Route SSO configuration through tasks

config/sso_tool.go

diff --git a/config/sso_tool.go b/config/sso_tool.go
index 58da2c6..9e533ea 100644
--- a/config/sso_tool.go
+++ b/config/sso_tool.go
@@ -122,16 +122,12 @@
 
 func printSSOUsage() {
 	fmt.Print(`Usage:
-ops config sso keycloak --enable --issuer-url URL --jwks-url URL (--audience AUDIENCE|--client-id CLIENT_ID) --required-group GROUP [options]
-ops config sso show
-ops config sso disable [options]
-
-Legacy embedded form:
 ops -config sso keycloak --enable --issuer-url URL --jwks-url URL (--audience AUDIENCE|--client-id CLIENT_ID) --required-group GROUP [options]
 ops -config sso show
 ops -config sso disable [options]
 
-Configure OpenServerless SSO/OIDC integration for admin-api.
+Legacy compatibility tool for OpenServerless SSO/OIDC integration.
+The public command surface is provided by the ops config sso task.
 
 Managed Kubernetes resources:
   ConfigMap NAME            OIDC_* and SSO_* values created by this command

docs/SSO.md

diff --git a/docs/SSO.md b/docs/SSO.md
index a91f7c9..d6a51e0 100644
--- a/docs/SSO.md
+++ b/docs/SSO.md
@@ -17,11 +17,13 @@
   ~ under the License.
   -->
 
-# SSO configuration ownership
+# Legacy embedded SSO configuration ownership
 
-`ops config sso keycloak --enable` manages the following configuration. The
-resource names can be changed with `--configmap`, `--secret`, `--statefulset`,
-and `--container`.
+The public `ops config sso` command is supplied by the task repository. The
+embedded `ops -config sso` form remains temporarily available for compatibility
+with already published scripts and installations. It manages the following
+configuration. Resource names can be changed with `--configmap`, `--secret`,
+`--statefulset`, and `--container`.
 
 ## Kubernetes resources
 

main.go

diff --git a/main.go b/main.go
index cf19df8..c59f578 100644
--- a/main.go
+++ b/main.go
@@ -408,14 +408,6 @@
 
 	args := os.Args
 
-	// Keep the historical `ops config` task surface intact; only the new SSO
-	// subtree is handled by the embedded config tool.
-	if isPlainConfigSSOCommand(args) {
-		fullargs := append([]string{"config"}, args[2:]...)
-		exitCode := executeTools(fullargs, opsHome)
-		os.Exit(exitCode)
-	}
-
 	// first argument with prefix "-" is considered an embedded tool
 	// using "-" or "--" or "-task" invokes the embedded task
 	// CLI: ops -<tool> (embedded tool)
@@ -554,10 +546,6 @@
 	return false
 }
 
-func isPlainConfigSSOCommand(args []string) bool {
-	return len(args) > 2 && args[1] == "config" && args[2] == "sso"
-}
-
 func runOps(baseDir string, args []string) error {
 	err := Ops(baseDir, args[1:])
 	if err == nil {

main_test.go

diff --git a/main_test.go b/main_test.go
index 30a14c6..493937c 100644
--- a/main_test.go
+++ b/main_test.go
@@ -156,14 +156,6 @@
 	require.False(t, isPlainEmbeddedToolAlias("login"))
 }
 
-func TestIsPlainConfigSSOCommand(t *testing.T) {
-	require.True(t, isPlainConfigSSOCommand([]string{"ops", "config", "sso"}))
-	require.True(t, isPlainConfigSSOCommand([]string{"ops", "config", "sso", "show"}))
-	require.False(t, isPlainConfigSSOCommand([]string{"ops", "config"}))
-	require.False(t, isPlainConfigSSOCommand([]string{"ops", "config", "--help"}))
-	require.False(t, isPlainConfigSSOCommand([]string{"ops", "-config", "sso"}))
-}
-
 func TestConfigValueForDebugRedactsSensitiveValues(t *testing.T) {
 	require.Equal(t, "<redacted>", configValueForDebug("AUTH", "uuid:key"))
 	require.Equal(t, "<redacted>", configValueForDebug("POSTGRES_PASSWORD", "secret"))