launchpad: row 192 packet, mutant 23 equivalent and the guard kept (sage-1407)

webui: Q175 phase 1 round 2, absolute post-sign-in Location checked on publicOrigin (row 192, #1690 )
webby-0019 B1, sage-1403: returnURL builds the Location from publicOrigin plus the parsed pathname and search, checks the origin again and returns the href, so a dot-segment `//host` path stays on the Console. Test 14 covers Webby's three cases and asserts each Location's origin; mutant 22 restores the r1 returnPath (killed). N1 design blob cite, N2 listed under Deviations, N3 SIGN_IN_COOKIE comment.
2026-10-20 15:07:24 -05:00 · 2026-10-20 14:54:43 -05:00 · 2026-10-20 14:30:24 -05:00
81 changed files with 1855 additions and 7889 deletions
@@ -19,12 +19,6 @@ not fleet seats. Keep changes in `/mnt/storage/src/mosaic-stack`; do not modify
 | Launchpad | Builder, MVP T1 row 192 (Q175 SSO phase 1) | T3 session (Claude, Opus 5.5), started by Sage under mos-0974/0977 | none, T3 only |
 | Morgana | Builder, MVP T1 row 193 (human users and RBAC) | T3 session (Claude, Opus 5.5), started by Sage under mos-0974/0977 | none, T3 only |
 | Honker | Builder, MVP T1 row 194 (agent lifecycle) | T3 session (Claude, Opus 5.5), started by Sage under mos-0974/0977 | none, T3 only |
-| Gander | Builder, the human boundary across uids (P19 333, #1694) | T3 session (Codex, gpt-6.1-sol), started by Sage under mos-0977 | none, T3 only |
-| Herb | Builder, a second gate lane (#1695) | T3 session (Codex, gpt-6.1-sol), started by Sage under mos-0977 | none, T3 only |
-| Bushroot | Builder, retire the control board writer on 7331 (#1696) | T3 session (Claude, claude-haiku-5-5), started by Sage under mos-1008 | none, T3 only |
-| Megavolt | Builder, MVP T1 item 6 (agent credentials and git identity, #1697) | T3 session (Claude, Opus 5.5), started by Sage under mos-0974/0977 | none, T3 only |
-| Quackerjack | Builder, federation R5 and R2 (#414) | T3 session (Claude, claude-haiku-5-5), started by Sage under mos-1023 | none, T3 only |
-| Gizmoduck | Federation design (#414) and builder of FED R1 | T3 session (Claude, Opus 5.5, thread 9312a896) | none, T3 only |
 | Webby | Reviewer: Case 2 designs, rows 192 and 194 | T3 session (Claude, Opus 5.5, thread 03086006), started by Mos (mos-0981) | none, T3 only |
 | Duckworth | Reviewer: federation designs, row 193 | T3 session (Claude, Opus 5.5, thread ffceafec), started by Mos (mos-0977) | none, T3 only |
 | Sage | Project lead: coordination, review, integration; earlier DYOR strategy records retained | T3 session (Claude Code); Pi launcher `zai/glm-5.3:high` retained | `agents/sage/launch.sh` |
@@ -1,8 +0,0 @@
-# Bushroot
-
-Builder seat, Claude Haiku 5.5, started by Sage under mos-1008 item 2 (a low-level model under Q177) for the row
-that retires the control board writer on 7331 (#1696).
-
-No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `bushroot/*`
-branches through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -3,5 +3,5 @@
 Reviewer seat, Claude Opus 5.5, started by Mos (mos-0977, thread ffceafec). Reviews federation designs and MVP T1 row 193.

 No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `duckworth/*` branches
+credentials of its own; until row 195 settles per-agent identity, it pushes only its own `duckworth/*` branches
 through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -1,8 +0,0 @@
-# Gander
-
-Builder seat, Codex gpt-6.1-sol, started by Sage under mos-0977 item 5 (more Codex Sol rows) for the human
-boundary row (P19 333, #1694, mos-0989).
-
-No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `gander/*`
-branches through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -1,9 +0,0 @@
-# Gizmoduck
-
-Design and builder seat, Claude Opus 5.5, a T3 thread (9312a896). Author of the federation design
-(`agents/gizmoduck/work/federation/DESIGN.md` on `gizmoduck/federation-design`, #414). Builds FED R1, the
-access.json loader and validator, under Mos's order mos-1023 item 1.
-
-No launcher in this directory. The seat works in its own worktree and has no credentials of its own; until
-the credentials row settles per-agent identity, it pushes only its own `gizmoduck/*` branches through the
-repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -1,11 +0,0 @@
-# Gosalyn
-
-Worker seat for Mosaic Stack, MVP track T2 (Case 2, the creative writing hub, Vikunja #416).
-
- T3 thread: 7604438a-0ded-41c8-bd3f-26f57fdb5cd2
- Model: Opus 5.5 (Claude Code, T3)
- Launched by Mos (Jason's main agent, T3 38bc4c81-6270-4021-b00c-6a15c43b9b0e), who briefs the seat
- Repository lead and queue: Sage (T3 1ef1e4f8-3ead-4208-beca-38f9f1add079)
- Branch: gosalyn/case2-design, pushed only by this seat, landed on refactor by Sage
-
-Work lives in `work/`. The Case 2 design is `work/case2/DESIGN.md`.
@@ -1,8 +0,0 @@
-# Herb
-
-Builder seat, Codex gpt-6.1-sol, started by Sage under mos-0977 item 5 (more Codex Sol rows) for a second gate lane
-design row (#1695, mos-0977 item 6).
-
-No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `herb/*`
-branches through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -3,5 +3,5 @@
 Builder seat, Claude Opus 5.5, started by Sage for MVP T1 row 194 (agent lifecycle, #1692) under mos-0974 and mos-0977.

 No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `honker/*` branches
+credentials of its own; until row 195 settles per-agent identity, it pushes only its own `honker/*` branches
 through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -1,158 +0,0 @@
-# PRD 1.7 draft: the chief of staff's hire and fire authority, the coder's push to its fork, and agent
-# host access through the credential store
-
-Draft by Honker for row 194 (#1692), under Mos's ruling mos-1017 (through Sage, sage-1365). Not approved.
-It changes nothing until Jason approves it as a `prd.approve` decision in the Console. Sage opens that
-decision and sends Mos its id. Base: `docs/prd/mosaic-stack.md` version 1.6 at 53bb59462.
-
-## What it changes
-
-Row 194 adds `role.hire` and `role.fire` to the vocabulary, and row 199 adds `git.push.remote`. Under
-REQ-WAIT-3 all three are hard waits, so today Jason resolves every hire, every fire and every push to a
-remote. This version routes hire and fire for the chief of staff within fixed bounds, so the chief hires
-and fires as needed and the user's per-agent forbid still holds. It routes `git.push.remote` for the coder
-only (Mos, mos-1028 item 3). It adds agent host access with sudo through the credential store for
-agents with a grant (Q183, Q184, Vikunja #424, due 2026-10-27). One `prd.approve` decision covers it all
-(Vikunja #420).
-
-When this version lands, a reviewed commit:
-
-1. adds `role.hire`, `role.fire` and `git.push.remote` to `ROUTED` in
-   `packages/business/src/vocabulary.mjs` and in `packages/bus/src/broker.mjs`.
-2. adds `role.hire` and `role.fire` to `roles/chief-of-staff.json` withinRole, and `git.push.remote` to
-   `roles/coder.json` withinRole. No other role file gets `git.push.remote`.
-3. switches the broker's check on `instance.hire` and `instance.fire` from a cited decision to the
-   `reason` form, as `role.end` works for REQ-ROLE-2, and makes `publish`'s `decision` optional for a
-   within-role class (row 199 D9 step 1).
-4. states, for a `git.push.remote` with no decision, where the source commit comes from: the latest work
-   commit the bus recorded for the coder's task. The check still matches it against the work ref tip and
-   the push sends it by oid (row 199, duckworth-0022 N9).
-5. adds the host credential grant check and the host access it allows (REQ-CRED-3, Vikunja #424).
-
-Every other check stays as rows 194 and 199 build it. Filling `hireable` stays a separate reviewed role
-file commit in `roles/`.
-
-## Text for the PRD
-
-Status line, appended to the current paragraph:
-
-> Version 1.7 routes the chief of staff's hire and fire actions and the coder's push to its own fork,
-> and adds agent host access through the credential store, approved by Jason in decision
-> <prd.approve decision id>.
-
-Source, a new bullet above "Version 1.6 source":
-
-> - Version 1.7 source, TARGET.md line 66: "Chief of staff agent has hire/fire authority for agents as
->   needed; unless user forbids per agent". And Jason through Mos (mos-1067), DECISIONS Q183, in part: "I will
->   still want to allow infra agent(s) on my .53 instance to access other servers, etc. However, not all
->   agents will need to have that access. I envision a credential store within Mosaic Stack that works
->   as some sort of variable for the agent to call. The system will enforce access to the credentials to
->   keep the agents sandboxed with proper security. I need to be able to trust my agents with assisting
->   me. This will require sudo access to several systems. If we can utilize the credential store in
->   Mosaic Stack and allow agents to perform their jobs with NOPASSWD sudo on various machines, I am a
->   happy man." DECISIONS Q184, on whether that is in place by 10-27: "Q5: by 10.27"
-
-Under "Added in version 1.2", after REQ-COS-2:
-
-> Added in version 1.7:
->
-> - **REQ-COS-3.** The chief of staff hires and fires role instances without a decision each time. Hiring
->   adds a role instance to the organization file and lists it for launch. Firing ends the instance's
->   runs and removes it from the launch list. It stays in the organization file. Only the user deletes
->   an instance. These actions are `role.hire` and `role.fire`. They leave the hard waits and route
->   under this requirement, within these bounds:
->   - The chief acts only in its own organization.
->   - The chief hires only role definitions that need no credentials, until a later version adds
->     credentialed roles.
->   - The chief hires only the role kinds its role file lists. Changing that list is a reviewed commit.
->   - The chief hires only a role whose every action is on a fixed list of plain work actions: sending
->     messages, writing records, asking for review, updating its assigned tasks, and the scope and
->     working-push actions of an assigned task. A role holding any other action, such as launch, end,
->     organization, naming, hire, review verdict or merge authority, or any action added later, is never
->     hired. So the chief never hires a chief, never picks its own reviewers or merge gate, and the author
->     is never the reviewer. This holds whatever the role file's list says. Adding to that list is a PRD
->     change.
->   - The chief may set a hired instance's model and narrow its limits, and nothing else about it.
->   - The user can forbid per agent. The user marks an instance so the chief can't fire it, end its runs
->     or change its model, and marks role kinds the chief can't hire. Only the user changes these marks, through the
->     WebUI or the CLI.
->   - The kill switch stops every hire and fire while it is on.
->   - Every hire and fire is logged with the chief's instance, its run and the reason.
-
-Under "Landing", after REQ-LAND-1:
-
-> Added in version 1.7:
->
-> - **REQ-LAND-2.** A coder pushes its own work to its own fork. The action is `git.push.remote`.
->   - What it pushes: one commit, by its oid, never a ref name. That commit is the latest work commit the
->     bus recorded for the coder's task, and the coder made that push. A decision that authorizes a push
->     names that commit, and it doesn't authorize any other.
->   - Where it lands: only the branch `refs/heads/<its Gitea user>/<branch>`. The host builds that
->     name, the agent never does. A push never forces.
->   - Which remote: the agent's own fork of the project's upstream. The business file names the upstream,
->     and the host never contacts it. For each push the host builds the fork's address over https from
->     the upstream's host, port and repository name and the agent's own Gitea user. The history check,
->     the push and the credential match all use that address. So the agent's own user owns the receiving
->     repository on every push, and the agent never names it.
->   - The host refuses an upstream on a host or port other than the agent's Gitea, and an upstream the
->     agent's own user owns. It refuses a fork that is missing, empty or doesn't share the project's
->     history. Gitea's push-to-create stays off, so a push never creates a repository.
->   - Who may: the action routes under REQ-DEC-2 and is granted within-role to the coder role only. No
->     other role file grants it.
->   - Before version 1.7 the action was a hard wait under REQ-WAIT-3, so each push needed a decision
->     the human resolved, and that decision named the commit.
->
->   Every push is logged with the remote, the ref, the commit and, when one was given, the decision.
-
-Under "Credentials", after REQ-CRED-2:
-
-> Added in version 1.7:
->
-> - **REQ-CRED-3.** An agent with a grant can run commands with sudo on another host. The agent asks
->   for the host credential by name. The stack checks that a grant exists for that agent and that host
->   before the credential is used. The agent never sees the key or any other secret value (REQ-CRED-1,
->   REQ-VAR-2). An agent without a grant for that host is refused. Not every agent gets a grant. Who
->   grants a host credential, and how, is set by the #424 design, which Jason approves.
-
-REQ-WAIT-3, appended:
-
-> `role.hire` and `role.fire` were added as hard waits and route under REQ-COS-3 since version 1.7.
-> `git.push.remote` was added as a hard wait and routes under REQ-LAND-2 since version 1.7.
-
-## Notes for the reviewer and for Mos
-
- REQ-COS-1 (1.2) already says the chief "hires and terminates role instances". REQ-COS-3 gives that
-  sentence its actions and bounds. It doesn't widen REQ-COS-1.
- The forbid now names what r3 called "replace": ending a kept instance's run with a reason and changing
-  its model (webby-0010 N2). A user-resolved decision still ends a kept run (row 194 D2.4).
- The fixed list is `HIRE_ALLOWED` in row 194 D2.3, an allowlist since r4 (webby-0010 B1). r3's text
-  named the refused authorities instead, which let merge-gate and any later action through.
- The kill switch is row 191's. If row 191 hasn't landed when this version is approved, the bound still
-  holds through row 194's chain on its candidate.
- REQ-LAND-2 follows row 199's design r6 (4d3007ec9 on megavolt/row199, approved by Duckworth in
-  duckworth-0027: D9 to D11, D9a, D9c, Q-M1 and Q-M2, and the oid binding from mos-1034 item 5) and
-  Megavolt's wording in megavolt-0005, megavolt-0008 and megavolt-0014, through Sage (sage-1377,
-  sage-1380, sage-1387). The fork bullet answers duckworth B5 and B6 and webby-0011 N1. Commit-email
-  checks, the refusal codes and the URL parse rules (D9c) are host checks with tests in row 199, not
-  bounds, so they stay out of the text (megavolt-0008).
- Once the routing lands and the decision is optional for the within-role class, the commit is the task's
-  latest recorded push at check time. It is still checked against the work ref tip and pushed by oid, so
-  the binding holds without a decision (megavolt-0008). Step 4 of "When this version lands" puts that in
-  the routing commit (duckworth-0022 N9, sage-1387).
- REQ-LAND-2 and REQ-COS-3 meet at the coder. Coder declares Gitea credentials, so REQ-COS-3's
-  credentials bound keeps the chief from hiring one until a later version lifts it. `git.push.remote` isn't
-  on REQ-COS-3's fixed list either, so a coder holding it stays unhireable until a PRD version adds it
-  (row 194 D2.3).
- Adding to the fixed action list is a PRD change (mos-1035 item 3, sage-1395). The role file's
-  `hireable` list stays a reviewed commit in `roles/`.
- The credentials bound names no row number, so the text doesn't go stale when row 199 lands. A later
-  version lifts it.
- REQ-CRED-3 states only what Jason said in Q183 and Q184 (sage-1422). It names the outcome and the
-  check, not how the stack reaches the host. Proxying the ssh and a signing socket are both designs, and
-  the #424 design picks one (duckworth-0038 B1).
- Open point: Q183 doesn't say who grants host access or how, so the text leaves it open and defines no
-  mechanism. The #424 design settles it, Jason approves that design, and Duckworth reviews it because it
-  gives agents sudo on hosts (Q184, Mos's reading, duckworth-0038 B2). The build is row 210 (#1707,
-  owner Gizmoduck), a new row on top of row 199 (megavolt-0019, sage-1430).
- This draft follows the PRD's own style: plain words, no semicolons in new sentences, and the status
-  paragraph never edited in place except to append.
@@ -3,5 +3,5 @@
 Builder seat, Claude Opus 5.5, started by Sage for MVP T1 row 192 (Q175 SSO phase 1, #1690) under mos-0974 and mos-0977.

 No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `launchpad/*` branches
+credentials of its own; until row 195 settles per-agent identity, it pushes only its own `launchpad/*` branches
 through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -0,0 +1,178 @@
+# Row 192: Q175 phase 1, the Console verifies sign-in itself (`--sso`)
+
+Launchpad, 2026-10-20. Author Launchpad, reviewer Webby, gate owner Sage. Issue #1690. Brief
+`docs/plans/2026-10-20_sso-phase1.md`. Design `agents/sage/work/q175-sso/DESIGN.md` (blob 9e3eadb15c80).
+Rulings sage-1340 (F1 to F6) and sage-1347 (F7, F8). Plan launchpad-0001.
+
+Base 53bb59462 (`base.txt`). Candidate: branch `launchpad/row192`, r1 83b32d8d8 and the round 2 commit on it.
+`candidate-manifest.sha256` lists the 18 changed code, test and doc paths; the packet files are not in it. Drift
+check at the r2 commit: `git log 53bb59462..origin/refactor` (origin/refactor ae3c36f24) touches none of the 18 paths.
+
+No request in any test goes to auth.diversecanvas.com, mosaic.woltje.com or 127.0.0.1:7332. Every provider
+is the fake OP in `tests/helpers/fake-oidc.mjs`: https on 127.0.0.1 with a throwaway self-signed certificate,
+and a fetch that refuses any other origin. The public Host in the tests is `console.example.test`, sent as a
+header to the test's own loopback listener. No test reads or writes `~/.mosaic-dev`, `~/.config/mosaic-dev`,
+`~/.mosaic`, a slot file outside its temp dir, or a live unit.
+
+## Files
+
+| Path | Change |
+| --- | --- |
+| `package.json`, `package-lock.json` | `oauth4webapi` 3.8.8, exact, at the root (design: the copy runs `npm ci` there). No other dependency. |
+| `scripts/mosaic-config.mjs` | Accepts an optional `console.sso` key and checks it with `checkConsole`. Without the key, output is byte-identical (F2). |
+| `scripts/test-config.sh` | Test 25: a good `console.sso` passes; each refusal class refuses. 31/31. |
+| `packages/webui/src/sso-config.mjs` (new) | `checkConsole`: shape, `publicOrigin`, 1 to 8 providers, issuer https with a trailing slash, slot names, `ALGS` (asymmetric only), 1 to 64 subjects. |
+| `packages/webui/src/sso.mjs` (new) | The relying party: `readSlot`, discovery and JWKS with retry, `/auth/login`, `/auth/callback`, `/auth/logout`, sessions, `health()`, `summary()`, `formTargets()`. |
+| `packages/webui/src/serve.mjs` | Under `sso`: public Host only on the human listener (F4), `/auth/*` routes, session check before every page and API route, CSP `form-action` adds the end-session origins, tester listener refusals (F8). |
+| `packages/webui/src/cli.mjs` | `--sso`, its refusals, slot reads, the start lines, `close()` on stop. |
+| `packages/webui/src/chat-http.mjs` | Under `--sso` the session check already ran, so the header-user check is skipped; the Origin check uses `publicOrigin`. |
+| `packages/webui/src/public/app.js`, `bus.js`, `index.html` | 401 `sign-in required` signs the page out with a link to `/auth/login?return=...` (design test 24, F1). The Sign out form shows only when `/api/config` says `sso` (F7). |
+| `scripts/webui-service.sh` | Passes `--sso` through; `--send` refusal text names `--sso`. |
+| `packages/webui/tests/service.test.mjs` | The `--send` refusal regex follows the new text. |
+| `packages/webui/README.md` | New section "Sign-in in the Console (Q175 phase 1, #1690)". |
+| `packages/webui/tests/helpers/fake-oidc.mjs` (new) | The fake OP. |
+| `packages/webui/tests/sso.test.mjs` (new) | 28 tests: three positives and design tests 1 to 23 (some split in parts). |
+| `packages/webui/tests/sso-browser.test.mjs` (new) | 2 tests: design test 24 with F1, and F7. |
+
+## Tests run (single files, this worktree, final tree)
+
+| File | Pass | Fail |
+| --- | --- | --- |
+| sso | 28 | 0 |
+| sso-browser | 2 | 0 |
+| pinned-copy | 10 | 0 |
+| serve | 4 | 0 |
+| preview | 11 | 0 |
+| proof | 4 | 0 |
+| proof-cli | 3 | 0 |
+| send | 13 | 0 |
+| service | 31 | 0 |
+| tester-listener | 10 | 0 |
+| tester-cli | 2 | 0 |
+| board-held | 3 | 0 |
+| send-browser | 2 | 0 |
+| docs-browser | 1 | 0 |
+| chat | 23 | 0 |
+| chat-browser | 11 | 0 |
+| bus-browser | 2 | 0 |
+| settings-write | 4 | 0 |
+| project-file | 10 | 0 |
+| instances | 5 | 0 |
+| routes | 5 | 0 |
+| `scripts/test-config.sh` | 31 | 0 |
+
+The first singles pass failed `pinned-copy` 1 of 10: `ERR_MODULE_NOT_FOUND: Cannot find package
+'oauth4webapi'` from a copy's `sso.mjs`. The test's fixture repo writes an empty package.json and lock, so the
+copy's `npm ci` installs nothing, and `sso.mjs` imported oauth4webapi at module load. `cli.mjs` imports
+`sso.mjs` on every start, so plain `serve` broke. Fix: `sso.mjs` loads oauth4webapi inside `createSso`
+(`oauth ??= await import('oauth4webapi')`). A Console without `--sso` never resolves the package. A real copy
+still has it from the root lock. Mutant 21 restores the static import and `pinned-copy` kills it. After the
+fix: pinned-copy, sso, sso-browser and serve rerun green (counts above).
+
+Not run by me (slot work, busy at the time): the full webui package suite, the cli suite, and
+`scripts/test-*.sh` other than test-config. `packages/cli/tests/stack-copy.test.mjs` and
+`stack-release.test.mjs` also build copies with an empty lock and are the ones to watch for the same
+failure. They need Sage's gate.
+
+## Mutants (`mutants.py`, run as `python3 mutants.py <tree> [N ...]`)
+
+Each mutant edits one source file, runs one test file filtered to one test name, and restores the file
+checked by sha256. Final run on the final tree: `/mnt/storage/scratch/launchpad-r192/mutants-final.log`.
+
+| # | Mutant | Test | Result |
+| --- | --- | --- | --- |
+| 1 | drop validateApplicationLevelSignature | sso 9 | KILLED |
+| 2 | wrap the signature call in a continuing try/catch | sso 9 | KILLED |
+| 3 | drop the subjects check | sso 10 | KILLED |
+| 4 | accept HS256 and none in ALGS | sso 11 start | KILLED |
+| 5 | take the provider from the query | sso 15 | KILLED |
+| 6 | tester listener reads sign-in cookies (F8) | sso 12 | KILLED |
+| 7 | tester listener takes Authorization (F8) | sso 12 | KILLED |
+| 8 | tester listener takes x-authentik-* (F8) | sso 12 | KILLED |
+| 9 | skip the login record delete | sso 7 | KILLED |
+| 10 | drop HttpOnly from the session cookie | sso 20 and 21 | KILLED |
+| 11 | refresh last-seen on every request | sso 13 idle | KILLED |
+| 12 | build redirect_uri from the request Host | sso 22 | KILLED |
+| 13 | serve the loopback read path under --sso (F4) | sso 22 | KILLED |
+| 14 | bus.js fetchRead ignores 401 sign-in required (F1) | sso-browser 1 | KILLED |
+| 15 | bus.js fetchApi ignores 401 sign-in required (F1) | sso-browser 1 | KILLED |
+| 16 | app.js getJSON ignores 401 sign-in required | sso-browser 1 | KILLED |
+| 17 | app.js api() ignores 401 sign-in required | sso-browser 1 | KILLED |
+| 18 | signInRequired takes any 401 | sso-browser 1 | KILLED |
+| 19 | Sign out shown without the sso condition (F7) | sso-browser 2 | KILLED |
+| 20 | CSP form-action without the end-session origins | sso 13 CSP | KILLED |
+| 21 | import oauth4webapi at module load | pinned-copy | KILLED |
+| 22 | restore the r1 relative returnPath (round 2, B1) | sso 14 | KILLED |
+| 23 | drop the second origin check (round 2, sage-1403) | sso 14 | SURVIVED, equivalent, guard kept (sage-1407) |
+
+Mutant 16 survived its first run: test 1 had no `getJSON` path. The History click on
+`/api/conversations` was added and it is now killed.
+
+## Deviations from the design
+
+- **F1 (sage-1340).** `bus.js` `fetchRead` and `fetchApi` apply the same 401 `sign-in required` rule as
+  `app.js`, even when `/api/config` has no `sso`. Tested in sso-browser 1, mutants 14 and 15.
+- **F7 (sage-1347).** A Sign out form (`POST /auth/logout`) in the command bar, hidden unless `/api/config`
+  says `sso`. Tested in sso-browser 2, mutant 19.
+
+- **Proof header on 7333 under `--sso` (webby-0019 N2).** `cli.mjs` passes `testerProofHeader: null` under
+  `--sso`, since `--sso` refuses the proof pair and there is no header name to refuse. A request to 7333 that
+  still carries the old proof header is not refused for it. It gains nothing: under `--sso` no listener
+  reads a proof header (`proof` is null in `startServer`). Left as is.
+
+## Assumptions and choices
+
+- **F8 (sage-1347).** Under `--sso` the tester listener refuses a request carrying `Authorization`, either
+  `__Host-mosaic` cookie or any `x-authentik-*` header, case-insensitive (Node lower-cases header names).
+  sso 12 sends one of each; mutants 6 to 8.
+- **oauth4webapi loads lazily** inside `createSso` (see the pinned-copy failure above).
+- **Client authentication** is `ClientSecretBasic`; the fake OP's token endpoint checks Basic auth.
+- **Caps**: 1 to 8 providers, 1 to 64 subjects per provider, 64 sessions, 32 pending logins. The 33rd login
+  drops the oldest record (sso 17).
+- **CSP**: under `--sso`, `form-action` adds each provider's end-session origin. Chrome applies
+  `form-action` to the redirect after the Sign out POST, so without it the logout stops at the Console.
+  Tested in sso 13 CSP, mutant 20. Without `--sso` the CSP string is unchanged.
+- **`--send` refusal text** in cli.mjs and webui-service.sh now ends "or --sso".
+- **Start lines**: one `Sign-in provider:` line per provider with id, issuer, subject count and state
+  (`ready`, `refused` or `unreachable`). No client id, secret or sub.
+- **Test 1** uses `console.example.test` as the public Host, not mosaic.woltje.com (no request goes there).
+- **Test 11 slot files**: the owner check is not tested; the test can't create a file owned by another uid
+  without privilege. Symlink, 0644, 0640 and a file under the repository are tested.
+- **Test 23** covers a provider down at start: the Console starts, `/auth/login` is 503, loopback `/healthz`
+  is 200 with `sso: { a: 'unreachable' }`, one `discovery-failed` line, and the retry makes sign-in work. An
+  HS-only discovery at start refuses the start (in test 23 and in test 11 start).
+- **Test 22**: a Host of bare `localhost` without a port is not in the table. It hits the older
+  `non-local Host refused` check before the sso check; a comment in the test says so.
+
+## Round 2 (webby-0019)
+
+- **B1, open redirect after sign-in.** `returnPath` took any URL on `publicOrigin`, and dot segments can
+  normalize to a pathname of `//evil.example`, which a browser reads as scheme-relative in a relative
+  Location. Fix per sage-1403: `returnURL` (renamed) builds an absolute URL, `publicOrigin + pathname +
+  search`, checks its origin again, and returns its href. Anything else is `publicOrigin/`. The callback's
+  Location is now always absolute on the Console. Test 14 asserts the exact Location and its origin for each
+  case. It adds Webby's three rows (`/.//evil.example`, `/x/..//evil.example`,
+  `https://console.example.test//evil.example`), each now `https://console.example.test//evil.example`, a path
+  on the Console. It also adds `/board/./x`, which lands on `/board/x`. The positive test expects
+  `https://console.example.test/board?x=1`.
+- **Mutant 22** restores the r1 relative `returnPath`; test 14 kills it.
+- **Mutant 23** drops the second origin check. It SURVIVES, and I read it as equivalent: `checkConsole`
+  holds `publicOrigin` to a bare https origin, and a parsed https pathname always starts with `/`, so
+  `publicOrigin + pathname` can't parse to another origin. Webby agrees (webby-0022). Sage's ruling
+  (sage-1407): the check stays as an unreachable guard, and 23 is listed here as equivalent. That is a packet
+  note, not a candidate change.
+- **N1.** The design cite is now blob 9e3eadb15c80 (`git rev-parse 83b32d8d8:agents/sage/work/q175-sso/DESIGN.md`).
+- **N2.** Listed under Deviations.
+- **N3.** `SIGN_IN_COOKIE` has its own comment, above the row 177 comment and `TESTER_CHAT_WRITE`.
+- **N4.** Row 200 (#1698) covers it: `stack-release.sh` refuses `config-console-key` before any stop when the
+  target's loader refuses the key, on activate and rollback.
+- **N5.** No change.
+
+Round 2 runs, this worktree, final tree: `sso.test.mjs` 28/28 (`/mnt/storage/scratch/launchpad-r192/sso-r2.log`);
+mutants 22 and 23 (`/mnt/storage/scratch/launchpad-r192/mutants-r2.log`).
+
+## Not done here
+
+- Row 200 (#1698, `stack-release.sh activate --sso`) is chained on this candidate and starts only after the
+  manifest is with Webby (sage-1369).
+- Full suites are for Sage's gate.
@@ -0,0 +1 @@
+53bb59462120a03a9f54b02881895e3f575e501c
@@ -0,0 +1,18 @@
+95d9a48812eebc415e3605239788e5b0746f1457a3bf0f9b9651a8c745e8b0f6  package.json
+390cbb0ef88de6cbc6d8f43b9e212abfdf0ef0e1c88fa02f5ab790caabc53eed  package-lock.json
+726b71bcfdb4d9409cefc86bed2fbe8e678c6efb50bcf5bb22344aeda1eee201  packages/webui/README.md
+f7b6b68906f13a644854b8083287dfa2936e8defc6207d05739e89763cc91440  packages/webui/src/chat-http.mjs
+4a2d226bdbfee98b180103f71b3cb8122303cfac4aeece42bd30ce167ba6ff55  packages/webui/src/cli.mjs
+41ee8798c34ee491b80ae1b42c3e96cd5d12fb1603b1ab88ac2dd10b5fb27964  packages/webui/src/public/app.js
+e6c8f838eb7cdc2ae556c04451ca4c8f2d433117a17f285a144cfc7dff03e2a4  packages/webui/src/public/bus.js
+f276fa440ec938638cb3e0f1b812fafa929460a6b96f1dab4cf1076a7c0c18ea  packages/webui/src/public/index.html
+333d474b1c7e753938aedc639c08f9db0e787faf56aa8068d013fd304a0b3b7e  packages/webui/src/serve.mjs
+37b01ab0479d5f2a7ab9aac790931c6d88c790465392d9c0b65a105513f3e36b  packages/webui/src/sso-config.mjs
+b624f044d361c648cefa161abe5f2b96e0cd8a83bc7816c9d501a2cd840988ca  packages/webui/src/sso.mjs
+84e31d4beba0de5ed6d192921bd7b016296c8b2a42b3fcf1176663e182320d9e  packages/webui/tests/helpers/fake-oidc.mjs
+ac01037743fcbf1efa641794d3878f113b6206033d2f66cde072a52ccfae1a51  packages/webui/tests/service.test.mjs
+9358e3755e174b61532e2c528e733ffcdb48941cbadb825f1b0254bc55d1920e  packages/webui/tests/sso-browser.test.mjs
+3f8527fd7ae1ffb2bffce3450971f125bd616954b534577ef54249c87f36e248  packages/webui/tests/sso.test.mjs
+f8307d4bd998634467fbed8748157754132b76affac051f320196161ce385e4a  scripts/mosaic-config.mjs
+3301c1fabf616bb961d62f6decd0a46dadb0f399b8ba7f3c2ca60023d2b24c78  scripts/test-config.sh
+7678bb6b45861c3dc6d775fc99269b1db7350ced60b89517d6ebeb4cc161781c  scripts/webui-service.sh
@@ -0,0 +1,59 @@
+# Row 192 (#1690) mutants: `python3 mutants.py <tree> [N ...]`. Each applies to the tree's source, runs one
+# test file (optionally one name pattern) and restores the file from a saved copy, checked by sha256.
+# Killed = test exit != 0.
+import hashlib, os, subprocess, sys, signal
+W = os.path.join(os.path.abspath(sys.argv[1]), 'packages', 'webui')
+if not os.path.isfile(os.path.join(W, 'src', 'sso.mjs')): sys.exit(f'ABORT no packages/webui/src/sso.mjs under {sys.argv[1]}')
+S, B, C, F = 'src/sso.mjs', 'src/serve.mjs', 'src/sso-config.mjs', 'src/public/'
+T, P = 'tests/sso.test.mjs', 'tests/sso-browser.test.mjs'
+M = [
+ ('drop validateApplicationLevelSignature (9b)', S, [("try { await oauth.validateApplicationLevelSignature(entry.as, response, options()); } catch (err) {", "try { } catch (err) {")], T, '^9:'),
+ ('wrap the signature call in a continuing try/catch (9b)', S, [("try { await oauth.validateApplicationLevelSignature(entry.as, response, options()); } catch (err) {", "try { try { await oauth.validateApplicationLevelSignature(entry.as, response, options()); } catch {} } catch (err) {")], T, '^9:'),
+ ('drop the subjects check (10)', S, [("if (name === undefined) {", "if (false) {")], T, '^10:'),
+ ('accept HS* in algs (11)', C, [("export const ALGS = Object.freeze(['PS256',", "export const ALGS = Object.freeze(['HS256', 'none', 'PS256',")], T, '^11: start'),
+ ('take the provider from the query (15)', S, [("const entry = record && providers.get(record.provider);", "const entry = record && providers.get(query.get('provider') ?? record.provider);")], T, '^15:'),
+ ('let the tester listener read cookies (12, F8)', B, [("SIGN_IN_COOKIE.test(req.headers.cookie ?? '') ||", "")], T, '^12:'),
+ ('tester listener takes Authorization (12, F8)', B, [("Object.hasOwn(req.headers, 'authorization') ||", "")], T, '^12:'),
+ ('tester listener takes x-authentik-* (12, F8)', B, [(" || Object.keys(req.headers).some(h => h.startsWith('x-authentik-'))", "")], T, '^12:'),
+ ('skip the login record delete (7)', S, [("if (key !== null) logins.delete(key);\n    // The provider", "// The provider")], T, '^7:'),
+ ('drop HttpOnly from the session cookie (21)', S, [("`${SESSION_COOKIE}=${id}; ${ATTRS}`", "`${SESSION_COOKIE}=${id}; Path=/; Secure; SameSite=Lax`")], T, '^20 and 21'),
+ ('refresh seen on every request (13)', B, [("sso.session(req, { touch: req.method === 'POST' || (req.method === 'GET' && !path.startsWith('/api/')) })", "sso.session(req, { touch: true })")], T, '^13: idle'),
+ ('build redirect_uri from the request Host (22)', S, [("const redirectUri = `${publicOrigin}/auth/callback`;", "let redirectUri = `${publicOrigin}/auth/callback`;"), ("    const query = new URLSearchParams(search);\n", "    const query = new URLSearchParams(search);\n    redirectUri = `https://${req.headers.host}/auth/callback`;\n")], T, '^22:'),
+ ('serve the loopback read path under --sso (22)', B, [("if (sso !== null && !named && !(path === '/healthz' && req.method === 'GET')) return json(res, 403, { error: 'public Host required' });", "")], T, '^22:'),
+ ('bus.js fetchRead ignores 401 sign-in required (F1)', F+'bus.js', [("    if (signInRequired(res, body)) { signOutSso(); throw signedOut(); }\n    if (!res.ok || !body || !Array.isArray(body.rows))", "    if (!res.ok || !body || !Array.isArray(body.rows))")], P, '^a 401'),
+ ('bus.js fetchApi ignores 401 sign-in required (F1)', F+'bus.js', [("    if (signInRequired(res, body)) { signOutSso(); throw signedOut(); }\n    if (!res.ok || !body || typeof body !== 'object'", "    if (!res.ok || !body || typeof body !== 'object'")], P, '^a 401'),
+ ('app.js getJSON ignores 401 sign-in required (24)', F+'app.js', [("    if (signInRequired(res, body)) { sso = true; signOut(); throw signedOut(); }\n    return { ok: res.ok, body };", "    return { ok: res.ok, body };")], P, '^a 401'),
+ ('app.js api() ignores 401 sign-in required (24)', F+'app.js', [("    if (signInRequired(res, result)) { sso = true; signOut(); throw signedOut(); }\n", "")], P, '^a 401'),
+ ('signInRequired takes any 401 (24)', F+'app.js', [("res.status === 401 && body?.error === 'sign-in required'", "res.status === 401")], P, '^a 401'),
+ ('Sign out shown without the sso condition (F7)', F+'app.js', [("if (config.sso === true) { sso = true; $('sign-out').hidden = out(); }", "{ $('sign-out').hidden = out(); }")], P, '^the Sign out'),
+ ('form-action without the end-session origins (CSP)', B, [("form-action 'self'${sso ? sso.formTargets().map(o => ` ${o}`).join('') : ''}`", "form-action 'self'`")], T, '^13: the CSP'),
+ ('import oauth4webapi at module load (copies)', S, [("let oauth;\n", "import * as oauth from 'oauth4webapi';\n"), ("  oauth ??= await import('oauth4webapi');\n", "")], 'tests/pinned-copy.test.mjs', '^serve runs from a copy'),
+ ('restore the r1 relative returnPath (14, webby-0019 B1)', S, [("      if (u.origin !== publicOrigin) return home;\n      const out = new URL(`${publicOrigin}${u.pathname}${u.search}`);\n      return out.origin === publicOrigin ? out.href : home;", "      return u.origin === publicOrigin ? u.pathname + u.search : '/';")], T, '^14:'),
+ ('drop the second origin check (14, sage-1403)', S, [("      return out.origin === publicOrigin ? out.href : home;", "      return `${publicOrigin}${u.pathname}${u.search}`;")], T, '^14:'),
+]
+sha = lambda b: hashlib.sha256(b).hexdigest()
+only = sys.argv[2:]
+os.chdir(W)
+survived = []
+for i, (name, path, pairs, test, pat) in enumerate(M, 1):
+    if only and str(i) not in only: continue
+    orig = open(path, 'rb').read(); h = sha(orig)
+    src = orig.decode()
+    for a, b in pairs:
+        if src.count(a) != 1: sys.exit(f'ABORT {i} {name}: pattern found {src.count(a)} times')
+        src = src.replace(a, b)
+    try:
+        open(path, 'w').write(src)
+        p = subprocess.Popen(['node', '--test', f'--test-name-pattern={pat}', test], stdout=subprocess.PIPE, stderr=subprocess.STDOUT, start_new_session=True)
+        try: out, _ = p.communicate(timeout=240)
+        except subprocess.TimeoutExpired:
+            os.killpg(p.pid, signal.SIGKILL); out, _ = p.communicate(); out += b'\nTIMEOUT'
+        text = out.decode(errors='replace')
+        ran = [l for l in text.splitlines() if l.startswith('ℹ tests ')]
+        verdict = 'KILLED' if p.returncode != 0 else 'SURVIVED'
+        if verdict == 'SURVIVED': survived.append(name)
+        print(f'{i:2} {verdict} {name} [{ran[0] if ran else "no count"}]', flush=True)
+    finally:
+        open(path, 'wb').write(orig)
+        if sha(open(path, 'rb').read()) != h: sys.exit(f'ABORT restore failed for {path}')
+print('survived:', survived or 'none')
@@ -1,8 +0,0 @@
-# Megavolt
-
-Builder seat, Claude Opus 5.5, started by Sage under mos-0974 and mos-0977 item 5 for MVP T1 item 6, the
-credential store per agent with its own git identity (#1697).
-
-No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `megavolt/*`
-branches through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -3,5 +3,5 @@
 Builder seat, Claude Opus 5.5, started by Sage for MVP T1 row 193 (human users and RBAC, #1691) under mos-0974 and mos-0977.

 No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `morgana/*` branches
+credentials of its own; until row 195 settles per-agent identity, it pushes only its own `morgana/*` branches
 through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -1,10 +0,0 @@
-# Quackerjack
-
-Builder seat, Claude Haiku 5.5 at high effort, started by Sage under mos-1023 item 1 and Q177 for federation
-rows R5 (`mosaic access list, grant, revoke`) and R2 (the `federation` config key), per Gizmoduck's design
-section 7 (#414).
-
-No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until the credentials row settles per-agent identity, it pushes only its own
-`quackerjack/*` branches through the repository credential helper (mos-0981), never `refactor`, `main` or
-another seat's branch.
@@ -1,8 +0,0 @@
-#!/bin/bash
-n=0
-for p in /proc/[0-9]*; do
-  c=$(tr '\0' ' ' < $p/cmdline 2>/dev/null) || continue
-  case "$c" in *shell-snapshots*|*chrome-devtools-mcp*|*sage-busy-now*) continue;; esac
-  if echo "$c" | grep -qE 'node --test|gate\.sh|mutant|scripts/test-[a-z-]+\.sh|docker compose'; then echo "BUSY ${p#/proc/}: ${c:0:160}"; n=$((n+1)); fi
-done
-[ $n -eq 0 ] && echo CLEAR
@@ -1,24 +0,0 @@
-#!/bin/bash
-set -o pipefail
-# Landing gate template (2026-10-14): sed the G= and OUT= lines and this comment.
-# Sequential suites, each teed to its own log; stops at the first failure.
-G=/mnt/storage/scratch/SET-ME-wt
-OUT=/mnt/storage/scratch/SET-ME-out
-cd "$G" || exit 9
-mkdir -p "$OUT" || exit 9  # a missing OUT failed the row 142 gate at step 1 (2026-10-15)
-# test-task.sh live cases run `docker compose` from $G, so without a name the project is "wt"
-# and leaves wt_default behind (row 142 gate, 2026-10-15). Name it per gate dir and remove it on exit.
-export COMPOSE_PROJECT_NAME="$(basename "$(dirname "$G")")"
-trap 'docker network rm "${COMPOSE_PROJECT_NAME}_default" >/dev/null 2>&1 && echo "removed network ${COMPOSE_PROJECT_NAME}_default"' EXIT
-# A gate tree without the node_modules link fails cli tests with ENOENT (2026-10-13).
-[ -d "$G/node_modules" ] || { echo "STOP no node_modules in $G"; exit 8; }
-echo "base $(git rev-parse --short HEAD) dirty $(git status --short | grep -vc node_modules) DOCKER_HOST=${DOCKER_HOST:-unset}"
-run() { local name="$1" dir="$2" cmd="$3"
-  (cd "$G/$dir" && bash -c "$cmd") > "$OUT/$name.log" 2>&1; local rc=$?
-  echo "$name rc=$rc $(grep -E '^ℹ (pass|fail) [0-9]+' "$OUT/$name.log" | tr '\n' ' ') | $(tail -n1 "$OUT/$name.log")"
-  [ $rc -eq 0 ] || { echo "STOP $name"; exit $rc; }; }
-# No pkg-queue step: scripts/test-queue.sh runs packages/queue/tests/ itself (same 156 tests; CI debate item 2a, Vikunja #274).
-for d in packages/*/; do p=$(basename "$d"); [ -d "$d/tests" ] || continue; [ "$p" = queue ] && continue
-  run "pkg-$p" "packages/$p" 'node --test tests/*.test.mjs'; done
-for s in scripts/test-*.sh; do n=$(basename "$s" .sh); run "script-${n#test-}" . "bash $s"; done
-echo GATE_PASSED
@@ -1,36 +0,0 @@
-# Row 189 gate timing (for row 197, Herb)
-
-Sage, 2026-10-20T19:25:04Z. Gate on 0c177e9ef (base 0217b71c8), one lane. The slot was mine. Seats may have run single test files at the same time, which the slot rules allow, and I did not record that.
-Start 2026-10-20T19:09:37Z, end 2026-10-20T19:20:36Z. Total wall time: 659 s.
-
-Wall time per suite is the gap between one suite's log mtime and the one before it (the first suite starts at start.txt), so it includes node start-up. node's duration_ms is listed where the suite prints it. Scripts print no duration.
-
-| Suite | Wall s | duration_ms s | Ended (UTC) |
-|---|---|---|---|
-| pkg-bus | 3 | 3.8 | 19:09:40 |
-| pkg-business | 3 | 2.2 | 19:09:43 |
-| pkg-cli | 388 | 388.5 | 19:16:11 |
-| pkg-control-board | 1 | 0.8 | 19:16:12 |
-| pkg-conversation | 35 | 35.4 | 19:16:47 |
-| pkg-discord | 3 | 2.6 | 19:16:50 |
-| pkg-harness | 12 | 11.6 | 19:17:02 |
-| pkg-ledger | 13 | 13.5 | 19:17:15 |
-| pkg-mosaic | 3 | 2.3 | 19:17:18 |
-| pkg-plugins | 0 | 0.3 | 19:17:18 |
-| pkg-project | 1 | 1.2 | 19:17:19 |
-| pkg-runs | 1 | 0.8 | 19:17:20 |
-| pkg-seat | 6 | 6.2 | 19:17:26 |
-| pkg-tasks | 1 | 1.2 | 19:17:27 |
-| pkg-webui | 58 | 57.9 | 19:18:25 |
-| script-auth | 1 | - | 19:18:26 |
-| script-conductor | 5 | - | 19:18:31 |
-| script-config | 2 | - | 19:18:33 |
-| script-discord | 8 | - | 19:18:41 |
-| script-extension-package | 1 | - | 19:18:42 |
-| script-foundation | 40 | - | 19:19:22 |
-| script-land-work | 11 | - | 19:19:33 |
-| script-queue | 21 | - | 19:19:54 |
-| script-release | 11 | - | 19:20:05 |
-| script-task | 31 | - | 19:20:36 |
-
-Source: /mnt/storage/scratch/sage-g189/out/*.log mtimes and gate.log. The cli suite is about 59% of the run, and webui plus conversation add about 14%.
@@ -1,86 +0,0 @@
-# Row 189: `stack-release.sh activate --no-send`
-
-Gitea #1687. Vikunja P19 #413 (Q175 interim, #412). Brief: docs/plans/2026-10-20_activate-no-send.md.
-Rulings: mos-0972 (the Console runs without `--send` until Q175 phase 2), mos-0973 (go; Sage builds,
-Dewey reviews; gate is the cli suite plus every scripts/test-*.sh). Base: def2e7932 (refactor, the
-brief commit on 9ae8c73ac).
-
-## What it does
-
-`activate ID BUSINESS --no-send` drops `--send` from `RUN_CONSOLE` in a new `send_for_target`, which
-`console_for_target` calls after `proof_for_target`. `install_stack` renders the unit from
-`RUN_CONSOLE` and `write_pointer` writes the pointer from it, so both lose the flag and `flags_drift`
-stays quiet afterwards. Only `activate` takes the flag; the parser sends every other op to usage
-(exit 4).
-
-`check_target` lets a `--no-send` activate name the pointer's copy only when the pointer's Console
-flags hold `--send`. That run is a live-copy re-pin, the same path row 187 uses for the proof pair:
-the plan prints the live-copy note, the run stops both units, backs up the stopped store and starts
-them again. A plain same-copy activate, or a same-copy `--no-send` once `--send` is gone, still
-refuses `already-active`.
-
-`--plan` prints one `send:` line after the `proof:` line, for activate and rollback:
-
- `send: dropped; --no-send was given`
- `send: off; --no-send was given and the pointer holds no --send`
- `send: carried` (the pointer's `--send` goes on unchanged)
- `send: off`
-
-The steps log gets `drop --send; --no-send was given`, or `--no-send was given and the pointer holds no
--send, so there is nothing to drop`.
-
-Rollback and pm-on carry the pointer's flags as they are, so once `--no-send` has run, nothing adds
-`--send` back. There is no re-enable flag (mos-0973). Q175 phase 2 changes the Console flags in its
-own row.
-
-docs/TOOLS.md: `[--no-send]` in the usage block and one paragraph after the proof paragraph.
-
-## Tests (packages/cli/tests/stack-release.test.mjs, T55)
-
-1. Seeded preview pointer with `--send --tester-port 7333`: a same-copy `activate B acme --no-send`
-   passes. The pointer and the unit ExecStart lack `--send` and keep the other flags in order, status
-   says the unit flags match, the steps log has the drop line, the log line has from = to = B and the
-   backup sum equals the stopped store's, and the units stop and start in order.
-2. Plain same-copy activate, with `--tester-port` and with `--no-proof`, refuses `already-active`. So does
-   a same-copy `--no-send` once `--send` is gone, and on a pointer that never held it.
-3. The four `send:` lines, the live-copy note on the same-copy plan only, and the Console line right
-   after `send:` without `--send`. The run on a pointer with no `--send` logs the nothing-to-drop line
-   and no drop line.
-4. After `--no-send` on C1, a rollback to B leaves `--send` out of the pointer and the unit, the steps
-   log never names `--send`, and status matches. pm-on after `activate --pm-after-harness --no-send`
-   keeps it off.
-5. `--no-send` on rollback (with and without `--plan`), pm-on, status, adopt and rehearse is a usage
-   error with the usage text, nothing written, started or logged. The usage text shows `[--no-send]`.
-6. A pointer holding both the proof pair and `--send`: the plans for `--no-proof`, `--no-send` and both
-   name what each drops and carries. `--no-send` keeps the pair, `--no-send` with a new pair replaces it,
-   `--no-proof` keeps `--send`, and both together leave neither. Status matches after each.
-
-`planTail` gains `'send: off'` after `'proof: off'`, because every plan now prints the line. T36 takes
-`out.slice(-n)` around `planTail`, so its four slice counts grow by one.
-
-## Mutants
-
-mutants.sh in this packet, run on the candidate. Each mutates scripts/stack-release.sh and runs T55
-plus T1 and T2.
-
- M1: the same-copy exception ignores `--no-send`.
- M2: the same-copy exception allows `--no-send` without `--send` in the pointer.
- M3: with `--no-send`, the pointer is written from `P_CONSOLE`, so it keeps `--send` while the unit
-  drops it.
- M4: rollback re-adds `--send`.
- M5: the parser accepts `--no-send` for rollback.
-
-Results: mutants-run.log, all five killed (M1 5 failures, M2 2, M3 7, M4 2, M5 2).
-
-## Deviations from the brief
-
- The brief's line numbers were taken before row 163 landed. The candidate corrects them to the
-  9ae8c73ac lines (check_target :249-256, flags_drift :646-657, console_for_target :664-693, adopt
-  :828).
- Test 5 also covers rehearse and `rollback --plan`, which the brief did not list.
-
-## Outbound calls
-
-None. The change edits an array before the existing unit render and pointer write. Every test uses
-the stand-in systemctl, units, stores and data root the file already builds; no test touches
-`~/.mosaic-dev`, the live units or a slot file.
@@ -1,5 +0,0 @@
-M1 KILLED fail=5
-M2 KILLED fail=2
-M3 KILLED fail=7
-M4 KILLED fail=2
-M5 KILLED fail=2
@@ -1,34 +0,0 @@
-#!/usr/bin/env bash
-# Row 189 mutants M1-M5: each mutates scripts/stack-release.sh in the sage-b189 worktree, runs T55 and
-# the plan-tail tests, and restores the file from a checked backup.
-set -uo pipefail
-WT=/mnt/storage/scratch/sage-b189
-OUT=/mnt/storage/scratch/sage-b189-mut/out
-S=$WT/scripts/stack-release.sh
-mkdir -p "$OUT" || exit 1
-cp -p "$S" "$OUT/stack-release.sh.orig" || { echo "backup failed"; exit 1; }
-ORIG=$(sha256sum "$S" | cut -d' ' -f1)
-[ "$(sha256sum "$OUT/stack-release.sh.orig" | cut -d' ' -f1)" = "$ORIG" ] || { echo "backup differs"; exit 1; }
-restore() { cp -p "$OUT/stack-release.sh.orig" "$S"; [ "$(sha256sum "$S" | cut -d' ' -f1)" = "$ORIG" ] || { echo "RESTORE FAILED"; exit 1; }; }
-trap restore EXIT
-
-mutate() {
-    case "$1" in
-        M1) sed -i '/{ \[ "\$NO_SEND" = 1 \] && \[\[ " \${P_CONSOLE\[\*\]} " == \*" --send "\* \]\]; } ||/d' "$S" ;;
-        M2) sed -i 's/{ \[ "\$NO_SEND" = 1 \] && \[\[ " \${P_CONSOLE\[\*\]} " == \*" --send "\* \]\]; } ||/{ [ "$NO_SEND" = 1 ]; } ||/' "$S" ;;
-        M3) sed -i 's/^    write_pointer "\$TO" "\$RUN_PM" "\$RUN_PENDING" "\$P_CLAUDE" "\$T_SCHEMA" "\${RUN_CONSOLE\[@\]}"$/    if [ "$NO_SEND" = 1 ]; then write_pointer "$TO" "$RUN_PM" "$RUN_PENDING" "$P_CLAUDE" "$T_SCHEMA" "${P_CONSOLE[@]}"; else write_pointer "$TO" "$RUN_PM" "$RUN_PENDING" "$P_CLAUDE" "$T_SCHEMA" "${RUN_CONSOLE[@]}"; fi/' "$S" ;;
-        M4) sed -i 's/^        SEND_PLAN="send: off"$/        SEND_PLAN="send: off"; [ "$OP" != rollback ] || RUN_CONSOLE+=(--send)/' "$S" ;;
-        M5) sed -i 's/--no-send) \[ "\$OP" = activate \] || usage;/--no-send) { [ "$OP" = activate ] || [ "$OP" = rollback ]; } || usage;/' "$S" ;;
-    esac
-}
-
-for m in M1 M2 M3 M4 M5; do
-    restore
-    mutate "$m"
-    if [ "$(sha256sum "$S" | cut -d' ' -f1)" = "$ORIG" ]; then echo "$m NOT-APPLIED"; continue; fi
-    bash -n "$S" || { echo "$m SYNTAX"; continue; }
-    diff "$OUT/stack-release.sh.orig" "$S" > "$OUT/$m.diff"
-    (cd "$WT" && TMPDIR=/mnt/storage/scratch/t189 timeout 900 node --test --test-reporter=tap --test-name-pattern='T55|T1 |T2 ' packages/cli/tests/stack-release.test.mjs) > "$OUT/$m.log" 2>&1
-    fails=$(awk '/^# fail /{print $3}' "$OUT/$m.log")
-    if [ "${fails:-0}" -gt 0 ]; then echo "$m KILLED fail=$fails"; else echo "$m SURVIVED"; fi
-done
@@ -3,5 +3,5 @@
 Reviewer seat, Claude Opus 5.5, started by Mos (mos-0981, thread 03086006). Reviews Case 2 designs and MVP T1 rows 192 and 194.

 No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `webby/*` branches
+credentials of its own; until row 195 settles per-agent identity, it pushes only its own `webby/*` branches
 through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.
@@ -1361,6 +1361,3 @@ are never rewritten or removed; corrections are new entries.
 2026-10-20T18:34:53Z | Filbert (Opus 5.5, 048f3c63) | Q175 SSO design review r2 (DESIGN.md blob 3eb718b5e131 at 1a268249e), static | changes: C1 config.json console key fails old loaders (mosaic-config.mjs:113 rejects unknown keys; key add inside phase 2 window, rollback removes it, loader test), C2 app.js signs out only on opaqueredirect so 401 never shows sign-in; notes on tests 15/7/9a, Q-B 200-HTML classification, scratch Console flags; Q-E keep iss/sub escaped and capped; verdict sent to Sage, no Gitea/queue record
 2026-10-20T18:40:20Z | Filbert (Opus 5.5, 048f3c63) | Q175 SSO design review r3 (DESIGN.md blob a152fd58e18e at 817e8f51b), static | approve on condition D1 (slot file checks stay out of shared loader, shape-only there) as a line edit; D2 notes: slot root from configDir, scratch dataRoot, name discovery GETs for Mos; C1/C2 and notes verified; Mos C1 sequence confirm still open; no Gitea/queue record
 2026-10-20T18:41:20Z | Filbert (Opus 5.5, 048f3c63) | Q175 SSO design D1/D2 check (DESIGN.md blob eba861f5d2bb at d55d86bb0), static git diff 817e8f51b..d55d86bb0 | ack: D1 and D2 match; design approved; Mos C1 sequence confirm still open; no Gitea/queue record
-2026-10-20T18:57:10Z | Filbert (Opus 5.5, 048f3c63) | row 190 design review r2 (#1688, DESIGN.md sha256 5493c9df3ec0) | CHANGES to Darkwing, cc Sage: B1 claim check on MOSAIC_CONFIG-only selection, B2 shared prefix drop-in dirs; N1-N7 notes; static read, no slot, no Gitea or queue record
-2026-10-20T19:00:04Z | Filbert (Opus 5.5, 048f3c63) | row 190 design review r3 (#1688, DESIGN.md sha256 98236a1aff98) | APPROVE to Darkwing, cc Sage: B1 and B2 closed with M13 and M14, N7 settled by Sage's 48ebee0ff; static read, no slot; manifest round gets a queue review record (sage-1337)
-2026-10-20T20:40:15Z | Filbert (Opus 5.5, 048f3c63) | row 190 (#1688) manifest round 1 review, candidate 8862feccc (static) | CHANGES: B1 base drift, row 189 ace27dc5e conflicts in stack-release.sh, rebase + full gate rerun; N1-N7 notes; Gitea 29634, queue rev 2362 (uncommitted, left for Sage)
@@ -368,7 +368,7 @@ reports checkout or copy identity and refactor drift, and writes nothing.
 ```
 scripts/stack-release.sh adopt BUSINESS
 scripts/stack-release.sh activate ID BUSINESS [--pm | --pm-after-harness] [--migrate] [--tester-port N]
-    [--proof-header NAME --proof-file PATH | --no-proof] [--no-send] [--timeout S] [--plan]
+    [--proof-header NAME --proof-file PATH | --no-proof] [--timeout S] [--plan]
 scripts/stack-release.sh pm-on BUSINESS [--timeout S]
 scripts/stack-release.sh rollback BUSINESS [--restore ACTIVATION [--events N]] [--timeout S] [--plan]
 scripts/stack-release.sh status BUSINESS
@@ -480,14 +480,6 @@ copies. It checks the file with `stat` and `realpath` and never reads the value.
 or `off`. On the live copy it also notes that the run re-pins the pointer's copy
 and only the Console flags change.

-`activate ... --no-send` (row 189, mos-0972) drops `--send` from the pointer's
-Console flags and the unit, so the Console serves reads and no human sends. It
-may name the live copy while the pointer holds `--send`; once `--send` is gone a
-same-copy `--no-send` refuses `already-active`. Later activates, `pm-on` and
-rollbacks carry the pointer, so send stays off. No flag puts `--send` back.
-`--plan` prints one `send:` line: `dropped`, `off` with or without the
-`--no-send` note, or `carried`.
-
 #### A target past c216f47db: the PM after the harness kind

 From c216f47db on, the bus launches the PM only with a `harness` kind in the
@@ -1,8 +1,7 @@
 # Brief: activate --no-send drops the Console's --send

 Sage, 2026-10-20, for Mos's ruling mos-0972 (Q175 interim, Vikunja #412). Owner Sage, reviewer Dewey, gate owner
-Sage. Base: refactor 9ae8c73ac (row 163 landed). Line numbers are at that commit. The candidate corrects them;
-the first draft took them before row 163.
+Sage. Base: refactor 9ae8c73ac (row 163 landed). Line numbers are at that commit.

 This row builds the tool only. The live restart without `--send` is a separate step afterwards, a same-copy
 activate under Q173 with a backup first and a STATE report after. No test here touches `~/.mosaic-dev`, the
@@ -15,11 +14,11 @@ Mos ruled that the Console runs without `--send` until Q175 phase 2, because wit
 process can forge `X-authentik-username` on 127.0.0.1:7332 and send as Jason (design section 8). On the pinned
 stack, the Console flags live in the pointer (`~/.mosaic-dev/state/stack-active.json`):

- `console_for_target` (scripts/stack-release.sh:664-693) carries the pointer's flags unchanged. Only
+- `console_for_target` (scripts/stack-release.sh:658-687) carries the pointer's flags unchanged. Only
  `--tester-port` and the row 187 proof pair can change.
- `check_target` (:249-256) lets an activate name the pointer's copy only for a proof-pair change.
- `adopt` refuses once a pointer exists (:828).
- A hand `webui-service.sh install` without `--send` makes `flags_drift` (:646-657) refuse
+- `check_target` (:247-249) lets an activate name the pointer's copy only for a proof-pair change.
+- `adopt` refuses once a pointer exists (:822).
+- A hand `webui-service.sh install` without `--send` makes `flags_drift` (:640-651) refuse
  `unit-flags-drift` on every later activate, pm-on and rollback.

 So the tool can't drop `--send` today. This row adds that one path.
@@ -1,57 +0,0 @@
-# Brief: a credential store per agent, own git identity, pushes to a remote
-
-Sage, 2026-10-20, for mos-0974 (MVP T1 item 6) and the MVP plan
-(`jason-master-restart/projects/mosaic-mvp/PLAN.md` item 6, GAP-MAP G11 and G13; TARGET.md: "credentials store
-available for all agents; secrets protected with RLS equivalent" and "Agent uses own credentials for git and
-other actions"). Gitea #1697. Owner Megavolt (Opus 5.5, a new builder seat), reviewer Duckworth, gate owner
-Sage. Base: refactor at the brief commit. Design first. The first deliverable is
-`agents/megavolt/work/queue-ROW/DESIGN.md`.
-
-This row draws a security boundary. Sage reviews the design's authority model, and Mos rules on it before any
-code is written.
-
-## What exists today (GAP-MAP, measured at 9ae8c73ac)
-
- G11. Credential references exist per instance for Gitea and Vikunja only
-  (`packages/business/src/credentials.mjs`, `packages/bus/src/credentials.mjs`, `vocabulary.mjs:103`). One
-  Claude env file is shared by every seat.
- G13. Agents use their own Vikunja token (`packages/tasks/src/adapter.mjs`). Git goes through the host
-  socket (`packages/cli/src/git-socket.mjs`). Gitea tokens are loaded but never used.
- The development repository's helper (`scripts/git-credential-mosaic.mjs`, wired in `.git/config` for
-  git.mosaicstack.dev) pushes as one identity. Until this row lands, seats push only their own `<seat>/*`
-  branches through it (mos-0981).
-
-## What the design must settle
-
-1. The store. Where each agent's credentials live, per instance, under the row 190 config canon. File modes,
-   ownership and the read path. Which process may read which entry, and how the bus enforces that (the "RLS
-   equivalent"). A process asking for another agent's entry is refused and logged.
-2. Kinds. Gitea (git over HTTPS, and the API), Vikunja, and the model provider. Say which kinds 10-27 needs
-   and which wait. The model provider entry must not copy jwoltje's `claude-session.env`. If it needs a new
-   provider account or subscription, flag it for Jason and don't pick one.
-3. Git identity and push. Each agent commits with its own name and email and pushes with its own token to a
-   remote it is granted. Which refs an agent may push (its own branches, never the default branch or another
-   agent's), and where that's enforced: the Gitea side (branch protection, token scopes) and our side. How
-   this fits the host git socket, or replaces it.
-4. Lifecycle. Issue, rotate (`rotateBy`, `expires`), revoke and delete, and what row 194 (agent lifecycle) calls
-   when an agent is hired or fired. A fired agent's credentials stop working at once.
-5. Who does what. Creating a Gitea user or token, or any account outside the fleet, is Jason's (Q173
-   exclusions). The design lists each such step as a command or UI action for Jason. Agents never mint
-   accounts.
-6. Migration. Today's seats (jarvis helper, seat tokens) keep working until each moves. The mos-0981 push
-   rule ends only when Mos says so.
-7. What this row closes in G11 and G13, and what stays open.
-
-## Boundaries
-
- No credential value is read, printed, logged or committed. Tests use fake tokens in scratch roots and a
-  fake Gitea.
- No change to `~/.mosaic-dev`, `~/.config/mosaic-dev`, the live units, slot files, `~/.mosaic` or the live
-  `.git/config` of the canonical checkout.
- No request to git.mosaicstack.dev, tasks.woltje.com or any provider from a test.
-
-## Gate
-
-Duckworth approves DESIGN.md, Mos rules on the authority model, then Duckworth approves the manifest. The bus,
-business, cli and tasks suites and every `scripts/test-*.sh` are green on Sage's gate, and the design's
-mutants are killed.
@@ -1,955 +0,0 @@
-# Case 2 slice rows: the creative writing hub (#416, T2)
-
-Gosalyn, 2026-10-20 (from `date -u`), for sage-1329. Every section follows `docs/plans/BRIEF-TEMPLATE.md`.
-The design they build is `agents/gosalyn/work/case2/DESIGN.md` on `gosalyn/case2-design`. Webby
-approved r5 at e1635308b in webby-0021, with notes at dba33aaf6. r6 and r7 change only sections 9 and 10
-and C2-13's row (mos-1057, Q183, webby-0023), and that diff is with Webby. Below, "the design" means that
-file, with its section number. A builder follows the design and doesn't reopen a decision in it. A
-departure goes to Sage before the build continues.
-
-These are the slice rows from design 9.2, plus C2-11a, which the design starts in the first wave. The
-other rows (C2-02, C2-03b, C2-09b, C2-10c, C2-11b, C2-15 to C2-19) get briefs when a seat is free for
-them. Owners and models come from design section 8 (Q177, Q178). Where the design names only a model,
-Sage picks the seat. The reviewers are my proposals, and Sage can change any of them with `queue set`.
-Sage owns every gate.
-
-Base: `refactor` at ae3c36f24. The design cites 9ae8c73ac. `git diff --stat 9ae8c73ac ae3c36f24 --
-packages adapters roles scripts` touches only `scripts/stack-release.sh` and its test, and no cited line
-is in either.
-
-Order (design 8, "Parallel waves"):
-1. Start now: C2-01, C2-08, C2-11a.
-2. On C2-01's candidate: C2-04, C2-05a, C2-06, C2-12. On C2-08's: C2-09a, C2-10a, C2-20.
-3. Then C2-03a and C2-07. Then C2-05b, C2-10b and C2-13.
-4. Last: C2-14.
-
-A row whose parent hasn't landed builds on the parent's candidate and rebases onto its landing (Q177).
-
-Rules every row keeps:
- No test touches `~/.mosaic-dev`, `~/.config/mosaic-dev`, a live unit, a slot file, Melanie's books
-  repo, git.mosaicstack.dev or any Discord server. Tests use scratch roots, scratch config dirs and a
-  local bare repo the test builds in her layout's shape: spaces and capitals in folder names, a `.canvas`
-  file and an unmapped top-level note.
- No row reads her text. Fixtures are made up. A marker string in a fixture body stands in for her
-  text wherever a test checks that output holds none.
- No credential value in any output, test, log or message (CONSTITUTION gate 13). Tests use a fixture
-  token file with a made-up value.
- No live stack change. Nothing here re-pins, restarts or activates anything. C2-13's run on the host
-  needs Jason's go (design 10).
- Before in-review, grep `packages/*/tests` and `scripts/test-*.sh` for each changed path and for any
-  64-hex pin of it, and run every changed or touched test file on its own. Suites need Sage's slot.
- A refusal code named in the design is the code the row ships. A new code goes to Sage first.
-
---
-
-## C2-01 packages/library: mapping, scope, reader, resolver, R-rules, renderItems, survey
-
-### Problem
-
-Nothing in the stack reads a writing repo by a mapping of folders to books, types, canon and playground.
-`packages/project/src/read.mjs:19-26` reads blobs from a record repo but accepts executables (`:21`) and
-knows no scope. Design 1.1 to 1.3 and 7.4 set out what Case 2 needs, and every later row builds on it.
-
-### Owner and reviewer
-
- Owner: Gosalyn, Opus 5.5.
- Reviewer: Webby, who reviewed the design.
- After: none.
-
-### Files owned
-
- `packages/library/` (new): `package.json`, `src/mapping.mjs`, `src/scope.mjs`, `src/reader.mjs`,
-  `src/links.mjs`, `src/problems.mjs`, `src/render.mjs`, `src/survey.mjs`, `src/index.mjs`, `tests/*.test.mjs`,
-  `tests/fixtures/`, `README.md`.
- `scripts/stack-copy.sh`: add `packages/library/src` to `COPY_PATHS`. Without it the live copy has no
-  library code, and no test catches the gap today.
- `packages/cli/tests/stack-copy.test.mjs`: add `packages/library/src/index.mjs` to the list at `:37`.
- `scripts/mosaic` or `packages/cli/src`: only the dispatch line for `library survey`.
-
-### What ships
-
- The mapping schema of design 1.1, including `library-playground-outside-book` and the rule that no
-  playground prefix holds another. Business file loading wires it in C2-04, so here it is a pure
-  validator.
- The scope rule of design 1.2. Only `.md` files are playground or canon.
- The commit reader of design 1.3: `git ls-tree -r -z` and `cat-file` on a commit, never a working tree,
-  through the same `git()` and `gitEnv()` as `packages/project`. R1 to R7 as problems with path and line.
- The link resolver, in the order 1.3 gives: repo root, `vaultPrefix/` stripped, relative to the linking
-  file, then shortest path. `appears_in` and `relationships` wikilinks are read as links.
- `renderItems(body)` (7.4), one pure function for the item kinds and the three notices.
- `library survey <repo> [--mapping <file>]`, which prints folder names, file counts, front matter key
-  sets and link-form counts, and never text.
-
-Tests: one case per R-rule and per resolver step. A link into another repo resolves to nothing. An
-`appears_in` wikilink is indexed. `renderItems` has a snapshot for each kind and each notice. The survey
-prints names, counts, key sets and link-form counts, and a marker string in a fixture body never
-appears in its output. The stack-copy test lists the new path. The library tests and
-`packages/cli/tests/stack-copy.test.mjs` pass.
-
-### Out of scope
-
-Business file loading and consumer skips (C2-04), sync (C2-03a), the index and queries (C2-05a), the
-guard (C2-06). The survey run on the host is design 10 step 7, after the token slot exists.
-
-### Gate
-
-Webby approves the manifest. The library tests and the cli suite are green on Sage's gate, along with
-every `scripts/test-*.sh`.
-
---
-
-## C2-08 creative roles, persona file and block, M1, M2, M6, M10, prompt passed by file
-
-### Problem
-
-The stack has no role that may only read and answer in cited items, no way to carry Bean's and Chet's
-personas, and several paths by which a non-human actor could change a creative instance (design 4, B3).
-Both adapters pass the whole prompt on the command line (`adapters/claude/adapter.sh:79`, `:82`,
-`adapters/pi/adapter.sh:106`, `:121`), so any local user can read it in `/proc/<pid>/cmdline`.
-
-### Owner and reviewer
-
- Owner: an Opus 5.5 seat that Sage picks.
- Reviewer: Webby.
- After: none.
-
-### Files owned
-
- `roles/companion.json`, `.md`, `roles/ideas.*`, `roles/research.*`, `roles/proofreader.*`,
-  `roles/fact-checker.*`, `roles/continuity.*` (new).
- `packages/business/src/vocabulary.mjs`: `THREAD_DEFINITIONS`, `END_PROTECTED` as `THREAD_DEFINITIONS`,
-  `CREATIVE_DEFINITIONS`, `CREATIVE_KINDS`, `CREATIVE_TOOLS`.
- `packages/business/src/role.mjs` (M1), `vars.mjs` (`persona.name`, `persona.sha256` in `REGISTRY`),
-  `launch-settings.mjs` (the `instances` and `models` checks and the `setRoutes` branch),
-  `instance-settings.mjs` (the creative branch).
- `packages/bus/src/broker.mjs`: M6 `decision-not-allowed` only.
- `packages/harness/src/bundle.mjs`: the persona file read and checks, the fenced block in `prompt()`, and
-  the `webPlan` refusal.
- `packages/harness/src/tools.mjs`: `raise_decision` left out for creative definitions.
- `adapters/claude/adapter.sh`, `adapters/pi/adapter.sh`, `adapters/README.md` (`:89`, `:107`).
- Tests in `packages/business/tests`, `packages/bus/tests`, `packages/harness/tests`.
-
-### What ships
-
-Design 4, 5.1 (M1, M2, M6, M10) and 5.3:
- The six role files, version 2, with the tools, authority, messaging and network of the design 4 table.
- The constants. `THREAD_DEFINITIONS` replaces `THREAD_DEFINITION` only where it means "may hold a
-  thread", and that use is C2-09a's. The `assistants` lines at `launch-settings.mjs:140`, `:186` and
-  `:191`, and `tools.mjs:186`, stay `THREAD_DEFINITION`.
- The persona file at `<configDir>/personas/<business>/<instance>.md`, read with `O_NOFOLLOW`. The
-  bundle refuses a non-regular file, another uid's, any group or other bit, more than 8,000 characters,
-  a digest off the var (`persona-mismatch`), and `</persona-file>` or a line starting `# ` or `## `
-  (`persona-invalid`). The block goes between the contract and "## This session", fenced as in design 4.
- One actor rule on all five write paths (design 4): a write that touches a `CREATIVE_DEFINITIONS`
-  instance is accepted only when its actor is the business file's `human`, otherwise
-  `organization-creative-human-only`. The `instances` key of `limits.set` and `organization.set` refuses
-  a creative instance for every actor with `organization-creative-instance`.
- Both adapters pass the prompt file, not its text. Claude uses `--system-prompt-file`. Pi gets the path
-  as `--system-prompt`, and its adapter checks `[ -r ]` first and refuses otherwise, because pi 0.85.1
-  uses the path string itself as the prompt when the file is missing or unreadable
-  (`resource-loader.js:21`, `:24-27`, `:30`).
-
-Tests, all named in the design 8 C2-08 row:
- Role, gate and messaging tests. A creative raise is refused and no decision row appears.
-  `harness-builtin` is refused for `research` and `companion`. `scripts/test-config.sh` passes.
- Persona vars are refused at other layers, when malformed and on a non-creative definition. Each
-  persona file refusal above has a test. A prompt snapshot pins contract, persona, session, in that
-  order.
- M10:
-  - Each path refuses with the file unchanged, and the human's `instances.set` and `routes.set` on
-    `bean` work.
-  - The human's `limits.set` change to Bean's `launch.models` key works, next to the chief of staff's
-    `organization.set` refusal of the same change.
-  - Tester cases run through the broker with a bound tester session, and chief of staff cases with a
-    role session.
-  - A mutant without the `models` check fails.
-  - No `instances` read, `changes.jsonl` line or adapter argv holds a marker string from a fixture
-    persona.
- Adapter tests in `claude-session.test.mjs` and `pi-session.test.mjs`: argv holds the prompt path and no
-  marker from the prompt. Pi's adapter refuses a missing prompt file and an unreadable one.
- Business file, `.history` and `changes.jsonl` modes after an `instances.set` write.
-
-### Out of scope
-
-Thread creation per instance and the launcher (C2-09a), the lookup tools (C2-05b), the cited-reply guard
-(C2-06). Checking the host's claude for `--system-prompt-file` is C2-13's precheck. If the C2-20 dry run
-finds heading lines in a real persona, the fence rule changes in a follow-up to this row, reviewed,
-before the import (design 9.1).
-
-### Gate
-
-Webby approves the manifest. The business, bus and harness suites, `scripts/test-config.sh` and every
-`scripts/test-*.sh` are green on Sage's gate, and the `models` mutant is killed.
-
---
-
-## C2-11a editor wikilink node, after measuring whether [[ round-trips
-
-### Problem
-
-The Console's editor opens a file in visual mode only if `roundTrip(text) === text`
-(`packages/webui/src/public/bus.js:919-920`). Its commonmark rules (`packages/webui/editor/model.mjs:119-120`)
-have no wikilink rule, and nobody has measured whether the serializer escapes `[[`. If it does, every
-note with a wikilink opens in Source.
-
-### Owner and reviewer
-
- Owner: Rocko, gpt-6.1-sol.
- Reviewer: Filbert.
- After: none.
-
-### Files owned
-
-`packages/webui/editor/model.mjs`, the editor's bundle output if the build commits one, and
-`packages/webui/tests/` editor test files.
-
-### What ships
-
-First a test that measures today's behaviour on `[[a]]`, `[[a|b]]`, `[[a#h]]`, in a list item, and next to
-front matter, with the result recorded in the manifest. Then a wikilink node that keeps each form byte
-for byte. `roundTrip` tests cover plain, labelled, heading, in a list, and next to front matter.
-
-### Out of scope
-
-Library pages and saving (C2-11b), link clicking to open a target (C2-11b), any `documentPath` change.
-
-### Gate
-
-Filbert approves the manifest. The webui suite is green on Sage's gate, along with every
-`scripts/test-*.sh`.
-
---
-
-## C2-04 the library entry in the business file, consumer skips, M9, mirror, library.file and library.status
-
-### Problem
-
-The business file accepts only `root` and `repo` per project (`packages/business/src/business.mjs:186-187`),
-and several consumers assume every project has a root (design 2.1). Nothing stops an organization write
-from changing `projects`, and nothing creates a mirror.
-
-### Owner and reviewer
-
- Owner: Rocko, gpt-6.1-sol.
- Reviewer: Filbert.
- After: C2-01.
-
-### Files owned
-
- `packages/business/src/business.mjs`, `organization.mjs` (M9 in `organizationWriter.write`, `:177`),
-  `project.mjs`, `cli.mjs`, `resolve.mjs`, `instance-settings.mjs` (only the skip at `:142`).
- `packages/seat/src/checkout.mjs` (`:310`, `:319`), `packages/cli/src/launcher.mjs` (`:353`).
- `packages/project/src/paths.mjs` (the overlap loop at `:41-44`, and the mirror path).
- `packages/bus/src/broker.mjs`: `library.file` and `library.status` only.
- `packages/webui/src/cli.mjs`: dispatch lines for the two verbs.
- Tests in the matching `tests/` directories.
-
-### What ships
-
-The `kind: "library"` entry of design 1.1, validated by C2-01's schema. Each consumer in design 2.1
-skips it, with its own test. M9: `organization-projects-protected` for any organization write whose
-`projects` differ from the file's in canonical JSON. The bare mirror is created at the `projectRepo` path
-with no remote in its config. `library.file` (read at the served commit) and `library.status` (reads the
-sync state, empty until C2-03a) are human only, refused from an agent session with `human-required`
-(M4).
-
-Tests: business file tests. One test per consumer skip. A launcher test that the workspace has no clone.
-The M9 test calls `write` directly, once with a changed playground prefix and once with a changed hybrid
-entry, and the file and `changes.jsonl` are unchanged. Each verb from an agent session refuses.
-
-### Out of scope
-
-Fetching (C2-03a). Bus writes (C2-02). The Console's library pages (C2-11b).
-
-### Gate
-
-Filbert approves the manifest. The business, seat, cli, project, bus and webui suites are green on Sage's
-gate, along with every `scripts/test-*.sh`.
-
---
-
-## C2-05a lookup index and queries
-
-### Problem
-
-Agents need typed lookups over her repo that keep universes apart and default to canon (design 3). The
-reader from C2-01 has no index or query layer.
-
-### Owner and reviewer
-
- Owner: a Haiku 5.5 subagent at high effort, dispatched by Sage (lead decision 129).
- Reviewer: Filbert.
- After: C2-01.
-
-### Files owned
-
-`packages/library/src/index-build.mjs`, `packages/library/src/query.mjs`, their exports in
-`packages/library/src/index.mjs`, and `packages/library/tests/` query test files.
-
-### What ships
-
-An index per commit (types, names, links, backlinks), cached in memory by commit id. Queries for find, get,
-search, manuscript and universe, with the arguments and result shapes in the design 3 table. `universe`
-is required. Results never leave it, except a hybrid's declared sources minus exclusions. Every result
-carries `scope`. Unmapped files never appear. `links_out` and `links_in` drop other-universe and unmapped
-targets. Results page under `REPLY_CAP` (`packages/harness/src/tools.mjs:271-280`) and are never cut.
-
-Tests: isolation, scope labels on every query, unmapped files never returned, paging under `REPLY_CAP`,
-and a rebuild time on a 3,000-file fixture recorded in the manifest.
-
-### Out of scope
-
-Broker verbs and typed tools (C2-05b). Hybrid entries in the business file (C2-15). The query code takes
-hybrids as a shape, and its tests use a hand-built hybrid mapping.
-
-### Gate
-
-Filbert approves the manifest. The library suite is green on Sage's gate, along with every
-`scripts/test-*.sh`.
-
---
-
-## C2-06 the cited-reply guard, the page store and the three notices
-
-### Problem
-
-Today a creative agent's free text would reach her as a stored message. Jason's ruling says agents never
-write prose for her and always refer to the source (Q176). Design 5.2 puts one guard in the broker before
-every agent-to-human message in a library business.
-
-### Owner and reviewer
-
- Owner: an Opus 5.5 seat that Sage picks.
- Reviewer: Webby.
- After: C2-05a.
-
-### Files owned
-
- `packages/library/src/guard.mjs` and its export.
- `packages/bus/src/broker.mjs`: the pre-check on `message.send` to `human`, and the page store beside the
-  web verbs (`:1516`, `:1521`).
- `packages/bus/src/web.mjs`, only if the page store needs the fetched text passed out.
- Tests in `packages/library/tests` and `packages/bus/tests`.
-
-### What ships
-
-The guard as design 5.2 sets it out: the JSON body, the M5 limits, the checks and refusal codes of the
-5.2 table, and the three notices. It runs before the insert, outside the SQL transaction, as
-`#requestProject` does (`broker.mjs:1378-1430`). It doesn't look at the sender's definition to decide
-whether to run. The page store keeps the last 20 broker fetches per session, 200 KB each, in memory,
-dropped when the session ends.
-
-Tests: one pass and one refusal for each check in M5 and 5.2, each limit refused one past its boundary
-and accepted at it. Each goes through the runner's RESULT path and through `send_message`, and once
-with a non-creative sender in a library business. The `messages` count is unchanged on each refusal.
-
-### Out of scope
-
-The runner retry and the runner's notices (C2-07). The Console's rendering (C2-10b). Any classifier of
-prose. The idea-text residual is Jason's or Melanie's to accept (design 5.1, 10 step 8).
-
-### Gate
-
-Webby approves the manifest. The library, bus and harness suites are green on Sage's gate, along with
-every `scripts/test-*.sh`.
-
---
-
-## C2-12 the setup sheet for Melanie and the survey run sheet
-
-### Problem
-
-Melanie keeps writing in Obsidian, and she needs to know what the agents read, how a playground folder
-works, what changes for Bean and Chet, and two surprises (design 7.1, N2, N4). Whoever runs the survey
-on the host needs exact steps.
-
-### Owner and reviewer
-
- Owner: gpt-6-luna.
- Reviewer: Webby.
- After: C2-01.
-
-### Files owned
-
-`docs/case2/SETUP-SHEET.md` and `docs/case2/SURVEY-RUN.md` (new).
-
-### What ships
-
-The setup sheet in plain words:
- Which folders the agents read, and that a folder named in `playground` is her playground.
- How to add a graph colour group for that path in her own vault.
- That moving a note into a book folder makes it canon, so agents may cite it as fact.
- That a short link to a name that also exists in another of her repos can point somewhere else for the
-  agents, and that a full-path link avoids this.
- What changes for Bean and Chet: short cited items, no passages (design 4).
-
-The survey run sheet gives the exact `library survey` command with C2-01's real flags, and states what
-the output holds: names and counts only.
-
-### Out of scope
-
-Sending it to her. Design 10 step 7 makes that Jason's call.
-
-### Gate
-
-Doc only. Webby approves it against C2-01's real flags. Before landing, grep `packages/*/tests` and
-`scripts/test-*.sh` to confirm no test reads either file.
-
---
-
-## C2-09a one thread per creative instance
-
-### Problem
-
-`thread.create` picks the single `assistant` instance and refuses more than one
-(`packages/bus/src/broker.mjs:2331-2334`). The same rule sits in `#threaded` (`:290-291`) and the launcher
-(`packages/cli/src/launcher.mjs:135`, `:236-238`). So she can't open a thread with Bean beside one with
-Chet.
-
-### Owner and reviewer
-
- Owner: Rocko, gpt-6.1-sol.
- Reviewer: Dewey.
- After: C2-08.
-
-### Files owned
-
-`packages/bus/src/broker.mjs` (`#threaded`, `thread.create`), `packages/cli/src/launcher.mjs`,
-`packages/webui/src/public/bus.js` and `serve.mjs` (the new-thread control only), and tests in
-`packages/bus/tests`, `packages/cli/tests` and `packages/webui/tests`.
-
-### What ships
-
-Design 6, C2-09a: `#threaded` and the launcher read `THREAD_DEFINITIONS`. `thread.create` takes
-`instance`, which must be a `THREAD_DEFINITIONS` instance. With no `instance` and exactly one such
-instance, today's behaviour holds. With more than one, it refuses `thread-instance-ambiguous`. The
-Console's new-thread control lists thread instances by `persona.name` or instance name and passes the
-one she picks. No schema change.
-
-Tests: a creative instance's thread starts a run, `thread.create` with `instance` binds it, and two thread
-instances with no `instance` still refuse.
-
-### Out of scope
-
-Rooms and @tags (C2-09b, C2-10c).
-
-### Gate
-
-Dewey approves the manifest. The bus, cli and webui suites are green on Sage's gate, along with every
-`scripts/test-*.sh`. Watch for hash pins on `bus.js` and `broker.mjs`
-(`packages/bus/tests/channel-proof.test.mjs` pins a webui file).
-
---
-
-## C2-10a no raw session view (M7) and no raw Discord engine (M8)
-
-### Problem
-
-The Console's conversation view shows a model's raw text from session files
-(`packages/conversation/src/reader.mjs:225-240`, `events.mjs:58`, `:82`), so a refused answer would still
-show. The Discord connector posts its engine's output and the broker never sees it
-(`packages/discord/src/connector.mjs:381-387`).
-
-### Owner and reviewer
-
- Owner: a Haiku 5.5 subagent at high effort, dispatched by Sage.
- Reviewer: Filbert.
- After: C2-08.
-
-### Files owned
-
-`packages/conversation/src/reader.mjs`, `packages/discord/src/cli.mjs` (`check` and `run` only), and
-tests in `packages/conversation/tests` and `packages/discord/tests`.
-
-### What ships
-
-M7 and M8 as design 5.1 states them. On a business with a library project, `catalogue()` leaves creative
-sessions out and `open()` refuses them with `conversation-not-listed`. `discord check` and `discord run`
-refuse a binding whose engine isn't `mosaic-bus` with `discord-engine-not-allowed`, and also refuse a
-`mosaic-bus` binding with `tools`.
-
-Tests: a creative session file under the root isn't listed and won't open by id, and an assistant session
-still lists. Both Discord verbs refuse on a library business, and a pi binding on a business without a
-library still checks clean.
-
-### Out of scope
-
-The relay engine itself (C2-18).
-
-### Gate
-
-Filbert approves the manifest. The conversation and discord suites and `scripts/test-discord.sh` are
-green on Sage's gate, along with every `scripts/test-*.sh`. No test reaches a Discord server.
-
---
-
-## C2-20 Bean and Chet persona import, with a count-only dry run
-
-### Problem
-
-Bean's and Chet's personas live in her two Hermes profiles on 10.1.1.54. The hub needs each one as a
-0600 persona file with its digest in the business file (design 4), and nothing should read her memory,
-sessions or messages to get them (design 9.1).
-
-### Owner and reviewer
-
- Owner: Gosalyn, Opus 5.5. The script runs only under Jason's go, by whoever he names.
- Reviewer: Webby.
- After: C2-08.
-
-### Files owned
-
-`scripts/case2-persona-import.mjs` (new), `packages/cli/tests/case2-persona-import.test.mjs` (new) and its
-fixture tree.
-
-### What ships
-
-A script that reads only the persona definition of each of the two Hermes profiles. It confirms profile
-to name from each profile's own configured name, prints the pairing, and stops if a profile names
-neither Bean nor Chet. Per-channel prompts are listed by name and size only. It writes each persona to
-a 0600 staging file. A second step, run as `<user>`, installs it at
-`<configDir>/personas/<business>/<instance>.md` and prints `persona.name` and `persona.sha256`.
-Otherwise it prints names, byte counts and sha256 only. `--dry-run` writes nothing and prints only counts
-of files, lines, and lines starting `# ` or `## `.
-
-Build note (gosalyn-0030, mos-1087). The dry run also counts lines that name a Hermes tool or channel,
-so Jason knows before the import whether a persona refers to things Bean and Chet won't have in
-Mosaic. The words come from a fixed list in the script: the tool names in the hermes-agent checkout at
-df5700ebe, read from its code and not her profiles, plus `Hermes` and `Discord`. It prints one count
-per persona file and never the line, its number or the matched word. A nonzero count changes nothing
-in the import. It goes to Jason with the other counts.
-
-Tests, on fixture Hermes profile trees:
- The right fields are taken.
- Memory and session files are never opened, shown by a read trace on the fixture.
- A profile with no persona field refuses, and a persona that fails C2-08's fence check refuses.
- Output holds no persona text. Each written file is 0600 and its digest matches.
- `--dry-run` writes nothing, and prints the right counts and no marker string for a fixture with two
-  heading lines.
- `--dry-run` counts three lines that name a listed Hermes tool or channel in a fixture. Its output
-  holds none of the matched words.
-
-### Out of scope
-
-Running it. Design 10 step 6 and 9.1 make the dry run, the import and the pairing check Jason's go. If
-the dry run counts heading lines, the C2-08 follow-up changes the fence rule before the import, and her
-text is rewritten only if she says so through Jason.
-
-### Gate
-
-Webby approves the manifest. The test file runs green on its own and the cli suite is green on Sage's
-gate, along with every `scripts/test-*.sh`.
-
---
-
-## C2-03a fetch-only sync
-
-### Problem
-
-The mirror from C2-04 holds nothing until something fetches her repo, safely and read-only, without the
-token ever reaching argv, config, logs or replies (design 7.2, CONSTITUTION gate 13).
-
-### Owner and reviewer
-
- Owner: an Opus 5.5 seat that Sage picks.
- Reviewer: Dewey.
- After: C2-04.
-
-### Files owned
-
-`packages/library/src/sync.mjs`, `packages/library/bin/askpass` (new), `packages/bus/src/broker.mjs`
-(`library.sync`, the 60-second timer and the library lock), `packages/webui/src/cli.mjs` (dispatch line),
-and tests in `packages/library/tests` and `packages/bus/tests`. If the helper sits outside
-`packages/library/src`, add its path to `COPY_PATHS` in `scripts/stack-copy.sh`.
-
-### What ships
-
-Design 7.2's slice:
- `syncCommand(kind, url)`: its argv is `SAFE`, exactly one `-c protocol.https.allow=always`, `-C
-  <mirror>`, then the command. Its env is `gitEnv()` plus `GIT_ASKPASS` naming a helper outside the
-  mirror, which reads the `library-gitea` slot.
- An `https://` URL only.
- The served ref `refs/heads/served`, and `library-diverged`, held until a human `library.sync --accept
-  <commit>`.
- The sync state file, written atomically inside the mirror, and the 60-second timer.
- `library.sync`, human only. A test reaches a local bare repo only through the module parameter that
-  replaces `syncCommand`.
-
-Tests: the C2-03a tests in design 7.2. A mutant that sets `protocol.allow=always` fails the argv test.
-
-### Out of scope
-
-Push and every bus write (C2-03b, C2-02). Creating the token slot, which is design 10 step 4.
-
-### Gate
-
-Dewey approves the manifest. The library and bus suites are green on Sage's gate, along with every
-`scripts/test-*.sh`, and the mutant is killed. A search of the test run's output for the fixture token
-finds nothing.
-
---
-
-## C2-07 runner retry on a guard refusal, and the runner's notices
-
-### Problem
-
-When `message.send` refuses, the runner logs it and marks the message read, so the answer is lost
-(`packages/harness/src/runner.mjs:451-456`). Its empty and failed turn texts (`:449`) wouldn't pass the
-guard.
-
-### Owner and reviewer
-
- Owner: a Haiku 5.5 subagent at high effort, dispatched by Sage.
- Reviewer: Filbert.
- After: C2-06.
-
-### Files owned
-
-`packages/harness/src/runner.mjs` and `packages/harness/tests/runner.test.mjs`.
-
-### What ships
-
-On a refusal with a guard code, a new turn in the same session with the code and reason, at most twice,
-then `{"items": [], "notice": "no-cited-answer"}`. In a library business, `no-answer` and `turn-failed`
-replace the two texts at `:449`. The failure reason stays in the run log.
-
-Tests: a fake harness answers free text, then a valid reply, and exactly one message is stored. An empty
-turn and a failed turn store the fixed notices.
-
-### Out of scope
-
-The guard itself (C2-06).
-
-### Gate
-
-Filbert approves the manifest. The harness suite is green on Sage's gate, along with every
-`scripts/test-*.sh`.
-
---
-
-## C2-05b broker lookup verbs and typed tools
-
-### Problem
-
-The queries from C2-05a aren't reachable from an agent session. Design 3 and M3 call for typed tools
-that the broker re-checks on every call.
-
-### Owner and reviewer
-
- Owner: Rocko, gpt-6.1-sol.
- Reviewer: Dewey.
- After: C2-05a, C2-03a.
-
-### Files owned
-
-`packages/bus/src/broker.mjs` (the lookup verbs), `packages/harness/src/tools.mjs` (the five typed tools),
-and tests in `packages/bus/tests` and `packages/harness/tests`.
-
-### What ships
-
-The five lookup tools of design 3, for every agent session in a business with a library project. Each
-read is at the served commit, and a read whose last fetch is older than 60 seconds syncs first. The
-verbs refuse `library-not-configured` in a business without a library and refuse a missing `universe`.
-The creative tool set is exact: the lookups and `send_message`, with no write tool and no
-`raise_decision`.
-
-Tests: broker verb tests and a snapshot of typed tool names per creative role (M3).
-
-### Out of scope
-
-The guard (C2-06). Write verbs (C2-02, C2-19).
-
-### Gate
-
-Dewey approves the manifest. The bus and harness suites are green on Sage's gate, along with every
-`scripts/test-*.sh`.
-
---
-
-## C2-10b Console chat: cited items and the status line
-
-### Problem
-
-The Console would show a cited reply as raw JSON, and she can't see when the hub falls behind her repo
-(design 7.4).
-
-### Owner and reviewer
-
- Owner: a Haiku 5.5 subagent at high effort, dispatched by Sage.
- Reviewer: Dewey.
- After: C2-06, C2-09a, C2-03a.
-
-### Files owned
-
-`packages/webui/src/public/bus.js`, its stylesheet, `packages/webui/src/serve.mjs` (a `library.status`
-route only), and tests in `packages/webui/tests`.
-
-### What ships
-
-Design 7.4. The chat view renders a cited reply through `renderItems`: each item's kind, text and cites,
-with a scope badge (canon, playground or web) and "changed since" when the file's last commit is newer
-than the cited one. Each notice shows its fixed line. A status line reads `library.status`: the served
-commit and its age, `library-diverged`, a fetch error, and the count of R-problems with a link to the
-list.
-
-Tests: webui tests for items, scope badges, notices, "changed since" and the status line.
-
-### Out of scope
-
-The room view (C2-10c), library pages (C2-11b). Her sign-in from her machine waits on SSO (#412) or
-Jason's interim ruling (design 10 step 5).
-
-### Gate
-
-Dewey approves the manifest. The webui suite is green on Sage's gate, along with every
-`scripts/test-*.sh`. Grep for hash pins on `bus.js` and `serve.mjs` before in-review.
-
---
-
-## C2-13 install script and precheck for the host
-
-### Problem
-
-The hub runs on 10.1.1.54 as `mosaic` under `/srv/mosaic`, as `mosaic-stack.service` with
-`ProtectHome` (design 9, Q181). Nothing installs a library business there, or checks the host before it
-starts.
-
-### Owner and reviewer
-
- Owner: Gosalyn, Opus 5.5. The script runs only under Jason's go, by him or his delegate (design 10).
- Reviewer: Webby.
- After: C2-04, C2-03a, C2-20.
-
-### Files owned
-
-`scripts/case2-install.sh`, `scripts/case2-precheck.sh` and `scripts/case2-unit.sh` (new), the template
-`packages/cli/systemd/mosaic-stack.service.in` (new), `packages/cli/tests/case2-install.test.mjs`
-(new), and one line of `packages/cli/README.md`: at `:713`, "nothing in the repository creates or reads
-it" changes to say that nothing creates it, that only the Case 2 precheck reads it, and that the
-precheck prints only variable names, never values (webby-0034 N2, webby-0035).
-
-### What ships
-
-The install does: bootstrap, release package and activate, the business file with the mapping, `bean`
-and `chet` with their persona vars and files, any specialists she picks, her human id, the token slot
-path. It runs as `<user>` through `sudo -u mosaic -H` from `localadmin`, and `mosaic` gets no key. It
-doesn't create `<user>` and writes no unit file. Root does those in design 10 steps 2a and 2c. Every
-host value is an input, so a later host move changes only inputs.
-
-Row 195 runs these scripts by input for Case 1 on 10.1.1.53 (darkwing to gosalyn, design at
-`agents/darkwing/work/queue-195/DESIGN.md` section 2). They don't copy them. So the install and the
-precheck take `--profile factory|library`, default `library`:
- `library` is everything this brief lists.
- `factory` skips the library mapping, the persona files and digests, the token slot, and
-  `library.sync` and `library.status`. It requires `bus.tester` on, because Case 1's acceptance uses the
-  tester.
- `factory` refuses a business file that has a `kind: "library"` project, with
-  `profile-library-business`. So Case 2 can't reach a tester-on check through a wrong flag.
- `library` refuses with `bus.tester` on, as before.
-
-`case2-unit.sh` is the 2c step. Root runs it from a root-owned checkout of the reviewed commit outside
-`/srv/mosaic`, never from the release, because `mosaic` can write the release. It does the following:
- It renders the unit from the checkout's template, with the user, the home and the copy id as inputs.
- It refuses unless `User=`, `Group=`, `ExecStart=`, `EnvironmentFile=` and the hardening lines match
-  fixed values. `EnvironmentFile=` is the line in `packages/cli/systemd/mosaic-bus.service.in:24`. The
-  copy id is the one part of `ExecStart=` that varies, so a re-pin to a new copy can re-render the
-  unit (row 195). It must be exactly 40 lowercase hex characters naming a copy that holds `scripts/mosaic`,
-  directly under `<home>/.local/share/mosaic-stack/copies`. That is the rule `copy_root` uses
-  (`scripts/stack-copy.sh:6`, `:20`). Anything else refuses before the render.
- It refuses any `PermissionsStartOnly=`, and any `Exec*=` value whose leading run of prefix
-  characters (`@`, `-`, `:`, `+`, `!`) holds a `+` or `!`. systemd takes those prefixes in any order,
-  so `-+/srv/mosaic/x` runs as root even with `User=mosaic`. The named-line check doesn't read these
-  lines (webby-0026 N1, webby-0027, defence in depth).
- It writes `/etc/systemd/system/mosaic-stack.service` as `root:root` 0644. It never uses
-  `systemctl link`, and it refuses a symlink at the unit path.
- On a re-install, it refuses an installed unit that differs from the render.
- It reads nothing from under `<user>`'s home.
-
-The precheck refuses unless all of these hold:
- The config validates.
- `sudo -n true` fails as `<user>`, and `id -G` prints exactly one entry, its primary group. A system
-  user always has one, so the check is for supplementary groups. `bus.tester` is not on.
- The business file, `.history`, `changes.jsonl` and persona files have the modes in design 4, and
-  each persona digest matches.
- The run root is 0700.
- `XDG_DATA_HOME` is unset or is `<home>/.local/share`. `copy_root` reads the copies dir from it
-  (`scripts/stack-copy.sh:6`), and the unit fixes `<home>/.local/share`, so any other value would
-  put the copy where the unit refuses it (webby-0032 N2). A test sets it elsewhere and the precheck
-  refuses.
- `node --version` is 24 or later, because every package's `engines` field says `>=24` (row 195: .53
-  has v22.22.2).
- `bwrap --unshare-all --ro-bind / / true` exits 0 as `<user>`. Without it no session starts. Row 195
-  found no bwrap on .53, and `kernel.apparmor_restrict_unprivileged_userns=1`, and .54 may be the same.
-  On a refusal, the precheck prints the sysctl's value and whether `bwrap` is on PATH.
- When some creative instance's harness is claude-code, one marker prompt run through the host's claude
-  with `--system-prompt-file` shows that it replaces the default prompt. The claude version is printed.
-  With design r9's model path, Bean and Chet run pi, so this check is skipped unless she adds a
-  claude-code specialist.
- When an instance's provider is `zai`, `<configDir>/secrets/claude-session.env` exists, is a regular
-  file owned by `<user>` at 0600, and sets a nonempty `ZAI_API_KEY` (design 10 step 2d). It parses the
-  file the way systemd does, so the last assignment of a name wins (webby-0032 N3). A pi launch
-  has no credential check, so without this the first turn is where a missing key shows. The precheck
-  prints the name and never the value.
- `library.sync` fetches her repo read-only, and `library.status` lists R-problems.
- No Discord binding exists.
-
-It also prints free memory and verifies HOME is `/srv/mosaic`.
-
-Tests run against a scratch data root and a local bare repo. Each precheck refusal has a case. The
-claude check runs against a fake claude that appends rather than replaces, and that case refuses. With
-no claude-code instance the claude check doesn't run, and a test shows a missing claude passes. The key
-file refuses when missing, at 0644, a symlink, with `ZAI_API_KEY=` empty, and with `ZAI_API_KEY=x`
-followed by `ZAI_API_KEY=`. A search of the test
-output for the fixture key value finds nothing.
-`case2-unit.sh` runs against a scratch unit directory. These cases refuse:
- an installed unit edited to `User=root`
- an edited `ExecStart=`
- a template with a hardening line removed
- a template with the `EnvironmentFile=` line removed or pointing elsewhere
- a symlink at the unit path
- a template with `ExecStartPre=+/srv/mosaic/x`
- a template with `ExecStartPre=-+/srv/mosaic/x`
- a copy id that is short, uppercase, holds `/` or `..`, or names no directory
-
-Precheck cases for the new lines: a fake `node` printing v22 refuses, and a fake `bwrap` that exits 1
-refuses. `--profile factory` passes with the tester on and no library items, and refuses a business
-file with a library project. `--profile library` refuses with the tester on.
-A clean render writes a 0644 file. A test checks the script for `systemctl link`.
-
-### Out of scope
-
-Running it on the host. Design 10 steps 2 to 7 are Jason's. Step 1 no longer waits on #421 (Q183), and
-Mos lifted its hold (mos-1074). The root steps 2a and 2c are ops-01's, over ssh as `localadmin`,
-so the install waits on #423 step 1 and on nothing else in #423. The Gitea bot account and the token slot are steps 3 and 4. Stopping Hermes
-is step 9 and her choice.
-
-### Gate
-
-Webby approves the manifest. The test file and the cli suite are green on Sage's gate, along with every
-`scripts/test-*.sh`. The run on the host is a separate window with Jason's go.
-
---
-
-## C2-14 end-to-end acceptance on a scratch root
-
-### Problem
-
-Each slice row tests its own part. Nothing yet shows the whole path from her push to a checked reply in
-the Console.
-
-### Owner and reviewer
-
- Owner: an Opus 5.5 seat that Sage picks.
- Reviewer: Dewey, who also runs the script.
- After: every other slice row above.
-
-### Files owned
-
-`scripts/test-case2.sh` (new) and its fixtures.
-
-### What ships
-
-One script on a scratch data root and a bare repo in her layout. It syncs, asks a creative agent in its
-thread through a fake harness, and stores a reply whose cites verify. It refuses a playground cite on a
-`fact`, holds a force-push as `library-diverged`, and checks that the Console renders the reply as
-items.
-
-### Out of scope
-
-Any live host or real model call.
-
-### Gate
-
-Dewey runs the script and approves. It is green on Sage's gate with every `scripts/test-*.sh`.
-
---
-
-## Brief: row A, ZAI_API_KEY in the session env allowlist
-
-### Problem
-
-For 10-27, Bean and Chet both run pi with provider `zai` on `glm-5.3` (Q186, mos-1090, sage-1469). Pi
-reads the zai key from `ZAI_API_KEY` (pi-ai `env-api-keys.js:89`, with `glm-5.3` in `dist/providers/data/zai.json`).
-`ENV_ALLOW` (`packages/seat/src/session.mjs:83-88`) doesn't hold that name, so `sessionEnv` (`:97-99`)
-drops it. A pi launch has no credential check (`packages/plugins/harness/pi/index.mjs:42`
-`countsAccount: false`, `packages/cli/src/launcher.mjs:299`), so today a zai role launches and fails at
-its first turn, as `packages/cli/README.md:439-444` says.
-
-### Owner and reviewer
-
- Owner: a Haiku 5.5 subagent at high effort, dispatched by Sage (lead decision 129). Size XS.
- Reviewer: Webby.
- After: nothing. It doesn't wait on any Case 2 row.
-
-### Files owned
-
-`packages/seat/src/session.mjs`, `packages/seat/tests/session.test.mjs` and `packages/cli/README.md`.
-
-### What ships
-
- `"ZAI_API_KEY"` joins the provider line of `ENV_ALLOW` (`session.mjs:86`), after `OPENROUTER_API_KEY`.
-  Nothing else in the list changes. `SESSION_CREDENTIALS` and `hasSessionCredential` (`:94-95`) don't
-  change. They are Claude Code's login sets, and a zai key isn't one.
- `packages/cli/README.md`, after "A Pi session gets the same variables through the allowlist." (`:435`),
-  one sentence: a Pi session on provider `zai` logs in with `ZAI_API_KEY`, which the allowlist passes. Like
-  every allowlist variable, it reaches every session the host starts, Claude Code ones included, and a
-  shell inside any of them can read it. Where the README names `claude-session.env` ("Unit", `:711`),
-  "The file holds one line" becomes "The file holds one line per variable", followed by a sentence
-  saying it holds every session provider key, not only Claude's (webby-0032, webby-0034 N1). Leave
-  `:713`, "nothing in the repository creates or reads it", alone. C2-13 owns that line.
- One test in `session.test.mjs`: `ENV_ALLOW` includes `ZAI_API_KEY`, and
-  `sessionEnv({ ZAI_API_KEY: "fixture-zai", ZAI_TOKEN: "t" }, run)` returns `ZAI_API_KEY` with the fixture
-  value and no `ZAI_TOKEN`. The existing allowlist test (`:51-59`) stays as it is.
- One mutant: the same file with `"ZAI_API_KEY"` removed from `ENV_ALLOW`. The new test fails on it.
-
-### Out of scope
-
-Placing a key anywhere. The hub's own key on the Z.ai account is design 10 step 2d, and it is Jason's.
-Any pi launch or live check: running a pi role waits on #383. Chet's Codex login (row B, #428). A
-credential check for pi launches.
-
-### Gate
-
-Webby approves the manifest. The mutant is killed. The seat suite and the cli suite are green on
-Sage's gate with every `scripts/test-*.sh`.
-
---
-
-## Brief: row B, a per-instance pi agent dir for Chet's Codex login (#428)
-
-### Problem
-
-After 10-27, Chet moves from Bean's Z.ai account to his own ChatGPT/Codex login (Q186). Pi's
-`openai-codex` provider logs in with OAuth and a refresh token, and keeps both in `auth.json` under
-`PI_CODING_AGENT_DIR` (pi `config.js:405-438`). A role session's `HOME` is the run's own, so pi never
-sees an agent dir from the host (`packages/cli/README.md:439-441`), and `ENV_ALLOW` doesn't pass
-`PI_CODING_AGENT_DIR`. So no env variable can carry this login. Each instance needs its own agent dir
-that survives runs, because a refresh rewrites the file.
-
-Chet's Hermes profile uses the same login today. Until Hermes stops, two clients would hold one
-refresh token. If a refresh by one revokes the other's, one of them drops out mid-session.
-
-### Owner and reviewer
-
- Design: Gosalyn owns it (sage-1469). The build owner and reviewer are named when the design is
-  approved.
- Starts after 10-27. Nothing in this row is built or tested before then.
-
-### Files owned
-
-None yet. The design names them.
-
-### What ships
-
-The design first. It settles where the dir lives and who can read it, how the launcher mounts it into
-the sandbox writable for one instance only, how a refresh write survives the run, what a shell in the
-session can read, and how a launch with no login refuses. Build rows follow from it.
-
-### Out of scope
-
-Bean's model path. Any change to row A. Any change to Hermes or her server.
-
-### Gate
-
-A live check, run with Jason's or Mos's go, showing that two clients on one ChatGPT login don't revoke
-each other's refresh tokens. Until that check passes, no build row for this design starts.
@@ -1,120 +0,0 @@
-# Federation build rows R1, R2 and R5 (#414)
-
-Sage, 2026-10-20, for Mos's orders mos-1023 item 1, mos-1028 item 2 and mos-1034 item 1. The design is
-Gizmoduck's `agents/gizmoduck/work/federation/DESIGN.md` at a1daa3c07 on `gizmoduck/federation-design` (r4.9,
-sha256 a31cbebd070f9e3a5ca4ccb158b1747c6f5a83c3469855705b0026a581fb5c6a). Duckworth approved r4.5
-(duckworth-0012), r4.6, r4.7 (duckworth-0020) and r4.8 (duckworth-0021, 8a22d0897 on `duckworth/reviews`),
-and acked r4.9 (duckworth-0024). r4.7 applies Jason's Q181 hosts, r4.8 adds N22's R8 checks and r4.9 names who
-runs them. None of them changes R1, R2 or R5. Section 7's table
-sets each row's scope and test gate. Vikunja P19 #414. Seats push only their own `<seat>/*` branches
-(mos-0981).
-
-The other R rows are filed when their parents have candidates: R3 after R1 and row 196, R4 after R3, R5 and
-row 193's viewer level (193a, mos-1019), R6 after #412 phase 1, R1, R2 and R3, R7 after R1-R6 and row 190.
-R8 is a live window, not a code row. Its brief is the last section here.
-
-## Brief: FED R1, the access.json loader and validator
-
-Owner Gizmoduck, reviewer Duckworth, gate owner Sage. Base: refactor at this brief's commit. No parent.
-
-`packages/business/src/access.mjs`: the access.json loader and validator from DESIGN.md section 3.5, and the
-pure `covers`. Providers, peers and businesses come in as arguments. One read plus the file checks. The
-exported interface is what R5 and row 193a build against, so the manifest names it, and any change to it in
-review goes to Sage before it lands. Section 7 names `covers` but not the loader and validator exports or
-the context shape. Morgana's 193a (508ee4d61 on `morgana/row193a`) assumes `checkAccess(doc, {providers,
-peers, businesses})`, with `businesses` mapping an id to `{human, instances}`, throwing a `BusinessError` that
-names the key path. Use those names, or tell Morgana and Quackerjack yours before the manifest goes to
-Duckworth. Row 193a later widens the level check to `viewer` on R1's candidate (mos-1019).
-
-Tests, in `packages/business/tests/`: every rule in 3.5 refuses with the key path named. That covers a
-symlink, a non-regular file, another owner, group or other write, expiry, `*`, a grant disjoint from the given
-subjects, `human` and `tester` ids, any level other than `collaborator`, and a project entry that isn't a
-UUID. For `covers`: `*` and listed ids match, while an unlisted project, instance or business doesn't, an
-expired grant doesn't, and a level filter rejects another level. One mutant per refusal, each killed.
-
-Boundaries: no change to `~/.mosaic-dev`, `~/.config/mosaic-dev`, the live units or any live access.json. Tests
-use scratch roots. Single test files run freely, and suites need Sage's slot.
-
-Gate: Duckworth approves the manifest. The business suite and every `scripts/test-*.sh` are green on Sage's
-gate, and the mutants are killed.
-
-## Brief: FED R5, mosaic access list, grant and revoke
-
-Owner Quackerjack, reviewer Duckworth, gate owner Sage. Chained on R1 (Q177). The build starts now against
-R1's exported interface as the R1 manifest names it, and R5 lands after R1 and rebases onto R1's landing.
-
-`mosaic access list`, `grant` and `revoke`: human proof, atomic write, revision bump, a receipt line. The help
-text states the `instances` limit and the provider-removal order (DESIGN.md section 7, row R5). R4 later makes
-these verbs call `access.reload`, so R5 leaves no other reload path.
-
-Context (sage-1419). `ssoSubjects` is row 192's `console.sso.providers[].subjects` flattened to `{provider,
-sub}` pairs; the design's "`console.sso.subjects`" in 3.5 is shorthand for it. `providers` is the list of
-`providers[].id`, read through `loadSystem` and row 192's `checkConsole`. `peers` is `[]` until R2 lands, so a grant
-naming a peer home refuses. R5 rebases onto row 192's landing as well as R1's.
-
-Tests, in `packages/cli/tests/`: tester and agent callers are refused, a concurrent write refuses on a
-revision conflict, the receipt line is appended, and a bad grant is refused before anything is written. One
-mutant per refusal, each killed.
-
-Boundaries: no change to `~/.mosaic-dev`, `~/.config/mosaic-dev`, the live units or any live access.json. The
-human proof in tests uses the scratch stand-in pattern (a scratch bus verifies its own human-cli path).
-Single test files run freely, and suites need Sage's slot.
-
-Gate: Duckworth approves the manifest. The cli suite and every `scripts/test-*.sh` are green on Sage's gate,
-and the mutants are killed.
-
-## Brief: FED R2, the federation key in the system config
-
-Owner Quackerjack, reviewer Webby, gate owner Sage. Chained on row 192 (#412 phase 1). The build starts when
-row 192 has a candidate, on that candidate.
-
-A `federation` key in `scripts/mosaic-config.mjs` with the shape in DESIGN.md section 3. A config with no
-`federation` key still loads as it does today. This changes the config schema, so the manifest lists every
-reader of the key.
-
-Tests, in `scripts/test-config.sh`: a valid key loads, an unknown sub-key and a bad origin refuse, and a
-config without the key loads. One mutant per refusal, each killed.
-
-Boundaries: `~/.config/mosaic-dev/config.json` is user-authored and is not touched. Tests use scratch config
-dirs only.
-
-Gate: Webby approves the manifest. The cli suite and every `scripts/test-*.sh` are green on Sage's gate, and
-the mutants are killed.
-
-## Brief: FED R8, the hub window on 10.1.1.54
-
-A live window, not a code row (DESIGN.md section 7, row R8). The brief follows r4.11, b93f098f0 on
-`gizmoduck/federation-design` (sha256 1bcee8df0a3a8628a6646535b756c936ca6d9e7bcfa7e1dd2bf1d3f01715c8e6),
-which Duckworth acked with r4.10 (duckworth-0034). Mos closed design rounds there (mos-1072). Run by Jason and
-Mos. Nothing here authorizes a step on any host; each step waits for the window's go.
-
-What changed since r4.9 (DECISIONS Q182, Q183, mos-1055, mos-1063). R8 is a recorded acceptance. It starts
-with Jason's acceptance of the factory paths to .54 on record, quoted in section 8. The privilege and host
-checks still run, and each result goes into the R8 record with the name of whoever ran it. They report and
-don't refuse. The four functional checks named at the end of section 7's R8 row still stop R8 when they fail
-(mos-1066 item 1).
-
-Order (mos-1042 item 2). R8 runs after the Case 2 install on .54 (#416, due by 2026-10-27, Jason's latest-by
-date in Q176, mos-1069), after Bean and Chet are live in Case 2, and after both Hermes gateways on 10.1.1.54
-have stopped. Case 2 go-live doesn't wait on R8. The risk, stated for 10-27: federation between the two
-instances depends on Melanie's switch-over date.
-
-Entry checks, all before anything starts:
- R7, #412 phase 2 and Jason's #419 answer, as section 7 lists.
- The four hub user checks on 10.1.1.54 (N22, mos-1035 item 1): `sudo -l -U mosaic` grants nothing, `id
-  mosaic` shows only its own group, `~mosaic/.ssh/authorized_keys` is absent or empty, and no file under
-  `/etc/sudoers.d` names `mosaic`. An agent or Jason runs them as localadmin (mos-1055), and the output goes
-  into the R8 record with who ran them.
- The factory privilege checks, the key fingerprint comparison and the section 8 privilege path table, each
-  as section 7's R8 row states them.
-
-Build notes:
- N1 (Duckworth, duckworth-0034, mos-1072). A check that fails on a path Jason didn't name in Q182 or Q183 is
-  marked "not named in Q182 or Q183" in the record, not filed under the acceptance. Examples: a factory mount
-  of hub data, another agent on .54, a provider admin token. Mos takes each one to Jason.
- N2 (Duckworth, doc-only). The Q183 and Q4 quotes in section 8 are excerpts. When the R8 record quotes them,
-  it marks each omission with "…" and checks the full text at DECISIONS.md:1535-1541 in jason-master-restart
-  (read only).
-
-Done when every entry check has its output recorded, Jason signs in to the hub and sends one message, Melanie
-revokes, and his next request is refused.
@@ -1,81 +0,0 @@
-# Brief: a pre-push hook that refuses force-pushes, and a busy check that fails on BUSY (#426)
-
-Sage, 2026-10-20, for Mos's order mos-1078 (Vikunja P19 #426) and its go mos-1083 item 1. Owner Rocko,
-reviewer Dewey, gate owner Sage. Base: refactor at this brief's commit. Starts after row 191.
-
-## Why
-
-Morgana force-pushed a seat branch on 2026-10-20 (morgana-0016). Mos took it to Jason. Force-push is a
-Q173 exclusion, and canon says never force-push, but nothing mechanical stops one. Mos: "Done means a
-force-push from a seat worktree is refused, with a test that shows it."
-
-Earlier the same day, a busy check chained as `| tail -1 &&` passed while the slot was BUSY. The script it
-called prints BUSY or CLEAR, but it exits 0 either way.
-
-The guard has two layers:
- (a) Gitea protection with force-push off on seat branch patterns and on refactor, next and main. ops-01
-  sets it up, through Mos (mos-1082). That part isn't this row.
- (b) The client hook below. It can be bypassed with `--no-verify`, so (a) is the real guard and (b) is the
-  early refusal.
-
-## What ships
-
-1. `scripts/git-hooks/pre-push` (new). For each ref line git passes on stdin:
-   - It refuses when the remote sha isn't all zeros and isn't an ancestor of the local sha (`git
-     merge-base --is-ancestor`). The refusal names the ref and both shas, and the hook exits 1.
-   - A new branch passes. A delete (local sha all zeros) is refused.
-   - Any failure of the check refuses too, for example an unknown remote object. The hook fetches nothing.
-     If the remote tip isn't present locally, it refuses and says to fetch first.
-2. Install, following `scripts/queue-commit.sh --install-hook`. Either add a `--install-push-hook` there or
-   ship a small `scripts/install-git-hooks.sh`, whichever fits the existing code better. Say which in BUILD.md.
-   - The install copies the hook into the common `.git/hooks`, which every seat worktree shares.
-   - It refuses when `core.hooksPath` is set (the husky trap, 2026-10-09). It refuses when an installed
-     pre-push differs from the repository copy, unless `--force-install` is given.
-   - It never edits the installed copy in place.
-3. `scripts/slot-busy.sh` (new), the shared busy check.
-   - It prints one BUSY line per matching process, or CLEAR.
-   - It exits 0 on CLEAR, 1 on BUSY and 2 on its own error.
-   - It matches `node --test`, `gate.sh`, `mutant`, `scripts/test-*.sh` and `docker compose` command lines.
-     It skips its own process and shell snapshots.
-   - It reads `/proc/<pid>/cmdline` and the cwd link only, never file contents under another seat's
-     directory.
-   - Usage in `docs/TOOLS.md`: `bash scripts/slot-busy.sh > LOG && gate`, with `set -o pipefail` in any
-     script that pipes it. Never `| tail -1 &&`.
-
-## Tests
-
-Add them to `scripts/test-land-work.sh` or a new `scripts/test-git-guard.sh` (say which). Run against a scratch
-bare remote and a scratch clone with a worktree, never against origin:
- A rewritten branch pushed with `--force` from a worktree is refused, and the remote ref is unchanged.
- A `+refspec` push is refused.
- A fast-forward push passes.
- A new branch passes.
- A delete is refused.
- A remote tip that's missing locally is refused.
- The install refuses with `core.hooksPath` set, and refuses a differing installed hook.
- `slot-busy.sh` exits 1 with a fake `node --test` process running (a sleeping stand-in with that argv),
-  and 0 without one.
- `slot-busy.sh | tail -1 && false` doesn't apply here. The test runs `bash scripts/slot-busy.sh >/dev/null
-  && echo ran`, and asserts it doesn't print `ran` while BUSY.
-
-Mutants, each killed:
- drop the ancestor check
- treat an unknown remote object as passing
- let a delete pass
- install over a set `core.hooksPath`
- `slot-busy.sh` exits 0 on BUSY
-
-## Boundaries
-
- Install the hook in the canonical checkout only after landing, as its own step with Sage. Tests use
-  scratch repositories.
- No push to origin from a test. No change to Gitea config. That's ops-01's.
- Don't touch `~/.mosaic`, `~/.mosaic-dev` or `~/.config/mosaic-dev`.
-
-## Gate
-
-Dewey approves the manifest. The new or changed `scripts/test-*.sh` file and every other `scripts/test-*.sh`
-are green on Sage's gate, and the mutants are killed. Done when the hook is installed in the canonical
-checkout and a scripted force-push from a seat worktree to a scratch remote is refused there. ops-01's
-server proof (a refused force-push, plus a fast-forward push and a new branch that go through) is recorded
-in Vikunja #426 by Mos.
@@ -1,70 +0,0 @@
-# Brief: agent host access with sudo through the credential store (#424)
-
-Sage, 2026-10-20, for Jason's rulings Q183 and Q184 relayed by Mos (mos-1056 item 3, mos-1067). Gitea #1707, Vikunja P19
-#424, due 2026-10-27 (Q184: "Q5: by 10.27"). Owner Gizmoduck (design and build), reviewer Duckworth, gate owner
-Sage. Chained on row 199's candidate (Q177): row 199 design r6 (4d3007ec9 on `megavolt/row199`, approved in
-duckworth-0027) is not reopened. This row lands after 199 and rebases onto its landing.
-
-## What Jason asked for
-
-Q183, through Mos: "I envision a credential store within Mosaic Stack that works as some sort of variable for
-the agent to call. The system will enforce access to the credentials to keep the agents sandboxed with proper
-security... If we can utilize the credential store in Mosaic Stack and allow agents to perform their jobs with
-NOPASSWD sudo on various machines, I am a happy man." Q183 also says not every agent needs that access.
-
-Mos's requirements (mos-1067 item 1):
- An agent asks for a host credential by name.
- The stack checks a grant for that agent and that host, and does the ssh and sudo for it.
- The agent never sees the key or any secret value.
- Only agents with a grant can do it.
-
-The PRD text is REQ-CRED-3, drafted by Honker for PRD 1.7 (sage-1422). If it misses 1.7 it goes into 1.8, and
-this row lands only after the version that holds it is approved.
-
-## What row 199 gives and what it doesn't (megavolt-0019)
-
-It builds on 199 as 199 stands: the store layout under `<configDir>/secrets/agents/<business>/<agent>/`, the
-lifecycle verbs and their `changes.jsonl` receipts, `useFor(session, service, fn)` with the D5 allowlist test,
-`assertClean` on every result, and the grant shape of `publish` (a list on the role entry, checked by the
-broker, plus a hard-wait action that isn't routed).
-
-This row's own changes:
- A host kind in the closed kind set (vocabulary.mjs `SERVICES`, credentials.mjs, the broker's service check,
-  the CLI date flag, the remove regex), with a naming rule for one credential per host or per agent.
- A per-kind value check. An OpenSSH private key fails today's `TOKEN` pattern.
- Handing the key to ssh without the agent seeing it: an ssh-agent on a private socket, or a 0600 temp file
-  removed on every path, the way publish's one-shot helper works.
- Pinned host keys per host, and no trust on first use.
- The command boundary: what an agent may run under sudo, and how output returns without echoing the secret.
-  This is the main design work.
- The executor: a ticket and a host op running in the bus child, the same split row 199 uses for publish
-  (Megavolt's deviation in 199's BUILD.md).
-
-## Steps
-
-1. DESIGN.md first, in `agents/gizmoduck/work/queue-ROW/`. It answers each item above, names the grant shape
-   (`roles.<agent>.hosts` and a `host.sudo` action, or a reasoned alternative), says who grants (Jason, through
-   a reviewed role change, unless REQ-CRED-3 says otherwise), and lists tests and mutants. Duckworth approves it
-   before code. Sage reads it too, because it gives agents sudo on hosts.
-2. Build on 199's candidate. Single test files run freely. Suites and mutant batches need Sage's slot.
-3. The live part is not this row. Putting a key in the store and granting a host is a separate window with
-   Jason or Mos, after landing.
-
-## Hosts
-
-The first targets are `localadmin` with NOPASSWD sudo on 10.1.1.53 and 10.1.1.54 (#423 step 1, applied by
-ops-01 at 20:05:47Z), and the servers agents already reach as localadmin (Q172). ops-01 owns the host side.
-Tests use scratch sshd fixtures on 127.0.0.1 or fakes, never a real host.
-
-## Boundaries
-
- No change to `~/.mosaic-dev`, `~/.config/mosaic-dev`, slot files, the live units or `~/.mosaic`. No key is
-  read, copied or printed. No ssh to any real host from a test or a seat.
- No widening of row 199's kinds or regex inside row 199. Both rows touch them, so this row rebases after 199
-  lands.
-
-## Gate
-
-Duckworth approves DESIGN.md, then the manifest. The bus, business and cli suites and every
-`scripts/test-*.sh` are green on Sage's gate, and the mutants are killed (one per refusal, plus one that leaks
-the key into the agent's output and one that skips the host key pin).
@@ -1,66 +0,0 @@
-# Brief: the Case 1 install on 10.1.1.53 (row 195)
-
-Sage, 2026-10-20, third version, for Darkwing's rewrite request and sage-1439. Gitea #1693.
-
-Why it changed:
- The first two versions put Melanie's hub on its own Linux user, then on its own host, Jason's choice under
-  #419.
- Q181 settled the hosts: Case 1 (Jason's software factory) runs on 10.1.1.53 and Case 2 (Melanie's hub) on
-  10.1.1.54.
- Q182 and Q183 made the hub's privilege checks a recorded acceptance. They report and don't refuse
-  (federation R8, mos-1055, mos-1063, mos-1066).
- The Case 2 install on .54 is Gosalyn's C2-13 plus its window (#416, due by 2026-10-27). It is not this row.
-
-This row now installs Case 1 on .53. On the 10-27 MVP path (mos-0974, T1 item 1).
-
-Owner Darkwing (Opus 5.5), reviewer Duckworth, gate owner Sage. Chained on row 190's candidate (the config
-canon) and on C2-13's candidate (the install script), Q177. It reuses C2-13's `case2-install.sh`,
-`case2-precheck.sh` and `case2-unit.sh` by input, not by copy. A gap in them goes to Gosalyn as a C2-13
-change, or into this row's manifest as a named, reviewed change to those files. Design first:
-`agents/darkwing/work/queue-195/DESIGN.md`.
-
-## Goal
-
-Jason's software factory runs on 10.1.1.53 as `mosaic` under `/srv/mosaic`, in the same unit form as Case 2
-(design 9, Q181). It uses row 190's config canon and the model account the factory uses today (Q185,
-mos-1081 item 1). No new provider account.
-
-## Provision
-
- ops-01 runs the root steps over ssh as `localadmin`: `useradd mosaic`, `/srv/mosaic` and the unit through
-  `case2-unit.sh` from a root-owned checkout. #423 step 1 (localadmin with NOPASSWD sudo on .53 and .54) was
-  applied at 20:05:47Z (mos-1066, mos-1077), and nothing else in #423 gates this row.
- #423 step 4 (jarvis sudo) waits until Case 1 is live on .53.
- The host list comes from Q181. Agents may run read-only checks on .53 as `localadmin`.
-
-## The design must state
-
-1. The install as input values to C2-13's scripts: user, home, business file, roles, the human id, the
-   token slot path. Which commands run as `mosaic` through `sudo -u mosaic -H`, and which as root through
-   ops-01.
-2. Where Case 1 differs from Case 2: the factory roles in place of the library business, no library sync,
-   and any precheck item that doesn't apply, each with a reason.
-3. Model access through the existing factory account (Q185). Placing the credential on .53 is a step under
-   the Q173 secrets rule, done in the window. It is never copied by the script, and its value is never
-   printed.
-4. Re-pin, rollback and backup on .53, and who runs them.
-5. The acceptance checks, as code Duckworth can read. Each check names a path and gives it one of three
-   marks: closed, accepted under Q182 or Q183, or "not named in Q182 or Q183". An accepted path doesn't
-   fail the row. An unnamed one is reported to Mos, who takes it to Jason (the R8 N1 rule). The functional
-   checks fail the row when they fail: the unit runs as `mosaic`, the Console answers on its port on the
-   internal network only, and one tester message gets a reply.
-
-## Boundaries
-
- Infra and k3s changes, exposure outside the internal network, and spend stay Jason's (Q173 exclusions).
- No change to dragon-lin's `~/.mosaic-dev`, `~/.config/mosaic-dev`, its live units or `~/.mosaic`.
- No credential value is printed, logged or committed.
- Tests use scratch roots and stand-ins. Nothing in a test reaches .53.
- The run on .53 is a window with Jason's or Mos's go, a backup first where state exists, and a STATE report
-  after.
-
-## Gate
-
-Duckworth approves DESIGN.md, then the manifest. Any repository change is green on Sage's gate (cli suite and
-every `scripts/test-*.sh`), with the design's mutants killed. The row is done when the window's acceptance
-run passes on .53, Duckworth reads its output, and Mos confirms.
@@ -1,62 +0,0 @@
-# Brief: the human boundary across uids and humans (P19 333)
-
-Sage, 2026-10-20, for Mos's order mos-0989 (P19 333, MOSAICSTA-173, is now on the 10-27 path: federation R3 and
-row 193 need it). Gitea #1694. Owner Gander (Codex gpt-6.1-sol, a new builder seat under mos-0977 item 5),
-reviewer Duckworth, gate owner Sage. Latest-by: DESIGN.md approved by 2026-10-22, landed by 2026-10-24, and in
-any case before federation R3 lands. R3 and row 193 may chain on this row's candidate (Q177). Base: refactor at
-the brief commit. Design first. The first deliverable is `agents/gander/work/queue-ROW/DESIGN.md`.
-
-## The problem, as filed and as it now matters
-
-P19 333 as filed (row 87, mos-0657): the Console listens on a loopback TCP port, and any host process that
-reaches it, under any uid, acts as Jason. Jason accepted that as a documented limit for a one-user host
-(mos-0787, row 161). Two things change that:
-
- Row 190b (#1693, mos-0986) puts Melanie's hub under its own Linux user. Factory processes then sit on another
-  uid, on the same host, next to the hub's ports and socket. The other-uid reach is now the Case 2 threat.
- Federation r2 (gizmoduck-0004, 60b9b112a) binds a bus user only from a user-cli whose proof passes the human
-  walk, whose direct parent is the bus's own Console, and which holds a live grant. That rule rests on the
-  path-bound human proof (#225): today a same-uid process that runs the tree's `human-cli.mjs` acts as the
-  human, without touching the Console. The Q175 design (section 8) names that limit and leaves it here.
-
-## What already settles part of it
-
- Q175 phase 2 (#412) settles the Console-ingress part on the main port. Under `--sso`, 7332 answers any
-  non-public Host with 403 except `GET /healthz`, and every other request needs a verified OIDC session. A
-  process on another uid that reaches the port gets only `/healthz`. Phase 1 (row 192) builds it; it is live
-  only after the phase 2 window.
- Row 189 (`--no-send`) is interim only. Until phase 2 the Console takes no human writes, so the reach is
-  read-only. It settles nothing.
- Row 190b separates files and units by uid. Whether the hub's `broker.sock` refuses the factory uid depends on
-  its directory and socket modes, which this row checks and tests rather than assumes.
-
-## What the design must settle
-
-1. Inventory every listener and entry point per instance: the Console port, the tester listener (7333 today),
-   `broker.sock`, the human CLI wrapper, the Discord connector and anything row 190 adds. For each: who can
-   reach it today from the same uid and from another uid, with and without `--sso`.
-2. The tester listener. It serves reads and the row 175 tester writes to anything that reaches it, on any uid.
-   Close the other-uid reach (for example a unix socket with 0600 modes, or a peer-uid check on loopback), or
-   bring Mos a concrete reason it must stay open. bus.tester stays Jason's switch.
-3. The bus human boundary. How the bus tells the human's own verified call from a same-uid process that runs
-   `human-cli.mjs`. State what federation R3's direct-parent rule needs from the bus (peer credentials on
-   `broker.sock`, the parent check, how it can't be forged by a child of an agent), and what stays possible for
-   a same-uid process after this row. Say it plainly where a residual limit remains.
-4. Fit with row 193 (Morgana, human users and roles; Mos's B1 rule: a principal comes only from something the
-   bus verifies) and with federation R3. One mechanism, not three.
-5. Migration: the live single-user Console and bus keep working until each instance re-pins.
-6. Which parts of P19 333 this row closes, which parts Q175 phase 2 closes, and what P19 333 says when it is
-   closed.
-
-## Boundaries
-
- Who can reach the Console from outside stays Jason's. This row changes what a host process can do once it
-  reaches a local port or socket.
- No test touches `~/.mosaic-dev`, `~/.config/mosaic-dev`, the live units or a slot file. No test creates a real
-  second uid; use stand-ins as rows 190 and 190b do, and name any part only a Q173 window can prove.
- No request to the live 127.0.0.1:7332 or 7333, mosaic.woltje.com or auth.diversecanvas.com.
-
-## Gate
-
-Duckworth approves DESIGN.md, then the manifest. The bus, webui and cli suites and every `scripts/test-*.sh`
-are green on Sage's gate, and the design's mutants are killed.
@@ -1,70 +0,0 @@
-# Row 193 build rows: 193a, 193b1, 193b2, 193c and 193d (#1691)
-
-Sage, 2026-10-20, for Mos's go mos-1034 item 4. Row 193's design is Morgana's
-`agents/morgana/work/queue-193/DESIGN.md` at e2d161e2e on `morgana/row193` (r5, sha256
-dd7fcb419ed8510e9d8d74b569183386d0942af8b68eecc0bbb5e182e677b523), approved by Duckworth (duckworth-0018).
-Section 8 lists the tests and mutants, and section 9 the split. The brief behind them is
-`docs/plans/2026-10-20_human-users.md`. Vikunja P19 #414/#415, Gitea #1691.
-
-Owner Morgana for every row, reviewer Duckworth, gate owner Sage. Each row chains on its parent's candidate
-(Q177) and rebases onto the parent's landing. Seats push only their own `<seat>/*` branches (mos-0981).
-Single test files run freely, and suites and mutant batches need Sage's slot.
-
-Boundaries for every row: no change to `~/.mosaic-dev`, `~/.config/mosaic-dev`, the live units, slot files, any
-live access.json or `~/.mosaic`. No request to the live Console, mosaic.woltje.com or auth.diversecanvas.com.
-No user thread goes live before 193b1's message filter has landed (mos-1021 B2, FED R8).
-
-The owner-visible records are fixed by Mos (mos-1023 item 2) and named in one user sentence, which FED R6
-reuses word for word: "The business owner sees your thread's agent's decisions, inbox entries, claims, tasks
-and project files, but not your messages."
-
-## Brief: 193a, the access level check widened to viewer
-
-Chained on FED R1. Started early on `morgana/row193a` (508ee4d61) against R1's interface as the FED brief
-names it, with Sage's go (sage-1373). R1's level check accepts `viewer` and still refuses any other new
-level. Tests in `packages/business/tests/` (section 8, Business), with the four mutants in Morgana's
-BUILD.md. FED R4 chains on this row.
-
-Duckworth's N1 on R1 (duckworth-0033, sage-1417): with viewer added, `covers` called with no level would let a
-viewer grant cover a collaborator ask. This row makes `level` required in `covers`, with a test and a mutant that
-makes it optional again. R3 and R4 call `covers` with a level.
-
-Gate: Duckworth approves the manifest. The business suite and every `scripts/test-*.sh` are green on Sage's
-gate, and the mutants are killed.
-
-## Brief: 193b1, viewer verbs, board refusals and the message filter
-
-Chained on FED R3, FED R4 and row 196's verifier. The bus gets the viewer verb list, per-grant level
-checks, board reads refused to users, and the section 5.7 `trail` and `replies` filter with `#readable`
-owner-only. No schema change. The governance pin test names each item in the user sentence above. Bus tests
-and mutants 1, 3, 6, 10, 11 and 12 from section 8.
-
-Gate: Duckworth approves the manifest. The bus suite and every `scripts/test-*.sh` are green on Sage's gate,
-and the mutants are killed.
-
-## Brief: 193b2, thread shares (schema 3j)
-
-Chained on 193b1. `thread_shares`, the share verbs, the share rules of `#readable` and `#threadRead`, and the
-section 5.5 share filters. Schema 3i to 3j. The table is append-only, and row 181's restore guard and
-`COUNTED` include it. Bus tests for shares and the migration, and mutants 2, 4, 7, 8 and 9 from section 8.
-Going live needs a `--migrate` window with Jason. Sage takes it to Mos when this row is near.
-
-Gate: Duckworth approves the manifest. The bus suite, the cli suite and every `scripts/test-*.sh` are green on
-Sage's gate, and the mutants are killed.
-
-## Brief: 193c, mosaic access user verbs and --level viewer
-
-Chained on FED R5. `mosaic access user add/remove` and `grant --level viewer`, only where R5 lacks them. They
-refuse tester and agent callers, write a receipt line and call `access.reload` (section 8, CLI). If R5
-already has all of them, this row records that and closes with no code.
-
-Gate: Duckworth approves the manifest. The cli suite and every `scripts/test-*.sh` are green on Sage's gate,
-and the mutants are killed.
-
-## Brief: 193d, the Console's shared list, share controls and viewer read-only
-
-Chained on FED R6, row 192 and 193b2 (for share controls). A viewer has no composer or share control, and
-with each UI check removed the bus still refuses (section 8, Webui).
-
-Gate: Duckworth approves the manifest. The webui suite and every `scripts/test-*.sh` are green on Sage's
-gate, and the mutants are killed.
@@ -12,10 +12,8 @@ before any code, as Q175 did. Then the build follows the design, with tests and

 Two or more instances run side by side on dragon-lin. Each one has its own config file, data root (store,
 broker.sock, host.lock, state, runs, sessions, workspaces), businesses, bus unit, Console unit and port,
-tester port, Discord unit, Claude session env file, stack-active pointer and activation log. No instance's
-commands, units or tools address another instance's state by default or by mistake. On one uid this is
-addressing only, not a security boundary: a same-uid process can still read another instance's files.
-Isolation against that is row 190b (#1693, mos-0986), one Linux user per instance. The current instance keeps working unchanged: its
+tester port, Discord unit, Claude session env file, stack-active pointer and activation log. Nothing one
+instance does can read or change another's state. The current instance keeps working unchanged: its
 config path, data root, unit names and ports stay as they are, and no re-pin is needed for it.

 ## Known single-instance points (GAP-MAP.md, measured at 9ae8c73ac)
@@ -1,57 +0,0 @@
-# Brief: retire the control board writer on 7331
-
-Sage, 2026-10-20, for Mos's ruling mos-1008 item 2. Gitea #1696. MVP 10-27 work. Owner Bushroot (Haiku 5.5, a
-low-level model under Q177), reviewer Webby, gate owner Sage. Base: refactor at the brief commit.
-
-## Why
-
-`packages/control-board/src/serve.mjs` is a loopback HTTP service on 7331 with no authentication. It reads
-transcripts and writes through `/api/reply`. Any host process that reaches the port can do both. That fails
-Q175 ("zero trust with verification"). Gander found it in the row 196 inventory (gander-0004). Nothing listens
-on 7331 now (`ss -ltnp`, 2026-10-20T19:05:09Z), so retiring it costs the least.
-
-## Steps, in order
-
-1. Inventory first. List every reference to the control board and to 7331: scripts, units, `scripts/mosaic`
-   and other CLI dispatch, docs (AGENTS.md, READMEs, TOOLS.md), package.json scripts, tests, and the Console
-   (`packages/webui`). For each, say whether it starts the writer, reads its code, or only mentions it.
-   Commit the list as `agents/bushroot/work/queue-ROW/INVENTORY.md` and send it to Sage and Webby.
-2. Stop if something depends on it. If a reference shows a live dependency (the Console or another package
-   imports code that only the control board has, or a unit or script still starts it), stop. Sage takes it to
-   Mos before anything is removed.
-3. Otherwise retire the writer. Either remove the `serve` entry point, or make it refuse to start with a
-   message that points to the Console. Keep any read-only code another package imports, and say which.
-   Update the docs that tell people to start it. The AGENTS.md text about the control-board reply convention
-   is a separate matter. Change it only if it tells someone to start 7331.
-
-## Mos's call on the Console dependency (mos-1019)
-
-The inventory (004f133bd) found that the Console proxies `/api/board`, `/api/seen`, `/api/reply` and the
-conversation routes to `DEFAULT_BOARD` on 7331 (`packages/webui/src/serve.mjs:12`), so the board view returns
-502 today. Mos took Sage's recommendation: retire the 7331 listener and its README start commands, and have
-the Console call the board's read code in-process, behind the Console's own auth (Q175 SSO on 7332).
-`/api/reply` stays only under `--send`. The DESIGN.md for that change comes before code, and Webby approves
-it.
-
-## Acceptance
-
-Nothing in the stack can start a writer on 7331. A test proves it: the entry point refuses (or is gone), no
-script or unit starts it, and a grep check finds no starter. Each change gets a mutant that brings the writer
-back and the test kills it. Mos added three items (mos-1019):
-
- The board view answers from the Console with nothing listening on 7331.
- Every board route sits behind the Console's auth.
- A test proves `/api/reply` refuses without `--send`.
-
-Test fixtures that bind port 0 may stay if they only test the code in-process.
-
-## Boundaries
-
- No change to the live units, `~/.mosaic-dev`, `~/.config/mosaic-dev`, slot files or `~/.mosaic`.
- No request to any live port.
- Single test files run freely. Suites need Sage's slot.
-
-## Gate
-
-Webby approves INVENTORY.md, then DESIGN.md, then the manifest. The control-board and webui package suites, the cli suite and
-every `scripts/test-*.sh` are green on Sage's gate, and the mutants are killed.
@@ -1,42 +0,0 @@
-# Brief: a second gate lane, two full gates at once on dragon-lin
-
-Sage, 2026-10-20, for Mos's order mos-0977 item 6 ("put the design for a second gate lane on the list now")
-and the MVP push (mos-0974). Gitea #1695. Owner Herb (Codex gpt-6.1-sol, a new builder seat), reviewer
-Webby, gate owner Sage. Base: refactor at the brief commit. Design first. The first deliverable is
-`agents/herb/work/queue-ROW/DESIGN.md`.
-
-## Why
-
-Every full run shares one slot today. A full gate (cli suite plus every `scripts/test-*.sh`) takes about 13
-minutes or more, reviewers' runs and mutants take the same slot, and with eight or more seats building for
-10-27 the slot is the bottleneck. The slot exists because concurrent runs broke each other. The busy check is
-`agents/sage/work/gate-lane/busy-now.sh` (a copy of Sage's), and the gate is
-`agents/sage/work/gate-lane/gate-template.sh` (a copy of Sage's template). The host has 16 cores and 62 GB.
-
-## What the design must settle
-
-1. Every shared resource two concurrent runs can collide on, found from the code and tests, not guessed:
-   Docker compose project names and networks (`scripts/test-task.sh` and others), fixed TCP ports in tests,
-   unix socket paths and their 107-byte limit under TMPDIR, the sandbox's private `/tmp`, shared caches,
-   scratch and worktree paths, the queue lock, and any test that reads host-wide state (process lists,
-   `pgrep`, `/proc`). For each: how a lane gets its own copy, or why it is safe to share.
-2. Timing. Which tests have time limits that a doubled CPU load could break, measured, and what changes (a
-   bound, or a lane rule that keeps those suites apart).
-3. The lane mechanism: lane ids, a lock per lane that a run takes and releases even on a crash, the busy
-   check that reports per lane, and how a seat asks for a lane. Sage still grants it.
-4. The gate template takes a lane id and isolates everything from point 1 by it.
-5. Proof: two full gates on different candidates at once, three times, with zero cross-failures, plus the
-   wall time of each against a single-lane run. Any flake found is named with its cause.
-
-## Boundaries
-
- No change to the live units, `~/.mosaic-dev`, `~/.config/mosaic-dev` or slot files. The proof runs use
-  scratch roots only, and it needs Sage's grant of the whole slot while it runs.
- Test code changes that only isolate a resource are in scope. A change to what a test checks is not, and
-  goes to its owner.
- Docker networks and containers a run makes are removed by the run (trap), and nothing else is touched.
-
-## Gate
-
-Webby approves DESIGN.md, then the manifest. The cli suite and every `scripts/test-*.sh` are green on Sage's
-gate, both singly and in the two-lane proof.
@@ -1,39 +0,0 @@
-# Brief: stack-release.sh activates a Console with --sso (Q175 phase 2 prerequisite)
-
-Sage, 2026-10-20, for Launchpad's finding F3 on row 192 (launchpad-0001) and Q175 (#412). Gitea #1698. Owner
-Launchpad, reviewer Webby, gate owner Sage. Chained on row 192's candidate (Q177): it lands after row 192 and
-before the phase 2 window. Base: row 192's candidate.
-
-## Why
-
-The phase 2 window re-pins the Console to the phase 1 commit with `--sso --send --tester-port 7333`
-(`agents/sage/work/q175-sso/DESIGN.md`, section 5). `scripts/stack-release.sh` doesn't know `--sso` today.
-Its `proof_checks` (`:751`) requires `--public-host`, `--auth-header` and `--allow-user` whenever a proof pair is
-carried, and the pointer's Console flags still hold the forward-auth pair (`--auth-header X-authentik-username
--allow-user jason.woltje`) that `--sso` refuses to start with. So the window can't run through the script, and
-a hand-edited pointer is not an option.
-
-## What the row does
-
-1. `activate ID BUSINESS --sso` writes Console flags with `--sso` and without `--auth-header`, `--allow-user`
-   and any proof pair, and `--plan` names each flag it drops and carries, in the style of row 189's `send:`
-   line. The design names the full flag set the phase 2 Console starts with and checks it against row 192's
-   refusals.
-2. Before anything stops, the script refuses a target copy whose Console doesn't support `--sso`, and refuses
-   when the config's `console` key or its slot file fails the checks row 192's `--sso` start runs. It reads
-   neither value and only uses the same stat and shape checks.
-3. Rollback from an `--sso` pointer to a pre-phase-1 copy follows the design's phase 2 rollback order (remove
-   the `console` key first). The script refuses a rollback that would start a Console on a config it can't
-   read, and says which step comes first.
-4. `docs/TOOLS.md` gets the flag.
-
-## Boundaries
-
- No change to the live pointer, units, `~/.mosaic-dev` or `~/.config/mosaic-dev`. Tests use scratch roots
-  and seeded pointers, as rows 187 and 189 do.
- No request to the live Console, mosaic.woltje.com or auth.diversecanvas.com.
-
-## Gate
-
-Webby approves the manifest. The cli suite and every `scripts/test-*.sh` are green on Sage's gate, and the
-mutants are killed (one per refusal, and one that keeps `--auth-header` in the written flags).
@@ -33,7 +33,7 @@ Gaps found while working go to `docs/plans/DEFERRED.md`, not here.

 <!-- mosaic-queue:begin -->

-Generated from `docs/plans/queue.json` revision 2361 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.
+Generated from `docs/plans/queue.json` revision 2247 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.

 | # | Piece | Owner | Issues | State | After | Gate | Brief | Note |
 |---|---|---|---|---|---|---|---|---|
@@ -225,29 +225,9 @@ Generated from `docs/plans/queue.json` revision 2361 by `queue render`. Do not e
 | 186 | stack-release --plan: the backup line says what the run will do (P19 404, row 185 N1/N2) | darkwing; reviewers filbert | #1684 | done | — | Filbert approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the three brief mutants killed (sage) | `docs/plans/2026-10-20_plan-backup-line.md` § Brief: the activate plan's backup line says what the run will do | Landed 269134d8d (author Darkwing) on 3c5da3a91. Patch-id c97b9f6e25cd matches the r1 candidate (manifest 449e9121, Filbert approve 29419). Sage gate on b367f5730+patch 09:00:20Z-09:08:59Z: node 2681/0, scripts 422/0, queue 156, network removed; 3c5da3a91 adds only a SESSIONS line. Not live: the stack runs copy 490e2771d3d0. Follow-ups on P19 404: Filbert M6 gap, store-unclean reading. |
 | 187 | stack-release activate carries the row 178 proof pair (mos-0928 Part B A0) | darkwing; reviewers filbert | #1685 | done | 186 done | Filbert approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the brief mutants killed (sage) | `docs/plans/2026-10-20_activate-proof-pair.md` § Brief: activate carries the row 178 proof pair | Landed 9a71e4e80 (author Darkwing) on d17328a55; patch-id 6b57c47bc661 matches candidate 52a5ecc1d143 and Filbert's r1 reading. Sage gate passed 10:21:55Z: cli 446/446 and every package and scripts/test-*.sh green. Filbert approve 29424, rev 2204; follow-ups N1-N4 filed on P19. |
 | 188 | stack-release tests: a carried proof pair and a proof file inside the repository (P19 409, 410; gates Part B) | darkwing; reviewers filbert | #1686 | done | 187 settled | Filbert approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the brief mutants killed (sage) | `docs/plans/2026-10-20_proof-test-gaps.md` § Brief: tests for the two proof-file paths row 187 left open | Landed 8fc0ee216 (author Darkwing) on 23a609c5c; patch-id c9a56b167c07 matches candidate 86aa549bad75 and Filbert's r1 reading; stack-release.sh blob 2586a2a37cd2 unchanged. Sage gate passed 10:58Z: cli 453/453 and every package and scripts/test-*.sh green. Filbert approve 29433, rev 2212; N1 (REPO logical path) to P19 after Part B (mos-0959). |
-| 189 | stack-release activate --no-send drops the Console's --send and keeps the pointer in step (Q175 interim, mos-0972, P19 413) | sage; reviewers dewey | #1687 | done | 163 done | Dewey approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the brief mutants killed (sage) | `docs/plans/2026-10-20_activate-no-send.md` § Brief: activate --no-send drops the Console's --send | Landed ace27dc5e on refactor (cherry-pick of candidate d6116771f onto a4a42dbac). Gate GATE_PASSED on 0c177e9ef (base 0217b71c8), 2026-10-20T19:09:37Z-19:20:36Z, 25 suites rc=0. patch-id ce89378718f6 for both 0c177e9ef and ace27dc5e; range-diff differs only in the message. Landed manifest hashes to 67af69bd (Dewey approve 29485). Base drift 0217b71c8..a4a42dbac: 7 doc/README files, none on manifest paths, no test reads them. Brief re-pinned to blob 29a9e6d2d. |
-| 190 | several Mosaic Stack instances on one host: per-instance config, data root, units and ports (MVP T1.1, mos-0974, Vikunja #414) | darkwing; reviewers filbert | #1688 | in-review, round 1, request posted | — | Filbert approves DESIGN.md then the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the design mutants killed (sage) | `docs/plans/2026-10-20_multi-instance.md` § Brief: several Mosaic Stack instances on one host | — |
+| 189 | stack-release activate --no-send drops the Console's --send and keeps the pointer in step (Q175 interim, mos-0972, P19 413) | sage; reviewers dewey | #1687 | in-review, round 1, request posted | 163 done | Dewey approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the brief mutants killed (sage) | `docs/plans/2026-10-20_activate-no-send.md` § Brief: activate --no-send drops the Console's --send | — |
+| 190 | several Mosaic Stack instances on one host: per-instance config, data root, units and ports (MVP T1.1, mos-0974, Vikunja #414) | darkwing; reviewers filbert | #1688 | in-progress | — | Filbert approves DESIGN.md then the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the design mutants killed (sage) | `docs/plans/2026-10-20_multi-instance.md` § Brief: several Mosaic Stack instances on one host | — |
 | 191 | one kill switch for the bus, every run, Discord and new launches, from the CLI and the Console (MVP T1.4, mos-0974, Vikunja #414) | rocko; reviewers dewey | #1689 | in-progress | — | Dewey approves DESIGN.md then the manifest; cli, bus, discord and webui suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_kill-switch.md` § Brief: one kill switch for the bus, every run, Discord and new launches | — |
-| 192 | Q175 phase 1: the Console verifies SSO itself (--sso), OIDC RP with oauth4webapi 3.8.8, no live change (MVP T1.2, #412) | launchpad; reviewers webby | #1690 | in-review, round 2, request posted | — | Webby approves the manifest; webui and cli suites, scripts/test-config.sh and every scripts/test-*.sh green on Sage's gate; design section 9 mutants killed (sage) | `docs/plans/2026-10-20_sso-phase1.md` § Brief: Q175 phase 1, the Console verifies SSO itself (--sso) | — |
-| 193 | many humans per business, human roles, private and shared threads, one access.json store (MVP T1.3, Vikunja #414/#415) | morgana; reviewers duckworth | #1691 | in-progress | — | Duckworth approves DESIGN.md then the manifest; bus, business, cli and webui suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users.md` § Brief: many humans per business, human roles, private and shared threads | — |
-| 194 | agent lifecycle from the Console and the CLI (create, launch, terminate, regenerate, delete) with a per-agent hire/fire veto (MVP T1.5, Vikunja #414/#415) | honker; reviewers webby | #1692 | in-progress | — | Webby approves DESIGN.md then the manifest; bus, cli, business and webui suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_agent-lifecycle.md` § Brief: agent lifecycle from the Console and the CLI, with a per-agent hire/fire veto | — |
-| 195 | row 195: the Case 1 install on 10.1.1.53 as mosaic under /srv/mosaic, reusing C2-13's scripts by input under row 190's canon (Q181, Q182/Q183, Q185; ops-01 root steps under #423 step 1) | darkwing; reviewers duckworth | #1693 | briefed | 190 done | Duckworth approves DESIGN.md then the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_hub-own-uid.md` § Brief: the Case 1 install on 10.1.1.53 (row 195) | sage-1439: rewritten to Case 1 on .53 (f24f2cd40). Chains on C2-13's candidate too once C2-13 is queued. Darkwing starts DESIGN.md after row 190's mutants. |
-| 196 | the human boundary across uids and humans: Console, tester listener, broker.sock and the path-bound human proof (P19 333, before federation R3, mos-0989) | gander; reviewers duckworth | #1694 | in-progress | — | Duckworth approves DESIGN.md then the manifest; bus, webui and cli suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-boundary.md` § Brief: the human boundary across uids and humans (P19 333) | — |
-| 197 | a second gate lane: two full gates at once on dragon-lin, design first (mos-0977 item 6) | herb; reviewers webby | #1695 | in-progress | — | Webby approves DESIGN.md then the manifest; cli suite and every scripts/test-*.sh green on Sage's gate, singly and in the two-lane proof (sage) | `docs/plans/2026-10-20_second-gate-lane.md` § Brief: a second gate lane, two full gates at once on dragon-lin | Order with row 198 (Sage, mos-1040 N1): 197 lands first. After B1 the shared tests are packages/webui/tests/serve.test.mjs:100 and preview.test.mjs:208. Row 198 rebases onto 197's landing before its manifest review. |
-| 198 | retire the control board writer on 7331 (unauthenticated loopback writer, Q175; mos-1008) | bushroot; reviewers webby | #1696 | in-progress | 192 done, 197 done | Webby approves INVENTORY.md then the manifest; control-board, webui and cli suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_retire-control-board.md` § Brief: retire the control board writer on 7331 | Order with row 197 (Sage, mos-1040 N1): 197 lands first. Row 198 rebases onto 197's landing before its manifest review; shared tests are packages/webui/tests/serve.test.mjs:100 and preview.test.mjs:208. |
-| 199 | MVP T1 item 6: a credential store per agent, own git identity, pushes to a remote (G11, G13; mos-0974) | megavolt; reviewers duckworth | #1697 | in-progress | — | Duckworth approves DESIGN.md; Mos rules on the authority model; Duckworth approves the manifest; bus, business, cli and tasks suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_agent-credentials.md` § Brief: a credential store per agent, own git identity, pushes to a remote | — |
-| 200 | stack-release.sh activate --sso for the Q175 phase 2 window (row 192 F3; chained on 192) | launchpad; reviewers webby | #1698 | in-review, round 2, request posted | — | Webby approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_stack-release-sso.md` § Brief: stack-release.sh activates a Console with --sso (Q175 phase 2 prerequisite) | — |
-| 201 | FED R1: access.json loader and validator, and covers (#414) | gizmoduck; reviewers duckworth | #1699 | in-review, round 1, request posted | — | Duckworth approves the manifest; business suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_federation-r1-r2-r5.md` § Brief: FED R1, the access.json loader and validator | — |
-| 202 | FED R5: mosaic access list, grant and revoke (#414) | quackerjack; reviewers duckworth | #1700 | in-review, round 1, request posted | — | Duckworth approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_federation-r1-r2-r5.md` § Brief: FED R5, mosaic access list, grant and revoke | Chained on row 201's candidate (Q177), not its done: claimable now, lands after 201 and rebases onto its landing (Sage) |
-| 203 | FED R2: the federation key in the system config (#414) | quackerjack; reviewers webby | #1701 | briefed | — | Webby approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_federation-r1-r2-r5.md` § Brief: FED R2, the federation key in the system config | Chained on row 192's candidate (Q177): starts on 192's candidate, lands after 192 (Sage) |
-| 204 | 193a: access level check widened to viewer (#1691) | morgana; reviewers duckworth | #1702 | in-review, round 1, request posted | — | Duckworth approves the manifest; business suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193a, the access level check widened to viewer | Chained on row 201's candidate (Q177), not its done: claimable now, lands after 201 and rebases onto its landing (Sage) |
-| 205 | 193b1: viewer verbs, board refusals and the message filter (#1691; also after FED R3 and R4 when filed) | morgana; reviewers duckworth | #1703 | queued | 196 done | Duckworth approves the manifest; bus suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193b1, viewer verbs, board refusals and the message filter | — |
-| 206 | 193b2: thread shares, schema 3j (#1691; live needs a --migrate window with Jason) | morgana; reviewers duckworth | #1704 | queued | 205 done | Duckworth approves the manifest; bus suite, cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193b2, thread shares (schema 3j) | — |
-| 207 | 193c: mosaic access user verbs and --level viewer (#1691) | morgana; reviewers duckworth | #1705 | queued | 202 done | Duckworth approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193c, mosaic access user verbs and --level viewer | — |
-| 208 | 193d: Console shared list, share controls and viewer read-only (#1691; also after FED R6 when filed) | morgana; reviewers duckworth | #1706 | queued | 192 done, 206 done | Duckworth approves the manifest; webui suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193d, the Console's shared list, share controls and viewer read-only | — |
-| 209 | FED R8: the hub window on 10.1.1.54, a recorded acceptance (#414, r4.11 b93f098f0; live window run by Jason and Mos, after the Case 2 install #416, Bean and Chet live and both Hermes gateways stopped) | sage; reviewers duckworth | — | queued | — | Every entry check's output is in the R8 record with who ran it; Jason signs in to the hub and sends one message, Melanie revokes, his next request is refused; Duckworth checks the record (sage) | `docs/plans/2026-10-20_federation-r1-r2-r5.md` § Brief: FED R8, the hub window on 10.1.1.54 | Stays queued until its entry gates near: Case 2 install on .54 (#416, by 2026-10-27), Bean and Chet live, both Hermes gateways on .54 stopped, R7, #412 phase 2, #419 answer. Filed per mos-1073 after duckworth-0034 (Sage) |
-| 210 | Agent host access with sudo through the credential store: grant per agent and host, the stack does ssh and sudo, the agent never sees the key (#1707, Vikunja #424, Q183/Q184, due 10-27; chained on row 199's candidate) | gizmoduck; reviewers duckworth | #1707 | in-progress | — | Duckworth approves DESIGN.md, then the manifest; bus, business, cli suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_host-credentials.md` § Brief: agent host access with sudo through the credential store (#424) | Design runs before 199 lands (Q177 chain on 199's candidate). after cleared so Gizmoduck can claim; lands only after 199 and rebases onto it. |
-| 211 | Force-push guard: scripts/git-hooks/pre-push refuses non-fast-forward and delete pushes from every worktree, and scripts/slot-busy.sh exits 1 on BUSY (#1709, Vikunja #426, mos-1078/1083) | rocko; reviewers dewey | #1709 | briefed | — | Dewey approves the manifest; the new or changed scripts/test-*.sh and every other scripts/test-*.sh green on Sage's gate; the mutants killed; hook installed in the canonical checkout with a scripted refused force-push (sage) | `docs/plans/2026-10-20_force-push-guard.md` § Brief: a pre-push hook that refuses force-pushes, and a busy check that fails on BUSY (#426) | — |

 <!-- mosaic-queue:end -->

@@ -9,7 +9,8 @@
      "version": "0.0.3",
      "license": "UNLICENSED",
      "dependencies": {
-        "@earendil-works/pi-coding-agent": "0.85.1"
+        "@earendil-works/pi-coding-agent": "0.85.1",
+        "oauth4webapi": "3.8.8"
      }
    },
    "node_modules/@anthropic-ai/sdk": {
@@ -1933,6 +1934,15 @@
        "url": "https://opencollective.com/node-fetch"
      }
    },
+    "node_modules/oauth4webapi": {
+      "version": "3.8.8",
+      "resolved": "https://registry.npmjs.org/oauth4webapi/-/oauth4webapi-3.8.8.tgz",
+      "integrity": "sha512-8N28E+a/oxfXWBgOMt+ZP/JUf/XR+IFbvkAEPP3gznXOMv9BpAAwiIj0TFNz3tGTPc0ZQ8zmWBNgN1nAys0gng==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/panva"
+      }
+    },
    "node_modules/openai": {
      "version": "6.40.0",
      "resolved": "https://registry.npmjs.org/openai/-/openai-6.40.0.tgz",
@@ -5,6 +5,7 @@
  "description": "Minimal Mosaic Stack container proof of concept: one Pi agent, four local contract files, one real model request returning MOSAIC_HELLO_OK.",
  "license": "UNLICENSED",
  "dependencies": {
-    "@earendil-works/pi-coding-agent": "0.85.1"
+    "@earendil-works/pi-coding-agent": "0.85.1",
+    "oauth4webapi": "3.8.8"
  }
 }
@@ -34,7 +34,7 @@ export function setup(t, realPin=false){
 test('shared copy: npm ci, pushed reachability, readonly/existing copy, webui delegation',t=>{
 const s=setup(t),r=s.run('stack-copy.sh',['copy',s.id,'--copies',s.copies]);assert.equal(r.status,0,r.stderr);
 const copy=join(s.copies,s.id);assert.equal(statSync(copy).mode&0o777,0o555);
- for(const f of ['scripts/mosaic','adapters/pi/adapter.sh','packages/queue/src/cli.mjs','package.json','package-lock.json','packages/tasks/requirements.json','packages/project/src/index.mjs','packages/library/src/index.mjs','packages/project/schemas/project.schema.json','packages/project/templates/north-star.md','packages/plugins/src/kinds.mjs','packages/plugins/src/loader.mjs'])assert.ok(existsSync(join(copy,f)),f);
+ for(const f of ['scripts/mosaic','adapters/pi/adapter.sh','packages/queue/src/cli.mjs','package.json','package-lock.json','packages/tasks/requirements.json','packages/project/src/index.mjs','packages/project/schemas/project.schema.json','packages/project/templates/north-star.md','packages/plugins/src/kinds.mjs','packages/plugins/src/loader.mjs'])assert.ok(existsSync(join(copy,f)),f);
 const npm=join(s.bin,'npm');writeFileSync(npm,'#!/bin/sh\nexit 99\n');chmodSync(npm,0o755);
 const existing=s.run('webui-service.sh',['copy',s.id,'--copies',s.copies]);assert.equal(existing.status,0);assert.equal(existing.stdout,`exists: ${copy}\n`);unlinkSync(npm);
 git(s.repo,'update-ref','refs/remotes/origin/refactor',git(s.repo,'hash-object','-w','package.json'));
@@ -381,7 +381,7 @@ async function seed(e,{copy=B,pm=false,store='3g',pointer:how='adopt'}={}){
 const rolledBack=(code,to=B)=>`stack-release: ${code}; rolled back to ${to}, which passed the gate\n`;
 const planBackup=(e)=>`backup: the run backs up the stopped store to ${e.data}/backups/stack/<activation>/ before any migration`;
 const planNoBackup='backup: none; the run rolls back before the backup';
-const planTail=(e,to,pm=false)=>[`bus: scripts/bus-service.sh install --copy ${to} --copies ${COPIES}${pm?' --pm':''} --claude ${e.claude}`,'proof: off','send: off',`Console: scripts/webui-service.sh install --copy ${to} --copies ${COPIES} --port ${e.port} --business acme`,`CLI: scripts/stack-copy.sh wrapper ${to} --copies ${COPIES} --bin ${e.bin}`];
+const planTail=(e,to,pm=false)=>[`bus: scripts/bus-service.sh install --copy ${to} --copies ${COPIES}${pm?' --pm':''} --claude ${e.claude}`,'proof: off',`Console: scripts/webui-service.sh install --copy ${to} --copies ${COPIES} --port ${e.port} --business acme`,`CLI: scripts/stack-copy.sh wrapper ${to} --copies ${COPIES} --bin ${e.bin}`];

 // --- The T table ---

@@ -1030,17 +1030,17 @@ test('T36 --plan shows the pending state and lists the row 169 refusals it can s
  return r.out.split('\n');
 };
 let out=await quiet(0,'activate',C1,'acme','--pm-after-harness','--plan');
- assert.deepEqual(out.slice(-7),['pm: the bus starts without --pm and the PM stays pending; next: Jason\'s plugins set of harness, then pm-on',...planTail(e,C1),'']);
+ assert.deepEqual(out.slice(-6),['pm: the bus starts without --pm and the PM stays pending; next: Jason\'s plugins set of harness, then pm-on',...planTail(e,C1),'']);
 biz(e,HARNESS);
 out=await quiet(3,'activate',A,'acme','--pm-after-harness','--plan');
- assert.deepEqual(out.slice(-8),['pm: the bus starts without --pm and the PM stays pending; next: Jason\'s plugins set of harness, then pm-on',...planTail(e,A),`refuses unknown-kind-for-target: the business file names plug-in kind(s) harness, which ${A} does not know`,'']);
+ assert.deepEqual(out.slice(-7),['pm: the bus starts without --pm and the PM stays pending; next: Jason\'s plugins set of harness, then pm-on',...planTail(e,A),`refuses unknown-kind-for-target: the business file names plug-in kind(s) harness, which ${A} does not know`,'']);
 out=await quiet(3,'activate',C1,'acme','--pm-after-harness','--plan');
 assert.equal(out.at(-2),'refuses pm-after-harness-set: the business file already sets harness ["claude-code"]; use --pm');
 biz(e);assert.equal((await run(e,'activate',C1,'acme','--pm-after-harness')).code,0);
 out=await quiet(3,'activate',C,'acme','--plan');
- assert.deepEqual(out.slice(-8),['pm: the pointer is pending (activate --pm-after-harness); the bus runs without its PM',...planTail(e,C,true),`refuses pm-pending: ${PENDING_MSG}`,'']);
+ assert.deepEqual(out.slice(-7),['pm: the pointer is pending (activate --pm-after-harness); the bus runs without its PM',...planTail(e,C,true),`refuses pm-pending: ${PENDING_MSG}`,'']);
 out=await quiet(0,'rollback','acme','--plan');
- assert.deepEqual(out.slice(-7),['pm: the pointer is pending (activate --pm-after-harness); the bus runs without its PM',...planTail(e,B,true),'']);
+ assert.deepEqual(out.slice(-6),['pm: the pointer is pending (activate --pm-after-harness); the bus runs without its PM',...planTail(e,B,true),'']);
 });

 // Row 176 test 11: supported and older Console copies deliberately differ from the checkout.
@@ -1706,113 +1706,6 @@ test('T54 row 188: a carried pair gets the proof file checks, and a proof file i
 });
 });

-// Row 189 (#1687, mos-0972/0973): activate --no-send drops the pointer's --send; nothing turns it back on.
-const sendLines=(out)=>out.filter((l)=>l.startsWith('send:'));
-const noSend=(c)=>c.filter((x)=>x!=='--send');
-const LIVE_NOTE=`note: ${B} is the pointer's copy; the run re-pins it and only the Console flags change`;
-test('T55 row 189: activate --no-send drops --send, and rollback and pm-on carry it off',async(t)=>{
- await t.test('test 1: a live-copy --no-send drops --send from the pointer and the unit, keeps the rest in order, logs the step and backs up the stopped store',async(t)=>{
-  const e=await mk(t),base=await seedPreview(e,undefined,['--send','--tester-port','7333']),want=noSend(base);
-  assert.deepEqual(want.slice(-2),['--tester-port','7333']);
-  const sum=createHash('sha256').update(readFileSync(e.store)).digest('hex'),n=calls(e).length;
-  let r=await prun(e,'activate',B,'acme','--no-send');assert.equal(r.code,0,r.out+r.err);
-  assert.equal(pointer(e).copy,B);assert.deepEqual(pointer(e).console,want);
-  assert.ok(conExec(e).endsWith(` --checkout ${repo} ${want.join(' ')}`),conExec(e));assert.doesNotMatch(conExec(e),/ --send( |$)/);
-  r=await prun(e,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
-  assert.match(stepText(e),/Z drop --send; --no-send was given\n/);
-  const act=pointer(e).activation,l=logLines(e).at(-1);
-  assert.deepEqual([l.op,l.from,l.to,l.result,l.backup],['activate',B,B,'ok',act]);assert.equal(backupSum(e,act),sum);
-  assert.deepEqual(startsStops(e,n),[`stop ${CON}`,`stop ${BUS}`,`start ${BUS}`,`start ${CON}`]);
-  await noLeak(e);
- });
- await t.test('test 2: a plain live-copy activate still refuses already-active, and so does --no-send once --send is gone',async(t)=>{
-  const e=await mk(t);await seedPreview(e,undefined,['--send']);
-  await refused(e,['activate',B,'acme'],'already-active',`${B} is the pointer's copy`);
-  await refused(e,['activate',B,'acme','--tester-port','7333'],'already-active',`${B} is the pointer's copy`);
-  await refused(e,['activate',B,'acme','--no-proof'],'already-active',`${B} is the pointer's copy`);
-  const r=await prun(e,'activate',B,'acme','--no-send');assert.equal(r.code,0,r.out+r.err);
-  await refused(e,['activate',B,'acme','--no-send'],'already-active',`${B} is the pointer's copy`);
-  const g=await mk(t);await seedPreview(g);
-  await refused(g,['activate',B,'acme','--no-send'],'already-active',`${B} is the pointer's copy`);
-  for(const x of [e,g])await noLeak(x);
- });
- await t.test('test 3: --plan prints one send: line in each case, with the live-copy note on a same-copy run',async(t)=>{
-  const e=await mk(t),base=await seedPreview(e,undefined,['--send']);
-  let out=await planOnly(e,0,'activate',B,'acme','--no-send');
-  assert.deepEqual(sendLines(out),['send: dropped; --no-send was given']);
-  assert.deepEqual(out.filter((l)=>l.startsWith('note: ')),[LIVE_NOTE]);
-  assert.equal(out[out.indexOf('send: dropped; --no-send was given')+1],`Console: scripts/webui-service.sh install --copy ${B} --copies ${COPIES} ${noSend(base).join(' ')}`);
-  out=await planOnly(e,0,'activate',C1,'acme');
-  assert.deepEqual(sendLines(out),['send: carried']);assert.deepEqual(out.filter((l)=>l.startsWith('note: ')),[]);
-  assert.ok(out.find((l)=>l.startsWith('Console: ')).endsWith(' --send'));
-  assert.deepEqual(sendLines(await planOnly(e,0,'activate',C1,'acme','--no-send')),['send: dropped; --no-send was given']);
-  let r=await prun(e,'activate',C1,'acme','--no-send');assert.equal(r.code,0,r.out+r.err);
-  assert.deepEqual(pointer(e).console,noSend(base));assert.match(stepText(e),/Z drop --send; --no-send was given\n/);
-  assert.deepEqual(sendLines(await planOnly(e,0,'activate',B,'acme','--no-send')),['send: off; --no-send was given and the pointer holds no --send']);
-  assert.deepEqual(sendLines(await planOnly(e,0,'activate',B,'acme')),['send: off']);
-  assert.deepEqual(sendLines(await planOnly(e,0,'rollback','acme')),['send: off']);
-  r=await prun(e,'activate',B,'acme','--no-send');assert.equal(r.code,0,r.out+r.err);
-  assert.match(stepText(e),/Z --no-send was given and the pointer holds no --send, so there is nothing to drop\n/);
-  assert.doesNotMatch(stepText(e),/drop --send/);
-  await noLeak(e);
- });
- await t.test('test 4: after --no-send, a rollback to the earlier copy leaves --send out of the pointer and the unit',async(t)=>{
-  const e=await mk(t),base=await seedPreview(e,undefined,['--send']);
-  let r=await prun(e,'activate',C1,'acme','--no-send');assert.equal(r.code,0,r.out+r.err);
-  r=await prun(e,'rollback','acme');assert.equal(r.code,0,r.out+r.err);
-  assert.equal(pointer(e).copy,B);assert.deepEqual(pointer(e).console,noSend(base));assert.doesNotMatch(conExec(e),/ --send( |$)/);
-  assert.doesNotMatch(stepText(e),/--send/);
-  r=await prun(e,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
-  await noLeak(e);
- });
- await t.test('test 4: pm-on after --no-send keeps --send off',async(t)=>{
-  const e=await mk(t),base=await seedPreview(e,{pm:true},['--send']);
-  let r=await prun(e,'activate',C1,'acme','--pm-after-harness','--no-send');assert.equal(r.code,0,r.out+r.err);
-  biz(e,HARNESS);
-  r=await prun(e,'pm-on','acme');assert.equal(r.code,0,r.out+r.err);
-  assert.equal(pointer(e).pm,true);assert.deepEqual(pointer(e).console,noSend(base));assert.doesNotMatch(conExec(e),/ --send( |$)/);
-  r=await prun(e,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
-  await noLeak(e);
- });
- await t.test('test 5: --no-send on rollback, pm-on, status, adopt or rehearse is a usage error',async(t)=>{
-  const e=await mk(t);await seedPreview(e,undefined,['--send']);
-  const usageText=(await prun(e,'--help')).err,n=calls(e).length,logs=logLines(e).length,before=fp(e);
-  for(const args of [['rollback','acme','--no-send'],['rollback','acme','--plan','--no-send'],['pm-on','acme','--no-send'],['status','acme','--no-send'],['adopt','acme','--no-send'],
-   ['rehearse','acme','--backup','/tmp/x','--port','7400','--no-send']]){
-   const r=await prun(e,...args);assert.equal(r.code,4,args.join(' '));assert.equal(r.out,'');assert.equal(r.err,usageText);
-  }
-  assert.match(usageText,/\| --no-proof\] \[--no-send\]/);
-  assert.deepEqual(fp(e),before);assert.deepEqual(startsStops(e,n),[]);assert.equal(logLines(e).length,logs);
-  await noLeak(e);
- });
- await t.test('test 6: with both a pair and --send in the pointer, --no-send and --no-proof each drop what they name and keep the rest',async(t)=>{
-  const e=await mk(t),base=await seedPreview(e,undefined,['--send']),pre=noSend(base),f=await proofFile(e),g=await proofFile(e,'proof2.189',0o400);
-  let r=await prun(e,'activate',B,'acme',...pair(f));assert.equal(r.code,0,r.out+r.err);
-  assert.deepEqual(pointer(e).console,[...pre,...pair(f),'--send']);
-  let out=await planOnly(e,0,'activate',C1,'acme','--no-proof');
-  assert.deepEqual([...proofLines(out),...sendLines(out)],['proof: dropped; --no-proof drops header x-console-proof','send: carried']);
-  out=await planOnly(e,0,'activate',C1,'acme','--no-send');
-  assert.deepEqual([...proofLines(out),...sendLines(out)],['proof: carried, header x-console-proof','send: dropped; --no-send was given']);
-  out=await planOnly(e,0,'activate',B,'acme','--no-send','--no-proof');
-  assert.deepEqual([...proofLines(out),...sendLines(out)],['proof: dropped; --no-proof drops header x-console-proof','send: dropped; --no-send was given']);
-  r=await prun(e,'activate',C1,'acme','--no-send');assert.equal(r.code,0,r.out+r.err);
-  assert.deepEqual(pointer(e).console,[...pre,...pair(f)]);
-  r=await prun(e,'activate',C1,'acme','--no-send',...pair(g,'X-Proof-Two'));assert.equal(r.code,0,r.out+r.err);
-  assert.deepEqual(pointer(e).console,[...pre,...pair(g,'X-Proof-Two')]);
-  r=await prun(e,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
-  const h=await mk(t),hbase=await seedPreview(h,undefined,['--send']),hpre=noSend(hbase),k=await proofFile(h);
-  r=await prun(h,'activate',B,'acme',...pair(k));assert.equal(r.code,0,r.out+r.err);
-  r=await prun(h,'activate',C1,'acme','--no-proof');assert.equal(r.code,0,r.out+r.err);
-  assert.deepEqual(pointer(h).console,[...hpre,'--send']);
-  r=await prun(h,'activate',C1,'acme','--no-send','--no-proof');assert.equal(r.code,0,r.out+r.err);
-  assert.deepEqual(pointer(h).console,hpre);assert.doesNotMatch(conExec(h),/--proof-| --send( |$)/);
-  const steps=stepText(h);
-  assert.match(steps,/Z --no-proof was given and the pointer holds no proof pair, so there is nothing to drop\n/);assert.match(steps,/Z drop --send; --no-send was given\n/);
-  r=await prun(h,'status','acme');assert.equal(r.code,0,r.err);assert.match(r.out,/unit flags: match the pointer/);
-  for(const x of [e,h])await noLeak(x);
- });
-});
-
 // --- rehearse (D2, row 163; the brief's "Stack rehearsal on a scratch root") ---
 // Copies of their own in RCOPIES: the real scripts/mosaic, config loader, business loader, roles and
 // mosaic-config.mjs, with stand-ins for the bus host (cli.mjs), the Console, the Store and
@@ -1,128 +0,0 @@
-# packages/library
-
-Reads a writing repo by a mapping of folders to books, types, canon and playground. This is Case 2
-row C2-01 (`docs/plans/2026-10-20_case2-rows.md`), built from design sections 1.1 to 1.3 and 7.4 in
-`agents/gosalyn/work/case2/DESIGN.md` on `gosalyn/case2-design`.
-It is pure code with no state. Business file loading (C2-04), sync (C2-03a), the index (C2-05a) and the
-guard (C2-06) build on it.
-
-## Mapping
-
-`checkMapping(entry, where, { fail })` checks a `kind: "library"` project entry and returns a
-deep-frozen copy. `where` names the entry in messages. `fail(code, message)` defaults to throwing a
-`LibraryError`. C2-04 passes its own so a business file refusal carries the file name.
-
-```json
-{
-  "kind": "library",
-  "remote": "https://git.example.invalid/her/books.git",
-  "branch": "main",
-  "vaultPrefix": "books",
-  "types": { "Characters": "character", "Places": "place", "Research": "research" },
-  "manuscript": ["Chapters"],
-  "universes": {
-    "harbor": { "name": "Harbor", "books": ["Book One"], "playground": ["Book One/Playground/"] }
-  }
-}
-```
-
- `remote` is https with no credentials, query or fragment. `branch` is a plain ref name.
- `vaultPrefix` is optional, one folder name.
- `types` maps a folder name to `character`, `place`, `research`, `tracker` or `summary`.
-  `manuscript` lists folder names and shares none with `types`.
- A universe has `name`, `books` and `playground`. A hybrid adds `kind: "hybrid"`, two or more
-  non-hybrid `sources`, `constraints` (each one `{ "exclude": ... }` or
-  `{ "pin": { "entity", "field", "value" } }`) and `notes`.
-
-Refusals:
-
-| Code | When |
-|---|---|
-| `library-playground-outside-book` | a playground prefix is not strictly inside a book of its own universe |
-| `library-mapping-invalid` | any other shape fault: unknown key, bad remote or branch, a book folder in two universes, a book folder that holds another, a playground prefix that holds another, an unknown hybrid source |
-
-## Scope
-
-`classify(mapping, path)` decides scope from the path alone. Only paths ending in lowercase `.md` are
-mapped. A path under a playground prefix is `playground`. Any other path under a book folder is
-`canon`. Everything else is `unmapped`. The type is the first folder after the book, or after the
-playground prefix: a `types` name, `manuscript`, or `null`.
-
-## Reader
-
-`readLibrary({ repo, commit, mapping })` reads one commit, never a working tree. `repo` may be a
-clone or a bare mirror. `commit` must be a full 40-hex id that names a commit, else `library-commit`.
-Git runs through `git()` and `gitBytes()` from `packages/project/src/git.mjs`, so the same safe config,
-environment and ceiling directory apply. A failed git call refuses `library-git`.
-
-It returns `{ commit, files, problems }`, deep-frozen and sorted. Each file has its path, scope,
-universe, book, type, numbered lines, `bodyLine`, parsed `frontmatter` or `null`, `frontmatterRaw`
-and `links`. Front matter `appears_in` and `relationships` wikilinks count as links.
-
-Problems carry `{ code, path, line, message }`:
-
-| Rule | Meaning | File indexed |
-|---|---|---|
-| R1 | not a regular `100644` blob of at most 1 MiB, or not UTF-8, or holds a NUL | no |
-| R2 | path is unmapped | no |
-| R3 | front matter not fully parsed, `line` is where parsing stopped | yes, front matter kept raw |
-| R4 | link resolves to no file or to more than one | yes, link dropped |
-| R5 | canon file links into the playground | yes |
-| R6 | canon file links into another universe, a hybrid's sources excepted | yes |
-| R7 | two paths differ only in case | no, neither |
-
-The front matter parser takes scalars, quoted strings, flow lists, block lists and wikilinks. Nested
-maps, anchors, block scalars and duplicate keys stop it with R3.
-
-## Links
-
-`resolver(paths, { vaultPrefix })` tries four steps in order, each with the target as written and
-then with `.md` added:
-
-1. `root`: the path from the repo root.
-2. `vault-prefix`: the same path with `vaultPrefix/` stripped.
-3. `relative`: relative to the linking file, never above the repo root.
-4. `shortest`: a target with no `/` that matches the base name of exactly one indexed file.
-
-It resolves only against indexed files. A link to a `.canvas` file or an attachment is R4. A link into
-another repo resolves to nothing. `extractLinks` skips fenced and inline code.
-
-## renderItems
-
-`renderItems(body, { scopeOf, changed })` turns a reply body into the plain text both channels show.
-It is pure. Item kinds are `fact`, `finding`, `correction` (with `from` and `to`), `question` and
-`idea`. Each cite is a path with commit, line range and quote, or a url with a quote.
-
-```
-1. Correction: Chapter 1 says grey.
-   From: "green eyes"
-   To: "grey eyes"
-   [canon] Book One/Characters/Mara Vell.md:9 @bbbbbbb "green eyes" (changed since)
-```
-
-A body of `{ "items": [], "notice": ... }` gives `No cited answer`, `No answer` or `The turn failed`.
-Any other shape gives the fixed line `This reply could not be shown.` and none of the body's text.
-
-## Survey
-
-```sh
-mosaic library survey <repo> [--mapping <file>]
-```
-
-It reads the repo's HEAD commit and prints folder names, file counts by extension, front matter key
-sets and link-form counts. It never prints file text, front matter values, file names or link targets.
-A key that is not a short identifier prints as `(other key)`, since it could be her words. With
-`--mapping` it adds scope counts, resolver step counts and problem counts by rule.
-
-Exit codes follow `packages/project`: 0 done, 2 the repo can't be read (`library-git`,
-`library-commit`), 3 a bad mapping, 4 usage. `scripts/mosaic` sends `library survey` here. Other
-library verbs will be bus verbs.
-
-## Tests
-
-```sh
-node --test packages/library/tests/
-```
-
-Fixtures are made-up repos built per test in a temp dir. A marker string stands in for her text, and
-the survey tests check that it never appears in output.
@@ -1,11 +0,0 @@
-{
-  "name": "@mosaic/library",
-  "version": "0.1.0",
-  "private": true,
-  "type": "module",
-  "license": "UNLICENSED",
-  "exports": "./src/index.mjs",
-  "scripts": {
-    "test": "node --test tests/*.test.mjs"
-  }
-}
@@ -1,8 +0,0 @@
-// packages/library: her writing repo read by a mapping (Case 2, design 1 and 7.4). See README.md.
-export { LibraryError, RULES, problem, sortProblems } from './problems.mjs';
-export { checkMapping, TYPES } from './mapping.mjs';
-export { classify } from './scope.mjs';
-export { extractLinks, parseWikilink, resolver, formOf } from './links.mjs';
-export { readLibrary, listTree, readTexts, parseFile, parseFrontMatter, headCommit, MAX_BLOB, LINK_FIELDS } from './reader.mjs';
-export { renderItems, KINDS, NOTICES, UNREADABLE } from './render.mjs';
-export { survey, formatSurvey, surveyMain } from './survey.mjs';
@@ -1,79 +0,0 @@
-// Wikilinks and the link resolver of design 1.3. Links are [[target]], [[target|label]] and
-// [[target#heading]], with ![[...]] embeds read the same way. Links inside fenced code blocks and
-// inline code spans are not links, as in Obsidian.
-import { posix } from 'node:path';
-
-const WIKILINK = /(!?)\[\[([^\[\]\n]+?)\]\]/g;
-const MARKDOWN_LINK = /(?<!!)\[[^\[\]\n]*\]\(([^()\s]+)\)/g;
-const FENCE = /^\s{0,3}(`{3,}|~{3,})/;
-
-// One wikilink's parts, or null for text that isn't one.
-export function parseWikilink(text) {
-  const match = /^(!?)\[\[([^\[\]\n]+?)\]\]$/.exec(text);
-  return match ? parts(match[2], match[1] === '!') : null;
-}
-function parts(inner, embed) {
-  const bar = inner.indexOf('|');
-  const target = bar < 0 ? inner : inner.slice(0, bar);
-  const hash = target.indexOf('#');
-  return {
-    file: (hash < 0 ? target : target.slice(0, hash)).trim(),
-    heading: hash < 0 ? null : target.slice(hash + 1).trim(),
-    label: bar < 0 ? null : inner.slice(bar + 1),
-    embed,
-  };
-}
-// The form a link is counted under in the survey.
-export const formOf = link => link.markdown ? 'markdown' : link.embed ? 'embed' : !link.file ? 'self'
-  : link.label !== null ? 'label' : link.heading !== null ? 'heading' : 'plain';
-
-// Links in body lines. `lines` is [[number, text], ...]. Markdown links are returned only with
-// `markdown: true`, for the survey's counts. The resolver follows wikilinks only.
-export function extractLinks(lines, { markdown = false } = {}) {
-  const found = [];
-  let fence = null;
-  for (const [line, text] of lines) {
-    const open = FENCE.exec(text);
-    if (fence) { if (open && open[1][0] === fence[0] && open[1].length >= fence.length) fence = null; continue; }
-    if (open) { fence = open[1]; continue; }
-    const plain = text.replace(/(`+)[^`]*?\1/g, match => ' '.repeat(match.length));
-    for (const m of plain.matchAll(WIKILINK)) found.push({ ...parts(m[2], m[1] === '!'), line });
-    if (markdown) {
-      for (const m of plain.matchAll(MARKDOWN_LINK)) {
-        if (!/^[a-z][a-z0-9+.-]*:/i.test(m[1]) && !m[1].startsWith('#'))
-          found.push({ file: m[1], heading: null, label: null, embed: false, markdown: true, line });
-      }
-    }
-  }
-  return found;
-}
-
-// A resolver over the indexed paths. resolve(from, file) tries, in order: a path from the repo
-// root, the same path with `vaultPrefix/` stripped, a path relative to the linking file, and
-// Obsidian's shortest-path form, a base name that matches exactly one indexed file. Each step tries
-// the target as written and then with `.md` added. A target in another of her repos is not in the
-// index, so it resolves to nothing.
-export function resolver(paths, { vaultPrefix } = {}) {
-  const known = new Set(paths), byBase = new Map();
-  for (const path of known) {
-    const base = posix.basename(path);
-    for (const key of new Set([base, base.replace(/\.md$/, '')])) byBase.set(key, [...(byBase.get(key) ?? []), path]);
-  }
-  const hit = candidate => [candidate, `${candidate}.md`].find(c => known.has(c));
-  return function resolve(from, file) {
-    if (typeof file !== 'string' || !file) return { path: null, step: 'missing' };
-    let path = hit(file);
-    if (path) return { path, step: 'root' };
-    if (vaultPrefix && file.startsWith(`${vaultPrefix}/`) && (path = hit(file.slice(vaultPrefix.length + 1))))
-      return { path, step: 'vault-prefix' };
-    const relative = posix.normalize(posix.join(posix.dirname(from), file));
-    if (relative !== '..' && !relative.startsWith('../') && !relative.startsWith('/') && (path = hit(relative)))
-      return { path, step: 'relative' };
-    if (!file.includes('/')) {
-      const matches = byBase.get(file) ?? [];
-      if (matches.length === 1) return { path: matches[0], step: 'shortest' };
-      if (matches.length > 1) return { path: null, step: 'ambiguous', count: matches.length };
-    }
-    return { path: null, step: 'missing' };
-  };
-}
@@ -1,132 +0,0 @@
-// The library project entry of a business file (design 1.1): her folders mapped onto universes,
-// books, type folders, manuscript folders and playground prefixes. A pure validator. Business file
-// loading wires it in C2-04, which passes its own `fail` so the refusal reads as a business file
-// problem. Agents can't write this entry (M9, C2-04).
-import { raise } from './problems.mjs';
-
-export const TYPES = Object.freeze(['character', 'place', 'research', 'tracker', 'summary']);
-const ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
-const BRANCH = /^[A-Za-z0-9][A-Za-z0-9._/-]{0,127}$/;
-const CONSTRAINT_KEYS = ['exclude', 'pin'];
-
-// A folder segment from her vault: spaces and capitals are fine, separators, control characters
-// and dot names are not.
-function segment(value) {
-  return typeof value === 'string' && value.length > 0 && value.length <= 255 && value !== '.' && value !== '..'
-    && !/[\/\\\u0000-\u001f\u007f]/.test(value) && value.trim() === value;
-}
-function folder(value) {
-  return typeof value === 'string' && value.length <= 1024 && value.split('/').every(segment);
-}
-const holds = (outer, inner) => inner.startsWith(outer.endsWith('/') ? outer : `${outer}/`);
-
-export function checkMapping(entry, where = 'library', { fail = raise } = {}) {
-  const bad = message => fail('library-mapping-invalid', `${where} ${message}`);
-  const object = (value, name) => {
-    if (value === null || typeof value !== 'object' || Array.isArray(value)) bad(`${name} must be an object`);
-  };
-  const only = (value, keys, name) => {
-    for (const key of Object.keys(value)) if (!keys.includes(key)) bad(`${name} has unknown key ${JSON.stringify(key)}`);
-  };
-  const list = (value, name, check, what) => {
-    if (!Array.isArray(value)) bad(`${name} must be a list`);
-    for (const item of value) if (!check(item)) bad(`${name} holds ${JSON.stringify(item)}, which is not ${what}`);
-    if (new Set(value).size !== value.length) bad(`${name} names an entry twice`);
-    return [...value];
-  };
-
-  object(entry, '');
-  only(entry, ['kind', 'remote', 'branch', 'vaultPrefix', 'universes', 'types', 'manuscript'], 'entry');
-  if (entry.kind !== 'library') bad('kind must be "library"');
-  let url;
-  try { url = new URL(entry.remote); } catch { bad('remote must be an https:// URL'); }
-  if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash || entry.remote.includes('\0'))
-    bad('remote must be an https:// URL with no credentials, query or fragment');
-  if (typeof entry.branch !== 'string' || !BRANCH.test(entry.branch) || entry.branch.includes('..')
-      || entry.branch.includes('//') || entry.branch.endsWith('/') || entry.branch.endsWith('.lock'))
-    bad('branch must be a plain branch name');
-  if (Object.hasOwn(entry, 'vaultPrefix') && !segment(entry.vaultPrefix)) bad('vaultPrefix must be one folder name');
-
-  object(entry.types, 'types');
-  for (const [name, type] of Object.entries(entry.types)) {
-    if (!segment(name)) bad(`types has ${JSON.stringify(name)}, which is not one folder name`);
-    if (!TYPES.includes(type)) bad(`types.${name} must be one of ${TYPES.join(', ')}`);
-  }
-  const manuscript = list(entry.manuscript, 'manuscript', segment, 'one folder name');
-  for (const name of manuscript) if (Object.hasOwn(entry.types, name)) bad(`manuscript folder ${JSON.stringify(name)} is also a type folder`);
-
-  object(entry.universes, 'universes');
-  if (!Object.keys(entry.universes).length) bad('universes must name at least one universe');
-  const universes = {}, bookOwner = new Map(), prefixes = [];
-  for (const [id, universe] of Object.entries(entry.universes)) {
-    const name = `universes.${id}`;
-    if (!ID.test(id)) bad(`universe id ${JSON.stringify(id)} is not a plain id`);
-    object(universe, name);
-    const hybrid = universe.kind === 'hybrid';
-    only(universe, hybrid ? ['kind', 'name', 'sources', 'books', 'playground', 'constraints', 'notes'] : ['name', 'books', 'playground'], name);
-    if (typeof universe.name !== 'string' || !universe.name.trim() || universe.name.length > 128 || /[\u0000-\u001f]/.test(universe.name))
-      bad(`${name}.name must be a short display name`);
-    const books = list(universe.books, `${name}.books`, folder, 'a folder path');
-    if (!hybrid && !books.length) bad(`${name}.books must name at least one book folder`);
-    for (const book of books) {
-      if (bookOwner.has(book)) bad(`book folder ${JSON.stringify(book)} is in two universes`);
-      bookOwner.set(book, id);
-    }
-    const playground = list(universe.playground ?? [], `${name}.playground`,
-      value => typeof value === 'string' && value.endsWith('/') && folder(value.slice(0, -1)), 'a folder path ending in /');
-    for (const prefix of playground) {
-      // Every playground file must have a universe and a book (1.1, B1).
-      if (!books.some(book => holds(book, prefix) && prefix !== `${book}/`))
-        fail('library-playground-outside-book', `${where} ${name}.playground ${JSON.stringify(prefix)} is not inside one of its books`);
-      prefixes.push(prefix);
-    }
-    const out = { name: universe.name, books, playground };
-    if (hybrid) {
-      out.kind = 'hybrid';
-      out.sources = list(universe.sources, `${name}.sources`, value => typeof value === 'string' && ID.test(value), 'a universe id');
-      if (out.sources.length < 2) bad(`${name}.sources must name two or more universes`);
-      if (!Array.isArray(universe.constraints ?? [])) bad(`${name}.constraints must be a list`);
-      out.constraints = (universe.constraints ?? []).map((constraint, i) => {
-        const at = `${name}.constraints[${i}]`;
-        object(constraint, at);
-        only(constraint, CONSTRAINT_KEYS, at);
-        if (Object.keys(constraint).length !== 1) bad(`${at} must hold exactly one of ${CONSTRAINT_KEYS.join(', ')}`);
-        if (Object.hasOwn(constraint, 'exclude')) {
-          if (!folder(constraint.exclude)) bad(`${at}.exclude must be a source path`);
-          return { exclude: constraint.exclude };
-        }
-        object(constraint.pin, `${at}.pin`);
-        only(constraint.pin, ['entity', 'field', 'value'], `${at}.pin`);
-        if (!folder(constraint.pin.entity) || typeof constraint.pin.field !== 'string' || !constraint.pin.field
-            || !['string', 'number', 'boolean'].includes(typeof constraint.pin.value))
-          bad(`${at}.pin needs an entity path, a field name and a scalar value`);
-        return { pin: { ...constraint.pin } };
-      });
-      if (Object.hasOwn(universe, 'notes') && (typeof universe.notes !== 'string' || universe.notes.length > 4000))
-        bad(`${name}.notes must be text of at most 4000 characters`);
-      if (Object.hasOwn(universe, 'notes')) out.notes = universe.notes;
-    }
-    universes[id] = out;
-  }
-  for (const [id, universe] of Object.entries(universes)) {
-    for (const source of universe.sources ?? []) {
-      if (!Object.hasOwn(universes, source) || universes[source].kind === 'hybrid')
-        bad(`universes.${id}.sources names ${JSON.stringify(source)}, which is not a non-hybrid universe`);
-    }
-  }
-  const books = [...bookOwner.keys()];
-  for (const a of books) for (const b of books) if (a !== b && holds(a, b)) bad(`book folder ${JSON.stringify(a)} holds book folder ${JSON.stringify(b)}`);
-  for (const a of prefixes) for (const b of prefixes) if (a !== b && holds(a, b)) bad(`playground ${JSON.stringify(a)} holds playground ${JSON.stringify(b)}`);
-  if (new Set(prefixes).size !== prefixes.length) bad('a playground prefix is listed twice');
-
-  return deepFreeze({
-    kind: 'library', remote: entry.remote, branch: entry.branch,
-    ...(Object.hasOwn(entry, 'vaultPrefix') ? { vaultPrefix: entry.vaultPrefix } : {}),
-    universes, types: { ...entry.types }, manuscript,
-  });
-}
-
-function deepFreeze(value) {
-  if (value && typeof value === 'object') { for (const item of Object.values(value)) deepFreeze(item); Object.freeze(value); }
-  return value;
-}
@@ -1,27 +0,0 @@
-// Errors and the R-rule problems of design 1.3. A problem never holds back a commit: it names a
-// path and, where there is one, a line, and the index leaves the file or link out.
-export class LibraryError extends Error {
-  constructor(code, message) { super(`${code}: ${message}`); this.code = code; }
-}
-export const raise = (code, message) => { throw new LibraryError(code, message); };
-
-export const RULES = Object.freeze({
-  R1: 'not a regular blob up to 1 MiB of UTF-8 text',
-  R2: 'path is unmapped',
-  R3: 'front matter not fully parsed',
-  R4: 'link resolves to no file or to more than one',
-  R5: 'canon file refers into the playground',
-  R6: 'canon file refers into another universe',
-  R7: 'paths differ only in case',
-});
-
-export function problem(code, path, line, message = RULES[code]) {
-  if (!Object.hasOwn(RULES, code)) raise('library-problem-code', `unknown problem code ${code}`);
-  return Object.freeze({ code, path, ...(Number.isSafeInteger(line) ? { line } : {}), message });
-}
-
-// Stable order for status output and tests: path, then line, then code.
-export function sortProblems(list) {
-  return [...list].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1
-    : (a.line ?? 0) - (b.line ?? 0) || (a.code < b.code ? -1 : a.code > b.code ? 1 : 0));
-}
@@ -1,219 +0,0 @@
-// The commit reader of design 1.3. It reads a commit of her repo, never a working tree: it lists the
-// tree with `git ls-tree -r -z` and reads blobs with `cat-file`, through the same bounded git()
-// and gitBytes() as packages/project, so hooks, protocols and the environment are fixed the same
-// way. Nothing in the repo is checked out or run (D7). Each R-rule is a problem, never a refusal
-// of the commit; the affected file or link is left out of the index.
-import { git, gitBytes } from '../../project/src/git.mjs';
-import { classify } from './scope.mjs';
-import { extractLinks, parseWikilink, resolver } from './links.mjs';
-import { LibraryError, problem, raise, sortProblems } from './problems.mjs';
-
-export const MAX_BLOB = 1024 * 1024;
-const MAX_LISTING = 32 * 1024 * 1024;
-const SHA = /^[0-9a-f]{40}$/;
-const ENTRY = /^([0-7]{6}) (blob|tree|commit) ([0-9a-f]{40}) +(-|\d+)\t(.+)$/s;
-export const LINK_FIELDS = Object.freeze(['appears_in', 'relationships']);
-const READERS = 8;
-
-async function local(promise, message) {
-  try { return await promise; } catch (e) { raise('library-git', `${message} (${e.code ?? 'error'})`); }
-}
-
-export async function headCommit(repo) {
-  return local(git(repo, ['rev-parse', '--verify', '--end-of-options', 'HEAD^{commit}']), 'repository has no readable HEAD commit');
-}
-
-// Every entry of the commit's tree: { mode, type, oid, size, path }. Sizes come from `-l`, so no
-// blob is opened to list it.
-export async function listTree(repo, commit) {
-  if (typeof commit !== 'string' || !SHA.test(commit)) raise('library-commit', 'expected a full commit id');
-  const kind = await local(git(repo, ['cat-file', '-t', commit]), 'commit is not in the repository');
-  if (kind !== 'commit') raise('library-commit', 'not a commit');
-  const bytes = await local(gitBytes(repo, ['ls-tree', '-r', '-z', '-l', '--full-tree', commit], MAX_LISTING), 'tree listing refused');
-  let text;
-  try { text = new TextDecoder('utf-8', { fatal: true }).decode(bytes); }
-  catch { raise('library-git', 'tree listing is not UTF-8'); }
-  const entries = text.split('\0');
-  if (entries.pop() !== '') raise('library-git', 'invalid tree listing');
-  return entries.map(entry => {
-    const m = ENTRY.exec(entry);
-    if (!m) raise('library-git', 'invalid tree listing');
-    return { mode: m[1], type: m[2], oid: m[3], size: m[4] === '-' ? null : Number(m[4]), path: m[5] };
-  });
-}
-
-// R1: only a 100644 blob up to 1 MiB of UTF-8 text without NUL is read.
-export const readable = entry => entry.mode === '100644' && entry.type === 'blob'
-  && Number.isSafeInteger(entry.size) && entry.size <= MAX_BLOB;
-
-// Text of each readable entry, by path. An entry whose bytes aren't UTF-8 text is missing from the
-// map, and the caller reports it under R1.
-export async function readTexts(repo, entries) {
-  const texts = new Map(), queue = [...entries];
-  const decoder = new TextDecoder('utf-8', { fatal: true, ignoreBOM: false });
-  const worker = async () => {
-    for (let entry = queue.shift(); entry; entry = queue.shift()) {
-      const bytes = await local(gitBytes(repo, ['cat-file', 'blob', entry.oid], MAX_BLOB), 'blob read refused');
-      let value;
-      try { value = decoder.decode(bytes); } catch { continue; }
-      if (!value.includes('\0')) texts.set(entry.path, value);
-    }
-  };
-  await Promise.all(Array.from({ length: READERS }, worker));
-  return texts;
-}
-
-const QUOTED = /^"(?:[^"\\]|\\.)*"$|^'(?:[^']|'')*'$/;
-const PLAIN_START = /^[^\s\[\]{}&*!|>%@`"'#,]/;
-function scalar(raw) {
-  const value = raw.trim();
-  if (parseWikilink(value)) return { ok: true, value };
-  if (QUOTED.test(value)) {
-    if (value[0] === "'") return { ok: true, value: value.slice(1, -1).replace(/''/g, "'") };
-    try { return { ok: true, value: JSON.parse(value) }; } catch { return { ok: false }; }
-  }
-  if (value === '' || value === '~' || value === 'null') return { ok: true, value: null };
-  if (!PLAIN_START.test(value) || /: |\s#/.test(value) || value.endsWith(':')) return { ok: false };
-  if (value === 'true' || value === 'false') return { ok: true, value: value === 'true' };
-  if (/^-?(0|[1-9]\d*)(\.\d+)?$/.test(value)) return { ok: true, value: Number(value) };
-  return { ok: true, value };
-}
-function flow(raw) {
-  const inner = raw.trim().slice(1, -1), items = [];
-  let current = '', quote = null;
-  for (const ch of inner) {
-    if (quote) { current += ch; if (ch === quote) quote = null; continue; }
-    if (ch === '"' || ch === "'") { quote = ch; current += ch; continue; }
-    if (ch === '[' || ch === ']' || ch === '{' || ch === '}') return { ok: false };
-    if (ch === ',') { items.push(current); current = ''; continue; }
-    current += ch;
-  }
-  if (quote) return { ok: false };
-  if (current.trim() || items.length) items.push(current);
-  const values = [];
-  for (const item of items) { const s = scalar(item); if (!s.ok || !item.trim()) return { ok: false }; values.push(s.value); }
-  return { ok: true, value: values };
-}
-function value(raw) {
-  const text = raw.trim();
-  if (text.startsWith('[') && !parseWikilink(text)) return text.endsWith(']') ? flow(text) : { ok: false };
-  return scalar(text);
-}
-
-// Front matter of design 1.3 (R3): scalars, quoted strings, flow lists and block lists of scalars or
-// wikilinks. Anything else, a nested map, a block scalar or an anchor for example, leaves the whole
-// front matter as raw text with one R3 problem at the line where parsing stopped.
-// Returns { frontmatter, raw, bodyLine, stop } with 1-based line numbers.
-export function parseFrontMatter(lines) {
-  if (lines[0]?.replace(/^/, '').trimEnd() !== '---') return { frontmatter: null, raw: null, bodyLine: 1, stop: null };
-  const close = lines.findIndex((text, i) => i > 0 && /^(---|\.\.\.)\s*$/.test(text));
-  if (close < 0) return { frontmatter: null, raw: null, bodyLine: 1, stop: 1 };
-  const raw = lines.slice(1, close).join('\n'), data = {};
-  let list = null;
-  for (let i = 1; i < close; i++) {
-    const text = lines[i], line = i + 1;
-    if (!text.trim() || /^\s*#/.test(text)) continue;
-    const item = /^(\s*)- (.*)$|^(\s*)-$/.exec(text);
-    if (item && list) {
-      const parsed = scalar(item[2] ?? '');
-      if (!parsed.ok) return { frontmatter: null, raw, bodyLine: close + 2, stop: line };
-      data[list].push(parsed.value);
-      continue;
-    }
-    const pair = /^([^\s:#\-][^:]*?|"[^"]+"|'[^']+')\s*:(?:\s+(.*))?$/.exec(text);
-    if (!pair) return { frontmatter: null, raw, bodyLine: close + 2, stop: line };
-    const key = pair[1].replace(/^(["'])(.*)\1$/, '$2');
-    if (Object.hasOwn(data, key) || key === '__proto__') return { frontmatter: null, raw, bodyLine: close + 2, stop: line };
-    if (pair[2] === undefined || !pair[2].trim()) {
-      const next = lines[i + 1];
-      if (i + 1 < close && /^\s*-( |$)/.test(next)) { data[key] = []; list = key; }
-      else { data[key] = null; list = null; }
-      continue;
-    }
-    list = null;
-    const parsed = value(pair[2]);
-    if (!parsed.ok) return { frontmatter: null, raw, bodyLine: close + 2, stop: line };
-    data[key] = parsed.value;
-  }
-  return { frontmatter: data, raw: null, bodyLine: close + 2, stop: null };
-}
-
-export const splitLines = text => text.replace(/^/, '').split('\n').map(l => l.endsWith('\r') ? l.slice(0, -1) : l);
-
-// One parsed file: its lines (all of them, numbered from 1), front matter and the links it holds.
-// Front matter links come from LINK_FIELDS values that are wikilinks; other values are names.
-export function parseFile(text, { markdown = false } = {}) {
-  const lines = splitLines(text);
-  const fm = parseFrontMatter(lines);
-  const numbered = lines.map((t, i) => [i + 1, t]);
-  const links = extractLinks(numbered.slice(fm.bodyLine - 1), { markdown });
-  if (fm.frontmatter) {
-    for (const field of LINK_FIELDS) {
-      const raw = fm.frontmatter[field];
-      const values = Array.isArray(raw) ? raw : raw === undefined || raw === null ? [] : [raw];
-      for (const v of values) {
-        const link = typeof v === 'string' ? parseWikilink(v.trim()) : null;
-        if (link) links.push({ ...link, field, line: frontMatterLine(lines, fm.bodyLine, field) });
-      }
-    }
-  }
-  return { lines: numbered, bodyLine: fm.bodyLine, frontmatter: fm.frontmatter, frontmatterRaw: fm.raw, stop: fm.stop, links };
-}
-function frontMatterLine(lines, bodyLine, field) {
-  const i = lines.slice(0, bodyLine - 1).findIndex(t => new RegExp(`^["']?${field}["']?\\s*:`).test(t));
-  return i < 0 ? undefined : i + 1;
-}
-
-// Read a commit under a checked mapping (mapping.mjs). Returns the indexed files and every
-// R1-R7 problem: { commit, files: [...], problems: [...] }, frozen, sorted by path.
-export async function readLibrary({ repo, commit, mapping }) {
-  if (!mapping || mapping.kind !== 'library') throw new LibraryError('library-mapping-invalid', 'expected a checked library mapping');
-  const entries = await listTree(repo, commit);
-  const problems = [], twins = new Set(), byLower = new Map();
-  for (const e of entries) byLower.set(e.path.toLowerCase(), [...(byLower.get(e.path.toLowerCase()) ?? []), e.path]);
-  for (const group of byLower.values()) if (group.length > 1) for (const path of group) twins.add(path);
-
-  const candidates = [];
-  for (const entry of entries) {
-    const where = classify(mapping, entry.path);
-    if (where.scope === 'unmapped') { problems.push(problem('R2', entry.path)); continue; }
-    if (twins.has(entry.path)) { problems.push(problem('R7', entry.path)); continue; }
-    if (!readable(entry)) { problems.push(problem('R1', entry.path)); continue; }
-    candidates.push({ entry, where });
-  }
-  const texts = await readTexts(repo, candidates.map(c => c.entry));
-  const files = [];
-  for (const { entry, where } of candidates) {
-    if (!texts.has(entry.path)) { problems.push(problem('R1', entry.path)); continue; }
-    const parsed = parseFile(texts.get(entry.path));
-    if (parsed.stop !== null) problems.push(problem('R3', entry.path, parsed.stop));
-    files.push({ path: entry.path, ...where, name: entry.path.split('/').pop().replace(/\.md$/, ''), ...parsed });
-  }
-
-  const resolve = resolver(files.map(f => f.path), { vaultPrefix: mapping.vaultPrefix });
-  const byPath = new Map(files.map(f => [f.path, f]));
-  for (const file of files) {
-    const kept = [];
-    for (const link of file.links) {
-      if (!link.file) continue;
-      const target = resolve(file.path, link.file);
-      if (!target.path) { problems.push(problem('R4', file.path, link.line)); continue; }
-      const to = byPath.get(target.path);
-      if (file.scope === 'canon') {
-        if (to.scope === 'playground') problems.push(problem('R5', file.path, link.line));
-        const sources = mapping.universes[file.universe].sources ?? [];
-        if (to.universe !== file.universe && !sources.includes(to.universe)) problems.push(problem('R6', file.path, link.line));
-      }
-      kept.push({ ...link, path: target.path, step: target.step });
-    }
-    file.links = kept;
-    delete file.stop;
-  }
-  files.sort((a, b) => a.path < b.path ? -1 : 1);
-  return deepFreeze({ commit, files, problems: sortProblems(problems) });
-}
-
-function deepFreeze(value) {
-  if (value && typeof value === 'object' && !Object.isFrozen(value)) { Object.freeze(value); for (const v of Object.values(value)) deepFreeze(v); }
-  return value;
-}
@@ -1,59 +0,0 @@
-// renderItems(body): how a stored cited reply looks (design 7.4), shared by the Console chat (C2-10b)
-// and the Discord relay (C2-18). Pure: no git, no clock. The caller passes what it knows about cites.
-// The guard (C2-06) checks limits before a reply is stored. This only refuses to show a body that
-// doesn't have the reply shape, and then it shows a fixed line, never the body's text.
-export const KINDS = Object.freeze({ fact: 'Fact', finding: 'Finding', correction: 'Correction', question: 'Question', idea: 'Idea' });
-export const NOTICES = Object.freeze({ 'no-cited-answer': 'No cited answer', 'no-answer': 'No answer', 'turn-failed': 'The turn failed' });
-export const UNREADABLE = 'This reply could not be shown.';
-const SHA = /^[0-9a-f]{40}$/;
-
-const plain = value => value !== null && typeof value === 'object' && !Array.isArray(value);
-const line = n => Number.isSafeInteger(n) && n > 0;
-function cite(value, { scopeOf, changed }) {
-  if (!plain(value) || typeof value.quote !== 'string') return null;
-  if (Object.hasOwn(value, 'url')) {
-    if (typeof value.url !== 'string' || Object.hasOwn(value, 'path')) return null;
-    return { badge: 'web', url: value.url, ref: value.url, quote: value.quote, changed: false };
-  }
-  const { path, commit, lines } = value;
-  if (typeof path !== 'string' || !SHA.test(commit ?? '') || !Array.isArray(lines) || lines.length !== 2
-      || !line(lines[0]) || !line(lines[1]) || lines[1] < lines[0]) return null;
-  const badge = scopeOf?.(path);
-  const ref = `${path}:${lines[0] === lines[1] ? lines[0] : `${lines[0]}-${lines[1]}`} @${commit.slice(0, 7)}`;
-  return { badge: badge === 'canon' || badge === 'playground' ? badge : null, path, commit, lines: [...lines], ref,
-    quote: value.quote, changed: changed?.({ path, commit }) === true };
-}
-const quoted = text => JSON.stringify(text);
-
-// body: the stored message body (a JSON string or the parsed object).
-// options.scopeOf(path) -> 'canon' | 'playground' | undefined, for the scope badge.
-// options.changed({path, commit}) -> true when the file's last commit is newer than the cited one.
-// Returns { kind: 'items', items, text } | { kind: 'notice', notice, text } | { kind: 'unreadable', text }.
-export function renderItems(body, options = {}) {
-  const unreadable = { kind: 'unreadable', text: UNREADABLE };
-  let value = body;
-  if (typeof body === 'string') { try { value = JSON.parse(body); } catch { return unreadable; } }
-  if (!plain(value) || !Array.isArray(value.items)) return unreadable;
-  const keys = Object.keys(value);
-  if (value.items.length === 0) {
-    if (keys.length !== 2 || !Object.hasOwn(NOTICES, value.notice)) return unreadable;
-    return { kind: 'notice', notice: value.notice, text: NOTICES[value.notice] };
-  }
-  if (keys.length !== 1) return unreadable;
-  const items = [];
-  for (const item of value.items) {
-    if (!plain(item) || !Object.hasOwn(KINDS, item.kind) || typeof item.text !== 'string' || !Array.isArray(item.cites)) return unreadable;
-    const correction = item.kind === 'correction';
-    if (correction && (typeof item.from !== 'string' || typeof item.to !== 'string')) return unreadable;
-    const cites = item.cites.map(c => cite(c, options));
-    if (cites.some(c => c === null)) return unreadable;
-    items.push({ kind: item.kind, label: KINDS[item.kind], text: item.text,
-      ...(correction ? { from: item.from, to: item.to } : {}), cites });
-  }
-  const text = items.map((item, i) => [
-    `${i + 1}. ${item.label}: ${item.text}`,
-    ...(item.kind === 'correction' ? [`   From: ${quoted(item.from)}`, `   To: ${quoted(item.to)}`] : []),
-    ...item.cites.map(c => `   ${c.badge ? `[${c.badge}] ` : ''}${c.ref} ${quoted(c.quote)}${c.changed ? ' (changed since)' : ''}`),
-  ].join('\n')).join('\n');
-  return { kind: 'items', items, text };
-}
@@ -1,21 +0,0 @@
-// The scope rule of design 1.2. Scope comes from the path alone (D2): no file content can change it.
-// Paths are repo-relative and compared exactly, case included (R7 handles case-only twins).
-const inside = (folder, path) => path.startsWith(folder.endsWith('/') ? folder : `${folder}/`);
-
-// { scope: 'playground' | 'canon', universe, book, type, folder } or { scope: 'unmapped' }.
-// `type` is the mapped type of the first folder under the book (canon) or under the playground
-// prefix (playground), 'manuscript' for a manuscript folder, else null. `folder` is that folder name.
-export function classify(mapping, path) {
-  if (typeof path !== 'string' || !path.endsWith('.md')) return { scope: 'unmapped' };
-  for (const [universe, entry] of Object.entries(mapping.universes)) {
-    const book = entry.books.find(b => inside(b, path));
-    if (!book) continue;
-    const prefix = entry.playground.find(p => inside(p, path));
-    const rest = path.slice((prefix ?? `${book}/`).length).split('/');
-    const folder = rest.length > 1 ? rest[0] : null;
-    const type = folder === null ? null : Object.hasOwn(mapping.types, folder) ? mapping.types[folder]
-      : mapping.manuscript.includes(folder) ? 'manuscript' : null;
-    return { scope: prefix ? 'playground' : 'canon', universe, book, type, folder };
-  }
-  return { scope: 'unmapped' };
-}
@@ -1,126 +0,0 @@
-// `mosaic library survey <repo> [--mapping <file>]` (design 1.1, 10 step 7). It prints what a mapping
-// needs: folder names, file counts by extension, front matter key sets and link-form counts. It
-// never prints file text, front matter values, file names or link targets. With a mapping it adds
-// scope counts, resolver step counts and R-problem counts by code. It reads the repo's HEAD commit
-// through the commit reader, never the working tree.
-import { readFileSync, realpathSync, statSync } from 'node:fs';
-import { resolve as resolvePath } from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { checkMapping } from './mapping.mjs';
-import { classify } from './scope.mjs';
-import { formOf } from './links.mjs';
-import { headCommit, listTree, parseFile, readable, readLibrary, readTexts } from './reader.mjs';
-import { LibraryError, RULES } from './problems.mjs';
-
-export const USAGE = 'usage: mosaic library survey <repo> [--mapping <file>]';
-// Keys are printed only in the short identifier forms property names take. A key with spaces or of
-// any other shape could be a phrase of hers, so it is counted as one "(other key)".
-const KEY = /^[A-Za-z_][A-Za-z0-9_-]{0,31}$/;
-const OTHER_KEY = '(other key)';
-const FORMS = ['plain', 'label', 'heading', 'embed', 'self', 'markdown'];
-const STEPS = ['root', 'vault-prefix', 'relative', 'shortest'];
-const extension = path => /\.md$/.test(path) ? 'md' : /\.canvas$/.test(path) ? 'canvas' : /\.base$/.test(path) ? 'base' : 'other';
-
-// The survey as data. `mapping` is a checked mapping or undefined.
-export async function survey({ repo, commit, mapping }) {
-  const head = commit ?? await headCommit(repo);
-  const entries = await listTree(repo, head);
-  const folders = new Map();
-  for (const entry of entries) {
-    const slash = entry.path.lastIndexOf('/');
-    const name = slash < 0 ? '' : entry.path.slice(0, slash);
-    const counts = folders.get(name) ?? { md: 0, canvas: 0, base: 0, other: 0 };
-    counts[entry.type === 'blob' ? extension(entry.path) : 'other']++;
-    folders.set(name, counts);
-  }
-  const markdown = entries.filter(e => e.path.endsWith('.md'));
-  const texts = await readTexts(repo, markdown.filter(readable));
-  const keySets = new Map(), forms = Object.fromEntries(FORMS.map(f => [f, 0]));
-  const fields = { appears_in: { wikilink: 0, name: 0 }, relationships: { wikilink: 0, name: 0 } };
-  let noFrontMatter = 0, unparsed = 0;
-  for (const text of texts.values()) {
-    const file = parseFile(text, { markdown: true });
-    if (file.stop !== null) unparsed++;
-    else if (!file.frontmatter) noFrontMatter++;
-    else {
-      const set = [...new Set(Object.keys(file.frontmatter).map(k => KEY.test(k) ? k : OTHER_KEY))].sort().join(', ');
-      keySets.set(set, (keySets.get(set) ?? 0) + 1);
-      for (const field of Object.keys(fields)) {
-        const raw = file.frontmatter[field];
-        for (const v of Array.isArray(raw) ? raw : raw === undefined || raw === null ? [] : [raw])
-          fields[field][typeof v === 'string' && /^\s*!?\[\[[^\]]+\]\]\s*$/.test(v) ? 'wikilink' : 'name']++;
-      }
-    }
-    for (const link of file.links) if (!link.field) forms[formOf(link)]++;
-  }
-  const result = {
-    commit: head, entries: entries.length,
-    folders: [...folders].sort(([a], [b]) => a < b ? -1 : 1).map(([name, counts]) => ({ name, ...counts })),
-    markdown: { files: markdown.length, read: texts.size, noFrontMatter, unparsed },
-    keySets: [...keySets].sort(([a, x], [b, y]) => y - x || (a < b ? -1 : 1)).map(([keys, count]) => ({ keys, count })),
-    forms, fields,
-  };
-  if (mapping) {
-    const scopes = { canon: 0, playground: 0, unmapped: 0 };
-    for (const entry of entries) scopes[classify(mapping, entry.path).scope]++;
-    const library = await readLibrary({ repo, commit: head, mapping });
-    const steps = Object.fromEntries(STEPS.map(s => [s, 0]));
-    for (const file of library.files) for (const link of file.links) steps[link.step]++;
-    const problems = Object.fromEntries(Object.keys(RULES).map(code => [code, 0]));
-    for (const p of library.problems) problems[p.code]++;
-    steps.unresolved = problems.R4;
-    Object.assign(result, { scopes, indexed: library.files.length, steps, problems });
-  }
-  return result;
-}
-
-// Folder names are quoted as JSON strings, so no name can carry a control sequence to the terminal.
-export function formatSurvey(s) {
-  const out = [`commit ${s.commit}`, `entries ${s.entries}`, 'folders (direct children: md canvas base other)'];
-  for (const f of s.folders) out.push(`  ${f.name === '' ? '(root)' : JSON.stringify(f.name)} ${f.md} ${f.canvas} ${f.base} ${f.other}`);
-  out.push(`markdown ${s.markdown.files} files, ${s.markdown.read} read, ${s.markdown.noFrontMatter} without front matter, ${s.markdown.unparsed} with front matter not fully parsed`);
-  out.push('front matter key sets');
-  for (const k of s.keySets) out.push(`  ${k.count} [${k.keys}]`);
-  out.push(`body links ${FORMS.map(f => `${f} ${s.forms[f]}`).join(', ')}`);
-  for (const [field, c] of Object.entries(s.fields)) out.push(`field ${field} wikilink ${c.wikilink}, name ${c.name}`);
-  if (s.scopes) {
-    out.push(`scopes canon ${s.scopes.canon}, playground ${s.scopes.playground}, unmapped ${s.scopes.unmapped}; indexed ${s.indexed}`);
-    out.push(`resolved ${STEPS.map(st => `${st} ${s.steps[st]}`).join(', ')}, unresolved ${s.steps.unresolved}`);
-    out.push(`problems ${Object.entries(s.problems).map(([code, n]) => `${code} ${n}`).join(', ')}`);
-  }
-  return `${out.join('\n')}\n`;
-}
-
-// Exit codes as packages/project's CLI: 0 done, 2 the repo can't be read, 3 a bad mapping, 4 usage.
-export async function surveyMain(argv, io = { stdout: process.stdout, stderr: process.stderr }) {
-  const fail = (code, message) => { io.stderr.write(`library survey: ${message}\n`); return code; };
-  const [verb, ...rest] = argv;
-  if (verb !== 'survey') return fail(4, USAGE);
-  let repo, mappingFile;
-  for (let i = 0; i < rest.length; i++) {
-    if (rest[i] === '--mapping' && i + 1 < rest.length && mappingFile === undefined) mappingFile = rest[++i];
-    else if (!rest[i].startsWith('-') && repo === undefined) repo = rest[i];
-    else return fail(4, USAGE);
-  }
-  if (repo === undefined) return fail(4, USAGE);
-  let mapping;
-  if (mappingFile !== undefined) {
-    let entry;
-    try { entry = JSON.parse(readFileSync(mappingFile, 'utf8')); }
-    catch { return fail(3, `library-mapping-invalid: ${mappingFile} is not a readable JSON file`); }
-    try { mapping = checkMapping(entry, mappingFile); }
-    catch (e) { if (e instanceof LibraryError) return fail(3, e.message); throw e; }
-  }
-  const path = resolvePath(repo);
-  try { if (!statSync(path).isDirectory()) return fail(2, `library-git: ${repo} is not a directory`); }
-  catch { return fail(2, `library-git: ${repo} is not a directory`); }
-  try { io.stdout.write(formatSurvey(await survey({ repo: path, mapping }))); }
-  catch (e) { if (e instanceof LibraryError) return fail(2, e.message); throw e; }
-  return 0;
-}
-
-const entry = () => { try { return import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href; } catch { return false; } };
-if (process.argv[1] && entry()) {
-  const code = await surveyMain(process.argv.slice(2));
-  if (code !== 0) process.exitCode = code;
-}
@@ -1,12 +0,0 @@
-{
-  "kind": "library",
-  "remote": "https://git.example.invalid/writer/books.git",
-  "branch": "main",
-  "vaultPrefix": "books",
-  "universes": {
-    "harbor": {"name": "The Harbor", "books": ["Book One"], "playground": ["Book One/Playground/"]},
-    "second": {"name": "Second World", "books": ["Second World"]}
-  },
-  "types": {"Characters": "character", "Places": "place", "Research": "research", "Tracker": "tracker", "Summaries": "summary"},
-  "manuscript": ["Chapters"]
-}
@@ -1,54 +0,0 @@
-// A repo the test builds in her layout's shape: spaces and capitals in folder names, a .canvas file
-// and an unmapped top-level note. Bodies are made up; MARKER stands in for her text.
-import { mkdtempSync, rmSync, mkdirSync, writeFileSync, readFileSync, symlinkSync, chmodSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { execFileSync } from 'node:child_process';
-import { fileURLToPath } from 'node:url';
-import { checkMapping } from '../src/mapping.mjs';
-
-export const MARKER = 'MARKER-7f3a-HER-TEXT';
-export const FIXTURES = fileURLToPath(new URL('./fixtures/', import.meta.url));
-export const mappingEntry = () => JSON.parse(readFileSync(join(FIXTURES, 'mapping.json'), 'utf8'));
-export const mapping = (change = e => e) => checkMapping(change(mappingEntry()));
-
-export const git = (repo, ...args) => execFileSync('git', ['-c', 'user.name=fixture', '-c', '[email protected]',
-  '-c', 'commit.gpgsign=false', '-c', 'core.hooksPath=/dev/null', '-C', repo, ...args], { encoding: 'utf8' }).trim();
-
-export const BASE = {
-  'Book One/Characters/Mara Vell.md': [
-    '---', 'type: character', 'name: Mara Vell', 'appears_in: "[[Book One/Chapters/Chapter 01]]"',
-    'relationships:', '  - "[[Tomas]]"', '  - The Ferryman', '---', `Grey eyes. ${MARKER}`, ''].join('\n'),
-  'Book One/Characters/Tomas.md': ['---', 'type: character', 'name: Tomas', 'appears_in: ["[[Chapter 01]]"]', '---', MARKER, ''].join('\n'),
-  'Book One/Chapters/Chapter 01.md': [
-    '# One', `${MARKER} [[Mara Vell]] met [[Book One/Places/Harbor Town|the harbor]].`,
-    'See [[../Places/Harbor Town#Docks]] and [[books/Book One/Characters/Tomas]].',
-    '```', '[[Not A Link]]', '```', 'Inline `[[Not Either]]` and [a note](Notes.md).', ''].join('\n'),
-  'Book One/Places/Harbor Town.md': ['---', 'type: place', '---', `Salt. ${MARKER}`, ''].join('\n'),
-  'Book One/Playground/What If.md': ['---', 'name: What If', '---', `${MARKER} [[Mara Vell]]`, ''].join('\n'),
-  'Book One/Board.canvas': '{"nodes":[]}\n',
-  'Book One/Playground/Sketch.canvas': '{"nodes":[]}\n',
-  'Inbox Note.md': `${MARKER}\n`,
-  'Second World/Chapters/01.md': `# Elsewhere ${MARKER}\n`,
-};
-
-// repo({files, extra}) writes files (path -> text, or { link } / { mode, text }), commits, and
-// returns { repo, commit }.
-export function repo(t, files = BASE) {
-  const root = mkdtempSync(join(tmpdir(), 'library-'));
-  t.after(() => rmSync(root, { recursive: true, force: true }));
-  const dir = join(root, 'books');
-  mkdirSync(dir);
-  git(dir, 'init', '-q', '-b', 'main');
-  for (const [path, value] of Object.entries(files)) {
-    const file = join(dir, path);
-    mkdirSync(dirname(file), { recursive: true });
-    if (typeof value === 'object' && value.link) symlinkSync(value.link, file);
-    else if (typeof value === 'object' && value.bytes) writeFileSync(file, value.bytes);
-    else writeFileSync(file, typeof value === 'object' ? value.text : value);
-    if (typeof value === 'object' && value.mode) chmodSync(file, value.mode);
-  }
-  git(dir, 'add', '-A');
-  git(dir, 'commit', '-qm', 'fixture');
-  return { root, repo: dir, commit: git(dir, 'rev-parse', 'HEAD') };
-}
@@ -1,50 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { extractLinks, parseWikilink, resolver } from '../src/index.mjs';
-
-const PATHS = ['Book One/Characters/Mara Vell.md', 'Book One/Characters/Tomas.md', 'Book One/Places/Harbor Town.md',
-  'Book One/Chapters/Chapter 01.md', 'Book One/Places/Notes.md', 'Book One/Characters/Notes.md', 'Mara Vell.md'];
-const resolve = resolver(PATHS, { vaultPrefix: 'books' });
-const FROM = 'Book One/Chapters/Chapter 01.md';
-
-test('resolver step 1: a path from the repo root, with or without .md', () => {
-  assert.deepEqual(resolve(FROM, 'Book One/Places/Harbor Town'), { path: 'Book One/Places/Harbor Town.md', step: 'root' });
-  assert.deepEqual(resolve(FROM, 'Book One/Places/Harbor Town.md'), { path: 'Book One/Places/Harbor Town.md', step: 'root' });
-  // Root wins over shortest: Mara Vell.md at the root, not the character page.
-  assert.deepEqual(resolve(FROM, 'Mara Vell'), { path: 'Mara Vell.md', step: 'root' });
-});
-
-test('resolver step 2: the same path with vaultPrefix/ stripped', () => {
-  assert.deepEqual(resolve(FROM, 'books/Book One/Characters/Tomas'), { path: 'Book One/Characters/Tomas.md', step: 'vault-prefix' });
-  assert.deepEqual(resolver(PATHS)(FROM, 'books/Book One/Characters/Tomas'), { path: null, step: 'missing' });
-});
-
-test('resolver step 3: a path relative to the linking file, never above the repo root', () => {
-  assert.deepEqual(resolve(FROM, '../Places/Harbor Town'), { path: 'Book One/Places/Harbor Town.md', step: 'relative' });
-  assert.deepEqual(resolve('Book One/Places/Harbor Town.md', './Notes'), { path: 'Book One/Places/Notes.md', step: 'relative' });
-  assert.deepEqual(resolve(FROM, '../../../Book One/Places/Harbor Town'), { path: null, step: 'missing' });
-});
-
-test('resolver step 4: a base name that matches exactly one indexed file', () => {
-  assert.deepEqual(resolve(FROM, 'Tomas'), { path: 'Book One/Characters/Tomas.md', step: 'shortest' });
-  assert.deepEqual(resolve(FROM, 'Harbor Town.md'), { path: 'Book One/Places/Harbor Town.md', step: 'shortest' });
-  assert.deepEqual(resolve(FROM, 'Notes'), { path: null, step: 'ambiguous', count: 2 });
-  assert.deepEqual(resolve(FROM, 'Nobody'), { path: null, step: 'missing' });
-  // A partial path is not a base name.
-  assert.deepEqual(resolve(FROM, 'Places/Harbor Town'), { path: null, step: 'missing' });
-});
-
-test('a link into another of her repos resolves to nothing', () => {
-  assert.deepEqual(resolve(FROM, 'bean-brain/Journal/Today'), { path: null, step: 'missing' });
-  assert.deepEqual(resolve(FROM, '../bean-brain/Journal/Today'), { path: null, step: 'missing' });
-});
-
-test('wikilink forms, embeds, and links skipped inside code', () => {
-  assert.deepEqual(parseWikilink('[[A/B#Head|Label]]'), { file: 'A/B', heading: 'Head', label: 'Label', embed: false });
-  assert.deepEqual(parseWikilink('![[pic.png]]'), { file: 'pic.png', heading: null, label: null, embed: true });
-  assert.equal(parseWikilink('[[a]] and more'), null);
-  const lines = [[1, '[[One]] [[Two|2]] [[Three#H]] ![[Four]] [[#Self]]'], [2, '```js'], [3, '[[Fenced]]'], [4, '```'],
-    [5, 'Inline `[[Code]]` and [md](Five.md) and [web](https://example.invalid/x)']];
-  assert.deepEqual(extractLinks(lines).map(l => [l.file, l.line]), [['One', 1], ['Two', 1], ['Three', 1], ['Four', 1], ['', 1]]);
-  assert.deepEqual(extractLinks(lines, { markdown: true }).filter(l => l.markdown).map(l => l.file), ['Five.md']);
-});
@@ -1,82 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { checkMapping, classify, LibraryError } from '../src/index.mjs';
-import { mapping, mappingEntry } from './helpers.mjs';
-
-const refuses = (change, code, pattern) => assert.throws(() => checkMapping(change(mappingEntry())),
-  e => e instanceof LibraryError && e.code === code && (!pattern || pattern.test(e.message)));
-
-test('the fixture mapping checks and comes back frozen', () => {
-  const m = mapping();
-  assert.equal(m.universes.harbor.playground[0], 'Book One/Playground/');
-  assert.ok(Object.isFrozen(m.universes.harbor.books));
-  assert.throws(() => { m.types.Extra = 'place'; });
-});
-
-test('a playground prefix outside its universe books refuses library-playground-outside-book', () => {
-  refuses(e => { e.universes.harbor.playground = ['Second World/Playground/']; return e; }, 'library-playground-outside-book');
-  refuses(e => { e.universes.harbor.playground = ['Elsewhere/']; return e; }, 'library-playground-outside-book');
-  // The whole book as its playground would leave no canon: not inside the book.
-  refuses(e => { e.universes.harbor.playground = ['Book One/']; return e; }, 'library-playground-outside-book');
-});
-
-test('no playground prefix holds another, and no book folder holds another', () => {
-  refuses(e => { e.universes.harbor.playground = ['Book One/Playground/', 'Book One/Playground/Deep/']; return e; },
-    'library-mapping-invalid', /holds playground/);
-  refuses(e => { e.universes.second.books = ['Second World', 'Book One/Part Two']; return e; }, 'library-mapping-invalid', /holds book folder/);
-  refuses(e => { e.universes.second.books = ['Book One']; return e; }, 'library-mapping-invalid', /in two universes/);
-});
-
-test('shape refusals: kind, remote, branch, unknown keys, types, manuscript, folder names', () => {
-  refuses(e => ({ ...e, kind: 'code' }), 'library-mapping-invalid', /kind/);
-  refuses(e => ({ ...e, remote: 'http://git.example.invalid/x.git' }), 'library-mapping-invalid', /https/);
-  refuses(e => ({ ...e, remote: 'https://user:[email protected]/x.git' }), 'library-mapping-invalid', /credentials/);
-  refuses(e => ({ ...e, remote: '[email protected]:x.git' }), 'library-mapping-invalid', /https/);
-  refuses(e => ({ ...e, branch: 'main..x' }), 'library-mapping-invalid', /branch/);
-  refuses(e => ({ ...e, root: '/tmp' }), 'library-mapping-invalid', /unknown key "root"/);
-  refuses(e => { e.universes.harbor.extra = 1; return e; }, 'library-mapping-invalid', /unknown key/);
-  refuses(e => { e.types.Characters = 'villain'; return e; }, 'library-mapping-invalid', /types.Characters/);
-  refuses(e => { e.types['A/B'] = 'place'; return e; }, 'library-mapping-invalid', /one folder name/);
-  refuses(e => ({ ...e, manuscript: ['Characters'] }), 'library-mapping-invalid', /also a type folder/);
-  refuses(e => { e.universes.harbor.books = ['../Book One']; return e; }, 'library-mapping-invalid', /folder path/);
-  refuses(e => ({ ...e, vaultPrefix: 'a/b' }), 'library-mapping-invalid', /vaultPrefix/);
-  refuses(e => ({ ...e, universes: {} }), 'library-mapping-invalid', /at least one universe/);
-  refuses(e => { e.universes['bad id'] = e.universes.second; delete e.universes.second; return e; }, 'library-mapping-invalid', /plain id/);
-});
-
-test('a hybrid universe is a shape the query code can take (1.4), with sources that must exist', () => {
-  const hybrid = e => { e.universes.cross = { kind: 'hybrid', name: 'Crossover', sources: ['harbor', 'second'], books: ['Crossover'],
-    constraints: [{ exclude: 'second/Characters' }, { pin: { entity: 'Book One/Characters/Mara Vell.md', field: 'eyes', value: 'grey' } }],
-    notes: 'Set after book one.' }; return e; };
-  const m = checkMapping(hybrid(mappingEntry()));
-  assert.deepEqual(m.universes.cross.sources, ['harbor', 'second']);
-  refuses(e => { hybrid(e); e.universes.cross.sources = ['harbor', 'nowhere']; return e; }, 'library-mapping-invalid', /non-hybrid universe/);
-  refuses(e => { hybrid(e); e.universes.cross.sources = ['harbor']; return e; }, 'library-mapping-invalid', /two or more/);
-  refuses(e => { hybrid(e); e.universes.cross.constraints = [{ exclude: 'x', pin: {} }]; return e; }, 'library-mapping-invalid', /exactly one/);
-});
-
-test('a caller-supplied fail receives the code, as business file loading will pass it (C2-04)', () => {
-  const seen = [];
-  const fail = (code, message) => { seen.push(code); throw new Error(message); };
-  const entry = mappingEntry();
-  entry.universes.harbor.playground = ['Elsewhere/'];
-  assert.throws(() => checkMapping(entry, 'businesses/acme.json projects.books', { fail }), /businesses\/acme.json projects.books/);
-  assert.deepEqual(seen, ['library-playground-outside-book']);
-});
-
-test('scope comes from the path alone (design 1.2)', () => {
-  const m = mapping();
-  assert.deepEqual(classify(m, 'Book One/Characters/Mara Vell.md'),
-    { scope: 'canon', universe: 'harbor', book: 'Book One', type: 'character', folder: 'Characters' });
-  assert.deepEqual(classify(m, 'Book One/Chapters/Chapter 01.md'),
-    { scope: 'canon', universe: 'harbor', book: 'Book One', type: 'manuscript', folder: 'Chapters' });
-  assert.deepEqual(classify(m, 'Book One/Playground/What If.md'),
-    { scope: 'playground', universe: 'harbor', book: 'Book One', type: null, folder: null });
-  assert.deepEqual(classify(m, 'Book One/Playground/Characters/New.md'),
-    { scope: 'playground', universe: 'harbor', book: 'Book One', type: 'character', folder: 'Characters' });
-  assert.deepEqual(classify(m, 'Book One/Notes.md'), { scope: 'canon', universe: 'harbor', book: 'Book One', type: null, folder: null });
-  assert.equal(classify(m, 'Second World/Chapters/01.md').universe, 'second');
-  for (const path of ['Inbox Note.md', 'Book One/Board.canvas', 'Book One/Playground/Sketch.canvas', 'Book One/Board.base',
-    'Book One/cover.png', 'Book One/Upper.MD', 'Book Onex/a.md', 'book one/a.md', 'Elsewhere/Book One/a.md'])
-    assert.deepEqual(classify(m, path), { scope: 'unmapped' }, path);
-});
@@ -1,151 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { readLibrary, parseFrontMatter, LibraryError, MAX_BLOB } from '../src/index.mjs';
-import { BASE, git, mapping, repo } from './helpers.mjs';
-
-const codes = (result, path) => result.problems.filter(p => p.path === path).map(p => p.code);
-const file = (result, path) => result.files.find(f => f.path === path);
-
-test('the fixture reads clean: every resolver step, appears_in and relationships wikilinks indexed', async t => {
-  const r = repo(t);
-  const result = await readLibrary({ repo: r.repo, commit: r.commit, mapping: mapping() });
-  assert.equal(result.commit, r.commit);
-  assert.deepEqual(result.files.map(f => [f.path, f.scope]), [
-    ['Book One/Chapters/Chapter 01.md', 'canon'], ['Book One/Characters/Mara Vell.md', 'canon'],
-    ['Book One/Characters/Tomas.md', 'canon'], ['Book One/Places/Harbor Town.md', 'canon'],
-    ['Book One/Playground/What If.md', 'playground'], ['Second World/Chapters/01.md', 'canon']]);
-  const chapter = file(result, 'Book One/Chapters/Chapter 01.md');
-  assert.deepEqual(chapter.links.map(l => [l.path, l.step, l.line]), [
-    ['Book One/Characters/Mara Vell.md', 'shortest', 2], ['Book One/Places/Harbor Town.md', 'root', 2],
-    ['Book One/Places/Harbor Town.md', 'relative', 3], ['Book One/Characters/Tomas.md', 'vault-prefix', 3]]);
-  const mara = file(result, 'Book One/Characters/Mara Vell.md');
-  assert.deepEqual(mara.frontmatter, { type: 'character', name: 'Mara Vell', appears_in: '[[Book One/Chapters/Chapter 01]]',
-    relationships: ['[[Tomas]]', 'The Ferryman'] });
-  assert.deepEqual(mara.links.map(l => [l.field, l.path, l.line]), [
-    ['appears_in', 'Book One/Chapters/Chapter 01.md', 4], ['relationships', 'Book One/Characters/Tomas.md', 5]]);
-  assert.deepEqual(file(result, 'Book One/Characters/Tomas.md').links.map(l => [l.field, l.path]),
-    [['appears_in', 'Book One/Chapters/Chapter 01.md']]);
-  assert.equal(mara.bodyLine, 9);
-  assert.equal(mara.lines[8][0], 9);
-  assert.equal(mara.type, 'character');
-  // Only the unmapped paths are problems: the top-level note and both .canvas files.
-  assert.deepEqual(result.problems.map(p => [p.code, p.path]), [
-    ['R2', 'Book One/Board.canvas'], ['R2', 'Book One/Playground/Sketch.canvas'], ['R2', 'Inbox Note.md']]);
-  assert.ok(Object.isFrozen(result.files[0].links));
-});
-
-test('R1: executables, symlinks, gitlinks, blobs over 1 MiB and non-UTF-8 text are not indexed', async t => {
-  const r = repo(t, { ...BASE,
-    'Book One/Places/Run.md': { text: 'x\n', mode: 0o755 },
-    'Book One/Places/Link.md': { link: 'Harbor Town.md' },
-    'Book One/Places/Big.md': 'x'.repeat(MAX_BLOB + 1),
-    'Book One/Places/Edge.md': 'y'.repeat(MAX_BLOB),
-    'Book One/Places/Latin.md': { bytes: Buffer.from([0x63, 0x61, 0x66, 0xe9, 0x0a]) },
-    'Book One/Places/Nul.md': 'a\0b\n' });
-  git(r.repo, 'update-index', '--add', '--cacheinfo', `160000,${r.commit},Book One/Places/Sub.md`);
-  git(r.repo, 'commit', '-qm', 'gitlink');
-  const result = await readLibrary({ repo: r.repo, commit: git(r.repo, 'rev-parse', 'HEAD'), mapping: mapping() });
-  for (const name of ['Run', 'Link', 'Big', 'Latin', 'Nul', 'Sub']) {
-    assert.deepEqual(codes(result, `Book One/Places/${name}.md`), ['R1'], name);
-    assert.equal(file(result, `Book One/Places/${name}.md`), undefined, name);
-  }
-  assert.ok(file(result, 'Book One/Places/Edge.md'), 'exactly 1 MiB is read');
-});
-
-test('R2: unmapped paths are reported and not indexed', async t => {
-  const r = repo(t);
-  const result = await readLibrary({ repo: r.repo, commit: r.commit, mapping: mapping() });
-  for (const path of ['Inbox Note.md', 'Book One/Board.canvas', 'Book One/Playground/Sketch.canvas']) {
-    assert.deepEqual(codes(result, path), ['R2']);
-    assert.equal(file(result, path), undefined);
-  }
-});
-
-test('R3: front matter not fully parsed stays raw, with the line where parsing stopped', async t => {
-  const r = repo(t, { ...BASE,
-    'Book One/Places/Nested.md': ['---', 'type: place', 'coords:', '  lat: 1', '---', 'Body [[Tomas]]', ''].join('\n'),
-    'Book One/Places/Block.md': ['---', 'summary: |', '  text', '---', ''].join('\n'),
-    'Book One/Places/Open.md': ['---', 'type: place', 'never closed', ''].join('\n') });
-  const result = await readLibrary({ repo: r.repo, commit: r.commit, mapping: mapping() });
-  const nested = file(result, 'Book One/Places/Nested.md');
-  assert.deepEqual(result.problems.filter(p => p.path === 'Book One/Places/Nested.md'), [{ code: 'R3', path: 'Book One/Places/Nested.md', line: 4, message: 'front matter not fully parsed' }]);
-  assert.equal(nested.frontmatter, null);
-  assert.equal(nested.frontmatterRaw, 'type: place\ncoords:\n  lat: 1');
-  assert.deepEqual(nested.links.map(l => l.path), ['Book One/Characters/Tomas.md'], 'still indexed by body');
-  assert.equal(result.problems.find(p => p.path === 'Book One/Places/Block.md').line, 2);
-  assert.equal(result.problems.find(p => p.path === 'Book One/Places/Open.md').line, 1);
-  assert.equal(file(result, 'Book One/Places/Open.md').bodyLine, 1);
-});
-
-test('front matter forms the reader accepts and refuses', () => {
-  const parse = text => parseFrontMatter(text.split('\n'));
-  assert.deepEqual(parse('---\na: plain words\nb: "quoted: yes"\nc: \'it\'\'s\'\nd: [x, "y z", 3]\ne:\n- one\n- "[[Two]]"\nf: [[Wiki]]\ng: true\nh:\n---').frontmatter,
-    { a: 'plain words', b: 'quoted: yes', c: "it's", d: ['x', 'y z', 3], e: ['one', '[[Two]]'], f: '[[Wiki]]', g: true, h: null });
-  for (const bad of ['a: {x: 1}', 'a: &anchor x', 'a: [x, [y]]', 'a: x: y', 'a: 1\na: 2', '  a: 1', 'a: "open', '- loose'])
-    assert.notEqual(parse(`---\n${bad}\n---`).stop, null, bad);
-  assert.deepEqual(parse('no front matter'), { frontmatter: null, raw: null, bodyLine: 1, stop: null });
-});
-
-test('R4: a link to no file, to more than one, or into another repo is reported and not followed', async t => {
-  const r = repo(t, { ...BASE,
-    'Book One/Research/Notes.md': 'a\n', 'Book One/Places/Notes.md': 'b\n',
-    'Book One/Chapters/Links.md': ['[[Nobody]]', '[[Notes]]', '[[bean-brain/Journal/Today]]', '[[Tomas]]', ''].join('\n') });
-  const result = await readLibrary({ repo: r.repo, commit: r.commit, mapping: mapping() });
-  assert.deepEqual(result.problems.filter(p => p.path === 'Book One/Chapters/Links.md').map(p => [p.code, p.line]), [['R4', 1], ['R4', 2], ['R4', 3]]);
-  assert.deepEqual(file(result, 'Book One/Chapters/Links.md').links.map(l => l.path), ['Book One/Characters/Tomas.md']);
-});
-
-test('R5: a canon file that refers into the playground is reported, and the link still goes by path', async t => {
-  const r = repo(t, { ...BASE, 'Book One/Places/Dock.md': 'See [[What If]].\n' });
-  const result = await readLibrary({ repo: r.repo, commit: r.commit, mapping: mapping() });
-  assert.deepEqual(codes(result, 'Book One/Places/Dock.md'), ['R5']);
-  assert.deepEqual(file(result, 'Book One/Places/Dock.md').links.map(l => l.path), ['Book One/Playground/What If.md']);
-  // The playground file links to canon: no problem, R5 is only about canon.
-  assert.deepEqual(codes(result, 'Book One/Playground/What If.md'), []);
-});
-
-test('R6: a canon file that refers into another universe is reported; a hybrid may refer into its sources', async t => {
-  const r = repo(t, { ...BASE, 'Book One/Places/Far.md': 'Like [[Second World/Chapters/01]].\n',
-    'Crossover/Chapters/A.md': 'From [[Mara Vell]] and [[Second World/Chapters/01]].\n' });
-  const hybrid = mapping(e => { e.universes.cross = { kind: 'hybrid', name: 'Cross', sources: ['harbor', 'second'], books: ['Crossover'] }; return e; });
-  const result = await readLibrary({ repo: r.repo, commit: r.commit, mapping: hybrid });
-  assert.deepEqual(codes(result, 'Book One/Places/Far.md'), ['R6']);
-  assert.deepEqual(file(result, 'Book One/Places/Far.md').links.map(l => l.path), ['Second World/Chapters/01.md']);
-  assert.deepEqual(codes(result, 'Crossover/Chapters/A.md'), []);
-});
-
-test('R7: two paths that differ only in case are both left out', async t => {
-  const r = repo(t, BASE);
-  writeFileSync(join(r.root, 'twin'), 'twin\n');
-  const blob = git(r.repo, 'hash-object', '-w', join(r.root, 'twin'));
-  git(r.repo, 'update-index', '--add', '--cacheinfo', `100644,${blob},Book One/Characters/tomas.md`);
-  git(r.repo, 'commit', '-qm', 'case twin');
-  const result = await readLibrary({ repo: r.repo, commit: git(r.repo, 'rev-parse', 'HEAD'), mapping: mapping() });
-  for (const path of ['Book One/Characters/Tomas.md', 'Book One/Characters/tomas.md']) {
-    assert.deepEqual(codes(result, path), ['R7'], path);
-    assert.equal(file(result, path), undefined);
-  }
-});
-
-test('the reader reads the commit, never the working tree, and refuses a bad commit id', async t => {
-  const r = repo(t);
-  writeFileSync(join(r.repo, 'Book One/Places/Harbor Town.md'), 'unsaved [[Nobody]]\n');
-  writeFileSync(join(r.repo, 'Book One/Places/Untracked.md'), 'x\n');
-  const result = await readLibrary({ repo: r.repo, commit: r.commit, mapping: mapping() });
-  assert.equal(file(result, 'Book One/Places/Harbor Town.md').lines[0][1], '---');
-  assert.equal(file(result, 'Book One/Places/Untracked.md'), undefined);
-  for (const commit of ['HEAD', r.commit.slice(0, 12), '0'.repeat(40), git(r.repo, 'rev-parse', 'HEAD^{tree}')])
-    await assert.rejects(readLibrary({ repo: r.repo, commit, mapping: mapping() }), e => e instanceof LibraryError, commit);
-  await assert.rejects(readLibrary({ repo: r.repo, commit: r.commit, mapping: {} }), /library-mapping-invalid/);
-});
-
-test('a bare mirror reads the same as the clone', async t => {
-  const r = repo(t);
-  const bare = join(r.root, 'mirror.git');
-  git(r.root, 'clone', '-q', '--bare', r.repo, bare);
-  const a = await readLibrary({ repo: r.repo, commit: r.commit, mapping: mapping() });
-  const b = await readLibrary({ repo: bare, commit: r.commit, mapping: mapping() });
-  assert.deepEqual(b, a);
-});
@@ -1,80 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { renderItems, UNREADABLE } from '../src/index.mjs';
-
-const A = 'a'.repeat(40), B = 'b'.repeat(40);
-const cite = (path, lines, quote, commit = A) => ({ path, commit, lines, quote });
-const options = {
-  scopeOf: path => path.includes('/Playground/') ? 'playground' : path.endsWith('.md') ? 'canon' : undefined,
-  changed: ({ path, commit }) => path === 'Book One/Characters/Mara Vell.md' && commit === A,
-};
-const render = items => renderItems(JSON.stringify({ items }), options);
-
-// One snapshot per item kind: the plain text both channels show.
-const SNAPSHOTS = {
-  fact: [{ kind: 'fact', text: 'Tomas is the ferryman.', cites: [cite('Book One/Characters/Tomas.md', [3, 3], 'the ferryman', B)] }],
-  finding: [{ kind: 'finding', text: 'Eye colour differs.', cites: [cite('Book One/Chapters/Chapter 01.md', [41, 41], 'her grey eyes'),
-    cite('Book One/Characters/Mara Vell.md', [9, 10], 'green eyes')] }],
-  correction: [{ kind: 'correction', text: 'Chapter 1 says grey.', from: 'green eyes', to: 'grey eyes',
-    cites: [cite('Book One/Characters/Mara Vell.md', [9, 9], 'green eyes', B)] }],
-  question: [{ kind: 'question', text: 'Is the harbor north of the town?', cites: [cite('Book One/Places/Harbor Town.md', [2, 4], 'the harbor', B)] }],
-  idea: [{ kind: 'idea', text: 'A storm could close the harbor.', cites: [cite('Book One/Playground/What If.md', [5, 5], 'a storm', B),
-    { url: 'https://example.invalid/tides', quote: 'spring tides' }] }],
-};
-const EXPECTED = {
-  fact: '1. Fact: Tomas is the ferryman.\n   [canon] Book One/Characters/Tomas.md:3 @bbbbbbb "the ferryman"',
-  finding: '1. Finding: Eye colour differs.\n   [canon] Book One/Chapters/Chapter 01.md:41 @aaaaaaa "her grey eyes"\n'
-    + '   [canon] Book One/Characters/Mara Vell.md:9-10 @aaaaaaa "green eyes" (changed since)',
-  correction: '1. Correction: Chapter 1 says grey.\n   From: "green eyes"\n   To: "grey eyes"\n'
-    + '   [canon] Book One/Characters/Mara Vell.md:9 @bbbbbbb "green eyes"',
-  question: '1. Question: Is the harbor north of the town?\n   [canon] Book One/Places/Harbor Town.md:2-4 @bbbbbbb "the harbor"',
-  idea: '1. Idea: A storm could close the harbor.\n   [playground] Book One/Playground/What If.md:5 @bbbbbbb "a storm"\n'
-    + '   [web] https://example.invalid/tides "spring tides"',
-};
-
-for (const kind of Object.keys(SNAPSHOTS)) {
-  test(`renderItems snapshot: ${kind}`, () => {
-    const out = render(SNAPSHOTS[kind]);
-    assert.equal(out.kind, 'items');
-    assert.equal(out.text, EXPECTED[kind]);
-    assert.equal(out.items[0].kind, kind);
-  });
-}
-
-test('renderItems numbers several items and takes a parsed body as well as a string', () => {
-  const items = [...SNAPSHOTS.fact, ...SNAPSHOTS.question];
-  const out = renderItems({ items }, options);
-  assert.equal(out.text, `${EXPECTED.fact}\n${EXPECTED.question.replace(/^1\./, '2.')}`);
-  assert.deepEqual(out.items[1].cites[0], { badge: 'canon', path: 'Book One/Places/Harbor Town.md', commit: B, lines: [2, 4],
-    ref: 'Book One/Places/Harbor Town.md:2-4 @bbbbbbb', quote: 'the harbor', changed: false });
-});
-
-test('without options a path cite has no badge and is never marked changed', () => {
-  assert.equal(renderItems({ items: SNAPSHOTS.finding }).text,
-    '1. Finding: Eye colour differs.\n   Book One/Chapters/Chapter 01.md:41 @aaaaaaa "her grey eyes"\n'
-    + '   Book One/Characters/Mara Vell.md:9-10 @aaaaaaa "green eyes"');
-});
-
-const NOTICE_SNAPSHOTS = { 'no-cited-answer': 'No cited answer', 'no-answer': 'No answer', 'turn-failed': 'The turn failed' };
-for (const [notice, text] of Object.entries(NOTICE_SNAPSHOTS)) {
-  test(`renderItems snapshot: notice ${notice}`, () => {
-    assert.deepEqual(renderItems(JSON.stringify({ items: [], notice }), options), { kind: 'notice', notice, text });
-  });
-}
-
-test('a body without the reply shape shows a fixed line and none of its text', () => {
-  const secret = 'free prose the guard would refuse';
-  const bodies = [secret, JSON.stringify(secret), '{"items": [], "notice": "other"}', JSON.stringify({ items: [], notice: 'no-answer', extra: secret }),
-    JSON.stringify({ items: [] }), JSON.stringify({ items: [{ kind: 'story', text: secret, cites: [] }] }),
-    JSON.stringify({ items: [{ kind: 'fact', text: secret }] }), JSON.stringify({ items: SNAPSHOTS.fact, prose: secret }),
-    JSON.stringify({ items: [{ kind: 'correction', text: secret, cites: [] }] }),
-    JSON.stringify({ items: [{ kind: 'fact', text: secret, cites: [cite('a.md', [2, 1], 'q')] }] }),
-    JSON.stringify({ items: [{ kind: 'fact', text: secret, cites: [{ path: 'a.md', commit: 'abc', lines: [1, 1], quote: 'q' }] }] }),
-    JSON.stringify({ items: [{ kind: 'fact', text: secret, cites: [{ url: 'https://x.invalid', path: 'a.md', quote: 'q' }] }] }),
-    null, 42, '[]'];
-  for (const body of bodies) {
-    const out = renderItems(body, options);
-    assert.deepEqual(out, { kind: 'unreadable', text: UNREADABLE }, String(body));
-    assert.ok(!JSON.stringify(out).includes(secret));
-  }
-});
@@ -1,82 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { fileURLToPath } from 'node:url';
-import { surveyMain } from '../src/index.mjs';
-import { BASE, FIXTURES, MARKER, repo } from './helpers.mjs';
-
-const ROOT = fileURLToPath(new URL('../../..', import.meta.url));
-async function run(args) {
-  let stdout = '', stderr = '';
-  const code = await surveyMain(args, { stdout: { write: s => { stdout += s; } }, stderr: { write: s => { stderr += s; } } });
-  return { code, stdout, stderr };
-}
-// Strings from the fixture that are text, values, file names or link targets: none may be printed.
-const NEVER = [MARKER, 'Grey eyes', 'The Ferryman', 'Mara Vell', 'Tomas', 'Harbor Town', 'What If', 'Inbox Note', 'Chapter 01',
-  'Sketch', 'Board', 'Not A Link', 'the harbor', 'Docks', 'character'];
-
-test('the survey prints folder names, counts, key sets and link-form counts, and never text', async t => {
-  const r = repo(t, { ...BASE, 'Book One/Places/Odd.md': ['---', `"${MARKER} key": 1`, '---', ''].join('\n') });
-  const out = await run(['survey', r.repo]);
-  assert.equal(out.code, 0, out.stderr);
-  assert.equal(out.stdout, [
-    `commit ${r.commit}`,
-    'entries 10',
-    'folders (direct children: md canvas base other)',
-    '  (root) 1 0 0 0',
-    '  "Book One" 0 1 0 0',
-    '  "Book One/Chapters" 1 0 0 0',
-    '  "Book One/Characters" 2 0 0 0',
-    '  "Book One/Places" 2 0 0 0',
-    '  "Book One/Playground" 1 1 0 0',
-    '  "Second World/Chapters" 1 0 0 0',
-    'markdown 8 files, 8 read, 3 without front matter, 0 with front matter not fully parsed',
-    'front matter key sets',
-    '  1 [(other key)]',
-    '  1 [appears_in, name, relationships, type]',
-    '  1 [appears_in, name, type]',
-    '  1 [name]',
-    '  1 [type]',
-    'body links plain 3, label 1, heading 1, embed 0, self 0, markdown 1',
-    'field appears_in wikilink 2, name 0',
-    'field relationships wikilink 1, name 1',
-    ''].join('\n'));
-  for (const s of NEVER) assert.ok(!out.stdout.includes(s), s);
-});
-
-test('with --mapping the survey adds scope, resolver step and problem counts', async t => {
-  const r = repo(t);
-  const out = await run(['survey', r.repo, '--mapping', join(FIXTURES, 'mapping.json')]);
-  assert.equal(out.code, 0, out.stderr);
-  const tail = out.stdout.trimEnd().split('\n').slice(-3);
-  assert.deepEqual(tail, [
-    'scopes canon 5, playground 1, unmapped 3; indexed 6',
-    'resolved root 2, vault-prefix 1, relative 2, shortest 3, unresolved 0',
-    'problems R1 0, R2 3, R3 0, R4 0, R5 0, R6 0, R7 0']);
-  for (const s of NEVER) assert.ok(!out.stdout.includes(s), s);
-});
-
-test('survey exit codes: usage 4, bad mapping 3, unreadable repo 2', async t => {
-  const r = repo(t);
-  for (const args of [[], ['scan', r.repo], ['survey'], ['survey', r.repo, '--mapping'], ['survey', r.repo, '--other'], ['survey', r.repo, r.repo]])
-    assert.equal((await run(args)).code, 4, args.join(' '));
-  const bad = join(r.root, 'bad.json');
-  writeFileSync(bad, JSON.stringify({ kind: 'library' }));
-  const refused = await run(['survey', r.repo, '--mapping', bad]);
-  assert.equal(refused.code, 3);
-  assert.match(refused.stderr, /library-mapping-invalid/);
-  writeFileSync(bad, 'not json');
-  assert.equal((await run(['survey', r.repo, '--mapping', bad])).code, 3);
-  assert.equal((await run(['survey', join(r.root, 'missing')])).code, 2);
-  assert.equal((await run(['survey', r.root])).code, 2, 'a directory that is not a repo');
-});
-
-test('scripts/mosaic library survey reaches the survey', t => {
-  const r = repo(t);
-  const out = spawnSync(join(ROOT, 'scripts/mosaic'), ['library', 'survey', r.repo], { encoding: 'utf8', timeout: 30000 });
-  assert.equal(out.status, 0, out.stderr);
-  assert.match(out.stdout, new RegExp(`^commit ${r.commit}\n`));
-  assert.ok(!out.stdout.includes(MARKER));
-});
@@ -129,6 +129,45 @@ Switching the Console, bus or wrapper, changing any unit, and starting or
 stopping either service requires Mos's go for that live step. Agents build
 and test fixtures; they stop before the live sequence.

+## Sign-in in the Console (Q175 phase 1, #1690)
+
+`serve --sso [--send] [--tester-port N]` makes the Console an OpenID Connect
+relying party. It reads `console.sso` from the system config (`publicOrigin`
+and one or more providers, each with its issuer, client id, a client secret
+slot, the signing algorithms it accepts and the subjects allowed in). The
+design is `agents/sage/work/q175-sso/DESIGN.md`. `--sso` can't be combined
+with `--public-host`, `--auth-header`, `--allow-user` or `--proof-*`; `--send`
+takes `--sso` in place of the preview set.
+
+- The client secret is read once at start from
+  `<config dir>/secrets/mosaic-stack/<slot>`. The start refuses a slot that is
+  a symbolic link, not a regular file, owned by another user, has any group or
+  other mode bit, or sits in the repository, the `--checkout` directory or a
+  stack copy. The value is never printed.
+- At start the Console fetches each provider's discovery document and JWKS. A
+  provider that can't be reached (a network error, a timeout, a status other
+  than 200, or a body that isn't JSON) leaves the Console up with that
+  provider's `/auth/login` at 503 and a retry every 5 s, doubling, capped at 5
+  minutes. A document that fails a check (issuer, algorithms, S256, a usable
+  key) refuses the start. `/healthz` adds `sso: { <id>: "ready" | "unreachable"
+  | "refused" }`.
+- The Console listener serves only the Host of `publicOrigin`, whatever port
+  it listens on. Any other Host, a loopback one included, gets 403 `public
+  Host required`, except `GET /healthz`, which stays open on loopback for the
+  status and release gates. The loopback operator path in the preview section
+  above does not exist under `--sso`.
+- Without a session, `/api/*` gets 401 `sign-in required` and a page load gets
+  a 303 to `/auth/login?return=<path>`. The page then shows the signed-out line
+  with a link back to sign-in. A session lasts at most 8 hours and ends after 1
+  hour without a page load or a write; a restart ends every session.
+- The page shows Sign out only under `--sso`. It posts to `/auth/logout`, which
+  ends the session and goes to the provider's end-session endpoint when it has
+  one, or to `/auth/signed-out`.
+- With `--tester-port`, the tester listener refuses any request carrying an
+  `Authorization` header, a `__Host-mosaic_session` or `__Host-mosaic_login`
+  cookie, or an `x-authentik-*` header (403 `tester listener takes no
+  sign-in`). It never serves `/auth/*`.
+
 ## Message a role (row 76, #1570)

 ```sh
@@ -58,8 +58,9 @@ export async function chatHTTP(req, res, { path, search, chat, named, send, prev
      if (one(req, 'origin') !== preview.origin) return refuse(403, 'cross-origin');
    } else {
      if (!send || !named || !preview) return refuse(403, 'read-only');
-      if (one(req, preview.header) !== preview.user) return refuse(401, 'unauthenticated');
-      if (one(req, 'origin') !== `https://${preview.host}`) return refuse(403, 'cross-origin');
+      // Q175 phase 1 (#1690): under --sso the session was checked before this route.
+      if (preview.sso !== true && one(req, preview.header) !== preview.user) return refuse(401, 'unauthenticated');
+      if (one(req, 'origin') !== (preview.origin ?? `https://${preview.host}`)) return refuse(403, 'cross-origin');
    }
    if (one(req, 'sec-fetch-site') !== 'same-origin') return refuse(403, 'cross-site');
  }
@@ -7,20 +7,23 @@ import { views } from '../../bus/src/views.mjs';
 import { loadSystem, socketPath, REPO, rolesDir } from '../../cli/src/config.mjs';
 import { configDir } from '../../business/src/business.mjs';
 import { consoleReads, redactor } from './reads.mjs';
+import { createSso, readSlot } from './sso.mjs';
 import { statSync } from 'node:fs';
 import { isAbsolute } from 'node:path';
 import { ID_PATTERN } from '../../business/src/vocabulary.mjs';
 const args = process.argv.slice(2);
-const usage = 'node packages/webui/src/cli.mjs serve [--port N] [--tester-port N] [--checkout PATH] [--board http://127.0.0.1:7331] [--business ID] [--public-host NAME --auth-header HEADER --allow-user ID [--send] [--proof-header NAME --proof-file PATH]]';
+const usage = 'node packages/webui/src/cli.mjs serve [--port N] [--tester-port N] [--checkout PATH] [--board http://127.0.0.1:7331] [--business ID] [--sso [--send]] [--public-host NAME --auth-header HEADER --allow-user ID [--send] [--proof-header NAME --proof-file PATH]]';
 try {
  if (args.length === 1 && ['--help', '-h'].includes(args[0])) { console.log(usage); process.exit(0); }
  if (args.shift() !== 'serve') throw new Error(usage);
  const options = { board: DEFAULT_BOARD, port: 7330 }, preview = {}, proofFlags = {};
-  let sendOn = false, testerPort = null;
+  let sendOn = false, ssoOn = false, testerPort = null;
  while (args.length) {
    const flag = args.shift();
    // Row 76 (#1570): the one flag without a value.
    if (flag === '--send') { sendOn = true; continue; }
+    // Q175 phase 1 (#1690): the Console signs people in itself, from console.sso in config.json.
+    if (flag === '--sso') { ssoOn = true; continue; }
    const value = args.shift();
    if (!value) throw new Error(`missing value for ${flag}`);
    if (flag === '--port') {
@@ -51,9 +54,10 @@ try {
    else throw new Error(`unknown option: ${flag}`);
  }
  if (testerPort !== null && (testerPort === options.port || testerPort === 7332)) throw new Error('--tester-port must differ from --port and cannot be the forwarded port 7332');
+  if (ssoOn && (Object.keys(preview).length || Object.keys(proofFlags).length)) throw new Error('--sso cannot be combined with --public-host, --auth-header, --allow-user or --proof-*');
  options.preview = previewOptions(preview);
  const proof = proofOptions(proofFlags, options.preview);
-  if (sendOn && !options.preview) throw new Error('--send needs the preview mode (--public-host, --auth-header and --allow-user)');
+  if (sendOn && !options.preview && !ssoOn) throw new Error('--send needs the preview mode (--public-host, --auth-header and --allow-user) or --sso');
  // The bus views (slice 1 S5) need the system config. Without it the
  // board still serves and the bus routes answer not-configured.
  // The Queue, Business and Settings reads (row 54) need no bus; without
@@ -77,31 +81,46 @@ try {
    busLine = `Bus: ${options.business ?? 'the running bus host\'s business'}`;
  } catch (err) {
    const why = redactor({ configDir: configDir() })(err.message);
+    if (ssoOn) throw new Error(`--sso needs the system config (${why})`);
    if (sendOn) throw new Error(`--send needs the bus configured (${why})`);
    if (testerPort !== null) throw new Error(`--tester-port needs the bus configured (${why})`);
    busLine = `Bus: not configured (${why})`;
  }
  const reads = consoleReads({ root: REPO, queueRoot: options.checkout ?? REPO, system, configDir: configDir(), rolesDir: rolesDir(), business: options.business ?? null });
-  const server = await startServer({ board: options.board, port: options.port, bus, reads, preview: options.preview, proof, send, settingsWrite, projectFiles, projectFile, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite });
+  // The sign-in config is checked again here, then each slot file, before anything listens. A
+  // provider that can't be reached starts degraded; one whose discovery is refused stops the start.
+  let sso = null;
+  if (ssoOn) {
+    if (!system.console?.sso) throw new Error('--sso needs console.sso in the system config');
+    const secrets = new Map(system.console.sso.providers.map(p => [p.id, readSlot(configDir(), p, { repo: REPO, checkout: options.checkout ?? null })]));
+    sso = await createSso(system.console.sso, { secrets });
+  }
+  let server;
+  try {
+    server = await startServer({ board: options.board, port: options.port, bus, reads, preview: options.preview, sso, proof, send, settingsWrite, projectFiles, projectFile, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite });
+  } catch (err) { sso?.close(); throw err; }
  let testerServer = null;
  if (testerPort !== null) {
    const call = busCaller({ dataRoot: system.dataRoot, socket: socketPath(system.dataRoot), business: options.business ?? null, cli: TESTER_CLI });
    const testerBus = { ...views({ call }), names: () => call('names'), instances: () => call('instances'), routes: () => call('routes') };
    try {
      testerServer = await startServer({ host: '127.0.0.1', port: testerPort, board: options.board,
-        tester: true, testerProofHeader: proof?.header ?? null, testerAuthHeader: options.preview?.header ?? null, bus: testerBus, reads,
+        tester: true, testerNoSignIn: ssoOn, testerProofHeader: proof?.header ?? null, testerAuthHeader: options.preview?.header ?? null, bus: testerBus, reads,
        projectFiles: args => call('project.files', args), projectFile: args => call('project.file', args),
        instancesWrite: args => call('instances.set', args), routesWrite: args => call('routes.set', args), nameWrite: args => call('name.set', args),
        // Row 177 (#1675): the tester's own chat, through the tester CLI; 7332's stays the human's.
        chat: createChat({ call }),
      });
-    } catch (err) { await new Promise(resolve => server.close(resolve)); throw err; }
+    } catch (err) { sso?.close(); await new Promise(resolve => server.close(resolve)); throw err; }
  }
  const previewLine = options.preview ? `\nPreview: https://${options.preview.host}/ through the proxy, signed-in user from ${options.preview.header}, ${send ? 'reads and human messages to roles (--send); one line per send below' : 'read-only'}` : '';
  const proofLine = `\nProxy: proxy proof ${proof ? 'on' : 'off'}`;
+  // One line per provider: id, issuer, subject count and state. No client id, secret or sub.
+  const health = sso?.health() ?? {};
+  const ssoLines = sso ? `\nSign-in: ${sso.publicOrigin}/ (--sso), ${send ? 'reads and human writes (--send)' : 'read-only'}` + sso.summary().map(p => `\nSign-in provider: ${p.id} issuer ${p.issuer} subjects ${p.subjects} (${health[p.id]})`).join('') : '';
  const queueLine = options.checkout ? '\nQueue: read from the --checkout directory' : '';
-  console.log(`Mosaic Console: http://127.0.0.1:${server.address().port}/\nBoard: ${options.board}\n${busLine}${queueLine}${previewLine}${proofLine}${testerServer ? `\nTester Console: http://127.0.0.1:${testerServer.address().port}/ (binds the tester)` : ''}\nCtrl-C stops this server.`);
-  for (const signal of ['SIGINT', 'SIGTERM']) process.once(signal, () => { server.close(); testerServer?.close(); });
+  console.log(`Mosaic Console: http://127.0.0.1:${server.address().port}/\nBoard: ${options.board}\n${busLine}${queueLine}${previewLine}${ssoLines}${proofLine}${testerServer ? `\nTester Console: http://127.0.0.1:${testerServer.address().port}/ (binds the tester)` : ''}\nCtrl-C stops this server.`);
+  for (const signal of ['SIGINT', 'SIGTERM']) process.once(signal, () => { sso?.close(); server.close(); testerServer?.close(); });
 } catch (err) {
  console.error(`refused: ${err.message}`);
  process.exitCode = 2;
@@ -16,6 +16,11 @@
  // The first one sets body.signed-out (the listener below); after that no Console fetch is made.
  const out = () => document.body.classList.contains('signed-out');
  const signOut = () => { if (!out()) document.dispatchEvent(new Event('mosaic-signed-out')); };
+  // Q175 phase 1 (#1690): under --sso the Console itself answers a read without a session with 401
+  // `sign-in required`; that signs the page out too, and the line links to the Console's sign-in.
+  // Any other 401 stays an error. `sso` comes from /api/config.
+  let sso = false;
+  const signInRequired = (res, body) => res.status === 401 && body?.error === 'sign-in required';
  const signedOut = () => Object.assign(new Error('the sign-in proxy redirected it, so it never reached the Console'), { signedOut: true });
  const labels = { registration: 'registered', 'first-user-message': 'first message', 'tmux-pane': 'tmux pane', 'session-cwd': 'session cwd', 'workspace-git-root': 'git root' };
  const source = value => value ? `<span class="source">${esc(labels[value] || value)}</span>` : '';
@@ -110,6 +115,7 @@
    const res = await fetch(path, { cache: 'no-store', redirect: 'manual' });
    if (res.type === 'opaqueredirect') { signOut(); throw signedOut(); }
    let body; try { body = await res.json(); } catch { body = { error: `HTTP ${res.status}` }; }
+    if (signInRequired(res, body)) { sso = true; signOut(); throw signedOut(); }
    return { ok: res.ok, body };
  }
  function blockNode(b) {
@@ -304,6 +310,7 @@
    const res = await fetch(path, value === undefined ? { cache: 'no-store', redirect: 'manual' } : { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(value), redirect: 'manual' });
    if (res.type === 'opaqueredirect') { signOut(); throw signedOut(); }
    const result = await res.json();
+    if (signInRequired(res, result)) { sso = true; signOut(); throw signedOut(); }
    if (!res.ok) throw Object.assign(new Error(result.error || `HTTP ${res.status}`), { status: res.status });
    return result;
  }
@@ -452,7 +459,7 @@
  });
  // Signed out: everything drawn from a Console read goes, because none of it can be refreshed. The
  // line says so once; the send form (bus.js) keeps its draft and receipt. Reload is the way back.
-  document.addEventListener('mosaic-signed-out', () => {
+  document.addEventListener('mosaic-signed-out', e => {
    if (out()) return;
    document.body.classList.add('signed-out');
    clearTimeout(timer); convGen++;
@@ -461,9 +468,13 @@
    for (const id of ['projects', 'waiting', 'seen', 'sessions']) $(id).replaceChildren();
    $('refresh').disabled = $('pause').disabled = true;
    const line = $('signed-out');
-    line.innerHTML = '<p><b>Signed out.</b> Reload the page to sign in.</p>'; line.hidden = false;
+    line.innerHTML = sso || e.detail?.signIn
+      ? `<p><b>Signed out.</b> <a href="/auth/login?${esc(new URLSearchParams({ return: location.pathname + location.search }))}">Sign in again</a>.</p>`
+      : '<p><b>Signed out.</b> Reload the page to sign in.</p>';
+    line.hidden = false; $('sign-out').hidden = true;
    // Focus moves to the line only if what had it is gone or disabled, never out of a form being typed in.
    setTimeout(() => { const a = document.activeElement; if (!a || a === document.body || a.disabled || !a.getClientRects().length) line.focus(); });
  });
-  api('/api/config').then(config => { board = config.board; $('board-url').textContent = `Board: ${board}`; }).catch(err => { if (machine) error(err); }).finally(refresh);
+  // Sign out (sage-1347, F7): a plain same-origin form POST to /auth/logout, shown only under --sso.
+  api('/api/config').then(config => { board = config.board; $('board-url').textContent = `Board: ${board}`; if (config.sso === true) { sso = true; $('sign-out').hidden = out(); } }).catch(err => { if (machine) error(err); }).finally(refresh);
 })();
@@ -30,6 +30,10 @@
  const out = () => document.body.classList.contains('signed-out');
  const signOut = () => { if (!out()) document.dispatchEvent(new Event('mosaic-signed-out')); };
  const signedOut = () => new ReadError('signed-out', 'The sign-in proxy redirected the read.', 0);
+  // Q175 phase 1 (#1690, sage-1340 F1): under --sso a read without a session gets 401 `sign-in
+  // required` from the Console itself. That signs out the same way; any other 401 stays an error.
+  const signInRequired = (res, body) => res.status === 401 && body?.error === 'sign-in required';
+  const signOutSso = () => { if (!out()) document.dispatchEvent(new CustomEvent('mosaic-signed-out', { detail: { signIn: true } })); };
  // `replies` takes a message id as `id`; trail takes `subject`.
  async function fetchRead(verb, subject) {
    if (out()) throw signedOut();
@@ -38,6 +42,7 @@
    catch { throw new ReadError('unreachable', 'The Console server did not answer.', 0); }
    if (res.type === 'opaqueredirect') { signOut(); throw signedOut(); }
    try { body = await res.json(); } catch { throw new ReadError('unreachable', 'The Console server did not answer.', 0); }
+    if (signInRequired(res, body)) { signOutSso(); throw signedOut(); }
    if (!res.ok || !body || !Array.isArray(body.rows)) throw new ReadError(typeof body?.error === 'string' ? body.error : 'invalid-response', typeof body?.message === 'string' ? body.message : `HTTP ${res.status}`, res.status);
    return { ...body, rows: body.rows, at: body.at };
  }
@@ -50,6 +55,7 @@
    try { res = await fetch(`/api/${path}`, { cache: 'no-store', redirect: 'manual' }); } catch { throw unreachable(); }
    if (res.type === 'opaqueredirect') { signOut(); throw signedOut(); }
    try { body = await res.json(); } catch { throw unreachable(); }
+    if (signInRequired(res, body)) { signOutSso(); throw signedOut(); }
    if (!res.ok || !body || typeof body !== 'object' || Array.isArray(body)) throw Object.assign(new ReadError(typeof body?.error === 'string' ? body.error : 'invalid-response', typeof body?.message === 'string' ? body.message : `HTTP ${res.status}`, res.status), { module: true });
    return body;
  }
@@ -9,7 +9,7 @@
 <header class="cmdbar"><a href="/" class="wordmark"><svg class="mark" viewBox="0 0 16 17" aria-hidden="true"><use href="/icons.svg#mark"/></svg>Mosaic<small>Console</small></a>
 <button type="button" class="cmdk" id="cmdk" aria-haspopup="dialog" aria-controls="cmdk-dialog"><svg class="i" aria-hidden="true"><use href="/icons.svg#i-search"/></svg><span>Go to a view, decision or task</span><kbd>Ctrl K</kbd></button>
 <p class="fresh" id="fresh"><span id="fresh-board"></span><span id="fresh-bus"></span></p>
-<div class="cmd-right"><label>Palette<select id="palette"></select></label><label>Appearance<select id="mode"><option value="system">system</option><option value="light">light</option><option value="dim">dim</option><option value="dark">dark</option></select></label><button class="btn" id="refresh" type="button">Refresh</button><button class="btn" id="pause" type="button" aria-pressed="false">Pause</button></div></header>
+<div class="cmd-right"><label>Palette<select id="palette"></select></label><label>Appearance<select id="mode"><option value="system">system</option><option value="light">light</option><option value="dim">dim</option><option value="dark">dark</option></select></label><button class="btn" id="refresh" type="button">Refresh</button><button class="btn" id="pause" type="button" aria-pressed="false">Pause</button><form id="sign-out" method="post" action="/auth/logout" hidden><button class="btn" type="submit">Sign out</button></form></div></header>
 <div class="frame">
 <nav class="tree" aria-label="Console"><h2 class="tree-title">Console</h2><ul class="s1-sections" id="sections"></ul><div id="board-tree"><h2 class="tree-title">Projects</h2><div id="projects"><p class="muted">Loading projects…</p></div><p class="small muted">Select a project to filter sessions. Waiting on you always shows all projects.</p></div></nav>
 <main id="main" class="content" tabindex="-1"><div id="signed-out" class="banner ref" role="alert" tabindex="-1" hidden></div><div id="bus-down" class="banner err" role="alert" hidden></div><div class="page-head" id="board-head"><div><h1>Control board</h1><p id="status" class="small muted" role="status">Loading board…</p></div><div class="filters"><label><input id="show-machine" type="checkbox">Show machine sessions</label></div></div>
@@ -61,6 +61,8 @@ async function body(req, max = 4096) {
 // Row 65 (mos-0840) adds `routes`: each instance's harness, model, thinking and fallback.
 const BUS_VERBS = ['inbox', 'tasks', 'agents', 'trail', 'decisions', 'credentials', 'replies', 'messages', 'usage', 'limits', 'names', 'instances', 'routes'];
 const DECISION_LISTS = ['roles', 'recent'];
+// Q175 phase 1 (#1690, F8): either sign-in cookie, which the tester listener refuses under --sso.
+const SIGN_IN_COOKIE = /(?:^|;)\s*__host-mosaic_(?:session|login)\s*=/i;
 // Row 177 (#1675): the chat writes the tester listener lets through, exactly the four chatHTTP routes.
 const TESTER_CHAT_WRITE = /^\/api\/chat\/(?:projects|threads|threads\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/(?:messages|open))$/i;
 async function busRead(res, bus, verb, search) {
@@ -160,14 +162,18 @@ async function busRead(res, bus, verb, search) {
 // broker's to refuse. Nothing retries; an outcome the bus can't confirm is reported as unknown.
 const SEND_KEYS = ['to', 'body', 'in_reply_to'];
 const one = (req, name) => (req.headersDistinct[name]?.length === 1 ? req.headersDistinct[name][0] : null);
+// Q175 phase 1 (#1690): under --sso the writer comes from a session the handler already checked,
+// so it carries `sso: true` and the public origin; the preview writer still checks its header.
+const signedIn = (req, p) => p.sso === true || one(req, p.header) === p.user;
+const ownOrigin = p => p.origin ?? `https://${p.host}`;
 async function busSend(req, res, { send, preview, log }) {
-  if (one(req, preview.header) !== preview.user) return json(res, 401, { error: 'sign-in required' });
+  if (!signedIn(req, preview)) return json(res, 401, { error: 'sign-in required' });
  let to = null;
  // `to` is quoted and cut short so a crafted value can't forge a log line.
  const line = outcome => log(`${new Date().toISOString()} send user=${JSON.stringify(preview.user)} to=${typeof to === 'string' ? JSON.stringify(to.slice(0, 64)) : 'none'} ${outcome}`);
  // `sent` tells the page which it was: false, nothing was written; 'unknown', it may have been.
  const refuse = (status, error, message, sent = false) => { line(`error=${error}`); return json(res, status, { error, message, sent }); };
-  if (one(req, 'origin') !== `https://${preview.host}`) return refuse(403, 'cross-origin request refused', 'a send needs the Console\'s own Origin');
+  if (one(req, 'origin') !== ownOrigin(preview)) return refuse(403, 'cross-origin request refused', 'a send needs the Console\'s own Origin');
  if (one(req, 'sec-fetch-site') !== 'same-origin') return refuse(403, 'cross-site request refused', 'a send needs Sec-Fetch-Site: same-origin');
  let value;
  try { value = JSON.parse((await body(req, 16384)).toString('utf8')); } catch (err) { return refuse(400, 'invalid-request', err.message); }
@@ -241,10 +247,10 @@ export function proofOptions({ proofHeader, proofFile } = {}, preview = null) {
 // REQ-WEB-1: same signed-in send boundary, a distinct strict settings payload.
 async function settingsSend(req, res, { settingsWrite, preview, log }) {
  const refuse = (status, error, message) => json(res, status, { error, message, sent: false });
-  if (one(req, preview.header) !== preview.user) {
+  if (!signedIn(req, preview)) {
    return refuse(401, 'sign-in required', 'sign in again');
  }
-  if (one(req, 'origin') !== `https://${preview.host}`) {
+  if (one(req, 'origin') !== ownOrigin(preview)) {
    return refuse(403, 'cross-origin request refused', 'settings need the Console origin');
  }
  if (one(req, 'sec-fetch-site') !== 'same-origin') {
@@ -292,8 +298,8 @@ async function seatSend(req, res, { route, write, preview, log }) {
  // The instance is quoted and cut short so a crafted value can't forge a log line.
  const line = outcome => log(`${new Date().toISOString()} ${route.kind} user=${JSON.stringify(preview.user)} instance=${quoted(instance)} ${outcome}`);
  const refuse = (status, error, message, sent = false) => { line(`error=${error}`); return json(res, status, { error, message, sent }); };
-  if (!preview.tester && one(req, preview.header) !== preview.user) return json(res, 401, { error: 'sign-in required', message: 'sign in again', sent: false });
-  if (one(req, 'origin') !== (preview.origin ?? `https://${preview.host}`)) return refuse(403, 'cross-origin request refused', 'this needs the Console\'s own Origin');
+  if (!preview.tester && !signedIn(req, preview)) return json(res, 401, { error: 'sign-in required', message: 'sign in again', sent: false });
+  if (one(req, 'origin') !== ownOrigin(preview)) return refuse(403, 'cross-origin request refused', 'this needs the Console\'s own Origin');
  if (one(req, 'sec-fetch-site') !== 'same-origin') return refuse(403, 'cross-site request refused', 'this needs same-origin Fetch Metadata');
  let value;
  try { value = JSON.parse((await body(req)).toString('utf8')); } catch (err) { return refuse(400, 'invalid-request', err.message); }
@@ -335,8 +341,8 @@ async function instanceSend(req, res, { instancesWrite, preview, log }) {
  // The instance is quoted and cut short so a crafted value can't forge a log line. Vars are never logged.
  const line = outcome => log(`${new Date().toISOString()} instance user=${JSON.stringify(preview.user)} instance=${quoted(instance)} ${outcome}`);
  const refuse = (status, error, message, sent = false) => { line(`error=${error}`); return json(res, status, { error, message, sent }); };
-  if (!preview.tester && one(req, preview.header) !== preview.user) return json(res, 401, { error: 'sign-in required', message: 'sign in again', sent: false });
-  if (one(req, 'origin') !== (preview.origin ?? `https://${preview.host}`)) return refuse(403, 'cross-origin request refused', 'this needs the Console\'s own Origin');
+  if (!preview.tester && !signedIn(req, preview)) return json(res, 401, { error: 'sign-in required', message: 'sign in again', sent: false });
+  if (one(req, 'origin') !== ownOrigin(preview)) return refuse(403, 'cross-origin request refused', 'this needs the Console\'s own Origin');
  if (one(req, 'sec-fetch-site') !== 'same-origin') return refuse(403, 'cross-site request refused', 'this needs same-origin Fetch Metadata');
  let value;
  try { value = JSON.parse((await body(req, 16384)).toString('utf8')); } catch (err) { return refuse(400, 'invalid-request', err.message); }
@@ -382,8 +388,8 @@ async function routesSend(req, res, { routesWrite, preview, log }) {
  let names = [];
  const line = outcome => log(`${new Date().toISOString()} routes user=${JSON.stringify(preview.user)} instances=${quoted(names.join(','))} ${outcome}`);
  const refuse = (status, error, message, sent = false) => { line(`error=${error}`); return json(res, status, { error, message, sent }); };
-  if (!preview.tester && one(req, preview.header) !== preview.user) return json(res, 401, { error: 'sign-in required', message: 'sign in again', sent: false });
-  if (one(req, 'origin') !== (preview.origin ?? `https://${preview.host}`)) return refuse(403, 'cross-origin request refused', 'this needs the Console\'s own Origin');
+  if (!preview.tester && !signedIn(req, preview)) return json(res, 401, { error: 'sign-in required', message: 'sign in again', sent: false });
+  if (one(req, 'origin') !== ownOrigin(preview)) return refuse(403, 'cross-origin request refused', 'this needs the Console\'s own Origin');
  if (one(req, 'sec-fetch-site') !== 'same-origin') return refuse(403, 'cross-site request refused', 'this needs same-origin Fetch Metadata');
  let value;
  try { value = JSON.parse((await body(req, 16384)).toString('utf8')); } catch (err) { return refuse(400, 'invalid-request', err.message); }
@@ -420,8 +426,8 @@ async function projectFileSend(req, res, { projectSave, preview, log }) {
  const line = outcome => log(`${new Date().toISOString()} project-file user=${JSON.stringify(preview.user)} project=${quoted(target?.project)} path=${quoted(target?.path)} ${outcome}`);
  // `sent` tells the page which it was: false, nothing was written; 'unknown', it may have been.
  const refuse = (status, error, message, sent = false) => { line(`error=${error}`); return json(res, status, { error, message, sent }); };
-  if (one(req, preview.header) !== preview.user) return json(res, 401, { error: 'sign-in required', message: 'sign in again', sent: false });
-  if (one(req, 'origin') !== `https://${preview.host}`) return refuse(403, 'cross-origin request refused', 'a save needs the Console\'s own Origin');
+  if (!signedIn(req, preview)) return json(res, 401, { error: 'sign-in required', message: 'sign in again', sent: false });
+  if (one(req, 'origin') !== ownOrigin(preview)) return refuse(403, 'cross-origin request refused', 'a save needs the Console\'s own Origin');
  if (one(req, 'sec-fetch-site') !== 'same-origin') return refuse(403, 'cross-site request refused', 'a save needs same-origin Fetch Metadata');
  let value;
  try { value = JSON.parse((await body(req, FILE_SAVE_MAX)).toString('utf8')); } catch (err) { return refuse(400, 'invalid-request', err.message); }
@@ -460,13 +466,17 @@ async function projectFileRead(res, read, path, search) {
    return json(res, busStatus(code), { error: code, message: err instanceof BusReadError ? err.message : code });
  }
 }
-// `send` is the bus write (row 76): `args => Promise<{id}>`, only with the preview mode. `log`
+// `send` is the bus write (row 76): `args => Promise<{id}>`, only with the preview mode or `sso`.
+// `sso` is createSso() from sso.mjs (Q175 phase 1): the human listener signs people in itself.
+// `testerNoSignIn` makes the tester listener refuse anything that looks like a sign-in (--sso). `log`
 // takes one line per send attempt that got past sign-in; never the body. `fieldsFile` is for
 // tests; the field table is otherwise the committed packages/tasks/fields.json.
-export async function startServer({ host = '127.0.0.1', port = 7330, board = DEFAULT_BOARD, timeout = 20000, bus = null, reads = null, preview = null, tester = false, testerAuthHeader = null, proof = null, testerProofHeader = null, send = null, settingsWrite = null, projectFiles = null, projectFile = null, projectSave = null, chat = null, nameWrite = null, assistantStop = null, instancesWrite = null, routesWrite = null, log = line => console.log(line), fieldsFile = undefined } = {}) {
+export async function startServer({ host = '127.0.0.1', port = 7330, board = DEFAULT_BOARD, timeout = 20000, bus = null, reads = null, preview = null, sso = null, tester = false, testerNoSignIn = false, testerAuthHeader = null, proof = null, testerProofHeader = null, send = null, settingsWrite = null, projectFiles = null, projectFile = null, projectSave = null, chat = null, nameWrite = null, assistantStop = null, instancesWrite = null, routesWrite = null, log = line => console.log(line), fieldsFile = undefined } = {}) {
  if (!isLoopback(host)) throw new Error('refusing to bind to non-loopback host');
  if (host === 'localhost') host = '127.0.0.1';
  if (tester && preview !== null) throw new Error('tester listener cannot use preview mode');
+  if (tester && sso !== null) throw new Error('tester listener cannot use sso');
+  if (sso !== null && (preview !== null || proof !== null)) throw new Error('--sso cannot be combined with --auth-header, --allow-user or --proof-*');
  if (tester && host !== '127.0.0.1') throw new Error('tester listener must bind 127.0.0.1');
  // Row 177 (#1675): chat is allowed. The tester listener's chat binds the tester, so the bus keeps it on tester threads.
  if (tester && [send, settingsWrite, projectSave, assistantStop].some(value => value !== null)) throw new Error('tester listener permits only instance, route, name and chat writes');
@@ -476,21 +486,26 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
    throw new Error('preview mode needs --public-host, --auth-header and --allow-user together');
  }
  if (proof !== null && (preview === null || tester)) throw new Error('proxy proof needs preview mode');
-  if (send !== null && (preview === null || typeof send !== 'function')) throw new Error('--send needs the preview mode (--public-host, --auth-header and --allow-user)');
+  if (send !== null && ((preview === null && sso === null) || typeof send !== 'function')) throw new Error('--send needs the preview mode (--public-host, --auth-header and --allow-user) or --sso');
  const server = createServer(async (req, res) => {
    res.setHeader('x-content-type-options', 'nosniff');
    res.setHeader('referrer-policy', 'no-referrer');
-    res.setHeader('content-security-policy', "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; font-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'");
+    // Under --sso the Sign out form's POST is redirected to the provider's end-session endpoint, and
+    // browsers apply form-action to that redirect, so those origins (from discovery) are allowed too.
+    res.setHeader('content-security-policy', `default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; font-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'${sso ? sso.formTargets().map(o => ` ${o}`).join('') : ''}`);
    // Presence, even with an empty value: never turn the public listener into a tester ingress.
    if (!tester && Object.hasOwn(req.headers, 'x-mosaic-tester')) return json(res, 403, { error: 'tester listener required' });
    if (tester && testerAuthHeader && Object.hasOwn(req.headers, testerAuthHeader.toLowerCase())) return json(res, 403, { error: 'proxy header refused' });
    if (tester && testerProofHeader && Object.hasOwn(req.headers, testerProofHeader.toLowerCase())) return json(res, 403, { error: 'proxy proof header refused' });
+    // Under --sso the tester listener reads no cookie and takes no sign-in of any kind (design section 6).
+    if (tester && testerNoSignIn && (Object.hasOwn(req.headers, 'authorization') || SIGN_IN_COOKIE.test(req.headers.cookie ?? '') || Object.keys(req.headers).some(h => h.startsWith('x-authentik-'))))
+      return json(res, 403, { error: 'tester listener takes no sign-in' });
    let path, search;
    // Node keeps the first of repeated Host headers; a second one (a loopback Host, then NAME) is
    // never legitimate, so it is refused before any check reads the Host.
    if ((req.headersDistinct.host?.length ?? 0) > 1) return json(res, 400, { error: 'repeated Host refused' });
    // Preview mode: a request for the public name, exactly, as the proxy forwards it.
-    const named = preview !== null && (req.headers.host ?? '').toLowerCase() === preview.host;
+    const named = preview !== null ? (req.headers.host ?? '').toLowerCase() === preview.host : sso !== null && (req.headers.host ?? '').toLowerCase() === sso.publicHost;
    // The proof precedes every auth-header read, including the wrong-Host fence.
    if (proof !== null) {
      const values = req.headersDistinct[proof.header];
@@ -512,19 +527,34 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
      }
      ({ pathname: path, search } = new URL(req.url, 'http://localhost'));
    } catch { return json(res, 400, { error: 'invalid URL' }); }
+    // Under --sso the human listener serves only the public Host, whatever its port; GET /healthz
+    // alone stays open on a loopback Host for the status and release gates (Q-C).
+    if (sso !== null && !named && !(path === '/healthz' && req.method === 'GET')) return json(res, 403, { error: 'public Host required' });
    // No CORS. JSON content type and same-origin checks keep browser forms out.
-    if (req.headers.origin && req.headers.origin !== (named ? `https://${preview.host}` : `http://${req.headers.host}`)) return json(res, 403, { error: 'cross-origin request refused' });
-    if (named) {
+    if (req.headers.origin && req.headers.origin !== (named ? (sso ? sso.publicOrigin : `https://${preview.host}`) : `http://${req.headers.host}`)) return json(res, 403, { error: 'cross-origin request refused' });
+    let signer = preview;
+    if (sso !== null && named) {
+      if (path.startsWith('/auth/')) return sso.handle(req, res, path, search);
+      // Only a page load or a write keeps a session alive; the page's background reads don't (Q-D).
+      const session = path === '/healthz' ? null : sso.session(req, { touch: req.method === 'POST' || (req.method === 'GET' && !path.startsWith('/api/')) });
+      if (!session && path !== '/healthz') {
+        if (path.startsWith('/api/') || req.method !== 'GET') return json(res, 401, { error: 'sign-in required' });
+        res.writeHead(303, { location: `/auth/login?return=${encodeURIComponent(path + search)}`, 'cache-control': 'no-store' });
+        return res.end();
+      }
+      if (session) signer = { sso: true, user: session.name, host: sso.publicHost, origin: sso.publicOrigin };
+    }
+    if (named && preview !== null) {
      // One value, equal to the user id; the proxy strips client copies and sets it after sign-in.
      const values = req.headersDistinct[preview.header];
      if (!values || values.length !== 1 || values[0] !== preview.user) return json(res, 401, { error: 'sign-in required' });
    }
-    const writer = tester ? { tester: true, user: 'tester', origin: `http://127.0.0.1:${server.address().port}` } : preview;
+    const writer = tester ? { tester: true, user: 'tester', origin: `http://127.0.0.1:${server.address().port}` } : signer;
    if (tester && !['GET', 'HEAD'].includes(req.method) && !['/api/instances', '/api/routes', '/api/name'].includes(path) && !TESTER_CHAT_WRITE.test(path))
      return json(res, 403, { error: 'read-only', sent: false });
    if(path==='/api/settings'&&req.method==='POST'){
      if(!send||!settingsWrite||!named)return json(res,403,{error:'read-only',sent:false});
-      return settingsSend(req,res,{settingsWrite,preview,log});
+      return settingsSend(req,res,{settingsWrite,preview:signer,log});
    }
    if (Object.hasOwn(SEAT_ROUTES, path)) {
      if (req.method !== 'POST') return json(res, 405, { error: 'method not allowed' });
@@ -544,18 +574,18 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
    }
    if (path === '/api/project-file' && req.method === 'POST') {
      if (!send || !projectSave || !named) return json(res, 403, { error: 'read-only', sent: false });
-      return projectFileSend(req, res, { projectSave, preview, log });
+      return projectFileSend(req, res, { projectSave, preview: signer, log });
    }
    // Message sending has its own bounded payload and repeats the identity check.
    if (send && path === '/api/bus/message') {
      if (req.method !== 'POST') return json(res, 405, { error: 'method not allowed' });
-      return busSend(req, res, { send, preview, log });
+      return busSend(req, res, { send, preview: signer, log });
    }
    if (path === '/api/chat' || path.startsWith('/api/chat/')) {
      return chatHTTP(req, res, { path, search, chat, named, send, preview: writer, log });
    }
    // Nothing else but GET and HEAD gets past here in preview mode, whatever the Host.
-    if (preview !== null && req.method !== 'GET' && req.method !== 'HEAD') return json(res, 403, { error: 'read-only', message: 'the Console preview is read-only' });
+    if ((preview !== null || sso !== null) && req.method !== 'GET' && req.method !== 'HEAD') return json(res, 403, { error: 'read-only', message: 'the Console preview is read-only' });
    // The conversation routes (#1507, CHAT-02) keep their query; the board validates it.
    const conversation = path === '/api/conversations' || path === '/api/conversation';
    const allowed = path === '/api/board' || conversation ? 'GET' : ['/api/seen', '/api/reply'].includes(path) ? 'POST' : null;
@@ -607,8 +637,8 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
    if (req.method !== 'GET' && req.method !== 'HEAD') return json(res, 405, { error: 'method not allowed' });
    // `send`: the page shows the composer only where a send can pass (the public name, --send on).
    // `edit`: the editor shows Save only where a save can pass, the same test as the route's.
-    if (path === '/api/config') return json(res, 200, { board: upstream, ...(tester ? { tester: true } : {}), send: !tester && Boolean(send) && named, edit: !tester && Boolean(send) && Boolean(projectSave) && named });
-    if (path === '/healthz') return json(res, 200, { ok: true });
+    if (path === '/api/config') return json(res, 200, { board: upstream, ...(tester ? { tester: true } : {}), ...(sso ? { sso: true } : {}), send: !tester && Boolean(send) && named, edit: !tester && Boolean(send) && Boolean(projectSave) && named });
+    if (path === '/healthz') return json(res, 200, { ok: true, ...(sso ? { sso: sso.health() } : {}) });
    if (path === '/favicon.ico') { res.writeHead(204); return res.end(); }
    const file = files.get(path);
    if (!file) return json(res, 404, { error: 'not found' });
@@ -0,0 +1,75 @@
+// Q175 phase 1 (#1690): the shape of config.json's optional `console` key. The one loader,
+// scripts/mosaic-config.mjs, runs this on every read, so a bad key refuses the config for every
+// tool (design section 4, C1). The Console's --sso start runs it again before it uses the value.
+// Shape only: nothing here touches the network or a slot file. A refusal names the key path and
+// never quotes a value, so a refusal can't print a client id or a subject.
+
+// The asymmetric algorithms oauth4webapi 3.8.8 verifies (its supported(), build/index.js). No HS*
+// and no none, so a client secret can never be a signing key.
+export const ALGS = Object.freeze(['PS256', 'ES256', 'RS256', 'PS384', 'ES384', 'RS384', 'PS512', 'ES512', 'RS512', 'Ed25519', 'EdDSA', 'ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87']);
+const PROVIDER_ID = /^[a-z0-9-]{1,32}$/;
+const SLOT = /^[a-z0-9-]{1,64}$/;
+const SUB = /^[\x21-\x7e]{1,255}$/;
+const CLIENT_ID = /^[\x21-\x7e]{1,255}$/;
+// The name goes where the preview's --allow-user went (serve.mjs USER): visible ASCII, no comma.
+const NAME = /^[\x21-\x2b\x2d-\x7e]{1,64}$/;
+// The bus keeps these for the tester and the human role (section 6), so no subject can sign in as one.
+const RESERVED_NAMES = ['tester', 'human'];
+
+const object = v => typeof v === 'object' && v !== null && !Array.isArray(v);
+function refuse(where, why) {
+  throw new Error(`${where} ${why}`);
+}
+function keys(value, where, allowed, required = allowed) {
+  if (!object(value)) refuse(where, 'must be a JSON object');
+  for (const key of Object.keys(value)) if (!allowed.includes(key)) refuse(`${where}.${key}`, 'is not a supported key');
+  for (const key of required) if (!Object.hasOwn(value, key)) refuse(`${where}.${key}`, 'is required');
+}
+function httpsURL(value, where) {
+  let url;
+  if (typeof value !== 'string' || value.length > 512) refuse(where, 'must be an https URL of at most 512 characters');
+  try { url = new URL(value); } catch { refuse(where, 'must be an https URL'); }
+  if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash || value.includes('?') || value.includes('#')) {
+    refuse(where, 'must be https with no credentials, query or fragment');
+  }
+  return url;
+}
+
+// Returns the value unchanged when it passes; throws an Error naming the bad key path otherwise.
+export function checkConsole(value, where = 'console') {
+  keys(value, where, ['sso']);
+  const sso = value.sso, at = `${where}.sso`;
+  keys(sso, at, ['publicOrigin', 'providers']);
+  const origin = httpsURL(sso.publicOrigin, `${at}.publicOrigin`);
+  if (origin.origin !== sso.publicOrigin) refuse(`${at}.publicOrigin`, 'must be an https origin with no path, query, fragment or trailing slash');
+  if (!Array.isArray(sso.providers) || sso.providers.length === 0 || sso.providers.length > 8) refuse(`${at}.providers`, 'must be a list of 1 to 8 providers');
+  const ids = new Set();
+  sso.providers.forEach((p, i) => {
+    const pat = `${at}.providers[${i}]`;
+    keys(p, pat, ['id', 'issuer', 'clientId', 'clientSecret', 'algs', 'subjects']);
+    if (typeof p.id !== 'string' || !PROVIDER_ID.test(p.id)) refuse(`${pat}.id`, 'must match [a-z0-9-]{1,32}');
+    if (ids.has(p.id)) refuse(`${pat}.id`, 'repeats an earlier provider id');
+    ids.add(p.id);
+    httpsURL(p.issuer, `${pat}.issuer`);
+    if (typeof p.clientId !== 'string' || !CLIENT_ID.test(p.clientId)) refuse(`${pat}.clientId`, 'must be 1 to 255 visible characters');
+    keys(p.clientSecret, `${pat}.clientSecret`, ['slot']);
+    if (typeof p.clientSecret.slot !== 'string' || !SLOT.test(p.clientSecret.slot)) refuse(`${pat}.clientSecret.slot`, 'must match [a-z0-9-]{1,64}');
+    if (!Array.isArray(p.algs) || p.algs.length === 0) refuse(`${pat}.algs`, 'must be a non-empty list');
+    p.algs.forEach((alg, j) => {
+      if (!ALGS.includes(alg)) refuse(`${pat}.algs[${j}]`, `must be one of ${ALGS.join(', ')}; HS* and none are refused`);
+    });
+    if (new Set(p.algs).size !== p.algs.length) refuse(`${pat}.algs`, 'repeats an algorithm');
+    if (!Array.isArray(p.subjects) || p.subjects.length === 0 || p.subjects.length > 64) refuse(`${pat}.subjects`, 'must be a list of 1 to 64 subjects');
+    const subs = new Set();
+    p.subjects.forEach((s, j) => {
+      const sat = `${pat}.subjects[${j}]`;
+      keys(s, sat, ['sub', 'name']);
+      if (typeof s.sub !== 'string' || !SUB.test(s.sub)) refuse(`${sat}.sub`, 'must be 1 to 255 visible characters');
+      if (subs.has(s.sub)) refuse(`${sat}.sub`, 'repeats an earlier subject');
+      subs.add(s.sub);
+      if (typeof s.name !== 'string' || !NAME.test(s.name)) refuse(`${sat}.name`, 'must be 1 to 64 visible characters');
+      if (RESERVED_NAMES.includes(s.name.toLowerCase())) refuse(`${sat}.name`, `must not be ${RESERVED_NAMES.join(' or ')}`);
+    });
+  });
+  return value;
+}
@@ -0,0 +1,347 @@
+// Q175 phase 1 (#1690, design agents/sage/work/q175-sso/DESIGN.md): the Console as an OIDC relying
+// party. Used only by the human listener under --sso; startServer refuses it on the tester listener.
+// Every URL handed to a provider is built from the configured publicOrigin, never from a request's
+// Host. A refusal logs one fixed code and the provider id, never an exception, its message or its
+// cause: oauth4webapi's errors carry token bodies and claims there.
+import { createHash, randomBytes } from 'node:crypto';
+import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync, realpathSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join, relative, isAbsolute, resolve } from 'node:path';
+import { checkConsole } from './sso-config.mjs';
+
+// oauth4webapi loads in createSso, not here: cli.mjs imports this module on every start, and a
+// Console without --sso must not need the package (pinned-copy.test.mjs builds copies whose lock
+// installs nothing). A real copy installs it from the root lock.
+let oauth;
+
+export const SESSION_COOKIE = '__Host-mosaic_session';
+export const LOGIN_COOKIE = '__Host-mosaic_login';
+const ATTRS = 'Path=/; Secure; HttpOnly; SameSite=Lax';
+const LOGIN_MAX_AGE = 600;
+const SESSION_ABSOLUTE = 8 * 3600 * 1000, SESSION_IDLE = 3600 * 1000;
+const MAX_SESSIONS = 64, MAX_LOGINS = 32;
+const FETCH_TIMEOUT = 10000;
+const RETRY_CAP = 300000;
+const CODES = new Set(['login-record-missing', 'state-mismatch', 'auth-error-response', 'grant-failed', 'id-token-invalid', 'signature-invalid', 'alg-refused', 'issuer-mismatch', 'subject-unknown', 'discovery-failed', 'jwks-failed']);
+
+const sha256 = value => createHash('sha256').update(value).digest('hex');
+const escape = text => String(text).replace(/[&<>"']/g, c => `&#${c.charCodeAt(0)};`);
+const under = (parent, child) => { const rel = relative(parent, child); return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel)); };
+
+// The slot file holding a provider's client secret (design section 4, D1). Only the Console's --sso
+// start calls this. A refusal names the provider and the check, never the path's contents.
+export function readSlot(configDir, provider, { repo, checkout = null, copies = join(process.env.XDG_DATA_HOME || join(homedir(), '.local', 'share'), 'mosaic-stack', 'copies') } = {}) {
+  const where = `console.sso provider ${provider.id} client secret slot`;
+  const file = join(resolve(configDir), 'secrets', 'mosaic-stack', provider.clientSecret.slot);
+  let st;
+  try { st = lstatSync(file); } catch { throw new Error(`${where} is missing`); }
+  if (st.isSymbolicLink()) throw new Error(`${where} must not be a symbolic link`);
+  let fd, real, text;
+  try {
+    fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    st = fstatSync(fd);
+    if (!st.isFile()) throw new Error(`${where} must be a regular file`);
+    if (st.uid !== process.getuid()) throw new Error(`${where} must be owned by the Console's user`);
+    if (st.mode & 0o077) throw new Error(`${where} must have no group or other permission bits`);
+    real = realpathSync(file);
+    for (const root of [repo, checkout, copies].filter(Boolean)) {
+      let base;
+      try { base = realpathSync(root); } catch { base = resolve(root); }
+      if (under(base, real)) throw new Error(`${where} must not be inside the repository or a stack copy`);
+    }
+    text = readFileSync(fd, 'utf8');
+  } catch (err) {
+    throw err.message?.startsWith(where) ? err : new Error(`${where} is not readable`);
+  } finally {
+    if (fd !== undefined) closeSync(fd);
+  }
+  const secret = text.endsWith('\n') ? text.slice(0, -1) : text;
+  if (!secret || /[\r\n]/.test(secret)) throw new Error(`${where} must hold one non-empty line`);
+  return secret;
+}
+
+export function cookies(req, name) {
+  const found = [];
+  for (const part of (req.headers.cookie ?? '').split(';')) {
+    const at = part.indexOf('=');
+    if (at > 0 && part.slice(0, at).trim() === name) found.push(part.slice(at + 1).trim());
+  }
+  return found;
+}
+
+// The JWKS check at discovery, the same filter the library's key selection uses (kty, alg, use,
+// key_ops, crv; RSA at least 2048 bits), without a kid since no token is at hand yet.
+function usableKey(jwk, alg) {
+  const kty = { RS: 'RSA', PS: 'RSA', ES: 'EC', Ed: 'OKP', ML: 'AKP' }[alg.slice(0, 2)];
+  if (jwk === null || typeof jwk !== 'object' || jwk.kty !== kty) return false;
+  if (jwk.alg !== undefined && jwk.alg !== alg) return false;
+  if (jwk.use !== undefined && jwk.use !== 'sig') return false;
+  if (Array.isArray(jwk.key_ops) && !jwk.key_ops.includes('verify')) return false;
+  const crv = { ES256: 'P-256', ES384: 'P-384', ES512: 'P-521', Ed25519: 'Ed25519', EdDSA: 'Ed25519' }[alg];
+  if (crv && jwk.crv !== crv) return false;
+  if (kty === 'RSA' && (typeof jwk.n !== 'string' || Buffer.from(jwk.n, 'base64url').length * 8 < 2048)) return false;
+  return true;
+}
+
+class Unreachable extends Error {}
+class Refused extends Error {}
+const https = value => { try { return new URL(value).protocol === 'https:'; } catch { return false; } };
+
+// One provider's discovery and JWKS. Throws Unreachable (network, timeout, a status other than 200,
+// a body that isn't JSON) or Refused (a JSON document that fails a check). Q-B, design section 4.
+async function discover(p, fetchOptions) {
+  let response, text;
+  const options = () => ({ ...fetchOptions, signal: AbortSignal.timeout(FETCH_TIMEOUT) });
+  try {
+    response = await oauth.discoveryRequest(new URL(p.issuer), options());
+    if (response.status !== 200 || !/^application\/json\b/i.test(response.headers.get('content-type') ?? '')) throw new Error();
+    text = await response.text();
+    JSON.parse(text);
+  } catch { throw new Unreachable(); }
+  let as;
+  try {
+    as = await oauth.processDiscoveryResponse(new URL(p.issuer), new Response(text, { status: 200, headers: { 'content-type': 'application/json' } }));
+  } catch { throw new Refused(); }
+  if (as.issuer !== p.issuer) throw new Refused();
+  if (!Array.isArray(as.id_token_signing_alg_values_supported) || !p.algs.some(a => as.id_token_signing_alg_values_supported.includes(a))) throw new Refused();
+  if (!Array.isArray(as.code_challenge_methods_supported) || !as.code_challenge_methods_supported.includes('S256')) throw new Refused();
+  if (![as.authorization_endpoint, as.token_endpoint, as.jwks_uri].every(https)) throw new Refused();
+  if (as.end_session_endpoint !== undefined && !https(as.end_session_endpoint)) throw new Refused();
+  let jwks;
+  try {
+    const fetcher = fetchOptions[oauth.customFetch] ?? fetch;
+    const res = await fetcher(as.jwks_uri, { method: 'GET', headers: { accept: 'application/json, application/jwk-set+json' }, redirect: 'manual', signal: AbortSignal.timeout(FETCH_TIMEOUT) });
+    if (res.status !== 200) throw new Error();
+    jwks = JSON.parse(await res.text());
+  } catch { throw new Unreachable(); }
+  if (jwks === null || typeof jwks !== 'object' || !Array.isArray(jwks.keys)) throw new Refused();
+  const usable = p.algs.filter(alg => jwks.keys.some(k => usableKey(k, alg)));
+  if (!usable.length) throw new Refused();
+  return as;
+}
+
+// `config` is console.sso, checked again here; `secrets` maps provider id to its client secret
+// (readSlot). `fetch` is for tests: a fetch that trusts only the fake OP's certificate.
+// `retryFirst` is for tests too; production waits 5 s, doubling, capped at 5 minutes.
+export async function createSso(config, { secrets, fetch: customFetch = null, log = line => console.log(line), retryFirst = 5000 } = {}) {
+  checkConsole({ sso: config });
+  oauth ??= await import('oauth4webapi');
+  const publicOrigin = config.publicOrigin;
+  const publicHost = new URL(publicOrigin).host;
+  const redirectUri = `${publicOrigin}/auth/callback`;
+  const fetchOptions = customFetch ? { [oauth.customFetch]: customFetch } : {};
+  const sessions = new Map(), logins = new Map();
+  const timers = new Set();
+  let closed = false;
+  const refuse = (code, provider, extra = '') => {
+    if (!CODES.has(code)) throw new Error(`unknown sso log code ${code}`);
+    log(`${new Date().toISOString()} sso refused code=${code} provider=${provider}${extra}`);
+  };
+
+  const providers = new Map(config.providers.map(p => {
+    if (typeof secrets?.get(p.id) !== 'string') throw new Error(`console.sso provider ${p.id} has no client secret`);
+    return [p.id, {
+      config: p, state: 'unreachable', as: null, jwks: {},
+      client: { client_id: p.clientId, id_token_signed_response_alg: [...p.algs] },
+      auth: oauth.ClientSecretBasic(secrets.get(p.id)),
+      subjects: new Map(p.subjects.map(s => [s.sub, s.name])),
+    }];
+  }));
+
+  async function attempt(entry, atStart) {
+    try {
+      entry.as = await discover(entry.config, fetchOptions);
+      entry.jwks = {};
+      entry.state = 'ready';
+    } catch (err) {
+      if (err instanceof Refused) {
+        entry.state = 'refused';
+        refuse('discovery-failed', entry.config.id);
+        if (atStart) throw new Error(`console.sso provider ${entry.config.id} refused at discovery: the issuer, algorithms, S256 or JWKS check failed`);
+        return;
+      }
+      entry.state = 'unreachable';
+      refuse('discovery-failed', entry.config.id);
+      throw err;
+    }
+  }
+  function retry(entry, delay) {
+    if (closed) return;
+    const timer = setTimeout(async () => {
+      timers.delete(timer);
+      try { await attempt(entry, false); } catch { retry(entry, Math.min(delay * 2, RETRY_CAP)); }
+    }, delay);
+    timer.unref();
+    timers.add(timer);
+  }
+  for (const entry of providers.values()) {
+    try { await attempt(entry, true); } catch (err) {
+      if (!(err instanceof Unreachable)) throw err;
+      retry(entry, retryFirst);
+    }
+  }
+
+  const page = (res, status, title, html, headers = {}) => {
+    res.writeHead(status, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', ...headers });
+    res.end(`<!doctype html><meta charset="utf-8"><title>${escape(title)}</title><main style="font-family:sans-serif;max-width:32rem;margin:4rem auto"><h1>${escape(title)}</h1>${html}</main>\n`);
+  };
+  const redirect = (res, location, setCookie = []) => {
+    res.writeHead(303, { location, 'cache-control': 'no-store', ...(setCookie.length ? { 'set-cookie': setCookie } : {}) });
+    res.end();
+  };
+  const failed = (res, setCookie = []) => page(res, 403, 'Sign-in failed', '<p><a href="/auth/login">Sign in again</a></p>', setCookie.length ? { 'set-cookie': setCookie } : {});
+  const expire = name => `${name}=; ${ATTRS}; Max-Age=0`;
+  const remember = (map, key, value, cap) => {
+    while (map.size >= cap) map.delete(map.keys().next().value);
+    map.set(key, value);
+  };
+
+  // B2: only a URL on publicOrigin itself; anything else, or nothing, is publicOrigin's `/`. The
+  // Location is absolute and its origin checked again: dot segments can leave a pathname of `//host`,
+  // which as a relative Location a browser reads as another origin (webby-0019 B1, sage-1403).
+  function returnURL(ret) {
+    const home = `${publicOrigin}/`;
+    try {
+      if (typeof ret !== 'string' || !ret) return home;
+      const u = new URL(ret, publicOrigin);
+      if (u.origin !== publicOrigin) return home;
+      const out = new URL(`${publicOrigin}${u.pathname}${u.search}`);
+      return out.origin === publicOrigin ? out.href : home;
+    } catch { return home; }
+  }
+
+  async function start(res, entry, ret) {
+    const state = oauth.generateRandomState(), nonce = oauth.generateRandomNonce(), verifier = oauth.generateRandomCodeVerifier();
+    const challenge = await oauth.calculatePKCECodeChallenge(verifier);
+    const id = randomBytes(32).toString('base64url');
+    remember(logins, sha256(id), { provider: entry.config.id, state, nonce, verifier, ret: typeof ret === 'string' ? ret.slice(0, 2048) : '/', expires: Date.now() + LOGIN_MAX_AGE * 1000 }, MAX_LOGINS);
+    const url = new URL(entry.as.authorization_endpoint);
+    for (const [k, v] of Object.entries({ client_id: entry.config.clientId, response_type: 'code', scope: 'openid profile email', redirect_uri: redirectUri, state, nonce, code_challenge: challenge, code_challenge_method: 'S256' })) url.searchParams.set(k, v);
+    return redirect(res, url.href, [`${LOGIN_COOKIE}=${id}; ${ATTRS}; Max-Age=${LOGIN_MAX_AGE}`]);
+  }
+
+  function login(res, query) {
+    const asked = query.get('provider');
+    const ret = query.get('return');
+    if (asked === null && providers.size > 1) {
+      const items = [...providers.values()].map(e => `<li><a href="/auth/login?${escape(new URLSearchParams({ provider: e.config.id, ...(ret ? { return: ret } : {}) }))}">${escape(e.config.id)}</a></li>`).join('');
+      return page(res, 200, 'Sign in', `<ul>${items}</ul>`);
+    }
+    const entry = asked === null ? [...providers.values()][0] : providers.get(asked);
+    if (!entry) return page(res, 404, 'Unknown sign-in provider', '<p><a href="/auth/login">Sign in</a></p>');
+    if (entry.state !== 'ready') return page(res, 503, 'sign-in unavailable', '<p>The sign-in provider can\'t be reached. Try again shortly.</p>');
+    return start(res, entry, ret);
+  }
+
+  // Design section 1, steps 2-7. Each refusal ends here with one log line and the 403 page.
+  async function callback(res, query, req) {
+    const clear = [expire(LOGIN_COOKIE)];
+    const ids = cookies(req, LOGIN_COOKIE);
+    const key = ids.length === 1 ? sha256(ids[0]) : null;
+    const record = key === null ? undefined : logins.get(key);
+    if (key !== null) logins.delete(key);
+    // The provider comes from the record, never from the query.
+    const entry = record && providers.get(record.provider);
+    if (!record || record.expires <= Date.now() || !entry) {
+      refuse('login-record-missing', record?.provider ?? 'none');
+      return failed(res, clear);
+    }
+    const pid = entry.config.id;
+    if (entry.state !== 'ready') { refuse('discovery-failed', pid); return failed(res, clear); }
+    let params;
+    try { params = oauth.validateAuthResponse(entry.as, entry.client, query, record.state); } catch (err) {
+      refuse(err instanceof oauth.AuthorizationResponseError ? 'auth-error-response' : 'state-mismatch', pid);
+      return failed(res, clear);
+    }
+    const options = () => ({ ...fetchOptions, [oauth.jwksCache]: entry.jwks, signal: AbortSignal.timeout(FETCH_TIMEOUT) });
+    let response;
+    try { response = await oauth.authorizationCodeGrantRequest(entry.as, entry.client, entry.auth, params, redirectUri, record.verifier, options()); } catch {
+      refuse('grant-failed', pid); return failed(res, clear);
+    }
+    let result, claims;
+    try {
+      result = await oauth.processAuthorizationCodeResponse(entry.as, entry.client, response, { expectedNonce: record.nonce, requireIdToken: true });
+      claims = oauth.getValidatedIdTokenClaims(result);
+    } catch (err) {
+      refuse(err instanceof oauth.ResponseBodyError ? 'grant-failed' : 'id-token-invalid', pid);
+      return failed(res, clear);
+    }
+    // Step 5: the library skips this for a token-endpoint ID token; point 2 needs it, on the same
+    // Response object. Its throw ends the callback.
+    try { await oauth.validateApplicationLevelSignature(entry.as, response, options()); } catch (err) {
+      const fetching = !(err instanceof oauth.OperationProcessingError || err instanceof oauth.UnsupportedOperationError) || [oauth.RESPONSE_IS_NOT_CONFORM, oauth.RESPONSE_IS_NOT_JSON].includes(err.code);
+      refuse(fetching ? 'jwks-failed' : 'signature-invalid', pid);
+      return failed(res, clear);
+    }
+    // Step 6: our own checks on top of the library's.
+    let header;
+    try { header = JSON.parse(Buffer.from(result.id_token.split('.')[0], 'base64url').toString('utf8')); } catch { header = null; }
+    if (!header || !entry.config.algs.includes(header.alg)) { refuse('alg-refused', pid); return failed(res, clear); }
+    if (claims.iss !== entry.config.issuer) { refuse('issuer-mismatch', pid); return failed(res, clear); }
+    const name = typeof claims.sub === 'string' ? entry.subjects.get(claims.sub) : undefined;
+    if (name === undefined) {
+      refuse('subject-unknown', pid, ` iss=${JSON.stringify(String(claims.iss).slice(0, 255))} sub=${JSON.stringify(String(claims.sub).slice(0, 255))}`);
+      return failed(res, clear);
+    }
+    // Step 7: the session, then the return path.
+    const id = randomBytes(32).toString('base64url'), now = Date.now();
+    remember(sessions, sha256(id), { provider: pid, iss: claims.iss, sub: claims.sub, name, idToken: result.id_token, created: now, seen: now }, MAX_SESSIONS);
+    return redirect(res, returnURL(record.ret), [...clear, `${SESSION_COOKIE}=${id}; ${ATTRS}`]);
+  }
+
+  // The session for this request, or null. `touch` is true only for a page load or a write (Q-D).
+  function session(req, { touch = false } = {}) {
+    const ids = cookies(req, SESSION_COOKIE);
+    if (ids.length !== 1) return null;
+    const key = sha256(ids[0]);
+    const s = sessions.get(key);
+    if (!s) return null;
+    const now = Date.now();
+    if (now - s.created >= SESSION_ABSOLUTE || now - s.seen >= SESSION_IDLE) { sessions.delete(key); return null; }
+    if (touch) s.seen = now;
+    return s;
+  }
+
+  function logout(req, res) {
+    const one = name => (req.headersDistinct[name]?.length === 1 ? req.headersDistinct[name][0] : null);
+    if (one('origin') !== publicOrigin || one('sec-fetch-site') !== 'same-origin') {
+      return page(res, 403, 'Sign-out refused', '<p>Sign out from the Console page.</p>');
+    }
+    const ids = cookies(req, SESSION_COOKIE);
+    const key = ids.length === 1 ? sha256(ids[0]) : null;
+    const s = key === null ? undefined : sessions.get(key);
+    if (key !== null) sessions.delete(key);
+    const entry = s && providers.get(s.provider);
+    let location = `${publicOrigin}/auth/signed-out`;
+    if (entry?.as?.end_session_endpoint) {
+      const url = new URL(entry.as.end_session_endpoint);
+      url.searchParams.set('id_token_hint', s.idToken);
+      url.searchParams.set('post_logout_redirect_uri', `${publicOrigin}/auth/signed-out`);
+      url.searchParams.set('client_id', entry.config.clientId);
+      location = url.href;
+    }
+    return redirect(res, location, [expire(SESSION_COOKIE)]);
+  }
+
+  // `/auth/*` on the human listener; the caller has already checked the Host.
+  async function handle(req, res, path, search) {
+    const query = new URLSearchParams(search);
+    if (path === '/auth/logout') {
+      if (req.method !== 'POST') return page(res, 405, 'Method not allowed', '');
+      return logout(req, res);
+    }
+    if (req.method !== 'GET') return page(res, 405, 'Method not allowed', '');
+    if (path === '/auth/login') return login(res, query);
+    if (path === '/auth/callback') return callback(res, query, req);
+    if (path === '/auth/signed-out') return page(res, 200, 'Signed out', '<p><a href="/auth/login">Sign in</a></p>');
+    return page(res, 404, 'Not found', '');
+  }
+
+  return {
+    publicOrigin, publicHost, sessions, logins, handle, session, returnURL,
+    health: () => Object.fromEntries([...providers].map(([id, e]) => [id, e.state])),
+    formTargets: () => [...new Set([...providers.values()].filter(e => e.as?.end_session_endpoint).map(e => new URL(e.as.end_session_endpoint).origin))],
+    summary: () => config.providers.map(p => ({ id: p.id, issuer: p.issuer, subjects: p.subjects.length })),
+    close() { closed = true; for (const t of timers) clearTimeout(t); timers.clear(); },
+  };
+}
@@ -0,0 +1,155 @@
+// Q175 phase 1 (#1690, design section 9): a fake OpenID provider for the --sso tests. A loopback
+// https server with a self-signed certificate made in a temp dir; `op.fetch` is a fetch that trusts
+// only that certificate, so the code under test needs no insecure flag. It serves any number of
+// issuers (`/<name>/`) at once, each with discovery, a JWKS, authorization, token and end-session
+// endpoints. Keys come from node:crypto. Nothing here reaches any other host.
+import { constants, createHash, createHmac, generateKeyPairSync, randomBytes, sign } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { createServer, request } from 'node:https';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+export const b64url = value => Buffer.from(typeof value === 'string' ? value : JSON.stringify(value)).toString('base64url');
+
+export function rsaKey(kid = `rsa-${randomBytes(4).toString('hex')}`, bits = 2048) {
+  const { privateKey, publicKey } = generateKeyPairSync('rsa', { modulusLength: bits });
+  return { kid, alg: 'RS256', privateKey, jwk: { ...publicKey.export({ format: 'jwk' }), kid, use: 'sig', alg: 'RS256' } };
+}
+export function ecKey(kid = `ec-${randomBytes(4).toString('hex')}`) {
+  const { privateKey, publicKey } = generateKeyPairSync('ec', { namedCurve: 'P-256' });
+  return { kid, alg: 'ES256', privateKey, jwk: { ...publicKey.export({ format: 'jwk' }), kid, use: 'sig', alg: 'ES256' } };
+}
+export function psKey(kid = `ps-${randomBytes(4).toString('hex')}`) {
+  const k = rsaKey(kid);
+  return { ...k, alg: 'PS256', jwk: { ...k.jwk, alg: 'PS256' } };
+}
+
+// A compact JWS. `alg` HS256 uses `hmac` as the key, `none` has an empty signature.
+export function jwt(header, payload, { key = null, hmac = null } = {}) {
+  const input = `${b64url(header)}.${b64url(payload)}`;
+  let sig = '';
+  if (header.alg === 'HS256') sig = createHmac('sha256', hmac).update(input).digest('base64url');
+  else if (header.alg === 'RS256') sig = sign('sha256', Buffer.from(input), key).toString('base64url');
+  else if (header.alg === 'PS256') sig = sign('sha256', Buffer.from(input), { key, padding: constants.RSA_PKCS1_PSS_PADDING, saltLength: 32 }).toString('base64url');
+  else if (header.alg === 'ES256') sig = sign('sha256', Buffer.from(input), { key, dsaEncoding: 'ieee-p1363' }).toString('base64url');
+  return `${input}.${sig}`;
+}
+
+function certificate() {
+  const dir = mkdtempSync(join(tmpdir(), 'fake-oidc-'));
+  try {
+    const r = spawnSync('openssl', ['req', '-x509', '-newkey', 'ec', '-pkeyopt', 'ec_paramgen_curve:P-256', '-nodes', '-days', '1',
+      '-subj', '/CN=127.0.0.1', '-addext', 'subjectAltName=IP:127.0.0.1', '-keyout', join(dir, 'key.pem'), '-out', join(dir, 'cert.pem')], { encoding: 'utf8' });
+    if (r.status !== 0) throw new Error(`openssl failed: ${r.stderr}`);
+    return { key: readFileSync(join(dir, 'key.pem')), cert: readFileSync(join(dir, 'cert.pem')) };
+  } finally { rmSync(dir, { recursive: true, force: true }); }
+}
+
+// One issuer's state. `discovery` is merged over the defaults; `mode` is 'ok', 'down' (the socket is
+// destroyed) or 'html' (200 with an HTML page) for discovery.
+function issuerState(name, base, opts) {
+  const keys = opts.keys ?? [rsaKey()];
+  return {
+    name, issuer: `${base}/${name}/`, keys, retired: [], clientId: opts.clientId ?? `client-${name}`, clientSecret: opts.clientSecret ?? `secret-${name}-${randomBytes(6).toString('hex')}`,
+    discovery: opts.discovery ?? {}, mode: 'ok', jwksOverride: null, codes: new Map(), acceptTwice: false, requirePkce: true,
+    tokenRequests: [], authorizeRequests: [], jwksFetches: 0, discoveryFetches: 0,
+  };
+}
+
+export async function fakeOidc() {
+  const { key, cert } = certificate();
+  const issuers = new Map();
+  const server = createServer({ key, cert }, (req, res) => {
+    const url = new URL(req.url, 'https://127.0.0.1');
+    const [, name, ...rest] = url.pathname.split('/');
+    const iss = issuers.get(name);
+    const route = rest.join('/');
+    const json = (status, body, type = 'application/json') => { res.writeHead(status, { 'content-type': type }); res.end(typeof body === 'string' ? body : JSON.stringify(body)); };
+    if (!iss) return json(404, { error: 'no issuer' });
+    if (route === '.well-known/openid-configuration') {
+      iss.discoveryFetches++;
+      if (iss.mode === 'down') return req.socket.destroy();
+      if (iss.mode === 'html') return json(200, '<!doctype html><title>Sign in</title>', 'text/html');
+      return json(200, discovery(iss));
+    }
+    if (route === 'jwks') {
+      iss.jwksFetches++;
+      return json(200, iss.jwksOverride ?? { keys: iss.keys.map(k => k.jwk) });
+    }
+    if (route === 'authorize') { iss.authorizeRequests.push(Object.fromEntries(url.searchParams)); return json(200, { ok: true }); }
+    if (route === 'end-session') return json(200, { ok: true });
+    if (route === 'token' && req.method === 'POST') {
+      let text = '';
+      req.on('data', c => (text += c));
+      req.on('end', () => {
+        const form = new URLSearchParams(text);
+        const basic = Buffer.from((req.headers.authorization ?? '').replace(/^Basic /, ''), 'base64').toString();
+        const [id, secret] = basic.split(':').map(decodeURIComponent);
+        iss.tokenRequests.push({ form: Object.fromEntries(form), clientId: id });
+        if (id !== iss.clientId || secret !== iss.clientSecret) return json(401, { error: 'invalid_client' });
+        const grant = iss.codes.get(form.get('code'));
+        if (!grant) return json(400, { error: 'invalid_grant' });
+        if (!iss.acceptTwice) iss.codes.delete(form.get('code'));
+        if (form.get('redirect_uri') !== grant.redirectUri) return json(400, { error: 'invalid_grant', error_description: 'redirect_uri' });
+        if (iss.requirePkce && createHash('sha256').update(form.get('code_verifier') ?? '').digest('base64url') !== grant.challenge) return json(400, { error: 'invalid_grant', error_description: 'pkce' });
+        return json(200, { access_token: randomBytes(16).toString('hex'), token_type: 'Bearer', expires_in: 300, id_token: grant.idToken });
+      });
+      return;
+    }
+    return json(404, { error: 'not found' });
+  });
+  await new Promise(r => server.listen(0, '127.0.0.1', r));
+  const base = `https://127.0.0.1:${server.address().port}`;
+
+  const discovery = iss => ({
+    issuer: iss.issuer, authorization_endpoint: `${iss.issuer}authorize`, token_endpoint: `${iss.issuer}token`, jwks_uri: `${iss.issuer}jwks`,
+    end_session_endpoint: `${iss.issuer}end-session`, response_types_supported: ['code'], subject_types_supported: ['public'],
+    id_token_signing_alg_values_supported: [...new Set(iss.keys.map(k => k.alg))], code_challenge_methods_supported: ['S256'],
+    ...iss.discovery,
+  });
+
+  // A fetch over node:https that trusts only this certificate. oauth4webapi passes a Headers object
+  // and a string or URLSearchParams body.
+  const opFetch = (input, init = {}) => new Promise((resolve, reject) => {
+    const url = new URL(typeof input === 'string' ? input : input.href ?? input.url);
+    if (url.protocol !== 'https:' || url.hostname !== '127.0.0.1' || url.port !== String(server.address().port)) return reject(new TypeError(`fake OP fetch refuses ${url.origin}`));
+    const headers = Object.fromEntries(new Headers(init.headers ?? {}));
+    const body = init.body === undefined || init.body === null ? undefined : String(init.body);
+    if (body !== undefined) headers['content-length'] = Buffer.byteLength(body);
+    const req = request(url, { method: init.method ?? 'GET', headers, ca: cert, signal: init.signal }, res => {
+      const chunks = [];
+      res.on('data', c => chunks.push(c));
+      res.on('end', () => {
+        const h = new Headers();
+        for (const [k, v] of Object.entries(res.headers)) h.set(k, Array.isArray(v) ? v.join(', ') : v);
+        const response = new Response(res.statusCode === 204 ? null : Buffer.concat(chunks), { status: res.statusCode, headers: h });
+        Object.defineProperty(response, 'url', { value: url.href });
+        resolve(response);
+      });
+      res.on('error', reject);
+    });
+    req.on('error', reject);
+    req.end(body);
+  });
+
+  return {
+    base, fetch: opFetch, cert,
+    issuer(name, opts = {}) { const iss = issuerState(name, base, opts); issuers.set(name, iss); return iss; },
+    // A code for `iss` whose ID token is built from the start redirect's nonce, the claims and header
+    // overrides. `challenge` defaults to the start redirect's; `idToken` replaces the token outright.
+    grant(iss, authorizeUrl, { sub = `user-${iss.name}`, claims = {}, header = {}, key = iss.keys[0], idToken = null, challenge = null, redirectUri = null } = {}) {
+      const q = new URL(authorizeUrl).searchParams;
+      const now = Math.floor(Date.now() / 1000);
+      const payload = { iss: iss.issuer, sub, aud: iss.clientId, iat: now, exp: now + 300, nonce: q.get('nonce'), ...claims };
+      for (const [k, v] of Object.entries(payload)) if (v === undefined) delete payload[k];
+      const token = idToken ?? jwt({ alg: key.alg, kid: key.kid, typ: 'JWT', ...header }, payload, { key: key.privateKey, hmac: iss.clientSecret });
+      const code = randomBytes(12).toString('base64url');
+      iss.codes.set(code, { idToken: token, challenge: challenge ?? q.get('code_challenge'), redirectUri: redirectUri ?? q.get('redirect_uri') });
+      return { code, idToken: token, payload };
+    },
+    rotate(iss, next = rsaKey()) { iss.retired.push(...iss.keys); iss.keys = [next]; return next; },
+    close: () => new Promise(r => { server.close(r); server.closeAllConnections(); }),
+  };
+}
+
@@ -30,7 +30,7 @@ function fakeCopy(dir) {
  writeFileSync(join(copyRoot(dir), 'packages', 'webui', 'src', 'cli.mjs'), '');
  return copyRoot(dir);
 }
-const SEND_REFUSAL = /^webui-service: --send needs the preview mode \(--public-host, --auth-header and --allow-user\)$/m;
+const SEND_REFUSAL = /^webui-service: --send needs the preview mode \(--public-host, --auth-header and --allow-user\) or --sso$/m;
 const TEMPLATE = readFileSync(join(REPO, 'packages', 'webui', 'systemd', 'mosaic-webui.service.in'), 'utf8');

 // The unit as the base script renders it (row 75): the template with its four
@@ -0,0 +1,132 @@
+// Q175 phase 1 (#1690, design test 24, sage-1340 F1, sage-1347 F7): the page under --sso. A read
+// the Console answers 401 `sign-in required` signs the page out the way a proxy redirect does, and
+// the line links to /auth/login with the current path and query; any other 401 stays an error. Both
+// fetch paths in app.js and both in bus.js (fetchRead and fetchApi) do it. The Sign out form shows
+// only when /api/config says sso. The board-held.test.mjs stub, with two lists of paths: those in
+// window.__signIn answer 401 `sign-in required`, those in window.__other 401 `unauthenticated`. A
+// page URL holding `sso` gets `sso: true` added to /api/config. Poll timers fire after 150 ms.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Store } from '../../bus/src/store.mjs';
+import { Broker } from '../../bus/src/broker.mjs';
+import { views } from '../../bus/src/views.mjs';
+import { startServer } from '../src/serve.mjs';
+import { browser } from './browser.mjs';
+import { fixture, close } from './fixture.mjs';
+
+const businesses = { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'cto', delivery: 'pm' }, roles: { pm: { authority: { withinRole: ['message.send'], crossRole: [] } }, cto: { authority: { withinRole: ['message.send'], crossRole: [] } } } } };
+
+const stub = `(() => {
+  const real = window.fetch.bind(window);
+  window.__reqs = []; window.__signIn = []; window.__other = [];
+  const timeout = window.setTimeout.bind(window);
+  window.setTimeout = (f, ms, ...rest) => timeout(f, ms === 10000 ? 150 : ms, ...rest);
+  const answer = (status, body) => new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } });
+  window.fetch = async (url, init = {}) => {
+    const path = String(url).split('?')[0];
+    window.__reqs.push(path);
+    if (window.__signIn.includes(path)) return answer(401, { error: 'sign-in required' });
+    if (window.__other.includes(path)) return answer(401, { error: 'unauthenticated' });
+    if (path === '/api/config' && /sso/.test(location.search)) return answer(200, { ...(await (await real(url, init)).json()), sso: true });
+    return real(url, init);
+  };
+})();`;
+
+async function setup() {
+  const root = mkdtempSync(join(tmpdir(), 'webui-sso-browser-'));
+  const store = new Store(root), b0 = new Broker({ store, businesses });
+  b0.request(b0.bindLaunch({ business: 'demo', role: 'pm', run: 'pm-run', harness: 'pi', address: 'pm-run' }), { verb: 'role.claim' });
+  const reader = b0.bindReader({ business: 'demo' });
+  const bus = views({ call: async (verb, args = {}) => structuredClone(b0.request(reader, { verb, args })) });
+  const f = await fixture(), b = await browser({ machine: true });
+  const web = await startServer({ port: 0, board: f.boardURL, bus }), base = `http://127.0.0.1:${web.address().port}/`;
+  await b.call('Page.addScriptToEvaluateOnNewDocument', { source: stub });
+  await b.viewport(1280);
+  const wait = expr => b.evaluate(`(async()=>{for(let i=0;i<100;i++){if(${expr})return true;await new Promise(r=>setTimeout(r,50))}throw new Error('Condition timed out: '+${JSON.stringify(expr)})})()`);
+  const text = sel => b.evaluate(`document.querySelector(${JSON.stringify(sel)})?.textContent ?? null`);
+  const shown = sel => b.evaluate(`(()=>{const e=document.querySelector(${JSON.stringify(sel)});return !!e && !e.hidden && getComputedStyle(e).display !== 'none' && !!e.getClientRects().length})()`);
+  const reqs = () => b.evaluate('window.__reqs.length');
+  const settle = () => new Promise(r => setTimeout(r, 600));
+  const done = async () => { await b.close(); await close(web); await f.close(); store.close(); rmSync(root, { recursive: true, force: true }); };
+  return { b, base, wait, text, shown, reqs, settle, done };
+}
+
+const LOADED = 'document.querySelector("table.sessions [data-open=\'proj/agent1\']")';
+const LINE = 'Signed out. Sign in again.';
+
+test('a 401 sign-in required on each fetch path signs the page out with a sign-in link and stops the refresh; another 401 stays an error', { timeout: 120000 }, async () => {
+  const { b, base, wait, text, shown, reqs, settle, done } = await setup();
+  // The line, its link back to this page, the Sign out form gone, and no further fetch.
+  const out = async ret => {
+    await wait('!document.querySelector("#signed-out").hidden');
+    assert.equal(await text('#signed-out'), LINE);
+    assert.equal(await b.evaluate('document.querySelector("#signed-out a").getAttribute("href")'), `/auth/login?return=${encodeURIComponent(ret)}`);
+    assert.equal(await shown('#sign-out'), false);
+    assert.equal(await b.evaluate('document.querySelector("#refresh").disabled'), true);
+    const n = await reqs();
+    await b.evaluate('document.querySelector("#refresh").click(), true');
+    await settle();
+    assert.equal(await reqs(), n, 'the page fetched after signing out');
+  };
+  try {
+    // app.js api(): the Board read, with sso on from /api/config.
+    await b.navigate(`${base}?sso&x=1`);
+    await wait(LOADED);
+    await b.evaluate(`window.__signIn.push('/api/board'), document.querySelector('#refresh').click(), true`);
+    await out('/?sso&x=1');
+
+    // app.js getJSON: the conversation catalogue behind History.
+    await b.navigate(`${base}?sso&conv`);
+    await wait(LOADED);
+    await b.evaluate(`window.__signIn.push('/api/conversations'), document.querySelector('table.sessions [data-history="proj/agent1"]').click(), true`);
+    await out('/?sso&conv');
+
+    // app.js api(): the board POST behind Seen.
+    await b.navigate(`${base}?sso&seen`);
+    await wait(LOADED);
+    await b.evaluate(`document.querySelector('table.sessions [data-open="proj/agent1"]').click(), true`);
+    await wait('document.querySelector("#inspection [data-seen]")');
+    await b.evaluate(`window.__signIn.push('/api/seen'), document.querySelector('#inspection [data-seen]').click(), true`);
+    await out('/?sso&seen');
+
+    // bus.js fetchRead and fetchApi, on a page whose /api/config has no sso: the link comes from
+    // the 401 itself (F1).
+    await b.navigate(`${base}?read#/inbox`);
+    await wait(LOADED);
+    await b.evaluate(`window.__signIn.push('/api/bus/inbox'), document.querySelector('#refresh').click(), true`);
+    await out('/?read');
+    await b.navigate(`${base}?module`);
+    await wait(LOADED);
+    await b.evaluate(`window.__signIn.push('/api/queue'), location.hash = '#/queue', true`);
+    await out('/?module');
+
+    // Any other 401 is an error: no sign-out, and the polls go on.
+    await b.navigate(`${base}?sso&other`);
+    await wait(LOADED);
+    await b.evaluate(`window.__other.push('/api/board', '/api/bus/inbox', '/api/queue'), document.querySelector('#refresh').click(), true`);
+    await settle();
+    assert.equal(await b.evaluate('document.querySelector("#signed-out").hidden'), true);
+    assert.equal(await b.evaluate('document.body.classList.contains("signed-out")'), false);
+    const n = await reqs();
+    await settle();
+    assert.ok(await reqs() > n, 'the refresh stopped on another 401');
+    assert.equal(await shown('#sign-out'), true);
+  } finally { await done(); }
+});
+
+test('the Sign out form shows only when /api/config says sso, and posts to /auth/logout', { timeout: 120000 }, async () => {
+  const { b, base, wait, shown, done } = await setup();
+  try {
+    await b.navigate(base);
+    await wait(LOADED);
+    await new Promise(r => setTimeout(r, 300));
+    assert.equal(await shown('#sign-out'), false);
+    await b.navigate(`${base}?sso`);
+    await wait(`${LOADED} && !document.querySelector("#sign-out").hidden`);
+    assert.equal(await shown('#sign-out'), true);
+    assert.deepEqual(await b.evaluate('(() => { const f = document.querySelector("#sign-out"); return [f.method, f.getAttribute("action"), f.querySelector("button").textContent, f.querySelector("button").type]; })()'), ['post', '/auth/logout', 'Sign out', 'submit']);
+  } finally { await done(); }
+});
@@ -0,0 +1,589 @@
+// Q175 phase 1 (#1690, design agents/sage/work/q175-sso/DESIGN.md section 9): the Console as an
+// OIDC relying party (--sso). Every provider is the fake OP in helpers/fake-oidc.mjs on loopback;
+// no test reaches a real provider, the live Console or a real config or slot file. The public name
+// is console.example.test, sent only as a Host header to the test's own loopback listener. Each
+// refusal checks the status, that no session cookie was set and that the send stub never ran.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { request } from 'node:http';
+import { spawn, spawnSync } from 'node:child_process';
+import { chmodSync, mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { startServer } from '../src/serve.mjs';
+import { createSso, readSlot, SESSION_COOKIE, LOGIN_COOKIE } from '../src/sso.mjs';
+import { close } from './fixture.mjs';
+import { b64url, ecKey, fakeOidc, jwt, psKey, rsaKey } from './helpers/fake-oidc.mjs';
+
+const HOST = 'console.example.test', ORIGIN = `https://${HOST}`;
+const CLI = fileURLToPath(new URL('../src/cli.mjs', import.meta.url));
+const MSG = JSON.stringify({ to: 'coder', body: 'Please look at row 192.' });
+// Test 19: every log line any test here captured, and every token, code, state, nonce, verifier,
+// client secret and session id any test produced. The last test checks the one against the other.
+const ALL_LINES = [], PRODUCED = new Set();
+
+// node:http, not fetch: fetch can't set Host, Origin or Sec-Fetch-Site.
+function call(port, { method = 'GET', path = '/', headers = {}, body, host = HOST } = {}) {
+  return new Promise((resolve, reject) => {
+    const length = body === undefined ? {} : { 'content-length': Buffer.byteLength(body) };
+    const req = request({ host: '127.0.0.1', port, method, path, headers: { host, ...length, ...headers } }, res => {
+      let text = '';
+      res.on('data', c => (text += c));
+      res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body: text && (res.headers['content-type'] ?? '').startsWith('application/json') ? JSON.parse(text) : text }));
+    });
+    req.on('error', reject);
+    req.end(body);
+  });
+}
+const setCookies = r => [r.headers['set-cookie'] ?? []].flat();
+const sessionOf = r => setCookies(r).find(c => c.startsWith(`${SESSION_COOKIE}=`) && !c.includes('Max-Age=0'))?.split(';')[0] ?? null;
+const writeHeaders = cookie => ({ ...(cookie ? { cookie } : {}), origin: ORIGIN, 'sec-fetch-site': 'same-origin', 'content-type': 'application/json' });
+
+function providerFor(iss, extra = {}) {
+  return { id: iss.name, issuer: iss.issuer, clientId: iss.clientId, clientSecret: { slot: iss.name }, algs: [...new Set(iss.keys.map(k => k.alg))], subjects: [{ sub: `user-${iss.name}`, name: `person-${iss.name}` }], ...extra };
+}
+
+// A fake OP with `issuers`, createSso over them, and the human listener with a counting send.
+async function setup(t, { issuers = [{ name: 'a' }], provider = {}, before = null, retryFirst = 5000, server = {} } = {}) {
+  const op = await fakeOidc();
+  t.after(() => op.close());
+  const iss = issuers.map(o => op.issuer(o.name, o));
+  for (const i of iss) PRODUCED.add(i.clientSecret);
+  before?.(op, iss);
+  const config = { publicOrigin: ORIGIN, providers: iss.map(i => providerFor(i, provider[i.name] ?? {})) };
+  const lines = [];
+  const log = line => { lines.push(line); ALL_LINES.push(line); };
+  const sso = await createSso(config, { secrets: new Map(iss.map(i => [i.name, i.clientSecret])), fetch: op.fetch, log, retryFirst });
+  t.after(() => sso.close());
+  const sends = [];
+  const bus = Object.fromEntries(['inbox', 'tasks', 'agents', 'trail', 'decisions'].map(v => [v, async () => [{ verb: v }]]));
+  const web = await startServer({ port: 0, board: 'http://127.0.0.1:9', bus, sso, send: async args => { sends.push(args); return { id: 'msg-0001' }; }, log, ...server });
+  t.after(() => close(web));
+  return { op, iss, sso, port: web.address().port, lines, sends, config, bus };
+}
+
+// GET /auth/login; returns the authorize URL and the login cookie (name=value).
+async function begin(env, { provider = null, ret = null, query = null, host = HOST } = {}) {
+  const q = query ?? new URLSearchParams({ ...(provider ? { provider } : {}), ...(ret !== null ? { return: ret } : {}) }).toString();
+  const r = await call(env.port, { path: `/auth/login${q ? `?${q}` : ''}`, host });
+  assert.equal(r.status, 303, `login start: ${r.status} ${r.body}`);
+  const cookie = setCookies(r)[0].split(';')[0];
+  const location = r.headers.location;
+  const params = new URL(location).searchParams;
+  PRODUCED.add(cookie.split('=')[1]);
+  for (const k of ['state', 'nonce', 'code_challenge']) PRODUCED.add(params.get(k));
+  for (const record of env.sso.logins.values()) PRODUCED.add(record.verifier);
+  return { r, cookie, location, params };
+}
+function callback(env, begun, { code, state = begun.params.get('state'), extra = {}, cookie = begun.cookie } = {}) {
+  const q = new URLSearchParams({ ...(code !== undefined ? { code } : {}), state, ...extra });
+  return call(env.port, { path: `/auth/callback?${q}`, headers: cookie ? { cookie } : {} });
+}
+function grant(env, begun, iss, opts = {}) {
+  const g = env.op.grant(iss, begun.location, opts);
+  PRODUCED.add(g.code);
+  PRODUCED.add(g.idToken);
+  return g;
+}
+// A whole sign-in: start, a code at the OP, the callback. Returns the callback answer and the
+// session cookie (name=value) when one was set.
+async function signIn(env, { iss = env.iss[0], ret = null, opts = {} } = {}) {
+  const begun = await begin(env, { provider: env.iss.length > 1 ? iss.name : null, ret });
+  const g = grant(env, begun, iss, opts);
+  const r = await callback(env, begun, { code: g.code });
+  const session = sessionOf(r);
+  if (session) PRODUCED.add(session.split('=')[1]);
+  return { begun, g, r, session };
+}
+function refused(env, r, code) {
+  assert.equal(r.status, 403, `expected 403, got ${r.status}`);
+  assert.equal(sessionOf(r), null, 'a session cookie was set');
+  assert.equal(env.sends.length, 0, 'the send stub ran');
+  assert.ok(setCookies(r).includes(`${LOGIN_COOKIE}=; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=0`), 'the login cookie was not expired');
+  if (code) assert.match(env.lines.at(-1), new RegExp(` sso refused code=${code} provider=`), env.lines.at(-1));
+}
+
+test('positive: an RS256 provider signs in and sends one message, and the session reads', async t => {
+  const env = await setup(t);
+  assert.notEqual(env.port, 7332);
+  const { r, session } = await signIn(env, { ret: '/board?x=1' });
+  assert.equal(r.status, 303);
+  assert.equal(r.headers.location, `${ORIGIN}/board?x=1`);
+  assert.ok(session);
+  const send = await call(env.port, { method: 'POST', path: '/api/bus/message', headers: writeHeaders(session), body: MSG });
+  assert.equal(send.status, 200, JSON.stringify(send.body));
+  assert.deepEqual(env.sends, [{ to: 'coder', body: 'Please look at row 192.' }]);
+  assert.match(env.lines.at(-1), / send user="person-a" to="coder" id=msg-0001$/);
+  const read = await call(env.port, { path: '/api/bus/inbox', headers: { cookie: session } });
+  assert.equal(read.status, 200);
+  const config = await call(env.port, { path: '/api/config', headers: { cookie: session } });
+  assert.equal(config.body.sso, true);
+  assert.equal(config.body.send, true);
+});
+
+test('positive: an ES256 provider signs in and sends', async t => {
+  const env = await setup(t, { issuers: [{ name: 'e', keys: [ecKey()] }] });
+  assert.deepEqual(env.config.providers[0].algs, ['ES256']);
+  const { session } = await signIn(env);
+  assert.ok(session);
+  assert.equal((await call(env.port, { method: 'POST', path: '/api/bus/message', headers: writeHeaders(session), body: MSG })).status, 200);
+  assert.equal(env.sends.length, 1);
+});
+
+test('positive: two providers each sign in their own subjects, and one provider\'s subject is unknown to the other', async t => {
+  const env = await setup(t, { issuers: [{ name: 'a' }, { name: 'b', keys: [ecKey()] }] });
+  const list = await call(env.port, { path: '/auth/login?return=%2Fboard' });
+  assert.equal(list.status, 200);
+  assert.match(list.body, /provider=a&#38;return=%2Fboard/);
+  assert.match(list.body, /provider=b&#38;return=%2Fboard/);
+  const [a, b] = env.iss;
+  assert.ok((await signIn(env, { iss: a })).session);
+  assert.ok((await signIn(env, { iss: b })).session);
+  const names = [...env.sso.sessions.values()].map(s => s.name);
+  assert.deepEqual(names, ['person-a', 'person-b']);
+  const cross = await signIn(env, { iss: b, opts: { sub: 'user-a' } });
+  refused({ ...env, sends: [] }, cross.r, 'subject-unknown');
+});
+
+test('1: a forged x-authentik header without a cookie is 401 on the API and a sign-in redirect on a page', async t => {
+  const env = await setup(t);
+  const forged = { 'x-authentik-username': 'jason.woltje', origin: ORIGIN, 'sec-fetch-site': 'same-origin', 'content-type': 'application/json' };
+  for (const [method, path, body] of [['POST', '/api/bus/message', MSG], ['POST', '/api/settings', '{}'], ['GET', '/api/config', undefined]]) {
+    const r = await call(env.port, { method, path, headers: forged, body });
+    assert.equal(r.status, 401, `${method} ${path}`);
+    assert.deepEqual(r.body, { error: 'sign-in required' });
+  }
+  const page = await call(env.port, { path: '/', headers: forged });
+  assert.equal(page.status, 303);
+  assert.equal(page.headers.location, '/auth/login?return=%2F');
+  const deep = await call(env.port, { path: '/board?x=1' });
+  assert.equal(deep.headers.location, '/auth/login?return=%2Fboard%3Fx%3D1');
+  assert.equal(env.sends.length, 0);
+});
+
+test('2: an HS256 ID token keyed with the client secret and a real RSA kid is refused', async t => {
+  const env = await setup(t);
+  const [iss] = env.iss;
+  const { r } = await signIn(env, { opts: { header: { alg: 'HS256', kid: iss.keys[0].kid } } });
+  refused(env, r, 'id-token-invalid');
+});
+
+test('3: a wrong aud, and an aud list holding another client with no azp, are refused', async t => {
+  const env = await setup(t);
+  refused(env, (await signIn(env, { opts: { claims: { aud: 'another-client' } } })).r, 'id-token-invalid');
+  refused(env, (await signIn(env, { opts: { claims: { aud: [env.iss[0].clientId, 'another-client'] } } })).r, 'id-token-invalid');
+});
+
+test('4: a token that expired 10 minutes ago is refused', async t => {
+  const env = await setup(t);
+  const now = Math.floor(Date.now() / 1000);
+  refused(env, (await signIn(env, { opts: { claims: { iat: now - 900, exp: now - 600 } } })).r, 'id-token-invalid');
+});
+
+test('5: another issuer, and the issuer without its trailing slash, are refused', async t => {
+  const env = await setup(t);
+  const [iss] = env.iss;
+  refused(env, (await signIn(env, { opts: { claims: { iss: `${env.op.base}/other/` } } })).r, 'id-token-invalid');
+  refused(env, (await signIn(env, { opts: { claims: { iss: iss.issuer.slice(0, -1) } } })).r, 'id-token-invalid');
+});
+
+test('6: a nonce mismatch and a missing nonce are refused', async t => {
+  const env = await setup(t);
+  refused(env, (await signIn(env, { opts: { claims: { nonce: 'not-the-nonce' } } })).r, 'id-token-invalid');
+  refused(env, (await signIn(env, { opts: { claims: { nonce: undefined } } })).r, 'id-token-invalid');
+});
+
+test('7: state mismatch, no login cookie, a replay, an expired record and two login cookies are refused', async t => {
+  const env = await setup(t);
+  const [iss] = env.iss;
+  let begun = await begin(env);
+  refused(env, await callback(env, begun, { code: grant(env, begun, iss).code, state: 'wrong-state' }), 'state-mismatch');
+  begun = await begin(env);
+  refused(env, await callback(env, begun, { code: grant(env, begun, iss).code, cookie: null }), 'login-record-missing');
+  // Replay: the OP takes the code twice, so only the take-and-delete rule refuses the second callback.
+  iss.acceptTwice = true;
+  begun = await begin(env);
+  const g = grant(env, begun, iss);
+  const first = await callback(env, begun, { code: g.code });
+  assert.equal(first.status, 303);
+  PRODUCED.add(sessionOf(first).split('=')[1]);
+  refused(env, await callback(env, begun, { code: g.code }), 'login-record-missing');
+  iss.acceptTwice = false;
+  begun = await begin(env);
+  for (const record of env.sso.logins.values()) record.expires = Date.now() - 1;
+  refused(env, await callback(env, begun, { code: grant(env, begun, iss).code }), 'login-record-missing');
+  begun = await begin(env);
+  const other = await begin(env);
+  refused(env, await callback(env, begun, { code: grant(env, begun, iss).code, cookie: `${begun.cookie}; ${other.cookie}` }), 'login-record-missing');
+});
+
+test('8: the token request carries the PKCE verifier, and the OP refuses a wrong one', async t => {
+  const env = await setup(t);
+  const [iss] = env.iss;
+  const { r, begun } = await signIn(env);
+  assert.equal(r.status, 303);
+  const { form } = iss.tokenRequests.at(-1);
+  assert.equal(begun.params.get('code_challenge_method'), 'S256');
+  const { createHash } = await import('node:crypto');
+  assert.equal(createHash('sha256').update(form.code_verifier).digest('base64url'), begun.params.get('code_challenge'));
+  refused(env, (await signIn(env, { opts: { challenge: 'not-the-challenge' } })).r, 'grant-failed');
+});
+
+test('9: alg none, a changed payload under a real kid, and an unknown kid even after the refetch are refused', async t => {
+  const env = await setup(t);
+  const [iss] = env.iss;
+  // (a) alg none: the alg rule, before any signature check.
+  refused(env, (await signIn(env, { opts: { header: { alg: 'none' } } })).r, 'id-token-invalid');
+  // (b) a real kid's signature over another payload: only the signature check catches it.
+  let begun = await begin(env);
+  const real = env.op.grant(iss, begun.location);
+  PRODUCED.add(real.idToken);
+  const [h, , s] = real.idToken.split('.');
+  const forged = `${h}.${b64url({ ...real.payload, name: 'changed' })}.${s}`;
+  refused(env, await callback(env, begun, { code: grant(env, begun, iss, { idToken: forged }).code }), 'signature-invalid');
+  // (c) a key the JWKS never held, again after the cache is old enough to refetch.
+  t.mock.timers.enable({ apis: ['Date'], now: Date.now() });
+  const stranger = rsaKey('not-in-jwks');
+  refused(env, (await signIn(env, { opts: { key: stranger } })).r, 'signature-invalid');
+  const fetches = iss.jwksFetches;
+  t.mock.timers.tick(61000);
+  refused(env, (await signIn(env, { opts: { key: stranger } })).r, 'signature-invalid');
+  assert.equal(iss.jwksFetches, fetches + 1, 'no refetch');
+});
+
+test('10: a valid token for a subject not configured is 403 with one subject-unknown line', async t => {
+  const env = await setup(t);
+  const before = env.lines.length;
+  const { r } = await signIn(env, { opts: { sub: 'stranger' } });
+  refused(env, r, 'subject-unknown');
+  const added = env.lines.slice(before);
+  assert.equal(added.length, 1);
+  assert.match(added[0], new RegExp(`^\\S+ sso refused code=subject-unknown provider=a iss=${JSON.stringify(env.iss[0].issuer).replace(/[.*+?^${}()|[\]\\/]/g, '\\$&')} sub="stranger"$`));
+});
+
+test('11: start refusals: HS or none algs, reserved names, HS-only discovery, an empty JWKS, no S256, an issuer mismatch, a short RSA key', async t => {
+  const op = await fakeOidc();
+  t.after(() => op.close());
+  const start = (iss, extra = {}) => createSso({ publicOrigin: ORIGIN, providers: [providerFor(iss, extra)] }, { secrets: new Map([[iss.name, iss.clientSecret]]), fetch: op.fetch, log: l => ALL_LINES.push(l) });
+  const a = op.issuer('a');
+  PRODUCED.add(a.clientSecret);
+  for (const [extra, why] of [
+    [{ algs: ['HS256'] }, /algs\[0\] must be one of .*HS\* and none are refused/],
+    [{ algs: ['none'] }, /algs\[0\] must be one of/],
+    [{ subjects: [{ sub: 'u', name: 'tester' }] }, /subjects\[0\]\.name must not be tester or human/],
+    [{ subjects: [{ sub: 'u', name: 'Human' }] }, /subjects\[0\]\.name must not be tester or human/],
+  ]) await assert.rejects(start(a, extra), why);
+  const refusedAtDiscovery = /console\.sso provider \w+ refused at discovery/;
+  // The mosaic-preview shape: HS256 only.
+  const hs = op.issuer('hs', { discovery: { id_token_signing_alg_values_supported: ['HS256'] } });
+  await assert.rejects(start(hs, { algs: ['RS256'] }), refusedAtDiscovery);
+  const empty = op.issuer('empty');
+  empty.jwksOverride = { keys: [] };
+  await assert.rejects(start(empty), refusedAtDiscovery);
+  const plain = op.issuer('plain', { discovery: { code_challenge_methods_supported: ['plain'] } });
+  await assert.rejects(start(plain), refusedAtDiscovery);
+  const moved = op.issuer('moved');
+  moved.discovery = { issuer: `${op.base}/elsewhere/` };
+  await assert.rejects(start(moved), refusedAtDiscovery);
+  const small = op.issuer('small', { keys: [rsaKey('small', 1024)] });
+  await assert.rejects(start(small), refusedAtDiscovery);
+  // The control: the same OP and provider start.
+  const sso = await start(a);
+  assert.deepEqual(sso.health(), { a: 'ready' });
+  sso.close();
+  await assert.rejects(startServer({ port: 0, sso, preview: { host: HOST, header: 'remote-user', user: 'jason' } }), /--sso cannot be combined/);
+});
+
+test('11: slot files: a symlink, mode 0644, mode 0640 and a file under the repository are refused, and no message holds the value', t => {
+  const root = mkdtempSync(join(tmpdir(), 'webui-sso-slot-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const dir = join(root, 'config'), slots = join(dir, 'secrets', 'mosaic-stack');
+  mkdirSync(slots, { recursive: true });
+  const provider = slot => ({ id: 'a', clientSecret: { slot } });
+  const value = 'slot-value-do-not-print';
+  const opts = { repo: join(root, 'repo'), copies: join(root, 'copies') };
+  writeFileSync(join(slots, 'good'), `${value}\n`, { mode: 0o600 });
+  assert.equal(readSlot(dir, provider('good'), opts), value);
+  writeFileSync(join(root, 'target'), value, { mode: 0o600 });
+  symlinkSync(join(root, 'target'), join(slots, 'link'));
+  for (const [slot, mode] of [['wide', 0o644], ['group', 0o640]]) { writeFileSync(join(slots, slot), value); chmodSync(join(slots, slot), mode); }
+  writeFileSync(join(slots, 'two'), `${value}\nmore\n`, { mode: 0o600 });
+  writeFileSync(join(slots, 'empty'), '\n', { mode: 0o600 });
+  const cases = [
+    ['missing', /slot is missing$/, opts],
+    ['link', /must not be a symbolic link$/, opts],
+    ['wide', /must have no group or other permission bits$/, opts],
+    ['group', /must have no group or other permission bits$/, opts],
+    ['two', /must hold one non-empty line$/, opts],
+    ['empty', /must hold one non-empty line$/, opts],
+    // The config dir itself under the repository, and under a --checkout.
+    ['good', /must not be inside the repository or a stack copy$/, { ...opts, repo: root }],
+    ['good', /must not be inside the repository or a stack copy$/, { ...opts, checkout: dir }],
+    ['good', /must not be inside the repository or a stack copy$/, { ...opts, copies: dir }],
+  ];
+  for (const [slot, why, o] of cases) {
+    let err = null;
+    try { readSlot(dir, provider(slot), o); } catch (e) { err = e; }
+    assert.ok(err, `${slot} was read`);
+    assert.match(err.message, /^console\.sso provider a client secret slot /);
+    assert.match(err.message, why, slot);
+    assert.equal(err.message.includes(value), false);
+    assert.equal(err.message.includes(root), false);
+  }
+});
+
+test('11: the CLI refuses --sso with the old flags and without console.sso, and starts with a good one', async t => {
+  const root = mkdtempSync(join(tmpdir(), 'wsso-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const env = { ...process.env, MOSAIC_CONFIG: join(root, 'cfg', 'config.json'), XDG_DATA_HOME: join(root, 'xdg') };
+  for (const flags of [['--auth-header', 'remote-user'], ['--public-host', HOST], ['--allow-user', 'jason'], ['--proof-header', 'x-proof']]) {
+    const r = spawnSync(process.execPath, [CLI, 'serve', '--port', '0', '--sso', ...flags], { encoding: 'utf8', timeout: 10000, env });
+    assert.equal(r.status, 2, flags.join(' '));
+    assert.match(r.stderr, /^refused: --sso cannot be combined with --public-host, --auth-header, --allow-user or --proof-\*$/m);
+  }
+  const missing = spawnSync(process.execPath, [CLI, 'serve', '--port', '0', '--sso'], { encoding: 'utf8', timeout: 10000, env });
+  assert.equal(missing.status, 2);
+  assert.match(missing.stderr, /^refused: --sso needs the system config \(/);
+  const op = await fakeOidc();
+  t.after(() => op.close());
+  const a = op.issuer('a');
+  PRODUCED.add(a.clientSecret);
+  mkdirSync(join(root, 'cfg', 'secrets', 'mosaic-stack'), { recursive: true });
+  writeFileSync(join(root, 'ca.pem'), op.cert);
+  const base = { configVersion: 1, environment: 'development', dataRoot: join(root, 'data'), execution: { backend: 'docker', provider: 'zai', model: 'm' } };
+  writeFileSync(env.MOSAIC_CONFIG, JSON.stringify(base));
+  const noKey = spawnSync(process.execPath, [CLI, 'serve', '--port', '0', '--sso'], { encoding: 'utf8', timeout: 10000, env });
+  assert.equal(noKey.status, 2);
+  assert.match(noKey.stderr, /^refused: --sso needs console\.sso in the system config$/m);
+  writeFileSync(env.MOSAIC_CONFIG, JSON.stringify({ ...base, console: { sso: { publicOrigin: ORIGIN, providers: [providerFor(a)] } } }));
+  writeFileSync(join(root, 'cfg', 'secrets', 'mosaic-stack', 'a'), `${a.clientSecret}\n`, { mode: 0o644 });
+  const wide = spawnSync(process.execPath, [CLI, 'serve', '--port', '0', '--sso'], { encoding: 'utf8', timeout: 10000, env });
+  assert.equal(wide.status, 2);
+  assert.match(wide.stderr, /^refused: console\.sso provider a client secret slot must have no group or other permission bits$/m);
+  chmodSync(join(root, 'cfg', 'secrets', 'mosaic-stack', 'a'), 0o600);
+  // The child trusts the fake OP's certificate through NODE_EXTRA_CA_CERTS; the code under test has no flag for it.
+  const child = spawn(process.execPath, [CLI, 'serve', '--port', '0', '--sso'], { env: { ...env, NODE_EXTRA_CA_CERTS: join(root, 'ca.pem') } });
+  t.after(() => child.kill('SIGKILL'));
+  let out = '', err = '';
+  child.stderr.on('data', c => (err += c));
+  await new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error(`no start line: ${out} ${err}`)), 15000);
+    child.stdout.on('data', c => { out += c; if (out.includes('Ctrl-C')) { clearTimeout(timer); resolve(); } });
+    child.on('exit', () => { clearTimeout(timer); reject(new Error(`exited: ${err}`)); });
+  });
+  assert.match(out, new RegExp(`^Sign-in: ${ORIGIN}/ \\(--sso\\), read-only$`, 'm'));
+  assert.match(out, new RegExp(`^Sign-in provider: a issuer ${a.issuer.replace(/[.]/g, '\\.')} subjects 1 \\(ready\\)$`, 'm'));
+  assert.equal(out.includes(a.clientSecret) || err.includes(a.clientSecret), false);
+  assert.equal(out.includes(a.clientId), false);
+  const port = Number(out.match(/^Mosaic Console: http:\/\/127\.0\.0\.1:(\d+)\//m)[1]);
+  const health = await call(port, { path: '/healthz', host: `127.0.0.1:${port}` });
+  assert.deepEqual(health.body, { ok: true, sso: { a: 'ready' } });
+  child.kill('SIGTERM');
+});
+
+test('12: under --sso the tester listener refuses each kind of sign-in, has no /auth, and startServer refuses tester with sso', async t => {
+  const env = await setup(t);
+  const tester = await startServer({ port: 0, board: 'http://127.0.0.1:9', bus: env.bus, tester: true, testerNoSignIn: true, log: () => {} });
+  t.after(() => close(tester));
+  const port = tester.address().port, host = `127.0.0.1:${port}`;
+  const { session, g, begun } = await signIn(env);
+  assert.ok(session);
+  const plain = await call(port, { path: '/api/config', host });
+  assert.equal(plain.status, 200, 'control: a request with no sign-in is served');
+  for (const headers of [
+    { cookie: session },
+    { cookie: `theme=dark; ${begun.cookie}` },
+    { cookie: `${SESSION_COOKIE.toLowerCase()}=x` },
+    { authorization: `Bearer ${g.idToken}` },
+    { 'x-authentik-jwt': g.idToken },
+    { 'X-Authentik-Username': 'jason.woltje' },
+  ]) {
+    const r = await call(port, { path: '/api/config', host, headers });
+    assert.equal(r.status, 403, JSON.stringify(Object.keys(headers)));
+    assert.deepEqual(r.body, { error: 'tester listener takes no sign-in' });
+  }
+  assert.equal((await call(port, { path: '/auth/login', host })).status, 404);
+  await assert.rejects(startServer({ port: 0, tester: true, sso: env.sso }), /tester listener cannot use sso/);
+});
+
+test('13: idle and absolute expiry, logout then reuse, a cross-origin logout, and background reads that don\'t keep a session', async t => {
+  const env = await setup(t);
+  const read = cookie => call(env.port, { path: '/api/bus/inbox', headers: { cookie } });
+  const record = () => [...env.sso.sessions.values()].at(-1);
+  // Background reads don't move `seen`; a page load does.
+  let { session } = await signIn(env);
+  const old = Date.now() - 59 * 60 * 1000;
+  record().seen = old;
+  assert.equal((await read(session)).status, 200);
+  assert.equal(record().seen, old, 'a background read refreshed the session');
+  assert.equal((await call(env.port, { path: '/', headers: { cookie: session } })).status, 200);
+  assert.ok(record().seen > old, 'a page load did not refresh the session');
+  // Idle: 59 minutes of background reads, then one more past the hour.
+  record().seen = Date.now() - 61 * 60 * 1000;
+  assert.equal((await read(session)).status, 401);
+  // Absolute.
+  ({ session } = await signIn(env));
+  record().created = Date.now() - 8 * 3600 * 1000;
+  assert.equal((await call(env.port, { path: '/', headers: { cookie: session } })).headers.location, '/auth/login?return=%2F');
+  // Logout needs same-origin; refused, the session stays.
+  ({ session } = await signIn(env));
+  const cross = await call(env.port, { method: 'POST', path: '/auth/logout', headers: { cookie: session, origin: ORIGIN, 'sec-fetch-site': 'cross-site' } });
+  assert.equal(cross.status, 403);
+  assert.equal((await read(session)).status, 200);
+  const noOrigin = await call(env.port, { method: 'POST', path: '/auth/logout', headers: { cookie: session, 'sec-fetch-site': 'same-origin' } });
+  assert.equal(noOrigin.status, 403);
+  assert.equal((await read(session)).status, 200);
+  const out = await call(env.port, { method: 'POST', path: '/auth/logout', headers: { cookie: session, origin: ORIGIN, 'sec-fetch-site': 'same-origin' } });
+  assert.equal(out.status, 303);
+  const end = new URL(out.headers.location);
+  assert.equal(`${end.origin}${end.pathname}`, `${env.iss[0].issuer}end-session`);
+  assert.equal(end.searchParams.get('post_logout_redirect_uri'), `${ORIGIN}/auth/signed-out`);
+  assert.equal(end.searchParams.get('client_id'), env.iss[0].clientId);
+  assert.ok(end.searchParams.get('id_token_hint'));
+  assert.deepEqual(setCookies(out), [`${SESSION_COOKIE}=; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=0`]);
+  assert.equal((await read(session)).status, 401);
+  assert.equal((await call(env.port, { method: 'GET', path: '/auth/logout', headers: { cookie: session } })).status, 405);
+});
+
+test('13: the CSP lets the Sign out form reach the provider\'s end-session origin, and only under --sso', async t => {
+  const env = await setup(t);
+  const r = await call(env.port, { path: '/healthz', host: `127.0.0.1:${env.port}` });
+  assert.match(r.headers['content-security-policy'], new RegExp(`; form-action 'self' ${env.op.base.replace(/[.]/g, '\\.')}$`));
+  const plain = await startServer({ port: 0, board: 'http://127.0.0.1:9' });
+  t.after(() => close(plain));
+  const p = await call(plain.address().port, { path: '/healthz', host: `127.0.0.1:${plain.address().port}` });
+  assert.match(p.headers['content-security-policy'], /; form-action 'self'$/);
+});
+
+test('14: open redirects land on /, and a path on the Console lands there', async t => {
+  const env = await setup(t);
+  for (const [query, where] of [
+    ['return=%2F%2Fevil.example', `${ORIGIN}/`],
+    ['return=https%3A%2F%2Fevil.example', `${ORIGIN}/`],
+    ['return=%2F%5Cevil.example', `${ORIGIN}/`],
+    ['return=/%09/evil.example', `${ORIGIN}/`],
+    // Dot segments that leave a pathname of //evil.example stay on the Console (webby-0019 B1).
+    ['return=%2F.%2F%2Fevil.example', `${ORIGIN}//evil.example`],
+    ['return=%2Fx%2F..%2F%2Fevil.example', `${ORIGIN}//evil.example`],
+    [`return=${encodeURIComponent(`${ORIGIN}//evil.example`)}`, `${ORIGIN}//evil.example`],
+    ['return=%2Fboard%2F.%2Fx', `${ORIGIN}/board/x`],
+    ['return=%2Fboard%3Fx%3D1', `${ORIGIN}/board?x=1`],
+    ['', `${ORIGIN}/`],
+  ]) {
+    const begun = await begin(env, { query });
+    const r = await callback(env, begun, { code: grant(env, begun, env.iss[0]).code });
+    assert.equal(r.status, 303);
+    assert.equal(r.headers.location, where, query);
+    assert.equal(new URL(r.headers.location).origin, ORIGIN, query);
+    PRODUCED.add(sessionOf(r).split('=')[1]);
+  }
+});
+
+test('15: a callback for A carrying B\'s code and iss, and a provider= query, is refused', async t => {
+  const env = await setup(t, { issuers: [{ name: 'a' }, { name: 'b' }] });
+  const [, b] = env.iss;
+  for (const extra of [{ iss: b.issuer, provider: 'b' }, { provider: 'b' }]) {
+    const begun = await begin(env, { provider: 'a' });
+    // B's code against A's PKCE challenge and nonce, for B's own subject: only the record rule
+    // (this callback belongs to A) stands in the way.
+    const g = grant(env, begun, b, { sub: 'user-b' });
+    const r = await callback(env, begun, { code: g.code, extra });
+    refused(env, r);
+  }
+  assert.equal(b.tokenRequests.length, 0, 'B\'s token endpoint was called');
+});
+
+test('16: a provider with RS256 and ES256 takes either, and refuses PS256 with a usable PS256 key in the JWKS', async t => {
+  const rsa = rsaKey(), ec = ecKey(), ps = psKey();
+  const env = await setup(t, { issuers: [{ name: 'a', keys: [rsa, ec, ps] }], provider: { a: { algs: ['RS256', 'ES256'] } } });
+  assert.ok((await signIn(env, { opts: { key: rsa } })).session);
+  assert.ok((await signIn(env, { opts: { key: ec } })).session);
+  refused(env, (await signIn(env, { opts: { key: ps } })).r, 'id-token-invalid');
+});
+
+test('17: 33 started logins leave 32 records, and the first one\'s callback finds none', async t => {
+  const env = await setup(t);
+  const first = await begin(env);
+  for (let i = 0; i < 32; i++) await begin(env);
+  assert.equal(env.sso.logins.size, 32);
+  refused(env, await callback(env, first, { code: grant(env, first, env.iss[0]).code }), 'login-record-missing');
+});
+
+test('18: after a key rotation a sign-in works through one refetch, and the removed kid is refused', async t => {
+  const env = await setup(t);
+  const [iss] = env.iss;
+  t.mock.timers.enable({ apis: ['Date'], now: Date.now() });
+  const old = iss.keys[0];
+  assert.ok((await signIn(env)).session);
+  const fetches = iss.jwksFetches;
+  env.op.rotate(iss);
+  t.mock.timers.tick(61000);
+  assert.ok((await signIn(env)).session);
+  assert.equal(iss.jwksFetches, fetches + 1);
+  refused(env, (await signIn(env, { opts: { key: old } })).r, 'signature-invalid');
+});
+
+test('20 and 21: the store holds no raw session id, and the cookie strings are exact', async t => {
+  const env = await setup(t);
+  const begun = await begin(env);
+  assert.match(setCookies(begun.r)[0], new RegExp(`^${LOGIN_COOKIE}=[A-Za-z0-9_-]{43}; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=600$`));
+  for (const key of env.sso.logins.keys()) assert.match(key, /^[0-9a-f]{64}$/);
+  const r = await callback(env, begun, { code: grant(env, begun, env.iss[0]).code });
+  const set = setCookies(r);
+  assert.equal(set.length, 2);
+  assert.equal(set[0], `${LOGIN_COOKIE}=; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=0`);
+  assert.match(set[1], new RegExp(`^${SESSION_COOKIE}=[A-Za-z0-9_-]{43}; Path=/; Secure; HttpOnly; SameSite=Lax$`));
+  const id = set[1].split(';')[0].split('=')[1];
+  PRODUCED.add(id);
+  for (const [key, value] of env.sso.sessions) {
+    assert.match(key, /^[0-9a-f]{64}$/);
+    assert.notEqual(key, id);
+    assert.equal(JSON.stringify(value).includes(id), false);
+  }
+});
+
+test('22: a loopback Host is 403 on a page, a read and a write; /healthz on loopback is 200; a redirect_uri never comes from the Host', async t => {
+  const env = await setup(t);
+  const { session } = await signIn(env);
+  const loop = `127.0.0.1:${env.port}`;
+  for (const [method, path, body] of [['GET', '/', undefined], ['GET', '/api/board', undefined], ['GET', '/api/bus/inbox', undefined], ['POST', '/api/bus/message', MSG]]) {
+    // A loopback Host on this listener's port; any other Host is already the older non-local refusal.
+    for (const host of [loop, `localhost:${env.port}`]) {
+      const r = await call(env.port, { method, path, host, body, headers: { cookie: session, 'content-type': 'application/json' } });
+      assert.equal(r.status, 403, `${method} ${path} ${host}`);
+      assert.deepEqual(r.body, { error: 'public Host required' });
+    }
+  }
+  const health = await call(env.port, { path: '/healthz', host: loop });
+  assert.equal(health.status, 200);
+  assert.deepEqual(health.body, { ok: true, sso: { a: 'ready' } });
+  assert.equal(env.sends.length, 0);
+  const begun = await begin(env, { host: HOST.toUpperCase() });
+  assert.equal(begun.params.get('redirect_uri'), `${ORIGIN}/auth/callback`);
+});
+
+test('23: a provider down at start leaves the Console up and 503, and the retry makes sign-in work', async t => {
+  let env = await setup(t, { retryFirst: 50, before: (op, [a]) => { a.mode = 'down'; } });
+  assert.equal((await call(env.port, { path: '/auth/login' })).status, 503);
+  assert.deepEqual((await call(env.port, { path: '/healthz', host: `127.0.0.1:${env.port}` })).body.sso, { a: 'unreachable' });
+  assert.match(env.lines.at(-1), / sso refused code=discovery-failed provider=a$/);
+  env.iss[0].mode = 'ok';
+  for (let i = 0; i < 100 && env.sso.health().a !== 'ready'; i++) await new Promise(r => setTimeout(r, 20));
+  assert.deepEqual(env.sso.health(), { a: 'ready' });
+  assert.ok((await signIn(env)).session);
+  // A 200 HTML page at the discovery URL is unreachable too, and the Console starts.
+  env = await setup(t, { before: (op, [a]) => { a.mode = 'html'; } });
+  assert.deepEqual(env.sso.health(), { a: 'unreachable' });
+  // HS-only discovery at start refuses the start.
+  await assert.rejects(setup(t, { before: (op, [a]) => { a.discovery = { id_token_signing_alg_values_supported: ['HS256'] }; } }), /refused at discovery/);
+});
+
+test('19: no captured log line holds a token, code, state, nonce, verifier, client secret or session id', () => {
+  assert.ok(ALL_LINES.length > 20, `only ${ALL_LINES.length} lines`);
+  assert.ok(PRODUCED.size > 50, `only ${PRODUCED.size} values`);
+  for (const line of ALL_LINES) {
+    for (const value of PRODUCED) if (value) assert.equal(line.includes(value), false, `a log line holds a produced value: ${line.slice(0, 80)}`);
+    assert.match(line, /^\S+ (sso refused code=[a-z-]+ provider=[a-z0-9-]+( iss="[^"]*" sub="[^"]*")?|send user="[^"]+" to="[^"]*" (id=msg-0001|error=[a-z -]+))$/, line);
+  }
+});
@@ -34,12 +34,6 @@ if [ "${1:-}" = business ]; then
  shift
  exec node "$REPO/packages/business/src/cli.mjs" "$@"
 fi
-# `mosaic library survey`: names and counts from a writing repo, never its text
-# (packages/library/README.md). Other library verbs are bus verbs.
-if [ "${1:-}" = library ] && [ "${2:-}" = survey ]; then
-  shift
-  exec node "$REPO/packages/library/src/survey.mjs" "$@"
-fi
 case "${1:-}" in
  usage|project|limits|inbox|decide|tasks|agents|trail|talk|stop|launches|bus|plugins|name|names|follow|threads|thread) exec node "$REPO/packages/cli/src/cli.mjs" "$@" ;;
 esac
@@ -26,6 +26,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import process from "node:process";
+import { pathToFileURL } from "node:url";

 const SUPPORTED_CONFIG_VERSION = 1;
 const SUPPORTED_ENVIRONMENTS = new Set(["development", "production"]);
@@ -106,13 +107,30 @@ function isAncestorOf(ancestor, candidate) {
  return rel !== "" && !rel.startsWith("..") && !path.isAbsolute(rel);
 }

-function validate(document, file) {
+// Q175 phase 1 (#1690): the optional `console` key, checked for shape only by the Console's own
+// checker. It is imported only when the key is there, so a config without it never needs the
+// Console's code, and a copy of this file alone still reads one.
+async function validateConsole(value) {
+  let checkConsole;
+  try {
+    ({ checkConsole } = await import(pathToFileURL(path.join(import.meta.dirname, "..", "packages", "webui", "src", "sso-config.mjs")).href));
+  } catch {
+    fail(2, 'the "console" key needs packages/webui/src/sso-config.mjs beside this loader');
+  }
+  try {
+    return checkConsole(value);
+  } catch (error) {
+    fail(2, error.message);
+  }
+}
+
+async function validate(document, file) {
  if (!isPlainObject(document)) {
    fail(2, "configuration must be a JSON object");
  }
  rejectUnknownKeys(
    document,
-    ["configVersion", "environment", "dataRoot", "execution"],
+    ["configVersion", "environment", "dataRoot", "execution", "console"],
    "configuration",
  );

@@ -146,6 +164,10 @@ function validate(document, file) {
    fail(2, `unsupported execution.adapter: ${JSON.stringify(adapter)} (supported: ${[...SUPPORTED_ADAPTERS].join(", ")})`);
  }

+  // Last, so the older checks keep their order. The key is in the output only when the file has
+  // it, so a config without it prints what it always printed.
+  const consoleKey = Object.hasOwn(document, "console") ? await validateConsole(document.console) : undefined;
+
  return {
    configVersion: document.configVersion,
    environment: document.environment,
@@ -156,10 +178,11 @@ function validate(document, file) {
      model: document.execution.model,
      adapter,
    },
+    ...(consoleKey === undefined ? {} : { console: consoleKey }),
  };
 }

-function load(file) {
+async function load(file) {
  const raw = readRaw(file);
  if (raw === null) {
    fail(3, `configuration not found: ${file} (run scripts/bootstrap.sh to create it)`);
@@ -170,7 +193,7 @@ function load(file) {
  } catch (error) {
    fail(2, `configuration is not valid JSON (${file}): ${error.message}`);
  }
-  return validate(document, file);
+  return await validate(document, file);
 }

 function shellQuote(value) {
@@ -194,7 +217,7 @@ const file = configPath();
 switch (operation) {
  case "bootstrap": {
    if (fs.existsSync(file)) {
-      load(file); // validate only; never rewrite
+      await load(file); // validate only; never rewrite
      process.stderr.write(`mosaic-config: configuration already present, validated without changes: ${file}\n`);
      process.exit(0);
    }
@@ -206,26 +229,26 @@ switch (operation) {
      fs.writeFileSync(fd, `${JSON.stringify(DEFAULT_CONFIG, null, 2)}\n`);
    } catch (error) {
      if (error.code === "EEXIST") {
-        load(file);
+        await load(file);
        process.exit(0);
      }
      fail(1, `unable to create configuration: ${error.message}`);
    } finally {
      if (fd !== undefined) fs.closeSync(fd);
    }
-    load(file);
+    await load(file);
    process.stderr.write(`mosaic-config: created default configuration: ${file}\n`);
    process.exit(0);
  }

  case "validate": {
-    const resolved = load(file);
+    const resolved = await load(file);
    process.stdout.write(`${JSON.stringify(resolved, null, 2)}\n`);
    process.exit(0);
  }

  case "env": {
-    const resolved = load(file);
+    const resolved = await load(file);
    process.stdout.write(
      [
        `MOSAIC_DATA_ROOT=${shellQuote(resolved.dataRoot)}`,
@@ -27,7 +27,7 @@ COPY_PATHS=(
 packages/conversation/src packages/discord/src packages/discord/bin packages/discord/extension packages/harness/src
 packages/seat/src packages/tasks/src packages/tasks/fields.json packages/tasks/requirements.json
 packages/webui/src packages/webui/README.md packages/cli/README.md
- packages/queue/src packages/library/src
+ packages/queue/src
 # Whole directory: every in-repo plug-in module ships with the copy (row 131).
 packages/plugins
 )
@@ -3,7 +3,7 @@
 # Moves the bus, the Console and the human CLI from the pointer's copy to another copy together,
 # behind a health gate, and puts the old stack back inside the same run when the gate fails.
 # Console tester listener flags follow target support (row 176, #1674); so does the row 178 proof
-# pair, which activate sets or drops (row 187, #1685). activate --no-send drops --send (row 189, #1687).
+# pair, which activate sets or drops (row 187, #1685).
 # Design and tests: agents/darkwing/work/queue-162/BUILD.md.
 #
 # Who runs it. Decision 96 (Mos, mos-0716) lets this script stop and start the live units under
@@ -30,13 +30,13 @@ BIN="$HOME/.npm-global/bin"
 UNIT_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/systemd/user"
 CONSOLE_UNIT=mosaic-webui.service
 TIMEOUT=60 WANT_PM=0 AFTER_HARNESS=0 MIGRATE=0 PLAN=0 RESTORE="" EVENTS="" TESTER_PORT=""
-PROOF_HEADER="" PROOF_FILE="" NO_PROOF=0 NO_SEND=0 R_BACKUP="" R_PORT=""
+PROOF_HEADER="" PROOF_FILE="" NO_PROOF=0 R_BACKUP="" R_PORT=""

 usage() {
    cat >&2 <<'USAGE'
 usage: stack-release.sh adopt BUSINESS
       stack-release.sh activate ID BUSINESS [--pm | --pm-after-harness] [--migrate] [--tester-port N]
-           [--proof-header NAME --proof-file PATH | --no-proof] [--no-send] [--timeout S] [--plan]
+           [--proof-header NAME --proof-file PATH | --no-proof] [--timeout S] [--plan]
       stack-release.sh pm-on BUSINESS [--timeout S]
       stack-release.sh rollback BUSINESS [--restore ACTIVATION [--events N]] [--timeout S] [--plan]
       stack-release.sh status BUSINESS
@@ -85,7 +85,6 @@ parse_opts() {
            --proof-header) [ "$OP" = activate ] && [ $# -ge 2 ] && [ -n "$2" ] || usage; PROOF_HEADER="$2"; shift 2 ;;
            --proof-file) [ "$OP" = activate ] && [ $# -ge 2 ] && [ -n "$2" ] || usage; PROOF_FILE="$2"; shift 2 ;;
            --no-proof) [ "$OP" = activate ] || usage; NO_PROOF=1; shift ;;
-            --no-send) [ "$OP" = activate ] || usage; NO_SEND=1; shift ;;
            --migrate) [ "$OP" = activate ] || usage; MIGRATE=1; shift ;;
            --restore) [ "$OP" = rollback ] && [ $# -ge 2 ] && [[ "$2" =~ ^[0-9]{8}T[0-9]{6}Z-[0-9a-f]{12}(-[1-9])?$ ]] || usage; RESTORE="$2"; shift 2 ;;
            --backup) [ "$OP" = rehearse ] && [ $# -ge 2 ] && { [[ "$2" =~ ^[0-9]{8}T[0-9]{6}Z-[0-9a-f]{12}(-[1-9])?$ ]] || [[ "$2" =~ ^/[A-Za-z0-9/._+-]*$ ]]; } || usage; R_BACKUP="$2"; shift 2 ;;
@@ -245,16 +244,14 @@ target_schema() {
 in_chain() { local v; for v in "${T_CHAIN[@]}"; do [ "$v" != "$1" ] || return 0; done; return 1; }

 # The item 3 checks on the target copy, in order: copy, schema, already-active. An activate that
-# sets a proof pair, drops the pointer's pair with --no-proof, or drops the pointer's --send with
-# --no-send, may name the pointer's copy: it re-pins the live copy with new Console flags (row 187,
-# Part B's B3 and B-R1; row 189, mos-0972).
+# sets a proof pair, or drops the pointer's pair with --no-proof, may name the pointer's copy: it
+# re-pins the live copy with new Console flags (row 187, Part B's B3 and B-R1).
 check_target() {
    copy_exists "$TO" 2>/dev/null || refuse copy-missing "no copy $TO in $COPIES"
    copy_ok "$TO" 2>/dev/null || refuse copy-unreachable "$TO is not reachable from refactor and origin/refactor"
    target_schema "$TO" || refuse copy-schema-unknown "cannot read SCHEMA_VERSION and its chain from $COPIES/$TO/packages/bus/src/store.mjs"
    [ "$TO" != "$P_COPY" ] || [ -n "$PROOF_HEADER" ] ||
        { [ "$NO_PROOF" = 1 ] && [[ " ${P_CONSOLE[*]} " == *" --proof-header "* ]]; } ||
-        { [ "$NO_SEND" = 1 ] && [[ " ${P_CONSOLE[*]} " == *" --send "* ]]; } ||
        refuse already-active "$TO is the pointer's copy"
 }

@@ -693,33 +690,6 @@ console_for_target() {
        DROP_TESTER="--tester-port $inherited"
    fi
    proof_for_target
-    send_for_target
-}
-
-# Row 189 (mos-0972): --no-send drops --send from RUN_CONSOLE, so the unit and the pointer both lose
-# it; without the flag the pointer's --send goes on unchanged. Rollback and pm-on never take it, so
-# they carry the pointer as it is. Sets SEND_PLAN (the plan's send: line) and SEND_STEP.
-send_for_target() {
-    local had=0 i
-    local -a without_send=()
-    for ((i = 0; i < ${#RUN_CONSOLE[@]}; i++)); do
-        if [ "${RUN_CONSOLE[i]}" = --send ]; then had=1; else without_send+=("${RUN_CONSOLE[i]}"); fi
-    done
-    SEND_STEP=""
-    if [ "$NO_SEND" = 1 ]; then
-        RUN_CONSOLE=("${without_send[@]}")
-        if [ "$had" = 1 ]; then
-            SEND_PLAN="send: dropped; --no-send was given"
-            SEND_STEP="drop --send; --no-send was given"
-        else
-            SEND_PLAN="send: off; --no-send was given and the pointer holds no --send"
-            SEND_STEP="--no-send was given and the pointer holds no --send, so there is nothing to drop"
-        fi
-    elif [ "$had" = 1 ]; then
-        SEND_PLAN="send: carried"
-    else
-        SEND_PLAN="send: off"
-    fi
 }

 # Row 187: the row 178 proof pair in RUN_CONSOLE. A new pair replaces the pointer's and goes last;
@@ -973,7 +943,6 @@ plan() {
    echo "bus: scripts/bus-service.sh install --copy $TO --copies $COPIES$([ "$RUN_PM" = 0 ] || echo ' --pm') --claude $P_CLAUDE"
    [ -z "$DROP_TESTER" ] || echo "drop $DROP_TESTER; the target Console does not support it"
    echo "$PROOF_PLAN"
-    echo "$SEND_PLAN"
    echo "Console: scripts/webui-service.sh install --copy $TO --copies $COPIES${RUN_CONSOLE[*]:+ ${RUN_CONSOLE[*]}}"
    echo "CLI: scripts/stack-copy.sh wrapper $TO --copies $COPIES --bin $BIN"
    local r
@@ -987,7 +956,6 @@ run_steps() {
    capture || refuse capture-failed "could not write the rollback set $RS; nothing was stopped"
    [ -z "$DROP_TESTER" ] || say "drop $DROP_TESTER; the target Console does not support it"
    [ -z "$PROOF_STEP" ] || say "$PROOF_STEP"
-    [ -z "$SEND_STEP" ] || say "$SEND_STEP"
    trap 'after_fail signal' INT TERM HUP
    stop_both || rollback_in_run stop-timeout
    if [ -e "$STORE" ]; then
@@ -1510,7 +1478,7 @@ STORE="$DATA/bus/bus.sqlite"
 BUS_UNIT="mosaic-bus@$BUSINESS.service"
 FROM="" TO="" ACT="" RS="" POST="" BACKUP="" TAKEN="" RESTORED="" STEPS="" COUNT="" UNCLEAN="" FAIL=""
 STORE_SCHEMA="" START_EPOCH="" START_MS=0 GATE="" GATE_WHY="" S_CHANGED=""
-P_COPY="" P_PM=0 P_PENDING=0 P_SCHEMA="" P_CLAUDE="" P_CONSOLE=() RUN_PM=0 RUN_PENDING=0 RUN_CONSOLE=() DROP_TESTER="" PROOF_PLAN="" PROOF_STEP="" SEND_PLAN="" SEND_STEP="" PLAN_REFUSE=()
+P_COPY="" P_PM=0 P_PENDING=0 P_SCHEMA="" P_CLAUDE="" P_CONSOLE=() RUN_PM=0 RUN_PENDING=0 RUN_CONSOLE=() DROP_TESTER="" PROOF_PLAN="" PROOF_STEP="" PLAN_REFUSE=()
 R="" R_RC=0 R_EARLY=() R_BK="" R_HOST_PID="" R_CONSOLE_PID="" R_STARTED="" LIVE_CFG="" LIVE_BIZ=""
 case "$OP" in
    adopt) do_adopt ;;
@@ -151,6 +151,52 @@ else
    FAIL=$((FAIL+1)); echo "${C_FAIL}FAIL${C_RESET} env exports resolve correctly"
 fi

+# --- Q175 phase 1 (#1690), design test 25: the optional console key ---
+# Shape only. The slot path is a FIFO, so a loader that opened the slot would block and the
+# timeout would fail the case; no case reads a slot file.
+mkdir -p "$SANDBOX/secrets/mosaic-stack"
+mkfifo "$SANDBOX/secrets/mosaic-stack/console-sso-test"
+sso_body() {
+    printf '{"configVersion":1,"environment":"development","dataRoot":"%s","execution":{"backend":"docker","provider":"zai","model":"m"},"console":%s}' "$DATA_ROOT" "$1"
+}
+# provider [ALGS] [CLIENT_SECRET]: one provider entry; an empty argument takes the valid value.
+provider() {
+    local algs='["RS256"]' secret='{"slot":"console-sso-test"}'
+    [ -n "${1:-}" ] && algs="$1"
+    [ -n "${2:-}" ] && secret="$2"
+    printf '{"id":"fake","issuer":"https://op.test/app/","clientId":"client-1","clientSecret":%s,"algs":%s,"subjects":[{"sub":"user-1","name":"jason.woltje"}]}' "$secret" "$algs"
+}
+cfg sso-valid.json "$(sso_body '{"sso":{"publicOrigin":"https://console.test","providers":['"$(provider)"']}}')"
+OUT="$(MOSAIC_CONFIG="$SANDBOX/sso-valid.json" timeout 20 $CONFIG_OP validate 2>&1)"
+[ $? -eq 0 ] && printf '%s' "$OUT" | grep -q '"publicOrigin": "https://console.test"'
+check "valid console.sso loads and is in the output" $?
+
+# expect_refusal NAME PATH-IN-MESSAGE BODY: exit 2, and the message names the bad key path.
+expect_refusal() {
+    cfg sso-bad.json "$2"
+    local err rc
+    err="$(MOSAIC_CONFIG="$SANDBOX/sso-bad.json" timeout 20 $CONFIG_OP validate 2>&1 >/dev/null)"
+    rc=$?
+    [ "$rc" -eq 2 ] && printf '%s' "$err" | grep -qF -- "$3"
+    check "$1 (exit $rc)" $?
+}
+expect_refusal "console.sso HS256 alg exits 2 naming the path" \
+    "$(sso_body '{"sso":{"publicOrigin":"https://console.test","providers":['"$(provider '["HS256"]')"']}}')" 'console.sso.providers[0].algs[0] must be one of'
+expect_refusal "console.sso alg none exits 2 naming the path" \
+    "$(sso_body '{"sso":{"publicOrigin":"https://console.test","providers":['"$(provider '["RS256","none"]')"']}}')" 'console.sso.providers[0].algs[1] must be one of'
+expect_refusal "console.sso missing slot field exits 2 naming the path" \
+    "$(sso_body '{"sso":{"publicOrigin":"https://console.test","providers":['"$(provider '' '{}')"']}}')" 'console.sso.providers[0].clientSecret.slot is required'
+expect_refusal "console.sso slot name outside the pattern exits 2 naming the path" \
+    "$(sso_body '{"sso":{"publicOrigin":"https://console.test","providers":['"$(provider '' '{"slot":"../x"}')"']}}')" 'console.sso.providers[0].clientSecret.slot must match'
+expect_refusal "unknown key under console exits 2 naming the path" \
+    "$(sso_body '{"sso":{"publicOrigin":"https://console.test","providers":['"$(provider)"']},"extra":1}')" 'console.extra is not a supported key'
+
+# Without the key: the output is exactly what the loader printed before phase 1 (sage-1340, F2).
+cfg no-console.json '{"configVersion":1,"environment":"development","dataRoot":"'$DATA_ROOT'","execution":{"backend":"docker","provider":"zai","model":"m"}}'
+EXPECTED="$(printf '{\n  "configVersion": 1,\n  "environment": "development",\n  "dataRoot": "%s",\n  "execution": {\n    "backend": "docker",\n    "provider": "zai",\n    "model": "m",\n    "adapter": "pi"\n  }\n}' "$DATA_ROOT")"
+[ "$(MOSAIC_CONFIG="$SANDBOX/no-console.json" timeout 20 $CONFIG_OP validate)" = "$EXPECTED" ]
+check "config without console loads with unchanged output" $?
+
 # --- validation must not modify the file ---
 SUM_INVALID_BEFORE=$(sha256sum "$SANDBOX/invalid.json" | cut -d' ' -f1)
 MOSAIC_CONFIG="$SANDBOX/invalid.json" $CONFIG_OP validate >/dev/null 2>&1
@@ -49,6 +49,9 @@
 # character set and refused otherwise. --proof-header NAME --proof-file PATH
 # go together under preview; only the path is carried here, never the secret.
 # render checks ownership, mode and location without opening the proof file.
+# --sso (Q175 phase 1, #1690): the Console signs people in itself from
+# console.sso in config.json. It refuses the preview set and the proof pair,
+# and --send takes it in place of the preview set. Nothing secret is carried.
 #
 # There is no start, stop, enable or restart verb. The Console reads the
 # main listener's bus through the human transport; the optional loopback
@@ -68,7 +71,7 @@ REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 TEMPLATE="$REPO/packages/webui/systemd/mosaic-webui.service.in"
 UNIT_NAME="mosaic-webui.service"
 USAGE="usage: scripts/webui-service.sh copy COMMIT [--copies DIR] [--allow-worktree] | render [--copy ID [--copies DIR]] [FLAGS] | install --copy ID [--copies DIR] [--dir DIR] [--no-reload] [--allow-worktree] [FLAGS] | uninstall [--dir DIR] [--no-reload] | status [--dir DIR]
-  FLAGS: [--port N] [--business ID] [--board URL] [--public-host NAME --auth-header HEADER --allow-user ID [--send]] [--tester-port N] [--proof-header NAME --proof-file PATH]
+  FLAGS: [--port N] [--business ID] [--board URL] [--sso [--send] | --public-host NAME --auth-header HEADER --allow-user ID [--send]] [--tester-port N] [--proof-header NAME --proof-file PATH]
  --tester-port: 1024..65535, different from --port and never 7332; loopback tester listener.
  --allow-worktree is for the tests only: copy and install otherwise refuse outside the canonical checkout."

@@ -91,6 +94,7 @@ PUBLIC_HOST=""
 AUTH_HEADER=""
 ALLOW_USER=""
 SEND=0
+SSO=0
 PROOF_HEADER=""
 PROOF_FILE=""
 PROOF_SET=0
@@ -114,6 +118,7 @@ parse_flags() {
            --proof-header) [ $# -ge 2 ] || usage; PROOF_HEADER="$2"; PROOF_SET=1; SERVE_SET=1; shift 2 ;;
            --proof-file) [ $# -ge 2 ] || usage; PROOF_FILE="$2"; PROOF_SET=1; SERVE_SET=1; shift 2 ;;
            --send) SEND=1; SERVE_SET=1; shift ;;
+            --sso) SSO=1; SERVE_SET=1; shift ;;
            *) usage ;;
        esac
    done
@@ -166,9 +171,13 @@ serve_flags() {
    [ -z "$PUBLIC_HOST" ] || preview=$((preview + 1))
    [ -z "$AUTH_HEADER" ] || preview=$((preview + 1))
    [ -z "$ALLOW_USER" ] || preview=$((preview + 1))
-    # serve refuses --send without the preview set; refuse it here first,
-    # so no unit is written that would only exit 2 at start.
-    [ "$SEND" = 0 ] || [ "$preview" -eq 3 ] || die "--send needs the preview mode (--public-host, --auth-header and --allow-user)"
+    # serve refuses --sso with the preview set or the proof pair, and --send
+    # without --sso or the preview set; refuse them here first, so no unit is
+    # written that would only exit 2 at start.
+    if [ "$SSO" = 1 ] && { [ "$preview" -ne 0 ] || [ "$PROOF_SET" = 1 ]; }; then
+        die "--sso cannot be combined with --public-host, --auth-header, --allow-user or --proof-*"
+    fi
+    [ "$SEND" = 0 ] || [ "$preview" -eq 3 ] || [ "$SSO" = 1 ] || die "--send needs the preview mode (--public-host, --auth-header and --allow-user) or --sso"
    if [ "$preview" -ne 0 ]; then
        [ "$preview" -eq 3 ] || die "--public-host, --auth-header and --allow-user go together: all three or none"
        case "$PUBLIC_HOST" in [A-Za-z0-9]*) ;; *) die "public host must be a hostname, no port or scheme: $PUBLIC_HOST" ;; esac
@@ -201,6 +210,7 @@ serve_flags() {
        { [ "$proof_mode" = 600 ] || [ "$proof_mode" = 400 ]; } && [ "$proof_uid" = "$(id -u)" ] || die "invalid proxy proof file metadata"
        flags="$flags --proof-header $PROOF_HEADER --proof-file $PROOF_FILE"
    fi
+    [ "$SSO" = 0 ] || flags="$flags --sso"
    [ "$SEND" = 0 ] || flags="$flags --send"
    [ "$TESTER_SET" = 0 ] || flags="$flags --tester-port $TESTER_PORT"
    echo "$flags"
@@ -385,14 +395,17 @@ status_unit() {
    else
        echo "copy: none; the unit runs from $wd"
    fi
-    # render puts --send after the allowed user and optional proof pair,
-    # before the tester port. The allowed user
+    # render puts --send after the allowed user and optional proof pair, or
+    # after --sso, before the tester port. The allowed user
    # starts with a letter or digit (N5), so it is never the value --send.
-    if grep -Eq '^ExecStart=.* --allow-user [^ ][^ ]*( --proof-header [^ ]+ --proof-file /[^ ]+)? --send( --tester-port [0-9]+)?$' "$target"; then
+    if grep -Eq '^ExecStart=.*( --allow-user [^ ][^ ]*( --proof-header [^ ]+ --proof-file /[^ ]+)?| --sso) --send( --tester-port [0-9]+)?$' "$target"; then
        echo "send: on (--send; human messages to roles)"
    else
        echo "send: off (read-only)"
    fi
+    if grep -Eq '^ExecStart=.* --sso( --send)?( --tester-port [0-9]+)?$' "$target"; then
+        echo "sign-in: the Console's own (--sso)"
+    fi
    local tester_port
    tester_port="$(sed -n 's/^ExecStart=.* --tester-port \([0-9][0-9]*\)$/\1/p' "$target")"
    if [ -n "$tester_port" ]; then