plans: #436b approved at r5 1be535aca (dewey-0763); build carry N9 (restart after a revoke on an open rotation, 404 on delete by id is done) and N10 (serviceLeft a list); DESIGN.md unchanged; no code change

plans: #436b design r5 on dewey-0761: revoke on an open rotation deletes both previousTokenId and the minted tokenId, failures to serviceLeft (X-G5); N8 step 0 refuses grant-token-unknown while held; section 7 unchanged; no code change
plans: #436b design r4 on dewey-0759: item 1 option (b) per sage-1578 (step 0 refusal unspent only until the next start, cost in D5, X-G11 restart case); item 2 settle 200 unknown id drops memory, deletes nothing, grant-token-unknown, held at start; N7 secretCheck in 3d; duckworth-0067 N1 kind filter, X-G15; section 7 unchanged; no code change
2026-10-20 18:36:07 -05:00 · 2026-10-20 18:35:14 -05:00 · 2026-10-20 18:33:29 -05:00 · 2026-10-20 18:27:52 -05:00 · 2026-10-20 17:55:11 -05:00 · 2026-10-20 17:49:30 -05:00
88 changed files with 4381 additions and 1915 deletions
@@ -19,6 +19,10 @@ not fleet seats. Keep changes in `/mnt/storage/src/mosaic-stack`; do not modify
 | Launchpad | Builder, MVP T1 row 192 (Q175 SSO phase 1) | T3 session (Claude, Opus 5.5), started by Sage under mos-0974/0977 | none, T3 only |
 | Morgana | Builder, MVP T1 row 193 (human users and RBAC) | T3 session (Claude, Opus 5.5), started by Sage under mos-0974/0977 | none, T3 only |
 | Honker | Builder, MVP T1 row 194 (agent lifecycle) | T3 session (Claude, Opus 5.5), started by Sage under mos-0974/0977 | none, T3 only |
+| Gander | Builder, the human boundary across uids (P19 333, #1694) | T3 session (Codex, gpt-6.1-sol), started by Sage under mos-0977 | none, T3 only |
+| Herb | Builder, a second gate lane (#1695) | T3 session (Codex, gpt-6.1-sol), started by Sage under mos-0977 | none, T3 only |
+| Bushroot | Builder, retire the control board writer on 7331 (#1696) | T3 session (Claude, claude-haiku-5-5), started by Sage under mos-1008 | none, T3 only |
+| Megavolt | Builder, MVP T1 item 6 (agent credentials and git identity, #1697) | T3 session (Claude, Opus 5.5), started by Sage under mos-0974/0977 | none, T3 only |
 | Webby | Reviewer: Case 2 designs, rows 192 and 194 | T3 session (Claude, Opus 5.5, thread 03086006), started by Mos (mos-0981) | none, T3 only |
 | Duckworth | Reviewer: federation designs, row 193 | T3 session (Claude, Opus 5.5, thread ffceafec), started by Mos (mos-0977) | none, T3 only |
 | Sage | Project lead: coordination, review, integration; earlier DYOR strategy records retained | T3 session (Claude Code); Pi launcher `zai/glm-5.3:high` retained | `agents/sage/launch.sh` |
@@ -0,0 +1,8 @@
+# Bushroot
+
+Builder seat, Claude Haiku 5.5, started by Sage under mos-1008 item 2 (a low-level model under Q177) for the row
+that retires the control board writer on 7331 (#1696).
+
+No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
+credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `bushroot/*`
+branches through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -3,5 +3,5 @@
 Reviewer seat, Claude Opus 5.5, started by Mos (mos-0977, thread ffceafec). Reviews federation designs and MVP T1 row 193.

 No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until row 195 settles per-agent identity, it pushes only its own `duckworth/*` branches
+credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `duckworth/*` branches
 through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -0,0 +1,8 @@
+# Gander
+
+Builder seat, Codex gpt-6.1-sol, started by Sage under mos-0977 item 5 (more Codex Sol rows) for the human
+boundary row (P19 333, #1694, mos-0989).
+
+No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
+credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `gander/*`
+branches through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -0,0 +1,8 @@
+# Herb
+
+Builder seat, Codex gpt-6.1-sol, started by Sage under mos-0977 item 5 (more Codex Sol rows) for a second gate lane
+design row (#1695, mos-0977 item 6).
+
+No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
+credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `herb/*`
+branches through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -3,5 +3,5 @@
 Builder seat, Claude Opus 5.5, started by Sage for MVP T1 row 194 (agent lifecycle, #1692) under mos-0974 and mos-0977.

 No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until row 195 settles per-agent identity, it pushes only its own `honker/*` branches
+credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `honker/*` branches
 through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -3,5 +3,5 @@
 Builder seat, Claude Opus 5.5, started by Sage for MVP T1 row 192 (Q175 SSO phase 1, #1690) under mos-0974 and mos-0977.

 No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until row 195 settles per-agent identity, it pushes only its own `launchpad/*` branches
+credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `launchpad/*` branches
 through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -1,178 +0,0 @@
-# Row 192: Q175 phase 1, the Console verifies sign-in itself (`--sso`)
-
-Launchpad, 2026-10-20. Author Launchpad, reviewer Webby, gate owner Sage. Issue #1690. Brief
-`docs/plans/2026-10-20_sso-phase1.md`. Design `agents/sage/work/q175-sso/DESIGN.md` (blob 9e3eadb15c80).
-Rulings sage-1340 (F1 to F6) and sage-1347 (F7, F8). Plan launchpad-0001.
-
-Base 53bb59462 (`base.txt`). Candidate: branch `launchpad/row192`, r1 83b32d8d8 and the round 2 commit on it.
-`candidate-manifest.sha256` lists the 18 changed code, test and doc paths; the packet files are not in it. Drift
-check at the r2 commit: `git log 53bb59462..origin/refactor` (origin/refactor ae3c36f24) touches none of the 18 paths.
-
-No request in any test goes to auth.diversecanvas.com, mosaic.woltje.com or 127.0.0.1:7332. Every provider
-is the fake OP in `tests/helpers/fake-oidc.mjs`: https on 127.0.0.1 with a throwaway self-signed certificate,
-and a fetch that refuses any other origin. The public Host in the tests is `console.example.test`, sent as a
-header to the test's own loopback listener. No test reads or writes `~/.mosaic-dev`, `~/.config/mosaic-dev`,
-`~/.mosaic`, a slot file outside its temp dir, or a live unit.
-
-## Files
-
-| Path | Change |
-| --- | --- |
-| `package.json`, `package-lock.json` | `oauth4webapi` 3.8.8, exact, at the root (design: the copy runs `npm ci` there). No other dependency. |
-| `scripts/mosaic-config.mjs` | Accepts an optional `console.sso` key and checks it with `checkConsole`. Without the key, output is byte-identical (F2). |
-| `scripts/test-config.sh` | Test 25: a good `console.sso` passes; each refusal class refuses. 31/31. |
-| `packages/webui/src/sso-config.mjs` (new) | `checkConsole`: shape, `publicOrigin`, 1 to 8 providers, issuer https with a trailing slash, slot names, `ALGS` (asymmetric only), 1 to 64 subjects. |
-| `packages/webui/src/sso.mjs` (new) | The relying party: `readSlot`, discovery and JWKS with retry, `/auth/login`, `/auth/callback`, `/auth/logout`, sessions, `health()`, `summary()`, `formTargets()`. |
-| `packages/webui/src/serve.mjs` | Under `sso`: public Host only on the human listener (F4), `/auth/*` routes, session check before every page and API route, CSP `form-action` adds the end-session origins, tester listener refusals (F8). |
-| `packages/webui/src/cli.mjs` | `--sso`, its refusals, slot reads, the start lines, `close()` on stop. |
-| `packages/webui/src/chat-http.mjs` | Under `--sso` the session check already ran, so the header-user check is skipped; the Origin check uses `publicOrigin`. |
-| `packages/webui/src/public/app.js`, `bus.js`, `index.html` | 401 `sign-in required` signs the page out with a link to `/auth/login?return=...` (design test 24, F1). The Sign out form shows only when `/api/config` says `sso` (F7). |
-| `scripts/webui-service.sh` | Passes `--sso` through; `--send` refusal text names `--sso`. |
-| `packages/webui/tests/service.test.mjs` | The `--send` refusal regex follows the new text. |
-| `packages/webui/README.md` | New section "Sign-in in the Console (Q175 phase 1, #1690)". |
-| `packages/webui/tests/helpers/fake-oidc.mjs` (new) | The fake OP. |
-| `packages/webui/tests/sso.test.mjs` (new) | 28 tests: three positives and design tests 1 to 23 (some split in parts). |
-| `packages/webui/tests/sso-browser.test.mjs` (new) | 2 tests: design test 24 with F1, and F7. |
-
-## Tests run (single files, this worktree, final tree)
-
-| File | Pass | Fail |
-| --- | --- | --- |
-| sso | 28 | 0 |
-| sso-browser | 2 | 0 |
-| pinned-copy | 10 | 0 |
-| serve | 4 | 0 |
-| preview | 11 | 0 |
-| proof | 4 | 0 |
-| proof-cli | 3 | 0 |
-| send | 13 | 0 |
-| service | 31 | 0 |
-| tester-listener | 10 | 0 |
-| tester-cli | 2 | 0 |
-| board-held | 3 | 0 |
-| send-browser | 2 | 0 |
-| docs-browser | 1 | 0 |
-| chat | 23 | 0 |
-| chat-browser | 11 | 0 |
-| bus-browser | 2 | 0 |
-| settings-write | 4 | 0 |
-| project-file | 10 | 0 |
-| instances | 5 | 0 |
-| routes | 5 | 0 |
-| `scripts/test-config.sh` | 31 | 0 |
-
-The first singles pass failed `pinned-copy` 1 of 10: `ERR_MODULE_NOT_FOUND: Cannot find package
-'oauth4webapi'` from a copy's `sso.mjs`. The test's fixture repo writes an empty package.json and lock, so the
-copy's `npm ci` installs nothing, and `sso.mjs` imported oauth4webapi at module load. `cli.mjs` imports
-`sso.mjs` on every start, so plain `serve` broke. Fix: `sso.mjs` loads oauth4webapi inside `createSso`
-(`oauth ??= await import('oauth4webapi')`). A Console without `--sso` never resolves the package. A real copy
-still has it from the root lock. Mutant 21 restores the static import and `pinned-copy` kills it. After the
-fix: pinned-copy, sso, sso-browser and serve rerun green (counts above).
-
-Not run by me (slot work, busy at the time): the full webui package suite, the cli suite, and
-`scripts/test-*.sh` other than test-config. `packages/cli/tests/stack-copy.test.mjs` and
-`stack-release.test.mjs` also build copies with an empty lock and are the ones to watch for the same
-failure. They need Sage's gate.
-
-## Mutants (`mutants.py`, run as `python3 mutants.py <tree> [N ...]`)
-
-Each mutant edits one source file, runs one test file filtered to one test name, and restores the file
-checked by sha256. Final run on the final tree: `/mnt/storage/scratch/launchpad-r192/mutants-final.log`.
-
-| # | Mutant | Test | Result |
-| --- | --- | --- | --- |
-| 1 | drop validateApplicationLevelSignature | sso 9 | KILLED |
-| 2 | wrap the signature call in a continuing try/catch | sso 9 | KILLED |
-| 3 | drop the subjects check | sso 10 | KILLED |
-| 4 | accept HS256 and none in ALGS | sso 11 start | KILLED |
-| 5 | take the provider from the query | sso 15 | KILLED |
-| 6 | tester listener reads sign-in cookies (F8) | sso 12 | KILLED |
-| 7 | tester listener takes Authorization (F8) | sso 12 | KILLED |
-| 8 | tester listener takes x-authentik-* (F8) | sso 12 | KILLED |
-| 9 | skip the login record delete | sso 7 | KILLED |
-| 10 | drop HttpOnly from the session cookie | sso 20 and 21 | KILLED |
-| 11 | refresh last-seen on every request | sso 13 idle | KILLED |
-| 12 | build redirect_uri from the request Host | sso 22 | KILLED |
-| 13 | serve the loopback read path under --sso (F4) | sso 22 | KILLED |
-| 14 | bus.js fetchRead ignores 401 sign-in required (F1) | sso-browser 1 | KILLED |
-| 15 | bus.js fetchApi ignores 401 sign-in required (F1) | sso-browser 1 | KILLED |
-| 16 | app.js getJSON ignores 401 sign-in required | sso-browser 1 | KILLED |
-| 17 | app.js api() ignores 401 sign-in required | sso-browser 1 | KILLED |
-| 18 | signInRequired takes any 401 | sso-browser 1 | KILLED |
-| 19 | Sign out shown without the sso condition (F7) | sso-browser 2 | KILLED |
-| 20 | CSP form-action without the end-session origins | sso 13 CSP | KILLED |
-| 21 | import oauth4webapi at module load | pinned-copy | KILLED |
-| 22 | restore the r1 relative returnPath (round 2, B1) | sso 14 | KILLED |
-| 23 | drop the second origin check (round 2, sage-1403) | sso 14 | SURVIVED, equivalent, guard kept (sage-1407) |
-
-Mutant 16 survived its first run: test 1 had no `getJSON` path. The History click on
-`/api/conversations` was added and it is now killed.
-
-## Deviations from the design
-
- **F1 (sage-1340).** `bus.js` `fetchRead` and `fetchApi` apply the same 401 `sign-in required` rule as
-  `app.js`, even when `/api/config` has no `sso`. Tested in sso-browser 1, mutants 14 and 15.
- **F7 (sage-1347).** A Sign out form (`POST /auth/logout`) in the command bar, hidden unless `/api/config`
-  says `sso`. Tested in sso-browser 2, mutant 19.
-
- **Proof header on 7333 under `--sso` (webby-0019 N2).** `cli.mjs` passes `testerProofHeader: null` under
-  `--sso`, since `--sso` refuses the proof pair and there is no header name to refuse. A request to 7333 that
-  still carries the old proof header is not refused for it. It gains nothing: under `--sso` no listener
-  reads a proof header (`proof` is null in `startServer`). Left as is.
-
-## Assumptions and choices
-
- **F8 (sage-1347).** Under `--sso` the tester listener refuses a request carrying `Authorization`, either
-  `__Host-mosaic` cookie or any `x-authentik-*` header, case-insensitive (Node lower-cases header names).
-  sso 12 sends one of each; mutants 6 to 8.
- **oauth4webapi loads lazily** inside `createSso` (see the pinned-copy failure above).
- **Client authentication** is `ClientSecretBasic`; the fake OP's token endpoint checks Basic auth.
- **Caps**: 1 to 8 providers, 1 to 64 subjects per provider, 64 sessions, 32 pending logins. The 33rd login
-  drops the oldest record (sso 17).
- **CSP**: under `--sso`, `form-action` adds each provider's end-session origin. Chrome applies
-  `form-action` to the redirect after the Sign out POST, so without it the logout stops at the Console.
-  Tested in sso 13 CSP, mutant 20. Without `--sso` the CSP string is unchanged.
- **`--send` refusal text** in cli.mjs and webui-service.sh now ends "or --sso".
- **Start lines**: one `Sign-in provider:` line per provider with id, issuer, subject count and state
-  (`ready`, `refused` or `unreachable`). No client id, secret or sub.
- **Test 1** uses `console.example.test` as the public Host, not mosaic.woltje.com (no request goes there).
- **Test 11 slot files**: the owner check is not tested; the test can't create a file owned by another uid
-  without privilege. Symlink, 0644, 0640 and a file under the repository are tested.
- **Test 23** covers a provider down at start: the Console starts, `/auth/login` is 503, loopback `/healthz`
-  is 200 with `sso: { a: 'unreachable' }`, one `discovery-failed` line, and the retry makes sign-in work. An
-  HS-only discovery at start refuses the start (in test 23 and in test 11 start).
- **Test 22**: a Host of bare `localhost` without a port is not in the table. It hits the older
-  `non-local Host refused` check before the sso check; a comment in the test says so.
-
-## Round 2 (webby-0019)
-
- **B1, open redirect after sign-in.** `returnPath` took any URL on `publicOrigin`, and dot segments can
-  normalize to a pathname of `//evil.example`, which a browser reads as scheme-relative in a relative
-  Location. Fix per sage-1403: `returnURL` (renamed) builds an absolute URL, `publicOrigin + pathname +
-  search`, checks its origin again, and returns its href. Anything else is `publicOrigin/`. The callback's
-  Location is now always absolute on the Console. Test 14 asserts the exact Location and its origin for each
-  case. It adds Webby's three rows (`/.//evil.example`, `/x/..//evil.example`,
-  `https://console.example.test//evil.example`), each now `https://console.example.test//evil.example`, a path
-  on the Console. It also adds `/board/./x`, which lands on `/board/x`. The positive test expects
-  `https://console.example.test/board?x=1`.
- **Mutant 22** restores the r1 relative `returnPath`; test 14 kills it.
- **Mutant 23** drops the second origin check. It SURVIVES, and I read it as equivalent: `checkConsole`
-  holds `publicOrigin` to a bare https origin, and a parsed https pathname always starts with `/`, so
-  `publicOrigin + pathname` can't parse to another origin. Webby agrees (webby-0022). Sage's ruling
-  (sage-1407): the check stays as an unreachable guard, and 23 is listed here as equivalent. That is a packet
-  note, not a candidate change.
- **N1.** The design cite is now blob 9e3eadb15c80 (`git rev-parse 83b32d8d8:agents/sage/work/q175-sso/DESIGN.md`).
- **N2.** Listed under Deviations.
- **N3.** `SIGN_IN_COOKIE` has its own comment, above the row 177 comment and `TESTER_CHAT_WRITE`.
- **N4.** Row 200 (#1698) covers it: `stack-release.sh` refuses `config-console-key` before any stop when the
-  target's loader refuses the key, on activate and rollback.
- **N5.** No change.
-
-Round 2 runs, this worktree, final tree: `sso.test.mjs` 28/28 (`/mnt/storage/scratch/launchpad-r192/sso-r2.log`);
-mutants 22 and 23 (`/mnt/storage/scratch/launchpad-r192/mutants-r2.log`).
-
-## Not done here
-
- Row 200 (#1698, `stack-release.sh activate --sso`) is chained on this candidate and starts only after the
-  manifest is with Webby (sage-1369).
- Full suites are for Sage's gate.
@@ -1 +0,0 @@
-53bb59462120a03a9f54b02881895e3f575e501c
@@ -1,18 +0,0 @@
-95d9a48812eebc415e3605239788e5b0746f1457a3bf0f9b9651a8c745e8b0f6  package.json
-390cbb0ef88de6cbc6d8f43b9e212abfdf0ef0e1c88fa02f5ab790caabc53eed  package-lock.json
-726b71bcfdb4d9409cefc86bed2fbe8e678c6efb50bcf5bb22344aeda1eee201  packages/webui/README.md
-f7b6b68906f13a644854b8083287dfa2936e8defc6207d05739e89763cc91440  packages/webui/src/chat-http.mjs
-4a2d226bdbfee98b180103f71b3cb8122303cfac4aeece42bd30ce167ba6ff55  packages/webui/src/cli.mjs
-41ee8798c34ee491b80ae1b42c3e96cd5d12fb1603b1ab88ac2dd10b5fb27964  packages/webui/src/public/app.js
-e6c8f838eb7cdc2ae556c04451ca4c8f2d433117a17f285a144cfc7dff03e2a4  packages/webui/src/public/bus.js
-f276fa440ec938638cb3e0f1b812fafa929460a6b96f1dab4cf1076a7c0c18ea  packages/webui/src/public/index.html
-333d474b1c7e753938aedc639c08f9db0e787faf56aa8068d013fd304a0b3b7e  packages/webui/src/serve.mjs
-37b01ab0479d5f2a7ab9aac790931c6d88c790465392d9c0b65a105513f3e36b  packages/webui/src/sso-config.mjs
-b624f044d361c648cefa161abe5f2b96e0cd8a83bc7816c9d501a2cd840988ca  packages/webui/src/sso.mjs
-84e31d4beba0de5ed6d192921bd7b016296c8b2a42b3fcf1176663e182320d9e  packages/webui/tests/helpers/fake-oidc.mjs
-ac01037743fcbf1efa641794d3878f113b6206033d2f66cde072a52ccfae1a51  packages/webui/tests/service.test.mjs
-9358e3755e174b61532e2c528e733ffcdb48941cbadb825f1b0254bc55d1920e  packages/webui/tests/sso-browser.test.mjs
-3f8527fd7ae1ffb2bffce3450971f125bd616954b534577ef54249c87f36e248  packages/webui/tests/sso.test.mjs
-f8307d4bd998634467fbed8748157754132b76affac051f320196161ce385e4a  scripts/mosaic-config.mjs
-3301c1fabf616bb961d62f6decd0a46dadb0f399b8ba7f3c2ca60023d2b24c78  scripts/test-config.sh
-7678bb6b45861c3dc6d775fc99269b1db7350ced60b89517d6ebeb4cc161781c  scripts/webui-service.sh
@@ -1,59 +0,0 @@
-# Row 192 (#1690) mutants: `python3 mutants.py <tree> [N ...]`. Each applies to the tree's source, runs one
-# test file (optionally one name pattern) and restores the file from a saved copy, checked by sha256.
-# Killed = test exit != 0.
-import hashlib, os, subprocess, sys, signal
-W = os.path.join(os.path.abspath(sys.argv[1]), 'packages', 'webui')
-if not os.path.isfile(os.path.join(W, 'src', 'sso.mjs')): sys.exit(f'ABORT no packages/webui/src/sso.mjs under {sys.argv[1]}')
-S, B, C, F = 'src/sso.mjs', 'src/serve.mjs', 'src/sso-config.mjs', 'src/public/'
-T, P = 'tests/sso.test.mjs', 'tests/sso-browser.test.mjs'
-M = [
- ('drop validateApplicationLevelSignature (9b)', S, [("try { await oauth.validateApplicationLevelSignature(entry.as, response, options()); } catch (err) {", "try { } catch (err) {")], T, '^9:'),
- ('wrap the signature call in a continuing try/catch (9b)', S, [("try { await oauth.validateApplicationLevelSignature(entry.as, response, options()); } catch (err) {", "try { try { await oauth.validateApplicationLevelSignature(entry.as, response, options()); } catch {} } catch (err) {")], T, '^9:'),
- ('drop the subjects check (10)', S, [("if (name === undefined) {", "if (false) {")], T, '^10:'),
- ('accept HS* in algs (11)', C, [("export const ALGS = Object.freeze(['PS256',", "export const ALGS = Object.freeze(['HS256', 'none', 'PS256',")], T, '^11: start'),
- ('take the provider from the query (15)', S, [("const entry = record && providers.get(record.provider);", "const entry = record && providers.get(query.get('provider') ?? record.provider);")], T, '^15:'),
- ('let the tester listener read cookies (12, F8)', B, [("SIGN_IN_COOKIE.test(req.headers.cookie ?? '') ||", "")], T, '^12:'),
- ('tester listener takes Authorization (12, F8)', B, [("Object.hasOwn(req.headers, 'authorization') ||", "")], T, '^12:'),
- ('tester listener takes x-authentik-* (12, F8)', B, [(" || Object.keys(req.headers).some(h => h.startsWith('x-authentik-'))", "")], T, '^12:'),
- ('skip the login record delete (7)', S, [("if (key !== null) logins.delete(key);\n    // The provider", "// The provider")], T, '^7:'),
- ('drop HttpOnly from the session cookie (21)', S, [("`${SESSION_COOKIE}=${id}; ${ATTRS}`", "`${SESSION_COOKIE}=${id}; Path=/; Secure; SameSite=Lax`")], T, '^20 and 21'),
- ('refresh seen on every request (13)', B, [("sso.session(req, { touch: req.method === 'POST' || (req.method === 'GET' && !path.startsWith('/api/')) })", "sso.session(req, { touch: true })")], T, '^13: idle'),
- ('build redirect_uri from the request Host (22)', S, [("const redirectUri = `${publicOrigin}/auth/callback`;", "let redirectUri = `${publicOrigin}/auth/callback`;"), ("    const query = new URLSearchParams(search);\n", "    const query = new URLSearchParams(search);\n    redirectUri = `https://${req.headers.host}/auth/callback`;\n")], T, '^22:'),
- ('serve the loopback read path under --sso (22)', B, [("if (sso !== null && !named && !(path === '/healthz' && req.method === 'GET')) return json(res, 403, { error: 'public Host required' });", "")], T, '^22:'),
- ('bus.js fetchRead ignores 401 sign-in required (F1)', F+'bus.js', [("    if (signInRequired(res, body)) { signOutSso(); throw signedOut(); }\n    if (!res.ok || !body || !Array.isArray(body.rows))", "    if (!res.ok || !body || !Array.isArray(body.rows))")], P, '^a 401'),
- ('bus.js fetchApi ignores 401 sign-in required (F1)', F+'bus.js', [("    if (signInRequired(res, body)) { signOutSso(); throw signedOut(); }\n    if (!res.ok || !body || typeof body !== 'object'", "    if (!res.ok || !body || typeof body !== 'object'")], P, '^a 401'),
- ('app.js getJSON ignores 401 sign-in required (24)', F+'app.js', [("    if (signInRequired(res, body)) { sso = true; signOut(); throw signedOut(); }\n    return { ok: res.ok, body };", "    return { ok: res.ok, body };")], P, '^a 401'),
- ('app.js api() ignores 401 sign-in required (24)', F+'app.js', [("    if (signInRequired(res, result)) { sso = true; signOut(); throw signedOut(); }\n", "")], P, '^a 401'),
- ('signInRequired takes any 401 (24)', F+'app.js', [("res.status === 401 && body?.error === 'sign-in required'", "res.status === 401")], P, '^a 401'),
- ('Sign out shown without the sso condition (F7)', F+'app.js', [("if (config.sso === true) { sso = true; $('sign-out').hidden = out(); }", "{ $('sign-out').hidden = out(); }")], P, '^the Sign out'),
- ('form-action without the end-session origins (CSP)', B, [("form-action 'self'${sso ? sso.formTargets().map(o => ` ${o}`).join('') : ''}`", "form-action 'self'`")], T, '^13: the CSP'),
- ('import oauth4webapi at module load (copies)', S, [("let oauth;\n", "import * as oauth from 'oauth4webapi';\n"), ("  oauth ??= await import('oauth4webapi');\n", "")], 'tests/pinned-copy.test.mjs', '^serve runs from a copy'),
- ('restore the r1 relative returnPath (14, webby-0019 B1)', S, [("      if (u.origin !== publicOrigin) return home;\n      const out = new URL(`${publicOrigin}${u.pathname}${u.search}`);\n      return out.origin === publicOrigin ? out.href : home;", "      return u.origin === publicOrigin ? u.pathname + u.search : '/';")], T, '^14:'),
- ('drop the second origin check (14, sage-1403)', S, [("      return out.origin === publicOrigin ? out.href : home;", "      return `${publicOrigin}${u.pathname}${u.search}`;")], T, '^14:'),
-]
-sha = lambda b: hashlib.sha256(b).hexdigest()
-only = sys.argv[2:]
-os.chdir(W)
-survived = []
-for i, (name, path, pairs, test, pat) in enumerate(M, 1):
-    if only and str(i) not in only: continue
-    orig = open(path, 'rb').read(); h = sha(orig)
-    src = orig.decode()
-    for a, b in pairs:
-        if src.count(a) != 1: sys.exit(f'ABORT {i} {name}: pattern found {src.count(a)} times')
-        src = src.replace(a, b)
-    try:
-        open(path, 'w').write(src)
-        p = subprocess.Popen(['node', '--test', f'--test-name-pattern={pat}', test], stdout=subprocess.PIPE, stderr=subprocess.STDOUT, start_new_session=True)
-        try: out, _ = p.communicate(timeout=240)
-        except subprocess.TimeoutExpired:
-            os.killpg(p.pid, signal.SIGKILL); out, _ = p.communicate(); out += b'\nTIMEOUT'
-        text = out.decode(errors='replace')
-        ran = [l for l in text.splitlines() if l.startswith('ℹ tests ')]
-        verdict = 'KILLED' if p.returncode != 0 else 'SURVIVED'
-        if verdict == 'SURVIVED': survived.append(name)
-        print(f'{i:2} {verdict} {name} [{ran[0] if ran else "no count"}]', flush=True)
-    finally:
-        open(path, 'wb').write(orig)
-        if sha(open(path, 'rb').read()) != h: sys.exit(f'ABORT restore failed for {path}')
-print('survived:', survived or 'none')
@@ -0,0 +1,8 @@
+# Megavolt
+
+Builder seat, Claude Opus 5.5, started by Sage under mos-0974 and mos-0977 item 5 for MVP T1 item 6, the
+credential store per agent with its own git identity (#1697).
+
+No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
+credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `megavolt/*`
+branches through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -0,0 +1,10 @@
+# #436b build carry items
+
+The design is approved at r5: 1be535aca, DESIGN.md sha256 68df02cdf890564c6ed0a5426204114389ba7eb0eea1cf04f1bf5938b6de45f4. Dewey gave the approval in dewey-0763 (verdict sha256 de52be1b…6b68). Section 7 is approved at fa5658941 by duckworth-0067 and is unchanged since. DESIGN.md stays as approved. The row's build takes the items below, and its BUILD.md cites this file.
+
+- N9 (dewey-0763). Revoke writes `grant.revoked`, not a `grant.step`. A restart after a revoke on an open rotation therefore still sees a `commit` with no settle after it, and settles again: no file, `grant-lost`, a wrong message to Jason, and repeated deletes that come back 404 and go to `serviceLeft`. Two fixes:
+  - The section 5 restart row "`commit`, rotation, settle-pending" takes the held row's clause "with no `grant.revoked` after it".
+  - A 404 on a delete by id counts as done, not as a `serviceLeft` entry. That applies to revoke, sweep and the settle deletes.
+  - Add a test: revoke on an open rotation, then a restart. No settle runs, no Gitea call is made, and the restart sends no message about it.
+- N10 (dewey-0763). `grant.revoked {serviceLeft}` can now hold two ids, so it is a list of ids everywhere. `sweep` reads it as one.
+- duckworth-0067 N1 is in r4 (section 5, X-G15). Nothing more is carried for it.
@@ -0,0 +1,640 @@
+# Gitea grant path, design draft r5 (Vikunja #436b, Gitea #1697 follow-up)
+
+Author: Megavolt. Reviewer: Dewey. GitHub half: Bushroot. Base: Gizmoduck's #436a r6 (f9039682e, final,
+`agents/gizmoduck/work/machine-grant/DESIGN.md` on origin/gizmoduck/machine-grant-design) and row 199's
+DESIGN.md section 7a (e10e03f6b). Mos rulings used here: mos-1130 and mos-1136.
+
+This draft builds nothing. It says how an Approve in Jason's inbox makes an agent's Gitea user, its token and
+its forks with no manual step, and it answers mos-1130 item 3 (a to e) on the executor's admin credential.
+
+## r5 changes (dewey-0761 on r4 3e66f5acf)
+
+Section 7 is unchanged from fa5658941.
+
+- Item 1 (blocks). A revoke on an open rotation deletes both tokens. When the last `grant.step` is a
+  rotation's `commit` with no settle after it (settle-pending or `grant-token-unknown`), section 6 step 3
+  deletes `previousTokenId` and the minted `tokenId`, each failure to `serviceLeft`. Section 5's
+  `grant-token-unknown` text now says both (X-G5).
+- N8. Step 0 refuses `grant-token-unknown` while the agent is held, so a revoke is the only way out.
+
+## r4 changes (dewey-0759 on r3 fa5658941, sage-1578, duckworth-0067)
+
+Section 7 is unchanged from fa5658941, the text Duckworth approved and Gizmoduck cites.
+
+- Item 1 (blocks), option (b), Sage's ruling in sage-1578. A step 0 refusal leaves the decision unspent only
+  until the next start. #436a r6 X3's start reconcile spends every resolved-yes grant decision with no
+  `action.allowed` as `interrupted`, and this draft no longer claims otherwise. `grants run` works while the
+  bus that refused is still up; after a restart the chief raises again and Jason approves again. `status`
+  says so on each open decision (D5, section 4 step 0, section 5, X-G11). (a) would change #436a r6, which is
+  final. The cost is in D5.
+- Item 2 (blocks). A settle that gets 200 with an `id` that is neither token no longer leaves the file in use.
+  Memory drops the credential (199 `revoke`'s memory step), the file and both recorded tokens stay, nothing
+  is deleted at Gitea, and the step ends `grant.failed {code: 'grant-token-unknown'}` for Jason. A restart
+  keeps the credential out of memory (`Credentials` `held`, built in #436b's row like `reload`). Revoke clears
+  it (section 5, X-G6).
+- N7. 3d says the private session-less writer runs `#secretCheck` on every guarded body, as `#event` does
+  (`broker.mjs:559`). The sentence is in 3d, so section 7 doesn't change.
+- duckworth-0067 N1. Every reader of grant evidence filters on `kind = 'action.allowed'` and the grant actor
+  pair, so a `grant.*` name under another kind is not evidence (section 5, X-G15).
+
+## r3 changes (dewey-0756 on r2 6db7cc45d, gizmoduck-0081 and -0084, duckworth-0065, mos-1144)
+
+- B1 (blocks). Only `#consumeGrant`'s own record carries `decision`. Every other `grant.*` body names the
+  decision `grantDecision`, so `#spent` sees exactly one spend. A step 0 or step 1 refusal leaves the
+  decision unspent (section 7, X-G11, a mutant).
+- B2 (blocks). Settle with the seat token is proven on scratch (F13): `GET /api/v1/token` answers 200 with the
+  minted id and 401 after the token is deleted. Only a 401 ends `grant-lost`. 403, 404, 5xx, a timeout, an
+  unreachable Gitea or a failed C1 to C4 leave the step open as `settle-pending`, delete nothing, and retry
+  on the next start and in `grants sweep` (section 5, X-G6). `Credentials.reload` is built by #436b's own
+  row in `packages/bus/src/credentials.mjs`; row 199's candidate doesn't change.
+- B3 (blocks). Step 5 compares against the user's forks of every upstream in the agent's `publish` list, not
+  only `target.projects`. The rendered block names those other upstreams as reach the token may have. A fork
+  whose upstream has left `publish` refuses `gitea-reach-wider` with its name (section 2, step 5, X-G12).
+- Section 7, the guard (gizmoduck-0081, -0084, duckworth-0065): one pattern, `grant.*`, on `body.action` and
+  on `body.operation` (Dewey N2: the consume record's `operation: 'grant.<method>'`). #436a renames its
+  `host.enroll.step`, `host.enrolled`, `host.checked` and `host.removed` into `grant.host.*`, so row 210's
+  `host.sudo` and `host.run` stay outside. The grant actor is `actor_role NULL, actor_run 'grant'`, which no
+  session or human event can produce (answers Dewey N1, same safety as `_bus`).
+- D12 / Q-B4 closed by mos-1146 (section 8).
+- N3. Step 5 reads every page of `/user/repos` and checks the total. N4. One nonce format, and the adopt
+  check compares the lowercased login. N5. `grants run` takes the `#inflight` claim. N6. One open-decision
+  query, `openGrantDecisions`, for `status`, rotate's void count and the start reconcile (section 7).
+
+## r2 changes (from r1 714c07304, Dewey's dewey-0754, verdict sha256 20d63dfb…)
+
+- D1 (blocks). `gitea_users` records the Gitea user `id`, and every later grant, rotation and fire compares it
+  (step 2). A nonce goes in `grant.step user` before the create and in the user's `full_name`, so a restart
+  adopts a user it made and refuses anything else (section 5, X-G6). Both are proven on scratch (F8, F9).
+- D2 (blocks). The audit records are `action.allowed` bodies with reserved `grant.*` actions, plus a trigger
+  in the store migration that only `system/grant` writes them (section 7). A call and its result are two
+  records paired by `callId`, because `events` is append-only (3d). To settle once with Gizmoduck for #436a.
+- D3 (blocks). Seat-token rotation gets its own rows. After `issue` has renamed the file, the executor settles
+  by asking Gitea which token the file holds (`GET /api/v1/token`, F7), and goes forward or back on that
+  answer, never by guessing (section 5).
+- D4 (blocks). 3c and section 8 now state the real gap. Reading the admin file gives instance admin, which is
+  more than a forged Approve gives. `write:admin` resets any user's password, email and admin flag, proven on
+  scratch (F10). The separate uid is deferred on cost, and the draft says so.
+- D5. The admin checks run before `#consumeGrant`, so a predictable refusal leaves Jason's Approve unspent. A
+  human `mosaic grants run <decision>` starts it again (step 0). The raise refuses when the admin slot is past
+  its rotate-by date. r4 (sage-1578): unspent only until the next start, when #436a r6 X3's reconcile spends
+  it as `interrupted`. The cost: if a step 0 refusal is followed by a restart before Jason rotates the admin
+  token or upgrades Gitea, the chief raises again and Jason approves again.
+- D6. One list of start checks (3a, 3e). The "no organization" claim is now part of the bootstrap promise,
+  and the check is that `GET /user/repos` is empty, which catches org and collaborator repositories (F11, and
+  F12 for a site-admin token).
+- D7. Admin rotation: a timestamped name (F9: names are unique per user), `--rotate-by` required, and `setAt`
+  changes, so open approvals are voided and `status` says so.
+- D8. The restart's remote undo runs the same admin checks and writes the same call records.
+- D9 (Q-B1). On fire: `prohibit_login` (F10) and delete every token the user has, not only the recorded one.
+- D10 (Q-B2). Step 5 checks the seat token's real reach with `GET /user/repos` (F11). Section 8 says reach can
+  grow later.
+- D11. One Gitea per business, stated, and checked at `set` and at raise.
+- D12. Section 8 asks for the jason.woltje comparison. I can't check it myself.
+
+## 0. What this adds to #436a
+
+#436a section 11 left `method: "gitea"` for a later draft, because the executor needs an admin credential and
+roles may never hold the admin scope (`packages/business/src/vocabulary.mjs:108-112`). That rule stays. The
+admin credential here is not a role service: no `useFor` reaches it, no definition can list it, and only the
+executor reads it.
+
+Everything in #436a's sections 4 and 5 holds unless this draft says otherwise: the `credential.mint` raise
+with a `grant` body, chief only (R3), the rendered block (R4), Jason's Approve via cli (R5, X1),
+`#consumeGrant` with `operation: 'grant.gitea'`, the `#inflight` claim and abort (X5), `grant.step` records and
+restart reconcile (X3), and revoke local first (section 6).
+
+What row 199 already gives: the agent's `identity = {name, email, gitea: {url, user}}`, its
+`publish: [project]` grant and each project's `remote` (199 D8, D9), the store and `issue(instance, service,
+token, date, commit)` (`packages/bus/src/credentials.mjs:156`), and section 7a's rule that `issue` accepts a
+resolved `credential.mint` decision as the human path. `issue` writes the file (tmp, fsync, rename), then calls
+`commit`, then fills memory (`credentials.mjs:156-193`). Section 5 depends on that order.
+
+## 1. Facts, proven on a scratch Gitea
+
+Run on gitea/gitea:1.27.1 (sha256:fe4e4b1c8b93) on 127.0.0.1, throwaway data, container removed after each
+run. Scripts and logs: `/mnt/storage/scratch/megavolt-r199/g436b/`. No log holds a token or password value.
+F1 to F6 were reported in megavolt-0034, and Mos accepted them in mos-1136.
+
+- F1 (`run4.log`). `POST /api/v1/users/{u}/tokens` with `Authorization: Basic <admin>:<admin token>` creates a
+  token for another user: 201. The same token in a `token` or `Bearer` header gets 401 on that route, while the
+  `token` header works on `GET /api/v1/user` (200). So the executor sends Basic on the token routes and
+  `token` everywhere else.
+- F2 (`run4.log`). The child-scope cap: a child scope broader than the parent's gets 403 ("cannot create an
+  access token with a broader scope than the authenticating token"), for `write:organization` and for `all`.
+  A narrower one gets 201.
+- F3 (`run4.log`). TOTP 2FA on the admin account blocks password Basic (401) and doesn't block token Basic
+  (201).
+- F4. The route's check is `reqSelfOrAdmin`: whether the account is a site admin, not the token's scope. Any
+  `write:user` token on a site-admin account can mint a token for any user.
+- F5. `write:X` implies `read:X` under Gitea's `HasScope`.
+- F6. The cap is Gitea #38406, backported in #38426 (de4b8277e9 on release/v1.27, 2026-07-12). It first ships
+  in v1.27.0. v1.27.0-rc0 lacks it, and so does every 1.24.x, 1.25.x and 1.26.x through 1.26.4.
+- F7 (`introspect.log`). `GET /api/v1/token` with the `token` header gives 200 with `id`, `name`, `scopes`,
+  `user`, `created_at` and `last_used_at`, and no token value. With Basic it gives 404. Scopes come back
+  normalized (3b).
+- F8 (`r2probe.log` 1a-1d). `POST /admin/users` with a `full_name` gives 201 with the user's `id` and that
+  `full_name`. `GET /users/SEAT-ONE` finds `seat-one` with the same `id`: names match case-insensitively. A
+  create of `Seat-One` next to `seat-one` gets 422.
+- F9 (`r2probe.log` 2a-2c). A second token with a name already used by that user gets 400. `GET
+  /users/{u}/tokens` with Basic lists the user's tokens.
+- F10 (`r2probe.log` 4a-4f, 5a). With `write:admin`, `PATCH /admin/users/{u}` on another site admin sets a new
+  password (200; the new password then signs in, the old one gets 401) and a new email. On a plain user it sets
+  `admin: true`, then `admin: false` with `prohibit_login: true`. Without `write:admin` the same PATCH gets 403.
+- F11 (`reach.log`). With the seat token (`write:repository`, `read:user`), `GET /user/repos` lists the user's
+  own fork, then also a repository it was made collaborator on, then also an org repository after it joined an
+  org team. `GET /user/orgs` and `GET /users/{u}/orgs` need `read:organization`, which neither token holds.
+- F12 (`c4.log`). With a site-admin account's three-scope token, `GET /user/repos` is empty on an instance
+  where other users and an org it isn't in hold public and private repositories: being site admin doesn't add
+  them. It lists a repository once the account is a collaborator, and an org repository once it joins that
+  org's team. Joining an org with no repositories leaves it empty, and `GET /user/orgs` gets 403 (no
+  `read:organization`).
+- F13 (`b2.log` b1-b7). Two seat tokens minted (201, ids 2 and 3). `GET /api/v1/token` with each token in the
+  `token` header gives 200, and the `id` is the minted one for both. After `DELETE` of seat-a's token (204), the
+  same call with it gives 401. After `prohibit_login` on seat-b (200), the call with seat-b's token gives 403
+  ("This account is prohibited from signing in"), not 401. A value never issued gives 401. So 401 is the only
+  answer that means the token is gone; 403 means the account is shut, and section 5 leaves it `settle-pending`.
+
+## 2. The binding
+
+The shared part (section 10) is proposed to Bushroot in megavolt-0036. This section is the Gitea half.
+
+```
+grant: { "method": "gitea", "agent": "<instance>", "rotateBy": "YYYY-MM-DD",
+         "target": { "projects": ["<project>", ...] } }
+```
+
+Code fixes the scopes of the agent's token: `write:repository` and `read:user`, row 199 A2's set. The raise
+can't name scopes, so the chief can't widen them.
+
+Checks at raise, inside the raise transaction. Each refusal stores nothing:
+
+- `agent` is a role instance of this business, its definition declares `{"service": "gitea"}`, and it has
+  `identity` and a `publish` grant (199 D8). Otherwise `gitea-not-declared`.
+- Each project in `target.projects` is in the agent's `publish` list (`remote-not-granted`), and its
+  `remote`'s origin equals `identity.gitea.url`'s (`remote-host-mismatch`), the same checks as 199 D9 step 2.
+- The business has an admin slot for `gitea` whose recorded `url` has the same origin
+  (`grant-admin-missing`), and the slot isn't past its rotate-by date (`grant-admin-rotation-due`).
+- `rotateBy` is inside 199's rotation window.
+
+The rendered block, appended by the broker as #436a R4 does: agent, Gitea user, email, Gitea URL, each fork
+URL it will make (`<url>/<user>/<repo>`), the two fixed scopes, the rotate-by date, one of "new Gitea user",
+"existing stack-made user, new token" or "token rotation" (step 2), and the line "The token can write every
+repository this user can write. Step 5 checks that this is only its forks." Then, when the agent's `publish`
+list has projects outside `target.projects`, the line "It may also reach this user's existing forks of:" and
+each such upstream. The raise makes no network call, so the block names every such upstream, not only those
+with a fork (B3). The 4096-character cap applies as in R4.
+
+The raise event body gets `grant = {method, agent, target, rotateBy, definitionSha256, identitySha256,
+adminSha256}`:
+
+- `definitionSha256` as in #436a.
+- `identitySha256` over the agent's `identity`, its `publish` list and the `remote` of every project in
+  `publish` (step 5 checks against all of them).
+- `adminSha256` over the admin slot's metadata (`url`, `account`, `setAt`), never over the token.
+
+At step 1 any of the three that differs refuses `decision-mismatch`. So a changed identity, publish list,
+upstream or admin credential between raise and Approve voids the Approve (REQ-GRANT-2).
+
+## 3. The executor's admin credential (mos-1130 item 3)
+
+### 3a. A dedicated account
+
+One Gitea account per Gitea instance, named `mosaic-grant` by default. It is a site admin and has TOTP 2FA on
+(F3: the token path still works). Its password and TOTP secret stay with Jason and never reach the stack. It
+is never jason.woltje or any other human's account. It owns no repositories, belongs to no organization and is
+no repository's collaborator.
+
+The admin checks, one list, run at `set` (3e), before every executor start (step 0) and before every remote
+undo (section 5):
+
+- C1. `GET /api/v1/version` is at least 1.27.0 (F6), compared as numbers, or `gitea-too-old`.
+- C2. `GET /api/v1/user` gives `login == account` as recorded at `set`, and `is_admin` true, or
+  `grant-admin-account`.
+- C3. `GET /api/v1/token` gives exactly the three scopes (3b), or `grant-admin-scope`.
+- C4. `GET /api/v1/user/repos` is empty, or `grant-admin-not-dedicated`. By F11 and F12 this list covers
+  owned, collaborator and org-team repositories, and site admin alone doesn't fill it.
+
+What code can't check: that nobody else uses the account, and org membership with no repositories (F11: the
+orgs routes need `read:organization`, which the admin token doesn't hold and shouldn't). Both are the bootstrap
+step's promise and go in the approval notes (section 8).
+
+### 3b. The scopes, each shown needed
+
+The admin token holds exactly `write:admin`, `write:user` and `write:repository` (mos-1136 item 1). From
+`matrix.log`, with each scope dropped in turn:
+
+| Parent token | A1 create user | A2 mint seat token | A3 fork (seat token) | A5 delete seat token |
+|---|---|---|---|---|
+| all four | 201 | 201 | 202 | 204 |
+| without `write:admin` | **403** | 201 | 202 | 204 |
+| without `write:user` | 201 | **403** | 202 | **403** |
+| without `write:repository` | 201 | **403** (cap, F2) | 202 | 204 |
+| without `read:user` | 201 | 201 | 202 | 204 |
+
+- `write:admin` is needed for A1, and for `prohibit_login` on fire (F10).
+- `write:user` is needed for A2 and A5.
+- `write:repository` is needed only because of the cap. The seat's token holds `write:repository`, and a
+  parent must hold at least what it mints. The executor itself never writes a repository with it.
+- `read:user` is covered by `write:user` (F5), so it is dropped.
+
+C3 reads the scopes with the `token` header (F7). Gitea reports normalized scopes, so a token made with the
+three plus `read:user` reads as the three. That is harmless, because `read:user` adds nothing to `write:user`.
+A token made with `all`, or with another category, refuses.
+
+### 3c. Where it lives, who can read it
+
+- The token: `<configDir>/secrets/grants/<business>/gitea/admin`, 0600, in 0700 dirs, owned by the stack's
+  OS user. Written and checked by row 199's store code (D1: tmp, fsync, rename, the mode and owner checks).
+- The metadata: `admin.json` next to it, 0600, holding `url`, `account`, `rotateBy` and `setAt`. No secret.
+- A business grants on one Gitea. `set` refuses a second `url` while a slot exists (`grant-admin-exists`;
+  `remove` first), and the raise checks the agent's Gitea against the slot's `url` (section 2). Two businesses
+  on one Gitea each hold their own token for the same `mosaic-grant` account.
+
+Who can read the file: the stack's OS user, and root.
+
+Whether an agent process runs as that uid:
+
+- On dragon-lin, yes. The stack runs as jwoltje, and so does every agent process on the machine: 13 claude, 4
+  codex and 2 pi processes, the bwrap sandboxes and node, counted 2026-10-20. That includes the T3 dev seats,
+  which are not sandboxed and can read any jwoltje file.
+- Stack workers run in the seat sandbox, which has a private HOME and no `~/.config`, `~/.mosaic` or `~/.ssh`
+  (`packages/seat/src/sandbox.mjs`). A sandboxed worker can't reach the file by path. The sandbox doesn't
+  confine the network or the host uid (`sandbox.mjs:29-31`). So the file is safe from a sandboxed worker and
+  not from an unsandboxed process running as the same uid.
+- On the .53 and .54 installs (#432) the stack runs as its own OS user. Workers run sandboxed as that user.
+  The T3 seats don't run there.
+
+What a separate uid would buy. A same-uid process has two paths. It can forge a human proof (`verifyHuman` is
+a cooperative same-UID check, `packages/bus/src/human.mjs:50-52`), and an approved grant then gives it a
+two-scope token for a stack-made, non-admin user, because step 2 refuses foreign and admin users. Or it can
+read the admin file, which gives instance admin (section 8). A separate uid for the file and the executor would
+close the second path and leave the first. That is a real step up, from "a seat token for a stack user" to "no
+admin".
+
+I defer it on cost, not because it wouldn't help. It means the executor runs as its own process under its own
+uid, with an IPC path from the bus that carries the decision id and nothing the bus could forge. That is a row
+of its own, and it is cleaner after the human proof stops being same-uid (#435 behind Q175 sign-in). Jason
+approves the gap as section 8 states it.
+
+### 3d. Every use logged, and rotation
+
+Every Gitea call made with the admin token, and every call the executor makes with a seat token, writes two
+records (section 7 has where they live):
+
+```
+grant.call   { callId, reason, method: "gitea", op }        written before the call
+grant.result { callId, status }                             written after it
+```
+
+- `op` is one of `version`, `self`, `token-scopes`, `repos-check`, `user-get`, `user-create`, `user-patch`,
+  `token-list`, `token-create`, `token-delete`, `admin-rotate`, `fork-get`, `fork`, `seat-self`,
+  `seat-repos`, `token-whoami`.
+- `reason` is the decision id for a grant or its undo, the `grant.revoked` record id for a revoke, the
+  `grant.sweep` record id for a sweep, or `admin:<verb>` with the human actor for `set`, `rotate` and `remove`.
+- No body, no header, no token, no URL query. `Credentials.assertClean` (`packages/bus/src/credentials.mjs:233`,
+  the runtime's `secretCheck`) runs on both. The private session-less writer of section 7 runs `#secretCheck`
+  on every guarded body it takes, `grant.step`, `grant.applied`, `grant.failed`, `grant.revoked`,
+  `grant.sweep` and the consume record included, as `#event` does (`packages/bus/src/broker.mjs:559`) (N7).
+- `events` is append-only (`events_no_update`, `packages/bus/src/migrations/3b.sql:131`), so the result is its
+  own record, written in the transaction of the step's next `grant.step` where there is one. A `grant.call`
+  with no `grant.result` means the process died during the call. Reconcile lists each one in its message.
+
+Rotation of the admin token: a human-only verb, `mosaic grants admin rotate gitea --rotate-by <date>`. It never
+runs from an agent, the chief or the tester, and it doesn't need a decision because only `verifyHuman` can
+start it:
+
+1. C1 to C4 with the current token.
+2. Mint a successor for the admin account itself: `POST /users/<account>/tokens` with Basic and the same three
+   scopes, named `mosaic-grant-<UTC yyyymmddThhmmssZ>`, so a second rotation on one day doesn't collide (F9).
+   F2's cap holds it to the current token's scopes.
+3. C2 and C3 with the successor.
+4. Write it through 199's tmp, fsync and rename. Update `admin.json` with the new `rotateBy` and a new `setAt`.
+5. Delete the old token at Gitea by name, with the new token. If that fails, `status` shows
+   `adminTokenLeft: <name>` until `rotate --finish` succeeds.
+
+A new `setAt` changes `adminSha256`, so every grant decision raised before the rotation and not yet run
+refuses `decision-mismatch` (fail closed). `rotate` prints how many open grant decisions that voids, and
+`status` lists them.
+
+`status` shows the rotate-by date. Past it, the raise and the executor refuse `grant-admin-rotation-due` until
+Jason rotates. A forgotten rotation stops grants rather than letting an old token run on.
+
+If the admin token leaks, Jason deletes it in Gitea (Settings, Applications, as `mosaic-grant`) or disables
+the account, then runs `mosaic grants admin remove gitea`, which unlinks the slot. Live agent tokens keep
+working. Each one is revoked on its own (section 6).
+
+### 3e. The one bootstrap step
+
+Once per Gitea instance per stack, at #436b deploy. This is the only manual credential step left, and
+Jason's approval names it:
+
+1. In Gitea, Jason creates `mosaic-grant` as a site admin with no repositories and no organizations, turns on
+   TOTP, and as that user creates a token with `write:admin`, `write:user` and `write:repository`.
+2. On the stack host, as the stack's OS user:
+   `mosaic grants admin set gitea --url <url> --account mosaic-grant --rotate-by <date>`, with the token on
+   stdin (never argv).
+
+`set` is human-only (`verifyHuman`). It runs C1 to C4 (3a) before it writes anything, and any failure writes
+nothing.
+
+## 4. The executor's steps
+
+0. **Start and pre-checks.** X1 starts the executor on Jason's yes. It claims `(agent, "gitea")` in
+   `#inflight` (#436a X5), then runs C1 to C4 and the admin rotate-by check. A refusal here writes
+   `grant.failed {code, grantDecision}` and leaves the decision unspent (section 7's spend rule). After the
+   fix (a rotation, an upgrade), Jason runs `mosaic grants run <decision>` (human-only, `verifyHuman`), which
+   starts step 0 again, claim included. That holds only while the bus that refused is up: at the next start,
+   #436a r6 X3's reconcile spends every resolved-yes grant decision with no `action.allowed` as
+   `interrupted`, a step 0 refusal included, and the chief raises again (D5, sage-1578). `status` lists each
+   such open decision with `spentAtNextStart: true`. While the agent is held (`grant-token-unknown`, section
+   5), step 0 refuses `grant-token-unknown`, so a revoke is the only way out (N8). While a start or another `grants run` holds the claim it refuses
+   `grant-busy` before any call, as #436a X2's `host-busy` does. It refuses `decision-consumed` for a spent
+   decision. No other path starts it. The tag is #436a X2 step 2's, over business, agent and `"gitea"`.
+1. **Recheck and consume**, in one transaction: `#consumeGrant` with `operation: 'grant.gitea'`, the
+   definition still declares `gitea`, the three hashes match (section 2), no revoke of `(agent, gitea)` newer
+   than the raise. A failure rolls the transaction back, so the decision is not spent, and then writes
+   `grant.failed {code, grantDecision}`. Nothing remote has changed. `grants run` may retry it, but these
+   refusals (`decision-mismatch`, a newer revoke, the definition) recur until the chief raises again.
+2. **User.** `GET /users/{user}` (F8: case-insensitive).
+   - 404: write `grant.step {step: 'user', nonce}`, where `nonce` is 16 random lowercase hex digits. Then
+     `POST /admin/users` with the agent's `gitea.user` and `email`, `full_name` = `<identity.name> [mosaic
+     <nonce>]`, a random password that is never stored, and `must_change_password: false`. Then, in one
+     transaction, record `gitea_users {user, id, nonce}` with the `id` from the response (F8) and
+     `grant.result`.
+   - 200, and `gitea_users` has this business and agent with the same `id`: go on. That is a second grant or a
+     rotation. A user deleted at Gitea and remade by a human under the same name has a new `id`, and refuses.
+   - 200 with any other `id`, or no `gitea_users` record: refuse `gitea-user-foreign`. The executor never mints
+     a token for a user this stack didn't create. Without this check an `identity` naming a human's account,
+     jason.woltje included, would get a token minted for that account on Approve.
+   - The user is a site admin, or has `prohibit_login`: refuse `gitea-user-admin` or `gitea-user-disabled`.
+3. **Token.** Write `grant.step {step: 'mint', tokenName}`, with the name `mosaic-<tag>-<decision>`. Then
+   `POST /users/{user}/tokens` with Basic and scopes `write:repository` and `read:user`. The value is held in
+   memory only. Write `grant.step {step: 'minted', tokenId}`.
+4. **Forks.** With the new token, for each project: `GET /repos/{user}/{repo}`. If it exists, its `parent`
+   must be the project's upstream, or `fork-foreign`. If it's 404, `POST /repos/{owner}/{repo}/forks`.
+   Push-to-create stays off on the Gitea side (199 N11).
+5. **Verify.** With the new token: `GET /api/v1/user` gives `login == user` and the recorded `id`. Then
+   `GET /api/v1/user/repos?limit=50&page=N` from page 1 until a page holds fewer than 50, with the count
+   equal to `X-Total-Count`. More than 20 pages, or a count that disagrees, refuses `gitea-reach-unknown`.
+   Every listed repository must be owned by this user and have as `parent` the upstream of a project in the
+   agent's `publish` list (F11). Anything else refuses `gitea-reach-wider` and names it: a repository from a
+   collaborator or org-team add, or the user's old fork of an upstream that has left `publish`. So the token
+   never reaches past the rendered block (B3).
+6. **Go live.** Write `grant.step {step: 'commit', previousTokenId}` (`null` for a first grant). Check the
+   abort signal, and with no `await` between, call 199 `issue(agent, "gitea", token, rotateBy, commit)`.
+   `commit` writes the `gitea_grants` record (tokenId, tokenName, projects, rotateBy, decision). The reference
+   is registered first (#436a X4).
+7. **Old token.** For a rotation, `DELETE /users/{user}/tokens/{previousTokenId}` after the new one is live.
+   A failure adds `serviceLeft: <id>`, which `sweep` clears.
+8. **Applied.** `grant.applied {grantDecision, agent, user, userId, tokenId, forks}` and a message to the human and
+   the chief. The token appears in no record, message or log.
+
+The claim is released in a `finally`.
+
+## 5. Failure and restart
+
+Ordered so a failure leaves nothing an agent can use. "Delete the token" is `DELETE /users/{user}/tokens/{id
+or name}` with the admin token, after C1 to C4, with `grant.call` and `grant.result` whose reason is the
+decision (D8). Best effort; a failure adds `serviceLeft`.
+
+**Settle.** Once `issue` has renamed the file, the file may hold the new token or the previous one, and the
+record may name either. The executor and the restart never guess. They read the store file and ask Gitea which
+token it is: `GET /api/v1/token` with that value in the `token` header (F7 for admin tokens, F13 for the
+two-scope seat token; op `token-whoami`). The answer is an `id`, never a value.
+
+- 200, `id` is the new token: forward. The `gitea_grants` record gets the new token (if `commit` hadn't
+  run), memory loads the file (`Credentials.reload(instance, service)`, a new method with load's checks,
+  built in #436b's row; row 199 doesn't change), and the previous token is deleted.
+- 200, `id` is the previous token: back. The new token is deleted. The record keeps or gets the previous
+  token.
+- 401: the file's token no longer exists at Gitea (F13 b4). The previous token can't be in the file, so the
+  agent holds nothing usable. Delete both by id, unregister, delete the record, unlink the file, and end
+  `grant.failed {code: 'grant-lost'}`. A new decision is needed. No file at all is the same case.
+- 200, `id` is neither token: the file holds a live token this grant didn't mint and step 5 never checked.
+  Memory drops it (199 `revoke`'s memory step) and the agent gets `credential-unavailable`. The file, the
+  record and both recorded tokens stay, and nothing is deleted at Gitea. The step ends `grant.failed {code:
+  'grant-token-unknown', grantDecision, tokenId}`, where `tokenId` is the id Gitea gave, and Jason gets a
+  message. `status` shows `tokenUnknown`. At each start, before `Credentials` loads, the reconcile passes such
+  `(agent, "gitea")` pairs as `held` (a `Credentials` option built in #436b's row, like `reload`), so memory
+  never loads that file. A revoke (section 6) clears it: it unlinks the file and deletes both recorded tokens.
+  The unknown token is Jason's to look at.
+- Anything else is `settle-pending`, and nothing is deleted: 403, 404, 5xx, a timeout, Gitea unreachable, or
+  C1 to C4 failing first. The last `grant.step` stays `commit`, the
+  `grant.call` without a `grant.result` stays listed, and `status` shows `settlePending`. The file stays as
+  it is, and the agent can use it: it holds one of the two tokens, and both passed step 5. The next start
+  and `mosaic grants sweep gitea` settle again. Only a 401 deletes.
+
+| Fails at | State left | Cleanup |
+|---|---|---|
+| 0 | nothing, the decision unspent until the next start | none. `grants run` retries while this bus is up; after a restart the reconcile spends it (`interrupted`) |
+| 1 | nothing | none |
+| 2, before the create | nothing | none |
+| 2, after the create, before the record | a user with the nonce | none here. Restart adopts it by the nonce (below) |
+| 3, before `minted` | maybe a token nobody holds | delete the token by its recorded name |
+| 4 or 5 | a token, maybe some forks | delete the token. Forks stay; they hold only upstream content |
+| 6 before the rename, first grant | a token | unregister, delete the token |
+| 6 after the rename, first grant | a store file with the new token, maybe the record | unlink the file, unregister, delete the record if written, delete the token |
+| 6 before the rename, rotation | the previous grant intact | delete the new token |
+| 6 after the rename, rotation | the file holds the new token, memory the previous | settle (forward: the new token passed step 5) |
+| 7 | both tokens live, the new one in use | `serviceLeft: <previousTokenId>` |
+
+**Restart**, before `Credentials` loads, from the last `grant.step`, as #436a X3. The local part runs first;
+the remote part runs after the bus is up, with C1 to C4.
+
+| Last step | Local | Remote |
+|---|---|---|
+| `user` | none | `GET /users/{user}`. 200 with `full_name` ending `[mosaic <nonce>]`, not admin: adopt, record `gitea_users` with its `id`. 404: none. Anything else: `gitea-user-orphan` with the name, for Jason to look at; nothing is deleted |
+| `mint` or `minted` | none | delete the token by name |
+| `commit`, first grant | unlink the file if present, delete the record if present | delete the new token |
+| `commit`, rotation | none | settle |
+| `commit`, rotation, settle-pending | none; memory loads the file as usual | none. The step stays open, and the next start or `grants sweep` settles again |
+| `grant.failed {code: 'grant-token-unknown'}` with no `grant.revoked` after it | pass `(agent, "gitea")` as `held`; memory doesn't load the file | none. Jason's message repeats until a revoke |
+
+Every reader of grant evidence (this reconcile, `status`, `openGrantDecisions`'s callers, `grants sweep`)
+reads a `grant.*` record only where `kind = 'action.allowed'` and `actor_role IS NULL AND actor_run IS
+'grant'`, so a `grant.*` name under another kind or actor is never evidence (duckworth-0067 N1).
+
+Then `grant.failed {code: 'interrupted'}` (or `grant.applied` if a rotation settled forward) and a message to
+Jason. A `grant.call` with no `grant.result` is listed in that message. After `interrupted`, the chief raises
+again and Jason approves again.
+
+## 6. Revoke
+
+As #436a section 6, with the same revokers (the human, the assistant in its own organization, the tester on
+dev only):
+
+1. 199 `revoke`: memory, abort a use or the executor in flight, unlink the file.
+2. One store transaction deletes the `gitea_grants` record and records `grant.revoked`.
+3. After C1 to C4, `DELETE /users/{user}/tokens/{tokenId}` with the admin token. If Gitea can't be reached,
+   `grant.revoked {serviceLeft: <tokenId>}`, and `mosaic grants sweep gitea` clears it later. When the last
+   `grant.step` is a rotation's `commit` with no settle after it (settle-pending, or `grant-token-unknown`),
+   two tokens are live and the record may name either (section 5), so the revoke deletes both
+   `previousTokenId` and the minted `tokenId`, each failure listed in `serviceLeft` (dewey-0761). The id
+   `grant-token-unknown` named is not one this stack minted; it stays for Jason.
+
+That closes 199 D12's gap: the token is gone at Gitea without Jason's A5 step.
+
+The Gitea user and its forks stay after a revoke, so a new grant can reuse them.
+
+On `credentials delete` (a fire), after the steps above and with the recorded `id` checked first:
+
+- `GET /users/{user}/tokens` with Basic (F9), and delete every token it lists, not only the recorded one. A
+  token the record doesn't know about doesn't outlive a fire.
+- `PATCH /admin/users/{user}` with `prohibit_login: true` (F10).
+- Each step that fails is listed in `serviceLeft`, and `sweep` retries it.
+
+## 7. Store records
+
+Two tables, in #436a S1's migration if #436a row b and this row land together, otherwise a `3j-3k.sql`:
+
+- `gitea_users`: business, agent, user, id, nonce, the decision that created it.
+- `gitea_grants`: business, agent, user, tokenId, tokenName, projects, rotate-by date, decision.
+
+The executor, revoke and `sweep` are the only writers, each in the transaction of its record. The admin slot
+is a file, not a table, so a store backup holds no admin token.
+
+The audit records (`grant.step`, `grant.call`, `grant.result`, `grant.applied`, `grant.failed`,
+`grant.revoked`, `grant.sweep`) are `action.allowed` events with that name in `body.action`. They are not new
+event kinds, so `events` and its CHECK (`3b.sql:9-30`) aren't rebuilt. This section is the rule's only home
+(mos-1144). #436a r6 (f9039682e) uses it too: #436a row a's BUILD.md cites this section at the commit Duckworth
+approves and maps r6's names to `body.action` values, with these renames (gizmoduck-0084):
+`host.enroll.step` to `grant.host.enroll.step`, `host.enrolled` to `grant.host.enrolled`, `host.checked` to
+`grant.host.checked`, `host.removed` to `grant.host.removed`. Cites are origin/refactor 00d4cc1f6.
+
+**The guarded namespace** is one pattern: an `action.allowed` whose `body.action` or `body.operation` GLOBs
+`'grant.*'`. `operation` is included because `#consumeGrant`'s consume record is
+`{operation: 'grant.<method>', decision}` (#436a X1), and a forged one would spend a decision (Dewey N2). Row
+210's `host.sudo` and `host.run`, written from agent sessions, stay outside it, and no grant-path name is left
+under `host.*`.
+
+**The grant actor** is `actor_role IS NULL AND actor_run IS 'grant'`. The only production insert into `events`
+is `#event` (`packages/bus/src/broker.mjs:568`), which writes the session's role and run. Every session with a
+NULL role also has a NULL run: the human (`:537`), the reader (`:549`) and a session-less record (`:1124`). The
+tester's role is `tester`. So neither a session nor the human path can produce that pair, as no instance can
+be named `_bus` (`:166-168`). A `system` role would not be safe, because `system` matches `ID_PATTERN`
+(Dewey N1). The broker writes guarded events, the consume record included, through a private session-less
+writer added in #436a row a; `#event` is unchanged. Revoke, sweep and check run for the human, the assistant,
+the tester or the chief, and their events still go out under the grant actor, with `body.by` naming the caller
+the broker checked.
+
+**Two guards** stop a forged record:
+
+- `recordEvent`, the trusted adapters' path (`broker.mjs:1111`), refuses `reserved-event` for any
+  `action.allowed` in the guarded namespace, as it does today for `git.push.working` and the merge action.
+- The migration adds a trigger: an `action.allowed` in the guarded namespace aborts unless
+  `actor_role IS NULL AND actor_run IS 'grant'`. That covers any path that misses the first guard.
+
+**Spend rule (B1).** `#spent` (`broker.mjs:811-817`) counts any `action.allowed` that names the decision in
+`body.decision` and whose `operation` isn't `decision.raise`; a record with no `operation` counts. So the
+consume record is the only guarded body with a `decision` key. Every other `grant.*` body names the decision
+`grantDecision`. A step 0 or step 1 refusal therefore leaves the decision unspent, and the start reconcile
+for "resolved yes, unspent" keeps reading `#spent` unchanged.
+
+A wider gap sits under this one and isn't this row's: today any `recordEvent` `action.allowed` that carries
+`body.decision` spends that decision. Follow-up for Sage to file.
+
+**Open decisions (N6).** One query, `openGrantDecisions(business, method)`: `credential.mint` decisions
+resolved yes by the human whose raise body has `grant.method = method`, and for which `#spent` is false.
+`status` lists them, `grants admin rotate` counts the ones it voids (all of them, since `adminSha256`
+changes), and the start reconcile reads the same query.
+
+**No task refs.** Guarded bodies never carry `target` or `task_ref` holding a task ref, so they stay clear of
+`task-subject-required` (`broker.mjs:561-565`) on any path. No other `action.allowed` reader sees these
+events: the rest key on `decision.raise` (`:670`, `:803`), `git.push.working` (`:863`, `:2019`) or
+routine (`:2100-2102`).
+
+## 8. Approval notes for Jason
+
+Stated once, here, for the #436b approval:
+
+- **Site admin plus `write:user`, and `write:admin`.** The admin token can mint a token for any Gitea user,
+  with any scope up to its own three, including users the stack didn't create (F4). With `write:admin` it can
+  also set any user's password, email and admin flag, and disable any user (F10, proven on scratch against a
+  second site admin). Whoever holds the token can take over any account on that Gitea, jason.woltje's
+  included, make any user a site admin, and read or write any repository. The executor uses none of that
+  beyond its steps, but the token itself can.
+- **Same uid on dragon-lin.** The token is a file readable by jwoltje, and every agent process on dragon-lin,
+  T3 dev seats included, runs as jwoltje (3c). The seat sandbox keeps sandboxed workers away from it. It does
+  not keep an unsandboxed same-uid process away. Such a process gets instance admin by reading the file, which
+  is more than it could get by forging an Approve. A separate uid would close that path. It is deferred on cost
+  (3c), not because it wouldn't help.
+- **For comparison, today (D12).** Every dev seat on dragon-lin already pushes as jason.woltje through
+  `scripts/git-credential-mosaic.mjs` (mos-1106). jason.woltje is a site admin on git.mosaicstack.dev, with
+  restricted false (mos-1146: Mos read `/api/v1/users/jason.woltje` with the mos token at 23:05:29Z; Jason's
+  token wasn't used). So a same-uid process on dragon-lin can already act as a site admin there through that
+  credential, and the admin file adds little exposure on that Gitea beyond what the seats already have. It
+  still matters on any other Gitea a business grants on, and once seats stop pushing as jason.woltje (#431).
+- **A seat token's reach can grow.** Step 5 checks, at the grant, that the token reaches only its forks. If
+  someone later adds the user to an org or as a collaborator, the token reaches that too, until the next grant
+  or rotation checks again.
+- **The admin account is dedicated by promise.** Code checks that it is a site admin with these three scopes
+  and no reachable repositories (C1 to C4). It can't check that nobody else uses it or that it is in no org.
+- **The bootstrap step** (3e) is the one manual credential step: Jason creates `mosaic-grant`, its TOTP and
+  its token, and enters the token once on stdin.
+
+## 9. Tests and mutants (for the row, not built here)
+
+Unit tests use a fake Gitea over TLS, as row 199's publish tests do. Section 1's facts get a scratch
+gitea/gitea:1.27.1 test on 127.0.0.1 with throwaway data, removed after. No test contacts git.mosaicstack.dev
+or any other live service. No token value is printed.
+
+| Test | Claim |
+|---|---|
+| X-G1 | a gitea raise for an agent without `gitea`, `identity` or `publish`, or a project outside `publish`, a remote on another host, no admin slot, or a slot past rotate-by refuses and stores nothing |
+| X-G2 | `set` refuses a version below 1.27.0 (fake reports 1.26.4, 1.27.0-rc0, and 1.9.0 against 1.27.0 as a string trap), a non-admin, a login mismatch, an account that reaches a repository, a token with another scope or `all`, and a second `url`. It writes nothing on any refusal |
+| X-G3 | on scratch 1.27.1, end to end: user made with the nonce and its `id` recorded, token minted with the two scopes, forks made, step 5 passes, `issue` writes the 0600 file, `grant.applied`, then revoke deletes the token at Gitea (gone from its list) |
+| X-G4 | an existing user with no record, a recorded name whose `id` differs (deleted and remade, and a case variant of the name), a site-admin user and a disabled user each refuse before any token call |
+| X-G5 | each failure row of section 5 leaves the stated state, rotation rows included. A failed delete leaves `serviceLeft`. A revoke while a rotation's `commit` is settle-pending, and one after `grant-token-unknown`, deletes both `previousTokenId` and the minted `tokenId` at the fake, and a failure of either lands in `serviceLeft`. A new grant for a held agent refuses `grant-token-unknown` at step 0, before any Gitea call |
+| X-G6 | a restart after `user` adopts a user whose `full_name` ends with ` [mosaic <nonce>]` (16 lowercase hex), whose lowercased login equals `gitea.user` lowercased and who isn't an admin; does nothing on 404; and reports `gitea-user-orphan` for a different `full_name`, a different login or an admin. A restart after `mint`, `minted` and `commit` of a first grant leaves no token at Gitea, no file and no record. A restart after `commit` of a rotation settles forward when the file holds the new token and back when it holds the previous one, ends `grant-lost` only on a 401, and stays `settle-pending` with nothing deleted on 403, 404, 500, a timeout and an unreachable fake. On 200 with an unknown `id` it drops the credential from memory, deletes nothing at Gitea, keeps the file, ends `grant-token-unknown`, and a second restart still doesn't load the file; a revoke then clears it |
+| X-G7 | an identity, publish, upstream or admin slot change between raise and Approve refuses `decision-mismatch` before any Gitea call. An admin rotate voids open grant decisions and `status` lists them |
+| X-G8 | every admin-token and seat-token call writes `grant.call` before it and `grant.result` after it, paired by `callId`. A crash between them is listed by reconcile. No record body holds a token |
+| X-G9 | admin rotate: C1 to C4, the successor named by time, checked, written, the old token deleted. Two rotations in one second's name refuse cleanly, not half done. Past rotate-by, the raise and the executor refuse |
+| X-G10 | seat-token rotation: the new token is live before the old one is deleted |
+| X-G11 | a step 0 refusal (rotation due, too old) and a step 1 refusal leave `#spent` false, and `grants run` by the human gets past `#consumeGrant`. `grants run` from an agent, the chief or the tester refuses. A `grants run` while a start holds the claim refuses `grant-busy` before any Gitea call. No `grant.*` body other than the consume record has a `decision` key. A step 0 refusal, then a restart, then `grants run`: the reconcile has spent the decision as `interrupted` and `grants run` refuses `decision-consumed`; before the restart `status` shows `spentAtNextStart` |
+| X-G12 | step 5 refuses `gitea-reach-wider` when the user was made collaborator on another repository, when it joined an org team, and when it owns a fork of an upstream that has left `publish`, and deletes the token. It passes with an old fork of a `publish` project outside `target.projects`, which the rendered block named. A fake returning 51 forks over two pages is read in full; a total that disagrees refuses `gitea-reach-unknown` |
+| X-G13 | `recordEvent` refuses an `action.allowed` with `body.action` `grant.call` (and each `grant.*`) and one with `body.operation` `grant.gitea`. A direct store insert aborts on the trigger for `grant.step` and `grant.host.enrolled` from a session, and for `grant.step` under the human's NULL pair. `host.sudo` from an agent session still writes |
+| X-G14 | fire: every token the user has is deleted, the user gets `prohibit_login`, and a failure of either lands in `serviceLeft` |
+| X-G15 | a `grant.step {step: 'commit'}` stored under `action.refused`, and one under the human's NULL pair, are ignored by the restart reconcile: no settle runs and no Gitea call is made |
+
+Mutants, a first list: drop the version floor; compare the version as a string; accept another admin scope;
+skip `gitea-user-foreign`; compare the user by name instead of `id`; skip the admin-user refusal; adopt a user
+at restart without the nonce; create the user before writing `grant.step user`; mint before writing
+`grant.step mint`; delete the old token before `issue`; settle a rotation by the record instead of
+`token-whoami`; run C1 to C4 after `#consumeGrant` instead of before; drop the `identitySha256` compare; drop
+`adminSha256`; skip the `grant.call` write; write `grant.result` before the call; drop the `grant.` reservation
+in `recordEvent`; drop the trigger; widen the trigger to `host.*` (breaks `host.sudo`); guard `body.action` only, not
+`operation`; key the trigger on `actor_run` alone; put `decision` in step 0's `grant.failed`; delete both
+tokens on a settle 403 or 5xx; compare step 5 against `target.projects` instead of `publish`; read one page
+of `/user/repos`; let `grants run` skip the claim; send the admin token in a `token` header on the mint route; revoke the
+remote token before the local steps; skip the fork `parent` check; skip step 5's reach check; delete only the
+recorded token on fire; let `grants run` accept an agent; keep the file in use on a settle 200 with an
+unknown `id`; load a `held` pair at start; revoke only `tokenId` on an open rotation; let step 0 pass a held agent; drop the `kind` filter from the restart reconcile.
+
+## 10. Shared with Bushroot's GitHub half (proposed in megavolt-0036, answer pending)
+
+- S1. The `grant` body: `{method, agent, rotateBy, target}`, scopes fixed by code per method.
+- S2. The admin slot: `<configDir>/secrets/grants/<business>/<method>/admin`, set once by
+  `mosaic grants admin set <method>`, never an agent service. One service instance per method per business.
+- S3. `grant.call` and `grant.result` (r2: two records, paired by `callId`) for every service call, as reserved
+  `action.allowed` bodies (section 7).
+- S4. The executor shape: pre-checks before consume (step 0), claim, consume, mint, verify, `issue`, applied,
+  with `grant.step` before and after the mint, and settle by asking the service which credential the file
+  holds. GitHub may not fit "mint once and store" (App installation tokens expire within an hour). If so, S4
+  becomes per method and the rest stays shared.
+- S5. Revoke local first, then the record, then the service, with `serviceLeft` and `grants sweep`.
+- S6. A capability floor per method, checked at `set`, before every start and before every remote undo.
+
+Dewey notes items 2, 3 and 5 of dewey-0754 apply to S3, S4 and S6. The r2 text above carries them.
+
+## 11. Questions
+
+- Q-B1. Answered (dewey-0754 item 9): on fire, `prohibit_login` and delete every token (section 6). The PATCH
+  route is proven (F10).
+- Q-B2. Answered (dewey-0754 item 10): no organizations. The token's real reach is checked at step 5 and
+  stated in section 8.
+- Q-B3. Bushroot's answer on S1 to S6.
+- Q-B4. Answered (mos-1146): jason.woltje is a site admin on git.mosaicstack.dev, restricted false. Section 8
+  says so.
+- Q-B5. Answered (gizmoduck-0081, -0084, mos-1144): one rule for #436a and #436b, section 7. #436a row a's
+  BUILD.md cites section 7 at the commit Duckworth approves, or carries its text in full if row a's candidate
+  comes first. Duckworth checks it with that candidate.
@@ -0,0 +1,167 @@
+# Row 199 (#1697): per-agent credential store, each agent's own git identity, publish to its fork
+
+Builder: Megavolt. Brief: `docs/plans/2026-10-20_agent-credentials.md`. Design: `DESIGN.md` r6 at
+4d3007ec9, approved by Duckworth in duckworth-0027 (REVIEW-r6.md at 640011518). Authority model ruled
+by Mos in mos-1027. Branch: megavolt/row199. Reviewer: Duckworth.
+
+Status: in progress. The full gate has not run; it is Sage's. Only single test files have run on
+this branch, apart from one slip noted under "Runs".
+
+## Commits so far
+
+- 286bf598c business: agent identity, the publish grant, the project upstream with the D9c parse, store
+  credential references; git.push.remote as a hard wait.
+- a2c387dba bus: broker publish authority (checkPublish, recordPublish, publishRefused, pushCommit on
+  the raise); the D9c parse moves to `business/src/vocabulary.mjs`; pm.md and chief-of-staff.md list
+  git.push.remote among the hard waits.
+- 609dc9364 bus: the per-agent credential store in `credentials.mjs`.
+- 504336797 bus: runtime wiring, the store root and the four publish entries in the op table.
+- a18fc6cf8 tasks: request calls use `useFor` keyed from the session; the start probe keeps `use`. The
+  D5 test in `credential-store.test.mjs` pins the `use(` call sites to `credentials.mjs` (useFor's own
+  call) and `tasks/src/adapter.mjs` (the host's @sync and start probe).
+- aa740cc71 bus: the lifecycle verbs `credentials.issue`, `credentials.revoke` and `credentials.delete`
+  in `credential-verbs.mjs`, the broker branch, the runtime wiring; `organizationWriter` gets a
+  `detail` on `write` and a receipt-only `record`.
+- 0cdace415 cli: `mosaic credentials status|issue|rotate|revoke|delete`, the scripts/mosaic route, docs.
+
+## Deviations from DESIGN.md r6
+
+1. **Identity is optional on an agent.** D8 reads as identity on every agent. Today's business files
+   carry none, so identity stays optional and `publish` requires it (N10's load refusal). An agent
+   without identity commits as E7 (T6).
+2. **Revoke of a `{file}` or `{env}` reference.** Section 6 describes revoke for store references.
+   For a reference outside the store, revoke forgets the token in memory and never unlinks the file;
+   the lifecycle verb then turns the business file's reference into `store`, so a restart finds
+   nothing. The test: `credential-store.test.mjs`, "revoke of a {file} reference".
+3. **Issue order.** Issue writes the token file (tmp, fsync, rename, dir fsync), then runs the
+   caller's commit (the business file's reference becomes `store`), then sets memory. A failed commit
+   leaves the file on disk and the token out of memory, so the agent stays `not-issued` until the
+   issue is run again. The test: "a failed commit leaves the token on disk but not in memory".
+4. **The D9c parse lives in `business/src/vocabulary.mjs`, not `business.mjs`.** The broker reads
+   `forkProblem` and `forkUrl`, and `project-runtime.test.mjs` pins the broker's import closure to
+   files that import nothing. `business.mjs` wraps `parseGiteaUrl` with the loader's refusal
+   messages. The pin test names the two new imports.
+5. **`withGitea` takes the publish ticket, not a cap (D9b).** The key is the session checkPublish
+   checked with `#agent` (a run holding its claim; never a tester, reader or human), read through
+   `broker.publishSession(ticket)`. The token is usable only between checkPublish and recordPublish
+   or publishRefused. Its refusals are filed once, by publishRefused on the task's trail, and not
+   also by `refusing()`. The test: `publish.test.mjs`, "runtime: withGitea keys from the open ticket
+   only".
+6. **Role contracts.** `workflow-roles.test.mjs` requires the hard waits listed in `roles/pm.md` and
+   `roles/chief-of-staff.md` to equal GATED_ONLY. Adding git.push.remote to the vocabulary made it
+   fail, so both lists now name git.push.remote. Prose only; no hash pin reads either file. Duckworth
+   should review this hunk because `roles/` is reviewed authority.
+
+7. **Delete takes a reason.** Section 6 lists `delete AGENT` with no reason. The broker requires
+   `reason` on delete as on revoke, so every receipt that ends a credential says why.
+8. **Rotate is `credentials.issue`.** There are three bus verbs, not four. An issue over an entry the
+   bus holds is recorded as `rotate` in the receipt and the answer. The CLI's `rotate` reads the
+   status first and refuses before reading stdin when nothing is issued.
+9. **Issue covers entries the bus loaded.** The business file must already name the kind for the
+   agent, and the bus must have loaded that reference at start; otherwise `credential-unknown`. An
+   agent added after the bus started needs the restart row 165 already asks for. Row 194's human
+   `create` is where a new agent's `store` references come from.
+10. **No Console page yet.** Section 6 puts the verbs in the Console's agent page too. This branch has
+    the bus verbs and the CLI. The Console page is a separate piece (packages/webui, its `BUS_VERBS`
+    and `STATUS` pins); I raise the split with Sage before the manifest. Ruled in sage-1421: the
+    Console page is out of row 199 and becomes a follow-up row with Webby as reviewer. The manifest
+    holds bus, business, tasks, cli and seat.
+11. **The push runs in the bus child, and the git socket polls for it (D9b).** The git socket runs in
+    the host process. The broker, the runtime and the token are in the bus child that
+    `packages/cli/src/host.mjs` forks, and host ops cross that IPC one at a time with a 10 s answer
+    limit. ls-remote and the push can run longer than that, so `withGitea(ticket, fn)` can't wrap a
+    host-side git. The split: the socket runs D9 steps 3 and 4 (tip and identity under the lock,
+    `working.publish`), then op `publishPush`, which starts `publishRemote` in the bus child under
+    `withGitea` and answers `{state: 'running'}`. The socket polls op `publishResult` every 200 ms
+    until it reads `pushed` or `refused`. Fork, user, source and destination come from the ticket
+    (`broker.publishTarget`), never from the host's message. `recordPublish` also refuses `ref-moved`
+    when the pushed ref isn't the ticket's destination. A second `publishPush` on a running ticket
+    refuses `publish-busy`. The token reaches git on fd 3 only (`runGit` option `pass`), read once
+    by a one-shot credential helper that answers `get` for https on the fork's exact host and port.
+    On close, a running publish's git isn't awaited; git's own time limit ends it, and the ticket
+    goes with the process. The 10 s IPC limit stays as it is (sage-1440). The poll has a bound
+    (sage-1440): `publishDeadlineMs`, by default four times git's limit and grace (publishRemote runs
+    at most four git commands) plus 30 s. Past it the socket refuses `publish-timeout`, filed once by
+    publishRefused, and logs that the bus process's push may still reach the fork. A failure that is not a refusal is filed as `git-failed` and logged on
+    the bus's stderr by error name and code only. Tests: `seat/tests/publish.test.mjs` (11),
+    `bus/tests/publish.test.mjs` (the process ops), `cli/tests/publish-socket.test.mjs` (7, end to
+    end through the socket, the in-process runtime, the store and a TLS fake Gitea; one is the
+    publish-timeout outcome).
+12. **No harness tool for publish.** `packages/harness/src/git-tools.mjs` has push, fetch and land
+    clients. A runner tool that calls the socket's `publish` op is in packages/harness, outside the
+    manifest scope sage-1421 set. Today a publish needs a socket client; the tool is a follow-up.
+13. **The bind rule's `git.push.remote` clause has no test of its own.** D11 adds it and the
+    launcher has it. A role can publish only a push its own role made (`work-not-yours`), and
+    `recordPush` needs `git.push.working`, which already binds the socket. No role reaches the
+    clause alone, so dropping it changes no outcome today. It matters once a role can publish work
+    it didn't push. Ruled in sage-1440: keep it; its mutant goes in the section 11 list as
+    equivalent, with this reasoning, and Duckworth judges it.
+14. **A push between checkPublish and the git push refuses; it never lands a different commit.**
+    T3 says such a push "doesn't change the commit that lands". Under the hard wait it refuses:
+    `working.publish` checks the work ref's tip against the ticket's source under the lock
+    (`ref-moved`, `seat/tests/publish.test.mjs`), and `recordPublish` checks `pushCommit` again
+    (`decision-mismatch`, `bus/tests/publish.test.mjs` "r4 B4"). The fork gets only the ticket's
+    oid either way. N9's routing-commit test still applies. Ruled in sage-1440: T3's wording in
+    DESIGN.md now reads "refuses with `ref-moved` or `decision-mismatch`", and an end-to-end test
+    asserts each code mid-flight in `cli/tests/publish-socket.test.mjs`: a push after checkPublish
+    refuses `ref-moved` with no request to the fork; a push recorded while the bus process pushes
+    refuses `decision-mismatch`, filed once, and the fork holds only the ticket's oid.
+
+15. **Fix: rotate on a due gitea key (gizmoduck-0050, sage-1494).** The CLI's `ISSUED` set
+    (`packages/cli/src/credentials.mjs`) listed valid, expiring and expired, but the bus's `status()`
+    gives a gitea key past its rotate-by date `rotation-due`. So `credentials rotate` refused the one
+    case it exists for. `ISSUED` now names every state status() gives a held token. The test:
+    `cli/tests/credentials.test.mjs`, "rotate goes ahead on each held state". Its mutant (the old set)
+    fails that test and goes in the section 11 list.
+
+## N9, for the routing commit (sage-1388)
+
+Today git.push.remote is a hard wait, so every publish carries a decision, and the decision's
+`pushCommit` fixes the commit. If a later commit routes git.push.remote within role, a publish has
+no decision and no `pushCommit`. `#publishFacts` then takes the commit from `#latestPush`, and the
+git socket's tip check under the lock is the only thing that holds it. That commit needs a test
+that a push between checkPublish and the git push doesn't change what lands.
+
+## R1, the backup set
+
+Checked at 504336797. Row 185's `backup_store` (`scripts/stack-release.sh:372-392`) copies only
+`<dataRoot>/bus/bus.sqlite`, plus its sums, modes, listing and stamps, into
+`<dataRoot>/backups/stack/<activation>/`. Nothing under `<configDir>` is copied, so
+`<configDir>/secrets/agents` isn't in the backup set. `rehearse` copies the live business file
+through `R_BUSINESS_JS` (`:1268-1288`). Its `swap` replaces every credential reference, a `store`
+one included, with a placeholder file in the rehearsal's own dir. The guard then refuses
+`credential-ref-live` unless every reference is such a placeholder (`:1329-1337`), so a rehearsal
+never reads a store token. A backup tool outside this repository that copies `<configDir>` would
+copy tokens. That is R1's open half, and it is Jason's to check on each VM.
+
+## T1 limit
+
+A wrong owner on a store dir or file can't be set up without root, so T1 covers modes, symlinks and
+dirs. The owner check (`st.uid !== process.getuid()`) is in `privateDir` and `#read`, and is untested.
+
+## Runs
+
+Single files, each green on its commit: bus broker, decision-close, decision-route, decisions,
+hard-waits, land, project-runtime, launch-notice, review, publish, credential-store, credentials,
+credential-status, limits, tester, plugins-verb, routes-verb, limits-runtime, instances-verb, web,
+usage-runtime, limit-checks, daily-quota-runtime, chief-of-staff, tasks, tester-writes; every
+business test file. Since: credential-verbs (2/2), credential-store (11/11, with D5), each tasks file,
+tester, credential-status, plugins-verb, routes-verb, instances-verb; business launch-settings,
+plugin-settings, instance-settings, token-limit-settings; cli credentials (3/3), cli, app,
+tester-reads, tester, other-tree, transport, instances, limits, verbs. Hash pins: none on a changed
+file (`thread-migration.test.mjs:46` pins DDL only).
+
+Publish, single files, each green before its commit: seat
+checkout (77), working (26), publish (11), landing (8); bus process (8), land (17), publish (12),
+credential-verbs (2); cli publish-socket (4), git-socket (24), launcher (29); harness tools (22).
+Hash pins: none on a changed file.
+
+sage-1440 changes (the poll bound, the mid-flight tests), single files, green before the commit: cli
+publish-socket (7), git-socket (24), launcher (29). Hash pins: none on a changed file.
+
+The rotation-due fix, single files: cli credentials (4), green; the old-set mutant fails it 3/1.
+Hash pins: none on a changed file.
+
+Slip, 2026-10-20 about 19:51Z: I ran `node --test packages/tasks/tests/*.test.mjs` in one command,
+which is a package suite, without asking Sage for the slot. It passed, 97 pass and 0 fail, in under a
+minute. Reported to Sage in megavolt-0017.
@@ -0,0 +1,430 @@
+# Row 199 design: a credential store per agent, own git identity, pushes to a remote
+
+Megavolt, 2026-10-20. Gitea #1697, MVP T1 item 6. Brief: `docs/plans/2026-10-20_agent-credentials.md`.
+Reviewer Duckworth. Mos rules on the authority model (section 9) before any code. Base: refactor at 992650232.
+No credential value was read to write this. Evidence is code and docs only.
+
+r2 answers duckworth-0013 (review at 6ab9cd927 on duckworth/reviews): B1 in D3a, T1 and T5, B2 in D9 step 5
+and T3, N1 in section 6 and Q-M3, N2 in section 6, N3 in D9 step 3, N4 in D9a and T3, N5 in E5 and D9b.
+
+r3 records Mos's rulings (mos-1027) in section 9. The Q-M2 hard wait changes D9 step 1, D9b and T3. Q-M1
+drops O2 (D10, A3, R2).
+
+r4 answers duckworth-0017 (REVIEW-r3.md at 4065ed59f): B3 in T3 and D9 step 5, B4 in D9 steps 1, 3 and 5, N6
+and N7 in D9a, N8 in D9 step 1.
+
+r5 takes webby-0011 N1 (row 194 review, through honker-0009): the host checks at each push that the
+remote's owner is the agent's own Gitea user. r4 named one `remote` per project, which can't be a fork per
+agent (O1) once two agents publish the same project. So `projects.<p>.remote` now names the upstream
+repository, and the host builds each agent's fork URL from it (D9 step 2, D10, T3). It also fixes a conflict
+found while building: D8 made `identity` required for every agent whose definition declares `gitea`, while D9
+step 2 says today's files load unchanged. Coder declares `gitea`, so r5 makes `identity` optional and
+`publish` require it (D8).
+
+r6 answers duckworth-0026 (REVIEW-r5.md at 3cb6888e1), with Mos's acceptance (mos-1043). B5: the derived URL
+has one name, `fork`, and D9a's `ls-remote`, step 5's push, the helper's host match, `checkPublish`'s result
+and step 6's event all use it (D9, D9a, D9b, T3). B6: the URL parse is written down (D9c) and tested (T3).
+N10 in D8 and T3. N11 in D9a and A3. N9 is carried to BUILD.md for the routing commit.
+
+## 0. Terms
+
+- **Stack instance**: one Mosaic Stack deployment (row 190). It has one OS user, one config dir
+  `~/.config/mosaic-NAME` (here `<configDir>`), one data root and one bus. Case 1 and Case 2 are two stack
+  instances on two VMs (DECISIONS Q180).
+- **Agent**: a role instance in a business file (`roles.<agent>`). Today's code calls it "instance". This
+  design says agent.
+- **Kind**: a credential type: `gitea`, `vikunja`, `model`.
+- **Host**: the bus process and its git socket, running as the stack instance's OS user, outside any sandbox.
+
+## 1. What exists (measured at 992650232)
+
+| Code | Fact | Where |
+|---|---|---|
+| E1 | The business file references credentials per agent: `roles.<agent>.credentials.<kind> = {file or env, rotateBy or expires}`. The kinds an agent may hold are the ones its role definition lists | `business/src/business.mjs:89-111`, `credentials.mjs:18-38`, `role.mjs:105-118` |
+| E2 | The bus reads each token once at start (O_NOFOLLOW, own uid, 0600, at most 16 KiB, outside the repos and data root) into a private map keyed `<business>/<agent>:<kind>` | `bus/src/credentials.mjs:18-89`, `bus/src/runtime.mjs:78-89` |
+| E3 | Only Vikunja uses a token: `credentials.use("<business>/<agent>", "vikunja", ...)`. Gitea tokens are loaded and never used. `assertClean` refuses any event that contains a token | `tasks/src/adapter.mjs:70`, `runtime.mjs:134`, `broker.mjs:560` |
+| E4 | Agents run in bwrap as the bus's own uid. `~/.config`, `~/.mosaic` and `~/.ssh` are not bound. The git socket is bound only for `git.push.working`, `review.verdict` or a landing | `seat/src/sandbox.mjs:21-30, 104-124`, `cli/src/launcher.mjs:401` |
+| E5 | A session proves who it is with a 64-hex cap the broker mints and maps to a frozen session record. The git socket resolves the cap to (business, role) before anything else | `broker.mjs:280, 379-383`, `packages/cli/src/git-socket.mjs:398-407` |
+| E6 | The model credential is one env file per host (`EnvironmentFile=-%h/.config/mosaic-dev/secrets/claude-session.env`). `ENV_ALLOW` passes it into every sandbox, so every agent holds the same model token | `cli/systemd/mosaic-bus.service.in:24`, `seat/src/session.mjs:83-94` |
+| E7 | Commits in a session's clone use `<agent>@<business>.mosaic.invalid`. Landed squashes use "Mosaic bus host" | `sandbox.mjs:151-157`, `working.mjs:280-281` |
+| E8 | No code pushes to a remote. The git socket pushes bundles into a local bare working repo with no remote and no credential | `working.mjs:1-14, 198-238` |
+| E9 | Adding or changing an agent refuses a definition that declares credentials (`organization-credentials-out-of-scope`). Binding them is a hand edit. Row 194's design keeps that refusal for create and hire "until the credentials row" | `business/src/instance-settings.mjs:20-29`, row 194 DESIGN.md D1 |
+| E10 | The development repository's helper pushes as one identity from one JSON file | `scripts/git-credential-mosaic.mjs` |
+
+So per-agent references and a host-only reader already exist for two kinds. What's missing: a fixed place for
+the files, an agent identity, any remote push, lifecycle verbs, and a model credential that agents don't
+share.
+
+## 2. The store (brief item 1)
+
+D1. **Layout.** Each stack instance keeps its agents' secrets under its own config dir:
+
+```
+<configDir>/secrets/agents/                       0700, owner = the stack instance's OS user
+<configDir>/secrets/agents/<business>/<agent>/    0700
+<configDir>/secrets/agents/<business>/<agent>/<kind>   0600, the token only, one line
+```
+
+This is row 190's secrets root (`<configDir>/secrets/...`, as Q175's slot uses). The token file keeps E2's
+format, so the bus reader doesn't change. Nothing in a token file is a name, an email or a URL. Those are not
+secret and go in the business file (D6), where review sees them.
+
+D2. **The business file reference.** A new reference form, `{"store": true, "rotateBy" | "expires": DATE}`,
+means "the file at the layout path for this business, agent and kind". The path is derived, never written,
+so an agent's entry can't name another agent's file. The old `{file}` and `{env}` forms stay valid for
+migration (section 7). A `{file}` reference that points inside `<configDir>/secrets/agents/` but not at its
+own agent's path refuses `credential-not-yours` when the business file loads.
+
+D3. **Read path.** Unchanged in shape: the bus reads every entry once at start (E2) and on a store change
+(section 6), and holds the values in memory. No sandbox binds `<configDir>` (E4 already holds). No token goes
+into a sandbox for `gitea` or `vikunja`. The agent asks the bus to act, and the bus uses the token.
+
+D3a. **A `store` reference with no file.** ENOENT on a `store` path loads as an absent entry. `status` shows
+`not-issued`, and `useFor` refuses `credential-unavailable`. The bus still starts. This is the state after a
+create without `issue` (D13) and after `revoke` (section 6). Every other defect still refuses start: wrong
+owner or mode on the file or a dir, a symlink, a non-regular file, bad format, a missing or wrong-mode
+`secrets/agents/` dir. `{file}` and `{env}` keep E2's behavior, where a missing file refuses start.
+
+## 3. The "RLS equivalent" (brief item 1)
+
+Three layers. Each one is enforced by code or the OS, not by prose.
+
+D4. **OS, between stack instances.** Files are 0600 and dirs 0700, owned by the stack instance's own OS user.
+Case 1's user can't read Case 2's store (Q180: each instance under its own user without sudo). The bus refuses
+to start when any file or dir under `secrets/agents/` has the wrong owner or mode (`credential-file`, as E2
+does for files today, extended to the dirs).
+
+D5. **Bus, between agents of one stack instance.** The principal for every credential use comes only from the
+verified cap (E5). The agent-facing API is `credentials.useFor(session, kind, op)`: `session` is the broker's
+frozen record, and the key is built from `session.business` and `session.role`. It has no agent argument, so
+there is nothing in a request to point at another agent. The existing `use(name, kind, op)` stays for the
+host's own `@sync` entry and is not reachable from a request. The tasks adapter's per-role calls (`ctx.as`,
+`verbs.mjs:126`) move to `useFor`. Any request field that names an agent other than the caller (`as`,
+`agent`, `instance`, `role` on a credential path) is refused `credential-not-yours` and recorded through
+`broker.refuse()` as `action.refused`, with the caller's cap and the task ref. A build test greps every
+`credentials.use(` call site and fails on a new one outside the allowlist.
+
+D6. **What stays open.** A process of the same OS user outside the sandbox can read every agent's file. That
+is the same limit as the human proof (P19 333). Q180's per-user VMs move the boundary to "one stack instance
+per OS user". Agents of one instance are kept apart by the sandbox and D5, not by the OS.
+
+## 4. Kinds (brief item 2)
+
+| Kind | 10-27 | Use |
+|---|---|---|
+| `gitea` | yes | Git push to a granted remote (section 5). Gitea API verbs (issues, pull requests) wait. The factory's review flow runs in the working repo today, and no 10-27 case needs an agent to open a pull request |
+| `vikunja` | yes, exists | Moves to `store` references and `useFor`. No behavior change |
+| `model` | per stack instance only | See D7 |
+
+D7. **Model provider.** A model token has to sit inside the sandbox today, because the harness calls the
+provider itself (E6). Per-agent model tokens need a proxy that holds the real token and gives each run its own
+short-lived one, which is the CLIProxyAPI line in TARGET.md. That waits for its own row. For 10-27 the model
+credential is per stack instance: row 190's `<configDir>/secrets/claude-session.env`, owned by that
+instance's OS user. It is never a copy of jwoltje's file. Jason signs in on each VM user himself (A6). Whether
+Case 1 and Case 2 run on Jason's existing subscription or need a new account is Jason's call (Q-J1). This row
+doesn't pick. A pi model credential also waits for P19 #383.
+
+## 5. Git identity and push (brief item 3)
+
+D8. **Identity.** A new business-file key, `roles.<agent>.identity = {name, email, gitea: {url, user}}`. It is
+optional, because today's business files with a `gitea` agent (coder) must load unchanged. `publish` (D9
+step 2) requires it, and requires that the definition declare `gitea`. A business file with a `publish`
+grant on an agent that lacks either refuses at load, and the error names `roles.<agent>.publish` and says
+"needs identity and a gitea definition" (N10). Load is the only place this is checked: a business file that
+fails it never reaches the bus. The sandbox sets `GIT_AUTHOR_*` and `GIT_COMMITTER_*` from
+it in place of E7's invalid domain. The email is the one Jason gives the agent's Gitea user, so Gitea links the
+commits to that user. Agents without `gitea` keep E7.
+
+D9. **Push to a remote: a new git socket op, `publish`.** No new socket, no bundle, and no token in the sandbox.
+
+```
+publish {"cap", "op": "publish", "task_ref", "project", "branch", "decision"}
+  -> {"ok": true, "result": {"fork", "ref", "commit", "previous"}} or a refusal
+```
+
+The host checks, in order, and each refusal goes through `broker.refuse()`:
+
+1. Identity from the cap (E5), then the broker's `#checkAuthority(s, "git.push.remote", {decision, target:
+   task_ref})`, as `checkLand` does for a merge (`broker.mjs:907-913`). `git.push.remote` is a new action in
+   ACTIONS and is not in ROUTED (REQ-WAIT-3, `packages/business/src/vocabulary.mjs:52-58`,
+   `broker.mjs:42-69`), so it is a hard wait and classifies `gated` for every role. Every publish therefore
+   needs a decision the human resolved for this task ref. A decision is spent once (`decision-consumed`).
+
+   **The decision binds one commit.** `#authorityFor` binds action, role, thread and target only
+   (`broker.mjs:769-798`), so the commit needs its own carrier. The raise records it the same way it records
+   `holderRun` for `role.revoke` (`broker.mjs:1733`). When the action is `git.push.remote`, the
+   `decision.raise` event body gets `pushCommit`. That is the commit of `#latestPush(business, target)` at
+   raise time, read by the broker and never taken from the agent. A raise with no recorded push for the task
+   refuses `no-push`. The decision's question shown to the human ends with that commit. `#authorityFor` then
+   refuses `decision-mismatch` when `context.pushCommit` differs from the commit of `#latestPush` now, which
+   is the same check `holderRun` gets at `broker.mjs:796`. So the sequence approve at A, push B, publish B
+   refuses.
+   No role definition grants the action yet. When Jason's PRD version routes it (Sage, Vikunja #420), a
+   reviewed commit adds it to both ROUTED lists and to coder's `withinRole`. From then on a coder publishes
+   without a decision, and `decision` is optional for a within-role class only.
+2. The project is in the agent's grant, `roles.<agent>.publish: [project]`, and the business file names the
+   project's upstream repository, `projects.<project>.remote: "https://HOST/OWNER/REPO"`
+   (`remote-not-granted`). Both URLs pass D9c's parse at load. The upstream's host and port equal
+   `identity.gitea.url`'s (`remote-host-mismatch`). The host never contacts that URL. It builds the agent's
+   fork, `fork = https://HOST[:PORT]/<gitea.user>/REPO`, from the upstream's origin and repository name and
+   the agent's own `gitea.user`. `fork` is the only URL the rest of `publish` uses: D9a's `ls-remote`, step
+   5's push, the helper's host match, `checkPublish`'s result and step 6's event. So the owner of the
+   repository that receives a push is the agent's own Gitea user on every push, by construction, and the
+   agent can't name it (webby-0011 N1). D9c is what makes "by construction" hold. Gitea's refusal of a
+   push to a repository the user doesn't own or collaborate on is the second layer. An upstream whose owner
+   equals the agent's `gitea.user`, compared without case, refuses `remote-not-fork`, at load and at push. `remote` is a new key
+   beside `root` and `repo` (`business.mjs:186`), and `identity` and `publish` are new keys on a role entry
+   (`business.mjs:89`). All three are optional, so today's business files load unchanged.
+3. The source is one commit, `C = context.pushCommit`. It is checked three ways, so all three are equal:
+   the decision's commit, the commit of `#latestPush`, and the work ref's tip in the working repo,
+   `work/vikunja-<project>-<task>` (`working.mjs:110-114`). The tip is read under the repository's lock, and
+   if they differ the push refuses `ref-moved`. The work ref is per task, not per agent. Two checks make it the
+   caller's: `#latestPush` was recorded by the caller's role (`work-not-yours`), and step 4. The destination is always `refs/heads/<gitea.user>/<branch>`, built by the host.
+   `validBranch(branch)` holds (`invalid-request`). The agent never names the destination ref.
+4. Every commit in `main..<work ref>` has author and committer email equal to `identity.email`
+   (`identity-mismatch`).
+5. The push runs through `credentials.useFor(session, "gitea", ...)`: `git push <fork> <C>:<dst>`, by oid,
+   with no `+` and no `--force`. It never pushes by ref name, so a push to the working repo after
+   `checkPublish` can't change what goes out (`non-fast-forward` from git stays a refusal). Git runs with E8's SAFE flags
+   (`working.mjs:92-98`), which set `protocol.allow=never`. `publish` adds exactly two flags,
+   `protocol.https.allow=always` and `http.followRedirects=false`, plus `GIT_TERMINAL_PROMPT=0` and no global
+   or system config. The token reaches git through a one-shot credential helper that reads it from an
+   inherited pipe, never through argv, env, the URL or a file. Seat `gitEnv` (`checkout.mjs:79-89`) takes only
+   PATH from the host and sets the rest itself, so no proxy or `GIT_SSL_*` variable reaches git. `publish` takes a `tls` parameter that
+   defaults to `[]`, the same way `push` takes `fsck = FSCK` (`working.mjs:100`). Tests pass
+   `["-c", "http.sslCAInfo=<scratch CA>"]`. The host never sets it, and nothing in config or env reaches it. The helper answers `get` only when `protocol`
+   is `https` and `host`, port included, equals `fork`'s. It writes nothing for any other `get` and for
+   `store` and `erase`. `assertClean` checks git's output, so a fork that echoes the token gets
+   `credential-leak`.
+6. The bus records `action.allowed` for `git.push.remote` with fork, ref and commit.
+
+D9a. **The agent's fork must share root's history.** A push sends every object the fork lacks. The working
+repo's `main` is the project root's history (`working.mjs`, seed), so a fork that doesn't share it would
+receive all of root, landing squashes included. The check runs on `fork`, never on the upstream: a related
+upstream says nothing about what the agent's `<user>/REPO` holds.
+`publish` runs `seed` first (`working.mjs:164-176`), under the repository's lock as `push` does, so `main`
+catches up with root before the check below. That means a fork also receives any landed root commits that
+upstream doesn't have yet, because they sit under the agent's work. That is expected: the agent's branch is
+built on them.
+Before the push, the host runs `git ls-remote --symref <fork> HEAD` (same flags and helper). It refuses
+`remote-unrelated` when the fork is empty or when that tip isn't a commit the working repo already has and an
+ancestor of `main`. When `ls-remote` exits non-zero, for a fork that doesn't exist, a refused token or a
+network failure, `publish` refuses `fork-unavailable` and the push doesn't run (N11). Git's stderr isn't
+parsed to tell those apart and isn't returned, since it can carry the URL. Only `ls-remote` crosses the
+network for this, so nothing is fetched from the fork. If the fork has moved past root, the refusal stands
+until root catches up. That is a human pull into root, not an agent's.
+
+D9c. **The URL parse (B6).** `projects.<p>.remote` and `identity.gitea.url` are parsed with `new URL()` at load,
+and the business file refuses to load unless all of these hold:
+
+- The scheme is `https:`. There is no username, password, query or fragment.
+- The string equals its own normalized form: for the upstream, `url.origin + url.pathname`; for
+  `gitea.url`, `url.origin + "/"` or `url.origin`. So a dot segment (`/<user>/../OWNER/REPO`), a
+  percent-encoded dot, an upper-case host, an explicit `:443`, a backslash, userinfo, a query and a fragment
+  each refuse, because `new URL()` would change them (checked with node: each differs from its normalized
+  form). A trailing slash survives normalization and is refused by the two-segment rule below. The checks below run on that path, so the owner that is checked is
+  the owner that is used.
+- The upstream's path is exactly `/OWNER/REPO`: two non-empty segments, no more and no fewer. One trailing `.git` on
+  REPO is allowed and stripped. `fork` is built from the stripped REPO.
+- `OWNER`, `REPO` and `gitea.user` each match Gitea's name rule, `^[A-Za-z0-9_.-]{1,100}$` and not `.` or
+  `..`. REPO after stripping must still match.
+- `gitea.url`'s path is `/`. A Gitea served under a sub-path isn't supported by this row and refuses at load.
+- Host and port are compared after `new URL()` normalized them, and an omitted port counts as 443 on both
+  sides.
+- Gitea compares user and repository names without case (`lower_name`), so `remote-not-fork` compares the
+  upstream's OWNER with `gitea.user` without case. An upstream owned by `Coder` and a `gitea.user` of `coder`
+  would otherwise build a "fork" that is the upstream itself.
+
+D9b. **How `publish` reaches the broker and the store.** The git socket runs in the bus process
+(`cli.mjs:504-506`) and reaches the broker only through the host's op table (`bus/src/runtime.mjs:222-246`).
+`publish` adds three entries there, each wrapped in `refusing()`:
+
+- `checkPublish(cap, args)`: steps 1 to 3, including the decision check. It returns `{ticket, fork, user,
+  email, source}` and no token. The ticket holds the session and the decision until `recordPublish`, the
+  same way `checkLand` holds a landing.
+- `withGitea(cap, fn)`: `credentials.useFor(broker.session(cap), "gitea", fn)`. `fn` gets the token and runs
+  step 5. The token never leaves that call.
+- `recordPublish(ticket, result)`: step 6, and it spends the decision.
+
+The op table gets no entry that returns a token.
+
+D10. **Which refs.** Our side: only `refs/heads/<gitea.user>/*`, set by the host (D9 step 3). The default
+branch and other agents' prefixes can't be named. Gitea side, two options (Q-M1):
+
+- **O1. A fork per agent. Ruled by Mos (mos-1027).** The agent's Gitea user has read on the upstream repo and owns a fork
+  named like it. The host derives the fork's URL from the upstream and the agent's user (D9 step 2).
+  Its token can write only repos the user owns or collaborates on, so Gitea itself stops any push to upstream
+  or to another agent's fork. No branch rules are needed per agent, so none can drift. The cost: work reaches
+  upstream as a pull request from the fork, opened by a human or a later API verb.
+- **O2. One shared repo. Not chosen.** The agent is a Write collaborator. Upstream's default and release branches get
+  branch protection with no agent on the push list, plus a rule `<user>/*` per agent. Gitea doesn't stop agent
+  A from creating an unprotected name outside `A/*` unless a catch-all rule outranks the per-agent ones. That
+  depends on Gitea's rule priority, which I haven't verified on our version (probe P1). Every hire adds a rule.
+
+Token scopes for either: `write:repository` and `read:user`, nothing else, per vocabulary.mjs rules (no
+`all`, no admin).
+
+D11. **The host git socket.** `publish` is added to the socket. `push`, `fetch` and `land` don't change. The
+socket's bind rule (E4) adds `git.push.remote`. The working repo stays credential-free and remote-free. The
+`fork` URL is passed per call and never written into its config. A landing still squashes into the project
+root as "Mosaic bus host". Landings don't push anywhere.
+
+## 6. Lifecycle (brief item 4)
+
+All verbs are on the bus, in the CLI (`mosaic credentials ...`) and in the Console's agent page. Every verb is
+human-only. Under Q173 the tester may run `status` and `revoke` on the dev stack instance. `issue` and
+`rotate` stay with Jason, because the tester is an agent and the token would pass through its session
+(duckworth N1). Each one appends to the organization
+writer's `changes.jsonl` (actor, agent, kind, verb, date; never a value). No schema migration, no new event
+kind. A refusal uses `action.refused`.
+
+| Verb | What it does |
+|---|---|
+| `issue AGENT KIND --rotate-by DATE` (gitea) or `--expires DATE` (vikunja) | Reads the token on stdin (never argv), checks E2's format, writes `<kind>.tmp` 0600, fsyncs, renames over `<kind>`, and sets the business file reference to `{"store": true, date}`. The bus reloads that one entry, with no restart |
+| `rotate` | Same as `issue` over an existing entry. The old value is gone from disk and memory when the call returns. Jason then deletes the old token in Gitea (A5) |
+| `revoke AGENT [KIND] --reason` | Drops the entry from the bus's memory first, then unlinks the file. A use in flight finishes. Every later use refuses `credential-unavailable` |
+| `delete AGENT` | `revoke` for every kind, then removes the agent's dir. Refused while the agent has a running claim |
+| `status [AGENT]` | Kind, date and state per entry (E3's `status()`), no values |
+
+D12. **"Stops working at once."** On our side this holds without a timing window. A fired agent never holds a
+`gitea` or `vikunja` token (D3), so revoking means the bus no longer has it. On the Gitea and Vikunja side the
+token still exists until Jason deletes it (A5). The status line for a revoked entry says so until Jason
+confirms. The model token is the exception: it sits in the running sandbox (D7), so a fired agent's runs must
+end. Row 194's fire ends them.
+
+D13. **What row 194 calls.**
+
+- `credentials.issue` is never called by the chief. Row 194's hire stays uncredentialed (its D1).
+- A human `create` of a credentialed definition: row 194 lifts E9's refusal for the human path only. The agent
+  is created with `store` references and no files. `launch` refuses `credential-unavailable` until Jason runs
+  `issue`.
+- `fire` and `delete`: row 194 calls `credentials.revoke(business, agent, {reason, actor})` before it changes
+  the business file. A failed revoke stops the fire (`credential-revoke-failed`), so an agent can't be fired
+  with its credentials still live on our side.
+- `regenerate`: no credential change.
+
+## 7. Who does what (brief item 5)
+
+Agents never mint accounts or tokens. Jason's steps, per agent that needs `gitea`:
+
+- A1. Create the Gitea user: Site Administration, User Accounts, Create User Account. The name is the agent's
+  `gitea.user`. The email is the agent's `identity.email`.
+- A2. Create its token: sign in as that user, Settings, Applications, Generate New Token, scopes
+  `write:repository` and `read:user`, nothing else.
+- A3. Create the fork of each granted repo as that user (O1). Gitea's push-to-create
+  (`ENABLE_PUSH_CREATE_USER`, `ENABLE_PUSH_CREATE_ORG`) stays off, so a push to a missing `<user>/REPO`
+  fails rather than creating a plain repository (N11). `publish` refuses `fork-unavailable` before that.
+- A4. On the stack instance's VM, as its OS user: `mosaic credentials issue AGENT gitea --rotate-by DATE`, with
+  the token pasted into stdin.
+- A5. On fire or rotate: delete the token in Gitea (Settings, Applications), or disable the user.
+- A6. Model: sign in to the provider on each VM user to write `<configDir>/secrets/claude-session.env`.
+
+Vikunja bot accounts and tokens are already Jason's (tracker bots). Only A4 changes for them.
+
+## 7a. The grant path (mos-1124, Q188, Q190)
+
+Q188: no agent creates a grant. The chief raises the request, Jason approves it in the inbox, and protected
+stack code creates the grant. Jason called manual grant steps a no-fly, so A1 to A4 above are the fallback only.
+
+- a. `credentials.issue`, and so `rotate`, accepts a resolved `credential.mint` decision, Jason's Approve, as
+  the human path. #436b's executor calls it with that decision and nothing pasted. #436b adds that path and
+  the decision kind. Row 199 ships the verbs with today's human check only.
+- b. Under Q190 ("Q12: O1"), each agent seat gets its own Gitea account. On the Approve, #436b's executor does
+  A1 to A3: the seat's Gitea user, its token and its forks. Until #436b lands, pushes stay as jason.woltje.
+- c. Q185 settles Q-J1 and Q190 settles Q-J2.
+
+No code in 07141966e changes for this section. The executor and the decision route are #436b's.
+
+## 8. Migration (brief item 6)
+
+- M1. Existing `{file}` and `{env}` references keep working. A business moves one agent at a time with
+  `issue`, which rewrites that agent's reference to `store`.
+- M2. Nothing here touches the dev repository's helper, its `.git/config`, `~/.mosaic` or `~/.mosaic-dev`.
+  Dev seats (jarvis, seat tokens) keep pushing as today. The mos-0981 rule ends only when Mos says so.
+- M3. The live dev stack instance needs no change at re-pin: no reference uses `store` until someone issues
+  one.
+
+## 9. Questions
+
+Mos ruled on the authority model in mos-1027 (2026-10-20T19:27Z):
+
+- Q-M1. O1, one fork per agent.
+- Q-M2. `git.push.remote` and its bounds in D9 to D11 are approved. It lands as a hard wait: out of ROUTED,
+  and no role grants it within-role (D9 step 1). Sage puts its routing in the PRD version draft going to
+  Jason with `role.hire` and `role.fire` (Vikunja #420). After his approval, a reviewed commit routes it and
+  grants it to coder.
+- Q-M3. Issue, rotate and delete are human-only, and the chief gets none of them. Under Q173 the dev
+  instance's tester gets `status` and `revoke` only.
+- Q-M4. The model credential stays per stack instance for 10-27. Per-agent model tokens wait for a proxy
+  row.
+
+Open for Jason. Mos takes these to him one at a time:
+
+- Q-J1. The model account for Case 1 and Case 2: existing subscription or a new account. Settled by Q185 (7a).
+- Q-J2. Gitea users and tokens for the agents that need them (A1 to A3). Settled by Q190 (7a).
+
+## 10. What this closes (brief item 7)
+
+- G11: closes the store (D1 to D6) and lifecycle (section 6) for `gitea` and `vikunja`. Still open: per-agent
+  model credentials (D7), and the same-uid limit inside one stack instance (D6).
+- G13: closes "own credentials for git" (D8 to D10). Still open: Gitea API verbs (section 4).
+- C2.5 (git remote): Case 2's books repo can use `publish` once its project names a remote.
+
+## 11. Tests and mutants
+
+All tests use scratch roots, fake tokens and a fake Gitea: `git http-backend` behind a node http server on
+127.0.0.1 that checks basic auth against a fake token and records each ref update. No request leaves the host.
+
+- T1. Layout: wrong mode or owner on a dir or file refuses start. A `{file}` reference into another agent's
+  path refuses `credential-not-yours`. A bus restart after a create without `issue` starts, and the agent's
+  status is `not-issued`. A missing `{file}` still refuses start.
+- T2. `useFor` keys from the cap only. A request naming another agent is refused and leaves one
+  `action.refused`.
+- T3. The fake Gitea serves https on 127.0.0.1 with a cert from a scratch CA made by the test. It reaches git
+  only through the `tls` parameter (D9 step 5). Each refusal test that should reach the network asserts that
+  the first port received the request, so no test passes because git refused http first. `publish`: the
+  happy path lands `refs/heads/<user>/<branch>` on the agent's fork in the fake, which shares root's history, at
+  exactly the decision's commit. Refusals for each step in D9, one test each, including `work-not-yours`. Until routing, a publish with
+  no decision refuses, one with a decision for another task or commit refuses, and a second publish on a
+  spent decision refuses `decision-consumed`. Approve while the latest push is A, push B, publish: refuses
+  `decision-mismatch`, and the fork receives nothing. A push to the working repo between `checkPublish` and
+  the git push refuses with `ref-moved` or `decision-mismatch` (sage-1440, BUILD.md deviation 14). A raise with no recorded push refuses `no-push`. A test pins that `git.push.remote` is in neither ROUTED list
+  and that no `roles/*.json` grants it. A force-push attempt is
+  refused by git's non-fast-forward. A fake fork that answers 302 to a second 127.0.0.1 port: the push
+  fails, and the second port receives no request with an Authorization header. A remote on the right host
+  and a different port is refused at step 2. Two agents granted one project each land on their own fork:
+  agent A's push reaches `/<A's user>/REPO` only and B's reaches `/<B's user>/REPO` only, and the fake's
+  upstream repository receives nothing. An upstream owned by the agent's own user refuses `remote-not-fork`,
+  and so does one whose owner differs from `gitea.user` only in case. With an upstream that shares root's
+  history, a first publish to an empty fork and to an unrelated fork each refuse `remote-unrelated`, and
+  neither fork nor upstream receives objects. A fork that doesn't exist refuses `fork-unavailable`, and the
+  fake records no push. `ls-remote` and the push each reach the fork's path only (the fake records every
+  path). Load refusals (D9c), one test each: a dot segment, an extra path segment, a missing segment,
+  a trailing slash, userinfo, a query, a fragment, an explicit `:443`, a name outside Gitea's rule, and a `gitea.url` with a
+  sub-path. A `.git` suffix loads and builds the fork without it. A `publish` grant on an agent without
+  `identity`, and on one whose definition lacks `gitea`, each refuse at load with the N10 message.
+- T4. Token handoff: the token never appears in argv, env, the fork URL, the working repo config,
+  `changes.jsonl`, events or logs (scan every file under the scratch roots).
+- T5. Lifecycle: issue, rotate, revoke and delete, each live with no restart. After revoke, `publish` and the
+  Vikunja path refuse `credential-unavailable`, and so they do after a bus restart that follows the revoke.
+  The tester can run `status` and `revoke`, and `issue` and `rotate` refuse it.
+- T6. Default: an agent without `identity` commits as E7. Existing `{file}` references load unchanged.
+
+Mutants to kill: drop the cap-derived key in `useFor`, let the request name the destination ref, add `+` to
+the refspec, skip the identity check, put the token in the URL, revoke file before memory, skip the dir mode
+check, allow a `{file}` reference into another agent's dir, make ENOENT on a `store` path fatal again, make
+ENOENT on a `{file}` path silent, a helper that answers any host, drop `http.followRedirects=false`, drop the
+`work-not-yours` check, drop the `remote-unrelated` check, add `git.push.remote` to ROUTED, skip the spent
+check on the decision, drop the `pushCommit` comparison in `#authorityFor`, push by ref name in place of the
+oid, push to the upstream URL in place of the derived fork, run `ls-remote` against the upstream in place of
+the fork, take the fork's owner from anywhere but the agent's `gitea.user`, compare the owner with case, run the
+D9c checks on the raw path in place of the normalized one, read a failed `ls-remote` as empty, skip the tip
+check under the lock, and pass a CA flag in production.
+
+## 12. Risks
+
+- R1. Backups: if a backup tool copies `<configDir>`, it copies tokens. The build checks row 185's backup set
+  and says what it includes.
+- R2. Withdrawn. O1 was ruled, so probe P1 isn't needed.
+- R3. Outbound HTTPS from the bus host to Gitea is new network reach for the host process. On the VMs this is
+  Jason's network to confirm.
@@ -3,5 +3,5 @@
 Builder seat, Claude Opus 5.5, started by Sage for MVP T1 row 193 (human users and RBAC, #1691) under mos-0974 and mos-0977.

 No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until row 195 settles per-agent identity, it pushes only its own `morgana/*` branches
+credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `morgana/*` branches
 through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -0,0 +1,8 @@
+#!/bin/bash
+n=0
+for p in /proc/[0-9]*; do
+  c=$(tr '\0' ' ' < $p/cmdline 2>/dev/null) || continue
+  case "$c" in *shell-snapshots*|*chrome-devtools-mcp*|*sage-busy-now*) continue;; esac
+  if echo "$c" | grep -qE 'node --test|gate\.sh|mutant|scripts/test-[a-z-]+\.sh|docker compose'; then echo "BUSY ${p#/proc/}: ${c:0:160}"; n=$((n+1)); fi
+done
+[ $n -eq 0 ] && echo CLEAR
@@ -0,0 +1,24 @@
+#!/bin/bash
+set -o pipefail
+# Landing gate template (2026-10-14): sed the G= and OUT= lines and this comment.
+# Sequential suites, each teed to its own log; stops at the first failure.
+G=/mnt/storage/scratch/SET-ME-wt
+OUT=/mnt/storage/scratch/SET-ME-out
+cd "$G" || exit 9
+mkdir -p "$OUT" || exit 9  # a missing OUT failed the row 142 gate at step 1 (2026-10-15)
+# test-task.sh live cases run `docker compose` from $G, so without a name the project is "wt"
+# and leaves wt_default behind (row 142 gate, 2026-10-15). Name it per gate dir and remove it on exit.
+export COMPOSE_PROJECT_NAME="$(basename "$(dirname "$G")")"
+trap 'docker network rm "${COMPOSE_PROJECT_NAME}_default" >/dev/null 2>&1 && echo "removed network ${COMPOSE_PROJECT_NAME}_default"' EXIT
+# A gate tree without the node_modules link fails cli tests with ENOENT (2026-10-13).
+[ -d "$G/node_modules" ] || { echo "STOP no node_modules in $G"; exit 8; }
+echo "base $(git rev-parse --short HEAD) dirty $(git status --short | grep -vc node_modules) DOCKER_HOST=${DOCKER_HOST:-unset}"
+run() { local name="$1" dir="$2" cmd="$3"
+  (cd "$G/$dir" && bash -c "$cmd") > "$OUT/$name.log" 2>&1; local rc=$?
+  echo "$name rc=$rc $(grep -E '^ℹ (pass|fail) [0-9]+' "$OUT/$name.log" | tr '\n' ' ') | $(tail -n1 "$OUT/$name.log")"
+  [ $rc -eq 0 ] || { echo "STOP $name"; exit $rc; }; }
+# No pkg-queue step: scripts/test-queue.sh runs packages/queue/tests/ itself (same 156 tests; CI debate item 2a, Vikunja #274).
+for d in packages/*/; do p=$(basename "$d"); [ -d "$d/tests" ] || continue; [ "$p" = queue ] && continue
+  run "pkg-$p" "packages/$p" 'node --test tests/*.test.mjs'; done
+for s in scripts/test-*.sh; do n=$(basename "$s" .sh); run "script-${n#test-}" . "bash $s"; done
+echo GATE_PASSED
@@ -0,0 +1,36 @@
+# Row 189 gate timing (for row 197, Herb)
+
+Sage, 2026-10-20T19:25:04Z. Gate on 0c177e9ef (base 0217b71c8), one lane. The slot was mine. Seats may have run single test files at the same time, which the slot rules allow, and I did not record that.
+Start 2026-10-20T19:09:37Z, end 2026-10-20T19:20:36Z. Total wall time: 659 s.
+
+Wall time per suite is the gap between one suite's log mtime and the one before it (the first suite starts at start.txt), so it includes node start-up. node's duration_ms is listed where the suite prints it. Scripts print no duration.
+
+| Suite | Wall s | duration_ms s | Ended (UTC) |
+|---|---|---|---|
+| pkg-bus | 3 | 3.8 | 19:09:40 |
+| pkg-business | 3 | 2.2 | 19:09:43 |
+| pkg-cli | 388 | 388.5 | 19:16:11 |
+| pkg-control-board | 1 | 0.8 | 19:16:12 |
+| pkg-conversation | 35 | 35.4 | 19:16:47 |
+| pkg-discord | 3 | 2.6 | 19:16:50 |
+| pkg-harness | 12 | 11.6 | 19:17:02 |
+| pkg-ledger | 13 | 13.5 | 19:17:15 |
+| pkg-mosaic | 3 | 2.3 | 19:17:18 |
+| pkg-plugins | 0 | 0.3 | 19:17:18 |
+| pkg-project | 1 | 1.2 | 19:17:19 |
+| pkg-runs | 1 | 0.8 | 19:17:20 |
+| pkg-seat | 6 | 6.2 | 19:17:26 |
+| pkg-tasks | 1 | 1.2 | 19:17:27 |
+| pkg-webui | 58 | 57.9 | 19:18:25 |
+| script-auth | 1 | - | 19:18:26 |
+| script-conductor | 5 | - | 19:18:31 |
+| script-config | 2 | - | 19:18:33 |
+| script-discord | 8 | - | 19:18:41 |
+| script-extension-package | 1 | - | 19:18:42 |
+| script-foundation | 40 | - | 19:19:22 |
+| script-land-work | 11 | - | 19:19:33 |
+| script-queue | 21 | - | 19:19:54 |
+| script-release | 11 | - | 19:20:05 |
+| script-task | 31 | - | 19:20:36 |
+
+Source: /mnt/storage/scratch/sage-g189/out/*.log mtimes and gate.log. The cli suite is about 59% of the run, and webui plus conversation add about 14%.
@@ -0,0 +1,86 @@
+# Row 189: `stack-release.sh activate --no-send`
+
+Gitea #1687. Vikunja P19 #413 (Q175 interim, #412). Brief: docs/plans/2026-10-20_activate-no-send.md.
+Rulings: mos-0972 (the Console runs without `--send` until Q175 phase 2), mos-0973 (go; Sage builds,
+Dewey reviews; gate is the cli suite plus every scripts/test-*.sh). Base: def2e7932 (refactor, the
+brief commit on 9ae8c73ac).
+
+## What it does
+
+`activate ID BUSINESS --no-send` drops `--send` from `RUN_CONSOLE` in a new `send_for_target`, which
+`console_for_target` calls after `proof_for_target`. `install_stack` renders the unit from
+`RUN_CONSOLE` and `write_pointer` writes the pointer from it, so both lose the flag and `flags_drift`
+stays quiet afterwards. Only `activate` takes the flag; the parser sends every other op to usage
+(exit 4).
+
+`check_target` lets a `--no-send` activate name the pointer's copy only when the pointer's Console
+flags hold `--send`. That run is a live-copy re-pin, the same path row 187 uses for the proof pair:
+the plan prints the live-copy note, the run stops both units, backs up the stopped store and starts
+them again. A plain same-copy activate, or a same-copy `--no-send` once `--send` is gone, still
+refuses `already-active`.
+
+`--plan` prints one `send:` line after the `proof:` line, for activate and rollback:
+
+- `send: dropped; --no-send was given`
+- `send: off; --no-send was given and the pointer holds no --send`
+- `send: carried` (the pointer's `--send` goes on unchanged)
+- `send: off`
+
+The steps log gets `drop --send; --no-send was given`, or `--no-send was given and the pointer holds no
+--send, so there is nothing to drop`.
+
+Rollback and pm-on carry the pointer's flags as they are, so once `--no-send` has run, nothing adds
+`--send` back. There is no re-enable flag (mos-0973). Q175 phase 2 changes the Console flags in its
+own row.
+
+docs/TOOLS.md: `[--no-send]` in the usage block and one paragraph after the proof paragraph.
+
+## Tests (packages/cli/tests/stack-release.test.mjs, T55)
+
+1. Seeded preview pointer with `--send --tester-port 7333`: a same-copy `activate B acme --no-send`
+   passes. The pointer and the unit ExecStart lack `--send` and keep the other flags in order, status
+   says the unit flags match, the steps log has the drop line, the log line has from = to = B and the
+   backup sum equals the stopped store's, and the units stop and start in order.
+2. Plain same-copy activate, with `--tester-port` and with `--no-proof`, refuses `already-active`. So does
+   a same-copy `--no-send` once `--send` is gone, and on a pointer that never held it.
+3. The four `send:` lines, the live-copy note on the same-copy plan only, and the Console line right
+   after `send:` without `--send`. The run on a pointer with no `--send` logs the nothing-to-drop line
+   and no drop line.
+4. After `--no-send` on C1, a rollback to B leaves `--send` out of the pointer and the unit, the steps
+   log never names `--send`, and status matches. pm-on after `activate --pm-after-harness --no-send`
+   keeps it off.
+5. `--no-send` on rollback (with and without `--plan`), pm-on, status, adopt and rehearse is a usage
+   error with the usage text, nothing written, started or logged. The usage text shows `[--no-send]`.
+6. A pointer holding both the proof pair and `--send`: the plans for `--no-proof`, `--no-send` and both
+   name what each drops and carries. `--no-send` keeps the pair, `--no-send` with a new pair replaces it,
+   `--no-proof` keeps `--send`, and both together leave neither. Status matches after each.
+
+`planTail` gains `'send: off'` after `'proof: off'`, because every plan now prints the line. T36 takes
+`out.slice(-n)` around `planTail`, so its four slice counts grow by one.
+
+## Mutants
+
+mutants.sh in this packet, run on the candidate. Each mutates scripts/stack-release.sh and runs T55
+plus T1 and T2.
+
+- M1: the same-copy exception ignores `--no-send`.
+- M2: the same-copy exception allows `--no-send` without `--send` in the pointer.
+- M3: with `--no-send`, the pointer is written from `P_CONSOLE`, so it keeps `--send` while the unit
+  drops it.
+- M4: rollback re-adds `--send`.
+- M5: the parser accepts `--no-send` for rollback.
+
+Results: mutants-run.log, all five killed (M1 5 failures, M2 2, M3 7, M4 2, M5 2).
+
+## Deviations from the brief
+
+- The brief's line numbers were taken before row 163 landed. The candidate corrects them to the
+  9ae8c73ac lines (check_target :249-256, flags_drift :646-657, console_for_target :664-693, adopt
+  :828).
+- Test 5 also covers rehearse and `rollback --plan`, which the brief did not list.
+
+## Outbound calls
+
+None. The change edits an array before the existing unit render and pointer write. Every test uses
+the stand-in systemctl, units, stores and data root the file already builds; no test touches
+`~/.mosaic-dev`, the live units or a slot file.
@@ -0,0 +1,5 @@
+M1 KILLED fail=5
+M2 KILLED fail=2
+M3 KILLED fail=7
+M4 KILLED fail=2
+M5 KILLED fail=2
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Row 189 mutants M1-M5: each mutates scripts/stack-release.sh in the sage-b189 worktree, runs T55 and
+# the plan-tail tests, and restores the file from a checked backup.
+set -uo pipefail
+WT=/mnt/storage/scratch/sage-b189
+OUT=/mnt/storage/scratch/sage-b189-mut/out
+S=$WT/scripts/stack-release.sh
+mkdir -p "$OUT" || exit 1
+cp -p "$S" "$OUT/stack-release.sh.orig" || { echo "backup failed"; exit 1; }
+ORIG=$(sha256sum "$S" | cut -d' ' -f1)
+[ "$(sha256sum "$OUT/stack-release.sh.orig" | cut -d' ' -f1)" = "$ORIG" ] || { echo "backup differs"; exit 1; }
+restore() { cp -p "$OUT/stack-release.sh.orig" "$S"; [ "$(sha256sum "$S" | cut -d' ' -f1)" = "$ORIG" ] || { echo "RESTORE FAILED"; exit 1; }; }
+trap restore EXIT
+
+mutate() {
+    case "$1" in
+        M1) sed -i '/{ \[ "\$NO_SEND" = 1 \] && \[\[ " \${P_CONSOLE\[\*\]} " == \*" --send "\* \]\]; } ||/d' "$S" ;;
+        M2) sed -i 's/{ \[ "\$NO_SEND" = 1 \] && \[\[ " \${P_CONSOLE\[\*\]} " == \*" --send "\* \]\]; } ||/{ [ "$NO_SEND" = 1 ]; } ||/' "$S" ;;
+        M3) sed -i 's/^    write_pointer "\$TO" "\$RUN_PM" "\$RUN_PENDING" "\$P_CLAUDE" "\$T_SCHEMA" "\${RUN_CONSOLE\[@\]}"$/    if [ "$NO_SEND" = 1 ]; then write_pointer "$TO" "$RUN_PM" "$RUN_PENDING" "$P_CLAUDE" "$T_SCHEMA" "${P_CONSOLE[@]}"; else write_pointer "$TO" "$RUN_PM" "$RUN_PENDING" "$P_CLAUDE" "$T_SCHEMA" "${RUN_CONSOLE[@]}"; fi/' "$S" ;;
+        M4) sed -i 's/^        SEND_PLAN="send: off"$/        SEND_PLAN="send: off"; [ "$OP" != rollback ] || RUN_CONSOLE+=(--send)/' "$S" ;;
+        M5) sed -i 's/--no-send) \[ "\$OP" = activate \] || usage;/--no-send) { [ "$OP" = activate ] || [ "$OP" = rollback ]; } || usage;/' "$S" ;;
+    esac
+}
+
+for m in M1 M2 M3 M4 M5; do
+    restore
+    mutate "$m"
+    if [ "$(sha256sum "$S" | cut -d' ' -f1)" = "$ORIG" ]; then echo "$m NOT-APPLIED"; continue; fi
+    bash -n "$S" || { echo "$m SYNTAX"; continue; }
+    diff "$OUT/stack-release.sh.orig" "$S" > "$OUT/$m.diff"
+    (cd "$WT" && TMPDIR=/mnt/storage/scratch/t189 timeout 900 node --test --test-reporter=tap --test-name-pattern='T55|T1 |T2 ' packages/cli/tests/stack-release.test.mjs) > "$OUT/$m.log" 2>&1
+    fails=$(awk '/^# fail /{print $3}' "$OUT/$m.log")
+    if [ "${fails:-0}" -gt 0 ]; then echo "$m KILLED fail=$fails"; else echo "$m SURVIVED"; fi
+done
@@ -3,5 +3,5 @@
 Reviewer seat, Claude Opus 5.5, started by Mos (mos-0981, thread 03086006). Reviews Case 2 designs and MVP T1 rows 192 and 194.

 No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until row 195 settles per-agent identity, it pushes only its own `webby/*` branches
+credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `webby/*` branches
 through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -1361,3 +1361,5 @@ are never rewritten or removed; corrections are new entries.
 2026-10-20T18:34:53Z | Filbert (Opus 5.5, 048f3c63) | Q175 SSO design review r2 (DESIGN.md blob 3eb718b5e131 at 1a268249e), static | changes: C1 config.json console key fails old loaders (mosaic-config.mjs:113 rejects unknown keys; key add inside phase 2 window, rollback removes it, loader test), C2 app.js signs out only on opaqueredirect so 401 never shows sign-in; notes on tests 15/7/9a, Q-B 200-HTML classification, scratch Console flags; Q-E keep iss/sub escaped and capped; verdict sent to Sage, no Gitea/queue record
 2026-10-20T18:40:20Z | Filbert (Opus 5.5, 048f3c63) | Q175 SSO design review r3 (DESIGN.md blob a152fd58e18e at 817e8f51b), static | approve on condition D1 (slot file checks stay out of shared loader, shape-only there) as a line edit; D2 notes: slot root from configDir, scratch dataRoot, name discovery GETs for Mos; C1/C2 and notes verified; Mos C1 sequence confirm still open; no Gitea/queue record
 2026-10-20T18:41:20Z | Filbert (Opus 5.5, 048f3c63) | Q175 SSO design D1/D2 check (DESIGN.md blob eba861f5d2bb at d55d86bb0), static git diff 817e8f51b..d55d86bb0 | ack: D1 and D2 match; design approved; Mos C1 sequence confirm still open; no Gitea/queue record
+2026-10-20T18:57:10Z | Filbert (Opus 5.5, 048f3c63) | row 190 design review r2 (#1688, DESIGN.md sha256 5493c9df3ec0) | CHANGES to Darkwing, cc Sage: B1 claim check on MOSAIC_CONFIG-only selection, B2 shared prefix drop-in dirs; N1-N7 notes; static read, no slot, no Gitea or queue record
+2026-10-20T19:00:04Z | Filbert (Opus 5.5, 048f3c63) | row 190 design review r3 (#1688, DESIGN.md sha256 98236a1aff98) | APPROVE to Darkwing, cc Sage: B1 and B2 closed with M13 and M14, N7 settled by Sage's 48ebee0ff; static read, no slot; manifest round gets a queue review record (sage-1337)
@@ -238,6 +238,12 @@ Exit codes: `0` ok · `2` invalid file or credential reference · `3` system
 config problem · `4` usage or a required file missing. Details:
 `packages/business/README.md`.

+`mosaic credentials status|issue|rotate|revoke|delete` (row 199) goes to
+`packages/cli` and the bus's human-only credential verbs: an agent's own
+token in `<configDir>/secrets/agents/<business>/<agent>/<kind>`, read on
+stdin, never printed. The tester may run `status` and `revoke`. Details:
+`packages/cli/README.md`.
+
 `instances` and `instance add|set` (row 165) go to `packages/cli` and the
 bus's human-only `instances` and `instances.set` verbs, so they need a live
 bus host and refuse inside an agent session. `instances` prints the revision,
@@ -368,7 +374,7 @@ reports checkout or copy identity and refactor drift, and writes nothing.
 ```
 scripts/stack-release.sh adopt BUSINESS
 scripts/stack-release.sh activate ID BUSINESS [--pm | --pm-after-harness] [--migrate] [--tester-port N]
-    [--proof-header NAME --proof-file PATH | --no-proof] [--timeout S] [--plan]
+    [--proof-header NAME --proof-file PATH | --no-proof] [--no-send] [--timeout S] [--plan]
 scripts/stack-release.sh pm-on BUSINESS [--timeout S]
 scripts/stack-release.sh rollback BUSINESS [--restore ACTIVATION [--events N]] [--timeout S] [--plan]
 scripts/stack-release.sh status BUSINESS
@@ -480,6 +486,14 @@ copies. It checks the file with `stat` and `realpath` and never reads the value.
 or `off`. On the live copy it also notes that the run re-pins the pointer's copy
 and only the Console flags change.

+`activate ... --no-send` (row 189, mos-0972) drops `--send` from the pointer's
+Console flags and the unit, so the Console serves reads and no human sends. It
+may name the live copy while the pointer holds `--send`; once `--send` is gone a
+same-copy `--no-send` refuses `already-active`. Later activates, `pm-on` and
+rollbacks carry the pointer, so send stays off. No flag puts `--send` back.
+`--plan` prints one `send:` line: `dropped`, `off` with or without the
+`--no-send` note, or `carried`.
+
 #### A target past c216f47db: the PM after the harness kind

 From c216f47db on, the bus launches the PM only with a `harness` kind in the
@@ -1,7 +1,8 @@
 # Brief: activate --no-send drops the Console's --send

 Sage, 2026-10-20, for Mos's ruling mos-0972 (Q175 interim, Vikunja #412). Owner Sage, reviewer Dewey, gate owner
-Sage. Base: refactor 9ae8c73ac (row 163 landed). Line numbers are at that commit.
+Sage. Base: refactor 9ae8c73ac (row 163 landed). Line numbers are at that commit. The candidate corrects them;
+the first draft took them before row 163.

 This row builds the tool only. The live restart without `--send` is a separate step afterwards, a same-copy
 activate under Q173 with a backup first and a STATE report after. No test here touches `~/.mosaic-dev`, the
@@ -14,11 +15,11 @@ Mos ruled that the Console runs without `--send` until Q175 phase 2, because wit
 process can forge `X-authentik-username` on 127.0.0.1:7332 and send as Jason (design section 8). On the pinned
 stack, the Console flags live in the pointer (`~/.mosaic-dev/state/stack-active.json`):

- `console_for_target` (scripts/stack-release.sh:658-687) carries the pointer's flags unchanged. Only
+- `console_for_target` (scripts/stack-release.sh:664-693) carries the pointer's flags unchanged. Only
  `--tester-port` and the row 187 proof pair can change.
- `check_target` (:247-249) lets an activate name the pointer's copy only for a proof-pair change.
- `adopt` refuses once a pointer exists (:822).
- A hand `webui-service.sh install` without `--send` makes `flags_drift` (:640-651) refuse
+- `check_target` (:249-256) lets an activate name the pointer's copy only for a proof-pair change.
+- `adopt` refuses once a pointer exists (:828).
+- A hand `webui-service.sh install` without `--send` makes `flags_drift` (:646-657) refuse
  `unit-flags-drift` on every later activate, pm-on and rollback.

 So the tool can't drop `--send` today. This row adds that one path.
@@ -0,0 +1,57 @@
+# Brief: a credential store per agent, own git identity, pushes to a remote
+
+Sage, 2026-10-20, for mos-0974 (MVP T1 item 6) and the MVP plan
+(`jason-master-restart/projects/mosaic-mvp/PLAN.md` item 6, GAP-MAP G11 and G13; TARGET.md: "credentials store
+available for all agents; secrets protected with RLS equivalent" and "Agent uses own credentials for git and
+other actions"). Gitea #1697. Owner Megavolt (Opus 5.5, a new builder seat), reviewer Duckworth, gate owner
+Sage. Base: refactor at the brief commit. Design first. The first deliverable is
+`agents/megavolt/work/queue-ROW/DESIGN.md`.
+
+This row draws a security boundary. Sage reviews the design's authority model, and Mos rules on it before any
+code is written.
+
+## What exists today (GAP-MAP, measured at 9ae8c73ac)
+
+- G11. Credential references exist per instance for Gitea and Vikunja only
+  (`packages/business/src/credentials.mjs`, `packages/bus/src/credentials.mjs`, `vocabulary.mjs:103`). One
+  Claude env file is shared by every seat.
+- G13. Agents use their own Vikunja token (`packages/tasks/src/adapter.mjs`). Git goes through the host
+  socket (`packages/cli/src/git-socket.mjs`). Gitea tokens are loaded but never used.
+- The development repository's helper (`scripts/git-credential-mosaic.mjs`, wired in `.git/config` for
+  git.mosaicstack.dev) pushes as one identity. Until this row lands, seats push only their own `<seat>/*`
+  branches through it (mos-0981).
+
+## What the design must settle
+
+1. The store. Where each agent's credentials live, per instance, under the row 190 config canon. File modes,
+   ownership and the read path. Which process may read which entry, and how the bus enforces that (the "RLS
+   equivalent"). A process asking for another agent's entry is refused and logged.
+2. Kinds. Gitea (git over HTTPS, and the API), Vikunja, and the model provider. Say which kinds 10-27 needs
+   and which wait. The model provider entry must not copy jwoltje's `claude-session.env`. If it needs a new
+   provider account or subscription, flag it for Jason and don't pick one.
+3. Git identity and push. Each agent commits with its own name and email and pushes with its own token to a
+   remote it is granted. Which refs an agent may push (its own branches, never the default branch or another
+   agent's), and where that's enforced: the Gitea side (branch protection, token scopes) and our side. How
+   this fits the host git socket, or replaces it.
+4. Lifecycle. Issue, rotate (`rotateBy`, `expires`), revoke and delete, and what row 194 (agent lifecycle) calls
+   when an agent is hired or fired. A fired agent's credentials stop working at once.
+5. Who does what. Creating a Gitea user or token, or any account outside the fleet, is Jason's (Q173
+   exclusions). The design lists each such step as a command or UI action for Jason. Agents never mint
+   accounts.
+6. Migration. Today's seats (jarvis helper, seat tokens) keep working until each moves. The mos-0981 push
+   rule ends only when Mos says so.
+7. What this row closes in G11 and G13, and what stays open.
+
+## Boundaries
+
+- No credential value is read, printed, logged or committed. Tests use fake tokens in scratch roots and a
+  fake Gitea.
+- No change to `~/.mosaic-dev`, `~/.config/mosaic-dev`, the live units, slot files, `~/.mosaic` or the live
+  `.git/config` of the canonical checkout.
+- No request to git.mosaicstack.dev, tasks.woltje.com or any provider from a test.
+
+## Gate
+
+Duckworth approves DESIGN.md, Mos rules on the authority model, then Duckworth approves the manifest. The bus,
+business, cli and tasks suites and every `scripts/test-*.sh` are green on Sage's gate, and the design's
+mutants are killed.
@@ -0,0 +1,77 @@
+# Brief: Melanie's hub instance on its own host (row 195, was 190b)
+
+Sage, 2026-10-20. Rewritten for Mos's rulings mos-0998 and mos-1005 (Vikunja #418, #419). The first version
+put the hub under its own Linux user on dragon-lin. That form can't pass Duckworth's B7 there, because the
+factory uid's `sudo -n` succeeds on dragon-lin (Mos's recon, brain-redux
+`projects/mosaic-mvp/MELANIE-HOST-RECON.md`). Melanie's own server is ruled out too: it has 1.2 GiB RAM free
+with her two Hermes bots running, and co-tenancy would share her user and her passwordless sudo. The hub runs
+on a separate host. Which host is Jason's decision (#419): hardware outside the cluster, a cluster VM with
+factory PVE root removed, or a cluster VM with that residual accepted. This row is written so the host choice
+doesn't change it. Gitea #1693. On the 10-27 MVP path. Federation R8 (Gizmoduck's design r4, 04a6112be) needs
+this row or nothing.
+
+Owner Darkwing (Opus 5.5), reviewer Duckworth (author of B5 and B7), gate owner Sage. Chained on row 190
+(Q177): the hub runs under row 190's config canon. Design first. The first deliverable is
+`agents/darkwing/work/queue-190b/DESIGN.md`.
+
+## Goal
+
+Melanie's hub instance (Case 2, C2-13) runs on its own host. No factory agent can read or write the hub's
+config, data root or secrets, reach its bus socket, or log in to the hub host. Her writing reaches the hub only
+through the existing git.mosaicstack.dev remotes, books repo only.
+
+## Provision (blank until Jason answers #419)
+
+Who provisions the host and how is left open. Sizing from Mos (mos-0998): 4 vCPU, 8 GB RAM, 64 GB disk,
+internal network only. Each agent process measures 300 to 390 MB RSS on dragon-lin. The design takes the host
+as given: a fresh Linux host with a named admin path, reachable by the deploying seat while the row runs.
+
+## The design must state
+
+1. The deploy. Exactly what Darkwing installs on the hub host and how: the stack copy, node, the units, the
+   config dir and data root under row 190's canon (O1: `~/.config/mosaic-NAME`, and "`~` is the home of the OS
+   user that runs the instance"). Which commands run as which user on the hub host, and which need its root.
+2. Re-pin, rollback and backup on the hub host, and who runs them after the deploy key is gone.
+3. How the hub gets model access without a copy of jwoltje's `claude-session.env` or any factory credential.
+   If that needs the credentials row (T1 item 6), say so and name the interim. If it needs a new subscription
+   or a new provider account, flag it for Jason and don't pick one (mos-1008).
+4. The books repo path. Which git.mosaicstack.dev remote, which credential the hub holds for it, and that it
+   can't read or push any other repository.
+5. The admin path and the end state. The host ends with no key the factory uid can read. The design names the
+   admin path that remains (for example the hypervisor console, or a key kept off the factory uid) and who
+   holds it.
+6. The acceptance script, as code Duckworth can read. It takes Gizmoduck's list of infrastructure gate items
+   as its input (mos-1011), not a fixed set of checks. Each item names a path, its closed form and its
+   accepted form, and the script reports which form holds for each, or fails. The list covers at least:
+   - federation R8's separate-host form: the hub's bus socket, data root and config dir don't exist on the
+     factory host, the factory host mounts nothing of the hub's, and no factory agent holds a login or key
+     for the hub host
+   - B7: from the factory uid, `sudo -n`, `doas -n`, `su`, polkit, and `ssh -o BatchMode=yes` to the hub
+     host all fail
+   - the hypervisor and backup paths ops-01 measured (mos-1011: one PVE node the factory key has root on,
+     PBS on that node with unencrypted backups, a flat /16 LAN), each closed or accepted by Jason
+7. The identity provider and TLS front end (B8, mos-1008, mos-1011). Either the factory holds no credential
+   that can create users, change groups, issue tokens or impersonate in the issuer the hub trusts, or the hub
+   uses an issuer the factory can't administer. A brand, tenant or app inside the same Authentik does not
+   count as separate. The same holds for the TLS front end that serves the hub. The proof is a failed admin
+   call from every token the factory's root can read. No credential value is printed in that proof.
+
+## Boundaries
+
+- Provisioning, hypervisor access and any infra or k3s change are Jason's (Q173 exclusions). Mos takes the
+  hypervisor residual (factory root on the PVE nodes, Q172) to Jason. It doesn't block this row.
+- Melanie's server (`[email protected]`) is reference only, read only, under Jason's authorization in
+  mos-0995. Nothing on it changes, and her Hermes bots keep running.
+- No tunnel, Traefik or other exposure outside the internal network. That waits for Jason, after Q175 SSO.
+- No credential value is printed, logged or committed. Keys made for the deploy are removed at the end, and
+  the acceptance script proves it.
+- The admin-call proof in point 7 and any call to the issuer or the TLS front end run only in a window Mos
+  approves, never as a test or an anonymous probe (Q175).
+- Tests in the repository use scratch roots and stand-ins. The live deploy and the acceptance run on the hub
+  host are a window with a backup first (where there is state) and a STATE report after.
+
+## Gate
+
+Duckworth approves DESIGN.md, then the manifest. Any repository change is green on Sage's gate (cli suite and
+every `scripts/test-*.sh`), with the design's mutants killed. The row is done when the acceptance script passes
+on the hub host from the factory uid, Duckworth reads its output, and Mos confirms.
@@ -0,0 +1,62 @@
+# Brief: the human boundary across uids and humans (P19 333)
+
+Sage, 2026-10-20, for Mos's order mos-0989 (P19 333, MOSAICSTA-173, is now on the 10-27 path: federation R3 and
+row 193 need it). Gitea #1694. Owner Gander (Codex gpt-6.1-sol, a new builder seat under mos-0977 item 5),
+reviewer Duckworth, gate owner Sage. Latest-by: DESIGN.md approved by 2026-10-22, landed by 2026-10-24, and in
+any case before federation R3 lands. R3 and row 193 may chain on this row's candidate (Q177). Base: refactor at
+the brief commit. Design first. The first deliverable is `agents/gander/work/queue-ROW/DESIGN.md`.
+
+## The problem, as filed and as it now matters
+
+P19 333 as filed (row 87, mos-0657): the Console listens on a loopback TCP port, and any host process that
+reaches it, under any uid, acts as Jason. Jason accepted that as a documented limit for a one-user host
+(mos-0787, row 161). Two things change that:
+
+- Row 190b (#1693, mos-0986) puts Melanie's hub under its own Linux user. Factory processes then sit on another
+  uid, on the same host, next to the hub's ports and socket. The other-uid reach is now the Case 2 threat.
+- Federation r2 (gizmoduck-0004, 60b9b112a) binds a bus user only from a user-cli whose proof passes the human
+  walk, whose direct parent is the bus's own Console, and which holds a live grant. That rule rests on the
+  path-bound human proof (#225): today a same-uid process that runs the tree's `human-cli.mjs` acts as the
+  human, without touching the Console. The Q175 design (section 8) names that limit and leaves it here.
+
+## What already settles part of it
+
+- Q175 phase 2 (#412) settles the Console-ingress part on the main port. Under `--sso`, 7332 answers any
+  non-public Host with 403 except `GET /healthz`, and every other request needs a verified OIDC session. A
+  process on another uid that reaches the port gets only `/healthz`. Phase 1 (row 192) builds it; it is live
+  only after the phase 2 window.
+- Row 189 (`--no-send`) is interim only. Until phase 2 the Console takes no human writes, so the reach is
+  read-only. It settles nothing.
+- Row 190b separates files and units by uid. Whether the hub's `broker.sock` refuses the factory uid depends on
+  its directory and socket modes, which this row checks and tests rather than assumes.
+
+## What the design must settle
+
+1. Inventory every listener and entry point per instance: the Console port, the tester listener (7333 today),
+   `broker.sock`, the human CLI wrapper, the Discord connector and anything row 190 adds. For each: who can
+   reach it today from the same uid and from another uid, with and without `--sso`.
+2. The tester listener. It serves reads and the row 175 tester writes to anything that reaches it, on any uid.
+   Close the other-uid reach (for example a unix socket with 0600 modes, or a peer-uid check on loopback), or
+   bring Mos a concrete reason it must stay open. bus.tester stays Jason's switch.
+3. The bus human boundary. How the bus tells the human's own verified call from a same-uid process that runs
+   `human-cli.mjs`. State what federation R3's direct-parent rule needs from the bus (peer credentials on
+   `broker.sock`, the parent check, how it can't be forged by a child of an agent), and what stays possible for
+   a same-uid process after this row. Say it plainly where a residual limit remains.
+4. Fit with row 193 (Morgana, human users and roles; Mos's B1 rule: a principal comes only from something the
+   bus verifies) and with federation R3. One mechanism, not three.
+5. Migration: the live single-user Console and bus keep working until each instance re-pins.
+6. Which parts of P19 333 this row closes, which parts Q175 phase 2 closes, and what P19 333 says when it is
+   closed.
+
+## Boundaries
+
+- Who can reach the Console from outside stays Jason's. This row changes what a host process can do once it
+  reaches a local port or socket.
+- No test touches `~/.mosaic-dev`, `~/.config/mosaic-dev`, the live units or a slot file. No test creates a real
+  second uid; use stand-ins as rows 190 and 190b do, and name any part only a Q173 window can prove.
+- No request to the live 127.0.0.1:7332 or 7333, mosaic.woltje.com or auth.diversecanvas.com.
+
+## Gate
+
+Duckworth approves DESIGN.md, then the manifest. The bus, webui and cli suites and every `scripts/test-*.sh`
+are green on Sage's gate, and the design's mutants are killed.
@@ -12,8 +12,10 @@ before any code, as Q175 did. Then the build follows the design, with tests and

 Two or more instances run side by side on dragon-lin. Each one has its own config file, data root (store,
 broker.sock, host.lock, state, runs, sessions, workspaces), businesses, bus unit, Console unit and port,
-tester port, Discord unit, Claude session env file, stack-active pointer and activation log. Nothing one
-instance does can read or change another's state. The current instance keeps working unchanged: its
+tester port, Discord unit, Claude session env file, stack-active pointer and activation log. No instance's
+commands, units or tools address another instance's state by default or by mistake. On one uid this is
+addressing only, not a security boundary: a same-uid process can still read another instance's files.
+Isolation against that is row 190b (#1693, mos-0986), one Linux user per instance. The current instance keeps working unchanged: its
 config path, data root, unit names and ports stay as they are, and no re-pin is needed for it.

 ## Known single-instance points (GAP-MAP.md, measured at 9ae8c73ac)
@@ -0,0 +1,57 @@
+# Brief: retire the control board writer on 7331
+
+Sage, 2026-10-20, for Mos's ruling mos-1008 item 2. Gitea #1696. MVP 10-27 work. Owner Bushroot (Haiku 5.5, a
+low-level model under Q177), reviewer Webby, gate owner Sage. Base: refactor at the brief commit.
+
+## Why
+
+`packages/control-board/src/serve.mjs` is a loopback HTTP service on 7331 with no authentication. It reads
+transcripts and writes through `/api/reply`. Any host process that reaches the port can do both. That fails
+Q175 ("zero trust with verification"). Gander found it in the row 196 inventory (gander-0004). Nothing listens
+on 7331 now (`ss -ltnp`, 2026-10-20T19:05:09Z), so retiring it costs the least.
+
+## Steps, in order
+
+1. Inventory first. List every reference to the control board and to 7331: scripts, units, `scripts/mosaic`
+   and other CLI dispatch, docs (AGENTS.md, READMEs, TOOLS.md), package.json scripts, tests, and the Console
+   (`packages/webui`). For each, say whether it starts the writer, reads its code, or only mentions it.
+   Commit the list as `agents/bushroot/work/queue-ROW/INVENTORY.md` and send it to Sage and Webby.
+2. Stop if something depends on it. If a reference shows a live dependency (the Console or another package
+   imports code that only the control board has, or a unit or script still starts it), stop. Sage takes it to
+   Mos before anything is removed.
+3. Otherwise retire the writer. Either remove the `serve` entry point, or make it refuse to start with a
+   message that points to the Console. Keep any read-only code another package imports, and say which.
+   Update the docs that tell people to start it. The AGENTS.md text about the control-board reply convention
+   is a separate matter. Change it only if it tells someone to start 7331.
+
+## Mos's call on the Console dependency (mos-1019)
+
+The inventory (004f133bd) found that the Console proxies `/api/board`, `/api/seen`, `/api/reply` and the
+conversation routes to `DEFAULT_BOARD` on 7331 (`packages/webui/src/serve.mjs:12`), so the board view returns
+502 today. Mos took Sage's recommendation: retire the 7331 listener and its README start commands, and have
+the Console call the board's read code in-process, behind the Console's own auth (Q175 SSO on 7332).
+`/api/reply` stays only under `--send`. The DESIGN.md for that change comes before code, and Webby approves
+it.
+
+## Acceptance
+
+Nothing in the stack can start a writer on 7331. A test proves it: the entry point refuses (or is gone), no
+script or unit starts it, and a grep check finds no starter. Each change gets a mutant that brings the writer
+back and the test kills it. Mos added three items (mos-1019):
+
+- The board view answers from the Console with nothing listening on 7331.
+- Every board route sits behind the Console's auth.
+- A test proves `/api/reply` refuses without `--send`.
+
+Test fixtures that bind port 0 may stay if they only test the code in-process.
+
+## Boundaries
+
+- No change to the live units, `~/.mosaic-dev`, `~/.config/mosaic-dev`, slot files or `~/.mosaic`.
+- No request to any live port.
+- Single test files run freely. Suites need Sage's slot.
+
+## Gate
+
+Webby approves INVENTORY.md, then DESIGN.md, then the manifest. The control-board and webui package suites, the cli suite and
+every `scripts/test-*.sh` are green on Sage's gate, and the mutants are killed.
@@ -0,0 +1,42 @@
+# Brief: a second gate lane, two full gates at once on dragon-lin
+
+Sage, 2026-10-20, for Mos's order mos-0977 item 6 ("put the design for a second gate lane on the list now")
+and the MVP push (mos-0974). Gitea #1695. Owner Herb (Codex gpt-6.1-sol, a new builder seat), reviewer
+Webby, gate owner Sage. Base: refactor at the brief commit. Design first. The first deliverable is
+`agents/herb/work/queue-ROW/DESIGN.md`.
+
+## Why
+
+Every full run shares one slot today. A full gate (cli suite plus every `scripts/test-*.sh`) takes about 13
+minutes or more, reviewers' runs and mutants take the same slot, and with eight or more seats building for
+10-27 the slot is the bottleneck. The slot exists because concurrent runs broke each other. The busy check is
+`agents/sage/work/gate-lane/busy-now.sh` (a copy of Sage's), and the gate is
+`agents/sage/work/gate-lane/gate-template.sh` (a copy of Sage's template). The host has 16 cores and 62 GB.
+
+## What the design must settle
+
+1. Every shared resource two concurrent runs can collide on, found from the code and tests, not guessed:
+   Docker compose project names and networks (`scripts/test-task.sh` and others), fixed TCP ports in tests,
+   unix socket paths and their 107-byte limit under TMPDIR, the sandbox's private `/tmp`, shared caches,
+   scratch and worktree paths, the queue lock, and any test that reads host-wide state (process lists,
+   `pgrep`, `/proc`). For each: how a lane gets its own copy, or why it is safe to share.
+2. Timing. Which tests have time limits that a doubled CPU load could break, measured, and what changes (a
+   bound, or a lane rule that keeps those suites apart).
+3. The lane mechanism: lane ids, a lock per lane that a run takes and releases even on a crash, the busy
+   check that reports per lane, and how a seat asks for a lane. Sage still grants it.
+4. The gate template takes a lane id and isolates everything from point 1 by it.
+5. Proof: two full gates on different candidates at once, three times, with zero cross-failures, plus the
+   wall time of each against a single-lane run. Any flake found is named with its cause.
+
+## Boundaries
+
+- No change to the live units, `~/.mosaic-dev`, `~/.config/mosaic-dev` or slot files. The proof runs use
+  scratch roots only, and it needs Sage's grant of the whole slot while it runs.
+- Test code changes that only isolate a resource are in scope. A change to what a test checks is not, and
+  goes to its owner.
+- Docker networks and containers a run makes are removed by the run (trap), and nothing else is touched.
+
+## Gate
+
+Webby approves DESIGN.md, then the manifest. The cli suite and every `scripts/test-*.sh` are green on Sage's
+gate, both singly and in the two-lane proof.
@@ -0,0 +1,39 @@
+# Brief: stack-release.sh activates a Console with --sso (Q175 phase 2 prerequisite)
+
+Sage, 2026-10-20, for Launchpad's finding F3 on row 192 (launchpad-0001) and Q175 (#412). Gitea #1698. Owner
+Launchpad, reviewer Webby, gate owner Sage. Chained on row 192's candidate (Q177): it lands after row 192 and
+before the phase 2 window. Base: row 192's candidate.
+
+## Why
+
+The phase 2 window re-pins the Console to the phase 1 commit with `--sso --send --tester-port 7333`
+(`agents/sage/work/q175-sso/DESIGN.md`, section 5). `scripts/stack-release.sh` doesn't know `--sso` today.
+Its `proof_checks` (`:751`) requires `--public-host`, `--auth-header` and `--allow-user` whenever a proof pair is
+carried, and the pointer's Console flags still hold the forward-auth pair (`--auth-header X-authentik-username
+--allow-user jason.woltje`) that `--sso` refuses to start with. So the window can't run through the script, and
+a hand-edited pointer is not an option.
+
+## What the row does
+
+1. `activate ID BUSINESS --sso` writes Console flags with `--sso` and without `--auth-header`, `--allow-user`
+   and any proof pair, and `--plan` names each flag it drops and carries, in the style of row 189's `send:`
+   line. The design names the full flag set the phase 2 Console starts with and checks it against row 192's
+   refusals.
+2. Before anything stops, the script refuses a target copy whose Console doesn't support `--sso`, and refuses
+   when the config's `console` key or its slot file fails the checks row 192's `--sso` start runs. It reads
+   neither value and only uses the same stat and shape checks.
+3. Rollback from an `--sso` pointer to a pre-phase-1 copy follows the design's phase 2 rollback order (remove
+   the `console` key first). The script refuses a rollback that would start a Console on a config it can't
+   read, and says which step comes first.
+4. `docs/TOOLS.md` gets the flag.
+
+## Boundaries
+
+- No change to the live pointer, units, `~/.mosaic-dev` or `~/.config/mosaic-dev`. Tests use scratch roots
+  and seeded pointers, as rows 187 and 189 do.
+- No request to the live Console, mosaic.woltje.com or auth.diversecanvas.com.
+
+## Gate
+
+Webby approves the manifest. The cli suite and every `scripts/test-*.sh` are green on Sage's gate, and the
+mutants are killed (one per refusal, and one that keeps `--auth-header` in the written flags).
@@ -9,8 +9,7 @@
      "version": "0.0.3",
      "license": "UNLICENSED",
      "dependencies": {
-        "@earendil-works/pi-coding-agent": "0.85.1",
-        "oauth4webapi": "3.8.8"
+        "@earendil-works/pi-coding-agent": "0.85.1"
      }
    },
    "node_modules/@anthropic-ai/sdk": {
@@ -1934,15 +1933,6 @@
        "url": "https://opencollective.com/node-fetch"
      }
    },
-    "node_modules/oauth4webapi": {
-      "version": "3.8.8",
-      "resolved": "https://registry.npmjs.org/oauth4webapi/-/oauth4webapi-3.8.8.tgz",
-      "integrity": "sha512-8N28E+a/oxfXWBgOMt+ZP/JUf/XR+IFbvkAEPP3gznXOMv9BpAAwiIj0TFNz3tGTPc0ZQ8zmWBNgN1nAys0gng==",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/panva"
-      }
-    },
    "node_modules/openai": {
      "version": "6.40.0",
      "resolved": "https://registry.npmjs.org/openai/-/openai-6.40.0.tgz",
@@ -5,7 +5,6 @@
  "description": "Minimal Mosaic Stack container proof of concept: one Pi agent, four local contract files, one real model request returning MOSAIC_HELLO_OK.",
  "license": "UNLICENSED",
  "dependencies": {
-    "@earendil-works/pi-coding-agent": "0.85.1",
-    "oauth4webapi": "3.8.8"
+    "@earendil-works/pi-coding-agent": "0.85.1"
  }
 }
@@ -215,6 +215,13 @@ an operator inspect content and delivery evidence after an uncertain result.
 | `trail` | `{subject}`: task ref, decision UUID or message UUID. Linked records in broker write order. |
 | `decisions` | `{list}`: `roles` or `recent`; human and reader sessions only. Open decisions routed to a role, or the last 50 closed. |
 | `credentials` | No args; human and reader sessions only. `[{service,account,role,dateKind,date,state}]` for the capability's business, never a token, file path or variable name. |
+| `credentials.issue` | `{agent,service,token,date}`; human only (row 199, #1697). Writes the token to `<configDir>/secrets/agents/<business>/<agent>/<service>` (0600, dirs 0700: tmp, fsync, rename), rewrites the agent's reference in the business file to `{"store":true,<rotateBy or expires>:date}`, then holds the token in memory, with no restart. Over an issued entry it is a rotate: the old value is gone from disk and memory when it returns. `service` is `gitea` or `vikunja` and the business file must already name it for the agent (`credential-unknown`). A token the bus already holds is `credential-leak`; a bad token `credential-format`; a bad date `credential-date`. Returns `{agent,verb,service,date,state}`, `verb` `issue` or `rotate`. The tester gets `tester-refused`. |
+| `credentials.revoke` | `{agent,service?,reason}`; human, or the tester (Q173). Drops the entry from memory, then unlinks a store file; a `file` or `env` reference keeps its file and becomes `store`, so a restart loads nothing. Without `service`, every kind the agent has. Returns `{agent,verb,services:[{service,state}]}`. |
+| `credentials.delete` | `{agent,reason}`; human only. `credentials.revoke` for every kind, then removes the agent's store dir; a file there other than a token is `credential-file`. While the agent or one of its threads holds a claim, `agent-running`. |
+
+Each of the three leaves one receipt in the organization's `changes.jsonl`: the actor and a
+`detail` of `{verb,agent,kind,date or reason}`, never a value. A change to the store alone writes
+a receipt with empty `changes`. A refusal is `action.refused` with its code alone.
 | `requirements` | No args; role sessions only, as `task.create` is (row 90, #1584). The approved PRD's requirement ids, `{prd,version,requirements:[{id,title}]}`, from `packages/tasks/requirements.json`, loaded when the broker starts; a bad file refuses the start. A human session refuses `agent-required`, a reader `read-only`. |
 | `state` | No args; role, human and reader sessions (row 109, #1603). `{launch:{state,at,event},tasks:{open:[{task_ref,title}],total,cap}}` for the capability's business. `launch` is the latest `launch.revoked` or `launch.restored` event: `allowed` with `at` and `event` null when none exists. `open` is the tracker snapshot's open tasks in `task_ref` order, at most `cap` (the `tasks` page size, 50); `total` counts every open task. The harness runner reads it before each turn. Writes nothing. |
 | `replies` | `{id}`: a message UUID; human and reader sessions only. The messages whose `in_reply_to` is that id, oldest first, at most 50. Writes nothing. |
@@ -3,7 +3,7 @@ import { isAbsolute } from 'node:path';
 import { NAME as HARNESS_NAME } from '../../plugins/src/kinds.mjs';
 import { loadRequirements } from '../../tasks/src/requirements.mjs';
 import { MERGE, LandingRefusal, readLanding } from './landing.mjs';
-import { ID_PATTERN, THREAD_DEFINITION, END_PROTECTED } from '../../business/src/vocabulary.mjs';
+import { ID_PATTERN, THREAD_DEFINITION, END_PROTECTED, forkProblem, forkUrl } from '../../business/src/vocabulary.mjs';

 // Kept closed while S1 lands; its vocabulary is the integration authority.
 export const ACTIONS = Object.freeze([
@@ -18,6 +18,8 @@ export const ACTIONS = Object.freeze([
  'git.push.working',
  'git.push.protected',
  'git.merge.protected',
+  // Row 199 (#1697, mos-1027 Q-M2): publish to the agent's fork. Not in ROUTED, so a hard wait.
+  'git.push.remote',
  'review.request',
  'review.verdict',
  'record.write',
@@ -101,6 +103,11 @@ export const TESTER_VERBS = Object.freeze(['message.send', 'message.receive', 'm
 // Row 175: the organization verbs a tester may call. Its writes run every check the human's do
 // and log actor `tester`; row 176 adds routes reads; limits.set, organization.set and organization.revision refuse it.
 export const TESTER_ORGANIZATION_VERBS = Object.freeze(['limits', 'plugins', 'instances', 'plugins.set', 'instances.set', 'routes.set', 'routes']);
+// Row 199 (#1697, design section 6): the credential lifecycle, human-only. Under Q173 the tester may
+// revoke; issue (rotate is an issue over an issued entry) and delete refuse it, because a token it
+// issued would pass through its session (duckworth N1). The status read stays the `credentials` verb.
+export const CREDENTIAL_VERBS = Object.freeze(['credentials.issue', 'credentials.revoke', 'credentials.delete']);
+const TESTER_CREDENTIAL_VERBS = Object.freeze(['credentials.revoke']);
 const SELF_KINDS = new Set(['task.created', 'task.assigned', 'task.state', 'task.closed', 'task.conflict']);
 const POLL_KINDS = new Set([
  'task.changed.external',
@@ -191,10 +198,13 @@ export class Broker {
  #received = new Set();
  // Row 137 (#1631): landings checkLand let start, by ticket, until recordLand or landRefused ends them.
  #landings = new Map();
+  // Row 199: a publish between checkPublish and recordPublish or publishRefused.
+  #publishes = new Map();
  #secretCheck;
  #credentialStatus;
  #requirements;
  #organization;
+  #credentialVerbs;
  #project;
  #usage;
  #limits;
@@ -203,13 +213,15 @@ export class Broker {
  #stops = new Map();
  #clock = 0;
  // credentialStatus is the runtime's metadata-only Credentials.status(); the broker never gets use().
-  constructor({ store, businesses, secretCheck = () => {}, credentialStatus = () => [], organization = null, project = null, usage = null, limits = null, harnessOn = null }) {
+  constructor({ store, businesses, secretCheck = () => {}, credentialStatus = () => [], organization = null, project = null, usage = null, limits = null, harnessOn = null, credentialVerbs = null }) {
    if (!object(businesses) || !Object.keys(businesses).length) fail('invalid-business');
    this.#businesses = structuredClone(businesses);
    this.#store = store;
    this.#secretCheck = secretCheck;
    this.#credentialStatus = credentialStatus;
    this.#organization = organization;
+    // Row 199: the runtime's credential lifecycle (credential-verbs.mjs); it holds the store, not the broker.
+    this.#credentialVerbs = credentialVerbs;
    this.#project = project;
    this.#usage = usage;
    this.#limits = limits;
@@ -795,7 +807,12 @@ export class Broker {
    // records `?? null` and the current holder reads undefined.
    if (action === 'role.revoke' && (context.holderRun ?? null) !== (this.#holder(s.business, target)?.holder_run ?? null))
      fail('decision-mismatch');
-    return { class: cls, decision: d.id };
+    // Row 199 (r4 B4): approve at A, push B, publish refuses.
+    if (action === 'git.push.remote' && (context.pushCommit ?? null) !== (this.#latestPush(s.business, target)?.commit ?? null))
+      fail('decision-mismatch');
+    return action === 'git.push.remote'
+      ? { class: cls, decision: d.id, pushCommit: context.pushCommit ?? null }
+      : { class: cls, decision: d.id };
  }
  // The raise's context: its target and approval option, from the decision.raise action.allowed.
  #raised(business, decision) {
@@ -858,13 +875,14 @@ export class Broker {
    if (body.commit !== push.commit) fail('verdict-stale');
  }
  // A push is the action.allowed recordPush wrote, the only one for git.push.working with a commit.
+  // role is the role that pushed (row 199, work-not-yours).
  #latestPush(business, task) {
    const r = this.#store.get(
-      "SELECT body FROM events WHERE business=? AND kind='action.allowed' AND json_extract(body,'$.action')='git.push.working' AND json_type(body,'$.commit')='text' AND subject=? ORDER BY seq DESC LIMIT 1",
+      "SELECT body, actor_role FROM events WHERE business=? AND kind='action.allowed' AND json_extract(body,'$.action')='git.push.working' AND json_type(body,'$.commit')='text' AND subject=? ORDER BY seq DESC LIMIT 1",
      business,
      task,
    );
-    return r ? JSON.parse(r.body) : null;
+    return r ? { ...JSON.parse(r.body), role: r.actor_role } : null;
  }
  // Row 93: the bus host's git socket asks before it takes a push's bytes. Nothing is recorded
  // unless it refuses: the push is recorded, and its authority consumed, once the ref moved.
@@ -998,6 +1016,98 @@ export class Broker {
    this.#landings.delete(ticket);
    return code;
  }
+  // Row 199 (#1697, design D9 steps 1 to 3, D9b): the bus host's git socket publishes a task's
+  // recorded work commit to the agent's own fork. checkPublish runs before anything touches the
+  // network. The run holds its claim; git.push.remote is a hard wait, so it cites a decision the
+  // human resolved for this task, bound to the task's latest push (#authorityFor). The project must
+  // be in the agent's publish grant with an upstream; the fork is built from that upstream and the
+  // agent's own Gitea user, never from the request. The ticket carries the session and decision to
+  // recordPublish or publishRefused. No token is in the result.
+  checkPublish(cap, args) {
+    const s = this.#session(cap);
+    return this.#store.transaction(() => {
+      keys(args, ['task_ref', 'project', 'branch', 'decision'], ['task_ref', 'project', 'branch']);
+      if (!taskRef(args.task_ref) || (args.decision !== undefined && !id(args.decision))) fail('invalid-request');
+      identifier(args.project);
+      string(args.branch, 200);
+      this.#agent(s);
+      const { task_ref, project, branch } = args;
+      const decision = args.decision ?? null;
+      const result = this.#checkAuthority(s, 'git.push.remote', { decision, target: task_ref });
+      const facts = this.#publishFacts(s, task_ref, project, result);
+      const ticket = randomUUID();
+      const dst = `refs/heads/${facts.user}/${branch}`;
+      this.#publishes.set(ticket, { s, task_ref, project, decision, dst, ...facts });
+      return { ticket, task_ref, project, fork: facts.fork, user: facts.user, email: facts.email, source: facts.source, dst };
+    });
+  }
+  // Steps 2 and 3, checked again at recordPublish. After routing a within-role publish has no
+  // decision, so the commit is the latest push's (N9); the git socket still checks the work ref tip.
+  #publishFacts(s, task_ref, project, result) {
+    if (result.decision && this.#spent(s.business, result.decision)) fail('decision-consumed');
+    const b = this.#business(s.business);
+    const role = b.roles?.[s.role];
+    const upstream = b.projects?.[project]?.remote;
+    if (!role?.identity || !(role.publish ?? []).includes(project) || !upstream) fail('remote-not-granted');
+    const problem = forkProblem(upstream, role.identity);
+    if (problem) fail(problem);
+    const push = this.#latestPush(s.business, task_ref);
+    if (!push) fail('no-push');
+    if (push.role !== s.role) fail('work-not-yours');
+    if (push.project !== project) fail('work-ref');
+    const source = result.pushCommit ?? push.commit;
+    if (source !== push.commit) fail('decision-mismatch');
+    const user = role.identity.gitea.user;
+    return { fork: forkUrl(upstream, user), user, email: role.identity.email, source };
+  }
+  #publish(ticket) {
+    return (typeof ticket === 'string' && this.#publishes.get(ticket)) || fail('publish-unknown');
+  }
+  // Design D5: the only key the git socket's gitea token use gets is the agent checkPublish checked
+  // (#agent: a run holding its claim, never a tester, reader or human). Trusted host only.
+  publishSession(ticket) {
+    const { s } = this.#publish(ticket);
+    return Object.freeze({ business: s.business, role: s.role });
+  }
+  // Where the bus process's git sends the push (D9 step 5): all from the ticket, none from the
+  // host's message. Trusted host only.
+  publishTarget(ticket) {
+    const { s, project, fork, user, source, dst } = this.#publish(ticket);
+    return Object.freeze({ business: s.business, project, fork, user, source, dst });
+  }
+  // Step 6: records the push the git socket made as the action.allowed for git.push.remote, which
+  // spends the decision. The checks run again; the run may have ended while git ran, so the holder
+  // check is not repeated (as recordLand). Trusted host only.
+  recordPublish(ticket, pushed) {
+    const t = this.#publish(ticket);
+    const done = this.#store.transaction(() => {
+      keys(pushed, ['ref', 'commit', 'previous'], ['ref', 'commit', 'previous']);
+      if (!oid(pushed.commit) || (pushed.previous !== null && !oid(pushed.previous))) fail('invalid-request');
+      string(pushed.ref, 260);
+      const result = this.#authorityFor(t.s, 'git.push.remote', { decision: t.decision, target: t.task_ref });
+      const facts = this.#publishFacts(t.s, t.task_ref, t.project, result);
+      if (facts.source !== t.source || pushed.commit !== t.source || facts.fork !== t.fork || pushed.ref !== t.dst) fail('ref-moved');
+      const { ref, commit, previous } = pushed;
+      this.#event(
+        t.s,
+        'action.allowed',
+        { project: t.project, fork: t.fork, ref, commit, previous, action: 'git.push.remote', ...result, target: t.task_ref },
+        t.task_ref,
+      );
+      return { task_ref: t.task_ref, fork: t.fork, ref, commit, previous };
+    });
+    this.#publishes.delete(ticket);
+    return done;
+  }
+  // Ends a publish that didn't push: action.refused with the code on the task's trail. The git
+  // socket answers the run with the same code. Trusted host only.
+  publishRefused(ticket, { code } = {}) {
+    const t = this.#publish(ticket);
+    if (!/^[a-z-]{1,64}$/.test(code ?? '')) fail('invalid-request');
+    this.#store.transaction(() => this.#event(t.s, 'action.refused', { code }, t.task_ref));
+    this.#publishes.delete(ticket);
+    return code;
+  }
  // The outcome as a RESULT from the bus, as #notice sends: the runner takes a turn on it and sends
  // no automatic reply. It goes to the role in the thread the decision was raised in.
  #landMessage(s, decision, body) {
@@ -1245,6 +1355,7 @@ export class Broker {
        return this.#requestProject(s, { verb: request.verb, args: structuredClone(args) });
      if (PROJECT_FILE_VERBS.includes(request.verb))
        return this.#requestProjectFile(s, { verb: request.verb, args: structuredClone(args) });
+      if (CREDENTIAL_VERBS.includes(request.verb)) return this.#requestCredential(s, request.verb, structuredClone(args));
      if (["limits", "limits.set", "organization.set", "organization.revision", "plugins", "plugins.set", "instances", "instances.set", "routes", "routes.set"].includes(request.verb)) {
        // Row 123 (#1617, REQ-COS-1, REQ-LIMIT-1): organization.set is limits.set for a role whose
        // file lists organization.change. It takes the same keys, runs the same write path and
@@ -1316,6 +1427,35 @@ export class Broker {
      throw this.#refused(s, e, request);
    }
  }
+  // Row 199 (#1697, design section 6). The token of an issue comes in args from the human's stdin; the
+  // secret check above has refused one the bus already holds, a refusal records its code alone, and
+  // nothing returned carries it. Outside the store transaction, as the organization branch.
+  #requestCredential(s, verb, a) {
+    if (s.tester ? !TESTER_CREDENTIAL_VERBS.includes(verb) : !s.human) fail(s.tester ? 'tester-refused' : 'human-required');
+    if (!this.#credentialVerbs) fail('not-configured');
+    if (verb === 'credentials.issue') keys(a, ['agent', 'service', 'token', 'date'], ['agent', 'service', 'token', 'date']);
+    else keys(a, verb === 'credentials.revoke' ? ['agent', 'service', 'reason'] : ['agent', 'reason'], ['agent', 'reason']);
+    string(a.agent, 64);
+    if (a.service !== undefined && !['gitea', 'vikunja'].includes(a.service)) fail('invalid-request');
+    if (a.token !== undefined) string(a.token, 16384);
+    if (a.date !== undefined) string(a.date, 10);
+    if (a.reason !== undefined) string(a.reason, 500);
+    if (!Object.hasOwn(this.#business(s.business).roles, a.agent)) fail('credential-unknown');
+    // A running agent keeps its tokens until its runs end: delete waits for every claim to end.
+    if (verb === 'credentials.delete' && (this.#holder(s.business, a.agent)?.op === 'claim' || this.#threadHolders(s.business, a.agent).length))
+      fail('agent-running');
+    let result;
+    try {
+      result = this.#credentialVerbs(s.business, verb, a, s.tester ? 'tester' : s.human);
+    } catch (e) {
+      if (e instanceof BusError && e.code.startsWith('credential-')) throw e;
+      if (e.code === 'revision-conflict' || e.code?.startsWith('organization-')) fail(e.code);
+      if (e.name === 'BusinessError') fail('invalid-request');
+      throw new BusError('outcome-unknown');
+    }
+    this.#secretCheck(result);
+    return result;
+  }
  // Only the runner's bound session and delivered message identify a turn; no host path crosses the wire.
  // Row 156 (#1651, sage-0808): a role run's landing turn is a merge decision id instead. Its begin
  // needs the decision held for the run's role; its end needs that begin, since the landing may
@@ -1698,6 +1838,12 @@ export class Broker {
            by,
          );
        }
+        // Row 199 (#1697, design D9 step 1, r4 B4): a publish decision binds one commit, the task's
+        // latest recorded push now, read here and never taken from the agent. The human sees it.
+        const pushCommit =
+          a.action === 'git.push.remote' ? (this.#latestPush(s.business, a.target)?.commit ?? fail('no-push')) : null;
+        const question = pushCommit ? `${a.question} (commit ${pushCommit})` : a.question;
+        string(question);
        const did = randomUUID();
        this.#store.run(
          'INSERT INTO decisions(id,at,business,project,raised_by_role,raised_by_run,class,action,route_to,question,options,recommendation,task_ref,requirement_ref,blocking,supersedes,spec_path,spec_commit) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)',
@@ -1710,7 +1856,7 @@ export class Broker {
          cls,
          a.action,
          route,
-          a.question,
+          question,
          JSON.stringify(a.options),
          a.recommendation,
          a.task_ref ?? null,
@@ -1732,6 +1878,7 @@ export class Broker {
            approvalChoice,
            holderRun:
              a.action === 'role.revoke' ? (this.#holder(s.business, a.target)?.holder_run ?? null) : null,
+            ...(pushCommit ? { pushCommit } : {}),
          },
          a.task_ref ?? (taskRef(a.target) ? a.target : did),
        );
@@ -0,0 +1,53 @@
+import { BusError } from './broker.mjs';
+// Row 199 (#1697, design section 6): issue, rotate, revoke and delete of one agent's credentials, for
+// the broker's human-only verbs. The broker checks the session, the keys and a running claim first.
+// Each verb leaves one receipt in the organization's changes.jsonl: the actor and a detail naming the
+// verb, agent, kinds, date or reason, never a value. Nothing here logs, and a result carries no token.
+const DATE_KEY = Object.freeze({ gitea: 'rotateBy', vikunja: 'expires' });
+const deny = (code) => {
+  throw new BusError(code);
+};
+export function credentialVerbs({ credentials, writer }) {
+  const state = (instance, service) =>
+    credentials.status().find((e) => e.instance === instance && e.service === service)?.state;
+  return (id, verb, args, actor) => {
+    const { agent } = args;
+    const instance = id + '/' + agent;
+    const { document, revision } = writer.read(id);
+    const current = document.roles?.[agent]?.credentials;
+    if (!current) deny('credential-unknown');
+    if (verb === 'credentials.issue') {
+      const { service, token, date } = args;
+      if (!current[service]) deny('credential-unknown');
+      // rotate is an issue over an entry the bus holds now; the old value is gone when this returns.
+      const kind = ['not-issued', 'revoked', undefined].includes(state(instance, service)) ? 'issue' : 'rotate';
+      const next = structuredClone(document);
+      next.roles[agent].credentials[service] = { store: true, [DATE_KEY[service]]: date };
+      const detail = { verb: kind, agent, kind: [service], date };
+      const status = credentials.issue(instance, service, token, date, () =>
+        writer.write(id, next, { revision, actor, detail }),
+      );
+      return { agent, verb: kind, service, date: status.date, state: status.state };
+    }
+    const services = verb === 'credentials.revoke' && args.service ? [args.service] : Object.keys(current);
+    if (services.some((service) => !current[service])) deny('credential-unknown');
+    // Memory first, then the store file (Credentials.revoke), then the business file. A reference
+    // outside the store becomes `store` with its date, so a restart loads nothing for it. When that
+    // write fails, the entry stays revoked in memory and the refusal says to run the verb again.
+    if (verb === 'credentials.delete') credentials.remove(instance);
+    else for (const service of services) credentials.revoke(instance, service);
+    const detail = { verb: verb.slice('credentials.'.length), agent, kind: services, reason: args.reason };
+    const moved = services.filter((service) => current[service].store !== true);
+    if (moved.length) {
+      const next = structuredClone(document);
+      for (const service of moved)
+        next.roles[agent].credentials[service] = { store: true, [DATE_KEY[service]]: current[service][DATE_KEY[service]] };
+      writer.write(id, next, { revision, actor, detail });
+    } else writer.record(id, { actor, detail });
+    return {
+      agent,
+      verb: detail.verb,
+      services: services.map((service) => ({ service, state: state(instance, service) ?? 'not-issued' })),
+    };
+  };
+}
@@ -1,5 +1,8 @@
-import { openSync, closeSync, fstatSync, readFileSync, lstatSync, realpathSync, constants } from 'node:fs';
-import { isAbsolute, relative, resolve } from 'node:path';
+import {
+  openSync, closeSync, fstatSync, readFileSync, lstatSync, realpathSync, constants, mkdirSync, writeSync, fsyncSync,
+  renameSync, unlinkSync, rmdirSync, readdirSync,
+} from 'node:fs';
+import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { BusError } from './broker.mjs';
 const deny = (code) => {
  throw new BusError(code);
@@ -13,9 +16,33 @@ const day = (value) =>
  /^\d{4}-\d{2}-\d{2}$/.test(value) &&
  !Number.isNaN(Date.parse(value)) &&
  new Date(value).toISOString().slice(0, 10) === value;
+const TOKEN = /^[-A-Za-z0-9._~]+\n?$/;
+// Row 199 (#1697, design D1, D4): a store dir is the stack instance's user's own and nobody else's.
+const privateDir = (path, { missing = false } = {}) => {
+  let st;
+  try {
+    st = lstatSync(path);
+  } catch (e) {
+    if (missing && e.code === 'ENOENT') return false;
+    deny('credential-file');
+  }
+  if (!st.isDirectory() || st.uid !== process.getuid() || (st.mode & 0o077) !== 0) deny('credential-file');
+  return true;
+};
 export class Credentials {
  #tokens = new Map();
-  constructor({ references = {}, repoRoots = [], dataRoot, env = process.env }) {
+  // Row 199: every reference the bus loaded, so issue, rotate, revoke and status work per entry.
+  #refs = new Map();
+  #revoked = new Set();
+  #storeRoot;
+  #repoRoots;
+  #dataRoot;
+  // storeRoot is <configDir>/secrets/agents (design D1); a reference with store: true must name the
+  // path under it for its own business, agent and service.
+  constructor({ references = {}, repoRoots = [], dataRoot, env = process.env, storeRoot = null }) {
+    this.#storeRoot = storeRoot;
+    this.#repoRoots = repoRoots;
+    this.#dataRoot = dataRoot;
    try {
      for (const [instance, services] of Object.entries(references))
        for (const [service, ref] of Object.entries(services)) {
@@ -26,12 +53,41 @@ export class Credentials {
          if (
            (ref.service !== undefined && ref.service !== service) ||
            Object.keys(ref).some(
-              (k) => !['service', 'file', 'env', service === 'vikunja' ? 'expires' : 'rotateBy'].includes(k),
+              (k) => !['service', 'file', 'env', 'store', service === 'vikunja' ? 'expires' : 'rotateBy'].includes(k),
            ) ||
-            Boolean(ref.file) === Boolean(ref.env)
+            Boolean(ref.file) === Boolean(ref.env) ||
+            (ref.store !== undefined && (ref.store !== true || ref.file !== this.#storePath(instance, service)))
          )
            deny('credential-reference');
+          this.#refs.set(instance + ':' + service, { ref, date });
+          const token = this.#read(ref, env);
+          if (token !== null) this.#tokens.set(instance + ':' + service, { token, date });
+        }
+    } catch (e) {
+      this.close();
+      throw e;
+    }
+  }
+  #storePath(instance, service) {
+    if (!this.#storeRoot) deny('credential-reference');
+    const [business, agent, ...rest] = instance.split('/');
+    if (!business || !agent || rest.length || agent.startsWith('@')) deny('credential-reference');
+    return join(this.#storeRoot, business, agent, service);
+  }
+  // One token, read and checked, or null for a store reference with no file yet (design D3a).
+  #read(ref, env) {
          let token;
+          if (ref.store) {
+            const agentDir = dirname(ref.file);
+            privateDir(this.#storeRoot);
+            if (!privateDir(dirname(agentDir), { missing: true }) || !privateDir(agentDir, { missing: true })) return null;
+            try {
+              lstatSync(ref.file);
+            } catch (e) {
+              if (e.code === 'ENOENT') return null;
+              deny('credential-file');
+            }
+          }
          if (ref.file) {
            if (!isAbsolute(ref.file)) deny('credential-location');
            let resolved, original;
@@ -43,7 +99,7 @@ export class Credentials {
            }
            if (original.isSymbolicLink() || !original.isFile()) deny('credential-file');
            if (
-              [...repoRoots, dataRoot].filter(Boolean).some((root) =>
+              [...this.#repoRoots, this.#dataRoot].filter(Boolean).some((root) =>
                inside(
                  (() => {
                    try {
@@ -81,16 +137,98 @@ export class Credentials {
            if (!/^[A-Z_][A-Z0-9_]*$/.test(ref.env)) deny('credential-reference');
            token = env[ref.env];
          }
-          if (typeof token !== 'string' || token.length > 16384 || !/^[-A-Za-z0-9._~]+\n?$/.test(token))
-            deny('credential-format');
-          token = token.replace(/\n$/, '');
-          if (token.length < 16) deny('credential-format');
-          this.#tokens.set(instance + ':' + service, { token, date });
-        }
-    } catch (e) {
-      this.close();
-      throw e;
+          return Credentials.#format(token);
+  }
+  static #format(token) {
+    if (typeof token !== 'string' || token.length > 16384 || !TOKEN.test(token)) deny('credential-format');
+    token = token.replace(/\n$/, '');
+    if (token.length < 16) deny('credential-format');
+    return token;
+  }
+  #known(instance, service) {
+    const known = this.#refs.get(instance + ':' + service);
+    if (!known) deny('credential-unknown');
+    return known;
+  }
+  // Row 199 (design section 6): write the token to the agent's store path (tmp, fsync, rename), then
+  // `commit` (the business file's reference becomes store), then memory. The token comes from the
+  // caller's stdin and is never logged. Returns the entry's new status.
+  issue(instance, service, token, date, commit = () => {}) {
+    this.#known(instance, service);
+    if (!day(date)) deny('credential-date');
+    token = Credentials.#format(token);
+    const file = this.#storePath(instance, service);
+    const agentDir = dirname(file);
+    mkdirSync(this.#storeRoot, { recursive: true, mode: 0o700 });
+    privateDir(this.#storeRoot);
+    for (const dir of [dirname(agentDir), agentDir]) {
+      if (!privateDir(dir, { missing: true })) mkdirSync(dir, { mode: 0o700 });
+      privateDir(dir);
    }
+    const tmp = file + '.tmp';
+    try {
+      unlinkSync(tmp);
+    } catch (e) {
+      if (e.code !== 'ENOENT') deny('credential-file');
+    }
+    let fd;
+    try {
+      fd = openSync(tmp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+      writeSync(fd, token + '\n');
+      fsyncSync(fd);
+    } finally {
+      if (fd !== undefined) closeSync(fd);
+    }
+    renameSync(tmp, file);
+    const dirFd = openSync(agentDir, constants.O_RDONLY);
+    try {
+      fsyncSync(dirFd);
+    } finally {
+      closeSync(dirFd);
+    }
+    commit();
+    this.#refs.set(instance + ':' + service, { ref: { service, store: true, file, [service === 'vikunja' ? 'expires' : 'rotateBy']: date }, date });
+    this.#tokens.set(instance + ':' + service, { token, date });
+    this.#revoked.delete(instance + ':' + service);
+    return this.status().find((e) => e.instance === instance && e.service === service);
+  }
+  // Memory first, then the store file (design section 6, D12). A file or env reference outside the
+  // store is never unlinked; the caller turns its reference into store, so a restart finds nothing.
+  revoke(instance, service) {
+    const { ref } = this.#known(instance, service);
+    this.#tokens.delete(instance + ':' + service);
+    this.#revoked.add(instance + ':' + service);
+    if (ref.store) {
+      try {
+        unlinkSync(ref.file);
+      } catch (e) {
+        if (e.code !== 'ENOENT') deny('credential-file');
+      }
+    }
+    return { file: Boolean(ref.store) };
+  }
+  // revoke for every service, then the agent's dir. A file other than a token or its tmp refuses.
+  remove(instance) {
+    const services = [...this.#refs.keys()].filter((k) => k.startsWith(instance + ':')).map((k) => k.slice(instance.length + 1));
+    for (const service of services) this.revoke(instance, service);
+    const agentDir = dirname(this.#storePath(instance, 'gitea'));
+    let names;
+    try {
+      names = readdirSync(agentDir);
+    } catch (e) {
+      if (e.code === 'ENOENT') return { services };
+      deny('credential-file');
+    }
+    if (names.some((n) => !/^(gitea|vikunja)(\.tmp)?$/.test(n))) deny('credential-file');
+    for (const n of names) unlinkSync(join(agentDir, n));
+    rmdirSync(agentDir);
+    return { services };
+  }
+  // The agent-facing use (design D5): the key comes only from the broker's verified session.
+  async useFor(session, service, operation) {
+    if (!session || typeof session.business !== 'string' || typeof session.role !== 'string' || session.role.startsWith('@'))
+      deny('credential-not-yours');
+    return this.use(session.business + '/' + session.role, service, operation);
  }
  assertClean(value) {
    let encoded;
@@ -109,14 +247,16 @@ export class Credentials {
    let result;
    try {
      result = await operation(entry.token);
-    } catch {
+    } catch (e) {
+      // Row 199: a host step's own refusal (publish) keeps its code; anything else is the service's.
+      if (e instanceof BusError) throw e;
      deny('service-failed');
    }
    this.assertClean(result);
    return result;
  }
  status() {
-    return [...this.#tokens.entries()].map(([key, { date }]) => {
+    return [...this.#refs.entries()].map(([key, { date }]) => {
      const i = key.lastIndexOf(':'),
        service = key.slice(i + 1),
        left = Date.parse(date + 'T00:00:00Z') - Date.now();
@@ -124,8 +264,11 @@ export class Credentials {
        instance: key.slice(0, i),
        service,
        date,
-        state:
-          service === 'gitea'
+        state: !this.#tokens.has(key)
+          ? this.#revoked.has(key)
+            ? 'revoked'
+            : 'not-issued'
+          : service === 'gitea'
            ? left <= 0
              ? 'rotation-due'
              : 'valid'
@@ -139,5 +282,6 @@ export class Credentials {
  }
  close() {
    this.#tokens.clear();
+    this.#refs.clear();
  }
 }
@@ -14,6 +14,11 @@ const LAUNCH_OPS = new Set([
  'checkLand',
  'recordLand',
  'landRefused',
+  'checkPublish',
+  'publishPush',
+  'publishResult',
+  'recordPublish',
+  'publishRefused',
  'landHeld',
  'threadsState',
  'threadIdle',
@@ -34,6 +39,12 @@ function launchOp(m) {
  if (m.op === 'checkLand') return runtime.checkLand(m.cap, m.args);
  if (m.op === 'recordLand') return runtime.recordLand(m.ticket, m.land);
  if (m.op === 'landRefused') return runtime.landRefused(m.ticket, m.args);
+  // Row 199 (#1697, design D9b): the git socket's publish op. No entry returns a token.
+  if (m.op === 'checkPublish') return runtime.checkPublish(m.cap, m.args);
+  if (m.op === 'publishPush') return runtime.publishPush(m.ticket);
+  if (m.op === 'publishResult') return runtime.publishResult(m.ticket);
+  if (m.op === 'recordPublish') return runtime.recordPublish(m.ticket, m.pushed);
+  if (m.op === 'publishRefused') return runtime.publishRefused(m.ticket, m.args);
  if (m.op === 'landHeld') return runtime.landHeld(m.record);
  // Row 121 (#1615): the launcher's view of the business's threads, and its idle release.
  if (m.op === 'threadsState') return runtime.threadsState(m.business);
@@ -99,7 +110,8 @@ if (!process.send) {
      booted = true;
      clearTimeout(timer);
      // `trackers` is S3's plain-data boot config; the adapter is loaded only when a business has one.
-      const { trackers, ...config } = message.config ?? {};
+      // Row 199: publishTls is the tests' scratch CA; no boot config sets it.
+      const { trackers, publishTls: _tls, ...config } = message.config ?? {};
      if (trackers) {
        const { tasksAdapter } = await import('../../tasks/src/adapter.mjs');
        config.tasks = tasksAdapter({ trackers });
@@ -8,9 +8,12 @@ import { Credentials } from './credentials.mjs';
 import { serve } from './server.mjs';
 import { launchSettings } from '../../business/src/launch-settings.mjs';
 import { readSessions } from '../../seat/src/session.mjs';
+import { publishRemote, workingRepo, WorkingError } from '../../seat/src/working.mjs';
 import { createLoader, hasModule } from '../../plugins/src/loader.mjs';
 import { pluginSettings } from '../../business/src/plugin-settings.mjs';
 import { instanceSettings } from '../../business/src/instance-settings.mjs';
+import { organizationWriter } from '../../business/src/organization.mjs';
+import { credentialVerbs } from './credential-verbs.mjs';
 import { webService } from './web.mjs';
 import { verifyHuman } from './human.mjs';
 import { createUsage } from './usage.mjs';
@@ -72,6 +75,9 @@ export async function startBroker({
  repoRoots = [],
  tasks = null,
  organization = null,
+  // Row 199: the tests' scratch CA for publish's git (`-c http.sslCAInfo=...`). process.mjs drops
+  // it from the boot config, so only an in-process caller sets it.
+  publishTls = [],
 }) {
  let store, credentials, server, adapter;
  try {
@@ -86,7 +92,9 @@ export async function startBroker({
      ...repoRoots,
      ...Object.values(businesses).flatMap((b) => Object.values(b.projects ?? {}).map((p) => p.root)),
    ];
-    credentials = new Credentials({ references, repoRoots: protectedRoots, dataRoot });
+    // Row 199 (#1697, design D1): the per-agent store is <configDir>/secrets/agents.
+    const storeRoot = organization ? join(organization.dir, 'secrets', 'agents') : null;
+    credentials = new Credentials({ references, repoRoots: protectedRoots, dataRoot, storeRoot });
    store = new Store(dataRoot);
    // vikunja:19/305: the plug-in switch through the same human-only path as the limits: the verbs
    // plugins and plugins.set, logged in changes.jsonl with the actor, a missing module refused.
@@ -133,6 +141,11 @@ export async function startBroker({
      }:null,
      secretCheck: (value) => credentials.assertClean(value),
      credentialStatus: () => credentials.status(),
+      // Row 199 (#1697, design section 6): issue, rotate, revoke and delete, live with no restart; each
+      // rewrites or records through the organization writer, so changes.jsonl holds the receipt.
+      credentialVerbs: organization
+        ? credentialVerbs({ credentials, writer: organizationWriter({ dir: organization.dir, rolesDir: organization.rolesDir }) })
+        : null,
      // Row 65: a new launch binds only on a harness its business switches on, read from the file
      // as it stands now; an unreadable file switches none on.
      harnessOn: (id, name) => {
@@ -212,6 +225,42 @@ export async function startBroker({
    // Row 137 (#1631): the git socket's land op. checkLand's refusal is the run's, like checkPush's.
    // A landing then ends in recordLand or landRefused under its ticket, which outlive the run's cap.
    const checkLand = (cap, args) => refusing(cap, () => broker.checkLand(cap, args), args?.task_ref);
+    // Row 199 (#1697, design D9b): the git socket's publish op. checkPublish's refusal is the run's.
+    // The gitea token is used only under the open ticket, keyed from the agent checkPublish checked,
+    // and the op table returns no token. A publish then ends in recordPublish or publishRefused,
+    // which files any refusal once, withGitea's included.
+    const checkPublish = (cap, args) => refusing(cap, () => broker.checkPublish(cap, args), args?.task_ref);
+    const withGitea = async (ticket, fn) => credentials.useFor(broker.publishSession(ticket), 'gitea', fn);
+    // The push itself runs here, where the token is (D9 step 5), and the git socket's host polls
+    // for its end: the host's op channel answers one op at a time within 10 s, and ls-remote and
+    // push can take longer. Fork, user, source and dst all come from the ticket. A WorkingError's
+    // code is the refusal; git's stderr stays here.
+    const remotes = new Map();
+    function publishPush(ticket) {
+      if (remotes.has(ticket)) throw new BusError('publish-busy');
+      const { business, project, fork, user, source, dst } = broker.publishTarget(ticket);
+      const entry = { state: 'running' };
+      remotes.set(ticket, entry);
+      withGitea(ticket, (token) =>
+        publishRemote({ repo: workingRepo(dataRoot, business, project), fork, user, source, dst, token, tls: publishTls }).catch((e) => {
+          throw e instanceof WorkingError ? new BusError(e.code) : e;
+        }),
+      ).then(
+        (r) => Object.assign(entry, { state: 'pushed', ...r }),
+        (e) => {
+          // Not a refusal: the error's name and code only, never a message that could carry git's output.
+          if (!(e instanceof BusError)) process.stderr.write(`bus: publish git-failed: ${JSON.stringify({ name: e?.name, code: e?.code })}\n`);
+          Object.assign(entry, { state: 'refused', code: e instanceof BusError ? e.code : 'git-failed' });
+        },
+      );
+      return { state: 'running' };
+    }
+    function publishResult(ticket) {
+      const entry = remotes.get(ticket);
+      if (!entry) throw new BusError('publish-unknown');
+      if (entry.state !== 'running') remotes.delete(ticket);
+      return { ...entry };
+    }
    // Metadata only (service, date, state); the token stays in Credentials.
    function credentialStatus(business, role) {
      return credentials
@@ -237,6 +286,12 @@ export async function startBroker({
      checkLand,
      recordLand: (ticket, land) => broker.recordLand(ticket, land),
      landRefused: (ticket, args) => broker.landRefused(ticket, args),
+      checkPublish,
+      withGitea,
+      publishPush,
+      publishResult,
+      recordPublish: (ticket, pushed) => broker.recordPublish(ticket, pushed),
+      publishRefused: (ticket, args) => broker.publishRefused(ticket, args),
      landHeld: (record) => broker.landHeld(record),
      // Row 156 (#1651): the launcher's landing pass.
      landHolders: (business) => broker.landHolders(business),
@@ -0,0 +1,182 @@
+// Row 199 (#1697, design D1, D3a, D4, section 6, T1 and T5): the per-agent credential store under
+// <configDir>/secrets/agents/<business>/<agent>/<service>. Fake tokens in a scratch root only.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Credentials } from '../src/credentials.mjs';
+
+const TOKEN = 'fake_store_token_0123456789';
+const ROTATED = 'fake_rotated_token_9876543210';
+const AGENT = { business: 'acme', role: 'coder' };
+
+function setup(t) {
+  const root = mkdtempSync(join(tmpdir(), 'bus-store-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const storeRoot = join(root, 'secrets', 'agents');
+  mkdirSync(storeRoot, { recursive: true, mode: 0o700 });
+  chmodSync(join(root, 'secrets'), 0o700);
+  const file = join(storeRoot, 'acme', 'coder', 'gitea');
+  const references = { 'acme/coder': { gitea: { service: 'gitea', store: true, file, rotateBy: '2099-01-01' } } };
+  const open = (extra = {}) => new Credentials({ references, storeRoot, repoRoots: [], dataRoot: '/nonexistent-data', ...extra });
+  const state = (c) => c.status().find((e) => e.instance === 'acme/coder' && e.service === 'gitea').state;
+  const read = (c, session = AGENT) => c.useFor(session, 'gitea', async (token) => ({ same: token === TOKEN, rotated: token === ROTATED }));
+  return { root, storeRoot, file, references, open, state, read };
+}
+
+test('T1: a store reference with no file yet starts, and the agent is not-issued until issue', async (t) => {
+  const s = setup(t);
+  const c = s.open();
+  assert.equal(s.state(c), 'not-issued');
+  await assert.rejects(s.read(c), /credential-unavailable/);
+  const status = c.issue('acme/coder', 'gitea', TOKEN, '2099-01-01');
+  assert.equal(status.state, 'valid');
+  assert.deepEqual(await s.read(c), { same: true, rotated: false });
+  assert.equal(statSync(s.file).mode & 0o777, 0o600);
+  for (const dir of [join(s.storeRoot, 'acme'), join(s.storeRoot, 'acme', 'coder')]) assert.equal(statSync(dir).mode & 0o777, 0o700);
+  assert.deepEqual(readdirSync(join(s.storeRoot, 'acme', 'coder')), ['gitea']);
+  // A restart reads the issued file.
+  assert.deepEqual(await s.read(s.open()), { same: true, rotated: false });
+});
+
+test('T1: a store path the reference does not own, or no store root, refuses the reference', (t) => {
+  const s = setup(t);
+  const other = join(s.storeRoot, 'acme', 'pm', 'gitea');
+  assert.throws(() => s.open({ references: { 'acme/coder': { gitea: { store: true, file: other, rotateBy: '2099-01-01' } } } }), /credential-reference/);
+  assert.throws(() => new Credentials({ references: s.references, repoRoots: [], dataRoot: '/nonexistent-data' }), /credential-reference/);
+  assert.throws(() => s.open({ references: { 'acme/@tester': { gitea: { store: true, file: join(s.storeRoot, 'acme', '@tester', 'gitea'), rotateBy: '2099-01-01' } } } }),
+    /credential-reference/);
+});
+
+test('T1: a wrong mode on the store root, a business dir, an agent dir or the file refuses start', (t) => {
+  const s = setup(t);
+  s.open().issue('acme/coder', 'gitea', TOKEN, '2099-01-01');
+  for (const [path, bad, good] of [
+    [s.storeRoot, 0o750, 0o700],
+    [join(s.storeRoot, 'acme'), 0o705, 0o700],
+    [join(s.storeRoot, 'acme', 'coder'), 0o770, 0o700],
+    [s.file, 0o640, 0o600],
+  ]) {
+    chmodSync(path, bad);
+    assert.throws(() => s.open(), /credential-file/, path);
+    chmodSync(path, good);
+  }
+  s.open();
+});
+
+test('T1: a missing store root refuses start; a missing {file} reference still refuses start', (t) => {
+  const s = setup(t);
+  rmSync(s.storeRoot, { recursive: true });
+  assert.throws(() => s.open(), /credential-file/);
+  assert.throws(() => s.open({ references: { coder: { gitea: { file: join(s.root, 'absent'), rotateBy: '2099-01-01' } } } }), /credential-file/);
+});
+
+test('T1: a store file that is a directory or a symlink refuses start', (t) => {
+  const s = setup(t);
+  mkdirSync(join(s.storeRoot, 'acme', 'coder'), { recursive: true, mode: 0o700 });
+  chmodSync(join(s.storeRoot, 'acme'), 0o700);
+  mkdirSync(s.file, { mode: 0o700 });
+  assert.throws(() => s.open(), /credential-file/);
+  rmSync(s.file, { recursive: true });
+  const target = join(s.root, 'target');
+  writeFileSync(target, TOKEN + '\n', { mode: 0o600 });
+  symlinkSync(target, s.file);
+  assert.throws(() => s.open(), /credential-file/);
+});
+
+test('T2: useFor keys from the session only', async (t) => {
+  const s = setup(t);
+  const c = s.open();
+  c.issue('acme/coder', 'gitea', TOKEN, '2099-01-01');
+  await assert.rejects(s.read(c, { business: 'acme', role: 'pm' }), /credential-unavailable/);
+  await assert.rejects(s.read(c, { business: 'acme', role: '@tester' }), /credential-not-yours/);
+  await assert.rejects(s.read(c, null), /credential-not-yours/);
+  await assert.rejects(s.read(c, { business: 'acme' }), /credential-not-yours/);
+});
+
+test('T5: issue, rotate, revoke and delete are live with no restart, and revoke holds across one', async (t) => {
+  const s = setup(t);
+  const c = s.open();
+  let committed = 0;
+  c.issue('acme/coder', 'gitea', TOKEN, '2099-01-01', () => committed++);
+  assert.equal(committed, 1);
+  // Rotate is a second issue: the new token is used at once, with no tmp file left.
+  c.issue('acme/coder', 'gitea', ROTATED + '\n', '2099-06-01');
+  assert.deepEqual(await s.read(c), { same: false, rotated: true });
+  assert.equal(c.status()[0].date, '2099-06-01');
+  assert.deepEqual(readdirSync(join(s.storeRoot, 'acme', 'coder')), ['gitea']);
+  // Revoke: memory first, then the file.
+  assert.deepEqual(c.revoke('acme/coder', 'gitea'), { file: true });
+  assert.equal(s.state(c), 'revoked');
+  assert.equal(existsSync(s.file), false);
+  await assert.rejects(s.read(c), /credential-unavailable/);
+  const restarted = s.open();
+  await assert.rejects(s.read(restarted), /credential-unavailable/);
+  assert.equal(s.state(restarted), 'not-issued');
+  // Delete removes the agent's dir.
+  c.issue('acme/coder', 'gitea', TOKEN, '2099-01-01');
+  assert.deepEqual(c.remove('acme/coder'), { services: ['gitea'] });
+  assert.equal(existsSync(join(s.storeRoot, 'acme', 'coder')), false);
+  await assert.rejects(s.read(c), /credential-unavailable/);
+});
+
+test('T5: a failed commit leaves the token on disk but not in memory, and a bad token or date writes nothing', async (t) => {
+  const s = setup(t);
+  const c = s.open();
+  assert.throws(() => c.issue('acme/coder', 'gitea', 'short', '2099-01-01'), /credential-format/);
+  assert.throws(() => c.issue('acme/coder', 'gitea', TOKEN, '2099-13-01'), /credential-date/);
+  assert.throws(() => c.issue('acme/pm', 'gitea', TOKEN, '2099-01-01'), /credential-unknown/);
+  assert.equal(existsSync(s.file), false);
+  assert.throws(() => c.issue('acme/coder', 'gitea', TOKEN, '2099-01-01', () => { throw new Error('commit failed'); }), /commit failed/);
+  assert.equal(existsSync(s.file), true);
+  assert.equal(s.state(c), 'not-issued');
+  await assert.rejects(s.read(c), /credential-unavailable/);
+});
+
+test('T5: revoke of a {file} reference forgets the token and never unlinks the file', async (t) => {
+  const s = setup(t);
+  const path = join(s.root, 'outside-token');
+  writeFileSync(path, TOKEN + '\n', { mode: 0o600 });
+  const c = s.open({ references: { 'acme/coder': { gitea: { file: path, rotateBy: '2099-01-01' } } } });
+  assert.deepEqual(await s.read(c), { same: true, rotated: false });
+  assert.deepEqual(c.revoke('acme/coder', 'gitea'), { file: false });
+  assert.equal(existsSync(path), true);
+  await assert.rejects(s.read(c), /credential-unavailable/);
+});
+
+test('T5: delete refuses an agent dir holding anything but tokens', (t) => {
+  const s = setup(t);
+  const c = s.open();
+  c.issue('acme/coder', 'gitea', TOKEN, '2099-01-01');
+  writeFileSync(join(s.storeRoot, 'acme', 'coder', 'notes'), 'x', { mode: 0o600 });
+  assert.throws(() => c.remove('acme/coder'), /credential-file/);
+  assert.equal(existsSync(join(s.storeRoot, 'acme', 'coder', 'notes')), true);
+});
+
+// Design D5: the name-keyed use() is the host's own, for @sync and the tracker's start check of each
+// role's token. Every other credential use goes through useFor, keyed from the broker's session. A
+// new use( call site outside this list fails here.
+test('D5: every credentials use( call site is on the allowlist', () => {
+  const packages = new URL('../../', import.meta.url);
+  const allowed = new Map([
+    ['bus/src/credentials.mjs', 1], // useFor's own call
+    ['tasks/src/adapter.mjs', 1], // the host's use(instance) for @sync and probe
+  ]);
+  const found = new Map();
+  const walk = (dir, rel) => {
+    for (const name of readdirSync(dir)) {
+      if (name === 'node_modules' || name === 'tests') continue;
+      const path = join(dir, name);
+      if (statSync(path).isDirectory()) walk(path, `${rel}${name}/`);
+      else if (name.endsWith('.mjs') || name.endsWith('.js')) {
+        const code = readFileSync(path, 'utf8').split('\n').filter((line) => !/^\s*\/\//.test(line)).join('\n');
+        const n = (code.match(/(?:credentials|this)\.use\(/g) ?? []).length;
+        if (n) found.set(`${rel}${name}`, n);
+      }
+    }
+  };
+  for (const pkg of readdirSync(packages)) if (statSync(new URL(`${pkg}/src`, packages), { throwIfNoEntry: false })?.isDirectory())
+    walk(new URL(`${pkg}/src`, packages).pathname, `${pkg}/src/`);
+  assert.deepEqual(Object.fromEntries([...found].sort()), Object.fromEntries([...allowed].sort()));
+});
@@ -0,0 +1,163 @@
+// Row 199 (#1697, design section 6, T4, T5): credentials.issue, credentials.revoke and
+// credentials.delete through the runtime. Human-only; the tester revokes and never issues. Each verb
+// is live with no restart and leaves one receipt in changes.jsonl with no value in it. Fake tokens in a
+// scratch root only.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, statSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { startBroker } from '../src/runtime.mjs';
+import { Broker, CREDENTIAL_VERBS } from '../src/broker.mjs';
+import { Store } from '../src/store.mjs';
+import { businessDoc, rolesCopy, systemFor, writeJson } from '../../business/tests/helpers.mjs';
+
+const TOKEN = 'fake_issued_token_0123456789';
+const ROTATED = 'fake_rotated_token_9876543210';
+const OTHER = 'fake_other_token_5555555555';
+const DATE = '2099-01-01';
+const role = { authority: { withinRole: ['message.send'], crossRole: [] } };
+
+async function setup(t) {
+  const root = mkdtempSync(join(tmpdir(), 'bus-cred-verbs-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const rolesDir = rolesCopy(root);
+  const doc = { ...businessDoc(root, 'demo'), plugins: { harness: ['pi'] } };
+  doc.roles.coder.credentials.gitea = { store: true, rotateBy: DATE };
+  writeJson(join(root, 'businesses/demo.json'), doc);
+  mkdirSync(join(root, 'data'), { mode: 0o700 });
+  mkdirSync(join(root, 'secrets', 'agents'), { mode: 0o700 });
+  const store = (agent, service) => join(root, 'secrets', 'agents', 'demo', agent, service);
+  // The bus's resolved business carries the same references; a store one names its derived file.
+  const demo = {
+    id: 'demo', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' }, vars: { 'bus.tester': true },
+    roles: {
+      coder: { ...role, credentials: { gitea: { store: true, file: store('coder', 'gitea'), rotateBy: DATE }, vikunja: doc.roles.coder.credentials.vikunja } },
+      reviewer: { ...role, credentials: doc.roles.reviewer.credentials },
+    },
+  };
+  const bus = await startBroker({ dataRoot: join(root, 'data'), businesses: { demo }, organization: { dir: root, rolesDir, system: systemFor(root) } });
+  t.after(() => bus.close());
+  const human = bus.broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+  const tester = bus.broker.bindTester({ business: 'demo' });
+  const ask = (cap, verb, args) => bus.broker.request(cap, { verb, args });
+  const file = () => JSON.parse(readFileSync(join(root, 'businesses/demo.json'), 'utf8'));
+  const receipts = () => {
+    const log = join(root, 'businesses/.history/demo/changes.jsonl');
+    return existsSync(log) ? readFileSync(log, 'utf8').trim().split('\n').map(JSON.parse) : [];
+  };
+  const committed = () => receipts().filter((r) => r.state === 'committed');
+  const status = (agent) => Object.fromEntries(bus.credentialStatus('demo', agent).map((e) => [e.service, e.state]));
+  return { root, bus, human, tester, ask, file, receipts, committed, status, store };
+}
+
+test('row 199: the lifecycle verbs refuse every session but the human, and the tester revokes only', (t) => {
+  const root = mkdtempSync(join(tmpdir(), 'bus-cred-gate-'));
+  const s = new Store(root);
+  t.after(() => { s.close(); rmSync(root, { recursive: true, force: true }); });
+  const calls = [];
+  const b = new Broker({
+    store: s,
+    businesses: { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' }, vars: { 'bus.tester': true }, roles: { coder: role } } },
+    credentialVerbs: (id, verb, args, actor) => (calls.push([verb, actor]), { ok: true }),
+  });
+  const human = b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+  const tester = b.bindTester({ business: 'demo' });
+  const reader = b.bindReader({ business: 'demo' });
+  const coder = b.bindLaunch({ business: 'demo', role: 'coder', run: 'coder-run', harness: 'pi' });
+  const args = {
+    'credentials.issue': { agent: 'coder', service: 'gitea', token: TOKEN, date: DATE },
+    'credentials.revoke': { agent: 'coder', reason: 'fired' },
+    'credentials.delete': { agent: 'coder', reason: 'fired' },
+  };
+  assert.deepEqual(CREDENTIAL_VERBS, Object.keys(args));
+  for (const verb of CREDENTIAL_VERBS) {
+    assert.throws(() => b.request(reader, { verb, args: args[verb] }), /human-required/, verb);
+    assert.throws(() => b.request(coder, { verb, args: args[verb] }), /human-required/, verb);
+  }
+  assert.throws(() => b.request(tester, { verb: 'credentials.issue', args: args['credentials.issue'] }), /tester-refused/);
+  assert.throws(() => b.request(tester, { verb: 'credentials.delete', args: args['credentials.delete'] }), /tester-refused/);
+  // Keys: a token on revoke, a missing reason, an unknown service, an unknown agent, an @ agent.
+  assert.throws(() => b.request(human, { verb: 'credentials.revoke', args: { ...args['credentials.revoke'], token: TOKEN } }), /invalid-request/);
+  assert.throws(() => b.request(human, { verb: 'credentials.revoke', args: { agent: 'coder' } }), /invalid-request/);
+  assert.throws(() => b.request(human, { verb: 'credentials.issue', args: { ...args['credentials.issue'], service: 'model' } }), /invalid-request/);
+  assert.throws(() => b.request(human, { verb: 'credentials.issue', args: { ...args['credentials.issue'], file: '/x' } }), /invalid-request/);
+  assert.throws(() => b.request(human, { verb: 'credentials.issue', args: { ...args['credentials.issue'], agent: 'pm' } }), /credential-unknown/);
+  assert.throws(() => b.request(human, { verb: 'credentials.revoke', args: { agent: '@sync', reason: 'x' } }), /credential-unknown/);
+  assert.equal(calls.length, 0);
+  // A refusal records its code alone, never the token.
+  const refused = s.all("SELECT body FROM events WHERE kind='action.refused'");
+  assert.ok(refused.length >= 10);
+  for (const { body } of refused) assert.equal(body.includes(TOKEN), false);
+  // delete waits for the agent's claim to end.
+  b.request(coder, { verb: 'role.claim' });
+  assert.throws(() => b.request(human, { verb: 'credentials.delete', args: args['credentials.delete'] }), /agent-running/);
+  b.request(coder, { verb: 'role.release' });
+  for (const verb of CREDENTIAL_VERBS) b.request(human, { verb, args: args[verb] });
+  b.request(tester, { verb: 'credentials.revoke', args: args['credentials.revoke'] });
+  assert.deepEqual(calls, [['credentials.issue', 'jason'], ['credentials.revoke', 'jason'], ['credentials.delete', 'jason'], ['credentials.revoke', 'tester']]);
+  // No lifecycle without the runtime's store.
+  const bare = new Broker({ store: s, businesses: { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' }, roles: { coder: role } } } });
+  const h2 = bare.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+  assert.throws(() => bare.request(h2, { verb: 'credentials.revoke', args: args['credentials.revoke'] }), /not-configured/);
+});
+
+test('T5: issue, rotate, revoke and delete are live, rewrite the business file and leave one receipt each, with no value anywhere', async (t) => {
+  const c = await setup(t);
+  const coder = { business: 'demo', role: 'coder' };
+  const read = (service) => c.bus.credentials.useFor(coder, service, async (token) => token === TOKEN ? 'issued' : token === ROTATED ? 'rotated' : 'other');
+  assert.deepEqual(c.status('coder'), { gitea: 'not-issued', vikunja: 'valid' });
+  // issue: the file, then the business file's reference, then memory.
+  const issued = c.ask(c.human, 'credentials.issue', { agent: 'coder', service: 'gitea', token: TOKEN + '\n', date: DATE });
+  assert.deepEqual(issued, { agent: 'coder', verb: 'issue', service: 'gitea', date: DATE, state: 'valid' });
+  assert.equal(await read('gitea'), 'issued');
+  assert.equal(statSync(c.store('coder', 'gitea')).mode & 0o777, 0o600);
+  assert.deepEqual(c.file().roles.coder.credentials.gitea, { store: true, rotateBy: DATE });
+  let last = c.committed().at(-1);
+  assert.equal(last.actor, 'jason');
+  assert.deepEqual(last.detail, { verb: 'issue', agent: 'coder', kind: ['gitea'], date: DATE });
+  // The same token again is one the bus holds: the secret check refuses it before any write.
+  const count = c.receipts().length;
+  assert.throws(() => c.ask(c.human, 'credentials.issue', { agent: 'coder', service: 'gitea', token: TOKEN, date: DATE }), /credential-leak/);
+  assert.throws(() => c.ask(c.human, 'credentials.issue', { agent: 'coder', service: 'gitea', token: 'short', date: DATE }), /credential-format/);
+  assert.throws(() => c.ask(c.human, 'credentials.issue', { agent: 'coder', service: 'gitea', token: OTHER, date: '2099-02-30' }), /credential-date/);
+  assert.equal(c.receipts().length, count);
+  // rotate: an issue over an issued entry, used at once.
+  const rotated = c.ask(c.human, 'credentials.issue', { agent: 'coder', service: 'gitea', token: ROTATED, date: '2099-06-01' });
+  assert.equal(rotated.verb, 'rotate');
+  assert.equal(await read('gitea'), 'rotated');
+  assert.deepEqual(c.file().roles.coder.credentials.gitea, { store: true, rotateBy: '2099-06-01' });
+  assert.deepEqual(c.committed().at(-1).detail, { verb: 'rotate', agent: 'coder', kind: ['gitea'], date: '2099-06-01' });
+  // revoke of a store entry by the tester: memory and file, no document change, a receipt.
+  const bytes = readFileSync(join(c.root, 'businesses/demo.json'), 'utf8');
+  const revoked = c.ask(c.tester, 'credentials.revoke', { agent: 'coder', service: 'gitea', reason: 'test' });
+  assert.deepEqual(revoked, { agent: 'coder', verb: 'revoke', services: [{ service: 'gitea', state: 'revoked' }] });
+  await assert.rejects(read('gitea'), /credential-unavailable/);
+  assert.equal(existsSync(c.store('coder', 'gitea')), false);
+  assert.equal(readFileSync(join(c.root, 'businesses/demo.json'), 'utf8'), bytes);
+  last = c.committed().at(-1);
+  assert.equal(last.actor, 'tester');
+  assert.deepEqual(last.changes, []);
+  assert.deepEqual(last.detail, { verb: 'revoke', agent: 'coder', kind: ['gitea'], reason: 'test' });
+  // revoke of a {file} reference: memory, the outside file kept, the reference becomes store.
+  const outside = c.file().roles.coder.credentials.vikunja.file;
+  c.ask(c.human, 'credentials.revoke', { agent: 'coder', service: 'vikunja', reason: 'moved' });
+  await assert.rejects(read('vikunja'), /credential-unavailable/);
+  assert.equal(existsSync(outside), true);
+  assert.deepEqual(c.file().roles.coder.credentials.vikunja, { store: true, expires: DATE });
+  assert.ok(c.committed().at(-1).changes.some((e) => e.path === 'roles.coder.credentials.vikunja.store' && e.new === true));
+  // delete: every kind revoked, the agent's dir gone, both references store.
+  c.ask(c.human, 'credentials.issue', { agent: 'reviewer', service: 'gitea', token: OTHER, date: DATE });
+  assert.equal(existsSync(c.store('reviewer', 'gitea')), true);
+  const deleted = c.ask(c.human, 'credentials.delete', { agent: 'reviewer', reason: 'fired' });
+  assert.deepEqual(deleted.services.map((e) => e.state), ['revoked', 'revoked']);
+  assert.equal(existsSync(join(c.root, 'secrets', 'agents', 'demo', 'reviewer')), false);
+  assert.deepEqual(c.file().roles.reviewer.credentials, { gitea: { store: true, rotateBy: DATE }, vikunja: { store: true, expires: DATE } });
+  assert.deepEqual(c.committed().at(-1).detail, { verb: 'delete', agent: 'reviewer', kind: ['gitea', 'vikunja'], reason: 'fired' });
+  // The status read never carries a value.
+  assert.deepEqual(c.ask(c.human, 'credentials', {}).map((e) => e.state).sort(), ['revoked', 'revoked', 'revoked', 'revoked']);
+  // T4: no token in any file under the root (receipts, business file, events, logs).
+  const walk = (dir) => readdirSync(dir, { withFileTypes: true }).flatMap((e) => e.isDirectory() ? walk(join(dir, e.name)) : e.isFile() ? [join(dir, e.name)] : []);
+  for (const path of walk(c.root))
+    for (const token of [TOKEN, ROTATED, OTHER]) assert.equal(readFileSync(path).includes(token), false, path);
+});
@@ -10,7 +10,7 @@ import { fixture } from './spec-fixtures.mjs';

 // PRD 1.5 REQ-WAIT-1, REQ-WAIT-2 and REQ-DEC-2 (row 139, #1633).
 const WAITS = ['spend', 'data.delete', 'network.expose', 'account.create', 'credential.mint', 'message.external',
-  'git.push.protected', 'deploy'];
+  'git.push.protected', 'git.push.remote', 'deploy'];
 const LEFT = ['git.merge.protected', 'policy.change', 'prd.approve', 'role.revoke'];
 const cite = f => ({ project: 'stack', spec_path: 'spec/north-star.md', spec_commit: f.commit });
 const routed = (f, d) => ({ ...f.store.get('SELECT class, route_to FROM decisions WHERE id=?', d.id) });
@@ -36,10 +36,14 @@ test('REQ-WAIT-2: a business granting a hard wait at either class is refused; th
 });

 test('REQ-DEC-2: every hard wait goes to the human, cited or not, and the arbiter cannot resolve it', async t => {
-  const f = await fixture(t);
+  const f = await fixture(t, { roles: { coder: { definition: 'coder',
+    authority: { withinRole: ['message.send', 'record.write', 'git.push.working'], crossRole: [] } } } });
+  // Row 199: a git.push.remote raise binds the task's latest push, so the task has one.
+  f.broker.recordPush(f.coder, { task_ref: 'vikunja:1/2', project: 'stack', branch: 'feat', ref: 'work/vikunja-stack-2',
+    commit: 'a'.repeat(40), previous: null });
  for (const action of WAITS) {
    for (const args of [{}, cite(f), { ...cite(f), domain: 'technical' }]) {
-      const d = await f.raise({ action, ...args });
+      const d = await f.raise({ action, ...(action === 'git.push.remote' ? { target: 'vikunja:1/2' } : {}), ...args });
      assert.deepEqual(routed(f, d), { class: 'gated', route_to: 'human' }, `${action} ${JSON.stringify(args)}`);
    }
  }
@@ -22,8 +22,8 @@ test('Broker keeps the sandbox client import closure: only the listed imports, n
    "import { MERGE, LandingRefusal, readLanding } from './landing.mjs';",
    // Row 141 (#1635): the business ID_PATTERN for instance names. The vocabulary is already in
    // RUNNER_FILES and imports nothing. Row 155 (#1649) reads THREAD_DEFINITION and END_PROTECTED
-    // from it too.
-    "import { ID_PATTERN, THREAD_DEFINITION, END_PROTECTED } from '../../business/src/vocabulary.mjs';",
+    // from it too. Row 199 (#1697) reads the D9c fork parse, forkProblem and forkUrl, from it.
+    "import { ID_PATTERN, THREAD_DEFINITION, END_PROTECTED, forkProblem, forkUrl } from '../../business/src/vocabulary.mjs';",
  ]);
  assert.doesNotMatch(source, /\bimport\s*\(/);
  assert.doesNotMatch(readFileSync(new URL('../src/landing.mjs', import.meta.url), 'utf8'), /\bimport\b/);
@@ -0,0 +1,274 @@
+// Row 199 (#1697, design D9 steps 1 to 3 and 6, D9b): the broker side of publish. git.push.remote
+// is a hard wait; its decision binds the task's latest push (pushCommit). checkPublish builds the
+// agent's fork from the project's upstream and the agent's own Gitea user; recordPublish spends the
+// decision; publishRefused files the refusal.
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { fork } from 'node:child_process';
+import { once } from 'node:events';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Store } from '../src/store.mjs';
+import { Broker } from '../src/broker.mjs';
+
+const TASK = 'vikunja:1/2';
+const A = 'a'.repeat(40);
+const B = 'b'.repeat(40);
+const C = 'c'.repeat(40);
+const identity = (user) => ({ name: user, email: `${user}@example.com`, gitea: { url: 'https://git.example', user } });
+const pusher = { withinRole: ['git.push.working', 'message.send'], crossRole: [] };
+function businesses(upstream = 'https://git.example/mosaic/stack') {
+  return {
+    demo: {
+      id: 'demo',
+      human: 'jason',
+      arbiters: { technical: 'reviewer', delivery: 'reviewer' },
+      projects: { stack: { root: '/nonexistent', remote: upstream }, books: { root: '/nonexistent-books' } },
+      roles: {
+        coder: { authority: pusher, identity: identity('acme-coder'), publish: ['stack'] },
+        second: { authority: pusher, identity: identity('acme-second'), publish: ['stack'] },
+        plain: { authority: pusher },
+        reviewer: { authority: { withinRole: ['message.send'], crossRole: [] } },
+      },
+    },
+  };
+}
+
+function setup(t, upstream) {
+  const root = mkdtempSync(join(tmpdir(), 'bus-publish-'));
+  const store = new Store(root);
+  const b = new Broker({ store, businesses: businesses(upstream) });
+  t.after(() => {
+    store.close();
+    rmSync(root, { recursive: true, force: true });
+  });
+  const caps = {};
+  for (const role of ['coder', 'second', 'plain', 'reviewer']) {
+    caps[role] = b.bindLaunch({ business: 'demo', role, run: `${role}-run`, harness: 'pi' });
+    b.request(caps[role], { verb: 'role.claim', args: {} });
+  }
+  const human = b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+  const call = (cap, verb, args) => b.request(cap, { verb, args });
+  const push = (commit, previous = null, role = 'coder', project = 'stack') => {
+    b.checkPush(caps[role], TASK);
+    return b.recordPush(caps[role], { task_ref: TASK, project, branch: 'feat', ref: 'work/vikunja-stack-2', commit, previous });
+  };
+  const raise = (role = 'coder') =>
+    call(caps[role], 'decision.raise', {
+      action: 'git.push.remote', target: TASK, task_ref: TASK, question: 'Publish?', blocking: false, recommendation: 'yes',
+      options: [{ key: 'yes', text: 'Yes' }, { key: 'no', text: 'No' }],
+    });
+  const approve = (role = 'coder') => {
+    const d = raise(role);
+    call(human, 'decision.resolve', { id: d.id, choice: 'yes' });
+    return d;
+  };
+  const publish = (decision, role = 'coder', extra = {}) =>
+    b.checkPublish(caps[role], { task_ref: TASK, project: 'stack', branch: 'feat', ...(decision ? { decision: decision.id } : {}), ...extra });
+  const events = (kind) => store.all('SELECT * FROM events WHERE kind=? ORDER BY seq', kind).map((e) => ({ ...e, body: JSON.parse(e.body) }));
+  return { b, store, caps, human, call, push, raise, approve, publish, events };
+}
+
+test('a raise with no recorded push refuses no-push; a raise binds the latest push and shows it', (t) => {
+  const f = setup(t);
+  assert.throws(() => f.raise(), /no-push/);
+  f.push(A);
+  const d = f.raise();
+  assert.match(d.question, new RegExp(`commit ${A}\\)$`));
+  const raised = f.events('action.allowed').find((e) => e.body.operation === 'decision.raise');
+  assert.equal(raised.body.pushCommit, A);
+  assert.deepEqual({ ...f.store.get('SELECT class, route_to FROM decisions WHERE id=?', d.id) }, { class: 'gated', route_to: 'human' });
+});
+
+test('happy path: the fork is the upstream repo under the agent\'s own user, the destination is host-built', (t) => {
+  const f = setup(t);
+  f.push(A);
+  const d = f.approve();
+  const r = f.publish(d);
+  assert.deepEqual({ ...r, ticket: typeof r.ticket }, {
+    ticket: 'string', task_ref: TASK, project: 'stack', fork: 'https://git.example/acme-coder/stack',
+    user: 'acme-coder', email: '[email protected]', source: A, dst: 'refs/heads/acme-coder/feat',
+  });
+  const done = f.b.recordPublish(r.ticket, { ref: r.dst, commit: A, previous: null });
+  assert.deepEqual(done, { task_ref: TASK, fork: r.fork, ref: r.dst, commit: A, previous: null });
+  const allowed = f.events('action.allowed').filter((e) => e.body.action === 'git.push.remote' && e.body.operation !== 'decision.raise');
+  assert.equal(allowed.length, 1);
+  assert.equal(allowed[0].subject, TASK);
+  assert.equal(allowed[0].body.decision, d.id);
+  assert.equal(allowed[0].body.fork, r.fork);
+  // Spent once.
+  assert.throws(() => f.publish(d), /decision-consumed/);
+  assert.throws(() => f.b.recordPublish(r.ticket, { ref: r.dst, commit: A, previous: null }), /publish-unknown/);
+});
+
+test('a hard wait: no decision refuses, and a decision for another task refuses', (t) => {
+  const f = setup(t);
+  f.push(A);
+  assert.throws(() => f.publish(null), /decision-required/);
+  const other = f.call(f.caps.coder, 'decision.raise', {
+    action: 'deploy', target: 'vikunja:1/3', question: 'Ship?', blocking: false, recommendation: 'yes',
+    options: [{ key: 'yes', text: 'Yes' }, { key: 'no', text: 'No' }],
+  });
+  f.call(f.human, 'decision.resolve', { id: other.id, choice: 'yes' });
+  assert.throws(() => f.publish(other), /decision-mismatch/);
+  const d = f.raise();
+  assert.throws(() => f.publish(d), /decision-not-approved/);
+});
+
+test('r4 B4: approve while the latest push is A, push B, publish refuses decision-mismatch', (t) => {
+  const f = setup(t);
+  f.push(A);
+  const d = f.approve();
+  f.push(B, A);
+  assert.throws(() => f.publish(d), /decision-mismatch/);
+  // And a push between checkPublish and recordPublish refuses the record.
+  const f2 = setup(t);
+  f2.push(A);
+  const d2 = f2.approve();
+  const r = f2.publish(d2);
+  f2.push(C, A);
+  assert.throws(() => f2.b.recordPublish(r.ticket, { ref: r.dst, commit: A, previous: null }), /decision-mismatch/);
+  assert.throws(() => f2.b.recordPublish(r.ticket, { ref: r.dst, commit: C, previous: null }), /decision-mismatch/);
+});
+
+test('grant and fork refusals', (t) => {
+  const f = setup(t);
+  f.push(A, null, 'plain');
+  // plain has no identity and no grant; its raise still binds the push, the publish refuses.
+  const d = f.approve('plain');
+  assert.throws(() => f.publish(d, 'plain'), /remote-not-granted/);
+  assert.throws(() => f.publish(d, 'plain', { project: 'books' }), /remote-not-granted|decision-mismatch/);
+  // work-not-yours: second publishes a push coder made.
+  const g = setup(t);
+  g.push(A);
+  const d2 = g.approve('second');
+  assert.throws(() => g.publish(d2, 'second'), /work-not-yours/);
+});
+
+test('remote-not-fork, compared without case, and remote-host-mismatch, at push', (t) => {
+  for (const [upstream, code] of [
+    ['https://git.example/acme-coder/stack', /remote-not-fork/],
+    ['https://git.example/ACME-Coder/stack', /remote-not-fork/],
+    ['https://other.example/mosaic/stack', /remote-host-mismatch/],
+    ['https://git.example:3000/mosaic/stack', /remote-host-mismatch/],
+  ]) {
+    const f = setup(t, upstream);
+    f.push(A);
+    const d = f.approve();
+    assert.throws(() => f.publish(d), code, upstream);
+  }
+});
+
+test('two agents granted one project each get their own fork', (t) => {
+  const f = setup(t);
+  f.push(A);
+  const r1 = f.publish(f.approve());
+  assert.equal(r1.fork, 'https://git.example/acme-coder/stack');
+  const g = setup(t);
+  g.push(A, null, 'second');
+  const r2 = g.publish(g.approve('second'), 'second');
+  assert.equal(r2.fork, 'https://git.example/acme-second/stack');
+  assert.equal(r2.dst, 'refs/heads/acme-second/feat');
+});
+
+test('the request cannot name the fork, the user or the destination', (t) => {
+  const f = setup(t);
+  f.push(A);
+  const d = f.approve();
+  for (const extra of [{ fork: 'https://git.example/x/stack' }, { dst: 'refs/heads/main' }, { user: 'x' }, { remote: 'https://x' }])
+    assert.throws(() => f.publish(d, 'coder', extra), /invalid-request/);
+});
+
+test('publishRefused files the code on the task\'s trail and drops the ticket', (t) => {
+  const f = setup(t);
+  f.push(A);
+  const r = f.publish(f.approve());
+  assert.equal(f.b.publishRefused(r.ticket, { code: 'remote-unrelated' }), 'remote-unrelated');
+  const refused = f.events('action.refused').filter((e) => e.subject === TASK);
+  assert.deepEqual(refused.at(-1).body, { code: 'remote-unrelated' });
+  assert.throws(() => f.b.publishRefused(r.ticket, { code: 'x' }), /publish-unknown/);
+});
+
+test('git.push.remote is in neither ROUTED list and no shipped role grants it', async () => {
+  const { ACTIONS, HARD_WAITS } = await import('../src/broker.mjs');
+  const vocabulary = await import('../../business/src/vocabulary.mjs');
+  assert.ok(ACTIONS.includes('git.push.remote') && HARD_WAITS.includes('git.push.remote'));
+  assert.ok(!vocabulary.ROUTED.includes('git.push.remote'));
+  const { readdirSync, readFileSync } = await import('node:fs');
+  const dir = new URL('../../../roles/', import.meta.url);
+  for (const name of readdirSync(dir).filter((n) => n.endsWith('.json')))
+    assert.ok(!readFileSync(new URL(name, dir), 'utf8').includes('git.push.remote'), name);
+});
+
+// D1 and D9b through the real startBroker: the store is <configDir>/secrets/agents, and the gitea
+// token is used only under an open publish ticket, keyed from the agent checkPublish checked.
+test('runtime: withGitea keys from the open ticket only, and the store root is the organization dir', async (t) => {
+  const { startBroker } = await import('../src/runtime.mjs');
+  const { businessDoc, rolesCopy, systemFor, writeJson } = await import('../../business/tests/helpers.mjs');
+  const { chmodSync, mkdirSync } = await import('node:fs');
+  const root = mkdtempSync(join(tmpdir(), 'bus-publish-rt-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const rolesDir = rolesCopy(root);
+  // The runtime reads the harness switch from the organization file as it stands.
+  writeJson(join(root, 'businesses/demo.json'), { ...businessDoc(root, 'demo'), plugins: { harness: ['pi'] } });
+  mkdirSync(join(root, 'data'), { mode: 0o700 });
+  mkdirSync(join(root, 'secrets', 'agents'), { recursive: true, mode: 0o700 });
+  chmodSync(join(root, 'secrets'), 0o700);
+  const demo = businesses().demo;
+  demo.roles.coder.credentials = { gitea: { store: true, file: join(root, 'secrets', 'agents', 'demo', 'coder', 'gitea'), rotateBy: '2099-01-01' } };
+  const organization = { dir: root, rolesDir, system: systemFor(root) };
+  // No organization, no store root: a store reference refuses the start.
+  await assert.rejects(startBroker({ dataRoot: join(root, 'data'), businesses: { demo } }), /credential-reference/);
+  const bus = await startBroker({ dataRoot: join(root, 'data'), businesses: { demo }, organization });
+  t.after(() => bus.close());
+  assert.deepEqual(bus.credentialStatus('demo', 'coder'), [{ service: 'gitea', date: '2099-01-01', state: 'not-issued' }]);
+  const coder = bus.broker.bindLaunch({ business: 'demo', role: 'coder', run: 'coder-run', harness: 'pi' });
+  const human = bus.broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
+  bus.broker.request(coder, { verb: 'role.claim', args: {} });
+  bus.checkPush(coder, TASK);
+  bus.recordPush(coder, { task_ref: TASK, project: 'stack', branch: 'feat', ref: 'work/vikunja-stack-2', commit: A, previous: null });
+  const d = bus.broker.request(coder, { verb: 'decision.raise', args: {
+    action: 'git.push.remote', target: TASK, task_ref: TASK, question: 'Publish?', blocking: false, recommendation: 'yes',
+    options: [{ key: 'yes', text: 'Yes' }, { key: 'no', text: 'No' }] } });
+  bus.broker.request(human, { verb: 'decision.resolve', args: { id: d.id, choice: 'yes' } });
+  assert.throws(() => bus.checkPublish(coder, { task_ref: TASK, project: 'stack', branch: 'feat' }), /decision-required/);
+  const ticket = bus.checkPublish(coder, { task_ref: TASK, project: 'stack', branch: 'feat', decision: d.id }).ticket;
+  await assert.rejects(bus.withGitea(ticket, async () => 1), /credential-unavailable/);
+  bus.credentials.issue('demo/coder', 'gitea', 'fake_publish_token_0123456789', '2099-01-01');
+  assert.equal(await bus.withGitea(ticket, async (token) => token === 'fake_publish_token_0123456789'), true);
+  await assert.rejects(bus.withGitea(ticket, async (token) => ({ echo: token })), /credential-leak/);
+  await assert.rejects(bus.withGitea('not-a-ticket', async () => 1), /publish-unknown/);
+  await assert.rejects(bus.withGitea(coder, async () => 1), /publish-unknown/);
+  bus.recordPublish(ticket, { ref: 'refs/heads/acme-coder/feat', commit: A, previous: null });
+  await assert.rejects(bus.withGitea(ticket, async () => 1), /publish-unknown/);
+});
+
+// Row 199 (D9b, deviation 11): the bus process answers the socket's five publish ops from their own
+// launchOp lines. A LAUNCH_OPS name without one would get launch-op-refused. A boot config that
+// carries publishTls still boots; process.mjs drops it before startBroker.
+test('the bus process answers the publish ops from their own lines, not launch-op-refused', async (t) => {
+  const root = mkdtempSync(join(tmpdir(), 'bus-publish-ops-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const child = fork(new URL('../src/process.mjs', import.meta.url), [], { stdio: ['ignore', 'ignore', 'ignore', 'ipc'] });
+  t.after(() => {
+    if (child.exitCode === null) child.kill('SIGKILL');
+  });
+  const ask = async (m) => {
+    const reply = once(child, 'message');
+    child.send(m);
+    return (await reply)[0];
+  };
+  const config = { dataRoot: root, businesses: businesses(), launches: [], readers: [], publishTls: ['-c', 'http.sslCAInfo=/nonexistent'] };
+  assert.equal((await ask({ op: 'boot', config })).ok, true);
+  const unknown = 'not-a-ticket';
+  assert.deepEqual(await ask({ op: 'publishPush', ticket: unknown, id: 1 }), { ok: false, error: 'publish-unknown', id: 1 });
+  assert.deepEqual(await ask({ op: 'publishResult', ticket: unknown, id: 2 }), { ok: false, error: 'publish-unknown', id: 2 });
+  assert.deepEqual(await ask({ op: 'recordPublish', ticket: unknown, pushed: { ref: 'refs/heads/x/y', commit: A, previous: null }, id: 3 }), { ok: false, error: 'publish-unknown', id: 3 });
+  assert.deepEqual(await ask({ op: 'publishRefused', ticket: unknown, args: { code: 'x' }, id: 4 }), { ok: false, error: 'publish-unknown', id: 4 });
+  assert.deepEqual(await ask({ op: 'checkPublish', cap: 'not-a-cap', args: { task_ref: TASK, project: 'stack', branch: 'feat' }, id: 5 }), { ok: false, error: 'unauthenticated', id: 5 });
+  const exit = once(child, 'exit');
+  child.send({ op: 'close' });
+  assert.equal((await exit)[0], 0);
+});
@@ -10,6 +10,7 @@ import { checkVars } from "./vars.mjs";
 import { parseCredentialRef } from "./credentials.mjs";
 import { loadRole } from "./role.mjs";
 import { checkPlugins } from "../../plugins/src/kinds.mjs";
+import { forkProblem, giteaName, parseGiteaUrl } from "./vocabulary.mjs";
 import {
  requireObject, rejectUnknownKeys, requireId, requirePositiveInt, requireString, requireDistinctList, readJsonFile, deepFreeze,
 } from "./util.mjs";
@@ -40,7 +41,7 @@ function checkBot(tracker, where) {
  return { bot: tracker.bot, botId: tracker.botId };
 }

-function checkCredentialMap(map, services, where) {
+function checkCredentialMap(map, services, where, store = null) {
  requireObject(map, where);
  const names = Object.keys(map).sort();
  const wanted = [...services].sort();
@@ -48,10 +49,37 @@ function checkCredentialMap(map, services, where) {
    refuse(`${where} must reference exactly the services its role definition needs (${wanted.join(", ") || "none"}; got ${names.join(", ") || "none"})`);
  }
  const out = {};
-  for (const service of names) out[service] = parseCredentialRef(map[service], service, `${where}.${service}`);
+  for (const service of names) out[service] = parseCredentialRef(map[service], service, `${where}.${service}`, { store });
  return out;
 }

+// Row 199 (#1697, design D8): the agent's own git identity. The email is the one its Gitea user
+// has, so Gitea links the commits to that user; gitea.url is the instance its pushes go to.
+const EMAIL = /^[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9.-]{1,190}\.[A-Za-z]{2,24}$/;
+const NAME = /^[^\0\n\r<>]{1,100}$/;
+
+// Row 199 (design D9c): the parse is vocabulary.mjs's, where the broker reads it; this wraps it with
+// the loader's refusals. Returns {url, owner, repo}.
+export function httpsUrl(value, where, { repo = false } = {}) {
+  const parsed = parseGiteaUrl(value, { repo });
+  if (parsed.problem === "form") refuse(`${where} must be a normalized https URL with no user, query or fragment`);
+  if (parsed.problem === "instance") refuse(`${where} must name the Gitea instance only, https://HOST[:PORT]`);
+  if (parsed.problem === "repository") refuse(`${where} must name a repository, https://HOST/OWNER/REPO`);
+  return parsed;
+}
+
+function checkIdentity(identity, where) {
+  requireObject(identity, where);
+  rejectUnknownKeys(identity, ["name", "email", "gitea"], where);
+  if (typeof identity.name !== "string" || !NAME.test(identity.name)) refuse(`${where}.name must be 1 to 100 characters with no <, > or line break`);
+  if (typeof identity.email !== "string" || !EMAIL.test(identity.email)) refuse(`${where}.email must be an email address`);
+  requireObject(identity.gitea, `${where}.gitea`);
+  rejectUnknownKeys(identity.gitea, ["url", "user"], `${where}.gitea`);
+  httpsUrl(identity.gitea.url, `${where}.gitea.url`);
+  if (!giteaName(identity.gitea.user)) refuse(`${where}.gitea.user must be a Gitea user name`);
+  return { name: identity.name, email: identity.email, gitea: { url: identity.gitea.url, user: identity.gitea.user } };
+}
+
 function checkTracker(tracker, file) {
  const where = `${file} tracker`;
  requireObject(tracker, where);
@@ -74,7 +102,7 @@ function checkTracker(tracker, file) {
  return { sync, labels };
 }

-function checkRoles(roles, file, rolesDir) {
+function checkRoles(roles, file, rolesDir, business) {
  const where = `${file} roles`;
  requireObject(roles, where);
  if (Object.keys(roles).length === 0) refuse(`${where} must declare at least one role instance`);
@@ -86,7 +114,7 @@ function checkRoles(roles, file, rolesDir) {
    requireId(instance, `${where} instance name`);
    const at = `${where}.${instance}`;
    requireObject(entry, at);
-    rejectUnknownKeys(entry, ["definition", "holder", "vars", "tracker", "credentials"], at);
+    rejectUnknownKeys(entry, ["definition", "holder", "vars", "tracker", "credentials", "identity", "publish"], at);
    requireId(entry.definition, `${at}.definition`);
    const definition = Object.hasOwn(definitions, entry.definition) ? definitions[entry.definition] : loadRole(rolesDir, entry.definition);
    definitions[entry.definition] = definition;
@@ -108,8 +136,18 @@ function checkRoles(roles, file, rolesDir) {
      holder: entry.holder === undefined ? null : requireId(entry.holder, `${at}.holder`),
      vars: checkVars(entry.vars ?? {}, "agent", `${at}.vars`),
      tracker,
-      credentials: checkCredentialMap(entry.credentials ?? {}, services, `${at}.credentials`),
+      credentials: checkCredentialMap(entry.credentials ?? {}, services, `${at}.credentials`,
+        { configDir: dirname(dirname(file)), business, agent: instance }),
    };
+    // Row 199 (#1697, design D8, D9 step 2): identity and publish are optional, so today's files
+    // load unchanged. publish needs both an identity and a gitea credential; the project ids it
+    // names are checked against projects once those are read.
+    if (entry.identity !== undefined) out[instance].identity = checkIdentity(entry.identity, `${at}.identity`);
+    if (entry.publish !== undefined) {
+      // N10: one message for both, naming the grant.
+      if (!out[instance].identity || !services.includes("gitea")) refuse(`${at}.publish needs identity and a gitea definition`);
+      out[instance].publish = requireDistinctList(entry.publish, `${at}.publish`, (p) => requireId(p, `${at}.publish entry`), { nonEmpty: true });
+    }
  }
  return { roles: out, definitions };
 }
@@ -159,7 +197,7 @@ export function validateBusinessDocument(document, file, { rolesDir }) {
  }
  const human = requireId(document.human, "business human");
  const vars = checkVars(document.vars ?? {}, "business", `${file} vars`);
-  const { roles, definitions } = checkRoles(document.roles, file, rolesDir);
+  const { roles, definitions } = checkRoles(document.roles, file, rolesDir, document.id);

  requireObject(document.arbiters, `${file} arbiters`);
  rejectUnknownKeys(document.arbiters, ["delivery", "technical"], `${file} arbiters`);
@@ -183,7 +221,7 @@ export function validateBusinessDocument(document, file, { rolesDir }) {
  for (const [id, entry] of Object.entries(document.projects)) {
    requireId(id, `${file} project id`);
    requireObject(entry, `${file} projects.${id}`);
-    rejectUnknownKeys(entry, ["root", "repo"], `${file} projects.${id}`);
+    rejectUnknownKeys(entry, ["root", "repo", "remote"], `${file} projects.${id}`);
    if (typeof entry.root !== "string" || !isAbsolute(entry.root) || normalize(entry.root) !== entry.root || entry.root.includes("\0")) {
      refuse(`${file} projects.${id}.root must be a normalized absolute path`);
    }
@@ -191,7 +229,18 @@ export function validateBusinessDocument(document, file, { rolesDir }) {
        normalize(entry.repo) !== entry.repo || entry.repo.includes("\0"))) {
      refuse(`${file} projects.${id}.repo must be a normalized absolute path`);
    }
-    projects[id] = { root: entry.root, ...(Object.hasOwn(entry, "repo") ? { repo: entry.repo } : {}) };
+    // Row 199 (#1697, design D9 step 2): the upstream; a granted agent's work goes to its fork.
+    if (Object.hasOwn(entry, "remote")) httpsUrl(entry.remote, `${file} projects.${id}.remote`, { repo: true });
+    projects[id] = { root: entry.root, ...(Object.hasOwn(entry, "repo") ? { repo: entry.repo } : {}),
+      ...(Object.hasOwn(entry, "remote") ? { remote: entry.remote } : {}) };
+  }
+  for (const [instance, role] of Object.entries(roles)) {
+    for (const project of role.publish ?? []) {
+      if (!Object.hasOwn(projects, project)) refuse(`${file} roles.${instance}.publish names ${project}, which the business file doesn't declare`);
+      if (!projects[project].remote) refuse(`${file} roles.${instance}.publish names ${project}, which has no "remote"`);
+      const problem = forkProblem(projects[project].remote, role.identity);
+      if (problem) refuse(`${file} roles.${instance}.publish names ${project}: ${problem}`);
+    }
  }

  const tracker = checkTracker(document.tracker, file);
@@ -3,7 +3,7 @@
 // lstat and realpath only; nothing in this package opens a token file.

 import { lstatSync, realpathSync } from "node:fs";
-import { isAbsolute, normalize, relative, sep } from "node:path";
+import { isAbsolute, join, normalize, relative, sep } from "node:path";
 import { refuse } from "./errors.mjs";
 import { SERVICES } from "./vocabulary.mjs";
 import { requireObject, rejectUnknownKeys, requireDate } from "./util.mjs";
@@ -14,21 +14,35 @@ const WARN_DAYS = 7;
 const DAY_MS = 24 * 60 * 60 * 1000;

 // Shape check for one reference. Returns a frozen { service, file | env,
-// rotateBy | expires }.
-export function parseCredentialRef(ref, service, where) {
+// rotateBy | expires }. Row 199 (#1697, design D1 and D2): `store` is the
+// file at <configDir>/secrets/agents/<business>/<agent>/<service>, derived
+// here and never written, so an entry can't name another agent's file. A
+// reference with no agent (the tracker's sync bot) passes store = null and
+// can't use the form. A `file` reference into the agents' store must be the
+// agent's own path (`credential-not-yours`).
+export function parseCredentialRef(ref, service, where, { store = null } = {}) {
  if (!SERVICES.includes(service)) refuse(`${where}: unknown credential service ${JSON.stringify(service)}`);
  requireObject(ref, where);
  const dateKey = DATE_KEY[service];
-  rejectUnknownKeys(ref, ["file", "env", dateKey], where);
+  rejectUnknownKeys(ref, ["file", "env", "store", dateKey], where);
  const hasFile = ref.file !== undefined;
  const hasEnv = ref.env !== undefined;
-  if (hasFile === hasEnv) refuse(`${where} must name exactly one of "file" or "env"`);
+  const hasStore = ref.store !== undefined;
+  if (Number(hasFile) + Number(hasEnv) + Number(hasStore) !== 1) refuse(`${where} must name exactly one of "file", "env" or "store"`);
  const out = { service };
-  if (hasFile) {
+  if (hasStore) {
+    if (ref.store !== true) refuse(`${where}.store must be true`);
+    if (!store) refuse(`${where}: a "store" reference needs an agent`);
+    out.store = true;
+    out.file = storePath(store, service);
+  } else if (hasFile) {
    if (typeof ref.file !== "string" || !isAbsolute(ref.file) || normalize(ref.file) !== ref.file || ref.file.includes("\0")) {
      refuse(`${where}.file must be a normalized absolute path`);
    }
    out.file = ref.file;
+    if (store && inside(join(store.configDir, "secrets", "agents"), ref.file) && ref.file !== storePath(store, service)) {
+      refuse(`${where}.file credential-not-yours: ${ref.file} is in the agents' store but not this agent's path`);
+    }
  } else {
    if (typeof ref.env !== "string" || !ENV_NAME.test(ref.env)) refuse(`${where}.env must match ${ENV_NAME}`);
    out.env = ref.env;
@@ -38,6 +52,11 @@ export function parseCredentialRef(ref, service, where) {
  return Object.freeze(out);
 }

+// The store path for one agent and service (design D1).
+export function storePath({ configDir, business, agent }, service) {
+  return join(configDir, "secrets", "agents", business, agent, service);
+}
+
 function inside(root, path) {
  const rel = relative(root, path);
  return rel === "" || (!rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel));
@@ -55,8 +74,10 @@ export function checkCredentialRef(ref, { forbiddenRoots = [], now = new Date(),
    let stat = null;
    try {
      stat = lstatSync(ref.file);
-    } catch {
-      problems.push(`${label}: not found`);
+    } catch (e) {
+      // Row 199 (design D3a): a store reference with no file is an agent not issued yet.
+      if (ref.store && e.code === "ENOENT") warnings.push(`${label}: not issued`);
+      else problems.push(`${label}: not found`);
    }
    if (stat) {
      if (stat.isSymbolicLink() || !stat.isFile()) problems.push(`${label}: must be a regular file, not a symbolic link`);
@@ -174,7 +174,9 @@ export function organizationWriter({ dir, rolesDir, barrier = () => {} }) {
    }
  }

-  function write(id, document, { revision, actor }) {
+  // Row 199 (#1697, design section 6): `detail` says what a credential verb did (verb, agent, kind,
+  // date, reason), never a value; the other setters pass none.
+  function write(id, document, { revision, actor, detail }) {
    requireId(actor, "authenticated actor");
    requireId(id, "organization id");
    return withLock(id, ({ home, parent }) => {
@@ -201,7 +203,7 @@ export function organizationWriter({ dir, rolesDir, barrier = () => {} }) {
      syncDir(tx);
      const event = {
        transaction, actor, business: id, before, after,
-        changes: changes(old, written), at: new Date().toISOString(),
+        changes: changes(old, written), ...(detail === undefined ? {} : { detail }), at: new Date().toISOString(),
      };
      log(id, { ...event, state: "prepared" });
      syncDir(home);
@@ -219,5 +221,22 @@ export function organizationWriter({ dir, rolesDir, barrier = () => {} }) {
    });
  }

-  return { logFile, read, write, recover: id => withLock(id, () => recover(id)) };
+  // Row 199: a receipt with no document change, for a credential verb that changes only the agents'
+  // store (a revoke or delete of store references). Committed at once; there is nothing to recover.
+  function record(id, { actor, detail }) {
+    requireId(actor, "authenticated actor");
+    requireId(id, "organization id");
+    return withLock(id, () => {
+      recover(id);
+      const hash = sha256(regular(businessFilePath(id, dir)));
+      const transaction = randomUUID();
+      log(id, {
+        transaction, actor, business: id, before: hash, after: hash, changes: [], detail,
+        at: new Date().toISOString(), state: "committed",
+      });
+      return { revision: hash, transaction };
+    });
+  }
+
+  return { logFile, read, write, record, recover: id => withLock(id, () => recover(id)) };
 }
@@ -20,6 +20,9 @@ export const ACTIONS = Object.freeze([
  "git.push.working",
  "git.push.protected",
  "git.merge.protected",
+  // Row 199 (#1697, mos-1027 Q-M2): the host pushes an agent's recorded work commit to the fork its
+  // business grants it. A hard wait under REQ-WAIT-3 until a PRD version routes it.
+  "git.push.remote",
  "review.request",
  "review.verdict",
  "record.write",
@@ -83,8 +86,8 @@ export const ROUTED = Object.freeze([
 // The hard waits (PRD 1.5 REQ-WAIT-1): always gated, always the human's,
 // cited spec or not. A role file may not list these under withinRole or
 // crossRole (REQ-WAIT-2). Today this is spend, data.delete, network.expose,
-// account.create, credential.mint, message.external, git.push.protected and
-// deploy; a test pins the list.
+// account.create, credential.mint, message.external, git.push.protected,
+// git.push.remote and deploy; a test pins the list.
 export const GATED_ONLY = Object.freeze(ACTIONS.filter((action) => !ROUTED.includes(action)));

 // pi's documented built-in tools; the same list scripts/mosaic-task.mjs
@@ -133,3 +136,50 @@ export const THREAD_DEFINITION = "assistant";
 // the human resolved through the CLI, may end or revoke. Row 155 moves the list here, and no
 // organization write may give an instance one of them.
 export const END_PROTECTED = Object.freeze([THREAD_DEFINITION]);
+
+// Row 199 (#1697, design D9c): the Gitea URL parse. It lives here because the broker reads it and
+// this file imports nothing. Gitea's name rule for users and repositories: letters, digits, "_", "."
+// and "-", not "." or "..".
+export const giteaName = (name) =>
+  typeof name === "string" && /^[A-Za-z0-9_.-]{1,100}$/.test(name) && name !== "." && name !== "..";
+
+// An https URL that is already its own normalized form, so a dot segment, an encoded dot, userinfo, a
+// query, a fragment, an upper-case host or an explicit :443 each fail, and the path checked is the
+// path used. With repo, the path is exactly /OWNER/REPO (one ".git" stripped); without, it is "/".
+// Returns {url, owner, repo}, or {problem} naming the rule that failed: form, instance or repository.
+export function parseGiteaUrl(value, { repo = false } = {}) {
+  let url = null;
+  try {
+    url = typeof value === "string" ? new URL(value) : null;
+  } catch {
+    url = null;
+  }
+  const normal = url && (repo ? [url.origin + url.pathname] : [url.origin, url.origin + "/"]);
+  if (!url || url.protocol !== "https:" || !normal.includes(value)) return { problem: "form" };
+  if (!repo) return url.pathname === "/" ? { url } : { problem: "instance" };
+  const segments = url.pathname.split("/").slice(1);
+  const name = segments[1]?.endsWith(".git") ? segments[1].slice(0, -4) : segments[1];
+  if (segments.length !== 2 || !giteaName(segments[0]) || !giteaName(name)) return { problem: "repository" };
+  return { url, owner: segments[0], repo: name };
+}
+
+// Design D9 step 2: the agent's fork of an upstream, https://HOST[:PORT]/<user>/REPO, or null for an
+// upstream that doesn't parse. The owner is always the agent's own Gitea user; nothing else names it.
+// URL.host drops a default port, so 443 counts the same on both sides.
+export function forkUrl(upstream, user) {
+  const { url, repo } = parseGiteaUrl(upstream, { repo: true });
+  return url ? `https://${url.host}/${user}/${repo}` : null;
+}
+
+// The refusal code for publishing `upstream` as an agent with `identity`, or null. Gitea compares
+// names without case (lower_name), so the owner check does too. An upstream or gitea.url that doesn't
+// parse is remote-not-granted: the business loader refuses both, so only a hand-built business gets
+// here.
+export function forkProblem(upstream, identity) {
+  const { url, owner } = parseGiteaUrl(upstream, { repo: true });
+  const instance = parseGiteaUrl(identity?.gitea?.url).url;
+  if (!url || !instance || typeof identity.gitea.user !== "string") return "remote-not-granted";
+  if (url.host !== instance.host) return "remote-host-mismatch";
+  if (owner.toLowerCase() === identity.gitea.user.toLowerCase()) return "remote-not-fork";
+  return null;
+}
@@ -0,0 +1,126 @@
+// Row 199 (#1697): an agent's own git identity, its publish grant, the project's upstream and the
+// credential store reference. Design D1, D8, D9 step 2 and D9c.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { join } from "node:path";
+import { BusinessError, parseCredentialRef, validateBusinessDocument } from "../src/index.mjs";
+import { forkProblem, forkUrl } from "../src/vocabulary.mjs";
+import { businessDoc, FAR_DATE, REPO_ROLES, tmp } from "./helpers.mjs";
+
+function refuses(fn, pattern) {
+  assert.throws(fn, (error) => {
+    assert.ok(error instanceof BusinessError, `expected BusinessError, got ${error}`);
+    assert.equal(error.exitCode, 2);
+    assert.match(error.message, pattern);
+    return true;
+  });
+}
+
+const IDENTITY = { name: "Coder", email: "[email protected]", gitea: { url: "https://git.example", user: "acme-coder" } };
+
+// The fixture with coder granted publish on stack, whose upstream is mosaic/stack.
+function check(mutate) {
+  const root = tmp();
+  const doc = businessDoc(root);
+  doc.projects.stack.remote = "https://git.example/mosaic/stack";
+  doc.roles.coder.identity = structuredClone(IDENTITY);
+  doc.roles.coder.publish = ["stack"];
+  mutate?.(doc, root);
+  return validateBusinessDocument(doc, join(root, "businesses", "acme.json"), { rolesDir: REPO_ROLES });
+}
+
+test("today's files load unchanged: identity, publish and remote are optional", () => {
+  const root = tmp();
+  const business = validateBusinessDocument(businessDoc(root), join(root, "businesses", "acme.json"), { rolesDir: REPO_ROLES });
+  assert.equal(business.roles.coder.identity, undefined);
+  assert.equal(business.roles.coder.publish, undefined);
+  assert.equal(business.projects.stack.remote, undefined);
+});
+
+test("a granted agent loads with its identity, grant and the project's upstream", () => {
+  const business = check();
+  assert.deepEqual({ ...business.roles.coder.identity, gitea: { ...business.roles.coder.identity.gitea } }, IDENTITY);
+  assert.deepEqual([...business.roles.coder.publish], ["stack"]);
+  assert.equal(business.projects.stack.remote, "https://git.example/mosaic/stack");
+});
+
+test("N10: publish needs identity and a gitea definition, and the error names the grant", () => {
+  refuses(() => check((d) => { delete d.roles.coder.identity; }), /roles\.coder\.publish needs identity and a gitea definition/);
+  refuses(() => check((d) => { d.roles.chief.identity = structuredClone(IDENTITY); d.roles.chief.publish = ["stack"]; }),
+    /roles\.chief\.publish needs identity and a gitea definition/);
+});
+
+test("publish names declared projects that have a remote, each once", () => {
+  refuses(() => check((d) => { d.roles.coder.publish = ["books"]; }), /publish names books, which the business file doesn't declare/);
+  refuses(() => check((d) => { delete d.projects.stack.remote; }), /publish names stack, which has no "remote"/);
+  refuses(() => check((d) => { d.roles.coder.publish = []; }), /publish/);
+  refuses(() => check((d) => { d.roles.coder.publish = ["stack", "stack"]; }), /publish/);
+});
+
+test("identity fields are checked", () => {
+  refuses(() => check((d) => { d.roles.coder.identity.email = "coder"; }), /identity\.email/);
+  refuses(() => check((d) => { d.roles.coder.identity.name = "a\nb"; }), /identity\.name/);
+  refuses(() => check((d) => { d.roles.coder.identity.extra = 1; }), /identity/);
+  refuses(() => check((d) => { d.roles.coder.identity.gitea.user = ".."; }), /gitea\.user/);
+  refuses(() => check((d) => { d.roles.coder.identity.gitea.user = "a/b"; }), /gitea\.user/);
+});
+
+test("D9c: the upstream must be its own normalized form, exactly /OWNER/REPO", () => {
+  const bad = {
+    "a dot segment": "https://git.example/acme-coder/../mosaic/stack",
+    "an encoded dot segment": "https://git.example/acme-coder/%2e%2e/mosaic/stack",
+    "an extra segment": "https://git.example/mosaic/stack/more",
+    "a missing segment": "https://git.example/stack",
+    "a trailing slash": "https://git.example/mosaic/stack/",
+    userinfo: "https://u:[email protected]/mosaic/stack",
+    "a query": "https://git.example/mosaic/stack?x=1",
+    "a fragment": "https://git.example/mosaic/stack#f",
+    "an explicit :443": "https://git.example:443/mosaic/stack",
+    "an upper-case host": "https://GIT.example/mosaic/stack",
+    "a backslash": "https://git.example\\mosaic\\stack",
+    "a name outside Gitea's rule": "https://git.example/mosaic/st%41ck",
+    "a dot-dot repo": "https://git.example/mosaic/...git",
+    http: "http://git.example/mosaic/stack",
+  };
+  for (const [what, remote] of Object.entries(bad)) {
+    assert.throws(() => check((d) => { d.projects.stack.remote = remote; }), BusinessError, what);
+  }
+});
+
+test("D9c: one .git is stripped, and the fork is built from the stripped name", () => {
+  assert.equal(check((d) => { d.projects.stack.remote = "https://git.example/mosaic/stack.git"; }).projects.stack.remote,
+    "https://git.example/mosaic/stack.git");
+  assert.equal(forkUrl("https://git.example/mosaic/stack.git", "acme-coder"), "https://git.example/acme-coder/stack");
+  assert.equal(forkUrl("https://git.example:3000/mosaic/stack", "acme-coder"), "https://git.example:3000/acme-coder/stack");
+});
+
+test("D9c: gitea.url names the instance only", () => {
+  for (const url of ["https://git.example/gitea", "https://git.example/gitea/", "https://git.example/?x", "https://git.example:443", "http://git.example"]) {
+    assert.throws(() => check((d) => { d.roles.coder.identity.gitea.url = url; }), BusinessError, url);
+  }
+  check((d) => { d.roles.coder.identity.gitea.url = "https://git.example/"; });
+});
+
+test("the upstream's host and port must be the agent's Gitea's", () => {
+  refuses(() => check((d) => { d.projects.stack.remote = "https://other.example/mosaic/stack"; }), /remote-host-mismatch/);
+  refuses(() => check((d) => { d.projects.stack.remote = "https://git.example:3000/mosaic/stack"; }), /remote-host-mismatch/);
+  assert.equal(forkProblem("https://git.example/mosaic/stack", { gitea: { url: "https://git.example/", user: "u" } }), null);
+});
+
+test("remote-not-fork: an upstream the agent's own user owns, compared without case", () => {
+  refuses(() => check((d) => { d.projects.stack.remote = "https://git.example/acme-coder/stack"; }), /remote-not-fork/);
+  refuses(() => check((d) => { d.projects.stack.remote = "https://git.example/ACME-Coder/stack"; }), /remote-not-fork/);
+});
+
+test("store references: own path only (design D1, D3a)", () => {
+  const store = { configDir: "/cfg", business: "acme", agent: "coder" };
+  const ref = parseCredentialRef({ store: true, rotateBy: FAR_DATE }, "gitea", "r", { store });
+  assert.equal(ref.file, "/cfg/secrets/agents/acme/coder/gitea");
+  assert.equal(ref.store, true);
+  refuses(() => parseCredentialRef({ store: true, rotateBy: FAR_DATE }, "gitea", "r"), /store/);
+  refuses(() => parseCredentialRef({ store: true, file: "/a", rotateBy: FAR_DATE }, "gitea", "r", { store }), /exactly one/);
+  refuses(() => parseCredentialRef({ file: "/cfg/secrets/agents/acme/pm/gitea", rotateBy: FAR_DATE }, "gitea", "r", { store }),
+    /credential-not-yours/);
+  assert.equal(parseCredentialRef({ file: "/cfg/secrets/agents/acme/coder/gitea", rotateBy: FAR_DATE }, "gitea", "r", { store }).file,
+    "/cfg/secrets/agents/acme/coder/gitea");
+});
@@ -9,7 +9,7 @@ import { validateRoleDocument } from "../src/index.mjs";
 import { tmp } from "./helpers.mjs";

 const WAITS = ["spend", "data.delete", "network.expose", "account.create", "credential.mint", "message.external",
-  "git.push.protected", "deploy"];
+  "git.push.protected", "deploy", "git.push.remote"];
 const LEFT = ["git.merge.protected", "policy.change", "prd.approve", "role.revoke"];
 const role = (authority) => {
  const dir = tmp();
@@ -1009,6 +1009,19 @@ names no one; the restart itself needs Mos's go or Jason's hand. A vars or launc
 prints `no restart`, because the launcher reads it at its next launch check.
 The Console Settings page has the same read and write (`packages/webui`).

+## credentials (row 199)
+
+`mosaic credentials [status [AGENT]] [--json] [--tester]` lists each agent's
+credential kinds with date and state, never a value. `issue AGENT gitea
+--rotate-by DATE` and `issue AGENT vikunja --expires DATE` read the token on
+stdin (pipe it, or paste it and end input) and send it once to the bus's
+`credentials.issue`; it is never an argument. `rotate` is the same over an
+entry the bus holds now, and refuses before reading stdin when there is none.
+`revoke AGENT [KIND] --reason TEXT` and `delete AGENT --reason TEXT` drop the
+entries; `delete` refuses `agent-running` while the agent holds a claim. With
+`--tester` only `status` and `revoke` run. After a rotate or revoke, delete
+the old token in Gitea or Vikunja yourself; the bus only forgets it.
+
 ## Token usage

 `mosaic usage [--business ID] [--json] [--tester]` reads the bus's accounting, without
@@ -17,6 +17,7 @@ import { projectBusCommand, projectCommand, PROJECT_BUS_USAGE, PROJECT_USAGE } f
 import { resolveThread, threadCommand, threadMembers, threadsCommand, THREAD_TALK_USAGE, THREAD_USAGE, THREADS_USAGE } from "./thread.mjs";
 import { limitsCommand, LIMITS_USAGE } from "./limits.mjs";
 import { pluginsCommand, PLUGINS_USAGE } from "./plugins.mjs";
+import { credentialsCommand, CREDENTIALS_USAGE } from "./credentials.mjs";
 import { instancesCommand, INSTANCES_USAGE } from "./instances.mjs";
 import { createChannelCaller } from "../../plugins/src/channel.mjs";
 import { PluginError } from "../../plugins/src/kinds.mjs";
@@ -38,6 +39,7 @@ export const USAGE = `usage:
  ${USAGE_USAGE}
  ${LIMITS_USAGE}
  ${PLUGINS_USAGE}
+  ${CREDENTIALS_USAGE}
  ${INSTANCES_USAGE}
  ${PROJECT_USAGE}
  ${PROJECT_BUS_USAGE}
@@ -576,6 +578,8 @@ export async function main(argv, io = { env: process.env, stdin: process.stdin,
  if (verb === "limits") return limitsCommand(rest,io,p=>callFor(p,io,deps));
  if (verb === "usage") return usageCommand(rest, io, p => callFor(p, io, deps));
  if (verb === "plugins") return pluginsCommand(rest, io, (p) => callFor(p, io, deps));
+  // Row 199 (#1697): issue and rotate read the token on stdin.
+  if (verb === "credentials") return credentialsCommand(rest, io, (p) => callFor(p, io, deps));
  // Row 165 (#1662): scripts/mosaic sends only `business instances` and `business instance` here.
  if (verb === "business") return instancesCommand(rest, io, (p) => callFor(p, io, deps));
  if (verb === "talk") return talk(rest, io, deps);
@@ -0,0 +1,83 @@
+// `mosaic credentials` (row 199, #1697, design section 6): an agent's per-agent credentials through
+// the broker's credentials, credentials.issue, credentials.revoke and credentials.delete. Every verb
+// is the human's; with --tester (Q173) only status and revoke. issue and rotate read the token on
+// stdin, never argv, and nothing here prints it: the broker's answer carries the kind, date and state.
+import { CliError } from "./errors.mjs";
+
+export const CREDENTIALS_USAGE = "mosaic credentials [status [AGENT]] [--json] [--tester] | issue|rotate AGENT gitea --rotate-by DATE | " +
+  "issue|rotate AGENT vikunja --expires DATE | revoke AGENT [KIND] --reason TEXT [--tester] | delete AGENT --reason TEXT [--business ID]";
+const DATE_FLAG = Object.freeze({ gitea: "--rotate-by", vikunja: "--expires" });
+const MAX_TOKEN = 16384;
+
+function parse(args) {
+  const out = { positional: [], flags: new Set(), values: {} };
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--json" || arg === "--tester") out.flags.add(arg);
+    else if (["--business", "--rotate-by", "--expires", "--reason"].includes(arg)) {
+      if (!args[i + 1] || Object.hasOwn(out.values, arg)) throw new CliError(CREDENTIALS_USAGE, 4);
+      out.values[arg] = args[++i];
+    } else if (arg.startsWith("--")) throw new CliError(CREDENTIALS_USAGE, 4);
+    else out.positional.push(arg);
+  }
+  return out;
+}
+
+// The whole of stdin, one token; a terminal shows what is typed, so a pipe or a paste then EOF.
+async function readToken(stdin) {
+  let text = "";
+  for await (const chunk of stdin) {
+    text += chunk;
+    if (text.length > MAX_TOKEN + 2) throw new CliError("refused: the token on stdin is too long", 2);
+  }
+  if (!text.trim()) throw new CliError("refused: no token on stdin; pipe or paste it, then end input", 4);
+  return text;
+}
+
+// The states the bus's status() gives a held token: gitea is valid or rotation-due, vikunja valid,
+// expiring or expired. not-issued and revoked hold none.
+const ISSUED = new Set(["valid", "rotation-due", "expiring", "expired"]);
+
+export async function credentialsCommand(args, io, callFor) {
+  const parsed = parse(args);
+  const [verb = "status", agent, kind, ...extra] = parsed.positional;
+  const v = parsed.values;
+  const shape = {
+    status: () => kind === undefined && !v["--rotate-by"] && !v["--expires"] && !v["--reason"],
+    issue: () => agent && DATE_FLAG[kind] && v[DATE_FLAG[kind]] && !v[kind === "gitea" ? "--expires" : "--rotate-by"] && !v["--reason"],
+    revoke: () => agent && (kind === undefined || DATE_FLAG[kind]) && v["--reason"] && !v["--rotate-by"] && !v["--expires"],
+    delete: () => agent && kind === undefined && v["--reason"] && !v["--rotate-by"] && !v["--expires"],
+  };
+  shape.rotate = shape.issue;
+  if (extra.length || !shape[verb]?.()) throw new CliError(CREDENTIALS_USAGE, 4);
+  // Q173 (duckworth N1): a token the tester issued would pass through its session.
+  if (parsed.flags.has("--tester") && !["status", "revoke"].includes(verb)) {
+    throw new CliError(`--tester takes only status and revoke\n${CREDENTIALS_USAGE}`, 4);
+  }
+  try {
+    const call = callFor(parsed);
+    let result;
+    if (verb === "status") {
+      const rows = await call("credentials", {});
+      result = agent ? rows.filter((r) => r.role === agent) : rows;
+      if (!parsed.flags.has("--json")) {
+        io.stdout.write(result.map((r) => `${r.role}\t${r.service}\t${r.state}\t${r.dateKind} ${r.date}`).join("\n") + (result.length ? "\n" : ""));
+        return;
+      }
+    } else if (verb === "issue" || verb === "rotate") {
+      // rotate names an entry the bus holds now; checked before stdin is read.
+      if (verb === "rotate") {
+        const held = (await call("credentials", {})).find((r) => r.role === agent && r.service === kind);
+        if (!ISSUED.has(held?.state)) throw new CliError(`refused: ${agent} has no issued ${kind} credential to rotate; use issue`, 2);
+      }
+      const token = await readToken(io.stdin);
+      result = await call("credentials.issue", { agent, service: kind, token, date: v[DATE_FLAG[kind]] });
+    } else if (verb === "revoke") {
+      result = await call("credentials.revoke", { agent, ...(kind ? { service: kind } : {}), reason: v["--reason"] });
+    } else result = await call("credentials.delete", { agent, reason: v["--reason"] });
+    io.stdout.write(JSON.stringify(result, null, 2) + "\n");
+  } catch (error) {
+    if (error instanceof CliError) throw error;
+    throw new CliError(error.message, 2);
+  }
+}
@@ -26,6 +26,19 @@
 //          squash that will land. The gate runs after the answer, and its
 //          outcome is the broker's: recordLand or landRefused, each on the
 //          task's trail and told to the role as a RESULT message.
+//   publish {"cap", "op": "publish", "task_ref", "project", "branch", "decision"}
+//          (row 199, #1697, design D9 to D11). The host answers {"ok": true,
+//          "result": {fork, ref, commit, previous}} or a refusal. The broker's
+//          checkPublish names the fork, the agent's email, the source commit
+//          and the destination; the request names none of them. publish
+//          (working.mjs) checks the work ref and the commits' identity under
+//          the repository's lock, then the bus process runs ls-remote and the
+//          push with the agent's gitea token (publishPush), and the host polls
+//          publishResult every publishPollMs: the host's op channel answers
+//          one op at a time within 10 s. The poll ends at publishDeadlineMs
+//          (publish-timeout), past git's own limit on each of the four git
+//          runs. recordPublish files the push; any refusal after checkPublish
+//          is filed once, by publishRefused.
 //
 // A refusal is {"ok": false, "error": "<code>"}, and the connection ends.
 // The host checks, in order: identity (a role of this business), the request
@@ -64,9 +77,10 @@ import { randomBytes } from "node:crypto";
 import { closeSync, createReadStream, existsSync, lstatSync, mkdirSync, openSync, rmSync, statSync, symlinkSync, writeSync, chmodSync } from "node:fs";
 import { createServer } from "node:net";
 import { join } from "node:path";
+import { GIT_GRACE_MS, GIT_TIMEOUT_MS } from "../../seat/src/checkout.mjs";
 import { gitSocketPath } from "../../seat/src/session.mjs";
 import { gateEnv, isMosaicStack, rootHits, runGate } from "../../seat/src/landing.mjs";
-import { BUNDLE_MAX, dropLand, finishLand, FSCK, HAVE_MAX, prepareLand, push, review, validBranch, workRef, WorkingError } from "../../seat/src/working.mjs";
+import { BUNDLE_MAX, dropLand, finishLand, FSCK, HAVE_MAX, prepareLand, publish, push, review, validBranch, workRef, WorkingError } from "../../seat/src/working.mjs";
 import { CliError } from "./errors.mjs";

 const HEADER_MAX = 4096;
@@ -84,6 +98,11 @@ export const bodyDeadline = (size) => BODY_IDLE_MS + Math.ceil(size / BODY_MIN_R
 const MAX_ACTIVE = 8;
 // The longest close() waits for its host-closing answers to leave.
 export const CLOSE_WAIT_MS = 2000;
+// How often the host asks the bus process whether a publish's push ended.
+const PUBLISH_POLL_MS = 200;
+// The longest the host polls: publishRemote runs at most four git commands
+// (ls-remote, cat-file, merge-base, push), each ended by git's own limit.
+const PUBLISH_DEADLINE_MS = 4 * (GIT_TIMEOUT_MS + GIT_GRACE_MS) + 30_000;
 const CAP = /^[0-9a-f]{64}$/;
 const OID = /^[0-9a-f]{40}([0-9a-f]{24})?$/;

@@ -272,7 +291,7 @@ Applied-under: git socket land (bus host)
 // host: startHost()'s handle; business: loadBusiness() output. bundleMax,
 // bodyDeadline, bodyIdle, maxActive, fsck and gate (LAND_GATE's shape) are
 // for the tests.
-export function createGitSocket({ host, business: b, dataRoot, env = process.env, log = () => {}, bundleMax = BUNDLE_MAX, bodyDeadline: deadlineOf = bodyDeadline, bodyIdle = BODY_IDLE_MS, maxActive = MAX_ACTIVE, fsck = FSCK, gate = LAND_GATE }) {
+export function createGitSocket({ host, business: b, dataRoot, env = process.env, log = () => {}, bundleMax = BUNDLE_MAX, bodyDeadline: deadlineOf = bodyDeadline, bodyIdle = BODY_IDLE_MS, maxActive = MAX_ACTIVE, fsck = FSCK, gate = LAND_GATE, publishPollMs = PUBLISH_POLL_MS, publishDeadlineMs = PUBLISH_DEADLINE_MS }) {
  const path = gitSocketPath(dataRoot);
  const dir = join(dataRoot, "bus-host");
  let server = null;
@@ -386,6 +405,55 @@ export function createGitSocket({ host, business: b, dataRoot, env = process.env
    })();
  }

+  async function doPublish(socket, cap, req) {
+    const { task_ref, branch, decision } = req;
+    const p = project(req.project);
+    if (!p || !validBranch(branch) || (decision !== undefined && typeof decision !== "string")) throw new Refusal("invalid-request");
+    workRef(task_ref);
+    const facts = await op({ op: "checkPublish", cap, args: { task_ref, project: req.project, branch, ...(decision === undefined ? {} : { decision }) } });
+    const { ticket } = facts;
+    // From the ticket on, a refusal is the publish's own, filed once by publishRefused.
+    const refused = async (e) => {
+      const code = e instanceof Refusal || e instanceof Recorded || e instanceof WorkingError ? e.code : "git-failed";
+      if (code === "git-failed") log(`git socket: publish ${task_ref}: ${code}: ${e.message}`);
+      await host.op({ op: "publishRefused", ticket, args: { code } }).catch((x) => log(`git socket: publish ${task_ref}: refusal ${code} not recorded: ${x.code ?? x.message}`));
+      return new Recorded(code);
+    };
+    let pushed;
+    try {
+      pushed = await publish({
+        dataRoot, business: b.id, project: req.project, root: p.root, taskRef: task_ref, source: facts.source, email: facts.email, env,
+        remote: async () => {
+          await op({ op: "publishPush", ticket });
+          const until = Date.now() + publishDeadlineMs;
+          for (;;) {
+            // The bus's git may still finish after this; the fork could then hold the commit with
+            // no record, as when recordPublish refuses after a push.
+            if (Date.now() >= until) {
+              log(`git socket: publish ${task_ref}: publish-timeout; the bus process's push may still reach the fork`);
+              throw new Refusal("publish-timeout");
+            }
+            await new Promise((r) => setTimeout(r, publishPollMs));
+            const r = await op({ op: "publishResult", ticket });
+            if (r.state === "pushed") return { ref: r.ref, commit: r.commit, previous: r.previous };
+            if (r.state === "refused") throw new Recorded(r.code);
+          }
+        },
+      });
+    } catch (e) {
+      throw await refused(e);
+    }
+    // The commit is on the fork now; a record the broker refuses is filed as that refusal.
+    let result;
+    try {
+      result = await op({ op: "recordPublish", ticket, pushed });
+    } catch (e) {
+      log(`git socket: publish ${task_ref}: ${pushed.commit} is on ${facts.fork} but wasn't recorded: ${e.code}`);
+      throw await refused(e);
+    }
+    socket.end(`${JSON.stringify({ ok: true, result: { fork: result.fork, ref: result.ref, commit: result.commit, previous: result.previous } })}\n`);
+  }
+
  async function serve(socket) {
    let cap = null;
    let subject = null;
@@ -410,7 +478,8 @@ export function createGitSocket({ host, business: b, dataRoot, env = process.env
      if (req.op === "push") await doPush(socket, cap, req, rest, file);
      else if (req.op === "fetch") await doFetch(socket, cap, req, file);
      else if (req.op === "land") await doLand(socket, cap, req);
-      else throw new Refusal("invalid-request", "op is push, fetch or land");
+      else if (req.op === "publish") await doPublish(socket, cap, req);
+      else throw new Refusal("invalid-request", "op is push, fetch, land or publish");
    } catch (e) {
      if (e instanceof Recorded) return fail(e.code);
      const code = e instanceof Refusal || e instanceof WorkingError ? e.code : "git-failed";
@@ -47,8 +47,9 @@
 // launchedBy = the business's human and no caller capability.
 //
 // listen() also serves the git socket (src/git-socket.mjs, row 93), which
-// the sandbox binds for a role that holds git.push.working or
-// review.verdict, or a merge decision to land (landHeld, row 137);
+// the sandbox binds for a role that holds git.push.working,
+// review.verdict or git.push.remote (row 199), or a merge decision to land
+// (landHeld, row 137);
 // session.json names it as gitSocket.
 //
 // Thread sessions (row 121, #1615). A thread instance (an instance whose
@@ -397,8 +398,9 @@ export function createLauncher({
    const transcript = call(model.harness, "transcript", () => harness.transcript({ runDir, store }));
    const harnessMounts = call(model.harness, "mounts", () => harness.mounts({ env }));
    // Row 93: the git socket, for a role that pushes work or reviews it. Row 137: or lands it.
+    // Row 199 (D11): or publishes it, once a reviewed commit routes git.push.remote within-role.
    const held = [...resolved.limits.authority.withinRole, ...resolved.limits.authority.crossRole];
-    const git = land || held.includes("git.push.working") || held.includes("review.verdict") ? gitSocketPath(dataRoot) : null;
+    const git = land || ["git.push.working", "review.verdict", "git.push.remote"].some((a) => held.includes(a)) ? gitSocketPath(dataRoot) : null;
    writeSessionFile(runDir, {
      ...sessionDefaults,
      business: b.id,
@@ -0,0 +1,114 @@
+// Row 199 (#1697, design section 6, T4, T5): `mosaic credentials`. issue and rotate read the token on
+// stdin and pass it once to credentials.issue; nothing printed carries it. --tester takes status and
+// revoke only. A fake transport records the calls; no bus runs here.
+import test from "node:test";
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { main } from "../src/cli.mjs";
+import { io, tmp } from "./helpers.mjs";
+
+const TOKEN = "fake_cli_token_0123456789";
+const MOSAIC = fileURLToPath(new URL("../../../scripts/mosaic", import.meta.url));
+const ROWS = [
+  { service: "gitea", account: null, role: "coder", dateKind: "rotateBy", date: "2099-01-01", state: "valid" },
+  { service: "vikunja", account: "bot", role: "coder", dateKind: "expires", date: "2099-01-01", state: "not-issued" },
+  { service: "gitea", account: null, role: "reviewer", dateKind: "rotateBy", date: "2099-01-01", state: "revoked" },
+];
+
+function deps(calls, rows = ROWS) {
+  const answer = (who) => (business) => async (verb, args) => {
+    calls.push({ who, business, verb, args });
+    if (verb === "credentials") return rows;
+    if (verb === "credentials.issue") return { agent: args.agent, verb: "issue", service: args.service, date: args.date, state: "valid" };
+    return { agent: args.agent, verb: verb.slice(12), services: [] };
+  };
+  return { system: { dataRoot: "/nonexistent" }, transport: answer("human"), testerTransport: answer("tester") };
+}
+const withStdin = (x, text) => {
+  x.stdin.end(text);
+  return x;
+};
+
+test("row 199: issue and rotate send the stdin token once to credentials.issue and print no value", async () => {
+  const calls = [];
+  const d = deps(calls);
+  const x = withStdin(io(), TOKEN + "\n");
+  await main(["credentials", "issue", "coder", "gitea", "--rotate-by", "2099-01-01", "--business", "acme"], x, d);
+  assert.deepEqual(calls, [{ who: "human", business: "acme", verb: "credentials.issue", args: { agent: "coder", service: "gitea", token: TOKEN + "\n", date: "2099-01-01" } }]);
+  assert.equal(x.out.text.includes(TOKEN), false);
+  assert.equal(JSON.parse(x.out.text).state, "valid");
+  // rotate checks the entry is issued before it reads stdin.
+  calls.length = 0;
+  await main(["credentials", "rotate", "coder", "gitea", "--rotate-by", "2099-06-01", "--business", "acme"], withStdin(io(), TOKEN), d);
+  assert.deepEqual(calls.map((c) => c.verb), ["credentials", "credentials.issue"]);
+  calls.length = 0;
+  await assert.rejects(main(["credentials", "rotate", "coder", "vikunja", "--expires", "2099-06-01", "--business", "acme"], withStdin(io(), TOKEN), d), /no issued vikunja credential to rotate; use issue/);
+  assert.deepEqual(calls.map((c) => c.verb), ["credentials"]);
+  // No token on stdin, the date flag of the other kind, a token in argv: refused before any write.
+  calls.length = 0;
+  await assert.rejects(main(["credentials", "issue", "coder", "gitea", "--rotate-by", "2099-01-01", "--business", "acme"], withStdin(io(), "\n"), d), /no token on stdin/);
+  await assert.rejects(main(["credentials", "issue", "coder", "gitea", "--expires", "2099-01-01", "--business", "acme"], withStdin(io(), TOKEN), d), /mosaic credentials/);
+  await assert.rejects(main(["credentials", "issue", "coder", "gitea", TOKEN, "--rotate-by", "2099-01-01", "--business", "acme"], withStdin(io(), TOKEN), d), /mosaic credentials/);
+  await assert.rejects(main(["credentials", "issue", "coder", "gitea", "--rotate-by", "2099-01-01", "--business", "acme"], withStdin(io(), "x".repeat(17000)), d), /too long/);
+  assert.equal(calls.filter((c) => c.verb === "credentials.issue").length, 0);
+  // From inside an agent run, the human's verbs refuse before any call.
+  await assert.rejects(main(["credentials", "issue", "coder", "gitea", "--rotate-by", "2099-01-01", "--business", "acme"], withStdin(io({ CLAUDECODE: "1" }), TOKEN), d), /outside any agent run/);
+});
+
+// gizmoduck-0050: a gitea key past its rotate-by date is rotation-due, and rotate is how a human
+// clears it. Every state the bus's status() gives a held token rotates; the other two refuse.
+test("row 199: rotate goes ahead on each held state, rotation-due included, and refuses not-issued, revoked and an unknown entry", async () => {
+  const states = { valid: true, "rotation-due": true, expiring: true, expired: true, "not-issued": false, revoked: false };
+  for (const [state, held] of Object.entries(states)) {
+    const calls = [];
+    const d = deps(calls, [{ service: "gitea", account: null, role: "coder", dateKind: "rotateBy", date: "2020-01-01", state }]);
+    const run = main(["credentials", "rotate", "coder", "gitea", "--rotate-by", "2099-06-01", "--business", "acme"], withStdin(io(), TOKEN), d);
+    if (held) await run;
+    else await assert.rejects(run, /no issued gitea credential to rotate; use issue/);
+    assert.deepEqual(calls.map((c) => c.verb), held ? ["credentials", "credentials.issue"] : ["credentials"], state);
+  }
+  const calls = [];
+  await assert.rejects(main(["credentials", "rotate", "tester", "gitea", "--rotate-by", "2099-06-01", "--business", "acme"], withStdin(io(), TOKEN), deps(calls)), /no issued gitea credential/);
+  assert.deepEqual(calls.map((c) => c.verb), ["credentials"]);
+});
+
+test("row 199: status, revoke and delete; the tester runs status and revoke only", async () => {
+  const calls = [];
+  const d = deps(calls);
+  const x = io();
+  await main(["credentials", "status", "coder", "--business", "acme"], x, d);
+  assert.equal(x.out.text, "coder\tgitea\tvalid\trotateBy 2099-01-01\ncoder\tvikunja\tnot-issued\texpires 2099-01-01\n");
+  const j = io();
+  await main(["credentials", "--json", "--business", "acme", "--tester"], j, d);
+  assert.equal(JSON.parse(j.out.text).length, 3);
+  await main(["credentials", "revoke", "coder", "gitea", "--reason", "fired", "--business", "acme", "--tester"], io(), d);
+  await main(["credentials", "revoke", "coder", "--reason", "fired", "--business", "acme"], io(), d);
+  await main(["credentials", "delete", "coder", "--reason", "fired", "--business", "acme"], io(), d);
+  assert.deepEqual(calls.map((c) => [c.who, c.verb, c.args]), [
+    ["human", "credentials", {}],
+    ["tester", "credentials", {}],
+    ["tester", "credentials.revoke", { agent: "coder", service: "gitea", reason: "fired" }],
+    ["human", "credentials.revoke", { agent: "coder", reason: "fired" }],
+    ["human", "credentials.delete", { agent: "coder", reason: "fired" }],
+  ]);
+  calls.length = 0;
+  for (const args of [
+    ["issue", "coder", "gitea", "--rotate-by", "2099-01-01", "--tester"],
+    ["rotate", "coder", "gitea", "--rotate-by", "2099-01-01", "--tester"],
+    ["delete", "coder", "--reason", "x", "--tester"],
+  ]) await assert.rejects(main(["credentials", ...args, "--business", "acme"], withStdin(io(), TOKEN), d), /--tester takes only status and revoke/);
+  for (const args of [["revoke", "coder"], ["delete", "coder"], ["delete", "coder", "gitea", "--reason", "x"], ["revoke", "coder", "model", "--reason", "x"], ["purge", "coder"]])
+    await assert.rejects(main(["credentials", ...args, "--business", "acme"], io(), d), /mosaic credentials/, args.join(" "));
+  assert.equal(calls.length, 0);
+});
+
+test("row 199: scripts/mosaic sends credentials to packages/cli, not the seat CLI", (t) => {
+  const root = tmp(t, "mosaic-cli-cred-route-");
+  const env = { PATH: process.env.PATH, HOME: join(root, "home"), MOSAIC_CONFIG: join(root, "none.json") };
+  const r = spawnSync(MOSAIC, ["credentials", "purge"], { env, encoding: "utf8" });
+  assert.equal(r.status, 4);
+  assert.match(r.stderr, /^mosaic: mosaic credentials \[status \[AGENT\]\]/);
+  assert.doesNotMatch(r.stderr, /mosaic launch </);
+});
@@ -0,0 +1,281 @@
+// Row 199 (#1697, design D9, D9b, D11, T3): the git socket's publish op end to end. The socket,
+// working.mjs, the bus runtime (in this process, so its publishTls can name the scratch CA), the
+// per-agent store and a TLS fake Gitea on 127.0.0.1. The host stand-in answers the socket's ops
+// the way packages/bus/src/process.mjs does. Fake tokens in a scratch root only.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { chmodSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { connect } from "node:net";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { startBroker } from "../../bus/src/runtime.mjs";
+import { businessDoc, rolesCopy, systemFor, writeJson } from "../../business/tests/helpers.mjs";
+import { pushWorking } from "../../harness/src/git-tools.mjs";
+import { gitEnv } from "../../seat/src/checkout.mjs";
+import { workRef } from "../../seat/src/working.mjs";
+import { fakeGitea, scratchCa } from "../../seat/tests/fake-gitea.mjs";
+import { createGitSocket } from "../src/git-socket.mjs";
+
+const TASK = "vikunja:1/2";
+const TASK2 = "vikunja:1/3";
+const TOKEN = "fake_socket_token_0123456789";
+const TOKEN2 = "fake_second_token_0123456789";
+
+function git(cwd, ...args) {
+  const r = spawnSync("git", args, { cwd, encoding: "utf8", env: gitEnv() });
+  assert.equal(r.status, 0, `git ${args.join(" ")}: ${r.stderr}`);
+  return r.stdout.trim();
+}
+function commit(dir, text, email) {
+  writeFileSync(join(dir, "README"), `${text}\n`);
+  git(dir, "add", "README");
+  git(dir, "-c", `user.name=${text}`, "-c", `user.email=${email}`, "commit", "-q", "-m", text);
+  return git(dir, "rev-parse", "HEAD");
+}
+function raw(path, req) {
+  return new Promise((resolve, reject) => {
+    const s = connect(path);
+    let buf = "";
+    s.on("connect", () => s.write(`${JSON.stringify(req)}\n`));
+    s.on("data", (b) => (buf += b));
+    s.on("end", () => resolve(JSON.parse(buf.split("\n")[0])));
+    s.on("error", reject);
+  });
+}
+// The socket's ops, answered as process.mjs's launchOp answers them.
+const OPS = {
+  identity: (r, m) => r.identity(m.cap),
+  refuse: (r, m) => r.refuse(m.cap, m.code, m.subject),
+  checkPush: (r, m) => r.checkPush(m.cap, m.task_ref),
+  recordPush: (r, m) => r.recordPush(m.cap, m.push),
+  checkPublish: (r, m) => r.checkPublish(m.cap, m.args),
+  publishPush: (r, m) => r.publishPush(m.ticket),
+  publishResult: (r, m) => r.publishResult(m.ticket),
+  recordPublish: (r, m) => r.recordPublish(m.ticket, m.pushed),
+  publishRefused: (r, m) => r.publishRefused(m.ticket, m.args),
+};
+
+async function setup(t, { publishDeadlineMs } = {}) {
+  const root = mkdtempSync(join(tmpdir(), "cli-publish-"));
+  const down = [];
+  t.after(async () => {
+    for (const fn of down) await fn();
+    rmSync(root, { recursive: true, force: true });
+  });
+  const ca = scratchCa(join(root, "ca"));
+  const gitea = await fakeGitea({ dir: join(root, "gitea"), tls: ca, users: { coder: TOKEN, second: TOKEN2 } });
+  down.push(() => gitea.close());
+  const project = join(root, "project");
+  mkdirSync(project);
+  git(project, "init", "-q", "-b", "main");
+  commit(project, "one", "[email protected]");
+  // Each agent's fork and the upstream, mosaic/stack, all clones of the root.
+  for (const owner of ["coder", "second", "mosaic"]) {
+    mkdirSync(join(gitea.repo(owner, "stack"), ".."), { recursive: true });
+    git(root, "clone", "-q", "--bare", project, gitea.repo(owner, "stack"));
+  }
+  const forkRepo = gitea.repo("coder", "stack");
+
+  const rolesDir = rolesCopy(root);
+  writeJson(join(root, "businesses/demo.json"), { ...businessDoc(root, "demo"), plugins: { harness: ["pi"] } });
+  mkdirSync(join(root, "data"), { mode: 0o700 });
+  mkdirSync(join(root, "secrets", "agents"), { recursive: true, mode: 0o700 });
+  chmodSync(join(root, "secrets"), 0o700);
+  const agent = (user) => ({
+    authority: { withinRole: ["git.push.working", "message.send"], crossRole: [] },
+    identity: { name: user, email: `${user}@example.com`, gitea: { url: gitea.origin, user } },
+    publish: ["stack"],
+    credentials: { gitea: { store: true, file: join(root, "secrets", "agents", "demo", user, "gitea"), rotateBy: "2099-01-01" } },
+  });
+  const demo = {
+    id: "demo", human: "jason", arbiters: { technical: "reviewer", delivery: "reviewer" },
+    projects: { stack: { root: project, remote: `${gitea.origin}/mosaic/stack` } },
+    roles: {
+      coder: agent("coder"),
+      second: agent("second"),
+      reviewer: { authority: { withinRole: ["message.send"], crossRole: [] } },
+    },
+  };
+  const dataRoot = join(root, "data");
+  const bus = await startBroker({ dataRoot, businesses: { demo }, organization: { dir: root, rolesDir, system: systemFor(root) }, publishTls: ["-c", `http.sslCAInfo=${ca.ca}`] });
+  down.unshift(() => bus.close());
+  // A test sets hooks[op] to act around one op: hook(message, next), where next() answers it.
+  const hooks = {};
+  const host = { op: async (m) => (hooks[m.op] ? hooks[m.op](m, () => OPS[m.op](bus, m)) : OPS[m.op](bus, m)) };
+  const logs = [];
+  mkdirSync(join(dataRoot, "bus-host"), { mode: 0o700 });
+  const sock = createGitSocket({ host, business: demo, dataRoot, env: process.env, log: (l) => logs.push(l), publishPollMs: 20, ...(publishDeadlineMs ? { publishDeadlineMs } : {}) });
+  down.unshift(() => sock.close());
+  await sock.listen();
+
+  const caps = {};
+  for (const role of ["coder", "second"]) {
+    caps[role] = bus.broker.bindLaunch({ business: "demo", role, run: `${role}-run`, harness: "pi" });
+    bus.broker.request(caps[role], { verb: "role.claim", args: {} });
+  }
+  const human = bus.broker.bindHuman({ business: "demo", human: "jason", via: "cli", outsideAgent: true });
+  // Each agent's workspace: a clone of the root with one commit of its own on feat, pushed to the
+  // working repo for its task.
+  const work = async (role, task) => {
+    const workspace = join(root, `ws-${role}`);
+    const tmp = join(root, `tmp-${role}`);
+    mkdirSync(workspace);
+    mkdirSync(tmp);
+    git(workspace, "clone", "-q", project, "stack");
+    const clone = join(workspace, "stack");
+    git(clone, "checkout", "-q", "-b", "feat");
+    const commitId = commit(clone, `work by ${role}`, `${role}@example.com`);
+    await pushWorking({ path: sock.path, cap: caps[role], workspace, tmp, task_ref: task, project: "stack", branch: "feat" });
+    return commitId;
+  };
+  // A second commit on the coder's feat, pushed to the working repo through the socket.
+  const again = async () => {
+    const workspace = join(root, "ws-coder");
+    const commitId = commit(join(workspace, "stack"), "more work", "[email protected]");
+    await pushWorking({ path: sock.path, cap: caps.coder, workspace, tmp: join(root, "tmp-coder"), task_ref: TASK, project: "stack", branch: "feat" });
+    return commitId;
+  };
+  const approve = (role = "coder", task = TASK) => {
+    const d = bus.broker.request(caps[role], { verb: "decision.raise", args: {
+      action: "git.push.remote", target: task, task_ref: task, question: "Publish?", blocking: false, recommendation: "yes",
+      options: [{ key: "yes", text: "Yes" }, { key: "no", text: "No" }] } });
+    bus.broker.request(human, { verb: "decision.resolve", args: { id: d.id, choice: "yes" } });
+    return d.id;
+  };
+  const publish = (decision, extra = {}, role = "coder", task = TASK) =>
+    raw(sock.path, { cap: caps[role], op: "publish", task_ref: task, project: "stack", branch: "feat", decision, ...extra });
+  // The bus holds the writer lock; the test reads its events through a read-only handle.
+  const events = (kind, task = TASK) => {
+    const db = new DatabaseSync(join(dataRoot, "bus", "bus.sqlite"), { readOnly: true });
+    try {
+      return db.prepare("SELECT * FROM events WHERE kind=? AND subject=? ORDER BY seq").all(kind, task).map((e) => ({ ...e, body: JSON.parse(e.body) }));
+    } finally {
+      db.close();
+    }
+  };
+  return { root, bus, gitea, forkRepo, work: await work("coder", TASK), more: work, again, hooks, caps, approve, publish, logs, events };
+}
+
+test("T3 end to end: publish under an approved decision sends the work commit to the agent's own fork and records it once", async (t) => {
+  const w = await setup(t);
+  // Nothing issued: the store has no token, and the refusal is filed once.
+  const first = w.approve();
+  assert.deepEqual(await w.publish(first), { ok: false, error: "credential-unavailable" });
+  assert.deepEqual(w.events("action.refused").map((e) => e.body.code), ["credential-unavailable"]);
+  assert.equal(w.gitea.requests.length, 0);
+
+  w.bus.credentials.issue("demo/coder", "gitea", TOKEN, "2099-01-01");
+  const reply = await w.publish(first);
+  assert.deepEqual(reply, { ok: true, result: { fork: `${w.gitea.origin}/coder/stack`, ref: "refs/heads/coder/feat", commit: w.work, previous: null } });
+  assert.equal(git(w.root, `--git-dir=${w.forkRepo}`, "rev-parse", "refs/heads/coder/feat"), w.work);
+  // Every request went to the agent's fork; the upstream, mosaic/stack, received none.
+  assert.ok(w.gitea.requests.some((r) => r.path === "/coder/stack/git-receive-pack" && r.user === "coder"));
+  for (const r of w.gitea.requests) assert.match(r.path, /^\/coder\/stack\//);
+  const allowed = w.events("action.allowed").filter((e) => e.body.action === "git.push.remote" && e.body.operation !== "decision.raise");
+  assert.equal(allowed.length, 1);
+  assert.equal(allowed[0].body.fork, `${w.gitea.origin}/coder/stack`);
+  assert.equal(allowed[0].body.commit, w.work);
+  // The decision is spent.
+  assert.deepEqual(await w.publish(first), { ok: false, error: "decision-consumed" });
+  // T4: no token in any answer, event or log line, nor in any file under the scratch root but the
+  // agent's own store file.
+  assert.equal(JSON.stringify([reply, w.events("action.allowed"), w.events("action.refused"), w.logs]).includes(TOKEN), false);
+  const store = join(w.root, "secrets", "agents", "demo", "coder", "gitea");
+  const holding = readdirSync(w.root, { recursive: true })
+    .map((name) => join(w.root, name))
+    .filter((file) => lstatSync(file).isFile() && readFileSync(file).includes(TOKEN));
+  assert.deepEqual(holding, [store]);
+});
+
+test("T3 end to end: a fork the token can't reach is fork-unavailable, filed once, and nothing is recorded as allowed", async (t) => {
+  const w = await setup(t);
+  w.bus.credentials.issue("demo/coder", "gitea", "fake_wrong_token_0123456789", "2099-01-01");
+  assert.deepEqual(await w.publish(w.approve()), { ok: false, error: "fork-unavailable" });
+  assert.ok(w.gitea.requests.length > 0);
+  assert.deepEqual(w.events("action.refused").map((e) => e.body.code), ["fork-unavailable"]);
+  assert.equal(w.events("action.allowed").filter((e) => e.body.action === "git.push.remote" && e.body.operation !== "decision.raise").length, 0);
+});
+
+test("a bad branch or project refuses before the broker; a fork, user or ref in the request is ignored", async (t) => {
+  const w = await setup(t);
+  const d = w.approve();
+  assert.deepEqual(await w.publish(d, { branch: "../main" }), { ok: false, error: "invalid-request" });
+  assert.deepEqual(await w.publish(d, { project: "nope" }), { ok: false, error: "invalid-request" });
+  // Filed through the socket's refuse op, as a bad push request is; no publish ticket opened.
+  assert.deepEqual(w.events("action.refused").map((e) => e.body.code), ["invalid-request", "invalid-request"]);
+  assert.equal(w.gitea.requests.length, 0);
+  // The broker builds the fork and the destination; the request's own are never read.
+  w.bus.credentials.issue("demo/coder", "gitea", TOKEN, "2099-01-01");
+  const reply = await w.publish(d, { fork: "https://127.0.0.1:1/other/stack", user: "other", dst: "refs/heads/main", ref: "refs/heads/main" });
+  assert.deepEqual(reply.result, { fork: `${w.gitea.origin}/coder/stack`, ref: "refs/heads/coder/feat", commit: w.work, previous: null });
+  for (const r of w.gitea.requests) assert.match(r.path, /^\/coder\/stack\//);
+  assert.equal(spawnSync("git", [`--git-dir=${w.forkRepo}`, "rev-parse", "-q", "--verify", "refs/heads/other/feat"], { env: gitEnv() }).status, 1);
+});
+
+test("T3 end to end: two agents, one project, each lands on its own fork only; the upstream receives nothing", async (t) => {
+  const w = await setup(t);
+  const second = await w.more("second", TASK2);
+  w.bus.credentials.issue("demo/coder", "gitea", TOKEN, "2099-01-01");
+  w.bus.credentials.issue("demo/second", "gitea", TOKEN2, "2099-01-01");
+  assert.equal((await w.publish(w.approve())).ok, true);
+  const coderRequests = w.gitea.requests.length;
+  for (const r of w.gitea.requests) assert.deepEqual([r.path.split("/")[1], r.user ?? "coder"], ["coder", "coder"]);
+  const reply = await w.publish(w.approve("second", TASK2), {}, "second", TASK2);
+  assert.deepEqual(reply.result, { fork: `${w.gitea.origin}/second/stack`, ref: "refs/heads/second/feat", commit: second, previous: null });
+  for (const r of w.gitea.requests.slice(coderRequests)) assert.deepEqual([r.path.split("/")[1], r.user ?? "second"], ["second", "second"]);
+  const refs = (owner) => git(w.root, `--git-dir=${w.gitea.repo(owner, "stack")}`, "for-each-ref", "--format=%(refname) %(objectname)");
+  assert.equal(refs("coder").includes(`refs/heads/coder/feat ${w.work}`), true);
+  assert.equal(refs("coder").includes("refs/heads/second/"), false);
+  assert.equal(refs("second").includes(`refs/heads/second/feat ${second}`), true);
+  assert.equal(refs("second").includes("refs/heads/coder/"), false);
+  assert.equal(refs("mosaic").split("\n").length, 1, "the upstream holds only main");
+});
+
+// sage-1440 on BUILD.md 14: a push between checkPublish and the git push refuses, with one code
+// for each place it can come in, and the fork never receives a commit the decision didn't bind.
+test("T3: a push after checkPublish and before the lock refuses ref-moved; the fork receives nothing", async (t) => {
+  const w = await setup(t);
+  w.bus.credentials.issue("demo/coder", "gitea", TOKEN, "2099-01-01");
+  w.hooks.checkPublish = async (m, next) => {
+    const facts = await next();
+    await w.again();
+    return facts;
+  };
+  assert.deepEqual(await w.publish(w.approve()), { ok: false, error: "ref-moved" });
+  assert.deepEqual(w.events("action.refused").map((e) => e.body.code), ["ref-moved"]);
+  assert.equal(w.gitea.requests.length, 0);
+  assert.equal(git(w.root, `--git-dir=${w.forkRepo}`, "for-each-ref", "refs/heads/coder/"), "");
+});
+
+test("T3: a push recorded while the bus process pushes refuses decision-mismatch; only the decision's commit reached the fork", async (t) => {
+  const w = await setup(t);
+  w.bus.credentials.issue("demo/coder", "gitea", TOKEN, "2099-01-01");
+  // The working repo's lock is held through the git push, so a socket push would wait for it; the
+  // broker's record of a newer push is what a push that won the lock leaves.
+  w.hooks.publishPush = async (m, next) => {
+    w.bus.checkPush(w.caps.coder, TASK);
+    w.bus.recordPush(w.caps.coder, { task_ref: TASK, project: "stack", branch: "feat", ref: workRef(TASK), commit: "c".repeat(40), previous: w.work });
+    return next();
+  };
+  assert.deepEqual(await w.publish(w.approve()), { ok: false, error: "decision-mismatch" });
+  assert.deepEqual(w.events("action.refused").map((e) => e.body.code), ["decision-mismatch"]);
+  assert.equal(w.events("action.allowed").filter((e) => e.body.action === "git.push.remote" && e.body.operation !== "decision.raise").length, 0);
+  assert.equal(git(w.root, `--git-dir=${w.forkRepo}`, "rev-parse", "refs/heads/coder/feat"), w.work);
+  assert.ok(w.logs.some((l) => l.includes("wasn't recorded")));
+});
+
+test("sage-1440: the publishResult poll is bounded: publish-timeout, filed once, and nothing recorded", async (t) => {
+  const w = await setup(t, { publishDeadlineMs: 150 });
+  let polls = 0;
+  w.hooks.publishResult = async () => {
+    polls++;
+    return { state: "running" };
+  };
+  assert.deepEqual(await w.publish(w.approve()), { ok: false, error: "publish-timeout" });
+  assert.ok(polls > 0);
+  assert.deepEqual(w.events("action.refused").map((e) => e.body.code), ["publish-timeout"]);
+  assert.equal(w.events("action.allowed").filter((e) => e.body.action === "git.push.remote" && e.body.operation !== "decision.raise").length, 0);
+  assert.ok(w.logs.some((l) => l.includes("publish-timeout")));
+});
@@ -381,7 +381,7 @@ async function seed(e,{copy=B,pm=false,store='3g',pointer:how='adopt'}={}){
 const rolledBack=(code,to=B)=>`stack-release: ${code}; rolled back to ${to}, which passed the gate\n`;
 const planBackup=(e)=>`backup: the run backs up the stopped store to ${e.data}/backups/stack/<activation>/ before any migration`;
 const planNoBackup='backup: none; the run rolls back before the backup';
-const planTail=(e,to,pm=false)=>[`bus: scripts/bus-service.sh install --copy ${to} --copies ${COPIES}${pm?' --pm':''} --claude ${e.claude}`,'proof: off',`Console: scripts/webui-service.sh install --copy ${to} --copies ${COPIES} --port ${e.port} --business acme`,`CLI: scripts/stack-copy.sh wrapper ${to} --copies ${COPIES} --bin ${e.bin}`];
+const planTail=(e,to,pm=false)=>[`bus: scripts/bus-service.sh install --copy ${to} --copies ${COPIES}${pm?' --pm':''} --claude ${e.claude}`,'proof: off','send: off',`Console: scripts/webui-service.sh install --copy ${to} --copies ${COPIES} --port ${e.port} --business acme`,`CLI: scripts/stack-copy.sh wrapper ${to} --copies ${COPIES} --bin ${e.bin}`];

 // --- The T table ---

@@ -1030,17 +1030,17 @@ test('T36 --plan shows the pending state and lists the row 169 refusals it can s
  return r.out.split('\n');
 };
 let out=await quiet(0,'activate',C1,'acme','--pm-after-harness','--plan');
- assert.deepEqual(out.slice(-6),['pm: the bus starts without --pm and the PM stays pending; next: Jason\'s plugins set of harness, then pm-on',...planTail(e,C1),'']);
+ assert.deepEqual(out.slice(-7),['pm: the bus starts without --pm and the PM stays pending; next: Jason\'s plugins set of harness, then pm-on',...planTail(e,C1),'']);
 biz(e,HARNESS);
 out=await quiet(3,'activate',A,'acme','--pm-after-harness','--plan');
- assert.deepEqual(out.slice(-7),['pm: the bus starts without --pm and the PM stays pending; next: Jason\'s plugins set of harness, then pm-on',...planTail(e,A),`refuses unknown-kind-for-target: the business file names plug-in kind(s) harness, which ${A} does not know`,'']);
+ assert.deepEqual(out.slice(-8),['pm: the bus starts without --pm and the PM stays pending; next: Jason\'s plugins set of harness, then pm-on',...planTail(e,A),`refuses unknown-kind-for-target: the business file names plug-in kind(s) harness, which ${A} does not know`,'']);
 out=await quiet(3,'activate',C1,'acme','--pm-after-harness','--plan');
 assert.equal(out.at(-2),'refuses pm-after-harness-set: the business file already sets harness ["claude-code"]; use --pm');
 biz(e);assert.equal((await run(e,'activate',C1,'acme','--pm-after-harness')).code,0);
 out=await quiet(3,'activate',C,'acme','--plan');
- assert.deepEqual(out.slice(-7),['pm: the pointer is pending (activate --pm-after-harness); the bus runs without its PM',...planTail(e,C,true),`refuses pm-pending: ${PENDING_MSG}`,'']);
+ assert.deepEqual(out.slice(-8),['pm: the pointer is pending (activate --pm-after-harness); the bus runs without its PM',...planTail(e,C,true),`refuses pm-pending: ${PENDING_MSG}`,'']);
 out=await quiet(0,'rollback','acme','--plan');
- assert.deepEqual(out.slice(-6),['pm: the pointer is pending (activate --pm-after-harness); the bus runs without its PM',...planTail(e,B,true),'']);
+ assert.deepEqual(out.slice(-7),['pm: the pointer is pending (activate --pm-after-harness); the bus runs without its PM',...planTail(e,B,true),'']);
 });

 // Row 176 test 11: supported and older Console copies deliberately differ from the checkout.
@@ -1706,6 +1706,113 @@ test('T54 row 188: a carried pair gets the proof file checks, and a proof file i
 });
 });

+// Row 189 (#1687, mos-0972/0973): activate --no-send drops the pointer's --send; nothing turns it back on.
+const sendLines=(out)=>out.filter((l)=>l.startsWith('send:'));
+const noSend=(c)=>c.filter((x)=>x!=='--send');
+const LIVE_NOTE=`note: ${B} is the pointer's copy; the run re-pins it and only the Console flags change`;
+test('T55 row 189: activate --no-send drops --send, and rollback and pm-on carry it off',async(t)=>{
+ await t.test('test 1: a live-copy --no-send drops --send from the pointer and the unit, keeps the rest in order, logs the step and backs up the stopped store',async(t)=>{
+  const e=await mk(t),base=await seedPreview(e,undefined,['--send','--tester-port','7333']),want=noSend(base);
+  assert.deepEqual(want.slice(-2),['--tester-port','7333']);
+  const sum=createHash('sha256').update(readFileSync(e.store)).digest('hex'),n=calls(e).length;
+  let r=await prun(e,'activate',B,'acme','--no-send');assert.equal(r.code,0,r.out+r.err);
+  assert.equal(pointer(e).copy,B);assert.deepEqual(pointer(e).console,want);
+  assert.ok(conExec(e).endsWith(` --checkout ${repo} ${want.join(' ')}`),conExec(e));assert.doesNotMatch(conExec(e),/ --send( |$)/);
+  r=await prun(e,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
+  assert.match(stepText(e),/Z drop --send; --no-send was given\n/);
+  const act=pointer(e).activation,l=logLines(e).at(-1);
+  assert.deepEqual([l.op,l.from,l.to,l.result,l.backup],['activate',B,B,'ok',act]);assert.equal(backupSum(e,act),sum);
+  assert.deepEqual(startsStops(e,n),[`stop ${CON}`,`stop ${BUS}`,`start ${BUS}`,`start ${CON}`]);
+  await noLeak(e);
+ });
+ await t.test('test 2: a plain live-copy activate still refuses already-active, and so does --no-send once --send is gone',async(t)=>{
+  const e=await mk(t);await seedPreview(e,undefined,['--send']);
+  await refused(e,['activate',B,'acme'],'already-active',`${B} is the pointer's copy`);
+  await refused(e,['activate',B,'acme','--tester-port','7333'],'already-active',`${B} is the pointer's copy`);
+  await refused(e,['activate',B,'acme','--no-proof'],'already-active',`${B} is the pointer's copy`);
+  const r=await prun(e,'activate',B,'acme','--no-send');assert.equal(r.code,0,r.out+r.err);
+  await refused(e,['activate',B,'acme','--no-send'],'already-active',`${B} is the pointer's copy`);
+  const g=await mk(t);await seedPreview(g);
+  await refused(g,['activate',B,'acme','--no-send'],'already-active',`${B} is the pointer's copy`);
+  for(const x of [e,g])await noLeak(x);
+ });
+ await t.test('test 3: --plan prints one send: line in each case, with the live-copy note on a same-copy run',async(t)=>{
+  const e=await mk(t),base=await seedPreview(e,undefined,['--send']);
+  let out=await planOnly(e,0,'activate',B,'acme','--no-send');
+  assert.deepEqual(sendLines(out),['send: dropped; --no-send was given']);
+  assert.deepEqual(out.filter((l)=>l.startsWith('note: ')),[LIVE_NOTE]);
+  assert.equal(out[out.indexOf('send: dropped; --no-send was given')+1],`Console: scripts/webui-service.sh install --copy ${B} --copies ${COPIES} ${noSend(base).join(' ')}`);
+  out=await planOnly(e,0,'activate',C1,'acme');
+  assert.deepEqual(sendLines(out),['send: carried']);assert.deepEqual(out.filter((l)=>l.startsWith('note: ')),[]);
+  assert.ok(out.find((l)=>l.startsWith('Console: ')).endsWith(' --send'));
+  assert.deepEqual(sendLines(await planOnly(e,0,'activate',C1,'acme','--no-send')),['send: dropped; --no-send was given']);
+  let r=await prun(e,'activate',C1,'acme','--no-send');assert.equal(r.code,0,r.out+r.err);
+  assert.deepEqual(pointer(e).console,noSend(base));assert.match(stepText(e),/Z drop --send; --no-send was given\n/);
+  assert.deepEqual(sendLines(await planOnly(e,0,'activate',B,'acme','--no-send')),['send: off; --no-send was given and the pointer holds no --send']);
+  assert.deepEqual(sendLines(await planOnly(e,0,'activate',B,'acme')),['send: off']);
+  assert.deepEqual(sendLines(await planOnly(e,0,'rollback','acme')),['send: off']);
+  r=await prun(e,'activate',B,'acme','--no-send');assert.equal(r.code,0,r.out+r.err);
+  assert.match(stepText(e),/Z --no-send was given and the pointer holds no --send, so there is nothing to drop\n/);
+  assert.doesNotMatch(stepText(e),/drop --send/);
+  await noLeak(e);
+ });
+ await t.test('test 4: after --no-send, a rollback to the earlier copy leaves --send out of the pointer and the unit',async(t)=>{
+  const e=await mk(t),base=await seedPreview(e,undefined,['--send']);
+  let r=await prun(e,'activate',C1,'acme','--no-send');assert.equal(r.code,0,r.out+r.err);
+  r=await prun(e,'rollback','acme');assert.equal(r.code,0,r.out+r.err);
+  assert.equal(pointer(e).copy,B);assert.deepEqual(pointer(e).console,noSend(base));assert.doesNotMatch(conExec(e),/ --send( |$)/);
+  assert.doesNotMatch(stepText(e),/--send/);
+  r=await prun(e,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
+  await noLeak(e);
+ });
+ await t.test('test 4: pm-on after --no-send keeps --send off',async(t)=>{
+  const e=await mk(t),base=await seedPreview(e,{pm:true},['--send']);
+  let r=await prun(e,'activate',C1,'acme','--pm-after-harness','--no-send');assert.equal(r.code,0,r.out+r.err);
+  biz(e,HARNESS);
+  r=await prun(e,'pm-on','acme');assert.equal(r.code,0,r.out+r.err);
+  assert.equal(pointer(e).pm,true);assert.deepEqual(pointer(e).console,noSend(base));assert.doesNotMatch(conExec(e),/ --send( |$)/);
+  r=await prun(e,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
+  await noLeak(e);
+ });
+ await t.test('test 5: --no-send on rollback, pm-on, status, adopt or rehearse is a usage error',async(t)=>{
+  const e=await mk(t);await seedPreview(e,undefined,['--send']);
+  const usageText=(await prun(e,'--help')).err,n=calls(e).length,logs=logLines(e).length,before=fp(e);
+  for(const args of [['rollback','acme','--no-send'],['rollback','acme','--plan','--no-send'],['pm-on','acme','--no-send'],['status','acme','--no-send'],['adopt','acme','--no-send'],
+   ['rehearse','acme','--backup','/tmp/x','--port','7400','--no-send']]){
+   const r=await prun(e,...args);assert.equal(r.code,4,args.join(' '));assert.equal(r.out,'');assert.equal(r.err,usageText);
+  }
+  assert.match(usageText,/\| --no-proof\] \[--no-send\]/);
+  assert.deepEqual(fp(e),before);assert.deepEqual(startsStops(e,n),[]);assert.equal(logLines(e).length,logs);
+  await noLeak(e);
+ });
+ await t.test('test 6: with both a pair and --send in the pointer, --no-send and --no-proof each drop what they name and keep the rest',async(t)=>{
+  const e=await mk(t),base=await seedPreview(e,undefined,['--send']),pre=noSend(base),f=await proofFile(e),g=await proofFile(e,'proof2.189',0o400);
+  let r=await prun(e,'activate',B,'acme',...pair(f));assert.equal(r.code,0,r.out+r.err);
+  assert.deepEqual(pointer(e).console,[...pre,...pair(f),'--send']);
+  let out=await planOnly(e,0,'activate',C1,'acme','--no-proof');
+  assert.deepEqual([...proofLines(out),...sendLines(out)],['proof: dropped; --no-proof drops header x-console-proof','send: carried']);
+  out=await planOnly(e,0,'activate',C1,'acme','--no-send');
+  assert.deepEqual([...proofLines(out),...sendLines(out)],['proof: carried, header x-console-proof','send: dropped; --no-send was given']);
+  out=await planOnly(e,0,'activate',B,'acme','--no-send','--no-proof');
+  assert.deepEqual([...proofLines(out),...sendLines(out)],['proof: dropped; --no-proof drops header x-console-proof','send: dropped; --no-send was given']);
+  r=await prun(e,'activate',C1,'acme','--no-send');assert.equal(r.code,0,r.out+r.err);
+  assert.deepEqual(pointer(e).console,[...pre,...pair(f)]);
+  r=await prun(e,'activate',C1,'acme','--no-send',...pair(g,'X-Proof-Two'));assert.equal(r.code,0,r.out+r.err);
+  assert.deepEqual(pointer(e).console,[...pre,...pair(g,'X-Proof-Two')]);
+  r=await prun(e,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
+  const h=await mk(t),hbase=await seedPreview(h,undefined,['--send']),hpre=noSend(hbase),k=await proofFile(h);
+  r=await prun(h,'activate',B,'acme',...pair(k));assert.equal(r.code,0,r.out+r.err);
+  r=await prun(h,'activate',C1,'acme','--no-proof');assert.equal(r.code,0,r.out+r.err);
+  assert.deepEqual(pointer(h).console,[...hpre,'--send']);
+  r=await prun(h,'activate',C1,'acme','--no-send','--no-proof');assert.equal(r.code,0,r.out+r.err);
+  assert.deepEqual(pointer(h).console,hpre);assert.doesNotMatch(conExec(h),/--proof-| --send( |$)/);
+  const steps=stepText(h);
+  assert.match(steps,/Z --no-proof was given and the pointer holds no proof pair, so there is nothing to drop\n/);assert.match(steps,/Z drop --send; --no-send was given\n/);
+  r=await prun(h,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
+  for(const x of [e,h])await noLeak(x);
+ });
+});
+
 // --- rehearse (D2, row 163; the brief's "Stack rehearsal on a scratch root") ---
 // Copies of their own in RCOPIES: the real scripts/mosaic, config loader, business loader, roles and
 // mosaic-config.mjs, with stand-ins for the bus host (cli.mjs), the Console, the Store and
@@ -101,8 +101,10 @@ export function gitEnv(env = process.env) {
 // consequence: a Ctrl-C at the terminal of a host run by hand no longer
 // reaches its git, though a systemd stop still does (it kills the cgroup).
 // `stdin` names a file git reads as its input (row 137: patch-id); without
-// it git gets none.
-export function runGit(argv, env, limits = GIT_LIMITS, { stdin = null } = {}) {
+// it git gets none. `pass` (row 199, publish) is written once to a pipe on
+// fd 3, which git and what it starts inherit; publish's credential helper
+// reads its token there, so the token is in no argv, env, URL or file.
+export function runGit(argv, env, limits = GIT_LIMITS, { stdin = null, pass = null } = {}) {
  return new Promise((resolve) => {
    let input = "ignore";
    try {
@@ -110,8 +112,10 @@ export function runGit(argv, env, limits = GIT_LIMITS, { stdin = null } = {}) {
    } catch (e) {
      return resolve({ ok: false, out: "", err: "", why: e.code ?? e.message });
    }
-    const child = spawn("git", argv, { env, detached: true, stdio: [input, "pipe", "pipe"] });
+    const child = spawn("git", argv, { env, detached: true, stdio: [input, "pipe", "pipe", ...(pass === null ? [] : ["pipe"])] });
    if (typeof input === "number") closeSync(input);
+    // A git that never asked for it closes the pipe unread: EPIPE is no fault.
+    if (pass !== null) child.stdio[3].on("error", () => {}).end(pass);
    let out = "";
    let err = "";
    let signalled = false;
@@ -63,6 +63,22 @@
 //     compare and swap (base-moved), then record() runs; when it throws, main
 //     goes back, and a main that can't go back refuses rollback-failed.
 // dropLand removes the worktree; the caller runs it on every path.
+//
+// publish (row 199, #1697, design D9 to D9b) sends a recorded work commit to
+// the agent's own fork. It runs in two processes, because the gitea token
+// lives in the bus process and the lock in the host's:
+//   publish, in the host, under the lock: the seed; the work ref is at the
+//     source commit (ref-moved); every commit in main..source has author and
+//     committer email equal to the agent's (identity-mismatch); then
+//     remote(), which the caller wires to publishRemote in the bus process.
+//   publishRemote, in the bus process, with the token on fd 3 only:
+//     `ls-remote --symref <fork> HEAD <dst>`; a non-zero exit refuses
+//     fork-unavailable. The fork's HEAD must be a commit this repository has
+//     and an ancestor of main (remote-unrelated, an empty fork included).
+//     Then `push <fork> <source>:<dst>` by oid, with no `+`. Only https
+//     crosses (protocol.https.allow), redirects are refused, and output
+//     holding the token refuses credential-leak. Git's stderr is never
+//     returned: it can carry the URL.

 import { randomBytes } from "node:crypto";
 import { closeSync, lstatSync, mkdirSync, openSync, readSync, renameSync, rmSync, writeFileSync } from "node:fs";
@@ -101,7 +117,7 @@ export const FSCK = ["-c", "transfer.fsckObjects=true"];

 // `limits` is { timeoutMs, graceMs }; the tests shorten them. runGit
 // (checkout.mjs) runs git in its own process group and signals the group.
-const git = (args, env, { pre = [], limits = GIT_LIMITS, stdin = null } = {}) => runGit([...SAFE, ...pre, ...args], gitEnv(env), limits, { stdin });
+const git = (args, env, { pre = [], limits = GIT_LIMITS, stdin = null, pass = null } = {}) => runGit([...SAFE, ...pre, ...args], gitEnv(env), limits, { stdin, pass });
 // git with this call's env and limits, for the helpers below.
 const bound = (env, limits) => (args, opts = {}) => git(args, env, { ...opts, limits });

@@ -402,3 +418,75 @@ async function removeWorktree(repo, worktree, g) {
  if (!r.ok) rmSync(worktree, { recursive: true, force: true });
  await g([`--git-dir=${repo}`, "worktree", "prune"]);
 }
+
+// await publish({ dataRoot, business, project, root, taskRef, source, email, remote, env, limits })
+// Resolves what remote() resolves; rejects with WorkingError.
+export function publish({ dataRoot, business, project, root, taskRef, source, email, remote, env = process.env, limits = GIT_LIMITS }) {
+  if (!PROJECT.test(project ?? "") || !OID.test(source ?? "") || typeof email !== "string" || !email) refuse("invalid-request");
+  const ref = `refs/heads/${workRef(taskRef)}`;
+  const repo = workingRepo(dataRoot, business, project);
+  const g = bound(env, limits);
+  return locked(repo, async () => {
+    try {
+      if (!lstatSync(repo).isDirectory()) refuse("working-repo-invalid");
+    } catch (e) {
+      if (e instanceof WorkingError) throw e;
+      refuse("working-repo-invalid", `${repo} can't be read: ${e.code}`);
+    }
+    await seed(repo, root, g);
+    const at = `--git-dir=${repo}`;
+    if ((await tip(repo, ref, g)) !== source) refuse("ref-moved", `${ref} isn't at ${source}`);
+    const range = await g([at, "log", "--format=%ae%x00%ce", `refs/heads/main..${source}`]);
+    if (!range.ok) refuse("working-repo-invalid", range.why);
+    for (const line of range.out.split("\n").filter(Boolean)) {
+      if (line !== `${email}\0${email}`) refuse("identity-mismatch", `a commit in main..${source.slice(0, 12)} isn't by ${email}`);
+    }
+    return remote();
+  });
+}
+
+const HOST = /^[a-z0-9.-]{1,253}(:[0-9]{1,5})?$/;
+const NAME = /^[A-Za-z0-9_.-]{1,100}$/;
+// The one-shot helper: for a `get` on https at exactly the fork's host and
+// port, it answers the user and the line it reads from fd 3. Anything else,
+// and `store` and `erase`, gets no answer. HOST and NAME keep both shell-safe.
+const helper = (host, user) =>
+  `!f() { test "$1" = get || exit 0; p=; h=; while IFS= read -r l; do case "$l" in protocol=*) p=\${l#protocol=};; host=*) h=\${l#host=};; "") break;; esac; done; ` +
+  `test "$p" = https && test "$h" = '${host}' || exit 0; IFS= read -r t <&3 || exit 0; printf 'username=%s\\npassword=%s\\n' '${user}' "$t"; }; f`;
+
+// await publishRemote({ repo, fork, user, source, dst, token, tls, env, limits })
+// Resolves { ref, commit, previous }, previous being dst's tip on the fork
+// before the push, or null. `tls` is for the tests' scratch CA only.
+export async function publishRemote({ repo, fork, user, source, dst, token, tls = [], env = process.env, limits = GIT_LIMITS }) {
+  let url;
+  try {
+    url = new URL(fork);
+  } catch {
+    refuse("invalid-request");
+  }
+  if (url.protocol !== "https:" || !HOST.test(url.host) || !NAME.test(user ?? "") || !OID.test(source ?? "") || !dst?.startsWith(`refs/heads/${user}/`)) refuse("invalid-request");
+  const secret = String(token).trim();
+  const net = async (args) => {
+    const pre = [...tls, "-c", "protocol.https.allow=always", "-c", "http.followRedirects=false", "-c", "credential.helper=", "-c", `credential.helper=${helper(url.host, user)}`];
+    const r = await git([`--git-dir=${repo}`, ...args], env, { pre, limits, pass: `${secret}\n` });
+    if (r.out.includes(secret) || r.err.includes(secret)) refuse("credential-leak");
+    return r;
+  };
+  const g = bound(env, limits);
+  const listed = await net(["ls-remote", "--symref", fork, "HEAD", dst]);
+  if (!listed.ok) refuse("fork-unavailable");
+  let head = null;
+  let previous = null;
+  for (const line of listed.out.split("\n")) {
+    const [oid, name] = line.split("\t");
+    if (!OID.test(oid ?? "")) continue;
+    if (name === "HEAD") head = oid;
+    else if (name === dst) previous = oid;
+  }
+  if (!head) refuse("remote-unrelated", "the fork is empty");
+  const known = await g([`--git-dir=${repo}`, "cat-file", "-e", `${head}^{commit}`]);
+  if (!known.ok || !(await g([`--git-dir=${repo}`, "merge-base", "--is-ancestor", head, "refs/heads/main"])).ok) refuse("remote-unrelated", "the fork's HEAD isn't in main's history");
+  const pushed = await net(["push", "--porcelain", "--no-follow-tags", fork, `${source}:${dst}`]);
+  if (!pushed.ok) refuse(/\((non-fast-forward|fetch first)\)/.test(pushed.out) ? "non-fast-forward" : "push-failed");
+  return { ref: dst, commit: source, previous };
+}
@@ -0,0 +1,95 @@
+// Row 199 (#1697, design T3): a fake Gitea for publish, on 127.0.0.1 over TLS with a scratch CA,
+// serving bare repositories under `<dir>/repos/<user>/<repo>.git` through git http-backend. Every
+// request needs Basic auth with the user and token it was made with, or with any pair in `users`,
+// as a private repository on Gitea does. It records each request's method, path and user, never the password. `redirect`
+// makes every request a 302 to `redirect`. A repository's own hooks run on a push, so a test can
+// make the fork echo something back as `remote:` lines. Nothing here leaves 127.0.0.1.
+import { spawn, spawnSync } from "node:child_process";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { createServer } from "node:https";
+import { join } from "node:path";
+
+// A CA and a server certificate for IP 127.0.0.1, made once per directory with openssl.
+export function scratchCa(dir) {
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const ssl = (...args) => {
+    const r = spawnSync("openssl", args, { cwd: dir, encoding: "utf8" });
+    if (r.status !== 0) throw new Error(`openssl ${args[0]}: ${r.stderr}`);
+  };
+  ssl("req", "-x509", "-newkey", "ec", "-pkeyopt", "ec_paramgen_curve:P-256", "-nodes", "-keyout", "ca.key", "-out", "ca.pem", "-days", "2", "-subj", "/CN=mosaic test CA");
+  ssl("req", "-newkey", "ec", "-pkeyopt", "ec_paramgen_curve:P-256", "-nodes", "-keyout", "server.key", "-out", "server.csr", "-subj", "/CN=127.0.0.1");
+  writeFileSync(join(dir, "san.ext"), "subjectAltName=IP:127.0.0.1\n");
+  ssl("x509", "-req", "-in", "server.csr", "-CA", "ca.pem", "-CAkey", "ca.key", "-CAcreateserial", "-out", "server.pem", "-days", "2", "-extfile", "san.ext");
+  return { ca: join(dir, "ca.pem"), key: readFileSync(join(dir, "server.key")), cert: readFileSync(join(dir, "server.pem")) };
+}
+
+export async function fakeGitea({ dir, tls, user, token, users = { [user]: token }, redirect = null }) {
+  const root = join(dir, "repos");
+  mkdirSync(root, { recursive: true });
+  const requests = [];
+  const server = createServer({ key: tls.key, cert: tls.cert }, (req, res) => {
+    const url = new URL(req.url, "https://127.0.0.1");
+    const auth = /^Basic (.+)$/.exec(req.headers.authorization ?? "");
+    const [who, pass] = auth ? Buffer.from(auth[1], "base64").toString().split(":") : [null, null];
+    requests.push({ method: req.method, path: url.pathname, user: who });
+    if (redirect) {
+      res.writeHead(302, { location: redirect + req.url });
+      return res.end();
+    }
+    if (!who || !Object.hasOwn(users, who) || pass !== users[who]) {
+      res.writeHead(401, { "www-authenticate": 'Basic realm="Gitea"' });
+      return res.end();
+    }
+    // /<owner>/<repo>/info/refs and the like, on <root>/<owner>/<repo>.git.
+    const m = /^\/([^/]+)\/([^/]+?)(?:\.git)?(\/.*)$/.exec(url.pathname);
+    if (!m) {
+      res.writeHead(404);
+      return res.end();
+    }
+    const cgi = spawn("git", ["http-backend"], {
+      env: {
+        PATH: process.env.PATH,
+        GIT_PROJECT_ROOT: root,
+        GIT_HTTP_EXPORT_ALL: "1",
+        GIT_CONFIG_NOSYSTEM: "1",
+        GIT_CONFIG_GLOBAL: "/dev/null",
+        HOME: "/nonexistent",
+        PATH_INFO: `/${m[1]}/${m[2]}.git${m[3]}`,
+        REQUEST_METHOD: req.method,
+        QUERY_STRING: url.search.slice(1),
+        CONTENT_TYPE: req.headers["content-type"] ?? "",
+        HTTP_CONTENT_ENCODING: req.headers["content-encoding"] ?? "",
+        GIT_PROTOCOL: req.headers["git-protocol"] ?? "",
+        REMOTE_USER: who,
+        REMOTE_ADDR: "127.0.0.1",
+      },
+      stdio: ["pipe", "pipe", "ignore"],
+    });
+    req.pipe(cgi.stdin);
+    const chunks = [];
+    cgi.stdout.on("data", (c) => chunks.push(c));
+    cgi.on("close", () => {
+      const out = Buffer.concat(chunks);
+      const split = out.indexOf("\r\n\r\n");
+      const head = out.subarray(0, split).toString().split("\r\n");
+      const headers = {};
+      let status = 200;
+      for (const line of head) {
+        const [k, ...v] = line.split(":");
+        if (k.toLowerCase() === "status") status = Number.parseInt(v.join(":").trim(), 10);
+        else headers[k] = v.join(":").trim();
+      }
+      res.writeHead(status, headers);
+      res.end(out.subarray(split + 4));
+    });
+  });
+  await new Promise((r) => server.listen(0, "127.0.0.1", r));
+  const port = server.address().port;
+  return {
+    port,
+    origin: `https://127.0.0.1:${port}`,
+    requests,
+    repo: (owner, name) => join(root, owner, `${name}.git`),
+    close: () => new Promise((r) => server.close(r)),
+  };
+}
@@ -0,0 +1,185 @@
+// Row 199 (#1697, design D9 step 3 to 5, D9a, T3): publish and publishRemote (src/working.mjs)
+// against a TLS fake Gitea on 127.0.0.1 (fake-gitea.mjs) with a scratch CA, passed only through
+// the `tls` parameter. Fake tokens in a scratch root. Each refusal that should reach the network
+// checks the fake saw the request, so no case passes because git refused https first.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { gitEnv } from "../src/checkout.mjs";
+import { publish, publishRemote, push, workingRepo } from "../src/working.mjs";
+import { fakeGitea, scratchCa } from "./fake-gitea.mjs";
+
+const TASK = "vikunja:1/2";
+const TOKEN = "fake_publish_token_0123456789";
+const USER = "coder";
+const EMAIL = "[email protected]";
+const DST = "refs/heads/coder/feat";
+
+function git(cwd, ...args) {
+  const r = spawnSync("git", args, { cwd, encoding: "utf8", env: gitEnv() });
+  assert.equal(r.status, 0, `git ${args.join(" ")}: ${r.stderr}`);
+  return r.stdout.trim();
+}
+function commit(dir, text, email = EMAIL) {
+  writeFileSync(join(dir, "README"), `${text}\n`);
+  git(dir, "add", "README");
+  git(dir, "-c", `user.name=${text}`, "-c", `user.email=${email}`, "commit", "-q", "-m", text);
+  return git(dir, "rev-parse", "HEAD");
+}
+const rejects = (p, code) => assert.rejects(p, (e) => e.code === code || assert.fail(`${e.code}: ${e.message}, wanted ${code}`));
+
+// A root, a coder's clone with work on feat pushed to the working repo, and a fake Gitea whose
+// coder/stack fork is a bare clone of the root.
+async function world(t, { fork = true, redirect = null } = {}) {
+  const dir = mkdtempSync(join(tmpdir(), "mosaic-publish-"));
+  t.after(() => rmSync(dir, { recursive: true, force: true }));
+  const root = join(dir, "root");
+  mkdirSync(root);
+  git(root, "init", "-q", "-b", "main");
+  const first = commit(root, "one", "[email protected]");
+  const clone = join(dir, "clone");
+  git(dir, "clone", "-q", root, clone);
+  git(clone, "checkout", "-q", "-b", "feat");
+  const work = commit(clone, "work");
+  const dataRoot = join(dir, "data");
+  mkdirSync(dataRoot, { mode: 0o700 });
+  const file = join(dir, "b.bundle");
+  git(clone, "bundle", "create", "-q", file, "refs/heads/feat", "--not", "--remotes=origin");
+  await push({ dataRoot, business: "acme", project: "stack", root, taskRef: TASK, branch: "feat", bundle: file });
+  const ca = scratchCa(join(dir, "ca"));
+  const gitea = await fakeGitea({ dir: join(dir, "gitea"), tls: ca, user: USER, token: TOKEN, redirect });
+  t.after(() => gitea.close());
+  const forkRepo = gitea.repo(USER, "stack");
+  if (fork) {
+    mkdirSync(join(forkRepo, ".."), { recursive: true });
+    git(dir, "clone", "-q", "--bare", root, forkRepo);
+  }
+  const tls = ["-c", `http.sslCAInfo=${ca.ca}`];
+  const repo = workingRepo(dataRoot, "acme", "stack");
+  const remote = (extra = {}) => publishRemote({ repo, fork: `${gitea.origin}/${USER}/stack`, user: USER, source: work, dst: DST, token: TOKEN + "\n", tls, ...extra });
+  const go = (extra = {}) => publish({ dataRoot, business: "acme", project: "stack", root, taskRef: TASK, source: work, email: EMAIL, remote: () => remote(), ...extra });
+  return { dir, root, first, clone, work, dataRoot, repo, gitea, forkRepo, tls, remote, go };
+}
+
+test("T3: publish pushes the work commit by oid to <user>/<branch> on the fork, with the token only through the helper", async (t) => {
+  const w = await world(t);
+  assert.deepEqual(await w.go(), { ref: DST, commit: w.work, previous: null });
+  assert.equal(git(w.dir, `--git-dir=${w.forkRepo}`, "rev-parse", DST), w.work);
+  // Every request went to the fork's path, and each one that carried auth carried the agent's user.
+  assert.ok(w.gitea.requests.length > 0);
+  for (const r of w.gitea.requests) assert.match(r.path, /^\/coder\/stack\/(info\/refs|git-receive-pack|git-upload-pack)$/);
+  assert.ok(w.gitea.requests.some((r) => r.user === USER && r.path.endsWith("git-receive-pack")));
+  // A second publish of the same commit is a no-op push and names the previous tip.
+  assert.deepEqual(await w.go(), { ref: DST, commit: w.work, previous: w.work });
+  // The working repo holds no remote and no credential config.
+  assert.equal(spawnSync("git", [`--git-dir=${w.repo}`, "config", "--get-regexp", "^(remote|credential)\\."], { env: gitEnv() }).stdout.toString(), "");
+});
+
+test("T3: a moved fork branch refuses non-fast-forward; no + and no force", async (t) => {
+  const w = await world(t);
+  const other = join(w.dir, "other");
+  git(w.dir, "clone", "-q", w.root, other);
+  const elsewhere = commit(other, "elsewhere");
+  git(other, "push", "-q", w.forkRepo, `${elsewhere}:${DST}`);
+  await rejects(w.go(), "non-fast-forward");
+  assert.equal(git(w.dir, `--git-dir=${w.forkRepo}`, "rev-parse", DST), elsewhere);
+});
+
+test("T3: D9a: an empty fork and an unrelated fork refuse remote-unrelated; a missing fork refuses fork-unavailable", async (t) => {
+  const empty = await world(t, { fork: false });
+  git(empty.dir, "init", "-q", "--bare", empty.forkRepo);
+  await rejects(empty.go(), "remote-unrelated");
+  assert.ok(empty.gitea.requests.length > 0);
+  assert.equal(empty.gitea.requests.some((r) => r.path.endsWith("git-receive-pack")), false);
+
+  const unrelated = await world(t, { fork: false });
+  const alone = join(unrelated.dir, "alone");
+  mkdirSync(alone);
+  git(alone, "init", "-q", "-b", "main");
+  commit(alone, "unrelated");
+  git(unrelated.dir, "clone", "-q", "--bare", alone, unrelated.forkRepo);
+  await rejects(unrelated.go(), "remote-unrelated");
+  assert.equal(unrelated.gitea.requests.some((r) => r.path.endsWith("git-receive-pack")), false);
+
+  const missing = await world(t, { fork: false });
+  await rejects(missing.go(), "fork-unavailable");
+  assert.ok(missing.gitea.requests.length > 0);
+});
+
+test("T3: a fork past main refuses remote-unrelated until root catches up", async (t) => {
+  const w = await world(t);
+  const other = join(w.dir, "other");
+  git(w.dir, "clone", "-q", w.forkRepo, other);
+  const ahead = commit(other, "ahead");
+  git(other, "push", "-q", w.forkRepo, `${ahead}:refs/heads/main`);
+  await rejects(w.go(), "remote-unrelated");
+});
+
+test("T3: a wrong token refuses fork-unavailable; git's stderr isn't in the refusal", async (t) => {
+  const w = await world(t);
+  await assert.rejects(w.remote({ token: "fake_wrong_token_0123456789" }), (e) => e.code === "fork-unavailable" && e.message === "fork-unavailable");
+  assert.ok(w.gitea.requests.length > 0);
+  assert.equal(git(w.dir, `--git-dir=${w.forkRepo}`, "for-each-ref", DST), "");
+});
+
+test("T3: a 302 is not followed: fork-unavailable, and the target sees no request", async (t) => {
+  const w = await world(t);
+  const target = await fakeGitea({ dir: join(w.dir, "target"), tls: scratchCa(join(w.dir, "ca2")), user: USER, token: TOKEN });
+  t.after(() => target.close());
+  const bounce = await fakeGitea({ dir: join(w.dir, "bounce"), tls: scratchCa(join(w.dir, "ca3")), user: USER, token: TOKEN, redirect: target.origin });
+  t.after(() => bounce.close());
+  const tls = ["-c", `http.sslCAInfo=${join(w.dir, "ca3", "ca.pem")}`];
+  await rejects(w.remote({ fork: `${bounce.origin}/${USER}/stack`, tls }), "fork-unavailable");
+  assert.ok(bounce.requests.length > 0);
+  assert.equal(target.requests.length, 0);
+});
+
+test("T3: the helper answers only the fork's host and port: a fork on another port gets no token", async (t) => {
+  const w = await world(t);
+  // The fork names port 1; insteadOf (through the tests' tls parameter) sends git to the fake's
+  // port. The helper was told port 1, so it answers nothing and no password goes out.
+  const before = w.gitea.requests.length;
+  await rejects(w.remote({ fork: `https://127.0.0.1:1/${USER}/stack`, tls: [...w.tls, "-c", `url.https://127.0.0.1:${w.gitea.port}/.insteadOf=https://127.0.0.1:1/`] }), "fork-unavailable");
+  assert.ok(w.gitea.requests.length > before, "the rewritten URL reached the fake");
+  assert.equal(w.gitea.requests.slice(before).some((r) => r.user !== null), false, "no credential went to a host the helper wasn't told");
+});
+
+test("T3: a fork that echoes the token refuses credential-leak", async (t) => {
+  const w = await world(t);
+  const hook = join(w.forkRepo, "hooks", "pre-receive");
+  writeFileSync(hook, `#!/bin/sh\necho ${TOKEN} >&2\nexit 0\n`);
+  chmodSync(hook, 0o755);
+  await rejects(w.go(), "credential-leak");
+});
+
+test("T3: no tls parameter, no trust: the scratch CA reaches git only through it", async (t) => {
+  const w = await world(t);
+  await rejects(w.remote({ tls: [] }), "fork-unavailable");
+});
+
+test("D9 steps 3 and 4: ref-moved and identity-mismatch refuse before any request", async (t) => {
+  const w = await world(t);
+  await rejects(w.go({ source: w.first }), "ref-moved");
+  const other = commit(w.clone, "by someone else", "[email protected]");
+  const file = join(w.dir, "b2.bundle");
+  git(w.clone, "bundle", "create", "-q", file, "refs/heads/feat", "--not", "--remotes=origin");
+  await push({ dataRoot: w.dataRoot, business: "acme", project: "stack", root: w.root, taskRef: TASK, branch: "feat", bundle: file });
+  await rejects(w.go({ source: other }), "identity-mismatch");
+  assert.equal(w.gitea.requests.length, 0);
+});
+
+test("publishRemote refuses a fork, user or destination that isn't shell- and ref-safe before any git", async (t) => {
+  const w = await world(t);
+  for (const extra of [
+    { fork: `http://127.0.0.1:${w.gitea.port}/${USER}/stack` },
+    { fork: `https://127.0.0.1:${w.gitea.port}'/${USER}/stack` },
+    { user: "co'der" },
+    { dst: "refs/heads/main" },
+    { dst: "refs/heads/pm/feat" },
+    { source: "HEAD" },
+  ]) await rejects(w.remote(extra), "invalid-request");
+  assert.equal(w.gitea.requests.length, 0);
+});
@@ -80,7 +80,11 @@ export function tasksAdapter({
        tree: null,
        bots: new Set([businesses[name].tracker.sync.botId, ...Object.values(s.roles).map((r) => r.botId)]),
        sync: use('@sync'),
-        as: (role, method, path, opts) => use(role)(method, path, opts),
+        // Row 199 (#1697, design D5): a request's call keys from the broker's session for its cap,
+        // never from a role name. probe is the host's own start check of each role's token.
+        as: (session, method, path, opts) =>
+          credentials.useFor(session, 'vikunja', (token) => call(token, method, path, opts)),
+        probe: (role, method, path, opts) => use(role)(method, path, opts),
        state: 'starting',
        refused: null,
        queue: Promise.resolve(),
@@ -96,7 +100,7 @@ export function tasksAdapter({
        timers: [],
      };
      ctx.syncCall = (_token, method, path, opts) => ctx.sync(method, path, opts);
-      ctx.asCall = (role) => (_token, method, path, opts) => ctx.as(role, method, path, opts);
+      ctx.asCall = (role) => (_token, method, path, opts) => ctx.probe(role, method, path, opts);
      ctx.handle = verbs(ctx);
      contexts.set(name, ctx);
    }
@@ -41,7 +41,7 @@ export async function startup(ctx) {
  if (probe.status === 404 || probe.status === 403 || outcome(probe) === 'ok') refuse('scope-too-broad');
  expect(probe, 401, 'tracker-unexpected');
  for (const [role, r] of Object.entries(ctx.roles)) {
-    const control = await ctx.as(role, 'GET', `/tasks/${MISSING}`);
+    const control = await ctx.probe(role, 'GET', `/tasks/${MISSING}`);
    if (control.status !== 404 || control.json?.code !== 4002) {
      expect(control, 404, 'tracker-unexpected');
      refuse('tracker-unexpected');
@@ -49,7 +49,7 @@ export async function startup(ctx) {
    const probes = [['DELETE', `/tasks/${MISSING}`, undefined]];
    if (r.definition !== 'pm') probes.push(['POST', `/tasks/${MISSING}/labels`, { label_id: 1 }]);
    for (const [method, path, body] of probes) {
-      const p = await ctx.as(role, method, path, { body });
+      const p = await ctx.probe(role, method, path, { body });
      if (p.status === 404 || p.status === 403 || outcome(p) === 'ok') refuse('scope-too-broad');
      if (p.status !== 401) refuse(p.status === 0 || p.status >= 500 ? 'tracker-unavailable' : 'tracker-unexpected');
    }
@@ -122,8 +122,9 @@ export function verbs(ctx) {
  const relatedTo = (task, kind, other) =>
    Array.isArray(task.related_tasks?.[kind]) && task.related_tasks[kind].some((t) => t?.id === other);
  // One write with the acting role's token. An uncertain answer is settled by a re-read.
-  async function step(role, method, path, body, at, done) {
-    const r = await ctx.as(role, method, path, { body });
+  // `me` is the broker's session for the caller's cap (design D5).
+  async function step(me, method, path, body, at, done) {
+    const r = await ctx.as(me, method, path, { body });
    const o = outcome(r);
    if (o === 'ok') return r;
    if (o === 'uncertain' && at !== null && done) {
@@ -144,7 +145,7 @@ export function verbs(ctx) {
    if (!mine) fail('tracker-role');
    if (PM_VERBS.has(verb) && mine.definition !== 'pm') fail('field-writer');
    const plan = prepare(verb, args, role, mine);
-    if (verb === 'task.create') return create(cap, role, plan);
+    if (verb === 'task.create') return create(cap, me, plan);
    const at = target(args.task_ref);
    const before = await read(at);
    if (args.expect !== undefined && args.expect !== before.digest) {
@@ -165,7 +166,7 @@ export function verbs(ctx) {
    let landed = 0;
    try {
      for (const [method, path, body, done] of work.steps) {
-        await step(role, method, path, body, at, done);
+        await step(me, method, path, body, at, done);
        landed++;
      }
    } catch (e) {
@@ -385,12 +386,12 @@ export function verbs(ctx) {
        fail('unknown-verb');
    }
  }
-  async function create(cap, role, plan) {
+  async function create(cap, me, plan) {
    if (!ctx.broker.taskView(ctx.business, 'input', plan.request)) fail('request-not-found');
    await located(plan.others);
    ctx.broker.authorize(cap, 'task.create', { decision: plan.decision, target: null });
    // No re-read can find a create whose answer was lost, so an uncertain create is reported as such.
-    const r = await step(role, 'POST', `/projects/${plan.at.project}/tasks`, plan.body, null, null);
+    const r = await step(me, 'POST', `/projects/${plan.at.project}/tasks`, plan.body, null, null);
    if (r.status !== 201 && r.status !== 200) fail('tracker-unexpected');
    checkTask(r.json);
    const id = r.json.id;
@@ -399,9 +400,9 @@ export function verbs(ctx) {
    let failure = null;
    try {
      for (const l of plan.labels)
-        await step(role, 'POST', `/tasks/${id}/labels`, { label_id: l }, at, (a) => a.fields.labels.includes(l));
+        await step(me, 'POST', `/tasks/${id}/labels`, { label_id: l }, at, (a) => a.fields.labels.includes(l));
      for (const x of plan.relations)
-        await step(role, 'POST', `/tasks/${id}/relations`, { other_task_id: x.other, relation_kind: x.kind }, at, (a) =>
+        await step(me, 'POST', `/tasks/${id}/relations`, { other_task_id: x.other, relation_kind: x.kind }, at, (a) =>
          relatedTo(a.task, x.kind, x.other),
        );
    } catch (e) {
@@ -129,45 +129,6 @@ Switching the Console, bus or wrapper, changing any unit, and starting or
 stopping either service requires Mos's go for that live step. Agents build
 and test fixtures; they stop before the live sequence.

-## Sign-in in the Console (Q175 phase 1, #1690)
-
-`serve --sso [--send] [--tester-port N]` makes the Console an OpenID Connect
-relying party. It reads `console.sso` from the system config (`publicOrigin`
-and one or more providers, each with its issuer, client id, a client secret
-slot, the signing algorithms it accepts and the subjects allowed in). The
-design is `agents/sage/work/q175-sso/DESIGN.md`. `--sso` can't be combined
-with `--public-host`, `--auth-header`, `--allow-user` or `--proof-*`; `--send`
-takes `--sso` in place of the preview set.
-
- The client secret is read once at start from
-  `<config dir>/secrets/mosaic-stack/<slot>`. The start refuses a slot that is
-  a symbolic link, not a regular file, owned by another user, has any group or
-  other mode bit, or sits in the repository, the `--checkout` directory or a
-  stack copy. The value is never printed.
- At start the Console fetches each provider's discovery document and JWKS. A
-  provider that can't be reached (a network error, a timeout, a status other
-  than 200, or a body that isn't JSON) leaves the Console up with that
-  provider's `/auth/login` at 503 and a retry every 5 s, doubling, capped at 5
-  minutes. A document that fails a check (issuer, algorithms, S256, a usable
-  key) refuses the start. `/healthz` adds `sso: { <id>: "ready" | "unreachable"
-  | "refused" }`.
- The Console listener serves only the Host of `publicOrigin`, whatever port
-  it listens on. Any other Host, a loopback one included, gets 403 `public
-  Host required`, except `GET /healthz`, which stays open on loopback for the
-  status and release gates. The loopback operator path in the preview section
-  above does not exist under `--sso`.
- Without a session, `/api/*` gets 401 `sign-in required` and a page load gets
-  a 303 to `/auth/login?return=<path>`. The page then shows the signed-out line
-  with a link back to sign-in. A session lasts at most 8 hours and ends after 1
-  hour without a page load or a write; a restart ends every session.
- The page shows Sign out only under `--sso`. It posts to `/auth/logout`, which
-  ends the session and goes to the provider's end-session endpoint when it has
-  one, or to `/auth/signed-out`.
- With `--tester-port`, the tester listener refuses any request carrying an
-  `Authorization` header, a `__Host-mosaic_session` or `__Host-mosaic_login`
-  cookie, or an `x-authentik-*` header (403 `tester listener takes no
-  sign-in`). It never serves `/auth/*`.
-
 ## Message a role (row 76, #1570)

 ```sh
@@ -58,9 +58,8 @@ export async function chatHTTP(req, res, { path, search, chat, named, send, prev
      if (one(req, 'origin') !== preview.origin) return refuse(403, 'cross-origin');
    } else {
      if (!send || !named || !preview) return refuse(403, 'read-only');
-      // Q175 phase 1 (#1690): under --sso the session was checked before this route.
-      if (preview.sso !== true && one(req, preview.header) !== preview.user) return refuse(401, 'unauthenticated');
-      if (one(req, 'origin') !== (preview.origin ?? `https://${preview.host}`)) return refuse(403, 'cross-origin');
+      if (one(req, preview.header) !== preview.user) return refuse(401, 'unauthenticated');
+      if (one(req, 'origin') !== `https://${preview.host}`) return refuse(403, 'cross-origin');
    }
    if (one(req, 'sec-fetch-site') !== 'same-origin') return refuse(403, 'cross-site');
  }
@@ -7,23 +7,20 @@ import { views } from '../../bus/src/views.mjs';
 import { loadSystem, socketPath, REPO, rolesDir } from '../../cli/src/config.mjs';
 import { configDir } from '../../business/src/business.mjs';
 import { consoleReads, redactor } from './reads.mjs';
-import { createSso, readSlot } from './sso.mjs';
 import { statSync } from 'node:fs';
 import { isAbsolute } from 'node:path';
 import { ID_PATTERN } from '../../business/src/vocabulary.mjs';
 const args = process.argv.slice(2);
-const usage = 'node packages/webui/src/cli.mjs serve [--port N] [--tester-port N] [--checkout PATH] [--board http://127.0.0.1:7331] [--business ID] [--sso [--send]] [--public-host NAME --auth-header HEADER --allow-user ID [--send] [--proof-header NAME --proof-file PATH]]';
+const usage = 'node packages/webui/src/cli.mjs serve [--port N] [--tester-port N] [--checkout PATH] [--board http://127.0.0.1:7331] [--business ID] [--public-host NAME --auth-header HEADER --allow-user ID [--send] [--proof-header NAME --proof-file PATH]]';
 try {
  if (args.length === 1 && ['--help', '-h'].includes(args[0])) { console.log(usage); process.exit(0); }
  if (args.shift() !== 'serve') throw new Error(usage);
  const options = { board: DEFAULT_BOARD, port: 7330 }, preview = {}, proofFlags = {};
-  let sendOn = false, ssoOn = false, testerPort = null;
+  let sendOn = false, testerPort = null;
  while (args.length) {
    const flag = args.shift();
    // Row 76 (#1570): the one flag without a value.
    if (flag === '--send') { sendOn = true; continue; }
-    // Q175 phase 1 (#1690): the Console signs people in itself, from console.sso in config.json.
-    if (flag === '--sso') { ssoOn = true; continue; }
    const value = args.shift();
    if (!value) throw new Error(`missing value for ${flag}`);
    if (flag === '--port') {
@@ -54,10 +51,9 @@ try {
    else throw new Error(`unknown option: ${flag}`);
  }
  if (testerPort !== null && (testerPort === options.port || testerPort === 7332)) throw new Error('--tester-port must differ from --port and cannot be the forwarded port 7332');
-  if (ssoOn && (Object.keys(preview).length || Object.keys(proofFlags).length)) throw new Error('--sso cannot be combined with --public-host, --auth-header, --allow-user or --proof-*');
  options.preview = previewOptions(preview);
  const proof = proofOptions(proofFlags, options.preview);
-  if (sendOn && !options.preview && !ssoOn) throw new Error('--send needs the preview mode (--public-host, --auth-header and --allow-user) or --sso');
+  if (sendOn && !options.preview) throw new Error('--send needs the preview mode (--public-host, --auth-header and --allow-user)');
  // The bus views (slice 1 S5) need the system config. Without it the
  // board still serves and the bus routes answer not-configured.
  // The Queue, Business and Settings reads (row 54) need no bus; without
@@ -81,46 +77,31 @@ try {
    busLine = `Bus: ${options.business ?? 'the running bus host\'s business'}`;
  } catch (err) {
    const why = redactor({ configDir: configDir() })(err.message);
-    if (ssoOn) throw new Error(`--sso needs the system config (${why})`);
    if (sendOn) throw new Error(`--send needs the bus configured (${why})`);
    if (testerPort !== null) throw new Error(`--tester-port needs the bus configured (${why})`);
    busLine = `Bus: not configured (${why})`;
  }
  const reads = consoleReads({ root: REPO, queueRoot: options.checkout ?? REPO, system, configDir: configDir(), rolesDir: rolesDir(), business: options.business ?? null });
-  // The sign-in config is checked again here, then each slot file, before anything listens. A
-  // provider that can't be reached starts degraded; one whose discovery is refused stops the start.
-  let sso = null;
-  if (ssoOn) {
-    if (!system.console?.sso) throw new Error('--sso needs console.sso in the system config');
-    const secrets = new Map(system.console.sso.providers.map(p => [p.id, readSlot(configDir(), p, { repo: REPO, checkout: options.checkout ?? null })]));
-    sso = await createSso(system.console.sso, { secrets });
-  }
-  let server;
-  try {
-    server = await startServer({ board: options.board, port: options.port, bus, reads, preview: options.preview, sso, proof, send, settingsWrite, projectFiles, projectFile, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite });
-  } catch (err) { sso?.close(); throw err; }
+  const server = await startServer({ board: options.board, port: options.port, bus, reads, preview: options.preview, proof, send, settingsWrite, projectFiles, projectFile, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite });
  let testerServer = null;
  if (testerPort !== null) {
    const call = busCaller({ dataRoot: system.dataRoot, socket: socketPath(system.dataRoot), business: options.business ?? null, cli: TESTER_CLI });
    const testerBus = { ...views({ call }), names: () => call('names'), instances: () => call('instances'), routes: () => call('routes') };
    try {
      testerServer = await startServer({ host: '127.0.0.1', port: testerPort, board: options.board,
-        tester: true, testerNoSignIn: ssoOn, testerProofHeader: proof?.header ?? null, testerAuthHeader: options.preview?.header ?? null, bus: testerBus, reads,
+        tester: true, testerProofHeader: proof?.header ?? null, testerAuthHeader: options.preview?.header ?? null, bus: testerBus, reads,
        projectFiles: args => call('project.files', args), projectFile: args => call('project.file', args),
        instancesWrite: args => call('instances.set', args), routesWrite: args => call('routes.set', args), nameWrite: args => call('name.set', args),
        // Row 177 (#1675): the tester's own chat, through the tester CLI; 7332's stays the human's.
        chat: createChat({ call }),
      });
-    } catch (err) { sso?.close(); await new Promise(resolve => server.close(resolve)); throw err; }
+    } catch (err) { await new Promise(resolve => server.close(resolve)); throw err; }
  }
  const previewLine = options.preview ? `\nPreview: https://${options.preview.host}/ through the proxy, signed-in user from ${options.preview.header}, ${send ? 'reads and human messages to roles (--send); one line per send below' : 'read-only'}` : '';
  const proofLine = `\nProxy: proxy proof ${proof ? 'on' : 'off'}`;
-  // One line per provider: id, issuer, subject count and state. No client id, secret or sub.
-  const health = sso?.health() ?? {};
-  const ssoLines = sso ? `\nSign-in: ${sso.publicOrigin}/ (--sso), ${send ? 'reads and human writes (--send)' : 'read-only'}` + sso.summary().map(p => `\nSign-in provider: ${p.id} issuer ${p.issuer} subjects ${p.subjects} (${health[p.id]})`).join('') : '';
  const queueLine = options.checkout ? '\nQueue: read from the --checkout directory' : '';
-  console.log(`Mosaic Console: http://127.0.0.1:${server.address().port}/\nBoard: ${options.board}\n${busLine}${queueLine}${previewLine}${ssoLines}${proofLine}${testerServer ? `\nTester Console: http://127.0.0.1:${testerServer.address().port}/ (binds the tester)` : ''}\nCtrl-C stops this server.`);
-  for (const signal of ['SIGINT', 'SIGTERM']) process.once(signal, () => { sso?.close(); server.close(); testerServer?.close(); });
+  console.log(`Mosaic Console: http://127.0.0.1:${server.address().port}/\nBoard: ${options.board}\n${busLine}${queueLine}${previewLine}${proofLine}${testerServer ? `\nTester Console: http://127.0.0.1:${testerServer.address().port}/ (binds the tester)` : ''}\nCtrl-C stops this server.`);
+  for (const signal of ['SIGINT', 'SIGTERM']) process.once(signal, () => { server.close(); testerServer?.close(); });
 } catch (err) {
  console.error(`refused: ${err.message}`);
  process.exitCode = 2;
@@ -16,11 +16,6 @@
  // The first one sets body.signed-out (the listener below); after that no Console fetch is made.
  const out = () => document.body.classList.contains('signed-out');
  const signOut = () => { if (!out()) document.dispatchEvent(new Event('mosaic-signed-out')); };
-  // Q175 phase 1 (#1690): under --sso the Console itself answers a read without a session with 401
-  // `sign-in required`; that signs the page out too, and the line links to the Console's sign-in.
-  // Any other 401 stays an error. `sso` comes from /api/config.
-  let sso = false;
-  const signInRequired = (res, body) => res.status === 401 && body?.error === 'sign-in required';
  const signedOut = () => Object.assign(new Error('the sign-in proxy redirected it, so it never reached the Console'), { signedOut: true });
  const labels = { registration: 'registered', 'first-user-message': 'first message', 'tmux-pane': 'tmux pane', 'session-cwd': 'session cwd', 'workspace-git-root': 'git root' };
  const source = value => value ? `<span class="source">${esc(labels[value] || value)}</span>` : '';
@@ -115,7 +110,6 @@
    const res = await fetch(path, { cache: 'no-store', redirect: 'manual' });
    if (res.type === 'opaqueredirect') { signOut(); throw signedOut(); }
    let body; try { body = await res.json(); } catch { body = { error: `HTTP ${res.status}` }; }
-    if (signInRequired(res, body)) { sso = true; signOut(); throw signedOut(); }
    return { ok: res.ok, body };
  }
  function blockNode(b) {
@@ -310,7 +304,6 @@
    const res = await fetch(path, value === undefined ? { cache: 'no-store', redirect: 'manual' } : { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(value), redirect: 'manual' });
    if (res.type === 'opaqueredirect') { signOut(); throw signedOut(); }
    const result = await res.json();
-    if (signInRequired(res, result)) { sso = true; signOut(); throw signedOut(); }
    if (!res.ok) throw Object.assign(new Error(result.error || `HTTP ${res.status}`), { status: res.status });
    return result;
  }
@@ -459,7 +452,7 @@
  });
  // Signed out: everything drawn from a Console read goes, because none of it can be refreshed. The
  // line says so once; the send form (bus.js) keeps its draft and receipt. Reload is the way back.
-  document.addEventListener('mosaic-signed-out', e => {
+  document.addEventListener('mosaic-signed-out', () => {
    if (out()) return;
    document.body.classList.add('signed-out');
    clearTimeout(timer); convGen++;
@@ -468,13 +461,9 @@
    for (const id of ['projects', 'waiting', 'seen', 'sessions']) $(id).replaceChildren();
    $('refresh').disabled = $('pause').disabled = true;
    const line = $('signed-out');
-    line.innerHTML = sso || e.detail?.signIn
-      ? `<p><b>Signed out.</b> <a href="/auth/login?${esc(new URLSearchParams({ return: location.pathname + location.search }))}">Sign in again</a>.</p>`
-      : '<p><b>Signed out.</b> Reload the page to sign in.</p>';
-    line.hidden = false; $('sign-out').hidden = true;
+    line.innerHTML = '<p><b>Signed out.</b> Reload the page to sign in.</p>'; line.hidden = false;
    // Focus moves to the line only if what had it is gone or disabled, never out of a form being typed in.
    setTimeout(() => { const a = document.activeElement; if (!a || a === document.body || a.disabled || !a.getClientRects().length) line.focus(); });
  });
-  // Sign out (sage-1347, F7): a plain same-origin form POST to /auth/logout, shown only under --sso.
-  api('/api/config').then(config => { board = config.board; $('board-url').textContent = `Board: ${board}`; if (config.sso === true) { sso = true; $('sign-out').hidden = out(); } }).catch(err => { if (machine) error(err); }).finally(refresh);
+  api('/api/config').then(config => { board = config.board; $('board-url').textContent = `Board: ${board}`; }).catch(err => { if (machine) error(err); }).finally(refresh);
 })();
@@ -30,10 +30,6 @@
  const out = () => document.body.classList.contains('signed-out');
  const signOut = () => { if (!out()) document.dispatchEvent(new Event('mosaic-signed-out')); };
  const signedOut = () => new ReadError('signed-out', 'The sign-in proxy redirected the read.', 0);
-  // Q175 phase 1 (#1690, sage-1340 F1): under --sso a read without a session gets 401 `sign-in
-  // required` from the Console itself. That signs out the same way; any other 401 stays an error.
-  const signInRequired = (res, body) => res.status === 401 && body?.error === 'sign-in required';
-  const signOutSso = () => { if (!out()) document.dispatchEvent(new CustomEvent('mosaic-signed-out', { detail: { signIn: true } })); };
  // `replies` takes a message id as `id`; trail takes `subject`.
  async function fetchRead(verb, subject) {
    if (out()) throw signedOut();
@@ -42,7 +38,6 @@
    catch { throw new ReadError('unreachable', 'The Console server did not answer.', 0); }
    if (res.type === 'opaqueredirect') { signOut(); throw signedOut(); }
    try { body = await res.json(); } catch { throw new ReadError('unreachable', 'The Console server did not answer.', 0); }
-    if (signInRequired(res, body)) { signOutSso(); throw signedOut(); }
    if (!res.ok || !body || !Array.isArray(body.rows)) throw new ReadError(typeof body?.error === 'string' ? body.error : 'invalid-response', typeof body?.message === 'string' ? body.message : `HTTP ${res.status}`, res.status);
    return { ...body, rows: body.rows, at: body.at };
  }
@@ -55,7 +50,6 @@
    try { res = await fetch(`/api/${path}`, { cache: 'no-store', redirect: 'manual' }); } catch { throw unreachable(); }
    if (res.type === 'opaqueredirect') { signOut(); throw signedOut(); }
    try { body = await res.json(); } catch { throw unreachable(); }
-    if (signInRequired(res, body)) { signOutSso(); throw signedOut(); }
    if (!res.ok || !body || typeof body !== 'object' || Array.isArray(body)) throw Object.assign(new ReadError(typeof body?.error === 'string' ? body.error : 'invalid-response', typeof body?.message === 'string' ? body.message : `HTTP ${res.status}`, res.status), { module: true });
    return body;
  }
@@ -9,7 +9,7 @@
 <header class="cmdbar"><a href="/" class="wordmark"><svg class="mark" viewBox="0 0 16 17" aria-hidden="true"><use href="/icons.svg#mark"/></svg>Mosaic<small>Console</small></a>
 <button type="button" class="cmdk" id="cmdk" aria-haspopup="dialog" aria-controls="cmdk-dialog"><svg class="i" aria-hidden="true"><use href="/icons.svg#i-search"/></svg><span>Go to a view, decision or task</span><kbd>Ctrl K</kbd></button>
 <p class="fresh" id="fresh"><span id="fresh-board"></span><span id="fresh-bus"></span></p>
-<div class="cmd-right"><label>Palette<select id="palette"></select></label><label>Appearance<select id="mode"><option value="system">system</option><option value="light">light</option><option value="dim">dim</option><option value="dark">dark</option></select></label><button class="btn" id="refresh" type="button">Refresh</button><button class="btn" id="pause" type="button" aria-pressed="false">Pause</button><form id="sign-out" method="post" action="/auth/logout" hidden><button class="btn" type="submit">Sign out</button></form></div></header>
+<div class="cmd-right"><label>Palette<select id="palette"></select></label><label>Appearance<select id="mode"><option value="system">system</option><option value="light">light</option><option value="dim">dim</option><option value="dark">dark</option></select></label><button class="btn" id="refresh" type="button">Refresh</button><button class="btn" id="pause" type="button" aria-pressed="false">Pause</button></div></header>
 <div class="frame">
 <nav class="tree" aria-label="Console"><h2 class="tree-title">Console</h2><ul class="s1-sections" id="sections"></ul><div id="board-tree"><h2 class="tree-title">Projects</h2><div id="projects"><p class="muted">Loading projects…</p></div><p class="small muted">Select a project to filter sessions. Waiting on you always shows all projects.</p></div></nav>
 <main id="main" class="content" tabindex="-1"><div id="signed-out" class="banner ref" role="alert" tabindex="-1" hidden></div><div id="bus-down" class="banner err" role="alert" hidden></div><div class="page-head" id="board-head"><div><h1>Control board</h1><p id="status" class="small muted" role="status">Loading board…</p></div><div class="filters"><label><input id="show-machine" type="checkbox">Show machine sessions</label></div></div>
@@ -61,8 +61,6 @@ async function body(req, max = 4096) {
 // Row 65 (mos-0840) adds `routes`: each instance's harness, model, thinking and fallback.
 const BUS_VERBS = ['inbox', 'tasks', 'agents', 'trail', 'decisions', 'credentials', 'replies', 'messages', 'usage', 'limits', 'names', 'instances', 'routes'];
 const DECISION_LISTS = ['roles', 'recent'];
-// Q175 phase 1 (#1690, F8): either sign-in cookie, which the tester listener refuses under --sso.
-const SIGN_IN_COOKIE = /(?:^|;)\s*__host-mosaic_(?:session|login)\s*=/i;
 // Row 177 (#1675): the chat writes the tester listener lets through, exactly the four chatHTTP routes.
 const TESTER_CHAT_WRITE = /^\/api\/chat\/(?:projects|threads|threads\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/(?:messages|open))$/i;
 async function busRead(res, bus, verb, search) {
@@ -162,18 +160,14 @@ async function busRead(res, bus, verb, search) {
 // broker's to refuse. Nothing retries; an outcome the bus can't confirm is reported as unknown.
 const SEND_KEYS = ['to', 'body', 'in_reply_to'];
 const one = (req, name) => (req.headersDistinct[name]?.length === 1 ? req.headersDistinct[name][0] : null);
-// Q175 phase 1 (#1690): under --sso the writer comes from a session the handler already checked,
-// so it carries `sso: true` and the public origin; the preview writer still checks its header.
-const signedIn = (req, p) => p.sso === true || one(req, p.header) === p.user;
-const ownOrigin = p => p.origin ?? `https://${p.host}`;
 async function busSend(req, res, { send, preview, log }) {
-  if (!signedIn(req, preview)) return json(res, 401, { error: 'sign-in required' });
+  if (one(req, preview.header) !== preview.user) return json(res, 401, { error: 'sign-in required' });
  let to = null;
  // `to` is quoted and cut short so a crafted value can't forge a log line.
  const line = outcome => log(`${new Date().toISOString()} send user=${JSON.stringify(preview.user)} to=${typeof to === 'string' ? JSON.stringify(to.slice(0, 64)) : 'none'} ${outcome}`);
  // `sent` tells the page which it was: false, nothing was written; 'unknown', it may have been.
  const refuse = (status, error, message, sent = false) => { line(`error=${error}`); return json(res, status, { error, message, sent }); };
-  if (one(req, 'origin') !== ownOrigin(preview)) return refuse(403, 'cross-origin request refused', 'a send needs the Console\'s own Origin');
+  if (one(req, 'origin') !== `https://${preview.host}`) return refuse(403, 'cross-origin request refused', 'a send needs the Console\'s own Origin');
  if (one(req, 'sec-fetch-site') !== 'same-origin') return refuse(403, 'cross-site request refused', 'a send needs Sec-Fetch-Site: same-origin');
  let value;
  try { value = JSON.parse((await body(req, 16384)).toString('utf8')); } catch (err) { return refuse(400, 'invalid-request', err.message); }
@@ -247,10 +241,10 @@ export function proofOptions({ proofHeader, proofFile } = {}, preview = null) {
 // REQ-WEB-1: same signed-in send boundary, a distinct strict settings payload.
 async function settingsSend(req, res, { settingsWrite, preview, log }) {
  const refuse = (status, error, message) => json(res, status, { error, message, sent: false });
-  if (!signedIn(req, preview)) {
+  if (one(req, preview.header) !== preview.user) {
    return refuse(401, 'sign-in required', 'sign in again');
  }
-  if (one(req, 'origin') !== ownOrigin(preview)) {
+  if (one(req, 'origin') !== `https://${preview.host}`) {
    return refuse(403, 'cross-origin request refused', 'settings need the Console origin');
  }
  if (one(req, 'sec-fetch-site') !== 'same-origin') {
@@ -298,8 +292,8 @@ async function seatSend(req, res, { route, write, preview, log }) {
  // The instance is quoted and cut short so a crafted value can't forge a log line.
  const line = outcome => log(`${new Date().toISOString()} ${route.kind} user=${JSON.stringify(preview.user)} instance=${quoted(instance)} ${outcome}`);
  const refuse = (status, error, message, sent = false) => { line(`error=${error}`); return json(res, status, { error, message, sent }); };
-  if (!preview.tester && !signedIn(req, preview)) return json(res, 401, { error: 'sign-in required', message: 'sign in again', sent: false });
-  if (one(req, 'origin') !== ownOrigin(preview)) return refuse(403, 'cross-origin request refused', 'this needs the Console\'s own Origin');
+  if (!preview.tester && one(req, preview.header) !== preview.user) return json(res, 401, { error: 'sign-in required', message: 'sign in again', sent: false });
+  if (one(req, 'origin') !== (preview.origin ?? `https://${preview.host}`)) return refuse(403, 'cross-origin request refused', 'this needs the Console\'s own Origin');
  if (one(req, 'sec-fetch-site') !== 'same-origin') return refuse(403, 'cross-site request refused', 'this needs same-origin Fetch Metadata');
  let value;
  try { value = JSON.parse((await body(req)).toString('utf8')); } catch (err) { return refuse(400, 'invalid-request', err.message); }
@@ -341,8 +335,8 @@ async function instanceSend(req, res, { instancesWrite, preview, log }) {
  // The instance is quoted and cut short so a crafted value can't forge a log line. Vars are never logged.
  const line = outcome => log(`${new Date().toISOString()} instance user=${JSON.stringify(preview.user)} instance=${quoted(instance)} ${outcome}`);
  const refuse = (status, error, message, sent = false) => { line(`error=${error}`); return json(res, status, { error, message, sent }); };
-  if (!preview.tester && !signedIn(req, preview)) return json(res, 401, { error: 'sign-in required', message: 'sign in again', sent: false });
-  if (one(req, 'origin') !== ownOrigin(preview)) return refuse(403, 'cross-origin request refused', 'this needs the Console\'s own Origin');
+  if (!preview.tester && one(req, preview.header) !== preview.user) return json(res, 401, { error: 'sign-in required', message: 'sign in again', sent: false });
+  if (one(req, 'origin') !== (preview.origin ?? `https://${preview.host}`)) return refuse(403, 'cross-origin request refused', 'this needs the Console\'s own Origin');
  if (one(req, 'sec-fetch-site') !== 'same-origin') return refuse(403, 'cross-site request refused', 'this needs same-origin Fetch Metadata');
  let value;
  try { value = JSON.parse((await body(req, 16384)).toString('utf8')); } catch (err) { return refuse(400, 'invalid-request', err.message); }
@@ -388,8 +382,8 @@ async function routesSend(req, res, { routesWrite, preview, log }) {
  let names = [];
  const line = outcome => log(`${new Date().toISOString()} routes user=${JSON.stringify(preview.user)} instances=${quoted(names.join(','))} ${outcome}`);
  const refuse = (status, error, message, sent = false) => { line(`error=${error}`); return json(res, status, { error, message, sent }); };
-  if (!preview.tester && !signedIn(req, preview)) return json(res, 401, { error: 'sign-in required', message: 'sign in again', sent: false });
-  if (one(req, 'origin') !== ownOrigin(preview)) return refuse(403, 'cross-origin request refused', 'this needs the Console\'s own Origin');
+  if (!preview.tester && one(req, preview.header) !== preview.user) return json(res, 401, { error: 'sign-in required', message: 'sign in again', sent: false });
+  if (one(req, 'origin') !== (preview.origin ?? `https://${preview.host}`)) return refuse(403, 'cross-origin request refused', 'this needs the Console\'s own Origin');
  if (one(req, 'sec-fetch-site') !== 'same-origin') return refuse(403, 'cross-site request refused', 'this needs same-origin Fetch Metadata');
  let value;
  try { value = JSON.parse((await body(req, 16384)).toString('utf8')); } catch (err) { return refuse(400, 'invalid-request', err.message); }
@@ -426,8 +420,8 @@ async function projectFileSend(req, res, { projectSave, preview, log }) {
  const line = outcome => log(`${new Date().toISOString()} project-file user=${JSON.stringify(preview.user)} project=${quoted(target?.project)} path=${quoted(target?.path)} ${outcome}`);
  // `sent` tells the page which it was: false, nothing was written; 'unknown', it may have been.
  const refuse = (status, error, message, sent = false) => { line(`error=${error}`); return json(res, status, { error, message, sent }); };
-  if (!signedIn(req, preview)) return json(res, 401, { error: 'sign-in required', message: 'sign in again', sent: false });
-  if (one(req, 'origin') !== ownOrigin(preview)) return refuse(403, 'cross-origin request refused', 'a save needs the Console\'s own Origin');
+  if (one(req, preview.header) !== preview.user) return json(res, 401, { error: 'sign-in required', message: 'sign in again', sent: false });
+  if (one(req, 'origin') !== `https://${preview.host}`) return refuse(403, 'cross-origin request refused', 'a save needs the Console\'s own Origin');
  if (one(req, 'sec-fetch-site') !== 'same-origin') return refuse(403, 'cross-site request refused', 'a save needs same-origin Fetch Metadata');
  let value;
  try { value = JSON.parse((await body(req, FILE_SAVE_MAX)).toString('utf8')); } catch (err) { return refuse(400, 'invalid-request', err.message); }
@@ -466,17 +460,13 @@ async function projectFileRead(res, read, path, search) {
    return json(res, busStatus(code), { error: code, message: err instanceof BusReadError ? err.message : code });
  }
 }
-// `send` is the bus write (row 76): `args => Promise<{id}>`, only with the preview mode or `sso`.
-// `sso` is createSso() from sso.mjs (Q175 phase 1): the human listener signs people in itself.
-// `testerNoSignIn` makes the tester listener refuse anything that looks like a sign-in (--sso). `log`
+// `send` is the bus write (row 76): `args => Promise<{id}>`, only with the preview mode. `log`
 // takes one line per send attempt that got past sign-in; never the body. `fieldsFile` is for
 // tests; the field table is otherwise the committed packages/tasks/fields.json.
-export async function startServer({ host = '127.0.0.1', port = 7330, board = DEFAULT_BOARD, timeout = 20000, bus = null, reads = null, preview = null, sso = null, tester = false, testerNoSignIn = false, testerAuthHeader = null, proof = null, testerProofHeader = null, send = null, settingsWrite = null, projectFiles = null, projectFile = null, projectSave = null, chat = null, nameWrite = null, assistantStop = null, instancesWrite = null, routesWrite = null, log = line => console.log(line), fieldsFile = undefined } = {}) {
+export async function startServer({ host = '127.0.0.1', port = 7330, board = DEFAULT_BOARD, timeout = 20000, bus = null, reads = null, preview = null, tester = false, testerAuthHeader = null, proof = null, testerProofHeader = null, send = null, settingsWrite = null, projectFiles = null, projectFile = null, projectSave = null, chat = null, nameWrite = null, assistantStop = null, instancesWrite = null, routesWrite = null, log = line => console.log(line), fieldsFile = undefined } = {}) {
  if (!isLoopback(host)) throw new Error('refusing to bind to non-loopback host');
  if (host === 'localhost') host = '127.0.0.1';
  if (tester && preview !== null) throw new Error('tester listener cannot use preview mode');
-  if (tester && sso !== null) throw new Error('tester listener cannot use sso');
-  if (sso !== null && (preview !== null || proof !== null)) throw new Error('--sso cannot be combined with --auth-header, --allow-user or --proof-*');
  if (tester && host !== '127.0.0.1') throw new Error('tester listener must bind 127.0.0.1');
  // Row 177 (#1675): chat is allowed. The tester listener's chat binds the tester, so the bus keeps it on tester threads.
  if (tester && [send, settingsWrite, projectSave, assistantStop].some(value => value !== null)) throw new Error('tester listener permits only instance, route, name and chat writes');
@@ -486,26 +476,21 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
    throw new Error('preview mode needs --public-host, --auth-header and --allow-user together');
  }
  if (proof !== null && (preview === null || tester)) throw new Error('proxy proof needs preview mode');
-  if (send !== null && ((preview === null && sso === null) || typeof send !== 'function')) throw new Error('--send needs the preview mode (--public-host, --auth-header and --allow-user) or --sso');
+  if (send !== null && (preview === null || typeof send !== 'function')) throw new Error('--send needs the preview mode (--public-host, --auth-header and --allow-user)');
  const server = createServer(async (req, res) => {
    res.setHeader('x-content-type-options', 'nosniff');
    res.setHeader('referrer-policy', 'no-referrer');
-    // Under --sso the Sign out form's POST is redirected to the provider's end-session endpoint, and
-    // browsers apply form-action to that redirect, so those origins (from discovery) are allowed too.
-    res.setHeader('content-security-policy', `default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; font-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'${sso ? sso.formTargets().map(o => ` ${o}`).join('') : ''}`);
+    res.setHeader('content-security-policy', "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; font-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'");
    // Presence, even with an empty value: never turn the public listener into a tester ingress.
    if (!tester && Object.hasOwn(req.headers, 'x-mosaic-tester')) return json(res, 403, { error: 'tester listener required' });
    if (tester && testerAuthHeader && Object.hasOwn(req.headers, testerAuthHeader.toLowerCase())) return json(res, 403, { error: 'proxy header refused' });
    if (tester && testerProofHeader && Object.hasOwn(req.headers, testerProofHeader.toLowerCase())) return json(res, 403, { error: 'proxy proof header refused' });
-    // Under --sso the tester listener reads no cookie and takes no sign-in of any kind (design section 6).
-    if (tester && testerNoSignIn && (Object.hasOwn(req.headers, 'authorization') || SIGN_IN_COOKIE.test(req.headers.cookie ?? '') || Object.keys(req.headers).some(h => h.startsWith('x-authentik-'))))
-      return json(res, 403, { error: 'tester listener takes no sign-in' });
    let path, search;
    // Node keeps the first of repeated Host headers; a second one (a loopback Host, then NAME) is
    // never legitimate, so it is refused before any check reads the Host.
    if ((req.headersDistinct.host?.length ?? 0) > 1) return json(res, 400, { error: 'repeated Host refused' });
    // Preview mode: a request for the public name, exactly, as the proxy forwards it.
-    const named = preview !== null ? (req.headers.host ?? '').toLowerCase() === preview.host : sso !== null && (req.headers.host ?? '').toLowerCase() === sso.publicHost;
+    const named = preview !== null && (req.headers.host ?? '').toLowerCase() === preview.host;
    // The proof precedes every auth-header read, including the wrong-Host fence.
    if (proof !== null) {
      const values = req.headersDistinct[proof.header];
@@ -527,34 +512,19 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
      }
      ({ pathname: path, search } = new URL(req.url, 'http://localhost'));
    } catch { return json(res, 400, { error: 'invalid URL' }); }
-    // Under --sso the human listener serves only the public Host, whatever its port; GET /healthz
-    // alone stays open on a loopback Host for the status and release gates (Q-C).
-    if (sso !== null && !named && !(path === '/healthz' && req.method === 'GET')) return json(res, 403, { error: 'public Host required' });
    // No CORS. JSON content type and same-origin checks keep browser forms out.
-    if (req.headers.origin && req.headers.origin !== (named ? (sso ? sso.publicOrigin : `https://${preview.host}`) : `http://${req.headers.host}`)) return json(res, 403, { error: 'cross-origin request refused' });
-    let signer = preview;
-    if (sso !== null && named) {
-      if (path.startsWith('/auth/')) return sso.handle(req, res, path, search);
-      // Only a page load or a write keeps a session alive; the page's background reads don't (Q-D).
-      const session = path === '/healthz' ? null : sso.session(req, { touch: req.method === 'POST' || (req.method === 'GET' && !path.startsWith('/api/')) });
-      if (!session && path !== '/healthz') {
-        if (path.startsWith('/api/') || req.method !== 'GET') return json(res, 401, { error: 'sign-in required' });
-        res.writeHead(303, { location: `/auth/login?return=${encodeURIComponent(path + search)}`, 'cache-control': 'no-store' });
-        return res.end();
-      }
-      if (session) signer = { sso: true, user: session.name, host: sso.publicHost, origin: sso.publicOrigin };
-    }
-    if (named && preview !== null) {
+    if (req.headers.origin && req.headers.origin !== (named ? `https://${preview.host}` : `http://${req.headers.host}`)) return json(res, 403, { error: 'cross-origin request refused' });
+    if (named) {
      // One value, equal to the user id; the proxy strips client copies and sets it after sign-in.
      const values = req.headersDistinct[preview.header];
      if (!values || values.length !== 1 || values[0] !== preview.user) return json(res, 401, { error: 'sign-in required' });
    }
-    const writer = tester ? { tester: true, user: 'tester', origin: `http://127.0.0.1:${server.address().port}` } : signer;
+    const writer = tester ? { tester: true, user: 'tester', origin: `http://127.0.0.1:${server.address().port}` } : preview;
    if (tester && !['GET', 'HEAD'].includes(req.method) && !['/api/instances', '/api/routes', '/api/name'].includes(path) && !TESTER_CHAT_WRITE.test(path))
      return json(res, 403, { error: 'read-only', sent: false });
    if(path==='/api/settings'&&req.method==='POST'){
      if(!send||!settingsWrite||!named)return json(res,403,{error:'read-only',sent:false});
-      return settingsSend(req,res,{settingsWrite,preview:signer,log});
+      return settingsSend(req,res,{settingsWrite,preview,log});
    }
    if (Object.hasOwn(SEAT_ROUTES, path)) {
      if (req.method !== 'POST') return json(res, 405, { error: 'method not allowed' });
@@ -574,18 +544,18 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
    }
    if (path === '/api/project-file' && req.method === 'POST') {
      if (!send || !projectSave || !named) return json(res, 403, { error: 'read-only', sent: false });
-      return projectFileSend(req, res, { projectSave, preview: signer, log });
+      return projectFileSend(req, res, { projectSave, preview, log });
    }
    // Message sending has its own bounded payload and repeats the identity check.
    if (send && path === '/api/bus/message') {
      if (req.method !== 'POST') return json(res, 405, { error: 'method not allowed' });
-      return busSend(req, res, { send, preview: signer, log });
+      return busSend(req, res, { send, preview, log });
    }
    if (path === '/api/chat' || path.startsWith('/api/chat/')) {
      return chatHTTP(req, res, { path, search, chat, named, send, preview: writer, log });
    }
    // Nothing else but GET and HEAD gets past here in preview mode, whatever the Host.
-    if ((preview !== null || sso !== null) && req.method !== 'GET' && req.method !== 'HEAD') return json(res, 403, { error: 'read-only', message: 'the Console preview is read-only' });
+    if (preview !== null && req.method !== 'GET' && req.method !== 'HEAD') return json(res, 403, { error: 'read-only', message: 'the Console preview is read-only' });
    // The conversation routes (#1507, CHAT-02) keep their query; the board validates it.
    const conversation = path === '/api/conversations' || path === '/api/conversation';
    const allowed = path === '/api/board' || conversation ? 'GET' : ['/api/seen', '/api/reply'].includes(path) ? 'POST' : null;
@@ -637,8 +607,8 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
    if (req.method !== 'GET' && req.method !== 'HEAD') return json(res, 405, { error: 'method not allowed' });
    // `send`: the page shows the composer only where a send can pass (the public name, --send on).
    // `edit`: the editor shows Save only where a save can pass, the same test as the route's.
-    if (path === '/api/config') return json(res, 200, { board: upstream, ...(tester ? { tester: true } : {}), ...(sso ? { sso: true } : {}), send: !tester && Boolean(send) && named, edit: !tester && Boolean(send) && Boolean(projectSave) && named });
-    if (path === '/healthz') return json(res, 200, { ok: true, ...(sso ? { sso: sso.health() } : {}) });
+    if (path === '/api/config') return json(res, 200, { board: upstream, ...(tester ? { tester: true } : {}), send: !tester && Boolean(send) && named, edit: !tester && Boolean(send) && Boolean(projectSave) && named });
+    if (path === '/healthz') return json(res, 200, { ok: true });
    if (path === '/favicon.ico') { res.writeHead(204); return res.end(); }
    const file = files.get(path);
    if (!file) return json(res, 404, { error: 'not found' });
@@ -1,75 +0,0 @@
-// Q175 phase 1 (#1690): the shape of config.json's optional `console` key. The one loader,
-// scripts/mosaic-config.mjs, runs this on every read, so a bad key refuses the config for every
-// tool (design section 4, C1). The Console's --sso start runs it again before it uses the value.
-// Shape only: nothing here touches the network or a slot file. A refusal names the key path and
-// never quotes a value, so a refusal can't print a client id or a subject.
-
-// The asymmetric algorithms oauth4webapi 3.8.8 verifies (its supported(), build/index.js). No HS*
-// and no none, so a client secret can never be a signing key.
-export const ALGS = Object.freeze(['PS256', 'ES256', 'RS256', 'PS384', 'ES384', 'RS384', 'PS512', 'ES512', 'RS512', 'Ed25519', 'EdDSA', 'ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87']);
-const PROVIDER_ID = /^[a-z0-9-]{1,32}$/;
-const SLOT = /^[a-z0-9-]{1,64}$/;
-const SUB = /^[\x21-\x7e]{1,255}$/;
-const CLIENT_ID = /^[\x21-\x7e]{1,255}$/;
-// The name goes where the preview's --allow-user went (serve.mjs USER): visible ASCII, no comma.
-const NAME = /^[\x21-\x2b\x2d-\x7e]{1,64}$/;
-// The bus keeps these for the tester and the human role (section 6), so no subject can sign in as one.
-const RESERVED_NAMES = ['tester', 'human'];
-
-const object = v => typeof v === 'object' && v !== null && !Array.isArray(v);
-function refuse(where, why) {
-  throw new Error(`${where} ${why}`);
-}
-function keys(value, where, allowed, required = allowed) {
-  if (!object(value)) refuse(where, 'must be a JSON object');
-  for (const key of Object.keys(value)) if (!allowed.includes(key)) refuse(`${where}.${key}`, 'is not a supported key');
-  for (const key of required) if (!Object.hasOwn(value, key)) refuse(`${where}.${key}`, 'is required');
-}
-function httpsURL(value, where) {
-  let url;
-  if (typeof value !== 'string' || value.length > 512) refuse(where, 'must be an https URL of at most 512 characters');
-  try { url = new URL(value); } catch { refuse(where, 'must be an https URL'); }
-  if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash || value.includes('?') || value.includes('#')) {
-    refuse(where, 'must be https with no credentials, query or fragment');
-  }
-  return url;
-}
-
-// Returns the value unchanged when it passes; throws an Error naming the bad key path otherwise.
-export function checkConsole(value, where = 'console') {
-  keys(value, where, ['sso']);
-  const sso = value.sso, at = `${where}.sso`;
-  keys(sso, at, ['publicOrigin', 'providers']);
-  const origin = httpsURL(sso.publicOrigin, `${at}.publicOrigin`);
-  if (origin.origin !== sso.publicOrigin) refuse(`${at}.publicOrigin`, 'must be an https origin with no path, query, fragment or trailing slash');
-  if (!Array.isArray(sso.providers) || sso.providers.length === 0 || sso.providers.length > 8) refuse(`${at}.providers`, 'must be a list of 1 to 8 providers');
-  const ids = new Set();
-  sso.providers.forEach((p, i) => {
-    const pat = `${at}.providers[${i}]`;
-    keys(p, pat, ['id', 'issuer', 'clientId', 'clientSecret', 'algs', 'subjects']);
-    if (typeof p.id !== 'string' || !PROVIDER_ID.test(p.id)) refuse(`${pat}.id`, 'must match [a-z0-9-]{1,32}');
-    if (ids.has(p.id)) refuse(`${pat}.id`, 'repeats an earlier provider id');
-    ids.add(p.id);
-    httpsURL(p.issuer, `${pat}.issuer`);
-    if (typeof p.clientId !== 'string' || !CLIENT_ID.test(p.clientId)) refuse(`${pat}.clientId`, 'must be 1 to 255 visible characters');
-    keys(p.clientSecret, `${pat}.clientSecret`, ['slot']);
-    if (typeof p.clientSecret.slot !== 'string' || !SLOT.test(p.clientSecret.slot)) refuse(`${pat}.clientSecret.slot`, 'must match [a-z0-9-]{1,64}');
-    if (!Array.isArray(p.algs) || p.algs.length === 0) refuse(`${pat}.algs`, 'must be a non-empty list');
-    p.algs.forEach((alg, j) => {
-      if (!ALGS.includes(alg)) refuse(`${pat}.algs[${j}]`, `must be one of ${ALGS.join(', ')}; HS* and none are refused`);
-    });
-    if (new Set(p.algs).size !== p.algs.length) refuse(`${pat}.algs`, 'repeats an algorithm');
-    if (!Array.isArray(p.subjects) || p.subjects.length === 0 || p.subjects.length > 64) refuse(`${pat}.subjects`, 'must be a list of 1 to 64 subjects');
-    const subs = new Set();
-    p.subjects.forEach((s, j) => {
-      const sat = `${pat}.subjects[${j}]`;
-      keys(s, sat, ['sub', 'name']);
-      if (typeof s.sub !== 'string' || !SUB.test(s.sub)) refuse(`${sat}.sub`, 'must be 1 to 255 visible characters');
-      if (subs.has(s.sub)) refuse(`${sat}.sub`, 'repeats an earlier subject');
-      subs.add(s.sub);
-      if (typeof s.name !== 'string' || !NAME.test(s.name)) refuse(`${sat}.name`, 'must be 1 to 64 visible characters');
-      if (RESERVED_NAMES.includes(s.name.toLowerCase())) refuse(`${sat}.name`, `must not be ${RESERVED_NAMES.join(' or ')}`);
-    });
-  });
-  return value;
-}
@@ -1,347 +0,0 @@
-// Q175 phase 1 (#1690, design agents/sage/work/q175-sso/DESIGN.md): the Console as an OIDC relying
-// party. Used only by the human listener under --sso; startServer refuses it on the tester listener.
-// Every URL handed to a provider is built from the configured publicOrigin, never from a request's
-// Host. A refusal logs one fixed code and the provider id, never an exception, its message or its
-// cause: oauth4webapi's errors carry token bodies and claims there.
-import { createHash, randomBytes } from 'node:crypto';
-import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync, realpathSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { join, relative, isAbsolute, resolve } from 'node:path';
-import { checkConsole } from './sso-config.mjs';
-
-// oauth4webapi loads in createSso, not here: cli.mjs imports this module on every start, and a
-// Console without --sso must not need the package (pinned-copy.test.mjs builds copies whose lock
-// installs nothing). A real copy installs it from the root lock.
-let oauth;
-
-export const SESSION_COOKIE = '__Host-mosaic_session';
-export const LOGIN_COOKIE = '__Host-mosaic_login';
-const ATTRS = 'Path=/; Secure; HttpOnly; SameSite=Lax';
-const LOGIN_MAX_AGE = 600;
-const SESSION_ABSOLUTE = 8 * 3600 * 1000, SESSION_IDLE = 3600 * 1000;
-const MAX_SESSIONS = 64, MAX_LOGINS = 32;
-const FETCH_TIMEOUT = 10000;
-const RETRY_CAP = 300000;
-const CODES = new Set(['login-record-missing', 'state-mismatch', 'auth-error-response', 'grant-failed', 'id-token-invalid', 'signature-invalid', 'alg-refused', 'issuer-mismatch', 'subject-unknown', 'discovery-failed', 'jwks-failed']);
-
-const sha256 = value => createHash('sha256').update(value).digest('hex');
-const escape = text => String(text).replace(/[&<>"']/g, c => `&#${c.charCodeAt(0)};`);
-const under = (parent, child) => { const rel = relative(parent, child); return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel)); };
-
-// The slot file holding a provider's client secret (design section 4, D1). Only the Console's --sso
-// start calls this. A refusal names the provider and the check, never the path's contents.
-export function readSlot(configDir, provider, { repo, checkout = null, copies = join(process.env.XDG_DATA_HOME || join(homedir(), '.local', 'share'), 'mosaic-stack', 'copies') } = {}) {
-  const where = `console.sso provider ${provider.id} client secret slot`;
-  const file = join(resolve(configDir), 'secrets', 'mosaic-stack', provider.clientSecret.slot);
-  let st;
-  try { st = lstatSync(file); } catch { throw new Error(`${where} is missing`); }
-  if (st.isSymbolicLink()) throw new Error(`${where} must not be a symbolic link`);
-  let fd, real, text;
-  try {
-    fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
-    st = fstatSync(fd);
-    if (!st.isFile()) throw new Error(`${where} must be a regular file`);
-    if (st.uid !== process.getuid()) throw new Error(`${where} must be owned by the Console's user`);
-    if (st.mode & 0o077) throw new Error(`${where} must have no group or other permission bits`);
-    real = realpathSync(file);
-    for (const root of [repo, checkout, copies].filter(Boolean)) {
-      let base;
-      try { base = realpathSync(root); } catch { base = resolve(root); }
-      if (under(base, real)) throw new Error(`${where} must not be inside the repository or a stack copy`);
-    }
-    text = readFileSync(fd, 'utf8');
-  } catch (err) {
-    throw err.message?.startsWith(where) ? err : new Error(`${where} is not readable`);
-  } finally {
-    if (fd !== undefined) closeSync(fd);
-  }
-  const secret = text.endsWith('\n') ? text.slice(0, -1) : text;
-  if (!secret || /[\r\n]/.test(secret)) throw new Error(`${where} must hold one non-empty line`);
-  return secret;
-}
-
-export function cookies(req, name) {
-  const found = [];
-  for (const part of (req.headers.cookie ?? '').split(';')) {
-    const at = part.indexOf('=');
-    if (at > 0 && part.slice(0, at).trim() === name) found.push(part.slice(at + 1).trim());
-  }
-  return found;
-}
-
-// The JWKS check at discovery, the same filter the library's key selection uses (kty, alg, use,
-// key_ops, crv; RSA at least 2048 bits), without a kid since no token is at hand yet.
-function usableKey(jwk, alg) {
-  const kty = { RS: 'RSA', PS: 'RSA', ES: 'EC', Ed: 'OKP', ML: 'AKP' }[alg.slice(0, 2)];
-  if (jwk === null || typeof jwk !== 'object' || jwk.kty !== kty) return false;
-  if (jwk.alg !== undefined && jwk.alg !== alg) return false;
-  if (jwk.use !== undefined && jwk.use !== 'sig') return false;
-  if (Array.isArray(jwk.key_ops) && !jwk.key_ops.includes('verify')) return false;
-  const crv = { ES256: 'P-256', ES384: 'P-384', ES512: 'P-521', Ed25519: 'Ed25519', EdDSA: 'Ed25519' }[alg];
-  if (crv && jwk.crv !== crv) return false;
-  if (kty === 'RSA' && (typeof jwk.n !== 'string' || Buffer.from(jwk.n, 'base64url').length * 8 < 2048)) return false;
-  return true;
-}
-
-class Unreachable extends Error {}
-class Refused extends Error {}
-const https = value => { try { return new URL(value).protocol === 'https:'; } catch { return false; } };
-
-// One provider's discovery and JWKS. Throws Unreachable (network, timeout, a status other than 200,
-// a body that isn't JSON) or Refused (a JSON document that fails a check). Q-B, design section 4.
-async function discover(p, fetchOptions) {
-  let response, text;
-  const options = () => ({ ...fetchOptions, signal: AbortSignal.timeout(FETCH_TIMEOUT) });
-  try {
-    response = await oauth.discoveryRequest(new URL(p.issuer), options());
-    if (response.status !== 200 || !/^application\/json\b/i.test(response.headers.get('content-type') ?? '')) throw new Error();
-    text = await response.text();
-    JSON.parse(text);
-  } catch { throw new Unreachable(); }
-  let as;
-  try {
-    as = await oauth.processDiscoveryResponse(new URL(p.issuer), new Response(text, { status: 200, headers: { 'content-type': 'application/json' } }));
-  } catch { throw new Refused(); }
-  if (as.issuer !== p.issuer) throw new Refused();
-  if (!Array.isArray(as.id_token_signing_alg_values_supported) || !p.algs.some(a => as.id_token_signing_alg_values_supported.includes(a))) throw new Refused();
-  if (!Array.isArray(as.code_challenge_methods_supported) || !as.code_challenge_methods_supported.includes('S256')) throw new Refused();
-  if (![as.authorization_endpoint, as.token_endpoint, as.jwks_uri].every(https)) throw new Refused();
-  if (as.end_session_endpoint !== undefined && !https(as.end_session_endpoint)) throw new Refused();
-  let jwks;
-  try {
-    const fetcher = fetchOptions[oauth.customFetch] ?? fetch;
-    const res = await fetcher(as.jwks_uri, { method: 'GET', headers: { accept: 'application/json, application/jwk-set+json' }, redirect: 'manual', signal: AbortSignal.timeout(FETCH_TIMEOUT) });
-    if (res.status !== 200) throw new Error();
-    jwks = JSON.parse(await res.text());
-  } catch { throw new Unreachable(); }
-  if (jwks === null || typeof jwks !== 'object' || !Array.isArray(jwks.keys)) throw new Refused();
-  const usable = p.algs.filter(alg => jwks.keys.some(k => usableKey(k, alg)));
-  if (!usable.length) throw new Refused();
-  return as;
-}
-
-// `config` is console.sso, checked again here; `secrets` maps provider id to its client secret
-// (readSlot). `fetch` is for tests: a fetch that trusts only the fake OP's certificate.
-// `retryFirst` is for tests too; production waits 5 s, doubling, capped at 5 minutes.
-export async function createSso(config, { secrets, fetch: customFetch = null, log = line => console.log(line), retryFirst = 5000 } = {}) {
-  checkConsole({ sso: config });
-  oauth ??= await import('oauth4webapi');
-  const publicOrigin = config.publicOrigin;
-  const publicHost = new URL(publicOrigin).host;
-  const redirectUri = `${publicOrigin}/auth/callback`;
-  const fetchOptions = customFetch ? { [oauth.customFetch]: customFetch } : {};
-  const sessions = new Map(), logins = new Map();
-  const timers = new Set();
-  let closed = false;
-  const refuse = (code, provider, extra = '') => {
-    if (!CODES.has(code)) throw new Error(`unknown sso log code ${code}`);
-    log(`${new Date().toISOString()} sso refused code=${code} provider=${provider}${extra}`);
-  };
-
-  const providers = new Map(config.providers.map(p => {
-    if (typeof secrets?.get(p.id) !== 'string') throw new Error(`console.sso provider ${p.id} has no client secret`);
-    return [p.id, {
-      config: p, state: 'unreachable', as: null, jwks: {},
-      client: { client_id: p.clientId, id_token_signed_response_alg: [...p.algs] },
-      auth: oauth.ClientSecretBasic(secrets.get(p.id)),
-      subjects: new Map(p.subjects.map(s => [s.sub, s.name])),
-    }];
-  }));
-
-  async function attempt(entry, atStart) {
-    try {
-      entry.as = await discover(entry.config, fetchOptions);
-      entry.jwks = {};
-      entry.state = 'ready';
-    } catch (err) {
-      if (err instanceof Refused) {
-        entry.state = 'refused';
-        refuse('discovery-failed', entry.config.id);
-        if (atStart) throw new Error(`console.sso provider ${entry.config.id} refused at discovery: the issuer, algorithms, S256 or JWKS check failed`);
-        return;
-      }
-      entry.state = 'unreachable';
-      refuse('discovery-failed', entry.config.id);
-      throw err;
-    }
-  }
-  function retry(entry, delay) {
-    if (closed) return;
-    const timer = setTimeout(async () => {
-      timers.delete(timer);
-      try { await attempt(entry, false); } catch { retry(entry, Math.min(delay * 2, RETRY_CAP)); }
-    }, delay);
-    timer.unref();
-    timers.add(timer);
-  }
-  for (const entry of providers.values()) {
-    try { await attempt(entry, true); } catch (err) {
-      if (!(err instanceof Unreachable)) throw err;
-      retry(entry, retryFirst);
-    }
-  }
-
-  const page = (res, status, title, html, headers = {}) => {
-    res.writeHead(status, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', ...headers });
-    res.end(`<!doctype html><meta charset="utf-8"><title>${escape(title)}</title><main style="font-family:sans-serif;max-width:32rem;margin:4rem auto"><h1>${escape(title)}</h1>${html}</main>\n`);
-  };
-  const redirect = (res, location, setCookie = []) => {
-    res.writeHead(303, { location, 'cache-control': 'no-store', ...(setCookie.length ? { 'set-cookie': setCookie } : {}) });
-    res.end();
-  };
-  const failed = (res, setCookie = []) => page(res, 403, 'Sign-in failed', '<p><a href="/auth/login">Sign in again</a></p>', setCookie.length ? { 'set-cookie': setCookie } : {});
-  const expire = name => `${name}=; ${ATTRS}; Max-Age=0`;
-  const remember = (map, key, value, cap) => {
-    while (map.size >= cap) map.delete(map.keys().next().value);
-    map.set(key, value);
-  };
-
-  // B2: only a URL on publicOrigin itself; anything else, or nothing, is publicOrigin's `/`. The
-  // Location is absolute and its origin checked again: dot segments can leave a pathname of `//host`,
-  // which as a relative Location a browser reads as another origin (webby-0019 B1, sage-1403).
-  function returnURL(ret) {
-    const home = `${publicOrigin}/`;
-    try {
-      if (typeof ret !== 'string' || !ret) return home;
-      const u = new URL(ret, publicOrigin);
-      if (u.origin !== publicOrigin) return home;
-      const out = new URL(`${publicOrigin}${u.pathname}${u.search}`);
-      return out.origin === publicOrigin ? out.href : home;
-    } catch { return home; }
-  }
-
-  async function start(res, entry, ret) {
-    const state = oauth.generateRandomState(), nonce = oauth.generateRandomNonce(), verifier = oauth.generateRandomCodeVerifier();
-    const challenge = await oauth.calculatePKCECodeChallenge(verifier);
-    const id = randomBytes(32).toString('base64url');
-    remember(logins, sha256(id), { provider: entry.config.id, state, nonce, verifier, ret: typeof ret === 'string' ? ret.slice(0, 2048) : '/', expires: Date.now() + LOGIN_MAX_AGE * 1000 }, MAX_LOGINS);
-    const url = new URL(entry.as.authorization_endpoint);
-    for (const [k, v] of Object.entries({ client_id: entry.config.clientId, response_type: 'code', scope: 'openid profile email', redirect_uri: redirectUri, state, nonce, code_challenge: challenge, code_challenge_method: 'S256' })) url.searchParams.set(k, v);
-    return redirect(res, url.href, [`${LOGIN_COOKIE}=${id}; ${ATTRS}; Max-Age=${LOGIN_MAX_AGE}`]);
-  }
-
-  function login(res, query) {
-    const asked = query.get('provider');
-    const ret = query.get('return');
-    if (asked === null && providers.size > 1) {
-      const items = [...providers.values()].map(e => `<li><a href="/auth/login?${escape(new URLSearchParams({ provider: e.config.id, ...(ret ? { return: ret } : {}) }))}">${escape(e.config.id)}</a></li>`).join('');
-      return page(res, 200, 'Sign in', `<ul>${items}</ul>`);
-    }
-    const entry = asked === null ? [...providers.values()][0] : providers.get(asked);
-    if (!entry) return page(res, 404, 'Unknown sign-in provider', '<p><a href="/auth/login">Sign in</a></p>');
-    if (entry.state !== 'ready') return page(res, 503, 'sign-in unavailable', '<p>The sign-in provider can\'t be reached. Try again shortly.</p>');
-    return start(res, entry, ret);
-  }
-
-  // Design section 1, steps 2-7. Each refusal ends here with one log line and the 403 page.
-  async function callback(res, query, req) {
-    const clear = [expire(LOGIN_COOKIE)];
-    const ids = cookies(req, LOGIN_COOKIE);
-    const key = ids.length === 1 ? sha256(ids[0]) : null;
-    const record = key === null ? undefined : logins.get(key);
-    if (key !== null) logins.delete(key);
-    // The provider comes from the record, never from the query.
-    const entry = record && providers.get(record.provider);
-    if (!record || record.expires <= Date.now() || !entry) {
-      refuse('login-record-missing', record?.provider ?? 'none');
-      return failed(res, clear);
-    }
-    const pid = entry.config.id;
-    if (entry.state !== 'ready') { refuse('discovery-failed', pid); return failed(res, clear); }
-    let params;
-    try { params = oauth.validateAuthResponse(entry.as, entry.client, query, record.state); } catch (err) {
-      refuse(err instanceof oauth.AuthorizationResponseError ? 'auth-error-response' : 'state-mismatch', pid);
-      return failed(res, clear);
-    }
-    const options = () => ({ ...fetchOptions, [oauth.jwksCache]: entry.jwks, signal: AbortSignal.timeout(FETCH_TIMEOUT) });
-    let response;
-    try { response = await oauth.authorizationCodeGrantRequest(entry.as, entry.client, entry.auth, params, redirectUri, record.verifier, options()); } catch {
-      refuse('grant-failed', pid); return failed(res, clear);
-    }
-    let result, claims;
-    try {
-      result = await oauth.processAuthorizationCodeResponse(entry.as, entry.client, response, { expectedNonce: record.nonce, requireIdToken: true });
-      claims = oauth.getValidatedIdTokenClaims(result);
-    } catch (err) {
-      refuse(err instanceof oauth.ResponseBodyError ? 'grant-failed' : 'id-token-invalid', pid);
-      return failed(res, clear);
-    }
-    // Step 5: the library skips this for a token-endpoint ID token; point 2 needs it, on the same
-    // Response object. Its throw ends the callback.
-    try { await oauth.validateApplicationLevelSignature(entry.as, response, options()); } catch (err) {
-      const fetching = !(err instanceof oauth.OperationProcessingError || err instanceof oauth.UnsupportedOperationError) || [oauth.RESPONSE_IS_NOT_CONFORM, oauth.RESPONSE_IS_NOT_JSON].includes(err.code);
-      refuse(fetching ? 'jwks-failed' : 'signature-invalid', pid);
-      return failed(res, clear);
-    }
-    // Step 6: our own checks on top of the library's.
-    let header;
-    try { header = JSON.parse(Buffer.from(result.id_token.split('.')[0], 'base64url').toString('utf8')); } catch { header = null; }
-    if (!header || !entry.config.algs.includes(header.alg)) { refuse('alg-refused', pid); return failed(res, clear); }
-    if (claims.iss !== entry.config.issuer) { refuse('issuer-mismatch', pid); return failed(res, clear); }
-    const name = typeof claims.sub === 'string' ? entry.subjects.get(claims.sub) : undefined;
-    if (name === undefined) {
-      refuse('subject-unknown', pid, ` iss=${JSON.stringify(String(claims.iss).slice(0, 255))} sub=${JSON.stringify(String(claims.sub).slice(0, 255))}`);
-      return failed(res, clear);
-    }
-    // Step 7: the session, then the return path.
-    const id = randomBytes(32).toString('base64url'), now = Date.now();
-    remember(sessions, sha256(id), { provider: pid, iss: claims.iss, sub: claims.sub, name, idToken: result.id_token, created: now, seen: now }, MAX_SESSIONS);
-    return redirect(res, returnURL(record.ret), [...clear, `${SESSION_COOKIE}=${id}; ${ATTRS}`]);
-  }
-
-  // The session for this request, or null. `touch` is true only for a page load or a write (Q-D).
-  function session(req, { touch = false } = {}) {
-    const ids = cookies(req, SESSION_COOKIE);
-    if (ids.length !== 1) return null;
-    const key = sha256(ids[0]);
-    const s = sessions.get(key);
-    if (!s) return null;
-    const now = Date.now();
-    if (now - s.created >= SESSION_ABSOLUTE || now - s.seen >= SESSION_IDLE) { sessions.delete(key); return null; }
-    if (touch) s.seen = now;
-    return s;
-  }
-
-  function logout(req, res) {
-    const one = name => (req.headersDistinct[name]?.length === 1 ? req.headersDistinct[name][0] : null);
-    if (one('origin') !== publicOrigin || one('sec-fetch-site') !== 'same-origin') {
-      return page(res, 403, 'Sign-out refused', '<p>Sign out from the Console page.</p>');
-    }
-    const ids = cookies(req, SESSION_COOKIE);
-    const key = ids.length === 1 ? sha256(ids[0]) : null;
-    const s = key === null ? undefined : sessions.get(key);
-    if (key !== null) sessions.delete(key);
-    const entry = s && providers.get(s.provider);
-    let location = `${publicOrigin}/auth/signed-out`;
-    if (entry?.as?.end_session_endpoint) {
-      const url = new URL(entry.as.end_session_endpoint);
-      url.searchParams.set('id_token_hint', s.idToken);
-      url.searchParams.set('post_logout_redirect_uri', `${publicOrigin}/auth/signed-out`);
-      url.searchParams.set('client_id', entry.config.clientId);
-      location = url.href;
-    }
-    return redirect(res, location, [expire(SESSION_COOKIE)]);
-  }
-
-  // `/auth/*` on the human listener; the caller has already checked the Host.
-  async function handle(req, res, path, search) {
-    const query = new URLSearchParams(search);
-    if (path === '/auth/logout') {
-      if (req.method !== 'POST') return page(res, 405, 'Method not allowed', '');
-      return logout(req, res);
-    }
-    if (req.method !== 'GET') return page(res, 405, 'Method not allowed', '');
-    if (path === '/auth/login') return login(res, query);
-    if (path === '/auth/callback') return callback(res, query, req);
-    if (path === '/auth/signed-out') return page(res, 200, 'Signed out', '<p><a href="/auth/login">Sign in</a></p>');
-    return page(res, 404, 'Not found', '');
-  }
-
-  return {
-    publicOrigin, publicHost, sessions, logins, handle, session, returnURL,
-    health: () => Object.fromEntries([...providers].map(([id, e]) => [id, e.state])),
-    formTargets: () => [...new Set([...providers.values()].filter(e => e.as?.end_session_endpoint).map(e => new URL(e.as.end_session_endpoint).origin))],
-    summary: () => config.providers.map(p => ({ id: p.id, issuer: p.issuer, subjects: p.subjects.length })),
-    close() { closed = true; for (const t of timers) clearTimeout(t); timers.clear(); },
-  };
-}
@@ -1,155 +0,0 @@
-// Q175 phase 1 (#1690, design section 9): a fake OpenID provider for the --sso tests. A loopback
-// https server with a self-signed certificate made in a temp dir; `op.fetch` is a fetch that trusts
-// only that certificate, so the code under test needs no insecure flag. It serves any number of
-// issuers (`/<name>/`) at once, each with discovery, a JWKS, authorization, token and end-session
-// endpoints. Keys come from node:crypto. Nothing here reaches any other host.
-import { constants, createHash, createHmac, generateKeyPairSync, randomBytes, sign } from 'node:crypto';
-import { spawnSync } from 'node:child_process';
-import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
-import { createServer, request } from 'node:https';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-export const b64url = value => Buffer.from(typeof value === 'string' ? value : JSON.stringify(value)).toString('base64url');
-
-export function rsaKey(kid = `rsa-${randomBytes(4).toString('hex')}`, bits = 2048) {
-  const { privateKey, publicKey } = generateKeyPairSync('rsa', { modulusLength: bits });
-  return { kid, alg: 'RS256', privateKey, jwk: { ...publicKey.export({ format: 'jwk' }), kid, use: 'sig', alg: 'RS256' } };
-}
-export function ecKey(kid = `ec-${randomBytes(4).toString('hex')}`) {
-  const { privateKey, publicKey } = generateKeyPairSync('ec', { namedCurve: 'P-256' });
-  return { kid, alg: 'ES256', privateKey, jwk: { ...publicKey.export({ format: 'jwk' }), kid, use: 'sig', alg: 'ES256' } };
-}
-export function psKey(kid = `ps-${randomBytes(4).toString('hex')}`) {
-  const k = rsaKey(kid);
-  return { ...k, alg: 'PS256', jwk: { ...k.jwk, alg: 'PS256' } };
-}
-
-// A compact JWS. `alg` HS256 uses `hmac` as the key, `none` has an empty signature.
-export function jwt(header, payload, { key = null, hmac = null } = {}) {
-  const input = `${b64url(header)}.${b64url(payload)}`;
-  let sig = '';
-  if (header.alg === 'HS256') sig = createHmac('sha256', hmac).update(input).digest('base64url');
-  else if (header.alg === 'RS256') sig = sign('sha256', Buffer.from(input), key).toString('base64url');
-  else if (header.alg === 'PS256') sig = sign('sha256', Buffer.from(input), { key, padding: constants.RSA_PKCS1_PSS_PADDING, saltLength: 32 }).toString('base64url');
-  else if (header.alg === 'ES256') sig = sign('sha256', Buffer.from(input), { key, dsaEncoding: 'ieee-p1363' }).toString('base64url');
-  return `${input}.${sig}`;
-}
-
-function certificate() {
-  const dir = mkdtempSync(join(tmpdir(), 'fake-oidc-'));
-  try {
-    const r = spawnSync('openssl', ['req', '-x509', '-newkey', 'ec', '-pkeyopt', 'ec_paramgen_curve:P-256', '-nodes', '-days', '1',
-      '-subj', '/CN=127.0.0.1', '-addext', 'subjectAltName=IP:127.0.0.1', '-keyout', join(dir, 'key.pem'), '-out', join(dir, 'cert.pem')], { encoding: 'utf8' });
-    if (r.status !== 0) throw new Error(`openssl failed: ${r.stderr}`);
-    return { key: readFileSync(join(dir, 'key.pem')), cert: readFileSync(join(dir, 'cert.pem')) };
-  } finally { rmSync(dir, { recursive: true, force: true }); }
-}
-
-// One issuer's state. `discovery` is merged over the defaults; `mode` is 'ok', 'down' (the socket is
-// destroyed) or 'html' (200 with an HTML page) for discovery.
-function issuerState(name, base, opts) {
-  const keys = opts.keys ?? [rsaKey()];
-  return {
-    name, issuer: `${base}/${name}/`, keys, retired: [], clientId: opts.clientId ?? `client-${name}`, clientSecret: opts.clientSecret ?? `secret-${name}-${randomBytes(6).toString('hex')}`,
-    discovery: opts.discovery ?? {}, mode: 'ok', jwksOverride: null, codes: new Map(), acceptTwice: false, requirePkce: true,
-    tokenRequests: [], authorizeRequests: [], jwksFetches: 0, discoveryFetches: 0,
-  };
-}
-
-export async function fakeOidc() {
-  const { key, cert } = certificate();
-  const issuers = new Map();
-  const server = createServer({ key, cert }, (req, res) => {
-    const url = new URL(req.url, 'https://127.0.0.1');
-    const [, name, ...rest] = url.pathname.split('/');
-    const iss = issuers.get(name);
-    const route = rest.join('/');
-    const json = (status, body, type = 'application/json') => { res.writeHead(status, { 'content-type': type }); res.end(typeof body === 'string' ? body : JSON.stringify(body)); };
-    if (!iss) return json(404, { error: 'no issuer' });
-    if (route === '.well-known/openid-configuration') {
-      iss.discoveryFetches++;
-      if (iss.mode === 'down') return req.socket.destroy();
-      if (iss.mode === 'html') return json(200, '<!doctype html><title>Sign in</title>', 'text/html');
-      return json(200, discovery(iss));
-    }
-    if (route === 'jwks') {
-      iss.jwksFetches++;
-      return json(200, iss.jwksOverride ?? { keys: iss.keys.map(k => k.jwk) });
-    }
-    if (route === 'authorize') { iss.authorizeRequests.push(Object.fromEntries(url.searchParams)); return json(200, { ok: true }); }
-    if (route === 'end-session') return json(200, { ok: true });
-    if (route === 'token' && req.method === 'POST') {
-      let text = '';
-      req.on('data', c => (text += c));
-      req.on('end', () => {
-        const form = new URLSearchParams(text);
-        const basic = Buffer.from((req.headers.authorization ?? '').replace(/^Basic /, ''), 'base64').toString();
-        const [id, secret] = basic.split(':').map(decodeURIComponent);
-        iss.tokenRequests.push({ form: Object.fromEntries(form), clientId: id });
-        if (id !== iss.clientId || secret !== iss.clientSecret) return json(401, { error: 'invalid_client' });
-        const grant = iss.codes.get(form.get('code'));
-        if (!grant) return json(400, { error: 'invalid_grant' });
-        if (!iss.acceptTwice) iss.codes.delete(form.get('code'));
-        if (form.get('redirect_uri') !== grant.redirectUri) return json(400, { error: 'invalid_grant', error_description: 'redirect_uri' });
-        if (iss.requirePkce && createHash('sha256').update(form.get('code_verifier') ?? '').digest('base64url') !== grant.challenge) return json(400, { error: 'invalid_grant', error_description: 'pkce' });
-        return json(200, { access_token: randomBytes(16).toString('hex'), token_type: 'Bearer', expires_in: 300, id_token: grant.idToken });
-      });
-      return;
-    }
-    return json(404, { error: 'not found' });
-  });
-  await new Promise(r => server.listen(0, '127.0.0.1', r));
-  const base = `https://127.0.0.1:${server.address().port}`;
-
-  const discovery = iss => ({
-    issuer: iss.issuer, authorization_endpoint: `${iss.issuer}authorize`, token_endpoint: `${iss.issuer}token`, jwks_uri: `${iss.issuer}jwks`,
-    end_session_endpoint: `${iss.issuer}end-session`, response_types_supported: ['code'], subject_types_supported: ['public'],
-    id_token_signing_alg_values_supported: [...new Set(iss.keys.map(k => k.alg))], code_challenge_methods_supported: ['S256'],
-    ...iss.discovery,
-  });
-
-  // A fetch over node:https that trusts only this certificate. oauth4webapi passes a Headers object
-  // and a string or URLSearchParams body.
-  const opFetch = (input, init = {}) => new Promise((resolve, reject) => {
-    const url = new URL(typeof input === 'string' ? input : input.href ?? input.url);
-    if (url.protocol !== 'https:' || url.hostname !== '127.0.0.1' || url.port !== String(server.address().port)) return reject(new TypeError(`fake OP fetch refuses ${url.origin}`));
-    const headers = Object.fromEntries(new Headers(init.headers ?? {}));
-    const body = init.body === undefined || init.body === null ? undefined : String(init.body);
-    if (body !== undefined) headers['content-length'] = Buffer.byteLength(body);
-    const req = request(url, { method: init.method ?? 'GET', headers, ca: cert, signal: init.signal }, res => {
-      const chunks = [];
-      res.on('data', c => chunks.push(c));
-      res.on('end', () => {
-        const h = new Headers();
-        for (const [k, v] of Object.entries(res.headers)) h.set(k, Array.isArray(v) ? v.join(', ') : v);
-        const response = new Response(res.statusCode === 204 ? null : Buffer.concat(chunks), { status: res.statusCode, headers: h });
-        Object.defineProperty(response, 'url', { value: url.href });
-        resolve(response);
-      });
-      res.on('error', reject);
-    });
-    req.on('error', reject);
-    req.end(body);
-  });
-
-  return {
-    base, fetch: opFetch, cert,
-    issuer(name, opts = {}) { const iss = issuerState(name, base, opts); issuers.set(name, iss); return iss; },
-    // A code for `iss` whose ID token is built from the start redirect's nonce, the claims and header
-    // overrides. `challenge` defaults to the start redirect's; `idToken` replaces the token outright.
-    grant(iss, authorizeUrl, { sub = `user-${iss.name}`, claims = {}, header = {}, key = iss.keys[0], idToken = null, challenge = null, redirectUri = null } = {}) {
-      const q = new URL(authorizeUrl).searchParams;
-      const now = Math.floor(Date.now() / 1000);
-      const payload = { iss: iss.issuer, sub, aud: iss.clientId, iat: now, exp: now + 300, nonce: q.get('nonce'), ...claims };
-      for (const [k, v] of Object.entries(payload)) if (v === undefined) delete payload[k];
-      const token = idToken ?? jwt({ alg: key.alg, kid: key.kid, typ: 'JWT', ...header }, payload, { key: key.privateKey, hmac: iss.clientSecret });
-      const code = randomBytes(12).toString('base64url');
-      iss.codes.set(code, { idToken: token, challenge: challenge ?? q.get('code_challenge'), redirectUri: redirectUri ?? q.get('redirect_uri') });
-      return { code, idToken: token, payload };
-    },
-    rotate(iss, next = rsaKey()) { iss.retired.push(...iss.keys); iss.keys = [next]; return next; },
-    close: () => new Promise(r => { server.close(r); server.closeAllConnections(); }),
-  };
-}
-
@@ -30,7 +30,7 @@ function fakeCopy(dir) {
  writeFileSync(join(copyRoot(dir), 'packages', 'webui', 'src', 'cli.mjs'), '');
  return copyRoot(dir);
 }
-const SEND_REFUSAL = /^webui-service: --send needs the preview mode \(--public-host, --auth-header and --allow-user\) or --sso$/m;
+const SEND_REFUSAL = /^webui-service: --send needs the preview mode \(--public-host, --auth-header and --allow-user\)$/m;
 const TEMPLATE = readFileSync(join(REPO, 'packages', 'webui', 'systemd', 'mosaic-webui.service.in'), 'utf8');

 // The unit as the base script renders it (row 75): the template with its four
@@ -1,132 +0,0 @@
-// Q175 phase 1 (#1690, design test 24, sage-1340 F1, sage-1347 F7): the page under --sso. A read
-// the Console answers 401 `sign-in required` signs the page out the way a proxy redirect does, and
-// the line links to /auth/login with the current path and query; any other 401 stays an error. Both
-// fetch paths in app.js and both in bus.js (fetchRead and fetchApi) do it. The Sign out form shows
-// only when /api/config says sso. The board-held.test.mjs stub, with two lists of paths: those in
-// window.__signIn answer 401 `sign-in required`, those in window.__other 401 `unauthenticated`. A
-// page URL holding `sso` gets `sso: true` added to /api/config. Poll timers fire after 150 ms.
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { Store } from '../../bus/src/store.mjs';
-import { Broker } from '../../bus/src/broker.mjs';
-import { views } from '../../bus/src/views.mjs';
-import { startServer } from '../src/serve.mjs';
-import { browser } from './browser.mjs';
-import { fixture, close } from './fixture.mjs';
-
-const businesses = { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'cto', delivery: 'pm' }, roles: { pm: { authority: { withinRole: ['message.send'], crossRole: [] } }, cto: { authority: { withinRole: ['message.send'], crossRole: [] } } } } };
-
-const stub = `(() => {
-  const real = window.fetch.bind(window);
-  window.__reqs = []; window.__signIn = []; window.__other = [];
-  const timeout = window.setTimeout.bind(window);
-  window.setTimeout = (f, ms, ...rest) => timeout(f, ms === 10000 ? 150 : ms, ...rest);
-  const answer = (status, body) => new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } });
-  window.fetch = async (url, init = {}) => {
-    const path = String(url).split('?')[0];
-    window.__reqs.push(path);
-    if (window.__signIn.includes(path)) return answer(401, { error: 'sign-in required' });
-    if (window.__other.includes(path)) return answer(401, { error: 'unauthenticated' });
-    if (path === '/api/config' && /sso/.test(location.search)) return answer(200, { ...(await (await real(url, init)).json()), sso: true });
-    return real(url, init);
-  };
-})();`;
-
-async function setup() {
-  const root = mkdtempSync(join(tmpdir(), 'webui-sso-browser-'));
-  const store = new Store(root), b0 = new Broker({ store, businesses });
-  b0.request(b0.bindLaunch({ business: 'demo', role: 'pm', run: 'pm-run', harness: 'pi', address: 'pm-run' }), { verb: 'role.claim' });
-  const reader = b0.bindReader({ business: 'demo' });
-  const bus = views({ call: async (verb, args = {}) => structuredClone(b0.request(reader, { verb, args })) });
-  const f = await fixture(), b = await browser({ machine: true });
-  const web = await startServer({ port: 0, board: f.boardURL, bus }), base = `http://127.0.0.1:${web.address().port}/`;
-  await b.call('Page.addScriptToEvaluateOnNewDocument', { source: stub });
-  await b.viewport(1280);
-  const wait = expr => b.evaluate(`(async()=>{for(let i=0;i<100;i++){if(${expr})return true;await new Promise(r=>setTimeout(r,50))}throw new Error('Condition timed out: '+${JSON.stringify(expr)})})()`);
-  const text = sel => b.evaluate(`document.querySelector(${JSON.stringify(sel)})?.textContent ?? null`);
-  const shown = sel => b.evaluate(`(()=>{const e=document.querySelector(${JSON.stringify(sel)});return !!e && !e.hidden && getComputedStyle(e).display !== 'none' && !!e.getClientRects().length})()`);
-  const reqs = () => b.evaluate('window.__reqs.length');
-  const settle = () => new Promise(r => setTimeout(r, 600));
-  const done = async () => { await b.close(); await close(web); await f.close(); store.close(); rmSync(root, { recursive: true, force: true }); };
-  return { b, base, wait, text, shown, reqs, settle, done };
-}
-
-const LOADED = 'document.querySelector("table.sessions [data-open=\'proj/agent1\']")';
-const LINE = 'Signed out. Sign in again.';
-
-test('a 401 sign-in required on each fetch path signs the page out with a sign-in link and stops the refresh; another 401 stays an error', { timeout: 120000 }, async () => {
-  const { b, base, wait, text, shown, reqs, settle, done } = await setup();
-  // The line, its link back to this page, the Sign out form gone, and no further fetch.
-  const out = async ret => {
-    await wait('!document.querySelector("#signed-out").hidden');
-    assert.equal(await text('#signed-out'), LINE);
-    assert.equal(await b.evaluate('document.querySelector("#signed-out a").getAttribute("href")'), `/auth/login?return=${encodeURIComponent(ret)}`);
-    assert.equal(await shown('#sign-out'), false);
-    assert.equal(await b.evaluate('document.querySelector("#refresh").disabled'), true);
-    const n = await reqs();
-    await b.evaluate('document.querySelector("#refresh").click(), true');
-    await settle();
-    assert.equal(await reqs(), n, 'the page fetched after signing out');
-  };
-  try {
-    // app.js api(): the Board read, with sso on from /api/config.
-    await b.navigate(`${base}?sso&x=1`);
-    await wait(LOADED);
-    await b.evaluate(`window.__signIn.push('/api/board'), document.querySelector('#refresh').click(), true`);
-    await out('/?sso&x=1');
-
-    // app.js getJSON: the conversation catalogue behind History.
-    await b.navigate(`${base}?sso&conv`);
-    await wait(LOADED);
-    await b.evaluate(`window.__signIn.push('/api/conversations'), document.querySelector('table.sessions [data-history="proj/agent1"]').click(), true`);
-    await out('/?sso&conv');
-
-    // app.js api(): the board POST behind Seen.
-    await b.navigate(`${base}?sso&seen`);
-    await wait(LOADED);
-    await b.evaluate(`document.querySelector('table.sessions [data-open="proj/agent1"]').click(), true`);
-    await wait('document.querySelector("#inspection [data-seen]")');
-    await b.evaluate(`window.__signIn.push('/api/seen'), document.querySelector('#inspection [data-seen]').click(), true`);
-    await out('/?sso&seen');
-
-    // bus.js fetchRead and fetchApi, on a page whose /api/config has no sso: the link comes from
-    // the 401 itself (F1).
-    await b.navigate(`${base}?read#/inbox`);
-    await wait(LOADED);
-    await b.evaluate(`window.__signIn.push('/api/bus/inbox'), document.querySelector('#refresh').click(), true`);
-    await out('/?read');
-    await b.navigate(`${base}?module`);
-    await wait(LOADED);
-    await b.evaluate(`window.__signIn.push('/api/queue'), location.hash = '#/queue', true`);
-    await out('/?module');
-
-    // Any other 401 is an error: no sign-out, and the polls go on.
-    await b.navigate(`${base}?sso&other`);
-    await wait(LOADED);
-    await b.evaluate(`window.__other.push('/api/board', '/api/bus/inbox', '/api/queue'), document.querySelector('#refresh').click(), true`);
-    await settle();
-    assert.equal(await b.evaluate('document.querySelector("#signed-out").hidden'), true);
-    assert.equal(await b.evaluate('document.body.classList.contains("signed-out")'), false);
-    const n = await reqs();
-    await settle();
-    assert.ok(await reqs() > n, 'the refresh stopped on another 401');
-    assert.equal(await shown('#sign-out'), true);
-  } finally { await done(); }
-});
-
-test('the Sign out form shows only when /api/config says sso, and posts to /auth/logout', { timeout: 120000 }, async () => {
-  const { b, base, wait, shown, done } = await setup();
-  try {
-    await b.navigate(base);
-    await wait(LOADED);
-    await new Promise(r => setTimeout(r, 300));
-    assert.equal(await shown('#sign-out'), false);
-    await b.navigate(`${base}?sso`);
-    await wait(`${LOADED} && !document.querySelector("#sign-out").hidden`);
-    assert.equal(await shown('#sign-out'), true);
-    assert.deepEqual(await b.evaluate('(() => { const f = document.querySelector("#sign-out"); return [f.method, f.getAttribute("action"), f.querySelector("button").textContent, f.querySelector("button").type]; })()'), ['post', '/auth/logout', 'Sign out', 'submit']);
-  } finally { await done(); }
-});
@@ -1,589 +0,0 @@
-// Q175 phase 1 (#1690, design agents/sage/work/q175-sso/DESIGN.md section 9): the Console as an
-// OIDC relying party (--sso). Every provider is the fake OP in helpers/fake-oidc.mjs on loopback;
-// no test reaches a real provider, the live Console or a real config or slot file. The public name
-// is console.example.test, sent only as a Host header to the test's own loopback listener. Each
-// refusal checks the status, that no session cookie was set and that the send stub never ran.
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { request } from 'node:http';
-import { spawn, spawnSync } from 'node:child_process';
-import { chmodSync, mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { startServer } from '../src/serve.mjs';
-import { createSso, readSlot, SESSION_COOKIE, LOGIN_COOKIE } from '../src/sso.mjs';
-import { close } from './fixture.mjs';
-import { b64url, ecKey, fakeOidc, jwt, psKey, rsaKey } from './helpers/fake-oidc.mjs';
-
-const HOST = 'console.example.test', ORIGIN = `https://${HOST}`;
-const CLI = fileURLToPath(new URL('../src/cli.mjs', import.meta.url));
-const MSG = JSON.stringify({ to: 'coder', body: 'Please look at row 192.' });
-// Test 19: every log line any test here captured, and every token, code, state, nonce, verifier,
-// client secret and session id any test produced. The last test checks the one against the other.
-const ALL_LINES = [], PRODUCED = new Set();
-
-// node:http, not fetch: fetch can't set Host, Origin or Sec-Fetch-Site.
-function call(port, { method = 'GET', path = '/', headers = {}, body, host = HOST } = {}) {
-  return new Promise((resolve, reject) => {
-    const length = body === undefined ? {} : { 'content-length': Buffer.byteLength(body) };
-    const req = request({ host: '127.0.0.1', port, method, path, headers: { host, ...length, ...headers } }, res => {
-      let text = '';
-      res.on('data', c => (text += c));
-      res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body: text && (res.headers['content-type'] ?? '').startsWith('application/json') ? JSON.parse(text) : text }));
-    });
-    req.on('error', reject);
-    req.end(body);
-  });
-}
-const setCookies = r => [r.headers['set-cookie'] ?? []].flat();
-const sessionOf = r => setCookies(r).find(c => c.startsWith(`${SESSION_COOKIE}=`) && !c.includes('Max-Age=0'))?.split(';')[0] ?? null;
-const writeHeaders = cookie => ({ ...(cookie ? { cookie } : {}), origin: ORIGIN, 'sec-fetch-site': 'same-origin', 'content-type': 'application/json' });
-
-function providerFor(iss, extra = {}) {
-  return { id: iss.name, issuer: iss.issuer, clientId: iss.clientId, clientSecret: { slot: iss.name }, algs: [...new Set(iss.keys.map(k => k.alg))], subjects: [{ sub: `user-${iss.name}`, name: `person-${iss.name}` }], ...extra };
-}
-
-// A fake OP with `issuers`, createSso over them, and the human listener with a counting send.
-async function setup(t, { issuers = [{ name: 'a' }], provider = {}, before = null, retryFirst = 5000, server = {} } = {}) {
-  const op = await fakeOidc();
-  t.after(() => op.close());
-  const iss = issuers.map(o => op.issuer(o.name, o));
-  for (const i of iss) PRODUCED.add(i.clientSecret);
-  before?.(op, iss);
-  const config = { publicOrigin: ORIGIN, providers: iss.map(i => providerFor(i, provider[i.name] ?? {})) };
-  const lines = [];
-  const log = line => { lines.push(line); ALL_LINES.push(line); };
-  const sso = await createSso(config, { secrets: new Map(iss.map(i => [i.name, i.clientSecret])), fetch: op.fetch, log, retryFirst });
-  t.after(() => sso.close());
-  const sends = [];
-  const bus = Object.fromEntries(['inbox', 'tasks', 'agents', 'trail', 'decisions'].map(v => [v, async () => [{ verb: v }]]));
-  const web = await startServer({ port: 0, board: 'http://127.0.0.1:9', bus, sso, send: async args => { sends.push(args); return { id: 'msg-0001' }; }, log, ...server });
-  t.after(() => close(web));
-  return { op, iss, sso, port: web.address().port, lines, sends, config, bus };
-}
-
-// GET /auth/login; returns the authorize URL and the login cookie (name=value).
-async function begin(env, { provider = null, ret = null, query = null, host = HOST } = {}) {
-  const q = query ?? new URLSearchParams({ ...(provider ? { provider } : {}), ...(ret !== null ? { return: ret } : {}) }).toString();
-  const r = await call(env.port, { path: `/auth/login${q ? `?${q}` : ''}`, host });
-  assert.equal(r.status, 303, `login start: ${r.status} ${r.body}`);
-  const cookie = setCookies(r)[0].split(';')[0];
-  const location = r.headers.location;
-  const params = new URL(location).searchParams;
-  PRODUCED.add(cookie.split('=')[1]);
-  for (const k of ['state', 'nonce', 'code_challenge']) PRODUCED.add(params.get(k));
-  for (const record of env.sso.logins.values()) PRODUCED.add(record.verifier);
-  return { r, cookie, location, params };
-}
-function callback(env, begun, { code, state = begun.params.get('state'), extra = {}, cookie = begun.cookie } = {}) {
-  const q = new URLSearchParams({ ...(code !== undefined ? { code } : {}), state, ...extra });
-  return call(env.port, { path: `/auth/callback?${q}`, headers: cookie ? { cookie } : {} });
-}
-function grant(env, begun, iss, opts = {}) {
-  const g = env.op.grant(iss, begun.location, opts);
-  PRODUCED.add(g.code);
-  PRODUCED.add(g.idToken);
-  return g;
-}
-// A whole sign-in: start, a code at the OP, the callback. Returns the callback answer and the
-// session cookie (name=value) when one was set.
-async function signIn(env, { iss = env.iss[0], ret = null, opts = {} } = {}) {
-  const begun = await begin(env, { provider: env.iss.length > 1 ? iss.name : null, ret });
-  const g = grant(env, begun, iss, opts);
-  const r = await callback(env, begun, { code: g.code });
-  const session = sessionOf(r);
-  if (session) PRODUCED.add(session.split('=')[1]);
-  return { begun, g, r, session };
-}
-function refused(env, r, code) {
-  assert.equal(r.status, 403, `expected 403, got ${r.status}`);
-  assert.equal(sessionOf(r), null, 'a session cookie was set');
-  assert.equal(env.sends.length, 0, 'the send stub ran');
-  assert.ok(setCookies(r).includes(`${LOGIN_COOKIE}=; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=0`), 'the login cookie was not expired');
-  if (code) assert.match(env.lines.at(-1), new RegExp(` sso refused code=${code} provider=`), env.lines.at(-1));
-}
-
-test('positive: an RS256 provider signs in and sends one message, and the session reads', async t => {
-  const env = await setup(t);
-  assert.notEqual(env.port, 7332);
-  const { r, session } = await signIn(env, { ret: '/board?x=1' });
-  assert.equal(r.status, 303);
-  assert.equal(r.headers.location, `${ORIGIN}/board?x=1`);
-  assert.ok(session);
-  const send = await call(env.port, { method: 'POST', path: '/api/bus/message', headers: writeHeaders(session), body: MSG });
-  assert.equal(send.status, 200, JSON.stringify(send.body));
-  assert.deepEqual(env.sends, [{ to: 'coder', body: 'Please look at row 192.' }]);
-  assert.match(env.lines.at(-1), / send user="person-a" to="coder" id=msg-0001$/);
-  const read = await call(env.port, { path: '/api/bus/inbox', headers: { cookie: session } });
-  assert.equal(read.status, 200);
-  const config = await call(env.port, { path: '/api/config', headers: { cookie: session } });
-  assert.equal(config.body.sso, true);
-  assert.equal(config.body.send, true);
-});
-
-test('positive: an ES256 provider signs in and sends', async t => {
-  const env = await setup(t, { issuers: [{ name: 'e', keys: [ecKey()] }] });
-  assert.deepEqual(env.config.providers[0].algs, ['ES256']);
-  const { session } = await signIn(env);
-  assert.ok(session);
-  assert.equal((await call(env.port, { method: 'POST', path: '/api/bus/message', headers: writeHeaders(session), body: MSG })).status, 200);
-  assert.equal(env.sends.length, 1);
-});
-
-test('positive: two providers each sign in their own subjects, and one provider\'s subject is unknown to the other', async t => {
-  const env = await setup(t, { issuers: [{ name: 'a' }, { name: 'b', keys: [ecKey()] }] });
-  const list = await call(env.port, { path: '/auth/login?return=%2Fboard' });
-  assert.equal(list.status, 200);
-  assert.match(list.body, /provider=a&#38;return=%2Fboard/);
-  assert.match(list.body, /provider=b&#38;return=%2Fboard/);
-  const [a, b] = env.iss;
-  assert.ok((await signIn(env, { iss: a })).session);
-  assert.ok((await signIn(env, { iss: b })).session);
-  const names = [...env.sso.sessions.values()].map(s => s.name);
-  assert.deepEqual(names, ['person-a', 'person-b']);
-  const cross = await signIn(env, { iss: b, opts: { sub: 'user-a' } });
-  refused({ ...env, sends: [] }, cross.r, 'subject-unknown');
-});
-
-test('1: a forged x-authentik header without a cookie is 401 on the API and a sign-in redirect on a page', async t => {
-  const env = await setup(t);
-  const forged = { 'x-authentik-username': 'jason.woltje', origin: ORIGIN, 'sec-fetch-site': 'same-origin', 'content-type': 'application/json' };
-  for (const [method, path, body] of [['POST', '/api/bus/message', MSG], ['POST', '/api/settings', '{}'], ['GET', '/api/config', undefined]]) {
-    const r = await call(env.port, { method, path, headers: forged, body });
-    assert.equal(r.status, 401, `${method} ${path}`);
-    assert.deepEqual(r.body, { error: 'sign-in required' });
-  }
-  const page = await call(env.port, { path: '/', headers: forged });
-  assert.equal(page.status, 303);
-  assert.equal(page.headers.location, '/auth/login?return=%2F');
-  const deep = await call(env.port, { path: '/board?x=1' });
-  assert.equal(deep.headers.location, '/auth/login?return=%2Fboard%3Fx%3D1');
-  assert.equal(env.sends.length, 0);
-});
-
-test('2: an HS256 ID token keyed with the client secret and a real RSA kid is refused', async t => {
-  const env = await setup(t);
-  const [iss] = env.iss;
-  const { r } = await signIn(env, { opts: { header: { alg: 'HS256', kid: iss.keys[0].kid } } });
-  refused(env, r, 'id-token-invalid');
-});
-
-test('3: a wrong aud, and an aud list holding another client with no azp, are refused', async t => {
-  const env = await setup(t);
-  refused(env, (await signIn(env, { opts: { claims: { aud: 'another-client' } } })).r, 'id-token-invalid');
-  refused(env, (await signIn(env, { opts: { claims: { aud: [env.iss[0].clientId, 'another-client'] } } })).r, 'id-token-invalid');
-});
-
-test('4: a token that expired 10 minutes ago is refused', async t => {
-  const env = await setup(t);
-  const now = Math.floor(Date.now() / 1000);
-  refused(env, (await signIn(env, { opts: { claims: { iat: now - 900, exp: now - 600 } } })).r, 'id-token-invalid');
-});
-
-test('5: another issuer, and the issuer without its trailing slash, are refused', async t => {
-  const env = await setup(t);
-  const [iss] = env.iss;
-  refused(env, (await signIn(env, { opts: { claims: { iss: `${env.op.base}/other/` } } })).r, 'id-token-invalid');
-  refused(env, (await signIn(env, { opts: { claims: { iss: iss.issuer.slice(0, -1) } } })).r, 'id-token-invalid');
-});
-
-test('6: a nonce mismatch and a missing nonce are refused', async t => {
-  const env = await setup(t);
-  refused(env, (await signIn(env, { opts: { claims: { nonce: 'not-the-nonce' } } })).r, 'id-token-invalid');
-  refused(env, (await signIn(env, { opts: { claims: { nonce: undefined } } })).r, 'id-token-invalid');
-});
-
-test('7: state mismatch, no login cookie, a replay, an expired record and two login cookies are refused', async t => {
-  const env = await setup(t);
-  const [iss] = env.iss;
-  let begun = await begin(env);
-  refused(env, await callback(env, begun, { code: grant(env, begun, iss).code, state: 'wrong-state' }), 'state-mismatch');
-  begun = await begin(env);
-  refused(env, await callback(env, begun, { code: grant(env, begun, iss).code, cookie: null }), 'login-record-missing');
-  // Replay: the OP takes the code twice, so only the take-and-delete rule refuses the second callback.
-  iss.acceptTwice = true;
-  begun = await begin(env);
-  const g = grant(env, begun, iss);
-  const first = await callback(env, begun, { code: g.code });
-  assert.equal(first.status, 303);
-  PRODUCED.add(sessionOf(first).split('=')[1]);
-  refused(env, await callback(env, begun, { code: g.code }), 'login-record-missing');
-  iss.acceptTwice = false;
-  begun = await begin(env);
-  for (const record of env.sso.logins.values()) record.expires = Date.now() - 1;
-  refused(env, await callback(env, begun, { code: grant(env, begun, iss).code }), 'login-record-missing');
-  begun = await begin(env);
-  const other = await begin(env);
-  refused(env, await callback(env, begun, { code: grant(env, begun, iss).code, cookie: `${begun.cookie}; ${other.cookie}` }), 'login-record-missing');
-});
-
-test('8: the token request carries the PKCE verifier, and the OP refuses a wrong one', async t => {
-  const env = await setup(t);
-  const [iss] = env.iss;
-  const { r, begun } = await signIn(env);
-  assert.equal(r.status, 303);
-  const { form } = iss.tokenRequests.at(-1);
-  assert.equal(begun.params.get('code_challenge_method'), 'S256');
-  const { createHash } = await import('node:crypto');
-  assert.equal(createHash('sha256').update(form.code_verifier).digest('base64url'), begun.params.get('code_challenge'));
-  refused(env, (await signIn(env, { opts: { challenge: 'not-the-challenge' } })).r, 'grant-failed');
-});
-
-test('9: alg none, a changed payload under a real kid, and an unknown kid even after the refetch are refused', async t => {
-  const env = await setup(t);
-  const [iss] = env.iss;
-  // (a) alg none: the alg rule, before any signature check.
-  refused(env, (await signIn(env, { opts: { header: { alg: 'none' } } })).r, 'id-token-invalid');
-  // (b) a real kid's signature over another payload: only the signature check catches it.
-  let begun = await begin(env);
-  const real = env.op.grant(iss, begun.location);
-  PRODUCED.add(real.idToken);
-  const [h, , s] = real.idToken.split('.');
-  const forged = `${h}.${b64url({ ...real.payload, name: 'changed' })}.${s}`;
-  refused(env, await callback(env, begun, { code: grant(env, begun, iss, { idToken: forged }).code }), 'signature-invalid');
-  // (c) a key the JWKS never held, again after the cache is old enough to refetch.
-  t.mock.timers.enable({ apis: ['Date'], now: Date.now() });
-  const stranger = rsaKey('not-in-jwks');
-  refused(env, (await signIn(env, { opts: { key: stranger } })).r, 'signature-invalid');
-  const fetches = iss.jwksFetches;
-  t.mock.timers.tick(61000);
-  refused(env, (await signIn(env, { opts: { key: stranger } })).r, 'signature-invalid');
-  assert.equal(iss.jwksFetches, fetches + 1, 'no refetch');
-});
-
-test('10: a valid token for a subject not configured is 403 with one subject-unknown line', async t => {
-  const env = await setup(t);
-  const before = env.lines.length;
-  const { r } = await signIn(env, { opts: { sub: 'stranger' } });
-  refused(env, r, 'subject-unknown');
-  const added = env.lines.slice(before);
-  assert.equal(added.length, 1);
-  assert.match(added[0], new RegExp(`^\\S+ sso refused code=subject-unknown provider=a iss=${JSON.stringify(env.iss[0].issuer).replace(/[.*+?^${}()|[\]\\/]/g, '\\$&')} sub="stranger"$`));
-});
-
-test('11: start refusals: HS or none algs, reserved names, HS-only discovery, an empty JWKS, no S256, an issuer mismatch, a short RSA key', async t => {
-  const op = await fakeOidc();
-  t.after(() => op.close());
-  const start = (iss, extra = {}) => createSso({ publicOrigin: ORIGIN, providers: [providerFor(iss, extra)] }, { secrets: new Map([[iss.name, iss.clientSecret]]), fetch: op.fetch, log: l => ALL_LINES.push(l) });
-  const a = op.issuer('a');
-  PRODUCED.add(a.clientSecret);
-  for (const [extra, why] of [
-    [{ algs: ['HS256'] }, /algs\[0\] must be one of .*HS\* and none are refused/],
-    [{ algs: ['none'] }, /algs\[0\] must be one of/],
-    [{ subjects: [{ sub: 'u', name: 'tester' }] }, /subjects\[0\]\.name must not be tester or human/],
-    [{ subjects: [{ sub: 'u', name: 'Human' }] }, /subjects\[0\]\.name must not be tester or human/],
-  ]) await assert.rejects(start(a, extra), why);
-  const refusedAtDiscovery = /console\.sso provider \w+ refused at discovery/;
-  // The mosaic-preview shape: HS256 only.
-  const hs = op.issuer('hs', { discovery: { id_token_signing_alg_values_supported: ['HS256'] } });
-  await assert.rejects(start(hs, { algs: ['RS256'] }), refusedAtDiscovery);
-  const empty = op.issuer('empty');
-  empty.jwksOverride = { keys: [] };
-  await assert.rejects(start(empty), refusedAtDiscovery);
-  const plain = op.issuer('plain', { discovery: { code_challenge_methods_supported: ['plain'] } });
-  await assert.rejects(start(plain), refusedAtDiscovery);
-  const moved = op.issuer('moved');
-  moved.discovery = { issuer: `${op.base}/elsewhere/` };
-  await assert.rejects(start(moved), refusedAtDiscovery);
-  const small = op.issuer('small', { keys: [rsaKey('small', 1024)] });
-  await assert.rejects(start(small), refusedAtDiscovery);
-  // The control: the same OP and provider start.
-  const sso = await start(a);
-  assert.deepEqual(sso.health(), { a: 'ready' });
-  sso.close();
-  await assert.rejects(startServer({ port: 0, sso, preview: { host: HOST, header: 'remote-user', user: 'jason' } }), /--sso cannot be combined/);
-});
-
-test('11: slot files: a symlink, mode 0644, mode 0640 and a file under the repository are refused, and no message holds the value', t => {
-  const root = mkdtempSync(join(tmpdir(), 'webui-sso-slot-'));
-  t.after(() => rmSync(root, { recursive: true, force: true }));
-  const dir = join(root, 'config'), slots = join(dir, 'secrets', 'mosaic-stack');
-  mkdirSync(slots, { recursive: true });
-  const provider = slot => ({ id: 'a', clientSecret: { slot } });
-  const value = 'slot-value-do-not-print';
-  const opts = { repo: join(root, 'repo'), copies: join(root, 'copies') };
-  writeFileSync(join(slots, 'good'), `${value}\n`, { mode: 0o600 });
-  assert.equal(readSlot(dir, provider('good'), opts), value);
-  writeFileSync(join(root, 'target'), value, { mode: 0o600 });
-  symlinkSync(join(root, 'target'), join(slots, 'link'));
-  for (const [slot, mode] of [['wide', 0o644], ['group', 0o640]]) { writeFileSync(join(slots, slot), value); chmodSync(join(slots, slot), mode); }
-  writeFileSync(join(slots, 'two'), `${value}\nmore\n`, { mode: 0o600 });
-  writeFileSync(join(slots, 'empty'), '\n', { mode: 0o600 });
-  const cases = [
-    ['missing', /slot is missing$/, opts],
-    ['link', /must not be a symbolic link$/, opts],
-    ['wide', /must have no group or other permission bits$/, opts],
-    ['group', /must have no group or other permission bits$/, opts],
-    ['two', /must hold one non-empty line$/, opts],
-    ['empty', /must hold one non-empty line$/, opts],
-    // The config dir itself under the repository, and under a --checkout.
-    ['good', /must not be inside the repository or a stack copy$/, { ...opts, repo: root }],
-    ['good', /must not be inside the repository or a stack copy$/, { ...opts, checkout: dir }],
-    ['good', /must not be inside the repository or a stack copy$/, { ...opts, copies: dir }],
-  ];
-  for (const [slot, why, o] of cases) {
-    let err = null;
-    try { readSlot(dir, provider(slot), o); } catch (e) { err = e; }
-    assert.ok(err, `${slot} was read`);
-    assert.match(err.message, /^console\.sso provider a client secret slot /);
-    assert.match(err.message, why, slot);
-    assert.equal(err.message.includes(value), false);
-    assert.equal(err.message.includes(root), false);
-  }
-});
-
-test('11: the CLI refuses --sso with the old flags and without console.sso, and starts with a good one', async t => {
-  const root = mkdtempSync(join(tmpdir(), 'wsso-'));
-  t.after(() => rmSync(root, { recursive: true, force: true }));
-  const env = { ...process.env, MOSAIC_CONFIG: join(root, 'cfg', 'config.json'), XDG_DATA_HOME: join(root, 'xdg') };
-  for (const flags of [['--auth-header', 'remote-user'], ['--public-host', HOST], ['--allow-user', 'jason'], ['--proof-header', 'x-proof']]) {
-    const r = spawnSync(process.execPath, [CLI, 'serve', '--port', '0', '--sso', ...flags], { encoding: 'utf8', timeout: 10000, env });
-    assert.equal(r.status, 2, flags.join(' '));
-    assert.match(r.stderr, /^refused: --sso cannot be combined with --public-host, --auth-header, --allow-user or --proof-\*$/m);
-  }
-  const missing = spawnSync(process.execPath, [CLI, 'serve', '--port', '0', '--sso'], { encoding: 'utf8', timeout: 10000, env });
-  assert.equal(missing.status, 2);
-  assert.match(missing.stderr, /^refused: --sso needs the system config \(/);
-  const op = await fakeOidc();
-  t.after(() => op.close());
-  const a = op.issuer('a');
-  PRODUCED.add(a.clientSecret);
-  mkdirSync(join(root, 'cfg', 'secrets', 'mosaic-stack'), { recursive: true });
-  writeFileSync(join(root, 'ca.pem'), op.cert);
-  const base = { configVersion: 1, environment: 'development', dataRoot: join(root, 'data'), execution: { backend: 'docker', provider: 'zai', model: 'm' } };
-  writeFileSync(env.MOSAIC_CONFIG, JSON.stringify(base));
-  const noKey = spawnSync(process.execPath, [CLI, 'serve', '--port', '0', '--sso'], { encoding: 'utf8', timeout: 10000, env });
-  assert.equal(noKey.status, 2);
-  assert.match(noKey.stderr, /^refused: --sso needs console\.sso in the system config$/m);
-  writeFileSync(env.MOSAIC_CONFIG, JSON.stringify({ ...base, console: { sso: { publicOrigin: ORIGIN, providers: [providerFor(a)] } } }));
-  writeFileSync(join(root, 'cfg', 'secrets', 'mosaic-stack', 'a'), `${a.clientSecret}\n`, { mode: 0o644 });
-  const wide = spawnSync(process.execPath, [CLI, 'serve', '--port', '0', '--sso'], { encoding: 'utf8', timeout: 10000, env });
-  assert.equal(wide.status, 2);
-  assert.match(wide.stderr, /^refused: console\.sso provider a client secret slot must have no group or other permission bits$/m);
-  chmodSync(join(root, 'cfg', 'secrets', 'mosaic-stack', 'a'), 0o600);
-  // The child trusts the fake OP's certificate through NODE_EXTRA_CA_CERTS; the code under test has no flag for it.
-  const child = spawn(process.execPath, [CLI, 'serve', '--port', '0', '--sso'], { env: { ...env, NODE_EXTRA_CA_CERTS: join(root, 'ca.pem') } });
-  t.after(() => child.kill('SIGKILL'));
-  let out = '', err = '';
-  child.stderr.on('data', c => (err += c));
-  await new Promise((resolve, reject) => {
-    const timer = setTimeout(() => reject(new Error(`no start line: ${out} ${err}`)), 15000);
-    child.stdout.on('data', c => { out += c; if (out.includes('Ctrl-C')) { clearTimeout(timer); resolve(); } });
-    child.on('exit', () => { clearTimeout(timer); reject(new Error(`exited: ${err}`)); });
-  });
-  assert.match(out, new RegExp(`^Sign-in: ${ORIGIN}/ \\(--sso\\), read-only$`, 'm'));
-  assert.match(out, new RegExp(`^Sign-in provider: a issuer ${a.issuer.replace(/[.]/g, '\\.')} subjects 1 \\(ready\\)$`, 'm'));
-  assert.equal(out.includes(a.clientSecret) || err.includes(a.clientSecret), false);
-  assert.equal(out.includes(a.clientId), false);
-  const port = Number(out.match(/^Mosaic Console: http:\/\/127\.0\.0\.1:(\d+)\//m)[1]);
-  const health = await call(port, { path: '/healthz', host: `127.0.0.1:${port}` });
-  assert.deepEqual(health.body, { ok: true, sso: { a: 'ready' } });
-  child.kill('SIGTERM');
-});
-
-test('12: under --sso the tester listener refuses each kind of sign-in, has no /auth, and startServer refuses tester with sso', async t => {
-  const env = await setup(t);
-  const tester = await startServer({ port: 0, board: 'http://127.0.0.1:9', bus: env.bus, tester: true, testerNoSignIn: true, log: () => {} });
-  t.after(() => close(tester));
-  const port = tester.address().port, host = `127.0.0.1:${port}`;
-  const { session, g, begun } = await signIn(env);
-  assert.ok(session);
-  const plain = await call(port, { path: '/api/config', host });
-  assert.equal(plain.status, 200, 'control: a request with no sign-in is served');
-  for (const headers of [
-    { cookie: session },
-    { cookie: `theme=dark; ${begun.cookie}` },
-    { cookie: `${SESSION_COOKIE.toLowerCase()}=x` },
-    { authorization: `Bearer ${g.idToken}` },
-    { 'x-authentik-jwt': g.idToken },
-    { 'X-Authentik-Username': 'jason.woltje' },
-  ]) {
-    const r = await call(port, { path: '/api/config', host, headers });
-    assert.equal(r.status, 403, JSON.stringify(Object.keys(headers)));
-    assert.deepEqual(r.body, { error: 'tester listener takes no sign-in' });
-  }
-  assert.equal((await call(port, { path: '/auth/login', host })).status, 404);
-  await assert.rejects(startServer({ port: 0, tester: true, sso: env.sso }), /tester listener cannot use sso/);
-});
-
-test('13: idle and absolute expiry, logout then reuse, a cross-origin logout, and background reads that don\'t keep a session', async t => {
-  const env = await setup(t);
-  const read = cookie => call(env.port, { path: '/api/bus/inbox', headers: { cookie } });
-  const record = () => [...env.sso.sessions.values()].at(-1);
-  // Background reads don't move `seen`; a page load does.
-  let { session } = await signIn(env);
-  const old = Date.now() - 59 * 60 * 1000;
-  record().seen = old;
-  assert.equal((await read(session)).status, 200);
-  assert.equal(record().seen, old, 'a background read refreshed the session');
-  assert.equal((await call(env.port, { path: '/', headers: { cookie: session } })).status, 200);
-  assert.ok(record().seen > old, 'a page load did not refresh the session');
-  // Idle: 59 minutes of background reads, then one more past the hour.
-  record().seen = Date.now() - 61 * 60 * 1000;
-  assert.equal((await read(session)).status, 401);
-  // Absolute.
-  ({ session } = await signIn(env));
-  record().created = Date.now() - 8 * 3600 * 1000;
-  assert.equal((await call(env.port, { path: '/', headers: { cookie: session } })).headers.location, '/auth/login?return=%2F');
-  // Logout needs same-origin; refused, the session stays.
-  ({ session } = await signIn(env));
-  const cross = await call(env.port, { method: 'POST', path: '/auth/logout', headers: { cookie: session, origin: ORIGIN, 'sec-fetch-site': 'cross-site' } });
-  assert.equal(cross.status, 403);
-  assert.equal((await read(session)).status, 200);
-  const noOrigin = await call(env.port, { method: 'POST', path: '/auth/logout', headers: { cookie: session, 'sec-fetch-site': 'same-origin' } });
-  assert.equal(noOrigin.status, 403);
-  assert.equal((await read(session)).status, 200);
-  const out = await call(env.port, { method: 'POST', path: '/auth/logout', headers: { cookie: session, origin: ORIGIN, 'sec-fetch-site': 'same-origin' } });
-  assert.equal(out.status, 303);
-  const end = new URL(out.headers.location);
-  assert.equal(`${end.origin}${end.pathname}`, `${env.iss[0].issuer}end-session`);
-  assert.equal(end.searchParams.get('post_logout_redirect_uri'), `${ORIGIN}/auth/signed-out`);
-  assert.equal(end.searchParams.get('client_id'), env.iss[0].clientId);
-  assert.ok(end.searchParams.get('id_token_hint'));
-  assert.deepEqual(setCookies(out), [`${SESSION_COOKIE}=; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=0`]);
-  assert.equal((await read(session)).status, 401);
-  assert.equal((await call(env.port, { method: 'GET', path: '/auth/logout', headers: { cookie: session } })).status, 405);
-});
-
-test('13: the CSP lets the Sign out form reach the provider\'s end-session origin, and only under --sso', async t => {
-  const env = await setup(t);
-  const r = await call(env.port, { path: '/healthz', host: `127.0.0.1:${env.port}` });
-  assert.match(r.headers['content-security-policy'], new RegExp(`; form-action 'self' ${env.op.base.replace(/[.]/g, '\\.')}$`));
-  const plain = await startServer({ port: 0, board: 'http://127.0.0.1:9' });
-  t.after(() => close(plain));
-  const p = await call(plain.address().port, { path: '/healthz', host: `127.0.0.1:${plain.address().port}` });
-  assert.match(p.headers['content-security-policy'], /; form-action 'self'$/);
-});
-
-test('14: open redirects land on /, and a path on the Console lands there', async t => {
-  const env = await setup(t);
-  for (const [query, where] of [
-    ['return=%2F%2Fevil.example', `${ORIGIN}/`],
-    ['return=https%3A%2F%2Fevil.example', `${ORIGIN}/`],
-    ['return=%2F%5Cevil.example', `${ORIGIN}/`],
-    ['return=/%09/evil.example', `${ORIGIN}/`],
-    // Dot segments that leave a pathname of //evil.example stay on the Console (webby-0019 B1).
-    ['return=%2F.%2F%2Fevil.example', `${ORIGIN}//evil.example`],
-    ['return=%2Fx%2F..%2F%2Fevil.example', `${ORIGIN}//evil.example`],
-    [`return=${encodeURIComponent(`${ORIGIN}//evil.example`)}`, `${ORIGIN}//evil.example`],
-    ['return=%2Fboard%2F.%2Fx', `${ORIGIN}/board/x`],
-    ['return=%2Fboard%3Fx%3D1', `${ORIGIN}/board?x=1`],
-    ['', `${ORIGIN}/`],
-  ]) {
-    const begun = await begin(env, { query });
-    const r = await callback(env, begun, { code: grant(env, begun, env.iss[0]).code });
-    assert.equal(r.status, 303);
-    assert.equal(r.headers.location, where, query);
-    assert.equal(new URL(r.headers.location).origin, ORIGIN, query);
-    PRODUCED.add(sessionOf(r).split('=')[1]);
-  }
-});
-
-test('15: a callback for A carrying B\'s code and iss, and a provider= query, is refused', async t => {
-  const env = await setup(t, { issuers: [{ name: 'a' }, { name: 'b' }] });
-  const [, b] = env.iss;
-  for (const extra of [{ iss: b.issuer, provider: 'b' }, { provider: 'b' }]) {
-    const begun = await begin(env, { provider: 'a' });
-    // B's code against A's PKCE challenge and nonce, for B's own subject: only the record rule
-    // (this callback belongs to A) stands in the way.
-    const g = grant(env, begun, b, { sub: 'user-b' });
-    const r = await callback(env, begun, { code: g.code, extra });
-    refused(env, r);
-  }
-  assert.equal(b.tokenRequests.length, 0, 'B\'s token endpoint was called');
-});
-
-test('16: a provider with RS256 and ES256 takes either, and refuses PS256 with a usable PS256 key in the JWKS', async t => {
-  const rsa = rsaKey(), ec = ecKey(), ps = psKey();
-  const env = await setup(t, { issuers: [{ name: 'a', keys: [rsa, ec, ps] }], provider: { a: { algs: ['RS256', 'ES256'] } } });
-  assert.ok((await signIn(env, { opts: { key: rsa } })).session);
-  assert.ok((await signIn(env, { opts: { key: ec } })).session);
-  refused(env, (await signIn(env, { opts: { key: ps } })).r, 'id-token-invalid');
-});
-
-test('17: 33 started logins leave 32 records, and the first one\'s callback finds none', async t => {
-  const env = await setup(t);
-  const first = await begin(env);
-  for (let i = 0; i < 32; i++) await begin(env);
-  assert.equal(env.sso.logins.size, 32);
-  refused(env, await callback(env, first, { code: grant(env, first, env.iss[0]).code }), 'login-record-missing');
-});
-
-test('18: after a key rotation a sign-in works through one refetch, and the removed kid is refused', async t => {
-  const env = await setup(t);
-  const [iss] = env.iss;
-  t.mock.timers.enable({ apis: ['Date'], now: Date.now() });
-  const old = iss.keys[0];
-  assert.ok((await signIn(env)).session);
-  const fetches = iss.jwksFetches;
-  env.op.rotate(iss);
-  t.mock.timers.tick(61000);
-  assert.ok((await signIn(env)).session);
-  assert.equal(iss.jwksFetches, fetches + 1);
-  refused(env, (await signIn(env, { opts: { key: old } })).r, 'signature-invalid');
-});
-
-test('20 and 21: the store holds no raw session id, and the cookie strings are exact', async t => {
-  const env = await setup(t);
-  const begun = await begin(env);
-  assert.match(setCookies(begun.r)[0], new RegExp(`^${LOGIN_COOKIE}=[A-Za-z0-9_-]{43}; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=600$`));
-  for (const key of env.sso.logins.keys()) assert.match(key, /^[0-9a-f]{64}$/);
-  const r = await callback(env, begun, { code: grant(env, begun, env.iss[0]).code });
-  const set = setCookies(r);
-  assert.equal(set.length, 2);
-  assert.equal(set[0], `${LOGIN_COOKIE}=; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=0`);
-  assert.match(set[1], new RegExp(`^${SESSION_COOKIE}=[A-Za-z0-9_-]{43}; Path=/; Secure; HttpOnly; SameSite=Lax$`));
-  const id = set[1].split(';')[0].split('=')[1];
-  PRODUCED.add(id);
-  for (const [key, value] of env.sso.sessions) {
-    assert.match(key, /^[0-9a-f]{64}$/);
-    assert.notEqual(key, id);
-    assert.equal(JSON.stringify(value).includes(id), false);
-  }
-});
-
-test('22: a loopback Host is 403 on a page, a read and a write; /healthz on loopback is 200; a redirect_uri never comes from the Host', async t => {
-  const env = await setup(t);
-  const { session } = await signIn(env);
-  const loop = `127.0.0.1:${env.port}`;
-  for (const [method, path, body] of [['GET', '/', undefined], ['GET', '/api/board', undefined], ['GET', '/api/bus/inbox', undefined], ['POST', '/api/bus/message', MSG]]) {
-    // A loopback Host on this listener's port; any other Host is already the older non-local refusal.
-    for (const host of [loop, `localhost:${env.port}`]) {
-      const r = await call(env.port, { method, path, host, body, headers: { cookie: session, 'content-type': 'application/json' } });
-      assert.equal(r.status, 403, `${method} ${path} ${host}`);
-      assert.deepEqual(r.body, { error: 'public Host required' });
-    }
-  }
-  const health = await call(env.port, { path: '/healthz', host: loop });
-  assert.equal(health.status, 200);
-  assert.deepEqual(health.body, { ok: true, sso: { a: 'ready' } });
-  assert.equal(env.sends.length, 0);
-  const begun = await begin(env, { host: HOST.toUpperCase() });
-  assert.equal(begun.params.get('redirect_uri'), `${ORIGIN}/auth/callback`);
-});
-
-test('23: a provider down at start leaves the Console up and 503, and the retry makes sign-in work', async t => {
-  let env = await setup(t, { retryFirst: 50, before: (op, [a]) => { a.mode = 'down'; } });
-  assert.equal((await call(env.port, { path: '/auth/login' })).status, 503);
-  assert.deepEqual((await call(env.port, { path: '/healthz', host: `127.0.0.1:${env.port}` })).body.sso, { a: 'unreachable' });
-  assert.match(env.lines.at(-1), / sso refused code=discovery-failed provider=a$/);
-  env.iss[0].mode = 'ok';
-  for (let i = 0; i < 100 && env.sso.health().a !== 'ready'; i++) await new Promise(r => setTimeout(r, 20));
-  assert.deepEqual(env.sso.health(), { a: 'ready' });
-  assert.ok((await signIn(env)).session);
-  // A 200 HTML page at the discovery URL is unreachable too, and the Console starts.
-  env = await setup(t, { before: (op, [a]) => { a.mode = 'html'; } });
-  assert.deepEqual(env.sso.health(), { a: 'unreachable' });
-  // HS-only discovery at start refuses the start.
-  await assert.rejects(setup(t, { before: (op, [a]) => { a.discovery = { id_token_signing_alg_values_supported: ['HS256'] }; } }), /refused at discovery/);
-});
-
-test('19: no captured log line holds a token, code, state, nonce, verifier, client secret or session id', () => {
-  assert.ok(ALL_LINES.length > 20, `only ${ALL_LINES.length} lines`);
-  assert.ok(PRODUCED.size > 50, `only ${PRODUCED.size} values`);
-  for (const line of ALL_LINES) {
-    for (const value of PRODUCED) if (value) assert.equal(line.includes(value), false, `a log line holds a produced value: ${line.slice(0, 80)}`);
-    assert.match(line, /^\S+ (sso refused code=[a-z-]+ provider=[a-z0-9-]+( iss="[^"]*" sub="[^"]*")?|send user="[^"]+" to="[^"]*" (id=msg-0001|error=[a-z -]+))$/, line);
-  }
-});
@@ -73,7 +73,8 @@ business's arbiter for its domain. Pass `domain` to `raise_decision`,
 gated raise, and every hard wait, goes to the human through the inbox.
 The hard waits are `spend`, `data.delete`, `network.expose`,
 `account.create`, `credential.mint`, `message.external`,
-`git.push.protected` and `deploy`; a citation never moves them.
+`git.push.protected`, `git.push.remote` and `deploy`; a citation never
+moves them.
 A `role.revoke` raise whose target is the assistant is a hard wait too:
 it goes to the human, cited or not.

@@ -53,7 +53,8 @@ business's arbiter for its domain. Pass `domain` to `raise_decision`,
 gated raise, and every hard wait, goes to the human through the inbox.
 The hard waits are `spend`, `data.delete`, `network.expose`,
 `account.create`, `credential.mint`, `message.external`,
-`git.push.protected` and `deploy`; a citation never moves them.
+`git.push.protected`, `git.push.remote` and `deploy`; a citation never
+moves them.
 A `role.revoke` raise whose target is the assistant is a hard wait too:
 it goes to the human, cited or not.

@@ -35,6 +35,6 @@ if [ "${1:-}" = business ]; then
  exec node "$REPO/packages/business/src/cli.mjs" "$@"
 fi
 case "${1:-}" in
-  usage|project|limits|inbox|decide|tasks|agents|trail|talk|stop|launches|bus|plugins|name|names|follow|threads|thread) exec node "$REPO/packages/cli/src/cli.mjs" "$@" ;;
+  usage|project|limits|inbox|decide|tasks|agents|trail|talk|stop|launches|bus|plugins|credentials|name|names|follow|threads|thread) exec node "$REPO/packages/cli/src/cli.mjs" "$@" ;;
 esac
 exec node "$REPO/packages/seat/src/cli.mjs" "$@"
@@ -26,7 +26,6 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import process from "node:process";
-import { pathToFileURL } from "node:url";

 const SUPPORTED_CONFIG_VERSION = 1;
 const SUPPORTED_ENVIRONMENTS = new Set(["development", "production"]);
@@ -107,30 +106,13 @@ function isAncestorOf(ancestor, candidate) {
  return rel !== "" && !rel.startsWith("..") && !path.isAbsolute(rel);
 }

-// Q175 phase 1 (#1690): the optional `console` key, checked for shape only by the Console's own
-// checker. It is imported only when the key is there, so a config without it never needs the
-// Console's code, and a copy of this file alone still reads one.
-async function validateConsole(value) {
-  let checkConsole;
-  try {
-    ({ checkConsole } = await import(pathToFileURL(path.join(import.meta.dirname, "..", "packages", "webui", "src", "sso-config.mjs")).href));
-  } catch {
-    fail(2, 'the "console" key needs packages/webui/src/sso-config.mjs beside this loader');
-  }
-  try {
-    return checkConsole(value);
-  } catch (error) {
-    fail(2, error.message);
-  }
-}
-
-async function validate(document, file) {
+function validate(document, file) {
  if (!isPlainObject(document)) {
    fail(2, "configuration must be a JSON object");
  }
  rejectUnknownKeys(
    document,
-    ["configVersion", "environment", "dataRoot", "execution", "console"],
+    ["configVersion", "environment", "dataRoot", "execution"],
    "configuration",
  );

@@ -164,10 +146,6 @@ async function validate(document, file) {
    fail(2, `unsupported execution.adapter: ${JSON.stringify(adapter)} (supported: ${[...SUPPORTED_ADAPTERS].join(", ")})`);
  }

-  // Last, so the older checks keep their order. The key is in the output only when the file has
-  // it, so a config without it prints what it always printed.
-  const consoleKey = Object.hasOwn(document, "console") ? await validateConsole(document.console) : undefined;
-
  return {
    configVersion: document.configVersion,
    environment: document.environment,
@@ -178,11 +156,10 @@ async function validate(document, file) {
      model: document.execution.model,
      adapter,
    },
-    ...(consoleKey === undefined ? {} : { console: consoleKey }),
  };
 }

-async function load(file) {
+function load(file) {
  const raw = readRaw(file);
  if (raw === null) {
    fail(3, `configuration not found: ${file} (run scripts/bootstrap.sh to create it)`);
@@ -193,7 +170,7 @@ async function load(file) {
  } catch (error) {
    fail(2, `configuration is not valid JSON (${file}): ${error.message}`);
  }
-  return await validate(document, file);
+  return validate(document, file);
 }

 function shellQuote(value) {
@@ -217,7 +194,7 @@ const file = configPath();
 switch (operation) {
  case "bootstrap": {
    if (fs.existsSync(file)) {
-      await load(file); // validate only; never rewrite
+      load(file); // validate only; never rewrite
      process.stderr.write(`mosaic-config: configuration already present, validated without changes: ${file}\n`);
      process.exit(0);
    }
@@ -229,26 +206,26 @@ switch (operation) {
      fs.writeFileSync(fd, `${JSON.stringify(DEFAULT_CONFIG, null, 2)}\n`);
    } catch (error) {
      if (error.code === "EEXIST") {
-        await load(file);
+        load(file);
        process.exit(0);
      }
      fail(1, `unable to create configuration: ${error.message}`);
    } finally {
      if (fd !== undefined) fs.closeSync(fd);
    }
-    await load(file);
+    load(file);
    process.stderr.write(`mosaic-config: created default configuration: ${file}\n`);
    process.exit(0);
  }

  case "validate": {
-    const resolved = await load(file);
+    const resolved = load(file);
    process.stdout.write(`${JSON.stringify(resolved, null, 2)}\n`);
    process.exit(0);
  }

  case "env": {
-    const resolved = await load(file);
+    const resolved = load(file);
    process.stdout.write(
      [
        `MOSAIC_DATA_ROOT=${shellQuote(resolved.dataRoot)}`,
@@ -3,7 +3,7 @@
 # Moves the bus, the Console and the human CLI from the pointer's copy to another copy together,
 # behind a health gate, and puts the old stack back inside the same run when the gate fails.
 # Console tester listener flags follow target support (row 176, #1674); so does the row 178 proof
-# pair, which activate sets or drops (row 187, #1685).
+# pair, which activate sets or drops (row 187, #1685). activate --no-send drops --send (row 189, #1687).
 # Design and tests: agents/darkwing/work/queue-162/BUILD.md.
 #
 # Who runs it. Decision 96 (Mos, mos-0716) lets this script stop and start the live units under
@@ -30,13 +30,13 @@ BIN="$HOME/.npm-global/bin"
 UNIT_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/systemd/user"
 CONSOLE_UNIT=mosaic-webui.service
 TIMEOUT=60 WANT_PM=0 AFTER_HARNESS=0 MIGRATE=0 PLAN=0 RESTORE="" EVENTS="" TESTER_PORT=""
-PROOF_HEADER="" PROOF_FILE="" NO_PROOF=0 R_BACKUP="" R_PORT=""
+PROOF_HEADER="" PROOF_FILE="" NO_PROOF=0 NO_SEND=0 R_BACKUP="" R_PORT=""

 usage() {
    cat >&2 <<'USAGE'
 usage: stack-release.sh adopt BUSINESS
       stack-release.sh activate ID BUSINESS [--pm | --pm-after-harness] [--migrate] [--tester-port N]
-           [--proof-header NAME --proof-file PATH | --no-proof] [--timeout S] [--plan]
+           [--proof-header NAME --proof-file PATH | --no-proof] [--no-send] [--timeout S] [--plan]
       stack-release.sh pm-on BUSINESS [--timeout S]
       stack-release.sh rollback BUSINESS [--restore ACTIVATION [--events N]] [--timeout S] [--plan]
       stack-release.sh status BUSINESS
@@ -85,6 +85,7 @@ parse_opts() {
            --proof-header) [ "$OP" = activate ] && [ $# -ge 2 ] && [ -n "$2" ] || usage; PROOF_HEADER="$2"; shift 2 ;;
            --proof-file) [ "$OP" = activate ] && [ $# -ge 2 ] && [ -n "$2" ] || usage; PROOF_FILE="$2"; shift 2 ;;
            --no-proof) [ "$OP" = activate ] || usage; NO_PROOF=1; shift ;;
+            --no-send) [ "$OP" = activate ] || usage; NO_SEND=1; shift ;;
            --migrate) [ "$OP" = activate ] || usage; MIGRATE=1; shift ;;
            --restore) [ "$OP" = rollback ] && [ $# -ge 2 ] && [[ "$2" =~ ^[0-9]{8}T[0-9]{6}Z-[0-9a-f]{12}(-[1-9])?$ ]] || usage; RESTORE="$2"; shift 2 ;;
            --backup) [ "$OP" = rehearse ] && [ $# -ge 2 ] && { [[ "$2" =~ ^[0-9]{8}T[0-9]{6}Z-[0-9a-f]{12}(-[1-9])?$ ]] || [[ "$2" =~ ^/[A-Za-z0-9/._+-]*$ ]]; } || usage; R_BACKUP="$2"; shift 2 ;;
@@ -244,14 +245,16 @@ target_schema() {
 in_chain() { local v; for v in "${T_CHAIN[@]}"; do [ "$v" != "$1" ] || return 0; done; return 1; }

 # The item 3 checks on the target copy, in order: copy, schema, already-active. An activate that
-# sets a proof pair, or drops the pointer's pair with --no-proof, may name the pointer's copy: it
-# re-pins the live copy with new Console flags (row 187, Part B's B3 and B-R1).
+# sets a proof pair, drops the pointer's pair with --no-proof, or drops the pointer's --send with
+# --no-send, may name the pointer's copy: it re-pins the live copy with new Console flags (row 187,
+# Part B's B3 and B-R1; row 189, mos-0972).
 check_target() {
    copy_exists "$TO" 2>/dev/null || refuse copy-missing "no copy $TO in $COPIES"
    copy_ok "$TO" 2>/dev/null || refuse copy-unreachable "$TO is not reachable from refactor and origin/refactor"
    target_schema "$TO" || refuse copy-schema-unknown "cannot read SCHEMA_VERSION and its chain from $COPIES/$TO/packages/bus/src/store.mjs"
    [ "$TO" != "$P_COPY" ] || [ -n "$PROOF_HEADER" ] ||
        { [ "$NO_PROOF" = 1 ] && [[ " ${P_CONSOLE[*]} " == *" --proof-header "* ]]; } ||
+        { [ "$NO_SEND" = 1 ] && [[ " ${P_CONSOLE[*]} " == *" --send "* ]]; } ||
        refuse already-active "$TO is the pointer's copy"
 }

@@ -690,6 +693,33 @@ console_for_target() {
        DROP_TESTER="--tester-port $inherited"
    fi
    proof_for_target
+    send_for_target
+}
+
+# Row 189 (mos-0972): --no-send drops --send from RUN_CONSOLE, so the unit and the pointer both lose
+# it; without the flag the pointer's --send goes on unchanged. Rollback and pm-on never take it, so
+# they carry the pointer as it is. Sets SEND_PLAN (the plan's send: line) and SEND_STEP.
+send_for_target() {
+    local had=0 i
+    local -a without_send=()
+    for ((i = 0; i < ${#RUN_CONSOLE[@]}; i++)); do
+        if [ "${RUN_CONSOLE[i]}" = --send ]; then had=1; else without_send+=("${RUN_CONSOLE[i]}"); fi
+    done
+    SEND_STEP=""
+    if [ "$NO_SEND" = 1 ]; then
+        RUN_CONSOLE=("${without_send[@]}")
+        if [ "$had" = 1 ]; then
+            SEND_PLAN="send: dropped; --no-send was given"
+            SEND_STEP="drop --send; --no-send was given"
+        else
+            SEND_PLAN="send: off; --no-send was given and the pointer holds no --send"
+            SEND_STEP="--no-send was given and the pointer holds no --send, so there is nothing to drop"
+        fi
+    elif [ "$had" = 1 ]; then
+        SEND_PLAN="send: carried"
+    else
+        SEND_PLAN="send: off"
+    fi
 }

 # Row 187: the row 178 proof pair in RUN_CONSOLE. A new pair replaces the pointer's and goes last;
@@ -943,6 +973,7 @@ plan() {
    echo "bus: scripts/bus-service.sh install --copy $TO --copies $COPIES$([ "$RUN_PM" = 0 ] || echo ' --pm') --claude $P_CLAUDE"
    [ -z "$DROP_TESTER" ] || echo "drop $DROP_TESTER; the target Console does not support it"
    echo "$PROOF_PLAN"
+    echo "$SEND_PLAN"
    echo "Console: scripts/webui-service.sh install --copy $TO --copies $COPIES${RUN_CONSOLE[*]:+ ${RUN_CONSOLE[*]}}"
    echo "CLI: scripts/stack-copy.sh wrapper $TO --copies $COPIES --bin $BIN"
    local r
@@ -956,6 +987,7 @@ run_steps() {
    capture || refuse capture-failed "could not write the rollback set $RS; nothing was stopped"
    [ -z "$DROP_TESTER" ] || say "drop $DROP_TESTER; the target Console does not support it"
    [ -z "$PROOF_STEP" ] || say "$PROOF_STEP"
+    [ -z "$SEND_STEP" ] || say "$SEND_STEP"
    trap 'after_fail signal' INT TERM HUP
    stop_both || rollback_in_run stop-timeout
    if [ -e "$STORE" ]; then
@@ -1478,7 +1510,7 @@ STORE="$DATA/bus/bus.sqlite"
 BUS_UNIT="mosaic-bus@$BUSINESS.service"
 FROM="" TO="" ACT="" RS="" POST="" BACKUP="" TAKEN="" RESTORED="" STEPS="" COUNT="" UNCLEAN="" FAIL=""
 STORE_SCHEMA="" START_EPOCH="" START_MS=0 GATE="" GATE_WHY="" S_CHANGED=""
-P_COPY="" P_PM=0 P_PENDING=0 P_SCHEMA="" P_CLAUDE="" P_CONSOLE=() RUN_PM=0 RUN_PENDING=0 RUN_CONSOLE=() DROP_TESTER="" PROOF_PLAN="" PROOF_STEP="" PLAN_REFUSE=()
+P_COPY="" P_PM=0 P_PENDING=0 P_SCHEMA="" P_CLAUDE="" P_CONSOLE=() RUN_PM=0 RUN_PENDING=0 RUN_CONSOLE=() DROP_TESTER="" PROOF_PLAN="" PROOF_STEP="" SEND_PLAN="" SEND_STEP="" PLAN_REFUSE=()
 R="" R_RC=0 R_EARLY=() R_BK="" R_HOST_PID="" R_CONSOLE_PID="" R_STARTED="" LIVE_CFG="" LIVE_BIZ=""
 case "$OP" in
    adopt) do_adopt ;;
@@ -151,52 +151,6 @@ else
    FAIL=$((FAIL+1)); echo "${C_FAIL}FAIL${C_RESET} env exports resolve correctly"
 fi

-# --- Q175 phase 1 (#1690), design test 25: the optional console key ---
-# Shape only. The slot path is a FIFO, so a loader that opened the slot would block and the
-# timeout would fail the case; no case reads a slot file.
-mkdir -p "$SANDBOX/secrets/mosaic-stack"
-mkfifo "$SANDBOX/secrets/mosaic-stack/console-sso-test"
-sso_body() {
-    printf '{"configVersion":1,"environment":"development","dataRoot":"%s","execution":{"backend":"docker","provider":"zai","model":"m"},"console":%s}' "$DATA_ROOT" "$1"
-}
-# provider [ALGS] [CLIENT_SECRET]: one provider entry; an empty argument takes the valid value.
-provider() {
-    local algs='["RS256"]' secret='{"slot":"console-sso-test"}'
-    [ -n "${1:-}" ] && algs="$1"
-    [ -n "${2:-}" ] && secret="$2"
-    printf '{"id":"fake","issuer":"https://op.test/app/","clientId":"client-1","clientSecret":%s,"algs":%s,"subjects":[{"sub":"user-1","name":"jason.woltje"}]}' "$secret" "$algs"
-}
-cfg sso-valid.json "$(sso_body '{"sso":{"publicOrigin":"https://console.test","providers":['"$(provider)"']}}')"
-OUT="$(MOSAIC_CONFIG="$SANDBOX/sso-valid.json" timeout 20 $CONFIG_OP validate 2>&1)"
-[ $? -eq 0 ] && printf '%s' "$OUT" | grep -q '"publicOrigin": "https://console.test"'
-check "valid console.sso loads and is in the output" $?
-
-# expect_refusal NAME PATH-IN-MESSAGE BODY: exit 2, and the message names the bad key path.
-expect_refusal() {
-    cfg sso-bad.json "$2"
-    local err rc
-    err="$(MOSAIC_CONFIG="$SANDBOX/sso-bad.json" timeout 20 $CONFIG_OP validate 2>&1 >/dev/null)"
-    rc=$?
-    [ "$rc" -eq 2 ] && printf '%s' "$err" | grep -qF -- "$3"
-    check "$1 (exit $rc)" $?
-}
-expect_refusal "console.sso HS256 alg exits 2 naming the path" \
-    "$(sso_body '{"sso":{"publicOrigin":"https://console.test","providers":['"$(provider '["HS256"]')"']}}')" 'console.sso.providers[0].algs[0] must be one of'
-expect_refusal "console.sso alg none exits 2 naming the path" \
-    "$(sso_body '{"sso":{"publicOrigin":"https://console.test","providers":['"$(provider '["RS256","none"]')"']}}')" 'console.sso.providers[0].algs[1] must be one of'
-expect_refusal "console.sso missing slot field exits 2 naming the path" \
-    "$(sso_body '{"sso":{"publicOrigin":"https://console.test","providers":['"$(provider '' '{}')"']}}')" 'console.sso.providers[0].clientSecret.slot is required'
-expect_refusal "console.sso slot name outside the pattern exits 2 naming the path" \
-    "$(sso_body '{"sso":{"publicOrigin":"https://console.test","providers":['"$(provider '' '{"slot":"../x"}')"']}}')" 'console.sso.providers[0].clientSecret.slot must match'
-expect_refusal "unknown key under console exits 2 naming the path" \
-    "$(sso_body '{"sso":{"publicOrigin":"https://console.test","providers":['"$(provider)"']},"extra":1}')" 'console.extra is not a supported key'
-
-# Without the key: the output is exactly what the loader printed before phase 1 (sage-1340, F2).
-cfg no-console.json '{"configVersion":1,"environment":"development","dataRoot":"'$DATA_ROOT'","execution":{"backend":"docker","provider":"zai","model":"m"}}'
-EXPECTED="$(printf '{\n  "configVersion": 1,\n  "environment": "development",\n  "dataRoot": "%s",\n  "execution": {\n    "backend": "docker",\n    "provider": "zai",\n    "model": "m",\n    "adapter": "pi"\n  }\n}' "$DATA_ROOT")"
-[ "$(MOSAIC_CONFIG="$SANDBOX/no-console.json" timeout 20 $CONFIG_OP validate)" = "$EXPECTED" ]
-check "config without console loads with unchanged output" $?
-
 # --- validation must not modify the file ---
 SUM_INVALID_BEFORE=$(sha256sum "$SANDBOX/invalid.json" | cut -d' ' -f1)
 MOSAIC_CONFIG="$SANDBOX/invalid.json" $CONFIG_OP validate >/dev/null 2>&1
@@ -49,9 +49,6 @@
 # character set and refused otherwise. --proof-header NAME --proof-file PATH
 # go together under preview; only the path is carried here, never the secret.
 # render checks ownership, mode and location without opening the proof file.
-# --sso (Q175 phase 1, #1690): the Console signs people in itself from
-# console.sso in config.json. It refuses the preview set and the proof pair,
-# and --send takes it in place of the preview set. Nothing secret is carried.
 #
 # There is no start, stop, enable or restart verb. The Console reads the
 # main listener's bus through the human transport; the optional loopback
@@ -71,7 +68,7 @@ REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 TEMPLATE="$REPO/packages/webui/systemd/mosaic-webui.service.in"
 UNIT_NAME="mosaic-webui.service"
 USAGE="usage: scripts/webui-service.sh copy COMMIT [--copies DIR] [--allow-worktree] | render [--copy ID [--copies DIR]] [FLAGS] | install --copy ID [--copies DIR] [--dir DIR] [--no-reload] [--allow-worktree] [FLAGS] | uninstall [--dir DIR] [--no-reload] | status [--dir DIR]
-  FLAGS: [--port N] [--business ID] [--board URL] [--sso [--send] | --public-host NAME --auth-header HEADER --allow-user ID [--send]] [--tester-port N] [--proof-header NAME --proof-file PATH]
+  FLAGS: [--port N] [--business ID] [--board URL] [--public-host NAME --auth-header HEADER --allow-user ID [--send]] [--tester-port N] [--proof-header NAME --proof-file PATH]
  --tester-port: 1024..65535, different from --port and never 7332; loopback tester listener.
  --allow-worktree is for the tests only: copy and install otherwise refuse outside the canonical checkout."

@@ -94,7 +91,6 @@ PUBLIC_HOST=""
 AUTH_HEADER=""
 ALLOW_USER=""
 SEND=0
-SSO=0
 PROOF_HEADER=""
 PROOF_FILE=""
 PROOF_SET=0
@@ -118,7 +114,6 @@ parse_flags() {
            --proof-header) [ $# -ge 2 ] || usage; PROOF_HEADER="$2"; PROOF_SET=1; SERVE_SET=1; shift 2 ;;
            --proof-file) [ $# -ge 2 ] || usage; PROOF_FILE="$2"; PROOF_SET=1; SERVE_SET=1; shift 2 ;;
            --send) SEND=1; SERVE_SET=1; shift ;;
-            --sso) SSO=1; SERVE_SET=1; shift ;;
            *) usage ;;
        esac
    done
@@ -171,13 +166,9 @@ serve_flags() {
    [ -z "$PUBLIC_HOST" ] || preview=$((preview + 1))
    [ -z "$AUTH_HEADER" ] || preview=$((preview + 1))
    [ -z "$ALLOW_USER" ] || preview=$((preview + 1))
-    # serve refuses --sso with the preview set or the proof pair, and --send
-    # without --sso or the preview set; refuse them here first, so no unit is
-    # written that would only exit 2 at start.
-    if [ "$SSO" = 1 ] && { [ "$preview" -ne 0 ] || [ "$PROOF_SET" = 1 ]; }; then
-        die "--sso cannot be combined with --public-host, --auth-header, --allow-user or --proof-*"
-    fi
-    [ "$SEND" = 0 ] || [ "$preview" -eq 3 ] || [ "$SSO" = 1 ] || die "--send needs the preview mode (--public-host, --auth-header and --allow-user) or --sso"
+    # serve refuses --send without the preview set; refuse it here first,
+    # so no unit is written that would only exit 2 at start.
+    [ "$SEND" = 0 ] || [ "$preview" -eq 3 ] || die "--send needs the preview mode (--public-host, --auth-header and --allow-user)"
    if [ "$preview" -ne 0 ]; then
        [ "$preview" -eq 3 ] || die "--public-host, --auth-header and --allow-user go together: all three or none"
        case "$PUBLIC_HOST" in [A-Za-z0-9]*) ;; *) die "public host must be a hostname, no port or scheme: $PUBLIC_HOST" ;; esac
@@ -210,7 +201,6 @@ serve_flags() {
        { [ "$proof_mode" = 600 ] || [ "$proof_mode" = 400 ]; } && [ "$proof_uid" = "$(id -u)" ] || die "invalid proxy proof file metadata"
        flags="$flags --proof-header $PROOF_HEADER --proof-file $PROOF_FILE"
    fi
-    [ "$SSO" = 0 ] || flags="$flags --sso"
    [ "$SEND" = 0 ] || flags="$flags --send"
    [ "$TESTER_SET" = 0 ] || flags="$flags --tester-port $TESTER_PORT"
    echo "$flags"
@@ -395,17 +385,14 @@ status_unit() {
    else
        echo "copy: none; the unit runs from $wd"
    fi
-    # render puts --send after the allowed user and optional proof pair, or
-    # after --sso, before the tester port. The allowed user
+    # render puts --send after the allowed user and optional proof pair,
+    # before the tester port. The allowed user
    # starts with a letter or digit (N5), so it is never the value --send.
-    if grep -Eq '^ExecStart=.*( --allow-user [^ ][^ ]*( --proof-header [^ ]+ --proof-file /[^ ]+)?| --sso) --send( --tester-port [0-9]+)?$' "$target"; then
+    if grep -Eq '^ExecStart=.* --allow-user [^ ][^ ]*( --proof-header [^ ]+ --proof-file /[^ ]+)? --send( --tester-port [0-9]+)?$' "$target"; then
        echo "send: on (--send; human messages to roles)"
    else
        echo "send: off (read-only)"
    fi
-    if grep -Eq '^ExecStart=.* --sso( --send)?( --tester-port [0-9]+)?$' "$target"; then
-        echo "sign-in: the Console's own (--sso)"
-    fi
    local tester_port
    tester_port="$(sed -n 's/^ExecStart=.* --tester-port \([0-9][0-9]*\)$/\1/p' "$target")"
    if [ -n "$tester_port" ]; then
Author	SHA1	Message	Date
jason.woltje	3330c901b9	plans: #436b approved at r5 `1be535aca` (dewey-0763); build carry N9 (restart after a revoke on an open rotation, 404 on delete by id is done) and N10 (serviceLeft a list); DESIGN.md unchanged; no code change	2026-10-20 18:36:07 -05:00
jason.woltje	1be535aca9	plans: #436b design r5 on dewey-0761: revoke on an open rotation deletes both previousTokenId and the minted tokenId, failures to serviceLeft (X-G5); N8 step 0 refuses grant-token-unknown while held; section 7 unchanged; no code change	2026-10-20 18:35:14 -05:00
jason.woltje	3e66f5acfd	plans: #436b design r4 on dewey-0759: item 1 option (b) per sage-1578 (step 0 refusal unspent only until the next start, cost in D5, X-G11 restart case); item 2 settle 200 unknown id drops memory, deletes nothing, grant-token-unknown, held at start; N7 secretCheck in 3d; duckworth-0067 N1 kind filter, X-G15; section 7 unchanged; no code change	2026-10-20 18:33:29 -05:00
jason.woltje	fa5658941b	plans: #436b design r3 on dewey-0756 (B1-B3, N1-N6), section 7 guard per gizmoduck-0081/-0084 and duckworth-0065, F13 settle probe, Q-B4 closed by mos-1146; no code change	2026-10-20 18:27:52 -05:00
jason.woltje	be823a6f73	plans: #436b design r2.1 work in progress, section 7 on gizmoduck-0081 (not final: dewey-0756 and duckworth-0065 still open); no code change	2026-10-20 17:55:11 -05:00
jason.woltje	6db7cc45d5	plans: #436b design r2 on dewey-0754: Gitea user id and a nonce adopt, grant.* as reserved action.allowed bodies with a system/grant trigger, seat-token rotation settled by GET /api/v1/token, the admin file's real reach (PATCH /admin/users proven), admin checks before consume with grants run, items 6 to 12; F8 to F12 from scratch 1.27.1; no code change	2026-10-20 17:49:30 -05:00
jason.woltje	714c073043	plans: #436b draft r1, 3b's open item closed on a scratch 1.27.1: GET /api/v1/token needs the token header (Basic 404s) and reports normalized scopes; no code change	2026-10-20 17:39:14 -05:00
jason.woltje	82ff4ae4b1	plans: #436b design draft r1, the Gitea grant path on #436a r4: the binding, the executor's admin credential (mos-1130 item 3 a to e, mos-1136 scopes and the 1.27.0 floor), steps, restart, revoke, approval notes; the shared part proposed to Bushroot (megavolt-0036); no code change	2026-10-20 17:38:17 -05:00
jason.woltje	e10e03f6be	plans: row 199 DESIGN.md section 7a, the grant path (mos-1124, Q188, Q190); A1 to A4 are the fallback only; Q-J1 and Q-J2 settled; no code change (#1697 )	2026-10-20 17:20:38 -05:00
jason.woltje	07141966e1	cli: row 199 rotate on a due gitea key; ISSUED names rotation-due, the state the bus's status() gives a gitea key past its rotate-by date, so `credentials rotate` no longer refuses it; a test over every status state; BUILD.md deviation 15 (gizmoduck-0050, sage-1494, #1697 )	2026-10-20 16:16:43 -05:00
jason.woltje	addee664ab	cli: row 199 sage-1440: publishResult's poll is bounded by publishDeadlineMs (four times git's limit and grace plus 30 s) and refuses publish-timeout, filed once; end-to-end tests for ref-moved and decision-mismatch mid-flight and for the timeout; DESIGN.md T3 now says such a push refuses; BUILD.md deviations 11, 13 and 14 ruled (#1697 )	2026-10-20 15:27:54 -05:00
jason.woltje	8315594389	plans: row 199 BUILD.md, deviation 10 ruled (sage-1421), deviations 11 to 14 for publish, the publish runs (#1697 )	2026-10-20 15:21:13 -05:00
jason.woltje	6d5e71b129	cli: row 199 the git socket's publish op; checkPublish, the seat's checks under the lock, then publishPush and a poll of publishResult, then recordPublish; a refusal after the ticket is filed once by publishRefused; the bind rule adds git.push.remote; an end-to-end test through the in-process runtime, the store and a TLS fake Gitea (#1697 )	2026-10-20 15:21:12 -05:00
jason.woltje	f83f3e6553	bus: row 199 publishPush and publishResult; the push runs in the bus child under withGitea with fork, user, source and dst from the ticket (publishTarget), and the host polls; recordPublish refuses a ref that isn't the ticket's dst; the bus process answers the five publish ops; publishTls is in-process only (#1697 )	2026-10-20 15:21:12 -05:00
jason.woltje	00499a4fb3	seat: row 199 publish and publishRemote; the tip and identity checks under the working repo's lock, then ls-remote and a push by oid to refs/heads/<user>/<branch> on the agent's fork; the token reaches git on fd 3 through a one-shot helper for the fork's exact host and port; no redirects, no stored remote or credential; a TLS fake Gitea for the tests (#1697 )	2026-10-20 15:21:06 -05:00
jason.woltje	94c4a484f0	plans: row 199 BUILD.md, the lifecycle and CLI commits, deviations 7 to 10 (#1697 )	2026-10-20 15:06:36 -05:00
jason.woltje	0cdace4155	cli: row 199 mosaic credentials status, issue, rotate, revoke and delete; issue and rotate read the token on stdin, never argv; --tester takes status and revoke; scripts/mosaic routes credentials to packages/cli (#1697 )	2026-10-20 15:06:22 -05:00
jason.woltje	aa740cc715	bus: row 199 credential lifecycle verbs, credentials.issue (rotate over an issued entry), credentials.revoke and credentials.delete; human-only, the tester revokes; delete waits for the agent's claims; each verb leaves one changes.jsonl receipt with no value, record() for a store-only change (#1697 )	2026-10-20 15:04:08 -05:00
jason.woltje	a18fc6cf8c	tasks: row 199 request calls use useFor keyed from the session; the host's start probe keeps use; a D5 test pins the use( call sites (#1697 )	2026-10-20 14:59:45 -05:00
jason.woltje	39d9bd6e64	plans: row 199 BUILD.md, deviations 1 to 6, N9 for the routing commit, R1 backup set checked (#1697 )	2026-10-20 14:57:24 -05:00
jason.woltje	5043367978	bus: row 199 runtime wiring, the store root is <configDir>/secrets/agents, and the op table gets checkPublish, withGitea, recordPublish and publishRefused; withGitea keys from the open publish ticket (#1697 ) Deviation from D9b, recorded for BUILD.md: withGitea takes the ticket, not a cap. The key is the session checkPublish checked as an agent holding its claim (broker.publishSession), so a tester, reader or human cap never reaches a token, and the token is usable only between checkPublish and recordPublish or publishRefused. Its refusals are filed once, by publishRefused.	2026-10-20 14:56:03 -05:00
jason.woltje	609dc9364d	bus: row 199 per-agent credential store, store references, issue (tmp, fsync, rename, commit, memory), revoke (memory first, store file only), remove, useFor keyed from the session, not-issued and revoked states (#1697 ) Design D1, D3a, D4 and section 6. Tests T1, T2 and the store half of T5 use fake tokens in a scratch root. A wrong owner can't be set without root, so T1 covers modes, symlinks and dirs only.	2026-10-20 14:52:52 -05:00
jason.woltje	a2c387dba6	bus: row 199 broker publish authority, the decision binds the latest push (pushCommit), checkPublish builds the agent's fork, recordPublish spends the decision; the D9c parse moves to vocabulary.mjs to keep the broker's import closure (#1697 ) git.push.remote is a hard wait. decision.raise records the task's latest push commit and refuses no-push without one; the authority check refuses decision-mismatch when the latest push moved. checkPublish refuses decision-consumed, remote-not-granted, remote-host-mismatch, remote-not-fork, no-push, work-not-yours and work-ref, and returns the fork, user, email, source and host-built destination. pm.md and chief-of-staff.md list git.push.remote among the hard waits.	2026-10-20 14:51:54 -05:00
jason.woltje	286bf598c0	business: row 199 agent identity, publish grant, project upstream with the D9c parse, store credential references; git.push.remote as a hard wait (#1697 )	2026-10-20 14:45:44 -05:00
jason.woltje	4d3007ec95	plans: row 199 design r6, answers duckworth-0026 B5 (ls-remote, push and helper use the derived fork) and B6 (URL parse in D9c), N10, N11 (#1697 )	2026-10-20 14:42:02 -05:00
jason.woltje	34bfe4a53d	plans: row 199 design r5, the host derives each agent's fork from the upstream and its own Gitea user (webby-0011 N1), identity optional and required by publish (#1697 )	2026-10-20 14:36:20 -05:00
jason.woltje	12c85ada18	Merge remote-tracking branch 'origin/refactor' into megavolt/row199	2026-10-20 14:34:09 -05:00
jason.woltje	e1aa6216c7	plans: row 199 design r4, answers duckworth-0017 B3 (TLS fake through a test seam), B4 (decision binds the commit, push by oid), N6 to N8 (#1697 )	2026-10-20 14:32:16 -05:00
jason.woltje	c2c729ddf0	plans: row 199 design r3, Mos rulings mos-1027 (forks, git.push.remote as a hard wait, tester status and revoke only) (#1697 )	2026-10-20 14:27:49 -05:00
jason.woltje	e806656b1d	plans: row 199 design r2, answers duckworth-0013 B1, B2 and N1 to N5 (#1697 )	2026-10-20 14:26:36 -05:00
jason.woltje	aa1bd209e3	gate-lane: row 189 gate timing table for row 197 (Herb)	2026-10-20 14:25:17 -05:00
jason.woltje	624e8ea3ab	plans: row 199 design, per-agent credential store, own git identity, publish to a granted remote (#1697 )	2026-10-20 14:22:26 -05:00
jason.woltje	ace27dc5eb	row 189 (#1687 ): stack-release.sh activate --no-send drops the Console's --send (Sage; Dewey approve 29485; Sage gate passed)	2026-10-20 14:21:56 -05:00
jason.woltje	a4a42dbac2	plans: stack-release --sso brief (#1698 , Launchpad, reviewer Webby, row 192 F3; chained on 192)	2026-10-20 14:18:08 -05:00
jason.woltje	a31f1a0f8b	plans: row 198 brief records Mos's call, in-process board reads behind the Console's auth (mos-1019)	2026-10-20 14:17:03 -05:00
jason.woltje	992650232f	plans: agent credentials and git identity brief (MVP T1 item 6, #1697 , Megavolt, reviewer Duckworth); Megavolt seat dir	2026-10-20 14:14:33 -05:00
jason.woltje	a7661ada06	plans: row 195 acceptance script takes Gizmoduck's gate item list; B8 issuer and TLS front end (mos-1011)	2026-10-20 14:12:19 -05:00
jason.woltje	f871cb3096	plans: retire the control board writer on 7331 brief (#1696 , Bushroot, reviewer Webby, mos-1008 item 2); Bushroot seat dir	2026-10-20 14:11:21 -05:00
jason.woltje	0bbd23c619	plans: row 195 brief adds the identity provider check and flags any new model account for Jason (mos-1008)	2026-10-20 14:10:28 -05:00
jason.woltje	0217b71c8f	plans: row 195 brief rewritten as the hub on its own host, host left to Jason (#1693 , mos-0998, mos-1005)	2026-10-20 14:07:57 -05:00
jason.woltje	c6f528a32f	plans: second gate lane brief (#1695 , Herb, reviewer Webby, mos-0977 item 6); Herb seat dir; gate template and busy check copies for the row	2026-10-20 14:03:36 -05:00
jason.woltje	96f243fafc	plans: human boundary row brief (P19 333, #1694 , Gander, reviewer Duckworth, mos-0989); Gander seat dir; seat READMEs name the credentials row, not row 195 (now 190b)	2026-10-20 14:00:58 -05:00
jason.woltje	c862699352	sessions: Filbert row 190 design review r3, approved	2026-10-20 14:00:05 -05:00
jason.woltje	48ebee0ffe	plans: row 190 brief scopes isolation to addressing on one uid, points to row 190b (Filbert N7, mos-0986)	2026-10-20 13:58:07 -05:00
jason.woltje	66bdd84b8f	sessions: Filbert row 190 design review r2, changes requested	2026-10-20 13:57:10 -05:00
jason.woltje	6966164f0c	plans: row 190b brief, Melanie's hub under its own Linux user (#1693 , Darkwing, reviewer Duckworth), mos-0986	2026-10-20 13:56:34 -05:00