- The copy launch gate reads the organization registry entry on every
check for a verified copy. A state other than active, or a new
incarnation, refuses credential-revoked; an unreadable registry
refuses credential-unavailable.
- Repository reads need read or write repository scope, like writes
need write scope.
- The admitted organization revision travels from the launcher through
bindLaunch. prepare checks it before and after the live proof, and
admit checks it after the launch authority; a change refuses
organization-changed.
- Tests for the completion authority recheck, the broker session
authority compare and an incarnation change; the copyRefusal comment
now names where restart-required is answered.
Materialize only verified bound copies: a binding approved after boot
answers restart-required. Boot and every launch re-resolve the binding
and prove the slot live against its service; unavailable verification,
a partial binding or a stale file refuses. The A3 revision fence and
the launch authority digest ride through prepare, final admission and
bindLaunch. Pending revocation blocks admission and no fence is
released on an uncertain outcome.
Every copy credential call checks session, incarnation, scopes,
generation and liveness, takes the slot from the session, goes only to
the approved origin with redirects refused, and rechecks the generation
at completion. Prepare and boot proofs run inside a time budget so a
silent service cannot stall the host channel. The launcher maps a
copyLaunch refusal to its own code instead of launch-failed.
Tests: copy-launch unit suite, CLI launch and race cases (prepare and
bind races assert no repo call, empty project manifest included), and a
docker acceptance on gitea 1.27.1.
jason.woltje