses credential-revoking. A revoke whose outcome is unknown keeps the fence until
+// the next boot. The token is never held: each call reads the slot by the identity the boot proved
+// and checks it against a keyed MAC of the token the boot proved. Nothing here logs, and no result
+// or refusal holds the token, the slot's path or anything derived from the token.
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { BusError } from './broker.mjs';
+import { assertNotHeld } from './credentials.mjs';
+import { send } from './gitea-grant.mjs';
+import { boundRepositories, tokenLevels, verifyGiteaToken } from './copy-grant.mjs';
+import { readOrgEntrySync } from '../../organization/src/org-registry.mjs';
+import { allGranted, copyBotLogin, definitionPin, resolveCopyBinding } from '../../organization/src/copy-bindings.mjs';
+import { COPY_BINDABLE } from '../../organization/src/agent-copies.mjs';
+import { checkDefinitions, readTemplate } from '../../organization/src/definitions.mjs';
+import { loadRole } from '../../organization/src/role.mjs';
+import { resolveAgentLevels } from '../../organization/src/agent-levels.mjs';
+import { canonicalJson, sha256 } from '../../organization/src/util.mjs';
+
+const deny = (code) => {
+  throw new BusError(code);
+};
+const object = (x) => x !== null && typeof x === 'object' && !Array.isArray(x);
+// The repository API a copy session may call: /api/v1/repos/<owner>/<repo>[/<rest>], ASCII names,
+// no dot segment, no encoded separator, no query beyond plain pairs.
+const REPO_PATH = /^\/api\/v1\/repos\/([A-Za-z0-9_.-]{1,100})\/([A-Za-z0-9_.-]{1,100})((?:\/[A-Za-z0-9_.-]{1,200}){0,8})(\?[A-Za-z0-9_=&.-]{0,200})?$/;
+const READ = ['GET', 'HEAD'];
+const WRITE = ['POST', 'PUT', 'PATCH', 'DELETE'];
+// Codes a boot check keeps for the copy; anything else (a thrown bug, a transport surprise) is
+// credential-unavailable.
+const KEPT = /^(credential-|copy-)/;
+
+// The launcher waits on its host channel for prepare, and the host stops on a reply later than its
+// request timeout (10 s); the boot runs inside the host's boot timeout (30 s). Each proof is held to
+// a budget well under those: a service slower than that answers no answer, so it is not proved.
+export const PREPARE_BUDGET_MS = 8000;
+export const BOOT_BUDGET_MS = 20000;
+
+export function copyLaunchGate({ credentials, writer, configDir, rolesDir, snapshot, transport = send, ca = undefined, timeoutMs = undefined, now = () => new Date(),
+  prepareMs = PREPARE_BUDGET_MS, bootMs = BOOT_BUDGET_MS }) {
+  const org = snapshot?.org ?? null;
+  const key = randomBytes(32);
+  const mac = (token) => createHmac('sha256', key).update(token).digest();
+  const verified = new Map();
+  const failed = new Map();
+  const fences = new Map();
+  const today = () => now().toISOString().slice(0, 10);
+  // The organization's registry incarnation as the registry stands now, or null when the entry is
+  // gone, carries none, or is not active (reserved, deleting, archived). Read on every check, never
+  // cached: an organization archived while the bus runs admits and sends nothing. An unreadable or
+  // unsafe registry refuses credential-unavailable.
+  const liveIncarnation = () => {
+    let entry;
+    try {
+      entry = readOrgEntrySync(configDir, org);
+    } catch {
+      return deny('credential-unavailable');
+    }
+    return entry?.state === 'active' ? entry.incarnation : null;
+  };
+  // The organization file is still the revision the launch resolved its bundle from (#1873 A3).
+  const sameRevision = (business, revision) => {
+    if (revision === undefined) return;
+    let now;
+    try {
+      now = writer.read(business);
+    } catch {
+      deny('organization-unreadable');
+    }
+    if (typeof revision !== 'string' || now?.revision !== revision) deny('organization-changed');
+  };
+  const read = (business) => {
+    try {
+      return writer.read(business).document;
+    } catch {
+      return deny('credential-unavailable');
+    }
+  };
+  // The copy, its pin, role and admitted projects as the file stands now (hire-decisions.mjs
+  // bindingFacts, without the refusals that function makes for a proposal).
+  const facts = (business, instance, doc) => {
+    const copy = snapshot?.org === business && Object.hasOwn(snapshot.copies ?? {}, instance) ? snapshot.copies[instance] : null;
+    if (!copy || copy.state === 'refused' || Object.hasOwn(doc.roles ?? {}, instance)) deny('copy-unavailable');
+    const definitions = { ...(snapshot.definitions ?? {}), ...(doc.definitions ?? {}) };
+    const pin = definitionPin(copy.definition, { definitions, rolesDir, readTemplate });
+    let role = null;
+    try {
+      role = copy.definition.startsWith('org:') ? checkDefinitions(definitions, 'copy definitions')[copy.definition] : loadRole(rolesDir, copy.definition);
+    } catch {
+      role = null;
+    }
+    if (!pin || !role) deny('credential-role-changed');
+    const code = Object.keys(doc.projects ?? {}).filter((p) => doc.projects[p]?.kind !== 'library');
+    let projects = code;
+    if (copy.level === 'root') {
+      let levels;
+      try {
+        levels = resolveAgentLevels({ orgId: business, doc: { ...doc, definitions }, root: { agents: snapshot.rootAgents ?? {} }, rolesDir });
+      } catch {
+        deny('copy-unavailable');
+      }
+      projects = code.filter((p) => levels.unions[p]?.ok && levels.unions[p].agents.some((a) => a.level === 'root' && a.name === copy.name));
+    }
+    return { copy, pin, role, projects };
+  };
+  const resolve = (business, instance, doc, record, inc) => {
+    const f = facts(business, instance, doc);
+    const res = resolveCopyBinding({ orgId: business, incarnation: inc, snapshot, instance, record, pin: f.pin, role: f.role, projects: f.projects });
+    if (!res.ok) deny(res.code);
+    if (Object.keys(res.services).some((s) => !COPY_BINDABLE.includes(s))) deny('credential-scope-unverified');
+    return { ...f, res };
+  };
+  const grantsOf = (record) => Object.fromEntries(Object.keys(record.services).sort()
+    .map((s) => [s, { grantId: record.services[s].grantId, grantGeneration: record.services[s].grantGeneration }]));
+  const slot = (instance) => org + '/' + instance;
+  // Live proof of one slot token against the record: the service's own answer, the grant id the
+  // verifier committed, and a rotation date not yet passed.
+  // The transport held to a deadline: each call gets what is left, and none starts after it.
+  const within = (deadline) => (req) => {
+    const left = deadline - Date.now();
+    if (left <= 0) return Promise.resolve({ status: 0, json: null, total: null });
+    return transport({ ...req, timeoutMs: Math.min(req.timeoutMs ?? left, left) });
+  };
+  const prove = async (doc, record, token, inc, deadline) => {
+    const approved = record.services.gitea;
+    if (approved.rotateBy < today()) deny('credential-expired');
+    const { origin, repos } = boundRepositories(doc, approved.resources.projects);
+    const login = copyBotLogin(inc, record.copyId, 'gitea');
+    if (!login) deny('credential-revoked');
+    const grant = await verifyGiteaToken({ transport: within(deadline), url: origin, ca, timeoutMs, token, approved: approved.scopes, repos, login, rotateBy: approved.rotateBy });
+    if (`gitea:${grant.userId}:${grant.tokenId}` !== approved.grantId) deny('credential-revoked');
+  };
+
+  async function boot(business) {
+    if (business !== org) return;
+    const deadline = Date.now() + bootMs;
+    // An inactive or unreadable registry entry leaves null: the resolver refuses every copy with its
+    // own code.
+    let incarnation = null;
+    try {
+      incarnation = liveIncarnation();
+    } catch {
+      incarnation = null;
+    }
+    let doc;
+    try {
+      doc = writer.read(business).document;
+    } catch {
+      return;
+    }
+    for (const [instance, copy] of Object.entries(snapshot.copies ?? {})) {
+      if (copy.state !== 'unbound') continue;
+      const record = doc.copyBindings?.[instance];
+      if (!object(record) || record.state !== 'bound' || !allGranted(record.services)) continue;
+      try {
+        if ((copy.missing ?? []).some((s) => !COPY_BINDABLE.includes(s))) deny('credential-scope-unverified');
+        const { pin, res } = resolve(business, instance, doc, record, incarnation);
+        const identity = credentials.copyIdentity(slot(instance), 'gitea');
+        if (!identity) deny('credential-unavailable');
+        const { token } = credentials.readCopy(slot(instance), 'gitea', identity);
+        await prove(doc, record, token, incarnation, deadline);
+        // The origin the token was proved at is the only one a call goes to.
+        const { origin } = boundRepositories(doc, res.services.gitea.projects);
+        verified.set(instance, Object.freeze({
+          copyId: record.copyId, incarnation, generation: record.generation, pin, grants: grantsOf(record),
+          identity, mac: mac(token), services: Object.keys(res.services), origin,
+        }));
+      } catch (e) {
+        failed.set(instance, e instanceof BusError && KEPT.test(e.code) ? e.code : 'credential-unavailable');
+      }
+    }
+  }
+
+  // The current authority of a copy, or the refusal. `withToken` also returns the slot's token,
+  // read now by the boot's identity and checked against the boot's MAC; only call() asks for it.
+  function current(business, instance, { withToken = false } = {}) {
+    if (business !== org || typeof instance !== 'string') deny('copy-unavailable');
+    if (fences.get(instance)) deny('credential-revoking');
+    const doc = read(business);
+    const record = doc.copyBindings?.[instance];
+    const v = verified.get(instance);
+    if (!v) {
+      if (object(record) && record.state === 'bound' && allGranted(record.services))
+        deny(failed.get(instance) ?? 'restart-required');
+      // Not bound: the resolver's own code (credential-unbound, a role change, a refused copy). This
+      // branch always refuses and holds no credential, so an unreadable registry is no incarnation.
+      let known = null;
+      try { known = liveIncarnation(); } catch { known = null; }
+      resolve(business, instance, doc, record, known);
+      deny('restart-required');
+    }
+    // A verified copy holds only while its organization is active under the incarnation boot proved.
+    const incarnation = liveIncarnation();
+    if (!object(record) || record.state !== 'bound' || record.copyId !== v.copyId || record.orgIncarnation !== v.incarnation
+      || incarnation !== v.incarnation) deny('credential-revoked');
+    if (record.generation !== v.generation || canonicalJson(grantsOf(record)) !== canonicalJson(v.grants)) deny('restart-required');
+    const { res } = resolve(business, instance, doc, record, incarnation);
+    if (canonicalJson(Object.keys(res.services)) !== canonicalJson(v.services)) deny('restart-required');
+    // A project's remote moved to another server is a new binding: the token never goes there.
+    const reach = boundRepositories(doc, res.services.gitea.projects);
+    if (reach.origin !== v.origin) deny('restart-required');
+    if (record.services.gitea.rotateBy < today()) deny('credential-expired');
+    const identity = credentials.copyIdentity(slot(instance), 'gitea');
+    if (!identity || identity.dev !== v.identity.dev || identity.ino !== v.identity.ino) deny('credential-unavailable');
+    let token;
+    try {
+      token = credentials.readCopy(slot(instance), 'gitea', v.identity).token;
+    } catch {
+      deny('credential-unavailable');
+    }
+    if (!timingSafeEqual(mac(token), v.mac)) deny('credential-unavailable');
+    const authority = sha256(canonicalJson({
+      org, instance, pin: v.pin, copyId: v.copyId, incarnation: v.incarnation, generation: v.generation, grants: v.grants, services: res.services,
+      origin: v.origin, repos: [...reach.repos].sort(),
+    }));
+    return { authority, services: v.services, record, res, reach, ...(withToken ? { doc, token } : {}) };
+  }
+
+  const gate = {
+    // { instance: [services] } of the copies the boot proved, for promoteCopies.
+    bound: () => Object.fromEntries([...verified].map(([instance, v]) => [instance, [...v.services]])),
+    verified: (business, instance) => business === org && verified.has(instance),
+    boot,
+    // Sync: the launch authority now, or the refusal.
+    authority(business, instance) {
+      const { authority, services } = current(business, instance);
+      return { authority, services: [...services] };
+    },
+    // The launcher's prepare: the authority, a live proof of the slot at the service, a fresh
+    // registry read, and the authority again; any change in between refuses.
+    // With `revision` (the launcher's, from the bundle it resolved) the organization file must still
+    // be that revision before and after the proof.
+    async prepare(business, instance, revision = undefined) {
+      sameRevision(business, revision);
+      const before = current(business, instance, { withToken: true });
+      await prove(before.doc, before.record, before.token, before.record.orgIncarnation, Date.now() + prepareMs);
+      const after = current(business, instance);
+      if (after.authority !== before.authority) deny('copy-authority-changed');
+      sameRevision(business, revision);
+      return { authority: after.authority, services: [...after.services] };
+    },
+    // Final admission and bindLaunch: the digest the launcher carries must still be the authority,
+    // and with `revision` the organization file still the one the launch resolved.
+    admit(business, instance, digest, revision = undefined) {
+      if (typeof digest !== 'string') deny('copy-authority-changed');
+      if (current(business, instance).authority !== digest) deny('copy-authority-changed');
+      sameRevision(business, revision);
+    },
+    revoking: (business, instance) => business === org && Boolean(fences.get(instance)),
+    // A write that can take a copy's grant away runs inside the fence. A definite answer (success,
+    // or a refusal the writer gave before any change) lifts it; an unknown outcome keeps it.
+    async fence(business, instance, fn) {
+      if (business !== org || typeof instance !== 'string') return fn();
+      fences.set(instance, (fences.get(instance) ?? 0) + 1);
+      let release = true;
+      try {
+        return await fn();
+      } catch (e) {
+        // A refusal code (lowercase, the bus's and the organization writer's) is a definite answer
+        // given before any change. outcome-unknown, a system error (ENOSPC, EIO) or an error with no
+        // code may have changed the binding or the slot, so the fence stays.
+        if (typeof e?.code !== 'string' || !/^[a-z][a-z0-9-]{1,80}$/.test(e.code) || e.code.startsWith('outcome-unknown')) release = false;
+        throw e;
+      } finally {
+        if (release) {
+          const n = fences.get(instance) - 1;
+          if (n > 0) fences.set(instance, n);
+          else fences.delete(instance);
+        }
+      }
+    },
+    // One checked Gitea request for a copy session: { business, role, copyAuthority } from the
+    // session the bus bound, never from the caller's arguments. Returns { status, json }.
+    async call(session, request) {
+      if (!object(session) || !object(request)) deny('copy-request-refused');
+      const { business, role: instance, copyAuthority } = session;
+      if (typeof copyAuthority !== 'string') deny('copy-authority-changed');
+      const { service = 'gitea', method, path, body } = request;
+      if (service !== 'gitea' || typeof method !== 'string' || typeof path !== 'string' || path.length > 1024) deny('copy-request-refused');
+      const m = REPO_PATH.exec(path);
+      if (!m || [m[1], m[2], ...m[3].split('/').slice(1)].some((x) => x === '.' || x === '..')) deny('copy-request-refused');
+      const before = current(business, instance, { withToken: true });
+      if (before.authority !== copyAuthority) deny('copy-authority-changed');
+      // Gitea's own semantics, enforced here: a read needs read:repository or write:repository, a
+      // write needs write:repository. A binding with neither sends no repository request.
+      const level = tokenLevels(before.res.services.gitea.scopes)?.repository;
+      if (READ.includes(method) ? !['read', 'write'].includes(level) : !(WRITE.includes(method) && level === 'write')) deny('copy-request-refused');
+      if (READ.includes(method) && body !== undefined) deny('copy-request-refused');
+      const { origin, repos } = before.reach;
+      if (!repos.has(`${m[1]}/${m[2]}`.toLowerCase())) deny('copy-request-refused');
+      const r = await transport({ url: origin, method, path, auth: { token: before.token }, ...(body === undefined ? {} : { body }), ca, timeoutMs });
+      // The answer is the session's only while the authority still holds.
+      const after = current(business, instance);
+      if (after.authority !== copyAuthority) deny('credential-revoked');
+      if (!object(r) || !Number.isSafeInteger(r.status) || r.status === 0) deny('credential-unavailable');
+      if (r.status >= 300 && r.status < 400) deny('copy-redirect-refused');
+      const out = { status: r.status, json: r.json ?? null };
+      assertNotHeld(out, [{ token: before.token }]);
+      return out;
+    },
+  };
+  return Object.freeze(gate);
+}

packages/bus/src/credentials.mjs

@@ -587,6 +587,23 @@ export class Credentials {
     }
     return Credentials.#format(service, text);
   }
+  // #1873 CB3: the identity (dev, ino) of a copy's slot as it is now, for the launch gate's boot check,
+  // or null when there is no single-link, self-owned 0600 regular file under private directories.
+  // The gate then reads the token by this identity (readCopy) and proves it at the service.
+  copyIdentity(instance, service) {
+    if (this.#refs.has(instance + ':' + service) || !SERVICES.includes(service)) return null;
+    try {
+      const file = this.#storePath(instance, service);
+      privateDir(this.#storeRoot);
+      privateDir(dirname(dirname(file)));
+      privateDir(dirname(file));
+      const st = lstatSync(file);
+      if (st.isSymbolicLink() || !st.isFile() || st.nlink !== 1 || st.uid !== process.getuid() || (st.mode & 0o777) !== 0o600) return null;
+      return { dev: st.dev, ino: st.ino };
+    } catch {
+      return null;
+    }
+  }
   // Removes the slot only while it is still the file the stage wrote; another file is left alone.
   unlinkCopy(instance, service, identity) {
     const file = this.#storePath(instance, service);

packages/bus/src/process.mjs

@@ -40,6 +40,7 @@ const LAUNCH_OPS = new Set([
   'sessionClearUncertain',
   'sessionClearRetire',
   'sessionClearStart',
+  'copyLaunch',
   'request.admission', 'request.launches', 'request.launchResult', 'request.release', 'request.chief', 'request.manifest',
 ]);
 function launchOp(m) {
@@ -90,7 +91,9 @@ function launchOp(m) {
   if (m.op === 'request.release') return runtime.requestRelease(m.cap, m.record);
   if (m.op === 'request.manifest') return runtime.requestManifest(m.record);
   if (m.op === 'request.chief') return runtime.requestChief(m.business);
-  if (m.op === 'request.admission') return runtime.admission({ business: m.business, project: m.project, projects: m.projects, instance: m.instance, revision: m.revision, thread: m.thread, session: m.session });
+  if (m.op === 'request.admission') return runtime.admission({ business: m.business, project: m.project, projects: m.projects, instance: m.instance, revision: m.revision, thread: m.thread, session: m.session, authority: m.authority });
+  // #1873 CB3: a copy's launch prepare: the launch authority after a live proof at the service.
+  if (m.op === 'copyLaunch') return runtime.copyLaunch({ business: m.business, instance: m.instance, revision: m.revision });
   if (m.op === 'credentialStatus') return runtime.credentialStatus(m.business, m.role);
   // #1873 T1 follow-up (org-defscan): the launcher's held-secret check of an org: definition.
   if (m.op === 'definitionScan') return runtime.definitionScan({ business: m.business, definition: m.definition, entry: m.entry });
@@ -165,7 +168,7 @@ if (!process.send) {
         await runtime.close();
         return;
       }
-      process.send({ ok: true, path: runtime.path, launches: runtime.launches, readers: runtime.readers });
+      process.send({ ok: true, path: runtime.path, launches: runtime.launches, readers: runtime.readers, copyBound: runtime.copyBound });
     } catch (e) {
       // org-defscan: a held credential in a definition says which definition and key, never the text.
       const reason = e instanceof BusError && e.code === DEFINITION_HOLDS_CREDENTIAL && typeof e.reason === 'string' ? { reason: e.reason } : {};

packages/bus/src/refusals.mjs

@@ -26,6 +26,17 @@ group("credential-unbound", "R1/R8: launch needs an approved, verified binding",
 group("credential-scope-unverified", "R1/R8: a copy credential is accepted only when the service proves its whole grant", "Gitea: approve read:user in the copy's binding (its role must declare it) so the account's repositories can be listed, give every bound project a Gitea remote on one server, and retry when the server answers. Vikunja has no verifier yet; its copy bindings stay unusable.");
 group("credential-identity-refused", "R1/R8: one dedicated service account per organization, copy and service", "Create the account the refusal names on the copy's Gitea server, not an administrator, with access to the bound projects' repositories only, and issue a token from that account. Never reuse another copy's or agent's account or token.");
 group("credential-date credential-format", "R1/R8: well-formed credentials with a future rotation date", "Supply the token on standard input alone, and a rotation date after today in YYYY-MM-DD form, no more than a year ahead for a copy credential.");
+// #1873 CB3: a copy launches only on a binding this bus verified at boot, and each use rechecks it.
+group("restart-required", "R1/R3/R8: a copy's binding is materialized only at boot, after live verification", "Ask the instance owner to restart the organization bus so it verifies the copy's newly approved or re-issued binding, then launch the copy again.");
+group("credential-revoked", "R1/R8: a revoked or replaced binding grants nothing, with no cached token", "Read the copy's binding. Ask the chief to raise a fresh binding decision for the owner, have the credential issued again, then restart the organization bus.");
+group("credential-revoking", "R1/R8: a revoke in flight blocks every new launch and call", "Wait for the revoke to finish and read its receipt. If its outcome stays unknown, ask the instance owner to restart the organization bus before launching the copy again.");
+group("credential-unavailable", "R1/R8: a copy credential is used only while the service and the stored slot prove it", "Check that the copy's Gitea server answers, then ask the owner to issue the copy's credential again and restart the organization bus. A slot changed outside the bus is never trusted.");
+group("credential-expired", "R1/R8: a copy credential stops at its rotation date", "Ask the owner to issue a fresh credential for the copy with a new rotation date, then restart the organization bus.");
+group("copy-authority-changed", "R1/R3/R8: the launch authority admitted at prepare must hold through bind and every use", "The copy's role, projects or binding changed during the launch. Read the copy's current binding and launch it again; a running session from the old authority must be stopped and relaunched.");
+group("copy-request-refused", "R1/R8: a copy calls only its bound repositories with the methods its approved scopes allow", "Call a repository of a project the copy is bound to, with GET or HEAD when the binding approved read:repository or write:repository, or a write method only when it approved write:repository. Ask the chief for a binding decision to widen it.");
+group("organization-changed organization-unreadable", "R3/R8: a launch holds to the organization file revision it resolved", "The organization file changed, or could not be read, while the launch was in progress. Launch the agent again so it resolves the file as it stands now.");
+group("copy-redirect-refused", "R1/R8: a copy credential goes only to the approved Gitea origin", "The Gitea server answered with a redirect. Fix the bound project's remote to name the server's final address, then ask the owner to issue the credential again; redirects are never followed.");
+group("project-repo-bound", "R1/R8: a binding grants the repository its projects name when the owner approved it", "Revoke the copy binding that names the project first: the chief raises an unbind decision and the owner approves it. Then set the project repository, then ask the chief to raise a new binding decision for the owner.");
 group("copy-unavailable copy-refused", "R3/R8: one active, unambiguous copy identity", "Read the organization's copies. Ask the owner to resolve the definition collision or restore the copy's source before raising a binding decision.");
 group("copy-stale", "R3: root policy changed since this bus booted", "Ask the owner to restart the organization bus to load the approved root policy, then launch a fresh copy.");
 group("root-policy-unreadable", "R3: root policy evidence must be readable", "Ask the owner to inspect root agent receipt metadata and restart the bus after repairing the read failure.");

packages/bus/src/runtime.mjs

@@ -45,8 +45,9 @@ import { DEFINITION_HOLDS_CREDENTIAL, heldPath, scanDefinitions } from './defini
 import { ROLE_RIGHTS } from '../../organization/src/org-rights.mjs';
 import { getProjectRemote } from '../../organization/src/project-remotes.mjs';
 import { credentialVerbs } from './credential-verbs.mjs';
-import { loadWithCopies } from '../../organization/src/agent-copies.mjs';
+import { loadWithCopies, promoteCopies } from '../../organization/src/agent-copies.mjs';
 import { copyGrant, sweepCopySlots } from './copy-grant.mjs';
+import { copyLaunchGate } from './copy-launch.mjs';
 import { loadRole } from '../../organization/src/role.mjs';
 import { resolveInstance } from '../../organization/src/resolve.mjs';
 import { canonicalJson } from '../../organization/src/util.mjs';
@@ -320,6 +321,9 @@ export async function startBroker({
   // #1873 A3: the boot's root and project agent copies (cli config.mjs copiesAtBoot), plain data. Every
   // reload of the organization file below re-applies this snapshot, never the root file.
   copies = null,
+  // #1873 CB3: the tests' Gitea transport and CA for the copy launch gate and copyGrant, { send, ca }.
+  // In-process only, like librarySync; production passes none.
+  copyTransport = null,
 }) {
   if (copies !== null && (typeof copies !== 'object' || Array.isArray(copies) || typeof copies.org !== 'string'
       || !Object.hasOwn(businesses ?? {}, copies.org) || copies.copies === null || typeof copies.copies !== 'object' || Array.isArray(copies.copies)))
@@ -339,7 +343,7 @@ export async function startBroker({
   let modelProxyClient = null, proxyPage = null, proxyUsage = null, usageTimer = null, proxyLock = null, proxyPort = null;
   let modelKeys = null, modelTimer = null, modelSweep = null, modelCatalogues = null;
   const modelRuns = new Map();
-  let store, credentials, server, adapter, processing, syncTimer = null, syncPass = null, accessTimer = null, requestTimer = null;
+  let store, credentials, server, adapter, processing, syncTimer = null, syncPass = null, accessTimer = null, requestTimer = null, copyLaunch = null;
   try {
     // Lifecycle Task 2 (#797): a product whose mapping is published but not yet activated is not part of
     // this process. A managed product is part of it only with both a committed activate receipt in the
@@ -437,6 +441,25 @@ export async function startBroker({
     }
     // The boot copy snapshot's definitions (the root agents file's, A4): every reload re-applies them.
     if (copies?.definitions !== undefined) scanDefinitions(copies.definitions, clean, { boot: true });
+    // #1873 CB3: each unbound copy whose binding is bound is re-resolved and its slot proved live at
+    // the service; only those that pass join the organization, now, before anything takes a copy of
+    // `businesses`. A binding approved later answers restart-required. copyGrant keeps the boot's own
+    // snapshot (bootCopies), and so does the gate: what it promotes is decided at boot only.
+    const bootCopies = copies;
+    if (organization && storeRoot && copies) {
+      copyLaunch = copyLaunchGate({ credentials, writer: organizationWriter({ dir: organization.dir, rolesDir: organization.rolesDir, dataRoot: instanceRoot ?? dataRoot }),
+        configDir: organization.dir, rolesDir: organization.rolesDir, snapshot: copies, ...(copyTransport ? { transport: copyTransport.send, ca: copyTransport.ca } : {}) });
+      await copyLaunch.boot(copies.org);
+      const verified = copyLaunch.bound();
+      if (Object.keys(verified).length) {
+        copies = promoteCopies(copies, verified);
+        const b = loadOrg(copies.org);
+        const resolved = {};
+        for (const instance of Object.keys(b.roles)) resolved[instance] = resolveInstance({ system: organization.system, business: b, instance });
+        businesses[copies.org] = withoutPending(copies.org, busOrganization(b, resolved));
+        if (proxy) for (const instance of Object.keys(verified)) if (Object.hasOwn(businesses[copies.org].roles, instance)) credentials.registerModel(copies.org + '/' + instance);
+      }
+    }
     if (proxy) {
       const inventory = modelRunInventory(dataRoot, modelRuns, credentials);
       modelKeys = new ModelKeys({ credentials, client: modelProxyClient, configDir: org ? instanceConfigDir : organization.dir, org: org?.id ?? null, lock: proxyLock,
@@ -628,6 +651,9 @@ export async function startBroker({
       && fixedAtStart(b).libraries === boot.libraries
       && Object.entries(fixedAtStart(b).roles).every(([role, f]) => f === (boot.roles[role] ?? fixedRole(null)));
     const booted = new Map(Object.entries(businesses).map(([id, b]) => [id, fixedAtStart(b)]));
+    // #1873 CB3: a copy the boot snapshot had unbound (whether the gate promoted it or not).
+    const copyNeedsAuthority = (id, instance) => copyLaunch !== null && bootCopies?.org === id
+      && Object.hasOwn(bootCopies.copies, instance) && bootCopies.copies[instance].state === 'unbound';
     const reloadLog = entry => process.stderr.write(`organization: ${JSON.stringify(entry)}\n`);
     function reload(id) {
       try {
@@ -693,7 +719,10 @@ export async function startBroker({
     // project as the business stands now: a project that excludes it, or whose union refuses, is not ready.
     // `instance` comes with `revision`, the organization file revision the launch resolved its bundle
     // from; a file that has changed since (a narrow, a project define's vars, an exclude) is not ready.
-    function admission({ business: id, project, projects, instance, revision: launched, thread, session }) {
+    // #1873 CB3: with `instance`, a copy the boot left needing a binding is admitted only on
+    // `authority`, the launch authority digest its prepare returned, still current now. Checked
+    // before the projects, so a launch with no project is held to it as well.
+    function admission({ business: id, project, projects, instance, revision: launched, thread, session, authority }) {
       if (projects !== undefined) {
         const no = code => ({ ready: false, revision: null, code });
         if (typeof id !== 'string' || !Object.hasOwn(businesses, id) || !Array.isArray(projects) || projects.some(p => typeof p !== 'string')) return no('project-unknown');
@@ -718,6 +747,9 @@ export async function startBroker({
             try { clean(name); held = heldPath(now.document.definitions?.[name], clean); } catch { held = 'name'; }
             if (held !== null) return no(DEFINITION_HOLDS_CREDENTIAL);
           }
+          if (copyNeedsAuthority(id, instance)) {
+            try { copyLaunch.admit(id, instance, authority); } catch (e) { return no(e?.code ?? 'copy-authority-changed'); }
+          }
         }
         for (const p of projects) {
           const result = admission({ business: id, project: p });
@@ -810,8 +842,9 @@ export async function startBroker({
       // #1873 CB2: credentials.issue for an agent copy's bound Gitea service, verified live at the server.
       copyGrant: organization && storeRoot
         ? copyGrant({ credentials, writer: organizationWriter({ dir: organization.dir, rolesDir: organization.rolesDir, dataRoot: instanceRoot ?? dataRoot }),
-          copies, organizations: () => Object.keys(businesses) })
+          copies: bootCopies, organizations: () => Object.keys(businesses), ...(copyTransport ? { transport: copyTransport.send, ca: copyTransport.ca } : {}) })
         : null,
+      copyLaunch,
       usage,
       limits,
       store,
@@ -1308,8 +1341,27 @@ export async function startBroker({
       credentials,
       // P2 consumes this inside the bus only. No process IPC/verb returns it.
       get modelProxy() { return modelProxyClient; },
+      // #1873 CB3: the copies the boot proved live, { instance: [service] }; names only.
+      copyBound: Object.freeze(copyLaunch ? copyLaunch.bound() : {}),
       path,
       bindLaunch,
+      // #1873 CB3: the launcher's prepare for a copy the boot left needing a binding: the launch
+      // authority { authority, services } after a live proof at the service, or the refusal. Any
+      // other instance needs none and gets { authority: null }.
+      // `revision` is the organization file revision the launch resolved its bundle from (A3); a
+      // copy's prepare holds the file to it.
+      copyLaunch: async ({ business, instance, revision }) => {
+        if (typeof business !== 'string' || typeof instance !== 'string') throw new BusError('invalid-request');
+        if (!copyNeedsAuthority(business, instance)) return { authority: null, services: [] };
+        if (typeof revision !== 'string') throw new BusError('invalid-request');
+        return copyLaunch.prepare(business, instance, revision);
+      },
+      // #1873 CB3: one checked Gitea request for a bound copy's run. Who it is for comes from the
+      // capability's session, never from the request. Returns { status, json }; nothing holds the token.
+      copyCall: async (cap, request) => {
+        if (!copyLaunch) throw new BusError('credential-unavailable');
+        return copyLaunch.call(broker.copySession(cap), request);
+      },
       recoverLaunch: ({ modelKeyId, ...record }) => broker.recoverLaunch(record),
       endLaunch: (r) => { const out = broker.endLaunch(r); modelRuns.delete(r.business + ':' + r.run); return out; },
       modelAdmission: async ({ business, instance, modelKey, harness, revision, entry: expected, provider, model, account, route, transport }) => {

packages/bus/tests/copy-launch-docker.test.mjs

@@ -0,0 +1,238 @@
+// #1873 CB3 live acceptance: a bound copy's launch gate against a scratch gitea/gitea:1.27.1, a
+// throwaway container on 127.0.0.1 over TLS with a scratch CA, removed after. The boot proves the
+// slot live, a launch carries its authority to the bound session, one checked call reads the bound
+// repository, and a reissue denies the next call before any request. The test never pulls an image;
+// without Docker or the image it skips. Every token here is a scratch token this container made;
+// none is printed, and nothing here reaches git.mosaicstack.dev or any real service.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash, randomBytes } from 'node:crypto';
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { request } from 'node:https';
+import { createServer } from 'node:net';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+import { Broker, BusError } from '../src/broker.mjs';
+import { Store } from '../src/store.mjs';
+import { Credentials } from '../src/credentials.mjs';
+import { copyGrant } from '../src/copy-grant.mjs';
+import { copyLaunchGate } from '../src/copy-launch.mjs';
+import { send } from '../src/gitea-grant.mjs';
+import { hireDecisions } from '../../organization/src/hire-decisions.mjs';
+import { organizationWriter } from '../../organization/src/organization.mjs';
+import { checkRootAgents } from '../../organization/src/agent-levels.mjs';
+import { loadWithCopies, materializeCopies, promoteCopies } from '../../organization/src/agent-copies.mjs';
+import { activateOrg, reserveOrg } from '../../organization/src/org-registry.mjs';
+import { copyBotLogin } from '../../organization/src/copy-bindings.mjs';
+import { businessDoc, rolesCopy, writeJson } from '../../organization/tests/helpers.mjs';
+import { scratchCa } from '../../seat/tests/fake-gitea.mjs';
+
+const IMAGE = 'gitea/gitea:1.27.1';
+const SUBJECT = { provider: 'test', iss: 'https://issuer.test', sub: 'owner' };
+const READ = { gitea: { scopes: ['read:repository', 'read:user'], projects: ['stack'] } };
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const ahead = (days) => new Date(Date.now() + days * 86400000).toISOString().slice(0, 10);
+const sha = (s) => createHash('sha256').update(s).digest('hex');
+const docker = (...args) => spawnSync('docker', args, { encoding: 'utf8', timeout: 120000 });
+const skip = docker('image', 'inspect', IMAGE).status === 0 ? false : `no Docker or no local ${IMAGE}; this test never pulls`;
+
+const freePort = () =>
+  new Promise((resolve, reject) => {
+    const s = createServer();
+    s.once('error', reject);
+    s.listen(0, '127.0.0.1', () => {
+      const { port } = s.address();
+      s.close(() => resolve(port));
+    });
+  });
+
+// One HTTPS call to the scratch container as its administrator, trusting only the scratch CA.
+function call(url, ca, method, path, { auth = null, body = null } = {}) {
+  return new Promise((resolve) => {
+    const data = body ? JSON.stringify(body) : null;
+    const headers = { accept: 'application/json', ...(data ? { 'content-type': 'application/json' } : {}), ...(auth ? { authorization: auth } : {}) };
+    const req = request(url + path, { method, ca, headers, timeout: 10000 }, (res) => {
+      let text = '';
+      res.on('data', (c) => (text += c));
+      res.on('end', () => {
+        let json = null;
+        try {
+          json = text ? JSON.parse(text) : null;
+        } catch {}
+        resolve({ status: res.statusCode, json });
+      });
+    });
+    req.on('timeout', () => req.destroy());
+    req.on('error', () => resolve({ status: 0, json: null }));
+    req.end(data ?? undefined);
+  });
+}
+
+test('CB3-D: on scratch 1.27.1 a bound copy boots proved, launches with its authority, reads only its repository, refuses a redirect, and a reissue denies the next call unsent', { skip, timeout: 300000 }, async (t) => {
+  // The child's complete TAP output is captured before any of it reaches this runner, so the parent
+  // can search it for the minted values without putting one in an assertion.
+  if (!process.env.CB3_COPY_CAPTURE) {
+    const capture = mkdtempSync(join(tmpdir(), 'cb3cap-'));
+    t.after(() => rmSync(capture, { recursive: true, force: true }));
+    const file = join(capture, 'minted');
+    const childEnv = { ...process.env, CB3_COPY_CAPTURE: file };
+    delete childEnv.NODE_TEST_CONTEXT;
+    const child = spawnSync(process.execPath, ['--test', '--test-name-pattern=^CB3-D:', fileURLToPath(import.meta.url)], {
+      encoding: 'utf8', timeout: 280000, env: childEnv,
+    });
+    const values = existsSync(file) ? JSON.parse(readFileSync(file, 'utf8')) : [];
+    const output = (child.stdout ?? '') + (child.stderr ?? '');
+    assert.ok(values.every((value) => !output.includes(value) && !output.includes(sha(value))), 'complete TAP stdout/stderr contain no minted token');
+    t.diagnostic(output);
+    t.diagnostic(`minted ${values.length}, hits 0 (complete TAP stdout/stderr)`);
+    assert.equal(child.status, 0, 'Docker child passed');
+    assert.equal(values.length, 3, 'all three scratch tokens were minted: the acceptance actually ran');
+    return;
+  }
+
+  const dir = mkdtempSync(join(tmpdir(), 'cb3d-'));
+  t.after(() => rmSync(dir, { recursive: true, force: true }));
+  const tlsDir = join(dir, 'tls'), tls = scratchCa(tlsDir);
+  // The container's git user reads the scratch key; it is a throwaway key for this run only.
+  chmodSync(tlsDir, 0o755);
+  chmodSync(join(tlsDir, 'server.key'), 0o644);
+  const ca = readFileSync(tls.ca, 'utf8'), port = await freePort();
+  const url = `https://127.0.0.1:${port}`, name = 'cb3-' + randomBytes(6).toString('hex');
+  t.after(() => docker('rm', '-f', name));
+  const started = docker('run', '-d', '--rm', '--name', name, '-p', `127.0.0.1:${port}:3000`, '-v', `${tlsDir}:/certs:ro`,
+    '-e', 'GITEA__security__INSTALL_LOCK=true', '-e', 'GITEA__database__DB_TYPE=sqlite3',
+    '-e', 'GITEA__service__DISABLE_REGISTRATION=true', '-e', 'GITEA__server__PROTOCOL=https',
+    '-e', 'GITEA__server__CERT_FILE=/certs/server.pem', '-e', 'GITEA__server__KEY_FILE=/certs/server.key',
+    '-e', `GITEA__server__ROOT_URL=${url}/`, IMAGE);
+  assert.equal(started.status, 0, 'scratch container starts');
+  const end = Date.now() + 120000;
+  while ((await call(url, ca, 'GET', '/api/v1/version')).status !== 200) {
+    assert.ok(Date.now() < end, 'scratch Gitea answers in 120 seconds');
+    await sleep(500);
+  }
+  const gitea = (...args) => docker('exec', '-u', 'git', name, 'gitea', ...args);
+  const minted = [];
+  const createUser = (user, admin = false) => {
+    const r = gitea('admin', 'user', 'create', '--username', user, '--email', `${user}@example.test`,
+      '--password', randomBytes(16).toString('base64url'), '--must-change-password=false', ...(admin ? ['--admin'] : []));
+    assert.equal(r.status, 0, `create scratch ${user}`);
+  };
+  const mint = (user, scopes) => {
+    const r = gitea('admin', 'user', 'generate-access-token', '--username', user, '--token-name', 'cb3-' + randomBytes(4).toString('hex'),
+      '--scopes', scopes.join(','), '--raw');
+    assert.equal(r.status, 0, `mint scratch ${user}`);
+    const value = r.stdout.trim();
+    assert.ok(/^[0-9a-f]{40}$/.test(value), 'minted token shape');
+    minted.push(value);
+    writeFileSync(process.env.CB3_COPY_CAPTURE, JSON.stringify(minted), { mode: 0o600 });
+    return value;
+  };
+  createUser('scratch-admin', true);
+  createUser('owner');
+  const admin = 'token ' + mint('scratch-admin', ['write:admin', 'write:repository', 'write:user']);
+  for (const repo of ['stack', 'other']) {
+    const made = await call(url, ca, 'POST', '/api/v1/admin/users/owner/repos', { auth: admin, body: { name: repo, auto_init: true, private: true } });
+    assert.equal(made.status, 201, `create owner/${repo}`);
+  }
+
+  // The organization: one root agent "rev" (research, Gitea alone) bound read-only to project stack.
+  const root = mkdtempSync(join(tmpdir(), 'cb3o-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const rolesDir = rolesCopy(root);
+  const doc = { ...businessDoc(root, 'demo'), plugins: { harness: ['pi'] }, vars: { 'bus.tester': true } };
+  doc.projects.stack.remote = `${url}/owner/stack`;
+  writeJson(join(root, 'businesses/demo.json'), doc);
+  const dataRoot = join(root, 'data');
+  mkdirSync(dataRoot, { mode: 0o700 });
+  const ctx = { configDir: root, dataRoot, instance: 'test' };
+  await reserveOrg(ctx, 'demo');
+  await activateOrg(ctx, 'demo');
+  const snapshot = materializeCopies({ orgId: 'demo', doc, root: { state: 'ok', ...checkRootAgents({ agentsVersion: 1, agents: { rev: { definition: 'research' } } }, { rolesDir }) }, rolesDir });
+  const writer = organizationWriter({ dir: root, rolesDir }), store = new Store(dataRoot);
+  t.after(() => store.close());
+  const service = hireDecisions({ writer, rolesDir, dataRoot, configDir: root, assertClean: () => {}, copies: (id) => (snapshot.org === id ? snapshot : null) });
+  const storeRoot = join(root, 'secrets', 'agents');
+  mkdirSync(storeRoot, { recursive: true, mode: 0o700 });
+  chmodSync(join(root, 'secrets'), 0o700);
+  const credentials = new Credentials({ references: {}, storeRoot, repoRoots: [], dataRoot: '/nonexistent-data' });
+  // Every request the gate sends, by op only.
+  const sent = [];
+  const transport = (req) => { sent.push(`${req.method} ${req.path.split('?')[0]}`); return send(req); };
+  const gate = copyLaunchGate({ credentials, writer, configDir: root, rolesDir, snapshot, transport, ca, timeoutMs: 10000 });
+  let promoted = snapshot;
+  const business = () => {
+    const d = loadWithCopies('demo', { dir: root, rolesDir, snapshot: promoted });
+    return { ...d, roles: Object.fromEntries(Object.entries(d.roles).map(([n, e]) => [n, { ...d.definitions?.[e.definition], ...e }])) };
+  };
+  const issue = copyGrant({ credentials, writer, copies: snapshot, organizations: () => ['demo'], ca, timeoutMs: 10000 });
+  const b = new Broker({
+    store, businesses: { demo: business() }, copyLaunch: gate,
+    hires: { ...service, apply: async (...args) => { const r = await service.apply(...args); b.reloadBusiness('demo', business()); return r; } },
+    credentialVerbs: () => { throw new BusError('credential-unknown'); }, copyGrant: (...a) => issue(...a),
+  });
+  const consoleCap = b.bindConsole({ business: 'demo', human: 'jason', subject: SUBJECT });
+  const human = b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+  const request_ = (cap, verb, args) => Promise.resolve().then(() => b.request(cap, { verb, args }));
+  await request_(consoleCap, 'hire.start.console', { op: 'change', level: 'root', name: 'rev', reason: 'Bind the copy', binding: { services: READ } });
+  const rec = () => JSON.parse(readFileSync(join(root, 'businesses/demo.json'), 'utf8')).copyBindings.rev;
+  const login = copyBotLogin(rec().orgIncarnation, rec().copyId, 'gitea');
+  createUser(login);
+  const collaborate = (repo) => call(url, ca, 'PUT', `/api/v1/repos/owner/${repo}/collaborators/${login}`, { auth: admin, body: { permission: 'read' } });
+  assert.equal((await collaborate('stack')).status, 204, 'bot is a read collaborator on owner/stack');
+  const issueToken = (token) => request_(human, 'credentials.issue', { agent: 'rev', service: 'gitea', date: ahead(30), token });
+  assert.equal((await issueToken(mint(login, ['read:repository', 'read:user']))).state, 'bound');
+
+  // Bound after this gate was made: restart-required until a boot proves it.
+  await assert.rejects(gate.prepare('demo', 'rev'), { code: 'restart-required' });
+  assert.deepEqual(sent, []);
+  await gate.boot('demo');
+  assert.deepEqual(gate.bound(), { rev: ['gitea'] });
+  assert.ok(sent.includes('GET /api/v1/token'), 'the boot proved the slot live at the service');
+  promoted = promoteCopies(snapshot, gate.bound());
+  b.reloadBusiness('demo', business());
+
+  // A launch: prepare proves the slot again, bindLaunch carries the authority to the session.
+  const project = (await request_(human, 'project.create', { name: 'stack work', repo: 'stack' })).id;
+  const thread = (await request_(human, 'thread.create', { project, name: 'one', instance: 'rev' })).id;
+  const proofs = sent.length;
+  const revision = writer.read('demo').revision;
+  const { authority } = await gate.prepare('demo', 'rev', revision);
+  assert.ok(sent.slice(proofs).includes('GET /api/v1/token'));
+  const cap = b.bindLaunch({ business: 'demo', role: 'rev', run: 'rev-run', harness: 'pi', thread, copyAuthority: authority, revision });
+  const use = (req) => Promise.resolve().then(() => gate.call(b.copySession(cap), req));
+  const own = await use({ method: 'GET', path: '/api/v1/repos/owner/stack' });
+  assert.equal(own.status, 200);
+  assert.equal(own.json.full_name, 'owner/stack');
+  // A repository outside the binding, and a write on a read binding: refused before any request.
+  const before = sent.length;
+  await assert.rejects(use({ method: 'GET', path: '/api/v1/repos/owner/other' }), { code: 'copy-request-refused' });
+  await assert.rejects(use({ method: 'POST', path: '/api/v1/repos/owner/stack/issues', body: { title: 'x' } }), { code: 'copy-request-refused' });
+  assert.equal(sent.length, before);
+
+  // A reissue (a new generation) while the session is live: the next call refuses, none is sent.
+  await issueToken(mint(login, ['read:repository', 'read:user']));
+  assert.equal(rec().services.gitea.grantGeneration, 2);
+  const afterIssue = sent.length;
+  await assert.rejects(use({ method: 'GET', path: '/api/v1/repos/owner/stack' }), { code: 'restart-required' });
+  assert.equal(sent.length, afterIssue, 'no request after the reissue');
+
+  // Gitea answers a renamed repository's old path with a redirect. A fresh boot and launch on the
+  // second token; the bound path now redirects, and the gate refuses it without following.
+  const gate2 = copyLaunchGate({ credentials, writer, configDir: root, rolesDir, snapshot, transport, ca, timeoutMs: 10000 });
+  await gate2.boot('demo');
+  assert.deepEqual(gate2.bound(), { rev: ['gitea'] });
+  const { authority: authority2 } = await gate2.prepare('demo', 'rev');
+  // The broker's session for the old launch is gone with its authority; this one is gate2's own.
+  assert.throws(() => b.copySession(cap), { code: 'restart-required' });
+  const session = { business: 'demo', role: 'rev', copyAuthority: authority2 };
+  assert.equal((await gate2.call(session, { method: 'GET', path: '/api/v1/repos/owner/stack' })).status, 200);
+  assert.equal((await call(url, ca, 'PATCH', '/api/v1/repos/owner/stack', { auth: admin, body: { name: 'moved' } })).status, 200, 'rename owner/stack');
+  const viaOld = await call(url, ca, 'GET', '/api/v1/repos/owner/stack', { auth: admin });
+  assert.equal(viaOld.status, 301, 'Gitea 1.27.1 redirects a renamed repository\'s old path');
+  const n = sent.length;
+  await assert.rejects(gate2.call(session, { method: 'GET', path: '/api/v1/repos/owner/stack' }), { code: 'copy-redirect-refused' });
+  assert.equal(sent.length, n + 1, 'one request, never followed');
+  t.diagnostic(`minted ${minted.length}`);
+});

packages/bus/tests/copy-launch.test.mjs

@@ -0,0 +1,567 @@
+// #1873 CB3 (design section 5 steps 7 and 8, section 8 row CB3): a bound agent copy launches only
+// when the bus's boot proved its binding live at the service, every launch carries a launch
+// authority the bus checks again at prepare, final admission and bindLaunch, and each credential
+// call is checked against the session's authority before and after the request. The fake Gitea is
+// fake-gitea-api.mjs on 127.0.0.1; the runtime and launcher halves are runtime tests below and
+// packages/cli/tests/agent-copies.test.mjs.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, unlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Broker, BusError } from '../src/broker.mjs';
+import { Store } from '../src/store.mjs';
+import { Credentials } from '../src/credentials.mjs';
+import { REFUSALS } from '../src/refusals.mjs';
+import { copyGrant } from '../src/copy-grant.mjs';
+import { copyLaunchGate } from '../src/copy-launch.mjs';
+import { send } from '../src/gitea-grant.mjs';
+import { fakeGiteaApi } from './fake-gitea-api.mjs';
+import { hireDecisions } from '../../organization/src/hire-decisions.mjs';
+import { organizationWriter } from '../../organization/src/organization.mjs';
+import { checkRootAgents } from '../../organization/src/agent-levels.mjs';
+import { loadWithCopies, materializeCopies, promoteCopies } from '../../organization/src/agent-copies.mjs';
+import { activateOrg, reserveOrg } from '../../organization/src/org-registry.mjs';
+import { copyBotLogin } from '../../organization/src/copy-bindings.mjs';
+import { businessDoc, rolesCopy, writeJson } from '../../organization/tests/helpers.mjs';
+
+const SUBJECT = { provider: 'test', iss: 'https://issuer.test', sub: 'owner' };
+const READ = { gitea: { scopes: ['read:repository', 'read:user'], projects: ['stack'] } };
+const WRITE = { gitea: { scopes: ['read:user', 'write:repository'], projects: ['stack'] } };
+const ahead = (days) => new Date(Date.now() + days * 86400000).toISOString().slice(0, 10);
+const CODES = ['restart-required', 'credential-revoked', 'credential-revoking', 'credential-unavailable', 'credential-expired',
+  'copy-authority-changed', 'copy-request-refused', 'copy-redirect-refused', 'organization-changed', 'organization-unreadable'];
+
+// demo with the project stack on the fake Gitea and the root copy rev (research, which needs gitea
+// alone; a binding may be narrower than the role). The
+// owner binds rev with `services` and, unless `issue` is false, issues one live token for it (CB2).
+// `gate` is the CB3 gate on the boot snapshot; `boot()` runs its boot check and returns the broker's
+// business with the copies it proved promoted, as runtime.mjs does.
+async function fixture(t, { services = READ, perm = 'read', issue = true, definition = 'research', budgets = {} } = {}) {
+  let clock = Date.now();
+  const root = mkdtempSync(join(tmpdir(), 'cb3-')), rolesDir = rolesCopy(root);
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const api = await fakeGiteaApi(t, root);
+  const doc = { ...businessDoc(root, 'demo'), plugins: { harness: ['pi'] }, vars: { 'bus.tester': true } };
+  doc.projects.stack.remote = `${api.url}/owner/stack`;
+  const file = writeJson(join(root, 'businesses/demo.json'), doc);
+  const dataRoot = join(root, 'data'); mkdirSync(dataRoot, { mode: 0o700 });
+  const ctx = { configDir: root, dataRoot, instance: 'test' };
+  await reserveOrg(ctx, 'demo'); await activateOrg(ctx, 'demo');
+  const snapshot = materializeCopies({ orgId: 'demo', doc, root: { state: 'ok', ...checkRootAgents({ agentsVersion: 1, agents: { rev: { definition } } }, { rolesDir }) }, rolesDir });
+  const writer = organizationWriter({ dir: root, rolesDir }), store = new Store(dataRoot);
+  t.after(() => store.close());
+  const service = hireDecisions({ writer, rolesDir, dataRoot, configDir: root, assertClean: () => {}, copies: (id) => snapshot.org === id ? snapshot : null });
+  const storeRoot = join(root, 'secrets', 'agents');
+  mkdirSync(storeRoot, { recursive: true, mode: 0o700 }); chmodSync(join(root, 'secrets'), 0o700);
+  const credentials = new Credentials({ references: {}, storeRoot, repoRoots: [], dataRoot: '/nonexistent-data' });
+  // Every request the gate sends, with what the test lets through; `hold` parks one until released.
+  const sent = [];
+  const transport = async (req) => { sent.push(`${req.method} ${req.path.split('?')[0]}`); return send(req); };
+  const gate = copyLaunchGate({ credentials, writer, configDir: root, rolesDir, snapshot, transport, ca: api.ca, timeoutMs: 3000, now: () => new Date(clock), ...budgets });
+  const advance = (days) => { clock += days * 86400000; };
+  let promoted = snapshot;
+  const business = () => {
+    const d = loadWithCopies('demo', { dir: root, rolesDir, snapshot: promoted });
+    return { ...d, roles: Object.fromEntries(Object.entries(d.roles).map(([n, e]) => [n, { ...d.definitions?.[e.definition], ...e }])) };
+  };
+  const issueGrant = (...a) => copyGrant({ credentials, writer, copies: snapshot, organizations: () => ['demo'], ca: api.ca, timeoutMs: 3000 })(...a);
+  const b = new Broker({ store, businesses: { demo: business() }, copyLaunch: gate,
+    hires: { ...service, apply: async (...args) => { const r = await service.apply(...args); b.reloadBusiness('demo', business()); return r; } },
+    credentialVerbs: () => { throw new BusError('credential-unknown'); }, copyGrant: (...a) => issueGrant(...a) });
+  const owner = b.bindConsole({ business: 'demo', human: 'jason', subject: SUBJECT });
+  const human = b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+  const call = (cap, verb, args = {}) => Promise.resolve().then(() => b.request(cap, { verb, args }));
+  const rec = () => JSON.parse(readFileSync(file, 'utf8')).copyBindings?.rev;
+  const repo = api.addRepo('owner', 'stack');
+  api.addRepo('owner', 'other');
+  await call(owner, 'hire.start.console', { op: 'change', level: 'root', name: 'rev', reason: 'Bind the copy', binding: { services } });
+  const r = rec();
+  const login = copyBotLogin(r.orgIncarnation, r.copyId, 'gitea');
+  const bot = api.addUser(login).user;
+  repo.collaborators.push(login); repo.permissions[login] = perm;
+  const scopes = services.gitea.scopes;
+  const reissue = (scopesNow = scopes) => call(human, 'credentials.issue', { agent: 'rev', service: 'gitea', date: ahead(30), token: api.addToken(login, `t${api.issued.length}`, scopesNow).sha1 });
+  if (issue) await reissue();
+  const boot = async () => {
+    await gate.boot('demo');
+    promoted = promoteCopies(snapshot, gate.bound());
+    b.reloadBusiness('demo', business());
+  };
+  const slot = join(storeRoot, 'demo', 'rev', 'gitea');
+  // A run of rev, bound with the authority the launcher's prepare returned.
+  // rev is a thread instance, so each run takes a thread of its own in the stack project.
+  let project = null;
+  const threadFor = async (run) => {
+    project ??= (await call(human, 'project.create', { name: 'stack work', repo: 'stack' })).id;
+    return (await call(human, 'thread.create', { project, name: run, instance: 'rev' })).id;
+  };
+  const launch = async (run = 'rev-run') => {
+    const thread = await threadFor(run);
+    const revision = writer.read('demo').revision;
+    const { authority } = await gate.prepare('demo', 'rev', revision);
+    return { authority, thread, cap: b.bindLaunch({ business: 'demo', role: 'rev', run, harness: 'pi', thread, copyAuthority: authority, revision }) };
+  };
+  const use = (cap, request) => Promise.resolve().then(() => gate.call(b.copySession(cap), request));
+  const GET = { method: 'GET', path: '/api/v1/repos/owner/stack' };
+  // The organization file edited in place, as an owner's editor would.
+  const edit = (fn) => {
+    const d = JSON.parse(readFileSync(file, 'utf8'));
+    fn(d);
+    writeFileSync(file, JSON.stringify(d, null, 2) + '\n');
+  };
+  // The next request matching `match` waits at the fake server until release() lets it through.
+  const hold = (match) => {
+    let release, arrived;
+    const go = new Promise((r) => { release = r; });
+    const seen = new Promise((r) => { arrived = r; });
+    const unrule = api.rule((e, body) => match(e, body), async () => { unrule(); arrived(); await go; return { pass: true }; });
+    return { release: () => release(), arrived: seen };
+  };
+  // Gate requests to the copy's repositories (the proof's /version, /token and /user routes aside).
+  const repoCalls = () => sent.filter((x) => x.includes('/api/v1/repos/')).length;
+  return { root, rolesDir, edit, hold, advance, repoCalls, file, api, b, gate, threadFor, writer, credentials, owner, human, call, rec, bot, login, repo, reissue, boot, slot, launch, use, sent, GET, storeRoot, snapshot, business };
+}
+
+const refuses = (code) => (e) => { assert.ok(e instanceof BusError, String(e?.stack ?? e)); assert.equal(e.code, code); return true; };
+
+test('CB3 every new refusal code is in the refusal table with a rail and a next step naming no path', () => {
+  for (const code of CODES) {
+    const entry = REFUSALS[code];
+    assert.ok(entry, code);
+    assert.match(entry.rail, /^R\d+[/:]/, code);
+    assert.ok(entry.nextStep.length > 20, code);
+    assert.ok(!/(^|\s)(\/|~\/)\S/.test(entry.nextStep), `${code} names a path`);
+  }
+});
+
+test('CB3 a copy bound before boot is proved live at boot and launches; prepare, admission and bindLaunch carry one authority', async (t) => {
+  const f = await fixture(t);
+  assert.equal(f.rec().state, 'bound');
+  await f.boot();
+  assert.deepEqual(f.gate.bound(), { rev: ['gitea'] });
+  const role = f.b.taskRoles('demo').rev;
+  assert.deepEqual([role.copyBound, role.credentials], [['gitea'], {}]);
+  const { authority, cap } = await f.launch();
+  assert.match(authority, /^[0-9a-f]{64}$/);
+  assert.equal(f.gate.authority('demo', 'rev').authority, authority);
+  // The live proof at prepare went to the bound origin as the copy's account.
+  assert.ok(f.sent.includes('GET /api/v1/token'));
+  const r = await f.use(cap, f.GET);
+  assert.equal(r.status, 200);
+  assert.equal(r.json.full_name, 'owner/stack');
+  assert.ok(!JSON.stringify(r).includes(f.api.issued.at(-1)));
+  // bindLaunch refuses a bound copy without the authority, or with another one.
+  const r2 = await f.threadFor('r2'), r3 = await f.threadFor('r3');
+  assert.throws(() => f.b.bindLaunch({ business: 'demo', role: 'rev', run: 'r2', harness: 'pi', thread: r2 }), refuses('copy-authority-changed'));
+  assert.throws(() => f.b.bindLaunch({ business: 'demo', role: 'rev', run: 'r3', harness: 'pi', thread: r3, copyAuthority: 'f'.repeat(64) }), refuses('copy-authority-changed'));
+  // A non-copy never carries one.
+  assert.throws(() => f.b.bindLaunch({ business: 'demo', role: 'chief', run: 'c1', harness: 'pi', copyAuthority: authority }), refuses('invalid-request'));
+});
+
+test('CB3 a binding approved after boot answers restart-required at every launch step and sends nothing', async (t) => {
+  const f = await fixture(t, { issue: false });
+  assert.notEqual(f.rec().state, 'bound');
+  await f.boot();
+  assert.deepEqual([f.gate.bound(), f.sent], [{}, []]);
+  // The owner issues the grant now: the record is bound and granted, but the boot didn't prove it.
+  await f.reissue();
+  assert.equal(f.rec().state, 'bound');
+  assert.equal(f.b.taskRoles('demo').rev, undefined);
+  assert.throws(() => f.gate.authority('demo', 'rev'), refuses('restart-required'));
+  await assert.rejects(f.gate.prepare('demo', 'rev'), refuses('restart-required'));
+  assert.throws(() => f.gate.admit('demo', 'rev', 'f'.repeat(64)), refuses('restart-required'));
+  // The verb says so too, before its own unbound refusal.
+  await assert.rejects(f.call(f.human, 'instance.launch', { instance: 'rev' }), refuses('restart-required'));
+  assert.deepEqual(f.sent, []);
+});
+
+test('CB3 a partial binding (a role needing gitea and vikunja, bound for gitea alone) never launches and its boot sends nothing', async (t) => {
+  const f = await fixture(t, { definition: 'reviewer' });
+  assert.equal(f.rec().state, 'bound');
+  await f.boot();
+  assert.deepEqual([f.gate.bound(), f.sent], [{}, []]);
+  assert.throws(() => f.gate.authority('demo', 'rev'), refuses('credential-scope-unverified'));
+  await assert.rejects(f.gate.prepare('demo', 'rev'), refuses('credential-scope-unverified'));
+  await assert.rejects(f.call(f.human, 'instance.launch', { instance: 'rev' }), refuses('credential-scope-unverified'));
+  assert.deepEqual(f.sent, []);
+});
+
+test('CB3 a redirect from the bound origin is refused and never followed', async (t) => {
+  const f = await fixture(t);
+  await f.boot();
+  const { cap } = await f.launch();
+  f.api.rule((e) => e.path === '/api/v1/repos/owner/stack', { status: 302 });
+  await assert.rejects(f.use(cap, f.GET), refuses('copy-redirect-refused'));
+  assert.equal(f.api.requests.filter((e) => e.path.startsWith('/api/v1/repos/')).length, 1);
+});
+
+test('CB3 a call reaches only the admitted repositories, by the methods the binding allows, with no body on a read', async (t) => {
+  const f = await fixture(t);
+  await f.boot();
+  const { cap } = await f.launch();
+  for (const request of [
+    { method: 'GET', path: '/api/v1/repos/owner/other' },
+    { method: 'GET', path: '/api/v1/repos/owner/stack/../other' },
+    { method: 'GET', path: '/api/v1/repos/owner/stack/%2e%2e/other' },
+    { method: 'GET', path: '/api/v1/user' },
+    { method: 'GET', path: 'https://evil.test/api/v1/repos/owner/stack' },
+    { method: 'GET', path: '//evil.test/api/v1/repos/owner/stack' },
+    { method: 'GET', path: '/api/v1/repos/owner/stack', body: { x: 1 } },
+    { method: 'POST', path: '/api/v1/repos/owner/stack/issues', body: { title: 'x' } },
+    { method: 'TRACE', path: '/api/v1/repos/owner/stack' },
+    { service: 'vikunja', method: 'GET', path: '/api/v1/repos/owner/stack' },
+  ]) await assert.rejects(f.use(cap, request), refuses('copy-request-refused'), JSON.stringify(request));
+  assert.equal(f.repoCalls(), 0);
+  // The session, never the arguments, names who the call is for.
+  await assert.rejects(f.gate.call({ business: 'demo', role: 'rev', copyAuthority: 'f'.repeat(64) }, f.GET), refuses('copy-authority-changed'));
+  assert.throws(() => f.b.copySession(f.human), refuses('copy-request-refused'));
+  assert.equal(f.repoCalls(), 0);
+});
+
+test('CB3 a write binding reaches its repository by POST as the copy\'s account (a READ binding is refused above)', async (t) => {
+  const f = await fixture(t, { services: WRITE, perm: 'write' });
+  await f.boot();
+  const { cap } = await f.launch();
+  f.api.rule((e) => e.method === 'POST' && e.path === '/api/v1/repos/owner/stack/issues', { status: 201, json: { number: 1 } });
+  const r = await f.use(cap, { method: 'POST', path: '/api/v1/repos/owner/stack/issues', body: { title: 'x' } });
+  assert.deepEqual(r, { status: 201, json: { number: 1 } });
+  const seen = f.api.requests.filter((e) => e.path === '/api/v1/repos/owner/stack/issues');
+  assert.deepEqual(seen.map((e) => [e.method, e.as]), [['POST', f.login]]);
+});
+
+test('CB3 a re-issue, a replaced slot or rewritten token bytes deny the next call with no request and no cached token', async (t) => {
+  for (const [name, change, code] of [
+    ['re-issue', (f) => f.reissue(), 'restart-required'],
+    ['slot replaced', (f) => { writeFileSync(f.slot + '.n', 'x'.repeat(40), { mode: 0o600 }); renameSync(f.slot + '.n', f.slot); }, 'credential-unavailable'],
+    ['bytes rewritten', (f) => writeFileSync(f.slot, readFileSync(f.slot, 'utf8').replace(/[0-9a-f]{40}/, '0'.repeat(40))), 'credential-unavailable'],
+    ['slot removed', (f) => unlinkSync(f.slot), 'credential-unavailable'],
+    ['mode widened', (f) => chmodSync(f.slot, 0o644), 'credential-unavailable'],
+  ]) {
+    await t.test(name, async (t) => {
+      const f = await fixture(t);
+      await f.boot();
+      const { cap } = await f.launch();
+      assert.equal((await f.use(cap, f.GET)).status, 200);
+      const before = f.sent.length;
+      await change(f);
+      // The bus's session lookup refuses the run itself, before the gate's own check.
+      assert.throws(() => f.b.copySession(cap), refuses(code));
+      await assert.rejects(f.use(cap, f.GET), refuses(code));
+      // No new launch either.
+      await assert.rejects(f.gate.prepare('demo', 'rev'), refuses(code));
+      assert.deepEqual(f.sent.slice(before), []);
+    });
+  }
+});
+
+test('CB3 a revoke while a call is in flight denies that call\'s answer and the next call', async (t) => {
+  const f = await fixture(t);
+  await f.boot();
+  const { cap } = await f.launch();
+  const h = f.hold((e) => e.path === '/api/v1/repos/owner/stack');
+  const pending = f.use(cap, f.GET);
+  await h.arrived;
+  await f.reissue();
+  h.release();
+  await assert.rejects(pending, refuses('restart-required'));
+  const before = f.sent.length;
+  await assert.rejects(f.use(cap, f.GET), refuses('restart-required'));
+  assert.equal(f.sent.length, before);
+});
+
+test('CB3 a grant change in flight fences the copy: nothing is admitted or sent until it ends, and an unknown outcome keeps the fence', async (t) => {
+  const f = await fixture(t);
+  await f.boot();
+  const { cap } = await f.launch();
+  const r2 = await f.threadFor('r2');
+  const authority = f.gate.authority('demo', 'rev').authority;
+  // The owner's re-issue holds at its live proof; the copy is fenced meanwhile.
+  const h = f.hold((e) => e.path === '/api/v1/version');
+  const issuing = f.reissue();
+  await h.arrived;
+  const before = f.sent.length;
+  assert.equal(f.gate.revoking('demo', 'rev'), true);
+  assert.throws(() => f.gate.authority('demo', 'rev'), refuses('credential-revoking'));
+  assert.throws(() => f.gate.admit('demo', 'rev', authority), refuses('credential-revoking'));
+  await assert.rejects(f.gate.prepare('demo', 'rev'), refuses('credential-revoking'));
+  assert.throws(() => f.b.bindLaunch({ business: 'demo', role: 'rev', run: 'r2', harness: 'pi', thread: r2, copyAuthority: authority }), refuses('credential-revoking'));
+  await assert.rejects(f.use(cap, f.GET), refuses('credential-revoking'));
+  assert.equal(f.sent.length, before);
+  h.release();
+  await issuing;
+  assert.equal(f.gate.revoking('demo', 'rev'), false);
+  assert.throws(() => f.gate.authority('demo', 'rev'), refuses('restart-required'));
+  // A definite refusal lifts the fence; an unknown outcome, a system error or a codeless throw keeps it.
+  await assert.rejects(f.gate.fence('demo', 'rev', () => { throw new BusError('credential-date'); }), refuses('credential-date'));
+  assert.equal(f.gate.revoking('demo', 'rev'), false);
+  for (const thrown of [new BusError('outcome-unknown'), Object.assign(new Error('disk'), { code: 'ENOSPC' }), new Error('bug')]) {
+    const g = await fixture(t);
+    await g.boot();
+    await assert.rejects(g.gate.fence('demo', 'rev', () => { throw thrown; }));
+    assert.equal(g.gate.revoking('demo', 'rev'), true, String(thrown.code));
+    await assert.rejects(g.gate.prepare('demo', 'rev'), refuses('credential-revoking'));
+    assert.deepEqual(g.sent.filter((x) => !x.startsWith('GET /api/v1/version') && !x.startsWith('GET /api/v1/token') && !x.startsWith('GET /api/v1/user')), []);
+  }
+});
+
+// Each change lands while prepare's live proof is at the server (between the authority before and
+// after), then again between prepare and bindLaunch, then between bindLaunch and the first use. None
+// may end in a request to the copy's repositories.
+const RACES = [
+  ['role definition changed', (f) => writeFileSync(join(f.rolesDir, 'research.md'), readFileSync(join(f.rolesDir, 'research.md'), 'utf8') + '\nChanged.\n')],
+  ['binding generation moved', (f) => f.edit((d) => { d.copyBindings.rev.generation += 1; })],
+  ['binding unbound', (f) => f.edit((d) => { d.copyBindings.rev.state = 'unbound'; })],
+  ['grant scopes narrowed', (f) => f.edit((d) => { d.copyBindings.rev.services.gitea.scopes = ['read:user']; })],
+  ['token bytes rewritten', (f) => writeFileSync(f.slot, readFileSync(f.slot, 'utf8').replace(/[0-9a-f]{40}/, '0'.repeat(40)))],
+  ['project remote moved', (f) => f.edit((d) => { d.projects.stack.remote = 'https://elsewhere.test/owner/stack'; })],
+  ['project removed', (f) => f.edit((d) => { delete d.projects.stack; })],
+  ['project excludes the copy', (f) => f.edit((d) => { d.projects.stack.agents = { ...d.projects.stack.agents, rev: { exclude: true } }; })],
+];
+
+test('CB3 a change during prepare\'s live proof refuses the launch with no repository request', async (t) => {
+  for (const [name, change] of RACES) {
+    await t.test(name, async (t) => {
+      const f = await fixture(t);
+      await f.boot();
+      const h = f.hold((e) => e.path === '/api/v1/token');
+      const preparing = f.gate.prepare('demo', 'rev');
+      await h.arrived;
+      await change(f);
+      h.release();
+      await assert.rejects(preparing, (e) => e instanceof BusError && /^(copy-|credential-|restart-)/.test(e.code));
+      assert.equal(f.repoCalls(), 0);
+    });
+  }
+});
+
+test('CB3 a change between prepare and bindLaunch, or between bindLaunch and use, refuses with no repository request', async (t) => {
+  for (const [name, change] of RACES) {
+    await t.test(`${name} before bind`, async (t) => {
+      const f = await fixture(t);
+      await f.boot();
+      const thread = await f.threadFor('r1');
+      const { authority } = await f.gate.prepare('demo', 'rev');
+      await change(f);
+      assert.throws(() => f.b.bindLaunch({ business: 'demo', role: 'rev', run: 'r1', harness: 'pi', thread, copyAuthority: authority }),
+        (e) => e instanceof BusError && /^(copy-|credential-|restart-)/.test(e.code));
+      assert.equal(f.repoCalls(), 0);
+    });
+    await t.test(`${name} before use`, async (t) => {
+      const f = await fixture(t);
+      await f.boot();
+      const { cap } = await f.launch();
+      await change(f);
+      await assert.rejects(f.use(cap, f.GET), (e) => e instanceof BusError && /^(copy-|credential-|restart-|run-)/.test(e.code));
+      assert.equal(f.repoCalls(), 0);
+    });
+  }
+});
+
+// The organization's registry entry rewritten in place (mode kept), as a lifecycle change would.
+const registryEdit = (f, fn) => {
+  const file = join(f.root, 'org-runtime.json');
+  const d = JSON.parse(readFileSync(file, 'utf8'));
+  fn(d.orgs.demo, d);
+  writeFileSync(file, JSON.stringify(d, null, 2) + '\n');
+};
+
+test('CB3 an organization no longer active admits and sends nothing, with the binding and incarnation unchanged', async (t) => {
+  for (const state of ['archived', 'deleting', 'reserved']) {
+    await t.test(`${state} after launch`, async (t) => {
+      const f = await fixture(t);
+      await f.boot();
+      const { cap, authority } = await f.launch();
+      registryEdit(f, (e) => { e.state = state; });
+      const before = f.sent.length;
+      assert.throws(() => f.gate.authority('demo', 'rev'), refuses('credential-revoked'));
+      assert.throws(() => f.gate.admit('demo', 'rev', authority), refuses('credential-revoked'));
+      await assert.rejects(f.gate.prepare('demo', 'rev'), refuses('credential-revoked'));
+      await assert.rejects(f.use(cap, f.GET), refuses('credential-revoked'));
+      assert.equal(f.sent.length, before);
+      assert.equal(f.repoCalls(), 0);
+    });
+  }
+  await t.test('archived while prepare\'s proof is at the server', async (t) => {
+    const f = await fixture(t);
+    await f.boot();
+    const h = f.hold((e) => e.path === '/api/v1/token');
+    const preparing = f.gate.prepare('demo', 'rev');
+    await h.arrived;
+    registryEdit(f, (e) => { e.state = 'archived'; });
+    h.release();
+    await assert.rejects(preparing, refuses('credential-revoked'));
+    assert.equal(f.repoCalls(), 0);
+  });
+  await t.test('archived before boot', async (t) => {
+    const f = await fixture(t);
+    registryEdit(f, (e) => { e.state = 'archived'; });
+    await f.boot();
+    assert.deepEqual([f.gate.bound(), f.sent], [{}, []]);
+  });
+  await t.test('registry unsafe after launch', async (t) => {
+    const f = await fixture(t);
+    await f.boot();
+    const { cap } = await f.launch();
+    chmodSync(join(f.root, 'org-runtime.json'), 0o644);
+    const before = f.sent.length;
+    await assert.rejects(f.use(cap, f.GET), refuses('credential-unavailable'));
+    assert.equal(f.sent.length, before);
+  });
+});
+
+test('CB3 an organization recreated under the same id (a new incarnation) admits and sends nothing for the old copy', async (t) => {
+  const f = await fixture(t);
+  await f.boot();
+  const { cap, authority } = await f.launch();
+  registryEdit(f, (e) => { e.incarnation = 'f'.repeat(32); });
+  const before = f.sent.length;
+  assert.throws(() => f.gate.admit('demo', 'rev', authority), refuses('credential-revoked'));
+  await assert.rejects(f.gate.prepare('demo', 'rev'), refuses('credential-revoked'));
+  await assert.rejects(f.use(cap, f.GET), refuses('credential-revoked'));
+  assert.equal(f.sent.length, before);
+});
+
+// The project points at another repository on the same server: origin, binding and slot are as
+// boot proved them, only the repositories the launch authority covers move.
+const repointed = (f) => f.edit((d) => { d.projects.stack.remote = d.projects.stack.remote.replace('/owner/stack', '/owner/other'); });
+
+test('CB3 a change while a call is in flight denies that call\'s answer, including one that moves only the launch authority', async (t) => {
+  for (const [name, change, code] of [['repository repointed', repointed, 'credential-revoked'],
+    ...RACES.filter(([n]) => ['role definition changed', 'project excludes the copy'].includes(n)).map(([n, c]) => [n, c, null])]) {
+    await t.test(name, async (t) => {
+      const f = await fixture(t);
+      await f.boot();
+      const { cap } = await f.launch();
+      const h = f.hold((e) => e.path === '/api/v1/repos/owner/stack');
+      const pending = f.use(cap, f.GET);
+      await h.arrived;
+      await change(f);
+      h.release();
+      await assert.rejects(pending, code ? refuses(code) : (e) => e instanceof BusError && /^(copy-|credential-|restart-)/.test(e.code));
+    });
+  }
+});
+
+test('CB3 a running copy session whose launch authority moved answers no agent verb', async (t) => {
+  const f = await fixture(t);
+  await f.boot();
+  const { cap } = await f.launch();
+  // Past the copy check to the holder check: the session holds no claim yet.
+  await assert.rejects(f.call(cap, 'inbox'), refuses('not-holder'));
+  repointed(f);
+  assert.doesNotThrow(() => f.gate.authority('demo', 'rev'));
+  await assert.rejects(f.call(cap, 'inbox'), refuses('copy-authority-changed'));
+});
+
+test('CB3 a binding with no repository scope sends no repository request, read or write', async (t) => {
+  const f = await fixture(t, { services: { gitea: { scopes: ['read:user'], projects: ['stack'] } } });
+  await f.boot();
+  assert.deepEqual(f.gate.bound(), { rev: ['gitea'] });
+  const { cap } = await f.launch();
+  for (const method of ['GET', 'HEAD', 'POST'])
+    await assert.rejects(f.use(cap, { method, path: '/api/v1/repos/owner/stack' }), refuses('copy-request-refused'), method);
+  assert.equal(f.repoCalls(), 0);
+});
+
+test('CB3 the organization file revision the launch resolved holds through prepare, final admission and bindLaunch', async (t) => {
+  // Same document, other bytes: the launch authority is unchanged, only the revision moves.
+  const rewrite = (f) => writeFileSync(f.file, JSON.stringify(JSON.parse(readFileSync(f.file, 'utf8'))) + '\n');
+  await t.test('changed before prepare', async (t) => {
+    const f = await fixture(t);
+    await f.boot();
+    const revision = f.writer.read('demo').revision;
+    rewrite(f);
+    const before = f.sent.length;
+    await assert.rejects(f.gate.prepare('demo', 'rev', revision), refuses('organization-changed'));
+    assert.equal(f.sent.length, before);
+  });
+  await t.test('changed during prepare\'s proof', async (t) => {
+    const f = await fixture(t);
+    await f.boot();
+    const revision = f.writer.read('demo').revision;
+    const h = f.hold((e) => e.path === '/api/v1/token');
+    const preparing = f.gate.prepare('demo', 'rev', revision);
+    await h.arrived;
+    rewrite(f);
+    h.release();
+    await assert.rejects(preparing, refuses('organization-changed'));
+  });
+  await t.test('changed after final admission, before bindLaunch', async (t) => {
+    const f = await fixture(t);
+    await f.boot();
+    const thread = await f.threadFor('r1');
+    const revision = f.writer.read('demo').revision;
+    const { authority } = await f.gate.prepare('demo', 'rev', revision);
+    f.gate.admit('demo', 'rev', authority, revision);
+    rewrite(f);
+    assert.equal(f.gate.authority('demo', 'rev').authority, authority);
+    assert.throws(() => f.gate.admit('demo', 'rev', authority, revision), refuses('organization-changed'));
+    const bind = (extra) => f.b.bindLaunch({ business: 'demo', role: 'rev', run: 'r1', harness: 'pi', thread, copyAuthority: authority, ...extra });
+    assert.throws(() => bind({ revision }), refuses('organization-changed'));
+    assert.throws(() => bind({}), refuses('organization-changed'));
+    assert.equal(f.repoCalls(), 0);
+    // The same authority on the file as it stands now binds: the refusal above was the revision's.
+    assert.ok(bind({ revision: f.writer.read('demo').revision }));
+  });
+  await t.test('a non-copy never carries a revision', async (t) => {
+    const f = await fixture(t);
+    await f.boot();
+    assert.throws(() => f.b.bindLaunch({ business: 'demo', role: 'chief', run: 'c1', harness: 'pi', revision: f.writer.read('demo').revision }), refuses('invalid-request'));
+  });
+});
+
+test('CB3 a copy past its rotation date refuses credential-expired at prepare and at the next call', async (t) => {
+  const f = await fixture(t);
+  await f.boot();
+  const { cap } = await f.launch();
+  f.advance(31);
+  const before = f.sent.length;
+  await assert.rejects(f.gate.prepare('demo', 'rev'), refuses('credential-expired'));
+  await assert.rejects(f.use(cap, f.GET), refuses('credential-expired'));
+  assert.equal(f.sent.length, before);
+});
+
+test('CB3 a boot that cannot verify proves nothing: the service unreachable, the token refused, the slot missing', async (t) => {
+  for (const [name, setup, code] of [
+    // The verifier answers an unreachable service as unverified (copy-grant.mjs verifyGiteaToken).
+    ['service down', (f) => f.api.rule(() => true, { drop: true }), 'credential-scope-unverified'],
+    ['token revoked at the service', (f) => f.api.rule((e) => e.path === '/api/v1/token', { status: 401, json: { message: 'no' } }), 'credential-scope-unverified'],
+    ['slot missing', (f) => unlinkSync(f.slot), 'credential-unavailable'],
+  ]) {
+    await t.test(name, async (t) => {
+      const f = await fixture(t);
+      setup(f);
+      await f.boot();
+      assert.deepEqual(f.gate.bound(), {});
+      assert.throws(() => f.gate.authority('demo', 'rev'), refuses(code));
+      await assert.rejects(f.call(f.human, 'instance.launch', { instance: 'rev' }), refuses(code));
+      assert.equal(f.repoCalls(), 0);
+    });
+  }
+});
+
+// The launcher's host stops on a reply later than 10 s, so a slow service must not hold prepare past
+// its budget: the proof gets no answer, the launch is refused, and nothing more is sent.
+test('CB3: a service that does not answer within the budget fails prepare and boot closed, inside the budget', { timeout: 60000 }, async (t) => {
+  await t.test('prepare', async (t) => {
+    const f = await fixture(t, { budgets: { prepareMs: 400 } });
+    await f.boot();
+    const unrule = f.api.rule((e) => e.path === '/api/v1/token', { hang: true });
+    t.after(unrule);
+    const at = Date.now();
+    await assert.rejects(f.gate.prepare('demo', 'rev'), (e) => e.code === 'credential-scope-unverified');
+    assert.ok(Date.now() - at < 2500, `prepare took ${Date.now() - at} ms`);
+    assert.equal(f.repoCalls(), 0);
+  });
+  await t.test('boot', async (t) => {
+    const f = await fixture(t, { budgets: { bootMs: 400 } });
+    const unrule = f.api.rule((e) => e.path === '/api/v1/token', { hang: true });
+    t.after(unrule);
+    const at = Date.now();
+    await f.boot();
+    assert.ok(Date.now() - at < 2500, `boot took ${Date.now() - at} ms`);
+    assert.deepEqual(f.gate.bound(), {});
+    await assert.rejects(f.gate.prepare('demo', 'rev'), (e) => e.code === 'credential-scope-unverified');
+  });
+});

packages/business/src/repo-remote.mjs

@@ -0,0 +1,2 @@
+// Old path of packages/organization/src/repo-remote.mjs (rename design r2, stage B).
+export * from "../../organization/src/repo-remote.mjs";

packages/cli/README.md

@@ -1279,8 +1279,15 @@ its checkout; `mosaic org project repo init ID PROJECT --local-only
 URL` selects remote mode instead. These commands never push or overwrite an
 existing repository. Local-only acceptance records the risk of losing the only
 copy. Read back with `mosaic org queue show ID [--json]` or `mosaic org project
-repo show ID PROJECT [--json]`. See `packages/organization/README.md` for the
-layout and scope. On existing CLI commands, `--org ID` is an alias for `--business ID`;
+repo show ID PROJECT [--json]`. `mosaic org project repo set ID PROJECT
+(--local-only --accept-local-loss-risk | --remote URL) --if-revision N [--json]`
+changes a project's repository later; it is refused with `project-repo-bound`
+(exit 2) while an approved or active copy binding names the project. A remote is https or ssh; its checkout's
+`origin` is set and checked once with `git ls-remote`, without credentials, and
+the receipt says `reachable`, `needs-credential` or `unreachable`. An ssh check
+does not verify the host key and says so. A copy
+credential binding supplies credentials for https Gitea remotes only. See
+`packages/organization/README.md` for the URL rules, layout and scope. On existing CLI commands, `--org ID` is an alias for `--business ID`;
 if both are supplied they must name the same ID.
 
 `mosaic org delete ID --confirm ID --if-revision N [--json]` stops the

packages/cli/src/host.mjs

@@ -367,7 +367,12 @@ export async function startHost({ boot, business, notifier = null, options = nul
     close(1);
   });
 
-  return Object.freeze({ path: ready.path, dataRoot, business, bindLaunch, op, beforeClose, close, done, pids: Object.freeze({ broker: broker.pid, notifier: notify?.pid ?? null }) });
+  // #1873 CB3: the copies the broker's boot proved live, names only; anything malformed counts as none.
+  const copyBound = {};
+  if (ready.copyBound && typeof ready.copyBound === "object" && !Array.isArray(ready.copyBound))
+    for (const [instance, services] of Object.entries(ready.copyBound))
+      if (Array.isArray(services) && services.every((s) => typeof s === "string")) copyBound[instance] = Object.freeze([...services]);
+  return Object.freeze({ path: ready.path, dataRoot, business, bindLaunch, op, beforeClose, close, done, copyBound: Object.freeze(copyBound), pids: Object.freeze({ broker: broker.pid, notifier: notify?.pid ?? null }) });
 }
 
 // `mosaic bus stop`: SIGTERM to the recorded host, after checking that the

packages/cli/src/launcher.mjs

@@ -147,7 +147,7 @@ import { configDir, resolveInstance, systemVars } from "../../organization/src/i
 import { organizationWriter } from "../../organization/src/organization.mjs";
 import { quietMessage } from "../../organization/src/org-registry.mjs";
 import { businessFilePath } from "../../organization/src/organization-config.mjs";
-import { copyOf, copyRefusal, loadWithCopies, projectRefusal, withCopies } from "../../organization/src/agent-copies.mjs";
+import { copyOf, copyRefusal, loadWithCopies, projectRefusal, promoteCopies, withCopies } from "../../organization/src/agent-copies.mjs";
 import { selectModelProvider } from "../../plugins/src/model-provider-selection.mjs";
 import { THREAD_DEFINITIONS } from "../../organization/src/vocabulary.mjs";
 import { limitHit } from "../../organization/src/launch.mjs";
@@ -264,6 +264,9 @@ export function createLauncher({
   if (testProxy !== null && system.proxy)
     throw Object.assign(new Error("testProxy skips P2 admission, so it is refused with system.proxy set"), { code: "test-proxy-refused" });
   const dataRoot = system.dataRoot;
+  // #1873 CB3: a copy the bus's boot proved live at its service launches as bound; the bus decides
+  // which, and admits each launch again on its own launch authority. The rest stay as booted.
+  if (copies && host.copyBound) copies = promoteCopies(copies, host.copyBound);
   function admission(generation = null) {
     try { return assertProcessing(dataRoot, generation); }
     catch (e) {
@@ -827,7 +830,19 @@ export function createLauncher({
     // asynchronous preparation read. Admission is the launch boundary; bindLaunch remains a fence.
     // #1873 A3: `revision` is the organization file check() resolved the bundle from; a file that
     // changed since (a narrow, a define's vars, an exclude) refuses, and the next launch resolves anew.
-    const finalAdmission = await host.op({ op: "request.admission", business: b.id, projects: Object.keys(codeProjects), instance, revision, thread, session });
+    // #1873 CB3: a bound copy's launch authority, after the bus re-resolved its binding and proved the
+    // slot live at the service. The final admission and bindLaunch each check it is still current.
+    let copyAuthority = null;
+    if (copyOf(b, instance)?.bound?.length) {
+      // The bus's refusal is the launch's: its code goes to the log and the thread as given.
+      let prepared;
+      try { prepared = await host.op({ op: "copyLaunch", business: b.id, instance, revision }); }
+      catch (e) { throw new Refusal(typeof e?.code === "string" && /^[a-z][a-z0-9-]*$/.test(e.code) ? e.code : "credential-unavailable", `${instance}'s bound services can't be proved live`); }
+      if (typeof prepared?.authority !== "string") throw new Refusal("credential-unavailable", `${instance}'s bound services can't be proved live`);
+      copyAuthority = prepared.authority;
+      admission(admissionGeneration);
+    }
+    const finalAdmission = await host.op({ op: "request.admission", business: b.id, projects: Object.keys(codeProjects), instance, revision, thread, session, ...(copyAuthority ? { authority: copyAuthority } : {}) });
     if (finalAdmission?.ready !== true) throw new Refusal(finalAdmission?.code ?? "project-pending");
     const managed = registerRuntime(dataRoot, { kind: 'session', business: b.id, run });
     let child;
@@ -856,7 +871,7 @@ export function createLauncher({
       admission(admissionGeneration);
       if (!outerStart) throw new Error("the session process exited at once");
       lock?.update({ run, runPid: child.pid, runStartTime: outerStart });
-      const launch = await host.bindLaunch({ business: b.id, role: instance, run, harness: model.harness, provider: model.provider, model: model.model, account, transcript, pid: child.pid, startTime: outerStart, ...(thread ? { thread, session } : {}), ...(admittedProxy ? { modelKeyId } : {}) });
+      const launch = await host.bindLaunch({ business: b.id, role: instance, run, harness: model.harness, provider: model.provider, model: model.model, account, transcript, pid: child.pid, startTime: outerStart, ...(thread ? { thread, session } : {}), ...(admittedProxy ? { modelKeyId } : {}), ...(copyAuthority ? { copyAuthority, revision } : {}) });
       bound = true;
       admission(admissionGeneration);
       entry = {

packages/cli/src/org.mjs

@@ -1,7 +1,7 @@
 import { readFile, writeFile } from 'node:fs/promises';
 import { configDir } from '../../organization/src/organization-config.mjs';
 import { listOrgs, orgLock } from '../../organization/src/org-registry.mjs';
-import { templateRender, validateOrg, createOrg, showOrg, updateOrg, queueInit, queueShow, projectRepoInit, projectRepoShow, deleteOrg, archiveOrg, restoreOrg } from '../../organization/src/org-service.mjs';
+import { templateRender, validateOrg, createOrg, showOrg, updateOrg, queueInit, queueShow, projectRepoInit, projectRepoShow, projectRepoSet, deleteOrg, archiveOrg, restoreOrg } from '../../organization/src/org-service.mjs';
 import { installedSystemTypes } from '../../plugins/src/system-types.mjs';
 import { DEV_OWNER, devOwnerInstance } from './dev-local-owner.mjs';
 import { loadSystem } from './config.mjs';
@@ -12,7 +12,7 @@ import { consoleBusRestart } from './org-console.mjs';
 import { refuseInsideAgent } from './transport.mjs';
 import { definitionsCommand, DEFINITIONS_USAGE } from './org-definitions.mjs';
 import { orgOwnerCommand, ORG_OWNER_USAGE, ORG_OWNER_VERBS } from './org-owner.mjs';
-export const ORG_USAGE = 'mosaic org system-types installed | system-types enabled ID | lock show|clear ID | reload ID | archive ID --if-revision N [--json] | restore ID --if-revision N [--no-bus] [--json] | delete ID --confirm ID [--if-revision N] [--json] | template render ID [--fixture local] --output FILE | validate FILE | create ID --from FILE | show ID [--json] | list [--json] | update ID --from FILE --if-revision N | queue init ID (--local-only --accept-local-loss-risk | --remote URL) | queue show ID [--json] | project repo init ID PROJECT (--local-only --accept-local-loss-risk | --remote URL) | project repo show ID PROJECT [--json] | ' + DEFINITIONS_USAGE.slice('mosaic org '.length) + ' | ' + ORG_OWNER_USAGE.slice('mosaic org '.length) + ' | config validate ID | config resolve ID INSTANCE [--project ID]';
+export const ORG_USAGE = 'mosaic org system-types installed | system-types enabled ID | lock show|clear ID | reload ID | archive ID --if-revision N [--json] | restore ID --if-revision N [--no-bus] [--json] | delete ID --confirm ID [--if-revision N] [--json] | template render ID [--fixture local] --output FILE | validate FILE | create ID --from FILE | show ID [--json] | list [--json] | update ID --from FILE --if-revision N | queue init ID (--local-only --accept-local-loss-risk | --remote URL) | queue show ID [--json] | project repo init ID PROJECT (--local-only --accept-local-loss-risk | --remote URL) | project repo show ID PROJECT [--json] | project repo set ID PROJECT (--local-only --accept-local-loss-risk | --remote URL) --if-revision N [--json] | ' + DEFINITIONS_USAGE.slice('mosaic org '.length) + ' | ' + ORG_OWNER_USAGE.slice('mosaic org '.length) + ' | config validate ID | config resolve ID INSTANCE [--project ID]';
 function parse(args) { const pos = [], values = {}, flags = new Set(); for (let i = 0; i < args.length; i++) { const a = args[i]; if (['--json', '--local-only', '--accept-local-loss-risk', '--no-bus'].includes(a)) { if (flags.has(a)) throw new CliError(`duplicate ${a}`, 4); flags.add(a); } else if (['--fixture', '--output', '--from', '--if-revision', '--remote', '--confirm'].includes(a)) { if (values[a] !== undefined || !args[i+1] || args[i+1].startsWith('--')) throw new CliError(`${a} needs one value`, 4); values[a] = args[++i]; } else if (a.startsWith('--')) throw new CliError(`unknown option ${a}`, 4); else pos.push(a); } return { pos, values, flags }; }
 // A refusal names the document by label and the error by its code, never by host path or bytes (PR #1916).
 const errorCode = e => typeof e?.code === 'string' && /^E[A-Z0-9]+$/.test(e.code) ? e.code : 'unreadable';
@@ -80,6 +80,9 @@ export async function orgCommand(args, io, deps = {}) {
    const project = words[0] === 'project', op = words[project ? 2 : 1], id = words[project ? 3 : 2], name = project ? words[4] : null;
    if (op === 'show') { allowed(['--json'], []); result = project ? await projectRepoShow(ctx, id, name) : await queueShow(ctx, id); }
    else if (op === 'init') { allowed(['--local-only', '--accept-local-loss-risk'], ['--remote']); if (p.flags.has('--local-only') === Boolean(p.values['--remote'])) throw new CliError('select exactly one of --local-only or --remote', 4); const opts = { mode: p.flags.has('--local-only') ? 'local-only' : 'remote', remote: p.values['--remote'], acceptLocalLossRisk: p.flags.has('--accept-local-loss-risk') }; result = project ? await projectRepoInit(ctx, id, name, opts) : await queueInit(ctx, id, opts); }
+   // #1873 P1-7: change the project's repository (remote URL, or remote to local-only and back).
+   // The same URL rules and check as init; origin follows; nothing is pushed.
+   else if (op === 'set' && project) { allowed(['--json', '--local-only', '--accept-local-loss-risk'], ['--remote', '--if-revision']); if (p.flags.has('--local-only') === Boolean(p.values['--remote'])) throw new CliError('select exactly one of --local-only or --remote', 4); const ifRevision = revision(p.values['--if-revision'], true); result = await projectRepoSet(ctx, id, name, { mode: p.flags.has('--local-only') ? 'local-only' : 'remote', remote: p.values['--remote'], acceptLocalLossRisk: p.flags.has('--accept-local-loss-risk'), ifRevision }); }
    else throw new CliError(ORG_USAGE, 4);
   } else throw new CliError(ORG_USAGE, 4);
   io.stdout.write(JSON.stringify(result, null, 2) + '\n');

packages/cli/tests/agent-copies.test.mjs

@@ -9,7 +9,7 @@ import { test } from "node:test";
 import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
 import { DatabaseSync } from "node:sqlite";
-import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, symlinkSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, symlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { businessDoc, launchDoc, tokenFile, writeJson } from "../../organization/tests/helpers.mjs";
@@ -23,6 +23,11 @@ import { bootConfig, loadSystem } from "../src/config.mjs";
 import { startTimeOf } from "../src/host.mjs";
 import { createLauncher } from "../src/launcher.mjs";
 import { fakeHarnesses, fixture, tmp, withoutHostCredentials } from "./helpers.mjs";
+import { fakeGiteaApi } from "../../bus/tests/fake-gitea-api.mjs";
+import { send as giteaSend } from "../../bus/src/gitea-grant.mjs";
+import { organizationWriter } from "../../organization/src/organization.mjs";
+import { activateOrg, reserveOrg } from "../../organization/src/org-registry.mjs";
+import { copyBotLogin } from "../../organization/src/copy-bindings.mjs";
 
 const FAKE = fileURLToPath(new URL("../../harness/tests/fixtures/fake-adapter.mjs", import.meta.url));
 const skip = sandboxProblem() ?? false;
@@ -81,10 +86,10 @@ function prepare(t, edit = (doc) => doc) {
   return { root, f, adapter };
 }
 
-async function start(t, { f, adapter }, { businessId = "acme", orgRoot } = {}) {
+async function start(t, { f, adapter }, { businessId = "acme", orgRoot, copyTransport = null, beforeBind = null } = {}) {
   const system = loadSystem({ env: f.env });
   const { trackers, ...boot } = bootConfig({ system, businessId, env: f.env, ...(orgRoot ? { orgRoot } : {}) });
-  const runtime = await startBroker(boot);
+  const runtime = await startBroker({ ...boot, ...(copyTransport ? { copyTransport } : {}) });
   const dataRoot = boot.dataRoot;
   mkdirSync(join(dataRoot, "bus-host"), { recursive: true, mode: 0o700 });
   const ops = {
@@ -104,6 +109,7 @@ async function start(t, { f, adapter }, { businessId = "acme", orgRoot } = {}) {
     lifecycleTake: (m) => runtime.lifecycleTake(m.record),
     lifecycleDelete: (m) => runtime.lifecycleDelete(m.record),
     lifecycleDone: (m) => runtime.lifecycleDone(m.record),
+    copyLaunch: (m) => runtime.copyLaunch(m),
   };
   const refusing = (what, fn) => async (m) => {
     try {
@@ -123,8 +129,11 @@ async function start(t, { f, adapter }, { businessId = "acme", orgRoot } = {}) {
       if (!Object.hasOwn(ops, m.op)) throw new BusError("invalid-host-request");
       return ops[m.op](m);
     }),
-    bindLaunch: refusing("launch bind", (r) => runtime.bindLaunch(r)),
+    bindLaunch: beforeBind
+      ? async (r) => { await beforeBind(r); return refusing("launch bind", (x) => runtime.bindLaunch(x))(r); }
+      : refusing("launch bind", (r) => runtime.bindLaunch(r)),
     beforeClose: (fn) => void hooks.push(fn),
+    copyBound: runtime.copyBound,
   };
   const logs = [];
   const launcher = createLauncher({
@@ -593,3 +602,157 @@ test("A3: a second organization boots its own copies from the same root file and
   assert.equal(sessions(b.dataRoot).includes(run.run), false);
   assert.equal(b.running("gate").length, 0);
 });
+
+// #1873 CB3: the researcher copy (research, gitea alone) bound and granted on a fake Gitea, through
+// the real bus, its boot check and the launcher. `sent` is every request the bus sends to the service.
+async function boundCopy(t) {
+  const api = await fakeGiteaApi(t, tmp(t, "cb3-api-"));
+  const p = prepare(t, (doc) => {
+    doc.projects.stack.remote = `${api.url}/owner/stack`;
+    return doc;
+  });
+  const ctx = { configDir: join(p.root, "config"), dataRoot: p.f.dataRoot, instance: "test" };
+  chmodSync(ctx.configDir, 0o700);
+  await reserveOrg(ctx, "acme");
+  await activateOrg(ctx, "acme");
+  const sent = [];
+  const copyTransport = { ca: api.ca, send: (req) => { sent.push(`${req.method} ${req.path.split("?")[0]}`); return giteaSend(req); } };
+  const repo = api.addRepo("owner", "stack");
+  const writer = organizationWriter({ dir: join(p.root, "config"), rolesDir: p.f.roles });
+  const rec = () => writer.read("acme").document.copyBindings?.researcher;
+  const day = (n) => new Date(Date.now() + n * 86400000).toISOString().slice(0, 10);
+  // Bind (the owner's console) and issue (the human), on a bus that is already up.
+  const bind = async (s) => {
+    const owner = s.runtime.broker.bindConsole({ business: "acme", human: p.f.doc.human, subject: { provider: "test", iss: "https://issuer.test", sub: "owner" } });
+    await s.runtime.broker.request(owner, { verb: "hire.start.console", args: { op: "change", level: "root", name: "researcher", reason: "Bind the copy",
+      binding: { services: { gitea: { scopes: ["read:repository", "read:user"], projects: ["stack"] } } } } });
+    const r = rec();
+    const login = copyBotLogin(r.orgIncarnation, r.copyId, "gitea");
+    api.addUser(login);
+    repo.collaborators.push(login); repo.permissions[login] = "read";
+    await s.call("credentials.issue", { agent: "researcher", service: "gitea", date: day(30), token: api.addToken(login, "t1", ["read:repository", "read:user"]).sha1 });
+    return login;
+  };
+  return { ...p, api, sent, copyTransport, rec, bind };
+}
+
+const launchEvents = (s) => existsSync(launchLogFile(s.dataRoot, "acme"))
+  ? readFileSync(launchLogFile(s.dataRoot, "acme"), "utf8").trim().split("\n").map((l) => JSON.parse(l)) : [];
+// One message to a new researcher thread, and the launcher's tick that takes it: the launch or the refusal.
+async function threadLaunch(s, name) {
+  const project = s.call("project.list").find((x) => x.name === "stack work")?.id ?? s.call("project.create", { name: "stack work", repo: "stack" }).id;
+  const thread = s.call("thread.create", { project, name, instance: "researcher" }).id;
+  s.call("thread.send", { thread, body: "hello" });
+  await s.launcher.tick();
+  return until(() => launchEvents(s).find((e) => e.thread === thread && ["launch", "refused"].includes(e.event)));
+}
+
+test("CB3: a binding approved after boot answers restart-required; after a restart the bus proves it live, and the launcher carries one launch authority to bind", { skip, timeout: 120000 }, async (t) => {
+  const p = await boundCopy(t);
+  const first = await start(t, p, { copyTransport: p.copyTransport });
+  assert.deepEqual(first.runtime.copyBound, {});
+  const login = await p.bind(first);
+  assert.equal(p.rec().state, "bound");
+  // The issue's own check (CB2) is the last request this bus sends for the copy.
+  const issued = p.sent.length;
+  assert.ok(issued > 0);
+  // Bound and granted after this boot: restart-required at the verb, at the bus's prepare, and at its admission.
+  assert.equal(refusedAt(first, "researcher").code, "restart-required");
+  const revision = organizationWriter({ dir: join(p.root, "config"), rolesDir: p.f.roles }).read("acme").revision;
+  // A copy launch carries the revision its bundle came from; without one it is not a request.
+  await assert.rejects(first.runtime.copyLaunch({ business: "acme", instance: "researcher" }), (e) => e.code === "invalid-request");
+  await assert.rejects(first.runtime.copyLaunch({ business: "acme", instance: "researcher", revision }), (e) => e.code === "restart-required");
+  assert.equal(first.runtime.admission({ business: "acme", projects: [], instance: "researcher", revision }).code, "copy-authority-changed");
+  assert.deepEqual(first.runtime.admission({ business: "acme", projects: [], instance: "researcher", revision, authority: "0".repeat(64) }), { ready: false, revision: null, code: "restart-required" });
+  assert.equal(p.sent.length, issued);
+  await first.close();
+
+  // The next boot proves the slot live as the copy's account, and the launcher sees it bound.
+  const s = await start(t, p, { copyTransport: p.copyTransport });
+  assert.deepEqual(s.runtime.copyBound, { researcher: ["gitea"] });
+  assert.ok(p.sent.slice(issued).includes("GET /api/v1/token"));
+  assert.ok(p.api.requests.filter((e) => e.path === "/api/v1/token").every((e) => e.as === login));
+  // Final admission with an empty project list still needs the authority.
+  const rev2 = organizationWriter({ dir: join(p.root, "config"), rolesDir: p.f.roles }).read("acme").revision;
+  assert.equal(s.runtime.admission({ business: "acme", projects: [], instance: "researcher", revision: rev2 }).code, "copy-authority-changed");
+  const { authority } = await s.runtime.copyLaunch({ business: "acme", instance: "researcher", revision: rev2 });
+  assert.match(authority, /^[0-9a-f]{64}$/);
+  assert.deepEqual(s.runtime.admission({ business: "acme", projects: [], instance: "researcher", revision: rev2, authority }), { ready: true, revision: null, code: null });
+  // Any other instance has no authority to carry.
+  assert.deepEqual(await s.runtime.copyLaunch({ business: "acme", instance: "gate" }), { authority: null, services: [] });
+
+  const before = p.sent.length;
+  const launched = await threadLaunch(s, "one");
+  assert.equal(launched.event, "launch", JSON.stringify(launched));
+  // The launcher's prepare proved the slot live again at launch.
+  assert.ok(p.sent.slice(before).includes("GET /api/v1/token"));
+  assert.equal(s.running("researcher").length, 1);
+  assert.equal(p.sent.filter((x) => x.includes("/api/v1/repos/")).length, 0);
+});
+
+// A reissue is a new generation: the slot the launch proved is not the slot it would use.
+const reissue = (p, s, login, name) => s.call("credentials.issue", { agent: "researcher", service: "gitea",
+  date: new Date(Date.now() + 30 * 86400000).toISOString().slice(0, 10), token: p.api.addToken(login, name, ["read:repository", "read:user"]).sha1 });
+const restarted = async (t, p, opts = {}) => {
+  const first = await start(t, p, { copyTransport: p.copyTransport });
+  const login = await p.bind(first);
+  await first.close();
+  return { login, s: await start(t, p, { copyTransport: p.copyTransport, ...opts }) };
+};
+const repoCalls = (p) => p.sent.filter((x) => x.includes("/api/v1/repos/")).length;
+
+test("CB3 race: a reissue while the launcher's live proof is in flight refuses the launch restart-required; nothing runs and no credential call is made", { skip, timeout: 120000 }, async (t) => {
+  const p = await boundCopy(t);
+  const { login, s } = await restarted(t, p);
+  let go, arrived;
+  const held = new Promise((r) => { arrived = r; });
+  const unrule = p.api.rule((e) => e.path === "/api/v1/token", async () => { unrule(); arrived(); await new Promise((r) => { go = r; }); return { pass: true }; });
+  const launching = threadLaunch(s, "raced");
+  await held;
+  await reissue(p, s, login, "t2");
+  go();
+  const event = await launching;
+  assert.equal(event.event, "refused", JSON.stringify(event));
+  assert.equal(event.code, "restart-required");
+  assert.equal(s.running("researcher").length, 0);
+  assert.equal(repoCalls(p), 0);
+});
+
+test("CB3 race: a reissue between the launcher's admission and bind refuses at bind; the spawned run is stopped and makes no credential call", { skip, timeout: 120000 }, async (t) => {
+  const p = await boundCopy(t);
+  let s, login, raced = 0;
+  ({ login, s } = await restarted(t, p, { beforeBind: async (r) => { if (r.role === "researcher" && raced++ === 0) await reissue(p, s, login, "t3"); } }));
+  const event = await threadLaunch(s, "bindrace");
+  assert.equal(raced, 1);
+  await until(() => s.running("researcher").length === 0);
+  assert.equal(repoCalls(p), 0);
+  const events = launchEvents(s).filter((e) => e.instance === "researcher");
+  // The launcher reports any bind refusal as launch-failed, naming the bus's code.
+  assert.equal(event.event, "refused", JSON.stringify(event));
+  assert.ok(events.some((e) => e.event === "refused" && e.why === "launch bind refused: restart-required"), JSON.stringify(events));
+  assert.ok(!events.some((e) => e.event === "launch"), JSON.stringify(events));
+});
+
+test("CB3 race: an organization file change between the launcher's admission and bind refuses at bind, even with the copy authority unchanged; the spawned run is stopped and makes no credential call", { skip, timeout: 120000 }, async (t) => {
+  const p = await boundCopy(t);
+  const file = join(p.root, "config", "businesses", "acme.json");
+  let s, raced = 0, authority = null;
+  // Same document, other bytes: the revision moves, the launch authority does not.
+  ({ s } = await restarted(t, p, { beforeBind: async (r) => {
+    if (r.role !== "researcher" || raced++ !== 0) return;
+    authority = r.copyAuthority;
+    writeFileSync(file, JSON.stringify(JSON.parse(readFileSync(file, "utf8"))) + "\n", { mode: 0o600 });
+  } }));
+  const event = await threadLaunch(s, "revrace");
+  assert.equal(raced, 1);
+  assert.match(authority, /^[0-9a-f]{64}$/);
+  await until(() => s.running("researcher").length === 0);
+  assert.equal(repoCalls(p), 0);
+  // The refusal was the revision's: on the file as it stands the same authority comes back.
+  const fresh = organizationWriter({ dir: join(p.root, "config"), rolesDir: p.f.roles }).read("acme").revision;
+  assert.equal((await s.runtime.copyLaunch({ business: "acme", instance: "researcher", revision: fresh })).authority, authority);
+  const events = launchEvents(s).filter((e) => e.instance === "researcher");
+  assert.equal(event.event, "refused", JSON.stringify(event));
+  assert.ok(events.some((e) => e.event === "refused" && e.why === "launch bind refused: organization-changed"), JSON.stringify(events));
+  assert.ok(!events.some((e) => e.event === "launch"), JSON.stringify(events));
+});

packages/cli/tests/org-repo-set.test.mjs

@@ -0,0 +1,91 @@
+// #1873 P1-6 and P1-7: `org project repo init --remote` sets and checks origin; `org project repo
+// set` changes the repository both ways. The remotes point at 127.0.0.1 port 1, which refuses at
+// once, so the check runs for real and answers "unreachable" without leaving the host.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { join, resolve } from 'node:path';
+import { tmpdir } from 'node:os';
+import { execFileSync, spawnSync } from 'node:child_process';
+const repo = resolve(import.meta.dirname, '../../..');
+const run = (env, ...args) => spawnSync(join(repo, 'scripts/mosaic'), args, { cwd: repo, env, encoding: 'utf8' });
+const git = (cwd, ...args) => execFileSync('git', ['-C', cwd, ...args], { env: { PATH: process.env.PATH, HOME: '/nonexistent', GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null' }, encoding: 'utf8' }).trim();
+
+test('org project repo init --remote and repo set: origin follows, the check is reported, refusals are plain', () => {
+  const home = mkdtempSync(join(tmpdir(), 'org-repo-')); const env = { ...process.env, HOME: home, MOSAIC_CONFIG: join(home, '.config/mosaic-orgtest/config.json') };
+  const boot = spawnSync(join(repo, 'scripts/bootstrap.sh'), ['--instance', 'orgtest'], { cwd: repo, env, encoding: 'utf8' }); assert.equal(boot.status, 0, boot.stderr);
+  const ok = (...args) => { const r = run(env, ...args); assert.equal(r.status, 0, r.stderr); return JSON.parse(r.stdout); };
+  const file = join(home, 'alpha.json');
+  run(env, 'org', 'template', 'render', 'alpha', '--fixture', 'local', '--output', file); ok('org', 'create', 'alpha', '--from', file);
+
+  const ssh = 'ssh://[email protected]:1/team/work.git';
+  const init = ok('org', 'project', 'repo', 'init', 'alpha', 'work', '--remote', ssh);
+  assert.equal(init.origin, ssh); assert.equal(init.check.result, 'unreachable'); assert.match(init.check.message, /port 1|refused/i);
+  assert.equal(git(init.root, 'remote', '-v'), `origin\t${ssh} (fetch)\norigin\t${ssh} (push)`);
+
+  // Usage errors come first and change nothing.
+  for (const args of [['--local-only', '--accept-local-loss-risk'], ['--remote', ssh, '--local-only', '--if-revision', '9'], ['--if-revision', '9'], ['--remote', ssh, '--if-revision', '0']]) {
+    const r = run(env, 'org', 'project', 'repo', 'set', 'alpha', 'work', ...args); assert.equal(r.status, 4, `${args}: ${r.stderr}`);
+  }
+  assert.equal(run(env, 'org', 'queue', 'set', 'alpha', '--local-only', '--accept-local-loss-risk', '--if-revision', '1').status, 4);
+  let rev = ok('org', 'show', 'alpha', '--json').revision;
+  for (const bad of ['ext::sh -c id', 'file:///etc', '/srv/repo', 'https://user:[email protected]:1/o/r', 'http://127.0.0.1:1/o/r']) {
+    const r = run(env, 'org', 'project', 'repo', 'set', 'alpha', 'work', '--remote', bad, '--if-revision', String(rev));
+    assert.equal(r.status, 2, bad); assert.match(r.stderr, /org-invalid/, bad);
+  }
+  const stale = run(env, 'org', 'project', 'repo', 'set', 'alpha', 'work', '--local-only', '--accept-local-loss-risk', '--if-revision', String(rev + 5));
+  assert.equal(stale.status, 2); assert.match(stale.stderr, /revision-conflict/);
+  assert.equal(git(init.root, 'remote', 'get-url', 'origin'), ssh);
+
+  const local = ok('org', 'project', 'repo', 'set', 'alpha', 'work', '--local-only', '--accept-local-loss-risk', '--if-revision', String(rev));
+  assert.equal(local.op, 'org.project.repo.set'); assert.equal(local.revision, rev + 1); assert.equal(local.origin, null); assert.equal(git(init.root, 'remote', '-v'), '');
+  rev = local.revision;
+  const https = 'https://127.0.0.1:1/team/work.git';
+  const back = ok('org', 'project', 'repo', 'set', 'alpha', 'work', '--remote', https, '--if-revision', String(rev), '--json');
+  assert.equal(back.revision, rev + 1); assert.equal(back.check.result, 'unreachable'); assert.match(back.check.message, /Failed to connect|Could not connect/);
+  assert.equal(git(init.root, 'remote', 'get-url', 'origin'), https);
+  assert.deepEqual(ok('org', 'project', 'repo', 'show', 'alpha', 'work', '--json').current, { mode: 'remote', remote: https, origin: https, revision: back.revision, check: back.check, changedAt: back.at });
+  assert.equal(back.check.url, https);
+
+  // The acceptance URL (#1873 P1-6): an .invalid host never resolves, so the check is unreachable
+  // and origin is still set to it.
+  const invalid = 'https://git.example.invalid/acme/work';
+  const named = ok('org', 'project', 'repo', 'set', 'alpha', 'work', '--remote', invalid, '--if-revision', String(back.revision), '--json');
+  assert.equal(named.origin, invalid); assert.equal(named.check.result, 'unreachable'); assert.equal(named.check.url, invalid);
+  assert.match(named.check.message, /resolve|timed out/i);
+  assert.equal(git(init.root, 'remote', '-v'), `origin\t${invalid} (fetch)\norigin\t${invalid} (push)`);
+});
+
+// #1873 F7: while a copy binding that names the project is approved or active, repo set is refused
+// with exit 2 and the next step; once the binding is unbound (revoked) the same set goes through.
+// The bindings are written into the document as the CB1 writer would leave them.
+test('org project repo set is refused under a copy binding that names the project, and allowed after revoke', () => {
+  const home = mkdtempSync(join(tmpdir(), 'org-repo-')); const env = { ...process.env, HOME: home, MOSAIC_CONFIG: join(home, '.config/mosaic-orgtest/config.json') };
+  const boot = spawnSync(join(repo, 'scripts/bootstrap.sh'), ['--instance', 'orgtest'], { cwd: repo, env, encoding: 'utf8' }); assert.equal(boot.status, 0, boot.stderr);
+  const ok = (...args) => { const r = run(env, ...args); assert.equal(r.status, 0, r.stderr); return JSON.parse(r.stdout); };
+  const file = join(home, 'alpha.json');
+  run(env, 'org', 'template', 'render', 'alpha', '--fixture', 'local', '--output', file); ok('org', 'create', 'alpha', '--from', file);
+  const init = ok('org', 'project', 'repo', 'init', 'alpha', 'work', '--local-only', '--accept-local-loss-risk');
+  const configDir = join(home, '.config/mosaic-orgtest');
+  const seed = (state) => {
+    const docFile = join(configDir, 'businesses/alpha.json'); const doc = JSON.parse(readFileSync(docFile, 'utf8'));
+    doc.copyBindings = { 'rev.work': { copyId: '1'.repeat(32), orgIncarnation: 'a'.repeat(32), source: { level: 'project', name: 'rev', project: 'work' },
+      definition: { ref: 'reviewer', rev: null, sha256: 'b'.repeat(64) }, generation: 1, state,
+      services: state === 'unbound' ? {} : { gitea: { slot: 'self', scopes: ['read:repository'], resources: { projects: ['work'] } } },
+      decision: '11111111-1111-4111-8111-111111111111' } };
+    const raw = JSON.stringify(doc, null, 2) + '\n'; writeFileSync(docFile, raw);
+    const regFile = join(configDir, 'org-runtime.json'); const reg = JSON.parse(readFileSync(regFile, 'utf8'));
+    reg.orgs.alpha.digest = createHash('sha256').update(raw).digest('hex'); writeFileSync(regFile, JSON.stringify(reg, null, 2) + '\n');
+  };
+  const invalid = 'https://git.example.invalid/acme/other';
+  seed('pending');
+  const rev = ok('org', 'show', 'alpha', '--json').revision;
+  const refused = run(env, 'org', 'project', 'repo', 'set', 'alpha', 'work', '--remote', invalid, '--if-revision', String(rev));
+  assert.equal(refused.status, 2, refused.stderr);
+  assert.match(refused.stderr, /project-repo-bound: project work is in a copy binding that still grants it: rev\.work \(approved, not yet verified\)\. Revoke that copy binding first/);
+  assert.equal(git(init.root, 'remote', '-v'), '');
+  seed('unbound');
+  const set = ok('org', 'project', 'repo', 'set', 'alpha', 'work', '--remote', invalid, '--if-revision', String(rev), '--json');
+  assert.equal(set.revision, rev + 1); assert.equal(git(init.root, 'remote', 'get-url', 'origin'), invalid);
+});

packages/organization/README.md

@@ -569,10 +569,45 @@ Initialize an organization checkout with `mosaic org queue init ID --local-only
 --accept-local-loss-risk` and a project repository with `mosaic org project repo
 init ID PROJECT --local-only --accept-local-loss-risk`. The explicit acceptance
 records that this machine may hold the only copy. Alternatively use `--remote
-https://HOST/OWNER/REPO` in place of both local-only flags. Both modes create a
-local repository and genesis commit; remote mode records the URL without a
-push. Existing paths are never overwritten. `mosaic org queue show ID --json`
-and `mosaic org project repo show ID PROJECT --json` read the receipts back.
+URL` in place of both local-only flags. Both modes create a local repository and
+genesis commit. Existing paths are never overwritten. `mosaic org queue show ID
+--json` and `mosaic org project repo show ID PROJECT --json` read the receipts
+back; the project form also reports the binding as it is now (`current`).
+
+Remote mode (#1873 P1-6) accepts `https://HOST/OWNER/REPO` and ssh
+(`ssh://[USER@]HOST[:PORT]/PATH` or `USER@HOST:PATH`) only. It refuses
+`ext::` and other transport helpers, `file://`, local paths, values that begin
+with `-`, any URL that carries a password or token, and any https URL that
+carries a user name (`src/vocabulary.mjs` `parseRepoRemote`). The checkout's `origin` is set to the
+URL and checked once with `git ls-remote` (`src/repo-remote.mjs`): no
+credential helper, no askpass, no terminal prompt, no redirects,
+`GIT_ALLOW_PROTOCOL=https:ssh`, no git or ssh config files, no ssh agent or key,
+and a 15 second limit. The receipt's `check.result` is `reachable`,
+`needs-credential` (the check sends none) or `unreachable` with git's error
+summarized. The ssh check accepts any host key, so an ssh answer shows only that
+something at that address speaks git; its message adds "the ssh host key was not
+verified". `check.url` names the URL it ran against, and `repo show` reports a
+check only for the URL recorded now. The check never refuses the setup, and
+nothing is pushed. A copy credential binding (CB lanes) supplies credentials
+for https Gitea remotes only; an ssh or other https remote that needs a
+credential gets none from it. Tests reach a local bare repository only through `repoRemoteTestSeam`,
+which no source module may import.
+
+`mosaic org project repo set ID PROJECT (--local-only --accept-local-loss-risk |
+--remote URL) --if-revision N [--json]` (#1873 P1-7) changes an initialized
+project's repository: a new URL, or remote to local only and back. It runs the
+same URL rules and check, sets or removes `origin`, records the binding in the
+organization file's `projects.PROJECT.git`, and writes an
+`org.project.repo.set` receipt. A stale `--if-revision` is `revision-conflict`.
+While a copy binding that names the project is approved (`pending`) or active
+(`bound`), repo set is refused with `project-repo-bound`, before any check or
+change to `origin`, even for the URL already recorded: the binding grants the
+repositories its projects name at credential issue, and its decision records
+only project names (#1873 F7). The message names the copies. Revoke the copy
+binding first (the chief raises an unbind decision and the owner approves it),
+then set the repository, then ask the chief to raise a new binding decision. An
+`unbound` binding, or none, does not refuse. A binding decision raised but not
+yet approved is not read here.
 Queue review transports and transitions are not provided by this setup.
 
 The local development owner is accepted only through the existing named-instance

packages/organization/src/agent-copies.mjs

@@ -115,11 +115,41 @@ export function materializeCopies({ orgId, doc, root, rolesDir }) {
 export function copiesView(copies) {
   return Object.fromEntries(Object.entries(copies ?? {}).map(([instance, c]) => [instance, {
     name: c.name, level: c.level, project: c.project, definition: c.definition, state: c.state,
-    ...(c.missing ? { missing: [...c.missing] } : {}), ...(c.reason ? { reason: c.reason } : {}),
+    ...(c.missing ? { missing: [...c.missing] } : {}), ...(c.bound ? { bound: [...c.bound] } : {}), ...(c.reason ? { reason: c.reason } : {}),
     ...(c.claims ? { claims: c.claims.map(({ name, project }) => ({ name, project })) } : {}),
   }]));
 }
 
+// #1873 CB3: the services a copy may have bound for it, through the store the bus checks at boot
+// and on every launch. Nothing else is bound for a copy (a tracker bot isn't).
+export const COPY_BINDABLE = Object.freeze(["gitea"]);
+
+// #1873 CB3: the snapshot with the copies the bus verified at boot made instances. `bound` is
+// { instance: [services] }, from copy-launch.mjs's boot check. A copy is promoted only when it is
+// unbound and its verified services are exactly the ones it misses, every one bindable: a partial
+// binding never joins, and an extra service is no promotion either. A promoted copy is
+// { ...copy, state: "instance", bound: [services] } with no `missing`. Anything else is unchanged.
+export function promoteCopies(snapshot, bound = {}) {
+  if (!snapshot) return snapshot;
+  const copies = { ...snapshot.copies };
+  for (const [instance, services] of Object.entries(bound ?? {})) {
+    const copy = Object.hasOwn(copies, instance) ? copies[instance] : null;
+    if (copy?.state !== "unbound" || !Array.isArray(services)) continue;
+    const want = [...copy.missing].sort();
+    const got = [...new Set(services)].sort();
+    if (want.length === 0 || want.join(",") !== got.join(",") || !want.every((s) => COPY_BINDABLE.includes(s))) continue;
+    const { missing: _, ...rest } = copy;
+    copies[instance] = { ...rest, state: "instance", bound: want };
+  }
+  return deepFreeze({ ...snapshot, copies });
+}
+
+// A stand-in date for a promoted copy's credential reference. The reference exists only so the
+// organization's own checks see the services the role needs; withCopies takes it out again, so no
+// path, date or file of it reaches the business. The copy's real date is its binding's rotateBy,
+// which copy-launch.mjs checks.
+const BOUND_PLACEHOLDER = "2999-12-31";
+
 // Every string the document or the copy holds as a var or a credential reference, longest first.
 function valuesOf(document, copy) {
   const out = new Set();
@@ -236,7 +266,8 @@ export function withCopies(document, file, { rolesDir, snapshot, dataRoot = null
     if (copy.state !== "instance") continue;
     const refused = copy.project === null ? null : projectCopyRefusal(copy, document, levels);
     if (refused) { view[instance] = { ...view[instance], state: "refused", reason: refused }; continue; }
-    const entry = entryOf(copy, copy.project === null && narrows[copy.name] ? narrowVars("root", copy.vars, narrows[copy.name]) : copy.vars);
+    const base = entryOf(copy, copy.project === null && narrows[copy.name] ? narrowVars("root", copy.vars, narrows[copy.name]) : copy.vars);
+    const entry = copy.bound?.length ? { ...base, credentials: Object.fromEntries(copy.bound.map((s) => [s, { store: true, rotateBy: BOUND_PLACEHOLDER }])) } : base;
     try {
       validateBusinessDocument({ ...narrowed, roles: { ...roles, [instance]: entry } }, file, { rolesDir, dataRoot });
       join[instance] = entry;
@@ -246,7 +277,15 @@ export function withCopies(document, file, { rolesDir, snapshot, dataRoot = null
     }
   }
   const business = validateBusinessDocument({ ...narrowed, roles: { ...roles, ...join } }, file, { rolesDir, dataRoot });
-  return deepFreeze({ ...business, ...(Object.keys(copies).length ? { copies: view } : {}), unions });
+  // #1873 CB3: a bound copy keeps no credential reference. Its token is read from the bus's copy
+  // store only for one checked call (copy-launch.mjs), so no path, store file or token goes to a
+  // launch, a sandbox or the bus's Credentials. `copyBound` names the services, never a value.
+  const out = { ...business, roles: { ...business.roles } };
+  for (const [instance, copy] of Object.entries(copies)) {
+    if (!copy.bound?.length || !Object.hasOwn(join, instance) || !Object.hasOwn(out.roles, instance)) continue;
+    out.roles[instance] = { ...out.roles[instance], credentials: {}, copyBound: [...copy.bound] };
+  }
+  return deepFreeze({ ...out, ...(Object.keys(copies).length ? { copies: view } : {}), unions });
 }
 
 // The organization with its copies, as a bus or launcher loads it. The plain load keeps
@@ -286,6 +325,9 @@ export function copyRefusal(business, instance) {
   if(business.roles?.[instance]?.unbound?.length)return {code:"credential-unbound",message:`${instance} has no binding for ${business.roles[instance].unbound.join(", ")}`};
   const copy = copyOf(business, instance);
   if (!copy || copy.state === "instance") return null;
+  // #1873 CB3: a copy whose binding was approved after the bus started waits for a restart. The bus
+  // answers restart-required for it at instance.launch and thread.create (copy-launch.mjs), before a
+  // launch reaches the launcher, so this view's credential-unbound is only its last word.
   if (copy.state === "unbound") {
     return { code: "credential-unbound", message: `${instance} has no binding in ${business.id} for ${copy.missing.join(", ")}` };
   }

packages/organization/src/org-registry.mjs

@@ -63,6 +63,23 @@ export function orgIncarnation(registry, id) {
   const value = registry?.orgs && Object.hasOwn(registry.orgs, id) ? registry.orgs[id]?.incarnation : undefined;
   return typeof value === 'string' && INCARNATION.test(value) ? value : null;
 }
+// #1873 CB3: one organization's registry entry read now, without the registry lock (the writer
+// publishes by rename, so a read sees one whole file). For the copy launch gate, which checks the
+// entry on every admission and use. null when no registry or no such entry; throws when unsafe.
+export function readOrgEntrySync(configDir, id) {
+  const file = join(configDir, 'org-runtime.json');
+  let dir; try { dir = lstatSync(configDir); } catch (e) { throw quiet(e, CONFIG); }
+  if (!dir.isDirectory() || dir.isSymbolicLink() || dir.uid !== process.getuid() || (dir.mode & 0o077)) fail('org-mismatch', 'unsafe private directory', configDir);
+  let fd;
+  try { fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK); }
+  catch (e) { if (e.code === 'ENOENT') return null; throw quiet(e, 'the registry file'); }
+  try {
+    const st = fstatSync(fd);
+    if (!st.isFile() || st.uid !== process.getuid() || (st.mode & 0o777) !== 0o600) fail('org-mismatch', 'unsafe metadata file', file);
+    const registry = validateRegistry(parseJsonFileText(readFileSync(fd, 'utf8'), file, 'registry file'), file);
+    return Object.hasOwn(registry.orgs, id) ? { state: registry.orgs[id].state, incarnation: orgIncarnation(registry, id) } : null;
+  } finally { closeSync(fd); }
+}
 export async function readRegistry({ configDir }) {
   await safeDir(configDir, false, CONFIG); await privateDir(configDir, CONFIG); const file = join(configDir, 'org-runtime.json'); let doc;
   try { doc = await readPrivate(file); } catch (e) { if (e.code === 'ENOENT') return null; if (e instanceof OrgError) throw e; fail('org-mismatch', `invalid registry: ${e instanceof SyntaxError ? e.message : quiet(e, 'registry file').message}`); }

packages/organization/src/org-service.mjs

@@ -4,7 +4,8 @@ import { spawn } from 'node:child_process';
 import { createHash, randomBytes } from 'node:crypto';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { validateBusinessDocument, httpsUrl } from './organization-config.mjs';
+import { validateBusinessDocument } from './organization-config.mjs';
+import { checkRemote, parseRepoRemote, projectBindings, REPO_BOUND, repoBoundMessage } from './repo-remote.mjs';
 import { ID_PATTERN } from './vocabulary.mjs';
 import { OrgError, orgRoot, quiet, readRegistry, reserveOrg, resolveOrg, withRegistry, withOrgLifecycle } from './org-registry.mjs';
 import { loadInstalled } from '../../plugins/src/loader.mjs';
@@ -198,7 +199,8 @@ export async function updateOrg(ctx, id, input, { ifRevision } = {}) {
 }
 function options({ mode, remote, acceptLocalLossRisk }) {
   if (mode === 'local-only') { if (acceptLocalLossRisk !== true || remote !== undefined) fail('org-risk', 'local-only requires explicit loss-risk acceptance and no remote'); return { mode, riskAccepted: true }; }
-  if (mode === 'remote') { if (acceptLocalLossRisk || typeof remote !== 'string') fail('org-invalid', 'remote mode requires a remote URL'); try { httpsUrl(remote, 'remote', { repo: true }); } catch (e) { fail('org-invalid', e.message); } return { mode, remote }; }
+  // #1873 P1-6: https or ssh, and nothing that git could read as an option, a helper or a path.
+  if (mode === 'remote') { if (acceptLocalLossRisk || typeof remote !== 'string') fail('org-invalid', 'remote mode requires a remote URL'); const parsed = parseRepoRemote(remote); if (!parsed.ok) fail('org-invalid', parsed.message, '$.remote'); return { mode, remote: parsed.url }; }
   fail('org-invalid', 'select local-only or remote');
 }
 async function git(root, args) {
@@ -206,8 +208,23 @@ async function git(root, args) {
   return new Promise((resolve, reject) => { const p = spawn('git', ['-c', 'user.name=Mosaic Local', '-c', '[email protected]', '-c', 'core.hooksPath=/dev/null', '-C', root, ...args], { env, stdio: ['ignore', 'pipe', 'pipe'] }); let out = '', err = ''; p.stdout.on('data', d => out += d); p.stderr.on('data', d => err += d); p.on('error', reject); p.on('close', code => code === 0 ? resolve(out.trim()) : reject(new OrgError('org-git', `git ${args[0]} failed (exit ${code})`))); });
 }
 async function initGit(root) { await fs.mkdir(root, { mode: 0o700 }); await git(root, ['init', '--quiet', '--template=']); await git(root, ['commit', '--quiet', '--allow-empty', '-m', 'Genesis']); return git(root, ['rev-parse', 'HEAD']); }
+// The checkout's origin, or null when it has none.
+async function originOf(root) { try { return await git(root, ['config', '--get', 'remote.origin.url']); } catch (e) { if (e?.code === 'org-git') return null; throw e; } }
+// #1873 P1-6: point origin at the remote (or remove it for local-only). Never pushes or fetches.
+async function setOrigin(root, selection) {
+  const origin = await originOf(root);
+  if (selection.mode === 'remote') { if (origin === null) await git(root, ['remote', 'add', 'origin', selection.remote]); else if (origin !== selection.remote) await git(root, ['remote', 'set-url', 'origin', selection.remote]); }
+  else if (origin !== null) await git(root, ['remote', 'remove', 'origin']);
+  return originOf(root);
+}
+// The check names the URL it ran against, so a reader can tell a check of an earlier URL from one of
+// the URL recorded now (#1873 P1-7 review).
+const checkFields = (check) => check ? { check: { result: check.result, message: check.message, url: check.url } } : {};
 async function setup(ctx, id, project, opts) {
   authorize(ctx); const selection = options(opts); if (project !== null) checkId(project);
+  // The check talks to the network, so it runs before any lock is taken. Its result is reported,
+  // never a refusal: a repository that needs a credential is the usual case before binding.
+  const check = selection.mode === 'remote' ? await checkRemote(selection.remote) : null;
   return withOrgLifecycle(ctx, id, async () => {
     const current = await withRegistry(ctx, async () => {
       const current = await readCurrentUnlocked(ctx, id); if (project !== null && !Object.hasOwn(current.doc.projects, project)) fail('org-unknown', 'unknown project');
@@ -217,7 +234,7 @@ async function setup(ctx, id, project, opts) {
     }, { write: false });
     const parent = project === null ? current.root : join(current.root, 'projects'); if (project !== null) await ensurePrivateDir(parent);
     const root = project === null ? join(current.root, 'checkout') : projectPath(current.root, project);
-    const commit = await initGit(root); const fields = { ...selection, root, commit, ...(project === null ? {} : { project }) };
+    const commit = await initGit(root); const origin = await setOrigin(root, selection); const fields = { ...selection, root, commit, ...(project === null ? {} : { project }), origin, ...checkFields(check) };
     return withRegistry(ctx, async registry => {
       const latest = await readCurrentUnlocked(ctx, id);
       if (latest.revision !== current.revision) fail('revision-conflict', 'organization changed during setup; inspect the initialized repository before retrying');
@@ -236,7 +253,49 @@ async function showSetup(ctx, id, project) {
   if (!item || item.root !== root || !same(item.subject, current.principal)) fail('org-unavailable', 'setup receipt unavailable');
   if (project !== null) { const parent = await fs.lstat(join(current.root, 'projects')); if (!parent.isDirectory() || parent.isSymbolicLink() || parent.uid !== process.getuid() || (parent.mode & 0o077)) fail('org-mismatch', 'unsafe projects directory'); }
   const st = await fs.lstat(root); const dotgit = await fs.lstat(join(root, '.git')); if (!st.isDirectory() || st.isSymbolicLink() || !dotgit.isDirectory() || dotgit.isSymbolicLink()) fail('org-mismatch', 'unsafe git repository');
-  await git(root, ['rev-parse', '--verify', 'HEAD']); return item;
+  await git(root, ['rev-parse', '--verify', 'HEAD']);
+  if (project === null) return item;
+  // #1873 P1-7: the binding as it is now, which a later repo set may have changed since init.
+  const binding = current.doc.projects[project].git ?? { mode: item.mode, ...(item.remote ? { remote: item.remote } : {}) };
+  const last = records.findLast(r => r.op === 'org.project.repo.set' && r.project === project && same(r.subject, current.principal)) ?? null;
+  // The last check is reported only when it ran against the URL recorded now: a set whose receipt
+  // did not land must not lend its check to another URL.
+  const check = binding.mode === 'remote' ? (last ?? item).check : undefined;
+  return { ...item, current: { mode: binding.mode, ...(binding.mode === 'remote' ? { remote: binding.remote } : {}), origin: await originOf(root), revision: current.revision, ...(check && check.url === binding.remote ? { check } : {}), ...(last ? { changedAt: last.at } : {}) } };
+}
+// #1873 P1-7: change an initialized project's repository between remote and local-only, or to a
+// new URL. The same URL rules and check as init; origin follows; nothing is pushed. A receipt
+// records it. Setting the same URL again re-runs the check and repairs origin.
+export async function projectRepoSet(ctx, id, project, opts = {}) {
+  authorize(ctx); checkId(id); checkId(project); const selection = options(opts); const { ifRevision } = opts;
+  if (!Number.isSafeInteger(ifRevision)) fail('org-invalid', 'repo set needs --if-revision');
+  // Fail fast on the cheap checks before the network check, then again under the lock.
+  await projectRepoShow(ctx, id, project).then(r => { if (r.current.revision !== ifRevision) fail('revision-conflict', 'organization revision changed'); });
+  // #1873 F7: never under a copy binding that still grants this project; checked again under the lock.
+  const refuseBound = doc => { const bound = projectBindings(doc, project); if (bound.length) fail(REPO_BOUND, repoBoundMessage(project, bound)); };
+  refuseBound((await readCurrent(ctx, id)).doc);
+  const check = selection.mode === 'remote' ? await checkRemote(selection.remote) : null;
+  return withOrgLifecycle(ctx, id, () => withRegistry(ctx, async registry => {
+    const latest = await readCurrentUnlocked(ctx, id); if (!Object.hasOwn(latest.doc.projects, project)) fail('org-unknown', 'unknown project');
+    if (latest.revision !== ifRevision) fail('revision-conflict', 'organization revision changed');
+    refuseBound(latest.doc);
+    const root = projectPath(latest.root, project);
+    const init = (await receipts(latest.root)).findLast(r => r.op === 'org.project.repo.init' && r.project === project);
+    if (!init || init.root !== root || !same(init.subject, latest.principal)) fail('org-unavailable', 'setup receipt unavailable');
+    const st = await fs.lstat(root); const dotgit = await fs.lstat(join(root, '.git')); if (!st.isDirectory() || st.isSymbolicLink() || !dotgit.isDirectory() || dotgit.isSymbolicLink()) fail('org-mismatch', 'unsafe git repository');
+    const previous = latest.doc.projects[project].git ?? { mode: init.mode, ...(init.remote ? { remote: init.remote } : {}) };
+    const next = selection.mode === 'remote' ? { mode: 'remote', remote: selection.remote } : { mode: 'local-only' };
+    // origin first: a failure after it leaves the recorded binding as it was, and repeating the
+    // same set repairs origin.
+    const origin = await setOrigin(root, selection);
+    let revision = latest.revision;
+    if (canonicalJson(previous) !== canonicalJson(next)) {
+      if (!Number.isSafeInteger(revision + 1)) fail('org-mismatch', 'organization revision cannot be incremented');
+      latest.doc.projects[project].git = next; await checked(latest.doc); const raw = encode(latest.doc);
+      await atomic(join(ctx.configDir, 'businesses', `${id}.json`), raw); registry.orgs[id].digest = digest(raw); registry.orgs[id].revision = revision = latest.revision + 1;
+    }
+    return receipt(latest.root, 'org.project.repo.set', id, ctx.principal, { ...selection, root, project, previous, revision, origin, ...checkFields(check) });
+  }));
 }
 export async function queueShow(ctx, id) { return showSetup(ctx, id, null); }
 export async function projectRepoShow(ctx, id, project) { return showSetup(ctx, id, project); }

packages/organization/src/organization-config.mjs

@@ -12,7 +12,7 @@ import { checkVars } from "./vars.mjs";
 import { parseCredentialRef } from "./credentials.mjs";
 import { loadRole } from "./role.mjs";
 import { checkDefinitions, checkDefinitionName, orgDefinitionName, ORG_PREFIX } from "./definitions.mjs";
-import { END_PROTECTED } from "./vocabulary.mjs";
+import { END_PROTECTED, parseRepoRemote } from "./vocabulary.mjs";
 import { checkPlugins, checkUsageSettings } from "../../plugins/src/kinds.mjs";
 import { hasModule } from "../../plugins/src/loader.mjs";
 import { readPluginLock } from "../../plugins/src/pinned.mjs";
@@ -320,7 +320,9 @@ export function validateOrganizationDocument(document, file, { rolesDir, dataRoo
       requireObject(entry.git, `${file} projects.${id}.git`);
       rejectUnknownKeys(entry.git, ["mode", "remote"], `${file} projects.${id}.git`);
       if (!['local-only', 'remote'].includes(entry.git.mode)) refuse(`${file} projects.${id}.git.mode must be local-only or remote`);
-      if (entry.git.mode === 'remote') httpsUrl(entry.git.remote, `${file} projects.${id}.git.remote`, { repo: true });
+      // #1873 P1-6: the checkout's origin may be https or ssh (repo-remote.mjs's rules). The Row 199
+      // upstream, projects.<p>.remote, stays https only.
+      if (entry.git.mode === 'remote') { const remote = parseRepoRemote(entry.git.remote); if (!remote.ok) refuse(`${file} projects.${id}.git.remote: ${remote.message}`); }
       else if (Object.hasOwn(entry.git, 'remote')) refuse(`${file} projects.${id}.git.remote is not allowed for local-only`);
     }
     projects[id] = { root: entry.root, ...(Object.hasOwn(entry, "repo") ? { repo: entry.repo } : {}),

packages/organization/src/repo-remote.mjs

@@ -0,0 +1,132 @@
+// #1873 P1-6 and P1-7: the project repository's remote URL, and the one check it gets.
+//
+// parseRepoRemote decides which URLs may become a checkout's origin: https (the Gitea form the
+// loader already uses) and ssh, nothing else. checkRemote runs `git ls-remote` against that URL with
+// no credential of any kind and a hard timeout, and says plainly whether the repository answered,
+// wants a credential, or could not be reached. Nothing here pushes, fetches objects or writes.
+import { spawn } from 'node:child_process';
+import { parseRepoRemote } from './vocabulary.mjs';
+import { BINDING_STATES } from './copy-bindings.mjs';
+
+export { parseRepoRemote };
+
+// The ssh client for the check: no user or system config file, no agent, no key, no password, no
+// proxy or jump host, no multiplexing, no forwarding, no local command, and an unknown host key is
+// accepted for this one connection without being remembered (nothing secret is sent to it).
+export const CHECK_SSH_COMMAND = [
+  'ssh', '-F', '/dev/null',
+  ...['BatchMode=yes', 'ConnectTimeout=5', 'StrictHostKeyChecking=no', 'UserKnownHostsFile=/dev/null',
+    'GlobalKnownHostsFile=/dev/null', 'LogLevel=ERROR', 'IdentityFile=none', 'IdentitiesOnly=yes',
+    'IdentityAgent=none', 'PasswordAuthentication=no', 'KbdInteractiveAuthentication=no',
+    'HostbasedAuthentication=no', 'GSSAPIAuthentication=no', 'ProxyCommand=none', 'ProxyJump=none',
+    'ControlMaster=no', 'ControlPath=none', 'PermitLocalCommand=no', 'ForwardAgent=no',
+    'ClearAllForwardings=yes'].flatMap((o) => ['-o', o]),
+].join(' ');
+
+const PRODUCTION = Object.freeze({ protocols: 'https:ssh', timeoutMs: 15000 });
+const OUTPUT_CAP = 64 * 1024;
+
+// git's own message for "this needs a credential": a prompt it could not show, a 401 or 403, or
+// ssh refusing every (absent) key.
+const NEEDS_CREDENTIAL = [
+  /terminal prompts disabled/i, /could not read (username|password)/i, /authentication failed/i,
+  /returned error: 40[13]\b/, /permission denied \(/i,
+];
+
+// One plain line from git's stderr: the first line that says what went wrong, without "fatal: ",
+// control characters or more than 200 characters.
+// Plain and true for every remote: the check itself sends none. Whether a credential binding can
+// supply one later depends on the remote (copy bindings cover https Gitea remotes only), so this line
+// does not promise it.
+export const NEEDS_CREDENTIAL_MESSAGE = 'the repository needs a credential; this check uses none';
+
+export function summarizeGitError(stderr) {
+  const lines = String(stderr).split('\n').map((l) => l.replace(/[\0-\x1f\x7f]/g, '').trim()).filter(Boolean);
+  const line = lines.find((l) => /^(fatal|ssh|error):/i.test(l)) ?? lines[0] ?? '';
+  const text = line.replace(/^(fatal|error):\s*/i, '');
+  return text.length > 200 ? `${text.slice(0, 199)}…` : text || 'git gave no reason';
+}
+
+export function classifyCheck({ code, timedOut, spawnError, stderr }) {
+  if (spawnError) return { result: 'unreachable', message: 'git could not be started' };
+  if (timedOut) return { result: 'unreachable', message: 'no answer before the check timed out' };
+  if (code === 0) return { result: 'reachable', message: 'the repository answered' };
+  if (NEEDS_CREDENTIAL.some((p) => p.test(stderr))) return { result: 'needs-credential', message: NEEDS_CREDENTIAL_MESSAGE };
+  return { result: 'unreachable', message: summarizeGitError(stderr) };
+}
+
+function lsRemote(url, { protocols, timeoutMs }) {
+  const env = {
+    PATH: process.env.PATH ?? '/usr/bin:/bin', HOME: '/nonexistent', LC_ALL: 'C',
+    GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null', GIT_CEILING_DIRECTORIES: '/',
+    GIT_TERMINAL_PROMPT: '0', GIT_ALLOW_PROTOCOL: protocols,
+    GIT_SSH_COMMAND: CHECK_SSH_COMMAND, GIT_SSH_VARIANT: 'ssh', GIT_PROTOCOL_FROM_USER: '0',
+  };
+  const args = [
+    '-c', 'credential.helper=', '-c', 'core.askPass=', '-c', 'http.followRedirects=false',
+    '-c', 'protocol.allow=never', ...protocols.split(':').flatMap((p) => ['-c', `protocol.${p}.allow=always`]),
+    'ls-remote', '--', url, 'HEAD',
+  ];
+  return new Promise((resolve) => {
+    let child;
+    try { child = spawn('git', args, { cwd: '/', env, stdio: ['ignore', 'pipe', 'pipe'], detached: true }); }
+    catch { resolve(classifyCheck({ spawnError: true })); return; }
+    let stderr = '', timedOut = false, done = false;
+    const kill = () => { try { process.kill(-child.pid, 'SIGKILL'); } catch { /* already gone */ } };
+    const timer = setTimeout(() => { timedOut = true; kill(); }, timeoutMs);
+    child.stdout.on('data', () => {});
+    child.stderr.on('data', (d) => { if (stderr.length < OUTPUT_CAP) stderr += d; });
+    const finish = (outcome) => { if (done) return; done = true; clearTimeout(timer); kill(); resolve(classifyCheck({ ...outcome, timedOut, stderr })); };
+    child.on('error', () => finish({ spawnError: true }));
+    child.on('close', (code) => finish({ code }));
+  });
+}
+
+let override = null;
+
+// The ssh check accepts any host key (nothing secret is sent to it), so an answer over ssh shows
+// that something at that address speaks git, not that it is the named host. Every ssh outcome that
+// came from an answer says so; https verifies the host's certificate as usual.
+export const SSH_HOST_UNVERIFIED = 'the ssh host key was not verified';
+
+// The check for a URL parseRepoRemote accepted: https and ssh only, 15 second limit. Returns
+// {result: 'reachable'|'needs-credential'|'unreachable', message, url}. A URL that does not parse
+// is refused by the caller first; here it is reported unreachable without running git.
+export async function checkRemote(url) {
+  const parsed = parseRepoRemote(url);
+  if (!parsed.ok) return { result: 'unreachable', message: parsed.message, url };
+  const outcome = override ? await override(parsed.url) : await lsRemote(parsed.url, PRODUCTION);
+  const message = parsed.kind === 'ssh' && outcome.result !== 'unreachable' ? `${outcome.message}; ${SSH_HOST_UNVERIFIED}` : outcome.message;
+  return { result: outcome.result, message, url: parsed.url };
+}
+
+// #1873 F7: a copy binding grants the repositories its projects' remotes name when a credential is
+// issued (bus copy-grant boundRepositories), and the decision records only project names. So a
+// project's repository does not change under a binding that still grants. These are the copies
+// whose binding names `project` and still grants: `pending` (approved, not yet verified) and
+// `bound` (active). The `unbound` tombstone an unbind leaves grants nothing and holds no services.
+// `doc` is the organization document as the loader validated it (copy-bindings.mjs schema).
+export const REPO_BOUND = 'project-repo-bound';
+const GRANTING = BINDING_STATES.filter((s) => s !== 'unbound');
+export function projectBindings(doc, project) {
+  const out = [];
+  for (const [instance, record] of Object.entries(doc?.copyBindings ?? {})) {
+    if (!GRANTING.includes(record?.state)) continue;
+    const names = record.source?.project === project
+      || Object.values(record.services ?? {}).some((v) => v?.resources?.projects?.includes(project));
+    if (names) out.push({ instance, state: record.state });
+  }
+  return out.sort((a, b) => (a.instance < b.instance ? -1 : a.instance > b.instance ? 1 : 0));
+}
+export function repoBoundMessage(project, bindings) {
+  const list = bindings.map((b) => `${b.instance} (${b.state === 'bound' ? 'active' : 'approved, not yet verified'})`).join(', ');
+  return `project ${project} is in a copy binding that still grants it: ${list}. Revoke that copy binding first (the chief raises an unbind decision and the owner approves it), then set the repository, then ask the chief to raise a new binding decision`;
+}
+
+// TEST SEAM. Tests reach a local bare repository through this and nothing else: lsRemote with a
+// widened protocol list, and a stand-in for checkRemote's git call. No module under packages/*/src
+// may import or name it; tests/repo-remote.test.mjs enforces that by scanning the sources.
+export const repoRemoteTestSeam = Object.freeze({
+  lsRemote: (url, { protocols, timeoutMs = 5000 }) => lsRemote(url, { protocols, timeoutMs }),
+  useCheck(fn) { override = typeof fn === 'function' ? fn : null; },
+});

packages/organization/src/vocabulary.mjs

@@ -236,6 +236,62 @@ export function parseGiteaUrl(value, { repo = false } = {}) {
   return { url, owner: segments[0], repo: name };
 }
 
+// #1873 P1-6: a project repository's remote, https or ssh. It lives here, beside parseGiteaUrl,
+// because the loader validates projects.<p>.git.remote with it and this file imports nothing.
+const REPO_REMOTE_MAX = 512;
+// A host name or IPv4 address: labels of letters, digits and "-", starting with a letter or digit.
+const REMOTE_HOST = '[A-Za-z0-9](?:[A-Za-z0-9-]{0,62})(?:\\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,62}))*';
+// A login name. It never starts with "-" so ssh can't read it as an option.
+const REMOTE_USER = '[A-Za-z0-9_][A-Za-z0-9_.-]{0,63}';
+// Path segments: letters, digits, "_", ".", "-" and "~", never starting with "-", never "." or "..".
+const REMOTE_SEGMENT = '[A-Za-z0-9_.~][A-Za-z0-9_.~-]{0,99}';
+const REMOTE_SSH_URL = new RegExp(`^ssh://(?:(${REMOTE_USER})@)?(${REMOTE_HOST})(?::([0-9]{1,5}))?(/${REMOTE_SEGMENT}(?:/${REMOTE_SEGMENT})*)$`);
+const REMOTE_SCP_LIKE = new RegExp(`^(${REMOTE_USER})@(${REMOTE_HOST}):(/?${REMOTE_SEGMENT}(?:/${REMOTE_SEGMENT})*)$`);
+
+const REMOTE_PROBLEMS = Object.freeze({
+  form: 'the repository URL must be an https or ssh URL',
+  option: 'the repository URL must not start with "-"',
+  transport: 'the repository URL must not name a git transport helper (such as ext::)',
+  local: 'the repository URL must not be a local path or a file:// URL',
+  scheme: 'the repository URL must use https or ssh',
+  credentials: 'the repository URL must not carry a password or token, or a user name in an https URL; a URL never holds a credential',
+  https: 'an https repository URL must be normalized and name a repository, https://HOST/OWNER/REPO',
+  ssh: 'an ssh repository URL must be ssh://[USER@]HOST[:PORT]/PATH or USER@HOST:PATH, with no "." or ".." segment',
+});
+
+// Returns {ok: true, kind: 'https'|'ssh', url} or {ok: false, problem, message}. The URL that is
+// checked and stored is exactly the value given; nothing is rewritten.
+export function parseRepoRemote(value) {
+  const no = (problem) => ({ ok: false, problem, message: REMOTE_PROBLEMS[problem] });
+  if (typeof value !== 'string' || value.length === 0 || value.length > REPO_REMOTE_MAX) return no('form');
+  if (value.startsWith('-')) return no('option');
+  if (value.includes('::')) return no('transport');
+  if (/[\s\0-\x1f\x7f]/.test(value)) return no('form');
+  if (/^file:/i.test(value) || /^[/.~\\]/.test(value)) return no('local');
+  const scheme = /^([A-Za-z][A-Za-z0-9+.-]*):\/\//.exec(value)?.[1]?.toLowerCase();
+  if (scheme === 'https') {
+    let url = null;
+    try { url = new URL(value); } catch { return no('https'); }
+    if (url.username || url.password) return no('credentials');
+    return parseGiteaUrl(value, { repo: true }).url ? { ok: true, kind: 'https', url: value } : no('https');
+  }
+  if (scheme === 'ssh') {
+    if (/^ssh:\/\/[^/@]*:[^/@]*@/.test(value)) return no('credentials');
+    const m = REMOTE_SSH_URL.exec(value);
+    if (!m || remoteDotSegment(m[4]) || (m[3] !== undefined && !(Number(m[3]) >= 1 && Number(m[3]) <= 65535 && !m[3].startsWith('0')))) return no('ssh');
+    return { ok: true, kind: 'ssh', url: value };
+  }
+  if (scheme !== undefined) return no('scheme');
+  // No "scheme://": git reads HOST:PATH as ssh only when the colon comes before any slash.
+  const colon = value.indexOf(':'), slash = value.indexOf('/');
+  if (colon < 0 || (slash >= 0 && slash < colon)) return no('local');
+  if (/^[^@]*:[^@]*@/.test(value)) return no('credentials');
+  const m = REMOTE_SCP_LIKE.exec(value);
+  if (!m || remoteDotSegment(m[3])) return no('ssh');
+  return { ok: true, kind: 'ssh', url: value };
+}
+const remoteDotSegment = (path) => path.split('/').some((s) => s === '.' || s === '..');
+
 // Design D9 step 2: the agent's fork of an upstream, https://HOST[:PORT]/<user>/REPO, or null for an
 // upstream that doesn't parse. The owner is always the agent's own Gitea user; nothing else names it.
 // URL.host drops a default port, so 443 counts the same on both sides.

packages/organization/tests/agent-copies.test.mjs

@@ -327,3 +327,34 @@ test("A3: a project narrowing a root copy narrows that copy; an organization wit
   assert.deepEqual(plain.roles.coder.vars["limits.tools"], ["read"]);
   assert.equal(Object.hasOwn(plain, "copies"), false);
 });
+
+// #1873 CB3: a copy the bus verified at boot joins as an instance with no credential reference, only
+// the services it was bound for; a partial or extra binding never promotes.
+test("CB3: a verified copy joins with copyBound and no reference; a partial or extra binding stays unbound", async () => {
+  const { promoteCopies } = await import("../src/agent-copies.mjs");
+  const dir = tmp();
+  const doc = org(dir, "acme");
+  const r = root({ researcher: { definition: "research" }, reviewer2: { definition: "reviewer" } });
+  const snapshot = materializeCopies({ orgId: "acme", doc, root: r, rolesDir });
+  const promoted = promoteCopies(snapshot, { researcher: ["gitea"], reviewer2: ["gitea"], nobody: ["gitea"] });
+  assert.equal(promoted.copies.researcher.state, "instance");
+  assert.deepEqual(promoted.copies.researcher.bound, ["gitea"]);
+  assert.equal(Object.hasOwn(promoted.copies.researcher, "missing"), false);
+  // reviewer needs gitea and vikunja: gitea alone is a partial binding.
+  assert.equal(promoted.copies.reviewer2.state, "unbound");
+  assert.equal(promoteCopies(snapshot, { researcher: ["gitea", "vikunja"] }).copies.researcher.state, "unbound", "an extra service is no promotion");
+  assert.equal(promoteCopies(snapshot, { reviewer2: ["gitea", "vikunja"] }).copies.reviewer2.state, "unbound", "vikunja has no copy verifier");
+  assert.ok(Object.isFrozen(promoted.copies.researcher));
+  assert.equal(snapshot.copies.researcher.state, "unbound", "the boot snapshot is unchanged");
+  const business = withCopies(doc, businessFilePath("acme", dir), { rolesDir, snapshot: promoted });
+  assert.deepEqual(business.roles.researcher.credentials, {});
+  assert.deepEqual(business.roles.researcher.copyBound, ["gitea"]);
+  assert.equal(business.copies.researcher.state, "instance");
+  assert.deepEqual(business.copies.researcher.bound, ["gitea"]);
+  assert.equal(copyRefusal(business, "researcher"), null);
+  assert.equal(copyRefusal(business, "reviewer2").code, "credential-unbound");
+  assert.equal(JSON.stringify(business).includes(join("secrets", "agents")), false, "no store path reaches the business");
+  assert.equal(JSON.stringify(business.roles.researcher).includes(dir), false);
+  const resolved = resolveInstance({ system: systemFor(dir), business, instance: "researcher" });
+  assert.deepEqual(resolved.credentials, {});
+});

packages/organization/tests/repo-remote.test.mjs

@@ -0,0 +1,352 @@
+// #1873 P1-6 and P1-7: the remote URL rules, the ls-remote check, and repo set.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createServer } from 'node:http';
+import { createServer as createTcpServer } from 'node:net';
+import { execFileSync } from 'node:child_process';
+import { chmodSync, mkdtempSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { tmpdir } from 'node:os';
+import { createHash } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { parseRepoRemote, checkRemote, classifyCheck, summarizeGitError, CHECK_SSH_COMMAND, NEEDS_CREDENTIAL_MESSAGE, SSH_HOST_UNVERIFIED, repoRemoteTestSeam } from '../src/repo-remote.mjs';
+import { createOrg, templateRender, projectRepoInit, projectRepoShow, projectRepoSet, queueInit, showOrg, updateOrg } from '../src/org-service.mjs';
+import { loadBusiness } from '../src/organization-config.mjs';
+import { REPO_ROLES } from './helpers.mjs';
+
+const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), '../../..');
+const seam = repoRemoteTestSeam;
+const gitEnv = { PATH: process.env.PATH, HOME: '/nonexistent', GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null', LC_ALL: 'C' };
+const git = (cwd, ...args) => execFileSync('git', ['-C', cwd, ...args], { env: gitEnv, encoding: 'utf8' }).trim();
+function bare() { const dir = mkdtempSync(join(tmpdir(), 'bare-')); git(dir, 'init', '--quiet', '--bare', '--template='); return dir; }
+function context() { const root = mkdtempSync(join(tmpdir(), 'repo-remote-')); const configDir = join(root, 'config'), dataRoot = join(root, 'data'); mkdirSync(configDir, { mode: 0o700 }); mkdirSync(dataRoot, { mode: 0o700 }); return { configDir, dataRoot, instance: 'test', principal: { provider: 'local-dev', iss: 'local-dev', sub: 'local-dev-owner' } }; }
+const listen = (server) => new Promise((r) => server.listen(0, '127.0.0.1', () => r(server.address().port)));
+
+test('remote URL rules: https and ssh only, nothing git could read as an option, helper, path or credential', () => {
+  for (const ok of ['https://git.example.com/owner/repo', 'https://git.example.com/owner/repo.git', 'https://git.example.com:8443/o/r',
+    'ssh://[email protected]/owner/repo.git', 'ssh://git.example.com:2222/srv/git/repo.git', '[email protected]:owner/repo.git', '[email protected]:/srv/repo']) {
+    assert.equal(parseRepoRemote(ok).ok, true, ok);
+  }
+  const refused = {
+    'ext::sh -c touch% /tmp/pwned': 'transport', 'fd::17': 'transport', 'file:///srv/repo.git': 'local', 'FILE:///srv/r': 'local',
+    '/srv/repo.git': 'local', './repo': 'local', '../repo': 'local', '~/repo': 'local', 'repo/sub:x': 'local', 'plainword': 'local',
+    '--upload-pack=touch /tmp/x': 'option', '-oProxyCommand=x': 'option',
+    'https://user:[email protected]/o/r': 'credentials', 'https://[email protected]/o/r': 'credentials',
+    'ssh://git:[email protected]/o/r': 'credentials', 'git:[email protected]:o/r': 'credentials',
+    'http://git.example.com/o/r': 'scheme', 'git://git.example.com/o/r': 'scheme', 'ftp://x/o/r': 'scheme', 'ssh+git://x/o/r': 'scheme',
+    'https://git.example.com/o/r?x=1': 'https', 'https://git.example.com/o/../r': 'https', 'https://git.example.com/o': 'https', 'HTTPS://git.example.com/o/r': 'https',
+    'ssh://-oProxyCommand=x/o/r': 'ssh', 'ssh://git@-host/o/r': 'ssh', 'ssh://-user@host/o/r': 'ssh', 'ssh://host/../etc': 'ssh',
+    'ssh://host:0/r': 'ssh', 'ssh://host:65536/r': 'ssh', 'ssh://host/-r': 'ssh', 'git@host:-r': 'ssh', 'git@host:a/../b': 'ssh', 'host:repo': 'ssh',
+    'ssh://host/a b': 'form', 'https://x/o/r\n': 'form', '': 'form',
+  };
+  for (const [value, problem] of Object.entries(refused)) {
+    const result = parseRepoRemote(value);
+    assert.equal(result.ok, false, value); assert.equal(result.problem, problem, value); assert.ok(result.message.length > 0);
+  }
+  assert.equal(parseRepoRemote(42).ok, false); assert.equal(parseRepoRemote('x'.repeat(600)).ok, false);
+});
+
+test('check outcomes are classified from git\'s own messages', () => {
+  assert.equal(classifyCheck({ code: 0, stderr: '' }).result, 'reachable');
+  assert.equal(classifyCheck({ code: 128, stderr: "fatal: could not read Username for 'https://git.example.com': terminal prompts disabled\n" }).result, 'needs-credential');
+  // An ssh remote that wants a key: the line says the check sent none and promises no binding,
+  // because copy credential bindings cover https Gitea remotes only (#1873 review F1).
+  assert.deepEqual(classifyCheck({ code: 128, stderr: '[email protected]: Permission denied (publickey,password).\nfatal: Could not read from remote repository.\n' }),
+    { result: 'needs-credential', message: 'the repository needs a credential; this check uses none' });
+  assert.equal(classifyCheck({ code: 128, stderr: "fatal: unable to access 'https://h/o/r/': The requested URL returned error: 403\n" }).result, 'needs-credential');
+  const dns = classifyCheck({ code: 128, stderr: "fatal: unable to access 'https://git.example.invalid/o/r.git/': Could not resolve host: git.example.invalid\n" });
+  assert.deepEqual(dns, { result: 'unreachable', message: "unable to access 'https://git.example.invalid/o/r.git/': Could not resolve host: git.example.invalid" });
+  const ssh = classifyCheck({ code: 128, stderr: 'ssh: Could not resolve hostname git.example.invalid: Name or service not known\r\nfatal: Could not read from remote repository.\n\nPlease make sure you have the correct access rights\n' });
+  assert.equal(ssh.message, 'ssh: Could not resolve hostname git.example.invalid: Name or service not known');
+  assert.equal(classifyCheck({ timedOut: true, stderr: '' }).message, 'no answer before the check timed out');
+  assert.equal(classifyCheck({ spawnError: true }).result, 'unreachable');
+  assert.equal(summarizeGitError(`fatal: ${'x'.repeat(400)}\u001b[31m`).length, 200);
+  assert.equal(summarizeGitError(''), 'git gave no reason');
+});
+
+test('the ssh client for the check reads no config, key, agent or proxy', () => {
+  for (const option of ['-F /dev/null', 'BatchMode=yes', 'IdentityFile=none', 'IdentitiesOnly=yes', 'IdentityAgent=none', 'PasswordAuthentication=no',
+    'KbdInteractiveAuthentication=no', 'ProxyCommand=none', 'ProxyJump=none', 'ControlPath=none', 'PermitLocalCommand=no', 'ForwardAgent=no', 'UserKnownHostsFile=/dev/null']) {
+    assert.ok(CHECK_SSH_COMMAND.includes(option), option);
+  }
+});
+
+test('production check refuses local and helper URLs without running git, and file is not an allowed transport', async () => {
+  const repo = bare();
+  for (const url of [`file://${repo}`, repo, 'ext::sh -c id', '--upload-pack=id']) assert.equal((await checkRemote(url)).result, 'unreachable', url);
+  // The production protocol list, through the seam: git itself refuses the file transport.
+  const refused = await seam.lsRemote(`file://${repo}`, { protocols: 'https:ssh' });
+  assert.equal(refused.result, 'unreachable'); assert.match(refused.message, /transport 'file' not allowed/);
+  assert.equal((await seam.lsRemote(`file://${repo}`, { protocols: 'file' })).result, 'reachable');
+});
+
+test('the check ignores the caller\'s git config and environment', async () => {
+  const repo = bare(); const home = mkdtempSync(join(tmpdir(), 'home-'));
+  // A user config that would rewrite the URL to the local repository, and a credential helper.
+  writeFileSync(join(home, '.gitconfig'), `[url "file://${repo}"]\n\tinsteadOf = https://git.example.invalid/o/r\n[credential]\n\thelper = !echo username=x; echo password=y\n`);
+  const saved = { HOME: process.env.HOME, GIT_CONFIG_PARAMETERS: process.env.GIT_CONFIG_PARAMETERS, GIT_CONFIG_GLOBAL: process.env.GIT_CONFIG_GLOBAL };
+  process.env.HOME = home; process.env.GIT_CONFIG_GLOBAL = join(home, '.gitconfig'); process.env.GIT_CONFIG_PARAMETERS = `'url.file://${repo}.insteadof'='https://git.example.invalid/o/r'`;
+  try {
+    const result = await seam.lsRemote('https://git.example.invalid/o/r', { protocols: 'https:ssh:file', timeoutMs: 10000 });
+    assert.equal(result.result, 'unreachable'); assert.match(result.message, /git\.example\.invalid/);
+  } finally { for (const [k, v] of Object.entries(saved)) if (v === undefined) delete process.env[k]; else process.env[k] = v; }
+});
+
+test('a 401 is needs-credential and no credential is sent', async () => {
+  const seen = [];
+  const server = createServer((req, res) => { seen.push(req.headers.authorization ?? null); res.writeHead(401, { 'WWW-Authenticate': 'Basic realm="git"' }); res.end(); });
+  const port = await listen(server);
+  try {
+    const result = await seam.lsRemote(`http://127.0.0.1:${port}/o/r.git`, { protocols: 'http' });
+    assert.equal(result.result, 'needs-credential'); assert.equal(result.message, NEEDS_CREDENTIAL_MESSAGE); assert.doesNotMatch(result.message, /binding/);
+    assert.ok(seen.length >= 1); assert.deepEqual(seen.filter(Boolean), []);
+  } finally { server.close(); }
+});
+
+test('a redirect is not followed, so the check reaches only the named URL', async () => {
+  let elsewhere = 0;
+  const other = createServer((req, res) => { elsewhere++; res.writeHead(404); res.end(); });
+  const otherPort = await listen(other);
+  const server = createServer((req, res) => { res.writeHead(302, { Location: `http://127.0.0.1:${otherPort}${req.url}` }); res.end(); });
+  const port = await listen(server);
+  try {
+    const result = await seam.lsRemote(`http://127.0.0.1:${port}/o/r.git`, { protocols: 'http' });
+    assert.equal(result.result, 'unreachable'); assert.match(result.message, /302/); assert.equal(elsewhere, 0);
+  } finally { server.close(); other.close(); }
+});
+
+test('a silent server times out and the check reports it', async () => {
+  const sockets = []; const server = createTcpServer((s) => sockets.push(s)); const port = await listen(server);
+  try {
+    const started = Date.now();
+    const result = await seam.lsRemote(`http://127.0.0.1:${port}/o/r.git`, { protocols: 'http', timeoutMs: 600 });
+    assert.deepEqual(result, { result: 'unreachable', message: 'no answer before the check timed out' }); assert.ok(Date.now() - started < 5000);
+  } finally { for (const s of sockets) s.destroy(); server.close(); }
+});
+
+test('no production source reaches the test seam', () => {
+  const offenders = [];
+  for (const pkg of readdirSync(join(repoRoot, 'packages'))) {
+    const walk = (dir) => { let entries; try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return; } for (const e of entries) { const p = join(dir, e.name); if (e.isDirectory()) { if (e.name !== 'node_modules') walk(p); } else if (/\.(m?js|cjs)$/.test(e.name) && readFileSync(p, 'utf8').includes('repoRemoteTestSeam') && !p.endsWith(join('organization', 'src', 'repo-remote.mjs'))) offenders.push(p); } };
+    walk(join(repoRoot, 'packages', pkg, 'src'));
+  }
+  assert.deepEqual(offenders, []);
+});
+
+// #1873 security review P2: the ssh check accepts any host key, so an ssh answer cannot say the
+// named host answered. Every ssh outcome that came from an answer says the key was not verified;
+// https and an unreachable ssh host do not carry the note.
+test('an ssh answer says the host key was not verified; https does not', async () => {
+  const answer = { reachable: { result: 'reachable', message: 'the repository answered' }, needs: { result: 'needs-credential', message: NEEDS_CREDENTIAL_MESSAGE }, down: { result: 'unreachable', message: 'ssh: Could not resolve hostname h.invalid' } };
+  try {
+    for (const url of ['[email protected]:team/work.git', 'ssh://[email protected]:2222/team/work.git']) {
+      seam.useCheck(async () => answer.reachable);
+      assert.deepEqual(await checkRemote(url), { result: 'reachable', message: `the repository answered; ${SSH_HOST_UNVERIFIED}`, url });
+      seam.useCheck(async () => answer.needs);
+      assert.equal((await checkRemote(url)).message, `${NEEDS_CREDENTIAL_MESSAGE}; ${SSH_HOST_UNVERIFIED}`);
+      seam.useCheck(async () => answer.down);
+      assert.equal((await checkRemote(url)).message, answer.down.message);
+    }
+    seam.useCheck(async () => answer.reachable);
+    assert.equal((await checkRemote('https://git.example.com/team/work.git')).message, 'the repository answered');
+  } finally { seam.useCheck(null); }
+});
+
+async function orgWithRepo(c, opts = { mode: 'local-only', acceptLocalLossRisk: true }) {
+  await createOrg(c, 'alpha', await templateRender('alpha')); return projectRepoInit(c, 'alpha', 'work', opts);
+}
+
+test('remote init sets origin and records the check; nothing is pushed', async () => {
+  const c = context(); const repo = bare(); const url = 'https://git.example.com/team/work.git';
+  seam.useCheck((u) => { assert.equal(u, url); return seam.lsRemote(`file://${repo}`, { protocols: 'file' }); });
+  try {
+    const r = await orgWithRepo(c, { mode: 'remote', remote: url });
+    assert.equal(r.origin, url); assert.deepEqual(r.check, { result: 'reachable', message: 'the repository answered', url });
+    assert.equal(git(r.root, 'remote', '-v'), `origin\t${url} (fetch)\norigin\t${url} (push)`);
+    assert.equal(git(repo, 'for-each-ref').length, 0, 'nothing pushed');
+    const shown = await projectRepoShow(c, 'alpha', 'work');
+    assert.deepEqual(shown.current, { mode: 'remote', remote: url, origin: url, revision: shown.current.revision, check: r.check });
+  } finally { seam.useCheck(null); }
+});
+
+test('repo set switches remote to local-only and back, with receipts and the revision fence', async () => {
+  const c = context(); const r = await orgWithRepo(c);
+  assert.equal(git(r.root, 'remote', '-v'), '');
+  let rev = (await showOrg(c, 'alpha')).revision;
+  seam.useCheck(async () => ({ result: 'needs-credential', message: NEEDS_CREDENTIAL_MESSAGE }));
+  try {
+    const ssh = '[email protected]:team/work.git';
+    await assert.rejects(projectRepoSet(c, 'alpha', 'work', { mode: 'remote', remote: ssh, ifRevision: rev + 1 }), { code: 'revision-conflict' });
+    await assert.rejects(projectRepoSet(c, 'alpha', 'work', { mode: 'remote', remote: ssh }), { code: 'org-invalid' });
+    const set = await projectRepoSet(c, 'alpha', 'work', { mode: 'remote', remote: ssh, ifRevision: rev });
+    assert.equal(set.op, 'org.project.repo.set'); assert.equal(set.revision, rev + 1); assert.deepEqual(set.previous, { mode: 'local-only' });
+    assert.equal(set.check.result, 'needs-credential'); assert.equal(set.check.url, ssh); assert.equal(git(r.root, 'remote', 'get-url', 'origin'), ssh);
+    assert.deepEqual(loadBusiness('alpha', { dir: c.configDir, rolesDir: REPO_ROLES }).projects.work.git, { mode: 'remote', remote: ssh });
+    rev = set.revision;
+    const https = 'https://git.example.com/team/work';
+    const moved = await projectRepoSet(c, 'alpha', 'work', { mode: 'remote', remote: https, ifRevision: rev });
+    assert.equal(git(r.root, 'remote', 'get-url', 'origin'), https); assert.equal(moved.revision, rev + 1); rev = moved.revision;
+    // The same URL again re-checks and repairs origin without a new revision.
+    git(r.root, 'remote', 'set-url', 'origin', 'https://elsewhere.example/x/y');
+    const again = await projectRepoSet(c, 'alpha', 'work', { mode: 'remote', remote: https, ifRevision: rev });
+    assert.equal(again.revision, rev); assert.equal(git(r.root, 'remote', 'get-url', 'origin'), https);
+    await assert.rejects(projectRepoSet(c, 'alpha', 'work', { mode: 'local-only', ifRevision: rev }), { code: 'org-risk' });
+    const local = await projectRepoSet(c, 'alpha', 'work', { mode: 'local-only', acceptLocalLossRisk: true, ifRevision: rev });
+    assert.equal(local.revision, rev + 1); assert.equal(local.check, undefined); assert.equal(git(r.root, 'remote', '-v'), '');
+    const shown = await projectRepoShow(c, 'alpha', 'work');
+    assert.deepEqual(shown.current, { mode: 'local-only', origin: null, revision: local.revision, changedAt: local.at });
+    const ops = readFileSync(join(r.root, '../../receipts.jsonl'), 'utf8').trim().split('\n').map((l) => JSON.parse(l).op);
+    assert.deepEqual(ops.filter((o) => o.startsWith('org.project.repo')), ['org.project.repo.init', 'org.project.repo.set', 'org.project.repo.set', 'org.project.repo.set', 'org.project.repo.set']);
+    // A whole-document update still can't change the binding.
+    const current = await showOrg(c, 'alpha'); const doc = structuredClone(current.doc); doc.projects.work.git = { mode: 'remote', remote: https };
+    await assert.rejects(updateOrg(c, 'alpha', doc, { ifRevision: current.revision }), { code: 'org-invalid' });
+  } finally { seam.useCheck(null); }
+});
+
+// #1873 review F2: origin is set before the document is written. When that write fails, the
+// checkout's origin and the recorded binding differ; show reports both as they are, keeps the
+// last check only for the URL it ran against, and the same set again repairs it.
+test('a set whose document write fails leaves origin ahead of the record, and show says so', async () => {
+  const c = context(); const r = await orgWithRepo(c);
+  seam.useCheck(async () => ({ result: 'reachable', message: 'the repository answered' }));
+  const businesses = join(c.configDir, 'businesses');
+  try {
+    let rev = (await showOrg(c, 'alpha')).revision;
+    const a = 'https://git.example.com/team/a', b = 'https://git.example.com/team/b';
+    rev = (await projectRepoSet(c, 'alpha', 'work', { mode: 'remote', remote: a, ifRevision: rev })).revision;
+    chmodSync(businesses, 0o500);
+    try { await assert.rejects(projectRepoSet(c, 'alpha', 'work', { mode: 'remote', remote: b, ifRevision: rev })); }
+    finally { chmodSync(businesses, 0o700); }
+    assert.equal(git(r.root, 'remote', 'get-url', 'origin'), b);
+    let shown = (await projectRepoShow(c, 'alpha', 'work')).current;
+    assert.deepEqual(shown, { mode: 'remote', remote: a, origin: b, revision: rev, check: { result: 'reachable', message: 'the repository answered', url: a }, changedAt: shown.changedAt });
+    // Repeating the recorded URL repairs origin.
+    await projectRepoSet(c, 'alpha', 'work', { mode: 'remote', remote: a, ifRevision: rev });
+    shown = (await projectRepoShow(c, 'alpha', 'work')).current;
+    assert.equal(shown.origin, a); assert.equal(shown.check.url, a);
+    // A recorded check for another URL is not lent to the current one.
+    const receipts = join(r.root, '../../receipts.jsonl');
+    const lines = readFileSync(receipts, 'utf8').trim().split('\n').map((l) => JSON.parse(l));
+    lines.at(-1).check.url = b; writeFileSync(receipts, lines.map((l) => JSON.stringify(l)).join('\n') + '\n');
+    shown = (await projectRepoShow(c, 'alpha', 'work')).current;
+    assert.equal(shown.check, undefined); assert.equal(shown.remote, a);
+  } finally { seam.useCheck(null); chmodSync(businesses, 0o700); }
+});
+
+// #1873 F7: a copy binding grants the repositories its projects' remotes name when a credential is
+// issued, and its decision records only project names. While a binding that names the project is
+// approved (pending) or active (bound), repo set refuses before any check or origin change, and
+// names the next step. An unbound (revoked) binding, or none, leaves repo set as it was.
+// Bindings are seeded into the document directly, as the CB1 writer would leave them; the registry
+// digest is updated so the read fences accept the document.
+function seedBindings(c, bindings) {
+  const file = join(c.configDir, 'businesses', 'alpha.json');
+  const doc = JSON.parse(readFileSync(file, 'utf8')); doc.copyBindings = bindings;
+  const raw = JSON.stringify(doc, null, 2) + '\n'; writeFileSync(file, raw, { mode: 0o600 });
+  const registryFile = join(c.configDir, 'org-runtime.json'); const registry = JSON.parse(readFileSync(registryFile, 'utf8'));
+  registry.orgs.alpha.digest = createHash('sha256').update(raw).digest('hex'); writeFileSync(registryFile, JSON.stringify(registry, null, 2) + '\n', { mode: 0o600 });
+}
+function binding(instance, state, { project = null, projects = ['work'], n = 1 } = {}) {
+  const name = project ? instance.slice(0, -(project.length + 1)) : instance;
+  const gitea = { slot: 'self', scopes: ['read:repository'], resources: { projects } };
+  if (state === 'bound') Object.assign(gitea, { rotateBy: '2099-01-01', grantId: `gitea:5:${n}`, grantGeneration: 1 });
+  return { copyId: String(n).repeat(32), orgIncarnation: 'a'.repeat(32),
+    source: { level: project ? 'project' : 'root', name, project }, definition: { ref: 'reviewer', rev: null, sha256: 'b'.repeat(64) },
+    generation: 1, state, services: state === 'unbound' ? {} : { gitea }, decision: `1111111${n}-1111-4111-8111-111111111111` };
+}
+async function refusedUnderBinding(bindings, expect) {
+  const c = context(); const r = await orgWithRepo(c);
+  const before = readFileSync(join(r.root, '../../receipts.jsonl'), 'utf8');
+  seedBindings(c, bindings);
+  let checks = 0; seam.useCheck(async () => { checks++; return { result: 'reachable', message: 'the repository answered' }; });
+  try {
+    const rev = (await showOrg(c, 'alpha')).revision;
+    for (const selection of [{ mode: 'remote', remote: 'https://git.example.com/team/other' }, { mode: 'local-only', acceptLocalLossRisk: true }]) {
+      await assert.rejects(projectRepoSet(c, 'alpha', 'work', { ...selection, ifRevision: rev }), (e) => {
+        assert.equal(e.code, 'project-repo-bound');
+        for (const text of expect) assert.ok(e.message.includes(text), `${text} in ${e.message}`);
+        assert.match(e.message, /Revoke that copy binding first .*then set the repository, then ask the chief to raise a new binding decision/);
+        return true;
+      });
+    }
+    assert.equal(checks, 0, 'no check ran'); assert.equal(git(r.root, 'remote', '-v'), '', 'origin unchanged');
+    assert.equal((await showOrg(c, 'alpha')).revision, rev); assert.equal(readFileSync(join(r.root, '../../receipts.jsonl'), 'utf8'), before, 'no receipt');
+    assert.deepEqual(loadBusiness('alpha', { dir: c.configDir, rolesDir: REPO_ROLES }).projects.work.git, { mode: 'local-only' });
+  } finally { seam.useCheck(null); }
+}
+
+test('repo set is refused while an approved (pending) copy binding names the project', async () => {
+  await refusedUnderBinding({ 'rev.work': binding('rev.work', 'pending', { project: 'work' }) }, ['rev.work (approved, not yet verified)']);
+});
+
+test('repo set is refused while an active (bound) copy binding names the project', async () => {
+  // A root copy whose gitea resources name the project, beside a binding for another project that does not count.
+  await refusedUnderBinding({ rev: binding('rev', 'bound', { projects: ['other', 'work'] }), dev: binding('dev', 'bound', { projects: ['other'], n: 2 }) },
+    ['rev (active)']);
+  await refusedUnderBinding({ rev: binding('rev', 'bound', { projects: ['work'] }), 'qa.work': binding('qa.work', 'pending', { project: 'work', n: 2 }) },
+    ['qa.work (approved, not yet verified), rev (active)']);
+});
+
+test('repo set is allowed after the binding is revoked (unbound)', async () => {
+  const c = context(); const r = await orgWithRepo(c);
+  seam.useCheck(async () => ({ result: 'reachable', message: 'the repository answered' }));
+  try {
+    const url = 'https://git.example.com/team/other';
+    seedBindings(c, { 'rev.work': binding('rev.work', 'bound', { project: 'work' }) });
+    const rev = (await showOrg(c, 'alpha')).revision;
+    await assert.rejects(projectRepoSet(c, 'alpha', 'work', { mode: 'remote', remote: url, ifRevision: rev }), { code: 'project-repo-bound' });
+    // The unbind leaves the tombstone; a binding for another project does not count.
+    const revoked = { 'rev.work': binding('rev.work', 'unbound', { project: 'work' }), dev: binding('dev', 'bound', { projects: ['other'], n: 2 }) };
+    seedBindings(c, revoked);
+    const set = await projectRepoSet(c, 'alpha', 'work', { mode: 'remote', remote: url, ifRevision: rev });
+    assert.equal(set.op, 'org.project.repo.set'); assert.equal(set.revision, rev + 1); assert.equal(git(r.root, 'remote', 'get-url', 'origin'), url);
+    assert.deepEqual(loadBusiness('alpha', { dir: c.configDir, rolesDir: REPO_ROLES }).copyBindings, revoked, 'bindings untouched');
+  } finally { seam.useCheck(null); }
+});
+
+// Unchanged behaviour: it passes on a source that never refuses, and guards against refusing too much.
+test('repo set is allowed with no copy binding', async () => {
+  const c = context(); const r = await orgWithRepo(c);
+  seam.useCheck(async () => ({ result: 'reachable', message: 'the repository answered' }));
+  try {
+    const rev = (await showOrg(c, 'alpha')).revision; const url = 'https://git.example.com/team/other';
+    const set = await projectRepoSet(c, 'alpha', 'work', { mode: 'remote', remote: url, ifRevision: rev });
+    assert.equal(set.revision, rev + 1); assert.equal(git(r.root, 'remote', 'get-url', 'origin'), url);
+  } finally { seam.useCheck(null); }
+});
+
+test('repo set refuses bad URLs before any check, and needs an initialized repository', async () => {
+  const c = context(); await createOrg(c, 'alpha', await templateRender('alpha'));
+  let checks = 0; seam.useCheck(async () => { checks++; return { result: 'reachable', message: 'x' }; });
+  try {
+    const rev = (await showOrg(c, 'alpha')).revision;
+    await assert.rejects(projectRepoSet(c, 'alpha', 'work', { mode: 'remote', remote: 'https://git.example.com/o/r', ifRevision: rev }), { code: 'org-unavailable' });
+    await projectRepoInit(c, 'alpha', 'work', { mode: 'local-only', acceptLocalLossRisk: true });
+    const rev2 = (await showOrg(c, 'alpha')).revision;
+    for (const remote of ['ext::sh -c id', `file://${bare()}`, '/srv/x', '--upload-pack=id', 'https://u:[email protected]/o/r', 'http://git.example.com/o/r']) {
+      await assert.rejects(projectRepoSet(c, 'alpha', 'work', { mode: 'remote', remote, ifRevision: rev2 }), { code: 'org-invalid' }, remote);
+      await assert.rejects(projectRepoInit(c, 'alpha', 'other', { mode: 'remote', remote }), { code: 'org-invalid' }, remote);
+    }
+    assert.equal(checks, 0);
+  } finally { seam.useCheck(null); }
+});
+
+test('queue init with a remote also sets origin', async () => {
+  const c = context(); await createOrg(c, 'alpha', await templateRender('alpha'));
+  seam.useCheck(async () => ({ result: 'unreachable', message: 'Could not resolve host: git.example.invalid' }));
+  try {
+    const q = await queueInit(c, 'alpha', { mode: 'remote', remote: 'ssh://[email protected]/team/queue.git' });
+    assert.equal(git(q.root, 'remote', 'get-url', 'origin'), 'ssh://[email protected]/team/queue.git'); assert.equal(q.check.result, 'unreachable');
+  } finally { seam.useCheck(null); }
+});
+
+test('the loader accepts an ssh git remote and refuses a helper URL', async () => {
+  const c = context(); await createOrg(c, 'alpha', await templateRender('alpha'));
+  const file = join(c.configDir, 'businesses', 'alpha.json');
+  const doc = JSON.parse(readFileSync(file, 'utf8'));
+  const { validateOrg } = await import('../src/org-service.mjs');
+  doc.projects.work.git = { mode: 'remote', remote: '[email protected]:team/work.git' };
+  assert.deepEqual(await validateOrg(doc), { ok: true, errors: [] });
+  doc.projects.work.git = { mode: 'remote', remote: 'ext::sh -c id' };
+  assert.equal((await validateOrg(doc)).ok, false);
+});

packages/webui/README.md

@@ -16,7 +16,8 @@ baseline CLI.
 | Create organization | `mosaic org create <id> --from <file>` | S6 integration hook |
 | Save organization or theme | `mosaic org update <id> --from <file> --if-revision <revision>` | S6 integration hook |
 | Initialize organization checkout | `mosaic org queue init <id> --local-only --accept-local-loss-risk` or `--remote <url>` | S6 integration hook |
-| Initialize project Git | `mosaic org project repo init <id> <project> --local-only --accept-local-loss-risk` or `--remote <url>` | S6 integration hook |
+| Initialize project Git | `mosaic org project repo init <id> <project> --local-only --accept-local-loss-risk` or `--remote <url>` | S6 integration hook; remote mode sets and checks `origin` (#1873 P1-6) |
+| Change a project's repository | `mosaic org project repo set <id> <project> (--local-only --accept-local-loss-risk \| --remote <url>) --if-revision <revision>` | Enabled (#1873 P1-7): the owner's Repository section on an organization project's Settings tab, `/api/orgs/<id>/repo/project/<project>`; needs send mode; refused (409 `project-repo-bound`) while an approved or active copy binding names the project |
 | Recover a stopped bus with stale host state | `mosaic bus recover <id>` | CLI only |
 | Inspect or clear a dead lifecycle lock | `mosaic org lock show <id>` / `mosaic org lock clear <id>` | CLI only |
 | Start, stop or restart a bus | `mosaic bus start <id>` / `mosaic bus stop <id>` / `mosaic bus restart <id>` | S6 integration hook |

packages/webui/src/org-admin.mjs

@@ -15,6 +15,8 @@
 //   GET  /api/orgs/ID/setup                 read-back of every setup step (resume)
 //   POST /api/orgs/ID/setup/queue           C2 queueInit     mosaic org queue init
 //   POST /api/orgs/ID/setup/project/P       C2 projectRepoInit  mosaic org project repo init
+//   GET  /api/orgs/ID/repo/project/P        C2 projectRepoShow  mosaic org project repo show (#1873 P1-7)
+//   POST /api/orgs/ID/repo/project/P        C2 projectRepoSet   mosaic org project repo set --if-revision
 //   POST /api/orgs/ID/setup/bus             C3 busStart      mosaic bus start --detach
 //   POST /api/orgs/ID/restore               C2 restoreOrg, then C3 busStart (E1: the answer's `bus`)
 //   POST /api/orgs/ID/restart/bus           C3 busRestart    mosaic bus restart (F3; busStart when stopped;
@@ -32,12 +34,13 @@ import { join } from 'node:path';
 import { actor } from './action-trail.mjs';
 import { DEV_OWNER } from '../../cli/src/dev-local-owner.mjs';
 import { revivePending } from './bus-revive.mjs';
+import { parseRepoRemote } from '../../organization/src/vocabulary.mjs';
 
 const ID = /^[a-z0-9][a-z0-9._-]{0,63}$/;
 const KEY = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
 const ENV_NAME = /^[A-Z][A-Z0-9_]{0,63}$/;
 const MAX_BODY = 64 * 1024;
-const ROUTE = /^\/api\/orgs\/([^/]+)\/(admin|setup|delete|archive|restore|restart|stop)(?:\/(queue|bus|project\/([^/]+)|records\/([^/]+)))?$/;
+const ROUTE = /^\/api\/orgs\/([^/]+)\/(admin|setup|repo|delete|archive|restore|restart|stop)(?:\/(queue|bus|project\/([^/]+)|records\/([^/]+)))?$/;
 // The org-template placeholder (packages/organization/src/org-service.mjs templateRender).
 export const placeholderRoot = (id, project) => `/__mosaic_org__/${id}/projects/${project}`;
 // Project fields the server owns. The browser never sees or sends them. `agents` (#1873 A1) is
@@ -46,11 +49,12 @@ const SERVER_PROJECT_KEYS = ['root', 'repo', 'git', 'agents'];
 
 // The CLI verb each step equals (r4 section 2).
 export function verbFor(step, id, opts = {}) {
-  const tail = opts.mode === 'remote' ? `--remote ${opts.remote ?? '<https-url>'}` : '--local-only --accept-local-loss-risk';
+  const tail = opts.mode === 'remote' ? `--remote ${opts.remote ?? '<repository-url>'}` : '--local-only --accept-local-loss-risk';
   if (step === 'create') return `mosaic org create ${id} --from <file>`;
   if (step === 'update') return `mosaic org update ${id} --from <file> --if-revision ${opts.revision ?? '<revision>'}`;
   if (step === 'queue') return `mosaic org queue init ${id} ${tail}`;
   if (step === 'project') return `mosaic org project repo init ${id} ${opts.project} ${tail}`;
+  if (step === 'repo') return `mosaic org project repo set ${id} ${opts.project} ${tail} --if-revision ${opts.revision ?? '<revision>'}`;
   if (step === 'archive' || step === 'restore') return `mosaic org ${step} ${id} --if-revision ${opts.revision}`;
   if (step === 'delete') return `mosaic org delete ${id} --confirm ${id} --if-revision ${opts.revision}`;
   if (step === 'records') return `mosaic project init ${id} ${opts.project}`;
@@ -270,6 +274,8 @@ function refusal(res, error, { step, id, unknownOk = false }) {
   if (code === 'org-forbidden') return json(res, 403, { error: 'org-forbidden', step, message: String(error.message ?? code) });
   if (code === 'org-exists' || code === 'org-overlap' || code === 'exists') return json(res, 409, { error: code, step, message: 'it already exists; read it back instead of creating it again', readBack: id ? `/api/orgs/${id}/setup` : null });
   if (code === 'org-invalid' && (step === 'queue' || step === 'project')) return json(res, 422, { error: code, step, message: String(error.message), errors: [{ path: '$.remote', field: 'remote', message: String(error.message) }] });
+  // #1873 F7: a copy binding still grants this project; the message names the copies and the next step.
+  if (code === 'project-repo-bound') return json(res, 409, { error: code, step, message: String(error.message ?? code) });
   if (code === 'org-risk') return json(res, 422, { error: code, step, message: String(error.message), errors: [{ path: '$.acceptLocalLossRisk', field: 'acceptLocalLossRisk', message: String(error.message) }] });
   if (typeof code === 'string' && /^org-|invalid|refused|required/.test(code)) return json(res, 422, { error: code, step, message: String(error.message ?? code), errors: error.errors ? withField(error.errors) : [] });
   if (unknownOk) return json(res, 502, { error: 'outcome-unknown', step, message: 'the outcome is unknown. Read the step back before retrying.', readBack: id ? `/api/orgs/${id}/setup` : null });
@@ -385,15 +391,17 @@ function unreadable(res, error, step, id, log) {
   return json(res, 409, { error: 'readback-failed', step, message: `the ${step === 'queue' ? 'checkout' : 'repository'} could not be read back${error?.code ? ` (${error.code})` : ''}, so it was not retried. Inspect it with the show verb.`, readBack: `/api/orgs/${id}/setup` });
 }
 
-const gitOptions = (body, res, step) => {
-  strictKeys(body, ['mode', 'remote', 'acceptLocalLossRisk']);
+const gitOptions = (body, res, step, extra = []) => {
+  strictKeys(body, ['mode', 'remote', 'acceptLocalLossRisk', ...extra]);
   if (body.mode === 'local-only') {
     if (body.acceptLocalLossRisk !== true) { json(res, 422, { error: 'risk-not-accepted', step, errors: [{ path: '$.acceptLocalLossRisk', field: 'acceptLocalLossRisk', message: 'tick the box to accept that a local-only checkout has no copy anywhere else' }] }); return null; }
     if (body.remote !== undefined) { json(res, 422, { error: 'invalid', step, errors: [{ path: '$.remote', field: 'remote', message: 'local only takes no remote' }] }); return null; }
     return { mode: 'local-only', acceptLocalLossRisk: true };
   }
   if (body.mode === 'remote') {
-    if (typeof body.remote !== 'string' || body.remote.length > 2048 || !/^https:\/\/[^\s/]+\/\S+$/.test(body.remote) || isShellText(body.remote)) { json(res, 422, { error: 'invalid', step, errors: [{ path: '$.remote', field: 'remote', message: 'must be an https repository URL, such as https://git.example/owner/repo' }] }); return null; }
+    // #1873 P1-6: the service's own URL rules (https or ssh; no option, helper, path or credential).
+    const parsed = parseRepoRemote(body.remote);
+    if (!parsed.ok) { json(res, 422, { error: 'invalid', step, errors: [{ path: '$.remote', field: 'remote', message: parsed.message }] }); return null; }
     if (body.acceptLocalLossRisk !== undefined) { json(res, 422, { error: 'invalid', step, errors: [{ path: '$.acceptLocalLossRisk', field: 'acceptLocalLossRisk', message: 'applies to local only' }] }); return null; }
     return { mode: 'remote', remote: body.remote };
   }
@@ -526,6 +534,7 @@ async function route(req, res, { path, search, org, admin, principal, write, log
   if (kind === 'setup' && !sub && !write) {
     try { return json(res, 200, await readSetup(admin, ctx, id)); } catch (e) { return refusal(res, e, { step: 'setup', id }); }
   }
+  if (kind === 'repo' && sub?.startsWith('project/')) return repoSet(req, res, { project, write, id, ctx, service, log });
   if (kind === 'restart') return restartBus(req, res, { sub, write, id, ctx, service, admin, log, trail, by });
   if (kind === 'stop') return stopBus(req, res, { sub, write, id, ctx, service, admin, log, trail, by });
   if (kind !== 'setup' || !sub || !write) return json(res, 404, { error: 'not found' });
@@ -614,6 +623,34 @@ async function restoreBus({ id, ctx, admin, log, trail, by }) {
   return { outcome: 'done', healthy, receipt: forReceipt(ctx, receipt), verb };
 }
 
+// #1873 P1-7: the project Settings tab reads and changes the project's repository. GET answers the
+// binding as it is now; POST is `mosaic org project repo set`: the same URL rules and check as setup,
+// origin follows, nothing is pushed, a receipt records it. A project not set up yet answers missing.
+async function repoSet(req, res, { project, write, id, ctx, service, log }) {
+  let name;
+  try { name = decodeURIComponent(project); } catch { return json(res, 404, { error: 'not found' }); }
+  if (!ID.test(name)) return json(res, 404, { error: 'not found' });
+  let body = null, opts = null;
+  if (write) { body = await readBody(req); opts = gitOptions(body, res, 'repo', ['ifRevision']); if (!opts) return; }
+  if (write && (!Number.isSafeInteger(body.ifRevision) || body.ifRevision < 1)) return json(res, 422, { error: 'invalid', step: 'repo', errors: [{ path: '$.ifRevision', field: 'ifRevision', message: 'reload the project; the revision you opened is missing' }] });
+  let shown;
+  try { shown = await service.showOrg(ctx, id); } catch (e) { return refusal(res, e, { step: 'repo', id }); }
+  if (!Object.hasOwn(shown.doc?.projects ?? {}, name) || shown.doc.projects[name]?.kind === 'library') return json(res, 404, { error: 'project-unknown', step: 'repo', message: `${id} declares no project ${name}` });
+  let existing;
+  try { existing = await receiptOf(() => service.projectRepoShow(ctx, id, name)); } catch (e) { return unreadable(res, e, 'project', id, log); }
+  // No new refusal code: a write to a project not set up yet is the existing 'invalid'.
+  if (!existing) return json(res, write ? 422 : 200, { state: 'missing', step: 'repo', project: name, revision: shown.revision, ...(write ? { error: 'invalid' } : {}), message: 'this project has no repository yet; set it up first', verb: verbFor('project', id, { project: name }) });
+  if (!write) {
+    const current = existing.current ?? { mode: existing.mode, ...(existing.remote ? { remote: existing.remote } : {}), revision: shown.revision };
+    return json(res, 200, { state: 'done', step: 'repo', project: name, current: forReceipt(ctx, current), receipt: forReceipt(ctx, existing), verb: verbFor('repo', id, { ...current, project: name, revision: current.revision }) });
+  }
+  if (typeof service.projectRepoSet !== 'function') return json(res, 503, { error: 'not-configured', step: 'repo', message: 'changing a project repository is not available on this Console yet' });
+  try {
+    const receipt = await service.projectRepoSet(ctx, id, name, { ...opts, ifRevision: body.ifRevision });
+    return json(res, 200, { outcome: 'done', step: 'repo', project: name, receipt: forReceipt(ctx, receipt), check: receipt?.check ?? null, verb: verbFor('repo', id, { ...opts, project: name, revision: body.ifRevision }) });
+  } catch (e) { return refusal(res, e, { step: 'repo', id, unknownOk: true }); }
+}
+
 // F3 (REQ-WEB-3): one control restarts an organization's bus and answers with a done receipt. A
 // running host restarts on the options it was started with (C3 busRestart keeps --dev-local-owner);
 // a stopped one starts as setup starts it. The trail line is written before anything changes, and

packages/webui/src/public/chat.js

@@ -683,7 +683,10 @@
     refreshRequestData(c, false);
     const remote = c.container.querySelector('[data-chat-remote]');
     const project = c.projects.find(p => p.id === c.id);
-    if (remote && roomOwner() && typeof window.MosaicProjectRemote?.mount === 'function') { remote.replaceChildren(); window.MosaicProjectRemote.mount({ container: remote, projectId: c.id, repositoryKey: project?.repo ?? null, projectArchived: !!c.projectArchived, preserve: true }); }
+    // #1873 P1-7: an organization project's repository is editable through the organization's own route,
+    // which names the project as the organization file does: the chat project's repo key.
+    if (remote && roomOwner() && window.MosaicOrg && typeof window.MosaicProjectRepo?.mount === 'function') window.MosaicProjectRepo.mount({ container: remote, project: project?.repo ?? null, archived: !!c.projectArchived });
+    else if (remote && roomOwner() && typeof window.MosaicProjectRemote?.mount === 'function') { remote.replaceChildren(); window.MosaicProjectRemote.mount({ container: remote, projectId: c.id, repositoryKey: project?.repo ?? null, projectArchived: !!c.projectArchived, preserve: true }); }
     // Phase P2 (#1873): the project's System types selection, the owner's, mounted like the remote.
     const types = c.container.querySelector('[data-chat-system-types]');
     if (types && roomOwner() && typeof window.MosaicSystemTypes?.mount === 'function') window.MosaicSystemTypes.mount({ container: types, projectId: c.id, archived: !!c.projectArchived });

packages/webui/src/public/org-create.js

@@ -4,6 +4,9 @@
 (() => {
   const $ = id => document.getElementById(id);
   const txt = v => String(v ?? '').replace(/[&<>"']/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
+  // #1873 P1-6: the remote check a repository receipt records, in one plain line.
+  const CHECKED = { reachable: 'reachable', 'needs-credential': 'needs a credential', unreachable: 'unreachable' };
+  const checkLine = r => `Remote check: ${CHECKED[r.check.result] ?? 'unknown'}, ${r.check.message}. Origin: ${r.origin ?? 'none'}.`;
   const ID = /^[a-z0-9][a-z0-9._-]{0,63}$/;
   const markup = `<div id="org-admin" class="org-admin">
 <section class="panel" aria-labelledby="org-start-title" id="org-start">
@@ -34,7 +37,7 @@
 <section id="org-quick" class="panel" hidden aria-labelledby="org-quick-title">
   <h3 id="org-quick-title">Quick Setup</h3>
   <div class="org-field"><label for="org-project">First project name</label><input id="org-project" value="work" autocomplete="off"><span class="org-help">Lowercase letters, digits, dot, dash or underscore.</span></div>
-  <div class="org-field"><label for="org-project-remote">Project remote URL (optional)</label><input id="org-project-remote" type="url" placeholder="https://git.example/team/project"><span class="org-help">Leave blank for local only. The organization checkout is local only.</span></div>
+  <div class="org-field"><label for="org-project-remote">Project remote URL (optional)</label><input id="org-project-remote" type="text" inputmode="url" autocomplete="off" spellcheck="false" placeholder="https://git.example/team/project or git@git.example:team/project.git"><span class="org-help">https or ssh. The project checkout's origin is set to it and checked without a credential; nothing is pushed. Leave blank for local only. The organization checkout is local only.</span></div>
   <label class="org-quick-risk"><input id="org-risk-accept" type="checkbox"> I understand local-only repositories have no copy elsewhere and can be lost.</label>
   <div class="settings-actions"><button type="button" id="org-quick-run">Create and set up organization</button></div>
   <ol id="org-quick-steps" class="org-steps" aria-live="polite"></ol>
@@ -302,7 +305,8 @@
       const project = $('org-project').value.trim(), remote = $('org-project-remote').value.trim();
       if (!ID.test(project)) { $('org-project').setAttribute('aria-invalid', 'true'); banner('Enter a valid project name.'); $('org-project').focus(); return; }
       $('org-project').removeAttribute('aria-invalid');
-      if (remote && !/^https:\/\/[^\s/]+\/\S+$/.test(remote)) { banner('Enter an https repository URL or leave it blank.'); $('org-project-remote').focus(); return; }
+      // The server applies the full URL rules (parseRepoRemote); this only catches an obvious slip.
+      if (remote && (/\s/.test(remote) || !/^(https:\/\/|ssh:\/\/|[A-Za-z0-9_][A-Za-z0-9_.-]*@[^/:]+:)/.test(remote))) { banner('Enter an https or ssh repository URL, or leave it blank.'); $('org-project-remote').focus(); return; }
       if (!$('org-risk-accept').checked) { banner('Accept the risk of local-only repositories to continue.'); $('org-risk-accept').focus(); return; }
       const id = st.id, enc = encodeURIComponent, local = { mode: 'local-only', acceptLocalLossRisk: true };
       const steps = [
@@ -340,6 +344,7 @@
           if (step === 'chat-project') quickDone = { org: id, chatProject: result.body.id, repo: project };
           card.querySelector('.org-pill').textContent = 'Done'; card.classList.add('org-step-done');
           if (result.body.verb) card.querySelector('code').textContent = result.body.verb;
+          if (step === 'project' && result.body.receipt?.check) card.querySelector('.org-verb').insertAdjacentHTML('afterend', `<p class="org-help" data-remote-check>${txt(checkLine(result.body.receipt))}</p>`);
         }
         editorDirty = false; $('org-new-id').value = ''; $('org-quick-open-org').hidden = false; $('org-quick-interview').hidden = !window.MosaicOnboarding; status('Organization setup complete.');
         // E1 (P1-5): the sidebar and header list the new organization without a reload.
@@ -451,13 +456,14 @@
           <div class="org-step-head"><h4 id="org-step-${i}-title"><span class="org-step-n">${i + 1}</span> ${txt(title)}</h4><span class="org-pill ${cls}">${txt(stateLabel)}</span></div>
           <p class="org-verb">Same as <code>${txt(s.verb || '')}</code></p>
           ${s.message ? `<p class="org-help">${txt(s.message)}</p>` : ''}
+          ${key.startsWith('project:') && s.receipt?.check ? `<p class="org-help" data-remote-check>${txt(checkLine(s.receipt))}</p>` : ''}
           ${s.lastError ? `<p class="org-field-err" role="alert">${txt(s.lastError)}</p>` : ''}
           ${s.receipt ? `<details${s.state === 'done' ? '' : ' open'}><summary>${key === 'bus' ? 'Bus status' : 'Receipt'}</summary><pre class="org-pre">${txt(JSON.stringify(s.receipt, null, 2))}</pre></details>` : ''}
           ${s.state === 'unknown' ? `<div class="settings-actions"><button type="button" class="org-secondary" data-readback="${txt(key)}">Read back</button><span class="org-help">Retry stays off until the step is read back.</span></div>` : ''}
           ${s.state !== 'done' && s.state !== 'unknown' && git ? `<fieldset class="org-git" ${ready && canWrite ? '' : 'disabled'}><legend>Where the history lives</legend>
               <label><input type="radio" name="${name}" value="local-only"${remote ? '' : ' checked'}> Local only, on this machine</label>
               <label><input type="radio" name="${name}" value="remote"${remote ? ' checked' : ''}> Remote</label>
-              <div class="org-remote"${remote ? '' : ' hidden'}><label for="${name}-remote">Remote repository URL</label><input id="${name}-remote" type="url" inputmode="url" data-remote autocomplete="off" spellcheck="false" placeholder="https://git.example/owner/repo" value="${txt(c.remote || '')}" aria-describedby="${name}-remote-help"${remote && s.lastError ? ' aria-invalid="true"' : ''}><span id="${name}-remote-help" class="org-help">An https URL. It is recorded in the receipt and the organization file; nothing is pushed.</span></div>
+              <div class="org-remote"${remote ? '' : ' hidden'}><label for="${name}-remote">Remote repository URL</label><input id="${name}-remote" type="text" inputmode="url" data-remote autocomplete="off" spellcheck="false" placeholder="https://git.example/owner/repo or git@git.example:owner/repo.git" value="${txt(c.remote || '')}" aria-describedby="${name}-remote-help"${remote && s.lastError ? ' aria-invalid="true"' : ''}><span id="${name}-remote-help" class="org-help">An https or ssh URL. The checkout's origin is set to it and checked without a credential; the result is in the receipt. Nothing is pushed.</span></div>
               <label class="org-risk"${remote ? ' hidden' : ''}><input type="checkbox" data-risk${c.risk ? ' checked' : ''}${!remote && s.lastError && !c.risk ? ' aria-invalid="true"' : ''}> I accept that a local-only history has no copy anywhere else and is lost with this disk.</label>
               <div class="settings-actions"><button type="button" data-run="${txt(key)}">${busy ? 'Working… <span class="settings-spinner" aria-hidden="true"></span>' : key === 'queue' ? 'Set up checkout' : 'Set up repository'}</button></div>
             </fieldset>` : ''}
@@ -514,7 +520,7 @@
     // The "Same as" line follows the choice in the card.
     function showVerb(card) {
       const key = card.dataset.step; if (key === 'bus') return;
-      const o = stepOptions(card), tail = o.mode === 'remote' ? `--remote ${o.remote || '<https-url>'}` : '--local-only --accept-local-loss-risk';
+      const o = stepOptions(card), tail = o.mode === 'remote' ? `--remote ${o.remote || '<repository-url>'}` : '--local-only --accept-local-loss-risk';
       const code = card.querySelector('.org-verb code'); if (!code) return;
       code.textContent = key === 'queue' ? `mosaic org queue init ${st.id} ${tail}` : `mosaic org project repo init ${st.id} ${key.slice(8)} ${tail}`;
     }

packages/webui/src/public/project-remote.css

@@ -3,3 +3,17 @@
 .project-remote input { box-sizing: border-box; width: 100%; min-height: 44px; }
 .project-remote button { min-height: 44px; justify-self: start; }
 .project-remote [role="status"] { overflow-wrap: anywhere; }
+/* #1873 P1-7: an organization project's repository (project-remote.js MosaicProjectRepo). */
+.project-repo fieldset { border: 0; margin: 0; padding: 0; display: grid; gap: .5rem; }
+.project-repo legend { font-weight: 600; margin-bottom: .25rem; }
+.project-repo-option { display: flex; align-items: flex-start; gap: .5rem; min-height: 44px; }
+.project-repo-option input { margin-top: .2rem; width: 20px; height: 20px; flex: none; }
+.project-repo-option span { display: flex; flex-direction: column; min-width: 0; }
+.project-repo-option small { color: var(--muted, inherit); }
+.project-repo-facts { display: grid; grid-template-columns: max-content minmax(0, 1fr); gap: .25rem 1rem; margin: 0 0 1rem; }
+.project-repo-facts dt { font-weight: 600; }
+.project-repo-facts dd { margin: 0; overflow-wrap: anywhere; }
+.project-repo-drift { margin: 0 0 1rem; padding: .5rem .75rem; border-left: 3px solid var(--warning, currentColor); }
+.project-repo [role="status"]:empty { display: none; }
+.project-repo [role="status"]:focus { outline: none; }
+@media (max-width: 480px) { .project-repo-facts { grid-template-columns: minmax(0, 1fr); } .project-repo-facts dd { margin-bottom: .5rem; } }

packages/webui/src/public/project-remote.js

@@ -103,3 +103,143 @@
   }
   window.MosaicProjectRemote = { mount };
 })();
+
+/* #1873 P1-7: an organization project's repository on its Settings tab, the owner's. It reads and
+   changes the binding through /api/orgs/ORG/repo/project/P, which is `mosaic org project repo set`:
+   https or ssh, the same check as setup, origin follows, nothing is pushed, a receipt records it.
+   The server and the organization service recheck every write; a control shown here grants nothing. */
+(() => {
+  'use strict';
+  const esc = value => String(value ?? '').replace(/[&<>"']/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+  const enc = encodeURIComponent;
+  const ID = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+  const LINES = {
+    'sign-in-required': 'Sign in again to see or change the repository.',
+    'owner-only': "The repository setting is the organization owner's.",
+    'read-only': 'This Console only reads. Changing the repository needs signed-in send mode.',
+    'revision-conflict': 'The organization changed after this page read it. The setting was read again; your entry is kept. Check it and save again.',
+    'risk-not-accepted': 'Tick the box to accept that a local-only repository has no copy anywhere else.',
+    'org-risk': 'Tick the box to accept that a local-only repository has no copy anywhere else.',
+    'org-inactive': 'This organization is not active, so its repository cannot be changed.',
+    'org-unavailable': 'This organization is not available.',
+    'project-unknown': 'This project was not found in the organization.',
+    'not-configured': 'Changing the repository is not available on this Console.',
+    'readback-failed': 'The repository could not be read back, so nothing was changed. Inspect it with the show command.',
+    'project-repo-bound': 'A copy binding still grants this project. Revoke that copy binding first, then set the repository, then ask the chief to raise a new binding decision.',
+    'outcome-unknown': 'The outcome is unknown. The setting was read again; check it before you retry.',
+  };
+  const CHECK = { reachable: 'Reachable', 'needs-credential': 'Needs a credential', unreachable: 'Unreachable' };
+  const checkLine = check => check && CHECK[check.result] ? `${CHECK[check.result]}: ${check.message}.` : null;
+
+  async function call(path, body) {
+    const init = body === undefined ? { cache: 'no-store', redirect: 'manual' }
+      : { method: 'POST', cache: 'no-store', redirect: 'manual', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) };
+    let response;
+    try { response = await fetch(path, init); } catch { return { ok: false, code: 'outcome-unknown' }; }
+    if (response.type === 'opaqueredirect') return { ok: false, code: 'sign-in-required' };
+    const value = await response.json().catch(() => null);
+    if (!response.ok) return { ok: false, code: typeof value?.error === 'string' ? value.error : 'outcome-unknown', message: value?.errors?.[0]?.message || value?.message || null };
+    return value && typeof value === 'object' ? { ok: true, value } : { ok: false, code: 'outcome-unknown' };
+  }
+  // A refusal the server explained (the URL rules, a missing setup) keeps its own words.
+  const refusalLine = r => (['invalid', 'org-invalid', 'project-repo-bound'].includes(r.code) && r.message) ? r.message : LINES[r.code] || LINES['outcome-unknown'];
+
+  let active = null;
+  document.addEventListener('mosaic-signed-out', () => { active?.dispose(); active = null; });
+  window.addEventListener('hashchange', () => { if (active) active.stale = true; });
+  function mount({ container, project, archived = false }) {
+    if (!(container instanceof Element)) return;
+    const org = window.MosaicOrg?.id ?? null;
+    if (active && active.org === org && active.project === project) {
+      container.replaceChildren(active.section);
+      if (active.archived !== archived) { active.archived = archived; active.paint(); }
+      if (active.stale) { active.stale = false; active.refresh(); }
+      return;
+    }
+    active?.dispose();
+    const section = document.createElement('section');
+    section.className = 'project-remote project-repo';
+    section.setAttribute('data-project-repo', '');
+    container.replaceChildren(section);
+    let value = null, code = null, outcome = '', saving = false, disposed = false, generation = 0;
+    let draft = null; // { mode, remote, risk } once the owner touches the form
+    const state = { org, project, section, archived, stale: false, paint, refresh: () => refresh(), dispose: () => { disposed = true; generation++; section.replaceChildren(); } };
+    active = state;
+    const path = () => `/api/orgs/${enc(org)}/repo/project/${enc(project)}`;
+    function form() {
+      const cur = value.current;
+      const d = draft ?? { mode: cur.mode, remote: cur.remote ?? '', risk: false };
+      const off = saving ? ' disabled' : '';
+      const remote = d.mode === 'remote';
+      return `<form data-project-repo-form><fieldset><legend>Where the repository lives</legend>`
+        + `<label class="project-repo-option"><input type="radio" name="repo-mode" value="remote"${remote ? ' checked' : ''}${off}><span><strong>Remote</strong><small>The checkout's origin points at this URL and is checked. Nothing is pushed.</small></span></label>`
+        + `<label class="project-repo-option"><input type="radio" name="repo-mode" value="local-only"${remote ? '' : ' checked'}${off}><span><strong>Local only</strong><small>No origin. The repository has no copy anywhere else.</small></span></label></fieldset>`
+        + (remote
+          ? `<label for="project-repo-url">Repository URL (https or ssh)</label><input id="project-repo-url" name="repo-url" type="text" inputmode="url" autocomplete="off" spellcheck="false" maxlength="512" placeholder="https://git.example/owner/repo or [email protected]:owner/repo.git" value="${esc(d.remote)}"${off}>`
+          : `<label class="project-repo-option"><input type="checkbox" name="repo-risk"${d.risk ? ' checked' : ''}${off}><span>I accept that a local-only repository has no copy anywhere else.</span></label>`)
+        + `<button type="submit" class="btn"${off}>${saving ? 'Saving…' : 'Save repository'}</button></form>`;
+    }
+    function paint() {
+      if (disposed) return;
+      const head = '<h2 tabindex="-1">Repository</h2>';
+      const status = `<p role="status" tabindex="-1" data-project-repo-status>${esc(outcome)}</p>`;
+      if (!org || !ID.test(project ?? '')) { section.innerHTML = `${head}<p>${org && !project ? 'This project is not linked to a repository in the organization.' : 'Repository setting unavailable.'}</p>`; return; }
+      if (!value) { section.innerHTML = `${head}<p>${esc(code ? `Repository setting unavailable. ${LINES[code] || LINES['outcome-unknown']}` : 'Reading the repository setting…')}</p>${status}`; return; }
+      if (value.state === 'missing') { section.innerHTML = `${head}<p>This project has no repository yet. Set it up from the organization's Quick Setup, or with <code>${esc(value.verb)}</code>.</p>${status}`; return; }
+      const cur = value.current;
+      const facts = `<dl class="project-repo-facts"><dt>Mode</dt><dd data-repo-mode>${cur.mode === 'remote' ? 'Remote' : 'Local only'}</dd>`
+        + `<dt>Repository URL</dt><dd data-repo-url>${cur.mode === 'remote' ? esc(cur.remote) : 'None (local only)'}</dd>`
+        + `<dt>Git origin</dt><dd data-repo-origin>${cur.origin ? esc(cur.origin) : 'None'}</dd>`
+        + `<dt>Last check</dt><dd data-repo-check>${cur.mode === 'remote' ? esc((cur.check?.url === cur.remote && checkLine(cur.check)) || 'Not recorded for this URL') : 'None (local only has no remote)'}</dd></dl>`;
+      // origin and the recorded binding disagree when a save stopped between setting origin and
+      // recording it; saving again repairs it.
+      const drift = (cur.mode === 'remote' ? cur.origin !== cur.remote : cur.origin != null)
+        ? '<p class="project-repo-drift" role="note" data-repo-drift>Git origin differs from the recorded repository; save it again to repair.</p>' : '';
+      const verb = `<p class="muted">Same as <code data-repo-verb>${esc(value.verb)}</code></p>`;
+      const why = state.archived ? '<p class="muted">This project is archived; its repository is shown read only.</p>' : '';
+      section.innerHTML = `${head}${facts}${drift}${state.archived ? '' : form()}${why}${status}${verb}`;
+    }
+    async function refresh() {
+      if (!org || !ID.test(project ?? '')) return;
+      const turn = ++generation;
+      const result = await call(path());
+      if (disposed || turn !== generation) return;
+      if (result.ok && (result.value.state === 'missing' || (result.value.state === 'done' && result.value.current))) { value = result.value; code = null; } else { value = null; code = result.ok ? 'outcome-unknown' : result.code; }
+      paint();
+    }
+    const focusUrl = () => section.querySelector('#project-repo-url')?.focus();
+    section.addEventListener('change', e => {
+      if (!value?.current) return;
+      const d = draft ?? { mode: value.current.mode, remote: value.current.remote ?? '', risk: false };
+      if (e.target.name === 'repo-mode') { draft = { ...d, mode: e.target.value }; paint(); section.querySelector(`input[name="repo-mode"][value="${e.target.value}"]`)?.focus(); }
+      else if (e.target.name === 'repo-risk') draft = { ...d, risk: e.target.checked };
+    });
+    section.addEventListener('input', e => {
+      if (e.target.name !== 'repo-url' || !value?.current) return;
+      draft = { ...(draft ?? { mode: value.current.mode, remote: '', risk: false }), remote: e.target.value };
+    });
+    section.addEventListener('submit', async e => {
+      e.preventDefault();
+      if (saving || !value?.current || state.archived) return;
+      const d = draft ?? { mode: value.current.mode, remote: value.current.remote ?? '', risk: false };
+      const remote = d.mode === 'remote' ? d.remote.trim() : '';
+      if (d.mode === 'remote' && !remote) { outcome = 'Enter a repository URL, or choose Local only.'; paint(); focusUrl(); return; }
+      if (d.mode === 'local-only' && !d.risk) { outcome = LINES['risk-not-accepted']; paint(); section.querySelector('input[name="repo-risk"]')?.focus(); return; }
+      const body = d.mode === 'remote' ? { mode: 'remote', remote, ifRevision: value.current.revision } : { mode: 'local-only', acceptLocalLossRisk: true, ifRevision: value.current.revision };
+      saving = true; outcome = ''; paint();
+      const result = await call(path(), body);
+      if (disposed) return;
+      saving = false;
+      if (result.ok && result.value.receipt) {
+        const r = result.value.receipt, check = checkLine(result.value.check);
+        outcome = `Saved${r.at ? ` at ${r.at}` : ''}. ${r.mode === 'remote' ? `Origin is ${r.origin ?? 'not set'}.` : r.origin == null ? 'Origin removed; local only.' : `Origin is still ${r.origin}.`}${check ? ` Check: ${check}` : ''} Nothing was pushed.`;
+        draft = null;
+      } else outcome = refusalLine(result);
+      await refresh();
+      section.querySelector('[data-project-repo-status]')?.focus({ preventScroll: true });
+    });
+    paint();
+    if (org && ID.test(project ?? '')) refresh();
+  }
+  window.MosaicProjectRepo = Object.freeze({ mount });
+})();

packages/webui/src/serve.mjs

@@ -829,7 +829,7 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
   for (const registerRoutes of routes) registerRoutes(registered);
   registered.add('GET', '/api/themes', (req, res) => themesHTTP(req, res, { log }), { publicRead: true });
   const adminRoute = (req, res, context) => orgAdminHTTP(req, res, { ...context, admin: orgAdmin ??= defaultOrgAdmin(), log, trail });
-  for (const path of ['/api/org-template', '/api/org-presets', '/api/org-validate', '/api/org-admin', /^\/api\/orgs\/[^/]+\/(?:admin|setup|delete|archive|restore|restart|stop)(?:\/(?:queue|bus|project\/[^/]+|records\/[^/]+))?$/]) {
+  for (const path of ['/api/org-template', '/api/org-presets', '/api/org-validate', '/api/org-admin', /^\/api\/orgs\/[^/]+\/(?:admin|setup|repo|delete|archive|restore|restart|stop)(?:\/(?:queue|bus|project\/[^/]+|records\/[^/]+))?$/]) {
     for (const method of ['GET', 'POST']) registered.add(method, path, adminRoute);
   }
   registered.add('POST', '/api/orgs', adminRoute);

packages/webui/tests/org-admin.test.mjs

@@ -31,6 +31,8 @@ function fakes() {
     queueInit: async (ctx, id, opts) => { calls.push(['queueInit', id, opts]); const o = get(id); if (o.queue) throw new OrgError('org-exists', 'repository was already initialized; inspect its receipt'); if (opts.mode === 'local-only' && opts.acceptLocalLossRisk !== true) throw new OrgError('org-risk', 'local-only needs the explicit risk'); o.queue = receipt('org.queue.init', id, { mode: opts.mode }); if (fail.queue) throw new Error('lost'); return o.queue; },
     projectRepoShow: async (ctx, id, project) => { const o = get(id); if (!o.doc.projects?.[project]) throw new OrgError('org-unknown', 'unknown project'); const r = o.repos[project]; if (!r) throw new OrgError('org-unavailable', 'setup receipt unavailable'); return r; },
     projectRepoInit: async (ctx, id, project, opts) => { calls.push(['projectRepoInit', id, project, opts]); const o = get(id); if (fail.project === 'before') throw new Error('crashed'); o.repos[project] = receipt('org.project.repo.init', id, { project, mode: opts.mode }); if (fail.project === 'after') throw new Error('timeout'); return o.repos[project]; },
+    // #1873 P1-7: like C2 projectRepoSet, the revision guards the change and origin follows the mode.
+    projectRepoSet: async (ctx, id, project, opts) => { calls.push(['projectRepoSet', id, project, opts]); const o = get(id); if (fail.repoSet) throw new Error('timeout'); if (o.revision !== opts.ifRevision) throw new OrgError('revision-conflict'); const r = o.repos[project]; o.revision++; const remote = opts.mode === 'remote' ? opts.remote : undefined; o.repos[project] = { ...r, current: { mode: opts.mode, ...(remote ? { remote } : {}), origin: remote ?? null, revision: o.revision, ...(remote ? { check: { result: 'needs-credential', message: 'the repository needs a credential; this check uses none' } } : {}) } }; return receipt('org.project.repo.set', id, { project, mode: opts.mode, ...(remote ? { remote } : {}), root: `/data/org-runtime/${id}/projects/${project}`, revision: o.revision, origin: remote ?? null, ...(remote ? { check: o.repos[project].current.check } : {}) }); },
   };
   const registry = { listOrgs: async () => [...orgs.keys()].map(id => ({ id, state: orgs.get(id).reserved ? 'reserved' : 'active' })) };
   let running = null;
@@ -198,10 +200,11 @@ test('setup resumes from the read-back and never overwrites a receipt', async t
   assert.equal(s.body.projects[0].verb, 'mosaic org project repo init acme work --local-only --accept-local-loss-risk');
   assert.equal(s.body.bus.verb, 'mosaic bus start acme --dev-local-owner --detach');
 
-  // Local only needs the explicit risk; remote needs an https URL.
+  // Local only needs the explicit risk; remote needs an https or ssh URL with no option, helper,
+  // path or credential in it (#1873 P1-6).
   let r = await c.call('POST', '/api/orgs/acme/setup/queue', { mode: 'local-only' });
   assert.equal(r.status, 422); assert.equal(r.body.error, 'risk-not-accepted'); assert.equal(r.body.errors[0].path, '$.acceptLocalLossRisk');
-  for (const remote of ['/srv/git', 'origin', 'ssh://git@host/acme/work', 'https://host/acme/$(id)', 'https://host/a b', 'file:///srv/git']) {
+  for (const remote of ['/srv/git', 'origin', 'https://host/acme/$(id)', 'https://host/a b', 'file:///srv/git', 'ext::sh -c id', '-uhost:x/y', '--upload-pack=touch /tmp/x', 'https://user:token@host/acme/work', 'ssh://git:pw@host/acme/work', 'http://host/acme/work', 'git://host/acme/work', 'ssh://-oProxyCommand=id/acme/work', 'git@host:../etc']) {
     r = await c.call('POST', '/api/orgs/acme/setup/queue', { mode: 'remote', remote });
     assert.equal(r.status, 422, remote); assert.equal(r.body.errors[0].path, '$.remote');
   }
@@ -239,6 +242,71 @@ test('setup resumes from the read-back and never overwrites a receipt', async t
   assert.deepEqual([s.body.queue.state, s.body.projects[0].state, s.body.bus.state], ['done', 'done', 'done']);
 });
 
+test('project repo set (#1873 P1-7): read, change both ways, refuse plainly, nothing before setup', async t => {
+  const c = await console_(t);
+  await c.call('POST', '/api/orgs', { id: 'acme', doc: browserDoc('acme') });
+  // Before setup: the read says so, and a write changes nothing.
+  let r = await c.call('GET', '/api/orgs/acme/repo/project/work');
+  assert.equal(r.status, 200); assert.equal(r.body.state, 'missing'); assert.equal(r.body.verb, 'mosaic org project repo init acme work --local-only --accept-local-loss-risk');
+  r = await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'local-only', acceptLocalLossRisk: true, ifRevision: 1 });
+  assert.equal(r.status, 422); assert.equal(r.body.error, 'invalid');
+  assert.equal(c.calls.filter(x => x[0] === 'projectRepoSet').length, 0);
+
+  assert.equal((await c.call('POST', '/api/orgs/acme/setup/project/work', { mode: 'local-only', acceptLocalLossRisk: true })).status, 201);
+  r = await c.call('GET', '/api/orgs/acme/repo/project/work');
+  assert.equal(r.status, 200, r.raw); assert.equal(r.body.state, 'done'); assert.equal(r.body.current.mode, 'local-only');
+  const rev = r.body.current.revision;
+  assert.equal(r.body.verb, `mosaic org project repo set acme work --local-only --accept-local-loss-risk --if-revision ${rev}`);
+
+  // The same URL rules as setup, before the service is called.
+  for (const remote of ['ext::sh -c id', '-uhost:x/y', 'file:///srv/git', '/srv/git', 'https://user:token@host/acme/work', 'http://host/acme/work']) {
+    r = await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'remote', remote, ifRevision: rev });
+    assert.equal(r.status, 422, remote); assert.equal(r.body.errors[0].path, '$.remote', remote);
+  }
+  for (const ifRevision of [undefined, 0, '1', 1.5]) {
+    r = await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'local-only', acceptLocalLossRisk: true, ...(ifRevision === undefined ? {} : { ifRevision }) });
+    assert.equal(r.status, 422, String(ifRevision)); assert.equal(r.body.errors[0].path, '$.ifRevision');
+  }
+  r = await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'local-only', ifRevision: rev });
+  assert.equal(r.status, 422); assert.equal(r.body.error, 'risk-not-accepted');
+  assert.equal((await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'local-only', acceptLocalLossRisk: true, ifRevision: rev, root: '/x' })).status, 400);
+  assert.equal(c.calls.filter(x => x[0] === 'projectRepoSet').length, 0, 'no refused body reached the service');
+
+  // Local only to ssh remote: the receipt, origin and the check come back.
+  const ssh = '[email protected]:acme/work.git';
+  r = await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'remote', remote: ssh, ifRevision: rev });
+  assert.equal(r.status, 200, r.raw); assert.equal(r.body.outcome, 'done'); assert.equal(r.body.receipt.op, 'org.project.repo.set');
+  assert.equal(r.body.receipt.origin, ssh); assert.equal(r.body.check.result, 'needs-credential');
+  assert.equal(r.body.receipt.root, '<data root>/org-runtime/acme/projects/work');
+  assert.equal(r.body.verb, `mosaic org project repo set acme work --remote ${ssh} --if-revision ${rev}`);
+  assert.deepEqual(c.calls.at(-1), ['projectRepoSet', 'acme', 'work', { mode: 'remote', remote: ssh, ifRevision: rev }]);
+  r = await c.call('GET', '/api/orgs/acme/repo/project/work');
+  assert.equal(r.body.current.mode, 'remote'); assert.equal(r.body.current.origin, ssh); assert.equal(r.body.current.revision, rev + 1);
+  // A stale revision is a plain conflict; then back to local only.
+  r = await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'local-only', acceptLocalLossRisk: true, ifRevision: rev });
+  assert.equal(r.status, 409); assert.equal(r.body.error, 'revision-conflict');
+  r = await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'local-only', acceptLocalLossRisk: true, ifRevision: rev + 1 });
+  assert.equal(r.status, 200, r.raw); assert.equal(r.body.receipt.origin, null); assert.equal(r.body.check, null);
+  // An unknown project or a crash: plain answers.
+  assert.equal((await c.call('GET', '/api/orgs/acme/repo/project/nope')).status, 404);
+  assert.equal((await c.call('POST', '/api/orgs/acme/repo/project/nope', { mode: 'local-only', acceptLocalLossRisk: true, ifRevision: rev + 2 })).body.error, 'project-unknown');
+  c.fail.repoSet = true;
+  r = await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'local-only', acceptLocalLossRisk: true, ifRevision: rev + 2 });
+  assert.equal(r.status, 502); assert.equal(r.body.error, 'outcome-unknown');
+  // The write fence holds: another site, or no --send, changes nothing.
+  c.fail.repoSet = false; const before = c.calls.length;
+  assert.equal((await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'local-only', acceptLocalLossRisk: true, ifRevision: rev + 2 }, { 'sec-fetch-site': 'cross-site' })).status, 403);
+  assert.equal(c.calls.length, before);
+});
+
+test('project repo set without --send or the owner is refused before the service', async t => {
+  for (const opts of [{ send: null }, { sso: null, send: null }]) {
+    const c = await console_(t, opts);
+    const r = await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'local-only', acceptLocalLossRisk: true, ifRevision: 1 });
+    assert.equal(r.status, 403, JSON.stringify(opts)); assert.equal(c.calls.length, 0);
+  }
+});
+
 test('a step whose receipt cannot be read back is never retried', async t => {
   const c = await console_(t);
   await c.call('POST', '/api/orgs', { id: 'acme', doc: browserDoc('acme') });
@@ -399,6 +467,11 @@ test('the Settings page ships the organization assets', async t => {
 test('against the real C2 service: create, set up, resume and refuse an overwrite', async t => {
   const service = await import('../../organization/src/org-service.mjs');
   const registry = await import('../../organization/src/org-registry.mjs');
+  // #1873 P1-6: the remote check goes through the test seam, so this test never leaves the host.
+  const { repoRemoteTestSeam } = await import('../../organization/src/repo-remote.mjs');
+  const checked = []; repoRemoteTestSeam.useCheck(async url => { checked.push(url); return { result: 'needs-credential', message: 'the repository needs a credential; this check uses none' }; });
+  t.after(() => repoRemoteTestSeam.useCheck(null));
+  const { execFileSync } = await import('node:child_process');
   const { mkdtempSync, mkdirSync, existsSync } = await import('node:fs');
   const { join } = await import('node:path'); const { tmpdir } = await import('node:os');
   const root = mkdtempSync(join(tmpdir(), 'oa')); const configDir = join(root, 'config'), dataRoot = join(root, 'data');
@@ -419,6 +492,10 @@ test('against the real C2 service: create, set up, resume and refuse an overwrit
   assert.equal(q.status, 201, q.raw); assert.equal(q.body.receipt.op, 'org.queue.init'); assert.ok(existsSync(join(dataRoot, 'org-runtime/acme/checkout/.git')));
   const p = await c.call('POST', '/api/orgs/acme/setup/project/work', { mode: 'remote', remote: 'https://git.example.invalid/acme/work' });
   assert.equal(p.status, 201, p.raw); assert.equal(p.body.receipt.remote, 'https://git.example.invalid/acme/work');
+  assert.equal(p.body.receipt.origin, 'https://git.example.invalid/acme/work'); assert.equal(p.body.receipt.check.result, 'needs-credential');
+  assert.deepEqual(checked, ['https://git.example.invalid/acme/work']);
+  const remotes = () => execFileSync('git', ['-C', join(dataRoot, 'org-runtime/acme/projects/work'), 'remote', '-v'], { env: { PATH: process.env.PATH, HOME: '/nonexistent', GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null' }, encoding: 'utf8' }).trim();
+  assert.equal(remotes(), 'origin\thttps://git.example.invalid/acme/work (fetch)\norigin\thttps://git.example.invalid/acme/work (push)');
   s = await c.call('GET', '/api/orgs/acme/setup');
   assert.deepEqual([s.body.queue.state, s.body.projects[0].state], ['done', 'done']);
   assert.equal(s.body.queue.receipt.root, '<data root>/org-runtime/acme/checkout');
@@ -433,9 +510,60 @@ test('against the real C2 service: create, set up, resume and refuse an overwrit
   assert.equal(stale.status, 409); assert.equal(stale.body.error, 'revision-conflict');
   const saved = await c.call('POST', '/api/orgs/acme/admin', { doc: shown.body.doc, ifRevision: shown.body.revision });
   assert.equal(saved.status, 200, saved.raw); assert.equal(saved.body.receipt.op, 'org.update');
+  // #1873 P1-7: the project's repository, changed from Settings: to local only and back to ssh.
+  let repo = await c.call('GET', '/api/orgs/acme/repo/project/work');
+  assert.equal(repo.status, 200, repo.raw); assert.equal(repo.body.current.mode, 'remote'); assert.equal(repo.body.current.origin, 'https://git.example.invalid/acme/work'); assert.equal(repo.body.current.check.result, 'needs-credential');
+  let set = await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'local-only', acceptLocalLossRisk: true, ifRevision: repo.body.current.revision });
+  assert.equal(set.status, 200, set.raw); assert.equal(set.body.receipt.op, 'org.project.repo.set'); assert.equal(set.body.receipt.origin, null); assert.equal(remotes(), '');
+  repo = await c.call('GET', '/api/orgs/acme/repo/project/work');
+  set = await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'remote', remote: 'ssh://[email protected]/acme/work.git', ifRevision: repo.body.current.revision });
+  assert.equal(set.status, 200, set.raw); assert.equal(set.body.check.result, 'needs-credential');
+  assert.equal(remotes(), 'origin\tssh://[email protected]/acme/work.git (fetch)\norigin\tssh://[email protected]/acme/work.git (push)');
+  assert.doesNotMatch(JSON.stringify([set.body, repo.body]), new RegExp(root.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')), 'no server path reaches the browser');
   assert.doesNotMatch(JSON.stringify([tpl.body, s.body, shown.body]), new RegExp(root.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')), 'no server path reaches the browser');
 });
 
+// #1873 F7: Settings cannot change the repository of a project an approved or active copy binding
+// names. The refusal is 409 with the copies and the next step; after revoke the same save goes through.
+test('against the real C2 service: repo set is refused under a copy binding and allowed after revoke', async t => {
+  const service = await import('../../organization/src/org-service.mjs');
+  const registry = await import('../../organization/src/org-registry.mjs');
+  const { repoRemoteTestSeam } = await import('../../organization/src/repo-remote.mjs');
+  let checks = 0; repoRemoteTestSeam.useCheck(async () => { checks++; return { result: 'reachable', message: 'the repository answered' }; });
+  t.after(() => repoRemoteTestSeam.useCheck(null));
+  const { createHash } = await import('node:crypto');
+  const root = mkdtempSync(join(tmpdir(), 'oa')); const configDir = join(root, 'config'), dataRoot = join(root, 'data');
+  mkdirSync(configDir, { mode: 0o700 }); mkdirSync(dataRoot, { mode: 0o700 });
+  const admin = createOrgAdmin({ service, registry, bus: null, context: async () => ({ configDir, dataRoot, instance: 'test' }) });
+  const c = await console_(t, { orgAdmin: admin });
+  const tpl = await c.call('GET', '/api/org-template?id=acme');
+  assert.equal((await c.call('POST', '/api/orgs', { id: 'acme', doc: tpl.body.doc })).status, 201);
+  assert.equal((await c.call('POST', '/api/orgs/acme/setup/project/work', { mode: 'local-only', acceptLocalLossRisk: true })).status, 201);
+  const seed = state => {
+    const docFile = join(configDir, 'businesses/acme.json'); const doc = JSON.parse(readFileSync(docFile, 'utf8'));
+    doc.copyBindings = { rev: { copyId: '1'.repeat(32), orgIncarnation: 'a'.repeat(32), source: { level: 'root', name: 'rev', project: null },
+      definition: { ref: 'reviewer', rev: null, sha256: 'b'.repeat(64) }, generation: 1, state,
+      services: state === 'unbound' ? {} : { gitea: { slot: 'self', scopes: ['read:repository'], resources: { projects: ['work'] }, ...(state === 'bound' ? { rotateBy: '2099-01-01', grantId: 'gitea:5:7', grantGeneration: 1 } : {}) } },
+      decision: '11111111-1111-4111-8111-111111111111' } };
+    const raw = JSON.stringify(doc, null, 2) + '\n'; writeFileSync(docFile, raw);
+    const regFile = join(configDir, 'org-runtime.json'); const reg = JSON.parse(readFileSync(regFile, 'utf8'));
+    reg.orgs.acme.digest = createHash('sha256').update(raw).digest('hex'); writeFileSync(regFile, JSON.stringify(reg, null, 2) + '\n');
+  };
+  const remote = 'https://git.example.invalid/acme/other';
+  for (const [state, label] of [['pending', 'approved, not yet verified'], ['bound', 'active']]) {
+    seed(state);
+    const rev = (await c.call('GET', '/api/orgs/acme/repo/project/work')).body.current.revision;
+    const r = await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'remote', remote, ifRevision: rev });
+    assert.equal(r.status, 409, r.raw); assert.equal(r.body.error, 'project-repo-bound'); assert.equal(r.body.step, 'repo');
+    assert.equal(r.body.message, `project work is in a copy binding that still grants it: rev (${label}). Revoke that copy binding first (the chief raises an unbind decision and the owner approves it), then set the repository, then ask the chief to raise a new binding decision`);
+  }
+  assert.equal(checks, 0);
+  seed('unbound');
+  const rev = (await c.call('GET', '/api/orgs/acme/repo/project/work')).body.current.revision;
+  const r = await c.call('POST', '/api/orgs/acme/repo/project/work', { mode: 'remote', remote, ifRevision: rev });
+  assert.equal(r.status, 200, r.raw); assert.equal(r.body.receipt.origin, remote); assert.equal(checks, 1);
+});
+
 test('preset routes expose installed choices and refuse invalid queries', async t => {
   const service = await import('../../organization/src/org-service.mjs');
   const admin = createOrgAdmin({ service, context: async () => ({ configDir: '/cfg', dataRoot: '/data', instance: 'test' }) });

packages/webui/tests/org-quick-browser.test.mjs

@@ -115,3 +115,44 @@ test('an unreadable success reply stops quick setup and a new draft gets fresh c
   assert.deepEqual(await controls(), [false, false, false]);
   assert.equal(await b.evaluate(`document.querySelector('#org-risk-accept').checked`), false);
 });
+
+// #1873 P1-6: Quick Setup in remote mode sets the project checkout's origin, checks it once (here
+// through the test seam, so nothing leaves the host) and shows the outcome on the project step.
+test('quick setup in remote mode sets origin and shows the check', { timeout: 45000 }, async t => {
+  const { mkdtempSync, mkdirSync, rmSync } = await import('node:fs');
+  const { tmpdir } = await import('node:os'); const { join } = await import('node:path'); const { execFileSync } = await import('node:child_process');
+  const registry = await import('../../organization/src/org-registry.mjs');
+  const { repoRemoteTestSeam } = await import('../../organization/src/repo-remote.mjs');
+  const remote = 'https://git.example.invalid/alpha/work';
+  const checked = []; repoRemoteTestSeam.useCheck(async url => { checked.push(url); return { result: 'unreachable', message: 'Could not resolve host: git.example.invalid' }; });
+  t.after(() => repoRemoteTestSeam.useCheck(null));
+  const dir = mkdtempSync(join(tmpdir(), 'quick-'));
+  const configDir = join(dir, 'config'), dataRoot = join(dir, 'data'); mkdirSync(configDir, { mode: 0o700 }); mkdirSync(dataRoot, { mode: 0o700 });
+  let starts = 0;
+  const bus = { busStatus: async () => ({ healthy: false }), busStart: async () => { starts++; return { healthy: true }; } };
+  const admin = createOrgAdmin({ service, registry, bus, context: async () => ({ configDir, dataRoot, instance: 'test' }) });
+  const projects = [];
+  const organizations = {
+    list: async () => starts ? [{ id: 'alpha', label: 'alpha', busHealthy: true }] : [],
+    resolve: async id => id === 'alpha' ? { send: async () => ({}), busHealthy: true, chat: {
+      projects: async () => projects, threads: async () => [],
+      createProject: async args => { const row = { id: '20000000-0000-4000-8000-000000000002', ...args }; projects.push(row); return row; },
+    } } : null,
+  };
+  const server = await startServer({ port: 0, sso: createDevOwner(), organizations, orgAdmin: admin, send: async () => ({}), board: 'http://127.0.0.1:9', log: () => {} }); t.after(() => close(server));
+  const b = await browser({ machine: false, args: ['--disable-extensions'] }); t.after(() => b.close());
+  t.after(() => rmSync(dir, { recursive: true, force: true }));
+  const wait = expression => b.evaluate(`(async()=>{for(let i=0;i<300;i++){if(${expression})return;await new Promise(r=>setTimeout(r,30))}throw Error(${JSON.stringify(expression)})})()`);
+  await b.navigate(`http://127.0.0.1:${server.address().port}/#/settings/organizations`);
+  await wait('document.querySelector("#org-new-form [data-write]") && !document.querySelector("#org-new-form [data-write]").disabled');
+  await b.evaluate(`document.querySelector('#org-new-id').value='alpha';document.querySelector('#org-new-form [data-write]').click()`);
+  await wait('document.querySelector("#org-quick-open") && !document.querySelector("#org-paths").hidden');
+  await b.evaluate(`document.querySelector('#org-quick-open').click();document.querySelector('#org-project-remote').value=${JSON.stringify(remote)};document.querySelector('#org-risk-accept').click();document.querySelector('#org-quick-run').click()`);
+  await wait(`document.querySelector('[data-quick-step="5"] .org-pill')?.textContent === 'Done'`);
+  assert.equal((await b.evaluate(`document.querySelector('[data-remote-check]')?.textContent ?? ''`)).trim(), `Remote check: unreachable, Could not resolve host: git.example.invalid. Origin: ${remote}.`);
+  assert.deepEqual(checked, [remote]);
+  const git = (...args) => execFileSync('git', ['-C', join(dataRoot, 'org-runtime/alpha/projects/work'), ...args], { env: { PATH: process.env.PATH, HOME: '/nonexistent', GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null' }, encoding: 'utf8' }).trim();
+  assert.equal(git('remote', '-v'), `origin\t${remote} (fetch)\norigin\t${remote} (push)`);
+  // The organization checkout stays local only.
+  assert.equal(execFileSync('git', ['-C', join(dataRoot, 'org-runtime/alpha/checkout'), 'remote', '-v'], { env: { PATH: process.env.PATH, HOME: '/nonexistent', GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null' }, encoding: 'utf8' }).trim(), '');
+});

packages/webui/tests/project-repo-browser.test.mjs

@@ -0,0 +1,242 @@
+// #1873 P1-7 (ruling 11): an organization project's Repository on its Settings tab is editable. The
+// Console, its per-organization routes, the org-admin route and the real organization service are
+// real; the organization's bus transports are a small fake, and the remote check goes through the
+// test seam, so nothing leaves the host. The page sets a remote, is refused a bad URL and a stale
+// revision, switches to local only and back, and `git remote -v` in the checkout follows each step.
+// MOSAIC_UX_SHOTS=<dir> also writes light and dark shots at 1440x900 and 390x844.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { startServer } from '../src/serve.mjs';
+import { createDevOwner } from '../src/dev-owner.mjs';
+import { createOrgAdmin } from '../src/org-admin.mjs';
+import * as service from '../../organization/src/org-service.mjs';
+import * as registry from '../../organization/src/org-registry.mjs';
+import { repoRemoteTestSeam } from '../../organization/src/repo-remote.mjs';
+import { browser } from './browser.mjs';
+import { close } from './fixture.mjs';
+
+const P = '10000000-0000-4000-8000-0000000000c1';
+const NEEDS = { result: 'needs-credential', message: 'the repository needs a credential; this check uses none' };
+const waitFor = b => expression => b.evaluate(`(async()=>{for(let i=0;i<300;i++){if(${expression})return true;await new Promise(r=>setTimeout(r,30))}throw Error(${JSON.stringify(expression)}+' | '+(document.querySelector('main')?.innerText||'').slice(0,1500))})()`);
+const text = (b, selector) => b.evaluate(`(document.querySelector(${JSON.stringify(selector)})?.innerText ?? '').replace(/\\s+/g, ' ').trim()`);
+const click = (b, selector) => b.evaluate(`(document.querySelector(${JSON.stringify(selector)}).click(), true)`);
+const fill = (b, selector, value) => b.evaluate(`(e => { e.value = ${JSON.stringify(value)}; e.dispatchEvent(new Event('input', { bubbles: true })); return true; })(document.querySelector(${JSON.stringify(selector)}))`);
+// A same-origin call from the page, so the write fence sees a real browser request.
+const api = (b, path, body) => b.evaluate(`fetch(${JSON.stringify(path)}, ${body === undefined ? '{}' : `{ method: 'POST', headers: { 'content-type': 'application/json' }, body: ${JSON.stringify(JSON.stringify(body))} }`}).then(async r => ({ status: r.status, body: await r.json() }))`);
+
+// One running organization whose chat project "Work" is the organization project `work`.
+function organizations() {
+  const business = { business: { id: 'acme', human: 'local-dev-owner', arbiters: [], projects: [P], vars: {}, instances: [], appearance: { theme: null } } };
+  return {
+    list: async () => [{ id: 'acme', label: 'Acme', theme: null, busHealthy: true }],
+    resolve: async id => id !== 'acme' ? null : ({
+      busHealthy: true, send: async () => ({}),
+      reads: { business: async () => business, settings: async () => ({}), queue: async () => ({ rows: [] }), busStatus: async () => ({}) },
+      bus: { instances: async () => ({ business: 'acme', revision: 'a'.repeat(64), launch: true, noHire: [], retired: [], definitions: {}, instances: {} }),
+        messages: async () => ({ messages: [], unread: 0 }), agents: async () => [], 'thread.claims': async () => [], inbox: async () => [], tasks: async () => [] },
+      chat: { projects: async () => [{ id: P, name: 'Work', repo: 'work' }], threads: async () => [] },
+    }),
+  };
+}
+
+async function console_(t, { send = true, width = 1440, height = 900, root = null } = {}) {
+  const fresh = root === null; root ??= mkdtempSync(join(tmpdir(), 'prb')); const configDir = join(root, 'config'), dataRoot = join(root, 'data');
+  if (fresh) { mkdirSync(configDir, { mode: 0o700 }); mkdirSync(dataRoot, { mode: 0o700 }); }
+  const orgAdmin = createOrgAdmin({ service, registry, bus: null, context: async () => ({ configDir, dataRoot, instance: 'test' }) });
+  const server = await startServer({ port: 0, sso: createDevOwner(), ...(send ? { send: async () => ({}) } : {}), organizations: organizations(), orgAdmin, log: () => {} });
+  t.after(() => close(server));
+  const b = await browser({ machine: false, args: ['--disable-extensions'] }); t.after(() => b.close());
+  const errors = [];
+  b.on('Runtime.exceptionThrown', p => errors.push(p.exceptionDetails?.exception?.description ?? p.exceptionDetails?.text ?? 'exception'));
+  await b.viewport(width, height);
+  const base = `http://127.0.0.1:${server.address().port}/`;
+  const checkout = join(dataRoot, 'org-runtime/acme/projects/work');
+  const git = (...args) => execFileSync('git', ['-C', checkout, ...args], { env: { PATH: process.env.PATH, HOME: '/nonexistent', GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null' }, encoding: 'utf8' }).trim();
+  const remotes = () => git('remote', '-v');
+  return { b, base, wait: waitFor(b), errors, root, remotes, git, receipts: join(dataRoot, 'org-runtime/acme/receipts.jsonl') };
+}
+
+// Create the organization and set the project up local-only, as Quick Setup does, through the routes.
+async function seed(p) {
+  await p.b.navigate(`${p.base}#/orgs/acme/organization`);
+  const tpl = await api(p.b, '/api/org-template?id=acme');
+  assert.equal(tpl.status, 200, JSON.stringify(tpl.body));
+  const made = await api(p.b, '/api/orgs', { id: 'acme', doc: tpl.body.doc });
+  assert.equal(made.status, 201, JSON.stringify(made.body));
+  const set = await api(p.b, '/api/orgs/acme/setup/project/work', { mode: 'local-only', acceptLocalLossRisk: true });
+  assert.equal(set.status, 201, JSON.stringify(set.body));
+}
+const settings = async ({ b, base, wait }) => {
+  await b.navigate(`${base}#/orgs/acme/projects/${P}/settings`);
+  await wait('document.querySelector("[data-project-repo]") && !/Reading the repository/.test(document.querySelector("[data-project-repo]").textContent)');
+};
+// A fresh page load, so the section reads the repository again rather than reusing its last view.
+const reread = async p => { await p.b.evaluate('location.reload(), true'); await new Promise(r => setTimeout(r, 200)); await settings(p); };
+const facts = b => b.evaluate(`['mode', 'url', 'origin', 'check'].map(k => document.querySelector('[data-repo-' + k + ']')?.textContent ?? null)`);
+const save = async ({ b, wait }, pattern) => {
+  await b.evaluate(`document.querySelector('[data-project-repo-status]').textContent = '', true`);
+  await click(b, '[data-project-repo-form] button[type=submit]');
+  await wait(`${pattern}.test(document.querySelector('[data-project-repo-status]')?.textContent)`);
+  return text(b, '[data-project-repo-status]');
+};
+
+test('the owner edits the repository on Settings: remote, refusals, local only and back, origin follows', { timeout: 90000 }, async t => {
+  const checked = []; repoRemoteTestSeam.useCheck(async url => { checked.push(url); return url.includes('down.invalid') ? { result: 'unreachable', message: 'Could not resolve host: down.invalid' } : NEEDS; });
+  t.after(() => repoRemoteTestSeam.useCheck(null));
+  const p = await console_(t); const { b } = p;
+  await seed(p);
+  assert.equal(p.remotes(), '');
+  await settings(p);
+  assert.deepEqual(await facts(b), ['Local only', 'None (local only)', 'None', 'None (local only has no remote)']);
+  assert.match(await text(b, '[data-repo-verb]'), /^mosaic org project repo set acme work --local-only --accept-local-loss-risk --if-revision \d+$/);
+
+  // Remote, https: origin is set, the check is reported in plain words, nothing is pushed.
+  await click(b, '[data-project-repo-form] input[name=repo-mode][value=remote]');
+  assert.equal(await b.evaluate('document.activeElement?.value'), 'remote', 'focus stays on the radio it changed');
+  const https = 'https://git.example.invalid/acme/work';
+  await fill(b, '#project-repo-url', https);
+  const saved = await save(p, '/Saved/');
+  assert.match(saved, new RegExp(`^Saved at \\S+\\. Origin is ${https.replace(/[.]/g, '\\.')}\\. Check: Needs a credential: the repository needs a credential; this check uses none\\. Nothing was pushed\\.$`));
+  assert.equal(await b.evaluate(`document.activeElement?.hasAttribute('data-project-repo-status')`), true);
+  assert.deepEqual(await facts(b), ['Remote', https, https, 'Needs a credential: the repository needs a credential; this check uses none.']);
+  assert.equal(p.remotes(), `origin\t${https} (fetch)\norigin\t${https} (push)`);
+  assert.deepEqual(checked, [https]);
+
+  // URLs the rules refuse never reach git, and origin stays as it was.
+  for (const [bad, why] of [['ext::sh -c id', /transport helper/], ['https://user:[email protected]/acme/work', /credential/], ['-uhost:x/y', /must not start with "-"/]]) {
+    await fill(b, '#project-repo-url', bad);
+    const line = await save(p, '/./');
+    assert.match(line, why, bad); assert.doesNotMatch(line, /Saved/, bad);
+    assert.equal(await b.evaluate(`document.querySelector('#project-repo-url').value`), bad, 'the entry is kept');
+  }
+  assert.deepEqual(checked, [https]);
+  assert.equal(p.remotes(), `origin\t${https} (fetch)\norigin\t${https} (push)`);
+
+  // An unreachable remote is still saved; the git error is summarized.
+  const down = 'ssh://[email protected]/acme/work.git';
+  await fill(b, '#project-repo-url', down);
+  assert.match(await save(p, '/Saved/'), /Check: Unreachable: Could not resolve host: down\.invalid\. Nothing was pushed\.$/);
+  assert.equal(p.remotes(), `origin\t${down} (fetch)\norigin\t${down} (push)`);
+
+  // Another write changed the organization meanwhile: the first try is refused, the second lands.
+  const shown = await api(b, '/api/orgs/acme/admin');
+  assert.equal((await api(b, '/api/orgs/acme/admin', { doc: shown.body.doc, ifRevision: shown.body.revision })).status, 200);
+  await click(b, '[data-project-repo-form] input[name=repo-mode][value=local-only]');
+  await click(b, '[data-project-repo-form] input[name=repo-risk]');
+  assert.match(await save(p, '/changed after this page read it/'), /your entry is kept/);
+  assert.equal(p.remotes(), `origin\t${down} (fetch)\norigin\t${down} (push)`);
+
+  // Local only needs the risk box; with it, origin is removed.
+  assert.equal(await b.evaluate(`document.querySelector('[data-project-repo-form] input[name=repo-risk]').checked`), true, 'the draft survived the refusal');
+  await click(b, '[data-project-repo-form] input[name=repo-risk]');
+  assert.equal(await save(p, '/Tick the box/'), 'Tick the box to accept that a local-only repository has no copy anywhere else.');
+  await click(b, '[data-project-repo-form] input[name=repo-risk]');
+  assert.match(await save(p, '/Saved/'), /^Saved at \S+\. Origin removed; local only\. Nothing was pushed\.$/);
+  assert.deepEqual(await facts(b), ['Local only', 'None (local only)', 'None', 'None (local only has no remote)']);
+  assert.equal(p.remotes(), '');
+
+  // And back to remote, scp-like ssh.
+  const scp = '[email protected]:acme/work.git';
+  await click(b, '[data-project-repo-form] input[name=repo-mode][value=remote]');
+  await fill(b, '#project-repo-url', scp);
+  assert.match(await save(p, '/Saved/'), new RegExp(`Origin is ${scp.replace(/[.]/g, '\\.')}\\.`));
+  assert.equal(p.remotes(), `origin\t${scp} (fetch)\norigin\t${scp} (push)`);
+  const receipts = (await api(b, '/api/orgs/acme/repo/project/work')).body;
+  assert.equal(receipts.current.mode, 'remote'); assert.equal(receipts.current.origin, scp);
+  assert.equal(await b.evaluate(`document.querySelector('[data-repo-drift]')`), null, 'origin matches: no drift line');
+
+  // #1873 review F2: origin moved away from the recorded URL (a save that stopped after setting
+  // origin). The page says so; saving the recorded URL again repairs it.
+  p.git('remote', 'set-url', 'origin', 'https://elsewhere.invalid/x/y');
+  await reread(p);
+  assert.deepEqual(await facts(b), ['Remote', scp, 'https://elsewhere.invalid/x/y', 'Needs a credential: the repository needs a credential; this check uses none; the ssh host key was not verified.']);
+  assert.equal(await text(b, '[data-repo-drift]'), 'Git origin differs from the recorded repository; save it again to repair.');
+  await save(p, '/Saved/');
+  assert.equal(p.remotes(), `origin\t${scp} (fetch)\norigin\t${scp} (push)`);
+  assert.equal(await b.evaluate(`document.querySelector('[data-repo-drift]')`), null);
+  // A recorded check of another URL is not shown as this URL's check.
+  const lines = readFileSync(p.receipts, 'utf8').trim().split('\n').map(l => JSON.parse(l));
+  lines.at(-1).check.url = 'https://git.example.invalid/acme/other'; writeFileSync(p.receipts, lines.map(l => JSON.stringify(l)).join('\n') + '\n');
+  await reread(p);
+  assert.equal((await facts(b))[3], 'Not recorded for this URL');
+  assert.doesNotMatch(await b.evaluate('document.body.innerText'), new RegExp(p.root.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')), 'no server path reaches the page');
+  assert.deepEqual(p.errors, []);
+});
+
+// #1873 F7: an active copy binding names the project, so Settings is refused with the copy and the
+// next step, the entry is kept and git is untouched; after the binding is revoked the same save lands.
+test('Settings refuses the repository change under an active copy binding and saves after revoke', { timeout: 60000 }, async t => {
+  repoRemoteTestSeam.useCheck(async () => NEEDS); t.after(() => repoRemoteTestSeam.useCheck(null));
+  const p = await console_(t); const { b } = p;
+  await seed(p);
+  const configDir = join(p.root, 'config');
+  const bind = state => {
+    const docFile = join(configDir, 'businesses/acme.json'); const doc = JSON.parse(readFileSync(docFile, 'utf8'));
+    doc.copyBindings = { rev: { copyId: '1'.repeat(32), orgIncarnation: 'a'.repeat(32), source: { level: 'root', name: 'rev', project: null },
+      definition: { ref: 'reviewer', rev: null, sha256: 'b'.repeat(64) }, generation: 1, state,
+      services: state === 'unbound' ? {} : { gitea: { slot: 'self', scopes: ['read:repository'], resources: { projects: ['work'] }, rotateBy: '2099-01-01', grantId: 'gitea:5:7', grantGeneration: 1 } },
+      decision: '11111111-1111-4111-8111-111111111111' } };
+    const raw = JSON.stringify(doc, null, 2) + '\n'; writeFileSync(docFile, raw);
+    const regFile = join(configDir, 'org-runtime.json'); const reg = JSON.parse(readFileSync(regFile, 'utf8'));
+    reg.orgs.acme.digest = createHash('sha256').update(raw).digest('hex'); writeFileSync(regFile, JSON.stringify(reg, null, 2) + '\n');
+  };
+  bind('bound');
+  await settings(p);
+  const url = 'https://git.example.invalid/acme/work';
+  await click(b, '[data-project-repo-form] input[name=repo-mode][value=remote]');
+  await fill(b, '#project-repo-url', url);
+  assert.equal(await save(p, '/copy binding/'), 'project work is in a copy binding that still grants it: rev (active). Revoke that copy binding first (the chief raises an unbind decision and the owner approves it), then set the repository, then ask the chief to raise a new binding decision');
+  assert.equal(await b.evaluate(`document.querySelector('#project-repo-url').value`), url, 'the entry is kept');
+  assert.equal(p.remotes(), '');
+  bind('unbound');
+  assert.match(await save(p, '/Saved/'), new RegExp(`Origin is ${url.replace(/[.]/g, '\\.')}\\.`));
+  assert.equal(p.remotes(), `origin\t${url} (fetch)\norigin\t${url} (push)`);
+  assert.deepEqual(p.errors, []);
+});
+
+test('a read-only Console shows the setting, refuses the change in plain words and git is untouched', { timeout: 60000 }, async t => {
+  repoRemoteTestSeam.useCheck(async () => NEEDS); t.after(() => repoRemoteTestSeam.useCheck(null));
+  // Seed through a send-mode Console, then open the same organization in one without send mode.
+  const p = await console_(t); await seed(p);
+  const q = await console_(t, { send: false, root: p.root }); const { b } = q;
+  await settings(q);
+  assert.deepEqual(await facts(b), ['Local only', 'None (local only)', 'None', 'None (local only has no remote)']);
+  await click(b, '[data-project-repo-form] input[name=repo-mode][value=remote]');
+  await fill(b, '#project-repo-url', 'https://git.example.invalid/acme/work');
+  assert.equal(await save(q, '/only reads/'), 'This Console only reads. Changing the repository needs signed-in send mode.');
+  assert.equal(p.remotes(), '');
+  assert.deepEqual(q.errors, []);
+});
+
+test('the Repository section fits 1440x900 and a phone in light and dark', { timeout: 90000 }, async t => {
+  repoRemoteTestSeam.useCheck(async () => NEEDS); t.after(() => repoRemoteTestSeam.useCheck(null));
+  const shots = process.env.MOSAIC_UX_SHOTS;
+  if (shots) mkdirSync(shots, { recursive: true });
+  for (const [width, height] of [[1440, 900], [390, 844]]) {
+    const p = await console_(t, { width, height }); const { b } = p;
+    await seed(p);
+    await settings(p);
+    await click(b, '[data-project-repo-form] input[name=repo-mode][value=remote]');
+    await fill(b, '#project-repo-url', 'https://git.example.invalid/acme/work');
+    await save(p, '/Saved/');
+    for (const mode of ['light', 'dark']) {
+      await b.call('Emulation.setEmulatedMedia', { features: [{ name: 'prefers-color-scheme', value: mode }] });
+      if (await b.evaluate(`document.getElementById('theme-switch').getAttribute('aria-checked')`) !== String(mode === 'dark')) {
+        await b.evaluate(`document.getElementById('theme-switch').click(), true`);
+        await p.wait(`document.getElementById('theme-switch').getAttribute('aria-checked') === '${mode === 'dark'}'`);
+      }
+      await b.evaluate(`document.querySelector('[data-project-repo]').scrollIntoView({ block: 'start' }), true`);
+      if (width === 390) assert.equal(await b.evaluate('document.documentElement.scrollWidth <= document.documentElement.clientWidth'), true, `page ${width} ${mode}`);
+      assert.equal(await b.evaluate(`(s => s.scrollWidth <= s.clientWidth && s.getBoundingClientRect().right <= document.documentElement.clientWidth)(document.querySelector('[data-project-repo]'))`), true, `section ${width} ${mode}`);
+      assert.equal(await b.evaluate(`[...document.querySelectorAll('[data-project-repo] .project-repo-option')].every(o => o.getBoundingClientRect().height >= 44)`), true, `targets ${width} ${mode}`);
+      assert.equal(await b.evaluate(`document.querySelector('#project-repo-url').getBoundingClientRect().height >= 44`), true, `url field ${width} ${mode}`);
+      if (shots) await b.screenshot(join(shots, `p1-7-project-repo-${width}-${mode}.png`));
+    }
+    assert.deepEqual(p.errors, []);
+  }
+});