Password gate: a shared password in front of an instance

A member puts one shared password in front of an instance's hostname — a static site or a prototype that should not be world-readable. Visitors see a neutral page asking for it and stay signed in for a week; the app behind it never sees the cookie.

Spec: docs/superpowers/specs/2026-09-07-password-gate-design.md Plan: docs/superpowers/plans/2026-09-07-password-gate.md

What lands

• provision.Record.Gate (bcrypt hash, additive, omitempty) → reconcile converges it into a new routes.gate registry column (in Fingerprint(), so the edge reloads on a change; Upsert preserves a set gate).
• internal/gate: password rules (8..72 bytes, bcrypt cost 10), a stateless HMAC cookie keyed off the hash (a password change signs everyone out), a per-address attempt limiter (10/min), an Origin check on the login POST, the login page, and Admit.
• internal/edge: the gate step sits after the usage meter and before the WebSocket bypass, the response cache and the hibernation activator — a stranger never wakes a sleeping instance and a cache hit is never served past the gate. A login POST is routed by its next field so path-prefix targets can be logged into; a login POST to an ungated route is 404.
• Console: instance PATCH gate field; every record reply carries gated and never the hash; a "Password gate" section on the app Settings page (set / change / turn off, member-gated, CSRF-checked, audited).
• CLI: carlos gate set|clear|list; documented in docs/site/cli.md.

Roll order (spec §9)

Boxes before console: a gate written by a new console into a record that an old box's reconcile does not understand is an open host that the member believes is closed. Roll the box binary fleet-wide, read a converged … gate open -> set line, then roll the console. The CLI degrades honestly against an old console: set/clear say it "does not know about password gates yet", and list prints unknown — console predates gates rather than "open".

Review trail

Spec, plan, seven task reviews, and a whole-branch review (Fable) with one fix wave; the SDD ledger's rulings are in the job's final report. Deferred minors (not fixed, recorded): sameOrigin is scheme-blind; an unparseable login form is a 413 that is not metered; the record-view shadow fields are declared three times; the Settings form ignores a password sent with action=clear.

Not built, on purpose (spec §8)

Basic auth for curl, per-path exemptions, per-user passwords or logout, a manifest-level gate, carlos route --gate for operator routes, and an "enforced" (as distinct from "set") report.