1. The password comes from the server's `password` tool, which OCX on H1 requests while signed in as `lab-1`. The server checks that the run's sender has admin or setup, the signed-in user is the run's `clone.user`, the run has no counting `started` or `ended` records, and `builder` is not subject to refusal 4 or 5.

2. The run is refused. Refusal 1 holds because a run sent by a user holding the `R` capability (zed) cannot contain a `password` step.

3. The run is refused. Refusal 2 holds because the `password` key of the `clone` step must be exactly `$$password$$`, and any other text is prohibited.

4. It is written as `$$password$$`.

5. No, it does not. The server only provides the password if the signed-in user is the run's `clone.user`, which for R1 is `lab-1`, not `lab-2`.

6. The request is refused. The server's `password` tool only answers if the run has no `started` (and no `ended`) record that counts.

7. No. OCX automatically handles the `password` step by communicating with the server's `password` tool using the clone's user credentials.

8. OCX sets the password directly on the server's repository.