# Brief: stack-release.sh activates a Console with --sso (Q175 phase 2 prerequisite)

Sage, 2026-10-20, for Launchpad's finding F3 on row 192 (launchpad-0001) and Q175 (#412). Gitea #1698. Owner
Launchpad, reviewer Webby, gate owner Sage. Chained on row 192's candidate (Q177): it lands after row 192 and
before the phase 2 window. Base: row 192's candidate.

## Why

The phase 2 window re-pins the Console to the phase 1 commit with `--sso --send --tester-port 7333`
(`agents/sage/work/q175-sso/DESIGN.md`, section 5). `scripts/stack-release.sh` doesn't know `--sso` today.
Its `proof_checks` (`:751`) requires `--public-host`, `--auth-header` and `--allow-user` whenever a proof pair is
carried, and the pointer's Console flags still hold the forward-auth pair (`--auth-header X-authentik-username
--allow-user jason.woltje`) that `--sso` refuses to start with. So the window can't run through the script, and
a hand-edited pointer is not an option.

## What the row does

1. `activate ID BUSINESS --sso` writes Console flags with `--sso` and without `--auth-header`, `--allow-user`
   and any proof pair, and `--plan` names each flag it drops and carries, in the style of row 189's `send:`
   line. The design names the full flag set the phase 2 Console starts with and checks it against row 192's
   refusals.
2. Before anything stops, the script refuses a target copy whose Console doesn't support `--sso`, and refuses
   when the config's `console` key or its slot file fails the checks row 192's `--sso` start runs. It reads
   neither value and only uses the same stat and shape checks.
3. Rollback from an `--sso` pointer to a pre-phase-1 copy follows the design's phase 2 rollback order (remove
   the `console` key first). The script refuses a rollback that would start a Console on a config it can't
   read, and says which step comes first.
4. `docs/TOOLS.md` gets the flag.

## Boundaries

- No change to the live pointer, units, `~/.mosaic-dev` or `~/.config/mosaic-dev`. Tests use scratch roots
  and seeded pointers, as rows 187 and 189 do.
- No request to the live Console, mosaic.woltje.com or auth.diversecanvas.com.

## Gate

Webby approves the manifest. The cli suite and every `scripts/test-*.sh` are green on Sage's gate, and the
mutants are killed (one per refusal, and one that keeps `--auth-header` in the written flags).

## Brief: row 200 follow-up N1, the sso-config hint names the instance

Sage, 2026-10-21, from Webby's round 3 note N1 on row 200 (comment 29772). Gitea #1744. Owner Launchpad,
reviewer Webby, gate owner Sage. Size XS. Builds on row 200's landing 9e1085816.

`scripts/stack-release.sh` builds the sso-config refusal's first-step hint as `activate $TO without --sso
first, then write console.sso, then run activate $TO --sso`. For a named instance (row 190), both commands
need `--instance NAME`, and the hint leaves it out. An operator who copies them acts on the default instance.

- When the run names an instance, both commands in the hint carry `--instance NAME`. The default instance's
  hint is unchanged.
- A test runs the sso-config refusal for a named instance and asserts both commands carry `--instance NAME`.
  The existing default-instance case keeps its exact text.
- One mutant drops the flag from the hint, and it must die.

Gate: Webby approves the manifest. `packages/cli/tests/stack-release.test.mjs` passes whole, and the cli suite
and every `scripts/test-*.sh` are green on Sage's gate.