sage: Q175 SSO design r3 fix, Filbert r3 D1 (loader checks slot shape only) and D2 (slot from config dir, scratch Console dataRoot and unreachable issuer)

agents/sage/work/q175-sso/DESIGN.md

@@ -15,6 +15,9 @@ and 353). #385 stays open until the Console stops trusting `X-authentik-username
 - Notes: tests 7 and 15 are built so that only the record rule refuses; test 9a is an alg test; Q-B's two
   classes are defined, and test 23 adds a 200 HTML page; the phase 2 scratch Console uses a scratch config,
   a dummy slot, no `--send` and no `--tester-port`.
+- r3 fix (Filbert r3 approve): D1, the loader checks the slot reference's shape only, and the file checks
+  run in the Console's `--sso` start; D2, the slot resolves from the config dir, and the scratch Console has
+  a scratch dataRoot and an unreachable issuer (section 5).
 - Q-E: settled as Filbert ruled. The `subject-unknown` line keeps iss and sub, JSON-escaped and capped
   (section 1, tests 10 and 19).
 
@@ -223,8 +226,11 @@ refuses any top-level key other than `configVersion`, `environment`, `dataRoot`
 `unsupported configuration key` (:113). The business, seat, cli, discord, bootstrap, land-work, stack-copy and
 conductor-apply code all use it. So phase 1 changes the shared loader, not a Console-only reader:
 
-- mosaic-config.mjs accepts an optional `console` key, and the strict `console.sso` validator (the config
-  checks below) runs inside the loader. The fail-closed canon holds for every reader.
+- mosaic-config.mjs accepts an optional `console` key, and the strict `console.sso` shape validator (the
+  config checks below, except the slot file checks) runs inside the loader. The fail-closed canon holds for
+  every reader. The loader checks shape only and never touches a slot file: `clientSecret` must be
+  `{ slot: <name> }` with the name matching `[a-z0-9-]{1,64}`. The file checks and the read run only in the
+  Console's `--sso` start (D1), so a missing slot or a 0640 slot stops the Console, not the stack.
 - The blast radius is the whole stack. A typo in `console.sso` makes every tool refuse the config, not just
   the Console. That's the price of one loader, and the reason step 4 writes the key inside a window with a
   backup first.
@@ -260,7 +266,9 @@ No secret value goes in this file. The client secret is a slot reference.
 At start, `--sso` prints one line per provider: its id, its issuer and the number of subjects. No client id
 value beyond that, no secret, no `sub`.
 
-The slot is `~/.config/mosaic-dev/secrets/mosaic-stack/<slot>`, read at start. The Console refuses to start if
+The slot is `<configDir>/secrets/mosaic-stack/<slot>`, where `configDir` is the directory of the config file
+the loader read (`MOSAIC_CONFIG`, default `~/.config/mosaic-dev`), so a scratch config gets a scratch slot
+(D2). The Console's `--sso` start reads it. The Console refuses to start if
 the file is a symlink, isn't a regular file, isn't owned by the Console's uid, has any group or other mode
 bits (0640 refuses as well as 0644), or resolves under the repo or a stack copy. The value is never logged or
 put in a refusal message.
@@ -278,7 +286,8 @@ provider and the check:
 - `algs` is non-empty and holds only asymmetric algs from the library's list. `HS256`, any `HS*` and `none`
   refuse.
 - `subjects` is non-empty, each `sub` is 1..255 visible characters, and no `name` is `tester` or `human`.
-- The client secret slot passes the file checks above.
+- `clientSecret` is `{ slot: <name> }` with the name matching `[a-z0-9-]{1,64}` (shape only, in the loader).
+- In the Console's `--sso` start only, the slot file passes the file checks above.
 
 Discovery checks, run per provider when its discovery succeeds:
 
@@ -337,9 +346,11 @@ them. Each entry has its own issuer, client, algs and subjects, and a session re
    check (a request with `X-authentik-username` and no cookie gets 401) runs either on a scratch Console or
    on live by Mos or Jason (B6). No agent sends the auth header to the live 7332 (section 8). The scratch
    Console runs from the same copy as `serve --sso --port <scratch port>`, with `MOSAIC_CONFIG` pointing at a
-   scratch config that names the real issuer and a dummy client secret in a scratch slot. It has no
-   `--send` and no `--tester-port`. Discovery and the JWKS load from the real issuer, and the forged request
-   needs no sign-in, so the dummy secret is never sent.
+   scratch config in a scratch dir. That config has a scratch `dataRoot`, and any business it serves comes
+   from the scratch config dir; neither points at live. Its dummy client secret sits in the scratch slot
+   (`<scratch configDir>/secrets/mosaic-stack/<slot>`). Its issuer is an unreachable loopback host, not
+   Authentik, so the scratch Console sends nothing outbound (D2, mos-0971). It comes up in the degraded
+   state (Q-B), and the 401 check needs no sign-in. It has no `--send` and no `--tester-port`.
 
    Rollback for phase 2: remove the `console` key from config.json first (restore the step 1 backup), then
    roll the pointer back. An older copy's loader refuses a config holding the key (section 4), so the other
@@ -475,7 +486,8 @@ More refusals:
     `/auth/login?return=<current path and query>`, and the refresh stops. A 401 with another error stays an
     error. The existing opaqueredirect case still signs out.
 25. Loader (C1), in scripts/test-config.sh: a config with a valid `console.sso` loads; a malformed one (an HS
-    alg, a missing slot, an unknown key under `console`) fails and names the bad key path; a config without
+    alg, a missing `slot` field, a slot name outside the pattern, an unknown key under `console`) fails and
+    names the bad key path, and no case reads a slot file (the file cases stay in test 11); a config without
     `console` loads.
 
 Positive paths: an RS256 and an ES256 provider each complete sign-in and one send, and two providers configured