stack/docs/plans/2026-10-20_stack-release-sso.md

Brief: stack-release.sh activates a Console with --sso (Q175 phase 2 prerequisite)

Sage, 2026-10-20, for Launchpad's finding F3 on row 192 (launchpad-0001) and Q175 (#412). Gitea #1698. Owner Launchpad, reviewer Webby, gate owner Sage. Chained on row 192's candidate (Q177): it lands after row 192 and before the phase 2 window. Base: row 192's candidate.

Why

The phase 2 window re-pins the Console to the phase 1 commit with --sso --send --tester-port 7333 (agents/sage/work/q175-sso/DESIGN.md, section 5). scripts/stack-release.sh doesn't know --sso today. Its proof_checks (:751) requires --public-host, --auth-header and --allow-user whenever a proof pair is carried, and the pointer's Console flags still hold the forward-auth pair (--auth-header X-authentik-username --allow-user jason.woltje) that --sso refuses to start with. So the window can't run through the script, and a hand-edited pointer is not an option.

What the row does

1. activate ID BUSINESS --sso writes Console flags with --sso and without --auth-header, --allow-user and any proof pair, and --plan names each flag it drops and carries, in the style of row 189's send: line. The design names the full flag set the phase 2 Console starts with and checks it against row 192's refusals.
2. Before anything stops, the script refuses a target copy whose Console doesn't support --sso, and refuses when the config's console key or its slot file fails the checks row 192's --sso start runs. It reads neither value and only uses the same stat and shape checks.
3. Rollback from an --sso pointer to a pre-phase-1 copy follows the design's phase 2 rollback order (remove the console key first). The script refuses a rollback that would start a Console on a config it can't read, and says which step comes first.
4. docs/TOOLS.md gets the flag.

Boundaries

• No change to the live pointer, units, ~/.mosaic-dev or ~/.config/mosaic-dev. Tests use scratch roots and seeded pointers, as rows 187 and 189 do.
• No request to the live Console, mosaic.woltje.com or auth.diversecanvas.com.

Gate

Webby approves the manifest. The cli suite and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed (one per refusal, and one that keeps --auth-header in the written flags).

Brief: row 200 follow-up N1, the sso-config hint names the instance

Sage, 2026-10-21, from Webby's round 3 note N1 on row 200 (comment 29772). Gitea #1744. Owner Launchpad, reviewer Webby, gate owner Sage. Size XS. Builds on row 200's landing 9e1085816.

scripts/stack-release.sh builds the sso-config refusal's first-step hint as activate $TO without --sso first, then write console.sso, then run activate $TO --sso. For a named instance (row 190), both commands need --instance NAME, and the hint leaves it out. An operator who copies them acts on the default instance.

• When the run names an instance, both commands in the hint carry --instance NAME. The default instance's hint is unchanged.
• A test runs the sso-config refusal for a named instance and asserts both commands carry --instance NAME. The existing default-instance case keeps its exact text.
• One mutant drops the flag from the hint, and it must die.

Gate: Webby approves the manifest. packages/cli/tests/stack-release.test.mjs passes whole, and the cli suite and every scripts/test-*.sh are green on Sage's gate.