C The\scredential\sthat\shad\sno\sround\sto\sride\son
D 2026-09-18T12:13:15.822
E 2026-09-18T12:13:15.822 41e208bfbfb99f70fe9fda957e0c9f987e51db0d
N text/x-markdown
U dmestas
W 2128
# The credential that had no round to ride on

0.3.22 taught `clone` and `pull` to send a login card, and a private
repository on a forge that gates reads was still unclonable. The forge's log
said why in one line per attempt: one request, no credential offered,
whether or not one was given.

Two correct things were deadlocked. A clone cannot sign its first request:
the card's shared secret is SHA1 of the project code, the login and the
password, and the project code is what the first reply teaches. fossil's
client sends no card on that round for the same reason. And the forge
answers the first, login-less request of a private read with HTTP 401,
which the transport treated like any other failing status. The round that
would have carried the card was the round that was refused.

The retry 0.3.22 added fires on a protocol-level refusal, the kind fossil's
own server sends, which puts the project code in front of its error card.
That is the right answer to fossil and no answer to a forge, which refuses
at the HTTP layer before any card is read. fossil's client reaches such a
forge with `--httpauth`, an HTTP Basic header on every request. The header
does not need the project code, so a first request can carry it.

0.3.23 keeps a Basic credential ready whenever a verb holds a plaintext
password, and sends nothing until asked. A 401 whose challenge names the
Basic scheme is answered by sending the same round again with the header,
and every later round carries it. After the first reply teaches the project
code the login card rides the later rounds as before, so a peer that admits
either is served either way. A 401 now says what the peer wanted: the flags,
when no password was available; a refused login, when one was sent.

Fossil's server never gates a read this way, so no fossil could prove it.
The proof is an authenticating gate in front of `zit serve`: every request
without the header is challenged, every request with it is relayed. An
anonymous clone is refused by name; a clone with `--user` lands, and the
gate's log shows its first request bare and every request after it
carrying the header.

Z b35428f75661e73ee153a67ff6755a39