[EHotwagner]

Config feed reads used urllib’s default redirect handler, which copies Authorization onto a redirected storage request. Share a credential-safe redirect handler across authenticated archive and enumeration reads: preserve same-origin Authorization and remove it when scheme, hostname or effective port changes. Restrict initial organization Basic credentials to the organization feed origin even when its service index names an external archive endpoint. Retain redacted stage, response host and HTTP status before refusing an unreadable feed.

Validation: actual urllib same/cross-origin controls, explicit default-port and foreign index endpoint controls, redacted index/archive403 controls, existing archive/recovery/readback cases, 35 extracted resolver controls, 30 mutations and Python syntax pass through the maintained harness at exact head 896be69. Original hosted readback37934541796/a1 and both digest-verified artifacts remain preserved. The original403 cause and org distribution readback remain unresolved. No dispatch, package generation or publication retry occurred.