Timeline

A forge that gates a read answers a clone's first request with 401. The login card cannot answer that round, since its secret needs the project code the first reply teaches, and the status was fatal, so the credential never reached the wire. When a verb holds a plaintext password the transport keeps a Basic credential ready, sends nothing until a 401 names the Basic scheme, then repeats the round with the Authorization header and carries it on every later round, as fossil's --httpauth does. A 401 now says what the peer wanted. Proven by an e2e with an authenticating gate in front of zit serve. check-in: 5f541eccc7 user: dmestas tags: trunk

Only push and sync signed a login, so a private repository on a forge that gates reads was unreadable by the account that owned it, and a stored login sat unused while pull read anonymously. All four verbs now resolve the login the same way: --user, the URL's user@, then the stored login. A clone holds name and password until the round-0 reply teaches the project code, then signs every later round; a refused round 0 that taught the code is retried with the login, as fossil's client does. The accepted login is stored in the clone. A URL user with no password source is a hint and goes anonymous with a note; --user without a password is an error. Smoke S17 drives a read-gated fossil. check-in: 1d5a6c8fa7 user: dmestas tags: trunk