Deferred Factory repositories

Factory deferred repository inventory at task creation: lists configured identities as <FORGE> "<owner>"/"<name>". It is the task's frozen configuration snapshot, not a filesystem inventory or authorization: even a listed repository may already be checked out or no longer accessible. Select only the repositories needed for the task.

1. Read OZ_WORKSPACE_ROOT, or WARP_WORKSPACE_ROOT only if the Oz spelling is absent. Require an absolute directory path. This is the checkout destination parent even if the shell's current directory has changed into an eager repository. Never substitute PWD, HOME, WORKSPACE, WARP_INITIAL_WORKING_DIR, or WARP_FACTORY_REPO_DIR; if the root is missing, relative, or unusable, report that checkout is blocked.
2. Read OZ_CLI, or WARP_CLI only if the Oz spelling is absent. Verify that the specified executable is usable; do not guess another executable from PATH if the specified one is missing or unusable. This is a separate value from the root and this skill's location. If it is unavailable, report that checkout is blocked.
3. For each selected forge/owner/name identity, inspect the workspace root for an existing checkout and confirm its remote identity before deciding to fetch anything. Choose an unused single-component checkout_name beneath the root, normally the repository name. Inspect the proposed target without following symlinks. If it is already a file, directory, or symlink (including a broken symlink), do not touch it; choose another unused name. When multiple identities share a name, give them distinct checkout names. Never overwrite an existing checkout, delete or reset a target, or retry blindly into a partially created target.
4. Build a fresh JSON request in a private scratch directory outside checkout targets. Its exact shape is {"working_dir":"<absolute exported root>","repositories":[{"source":{"code_forge":"GITHUB","owner":"<owner>","repo":"<name>"},"checkout_name":"<unused name>","head":null,"fetch_branch_only":false}]}; replace GITHUB with the listed GITLAB or AZURE_DEVOPS as appropriate. Construct JSON with a serializer rather than interpolating repository names: they are data, not shell syntax. Use only identities from the task's semantic inventory. Do not add fields or infer a branch/commit. In execution mode, the helper requires the run-owned preparation policy and resolves the effective remote, typed ref, fetch mode, expected SHA, and origin policy from that policy; request fields cannot override them. Do not change the preparation mode, file, run ID, execution ID, or root environment variables, and do not read or rewrite the private policy. If preparation is missing, stale, or inconsistent, report that checkout is blocked rather than bypassing it.
5. From the existing agent shell, invoke the selected executable as "$OZ_CLI" environment-checkout --requests-file "$requests_file" --report-file "$report_file" --fail-if-target-exists (substitute the selected CLI variable if needed). Quote each executable and absolute file path for the active shell; use that shell's equivalent quoting and invocation syntax outside POSIX shells. This is the top-level command, not agent-driver environment-checkout. Do not use --remove-origins-only. Keep HOME, environment, and the preconfigured Git credential helper unchanged. Never print or copy credentials into prompts, files, URLs, or logs, and never fall back to raw git clone.
6. Capture exit status and read the complete fresh JSON report. Require exactly one outcomes entry per submitted request_index, no missing or duplicate indices, and failure: null for each success. A nonzero exit, missing/malformed/incomplete report, or a Clone, Checkout, VerifyHead, or RemoveOrigin failure means the affected checkout cannot be reported as successful. Report per-request redacted diagnostics; other requests in a partially successful batch may still have created working trees, so inspect their targets instead of replaying the entire batch. Remove only your private scratch request/report files after inspection.

An on-demand checkout creates a Git working tree only. It does not automatically load repository skills, discover file-based MCP servers, run environment setup commands, initialize the build cache, or register the repository with Oz codebase indexing.