1. When OCX on H1 takes the step `password` for R1, it asks the server's `password` tool for a fresh password, signed in as `lab-1`. It checks if the sender (`stone`) holds admin or setup on the server and has the necessary rights to send such a run.
2. zed sends a run R2 naming H1's clone. OCX denies the run with refusal 4 because builder works for another clone (H1). The process's user of R2 is set as `builder`, and it would conflict with the existing `builder` user on the server due to the rule in 2.5.
3. A run R3, sent by stone, names a password directly for cloning. OCX denies the run with refusal 1 because direct password steps are not allowed for runs that don't ask for more than what they're allowed to do.
4. In R1's `started`, the value `password` is written as `$$password$$`. This indicates that OCX will insert the actual password used during the run when it logs or stores the information.
5. Lab-2 signs in and asks the server's `password` tool for R1's password. The server does not give the password because the sender (`lab-2`) is not the user of R1 (`lab-1`). Only the clone's user (`lab-1`) can have the correct password.
6. After R1's `started`, lab-1 cannot ask the `password` tool for R1's password again because refusal 9 holds. The server will refuse to provide a new password since the run has already been recorded and processed.
7. No person needs to press a button, approve a login, or edit a file on H1 for builder to have a password for R1. All password handling is automated by OCX during the run's processing based on the rules defined in the protocol.
8. A run R4, sent by stone, names the server's repository as its clone and works similarly to R1. Builder's password comes from the same source as before—OCX asks the server's `password` tool for a fresh password, signed in as `lab-1`, ensuring that builder has the necessary credentials to access the server's repository.