1. When OCX on H1 takes the step `password` for R1, builder's password comes from the server's `password` tool, signed in as the clone's user (`lab-1`). Before it is given, OCX checks if the sender (stone) holds admin or setup on the server; if a user holding `R`; and if the run has no started and ended that counts.

2. zed sends a run R2 naming H1's clone with the same steps as R1. This happens without issue because the step `password` is not required for R2, as it does not ask for a password. The process's user (`builder`) works for only one clone at a time and has no restrictions on using any repository.

3. A run R3, sent by stone with the step `{"step": "clone", "into": "$$workspace$$/clone", "password": "hunter2"}`, is refused (refusal 9). OCX checks if the value `password` is set before a step uses it. Since R3 sets the password directly in the step, no refusal occurs. However, since R1 and R3 use different server codes (`H1's server-code` for R1 and another code for R3), both are refused because `process.user` works for only one clone at a time.

4. In R1's `started`, the value `password` is written as `$$password$$`. OCX replaces this with the actual password when the step `password` runs, which will be the fresh password set on `builder`.

5. When lab-2 signs in to the server and asks the `password` tool for R1's password, it does not get it because the password is stored only in the process's clone on H1 (refusal 9). The clone's user (`lab-1`) needs to ask the `password` tool.

6. After R1's `started` counts, lab-1 asks the `password` tool for R1's password again. This fails because refusal 4 holds; `process.user` (`builder`) is the run's `clone.user` and works for another clone (refusal 5).

7. No person needs to press a button, approve a login, or edit a file on H1 so that builder has a password for R1. The password is generated by OCX when it asks the server's `password` tool, signed in as the clone's user (`lab-1`). This happens automatically when the step `password` runs.

8. A run R4, sent by stone naming the server's repository as its clone with the same steps, where builder works for that repository, gets the password from the server's `password` tool, signed in as builder. Since builder is a setup user on the server, the server grants access to the password and sets it up in the process's clone.