carlos / platform Public

docs: P7 plan round-6 findings (unedited): ready to build

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 3 weeks ago 4c7f39c69941ca9f03f43c69bbb8f78dd1ab081f parent c65ceff

1 file changed, +20 −0

docs/superpowers/plans/CODEX-FINDINGS-P7-EDGE-DOOR-R6.md +20 −0

CI cancelled — superseded by a newer push — run details

Intent

full ledger: instance-moves-p7

diff --git a/docs/superpowers/plans/CODEX-FINDINGS-P7-EDGE-DOOR-R6.md b/docs/superpowers/plans/CODEX-FINDINGS-P7-EDGE-DOOR-R6.md

new file mode 100644

index 000000000..8305b1059

--- /dev/null

+++ b/docs/superpowers/plans/CODEX-FINDINGS-P7-EDGE-DOOR-R6.md

@@ -0,0 +1,20 @@

+Reviewed revision 6 at `256645fc` against the checkout’s code. This is a source-level review; the door’s request path is not built yet.

+| Round-5 finding | Disposition |

+|---|---|

+| R5-1: alternate headers override the dummy address; Python classifies it as private | **Closed in the plan.** Both omitted headers are stripped, and the invented address is replaced with the box’s public address. [Plan:13](/home/paulca/amadan.net/carlos/platform-instance-moves-p7/docs/superpowers/plans/2026-09-28-instance-moves-p7-edge-door.md:13) |

+| R5-2: cache bypass disappears across backhaul | **Closed as a door-specific finding.** Revision 6 removes the bypass requirement and the special address. The underlying inbound-header `Vary` defect remains; this revision does not fix it. [Plan:18](/home/paulca/amadan.net/carlos/platform-instance-moves-p7/docs/superpowers/plans/2026-09-28-instance-moves-p7-edge-door.md:18) |

+**The paths are not exactly equivalent, but I found no new P1/P2 authority difference under the stated public-address assumption.**

+- **App-facing headers:** For a cache miss, both paths produce `X-Forwarded-For: <box address>`, `X-Forwarded-Host: <requested Host>` and `X-Forwarded-Proto: https`. Both remove `Forwarded` before proxying. The door additionally removes its credential and every listed alternate address header; ordinary public proxying can preserve those alternate headers. That is observable, but a public caller can reproduce the door’s resulting headers by omitting them. The door-specific scheme override is explicit at [plan:666](/home/paulca/amadan.net/carlos/platform-instance-moves-p7/docs/superpowers/plans/2026-09-28-instance-moves-p7-edge-door.md:666). Both proxy paths also strip `Carlos-Purge` and `Carlos-Purge-Host`. [purge_header.go:218](/home/paulca/amadan.net/carlos/platform-instance-moves-p7/internal/edge/purge_header.go:218)

+- **Gate and analytics:** Locally, replacing the Unix peer with the box address gives the gate the same address key as public traffic from that address. On backhaul, the gate uses the sending edge’s actual peer address, regardless of hop verification. [gate.go:230](/home/paulca/amadan.net/carlos/platform-instance-moves-p7/internal/gate/gate.go:230) Analytics instead uses verified XFF, falling back to the peer otherwise; its visitor hash also includes host, User-Agent and salt. These agree for matching paths and addresses, but public DNS choosing another ingress edge can change the gate’s bucket. Neither path bypasses password verification. [analytics.go:76](/home/paulca/amadan.net/carlos/platform-instance-moves-p7/internal/edge/analytics.go:76), [meter.go:62](/home/paulca/amadan.net/carlos/platform-instance-moves-p7/internal/analytics/meter.go:62)

+- **Cache:** A direct public request without forwarding headers reaches lookup with empty XFF. A verified backhauled door request reaches the far cache with XFF containing the box address. Thus `Vary: X-Forwarded-For` can select different entries even though the app would receive identical headers. Failed verification strips XFF again. Lookup and storage both use inbound headers. [edge.go:1583](/home/paulca/amadan.net/carlos/platform-instance-moves-p7/internal/edge/edge.go:1583), [edge.go:1702](/home/paulca/amadan.net/carlos/platform-instance-moves-p7/internal/edge/edge.go:1702) The existing defect can disclose incorrectly shared responses; the same box can already produce these cases through public requests, including public backhaul.

+- **Far-edge behavior:** Backhaul adds `X-Carlos-Hop` and `X-Carlos-Hop-Auth`; the receiver removes both. Successful verification grants forwarded-address trust, marks usage as hopped, and prevents another forwarding hop. A stale target therefore returns 503 where an ordinary public request could consult the home map. Failed verification removes forwarding headers and resumes ordinary-client handling. These are real differences, but the door supplies no caller-chosen address, and public backhaul obtains the same hop treatment. [edge.go:2772](/home/paulca/amadan.net/carlos/platform-instance-moves-p7/internal/edge/edge.go:2772), [homemap.go:767](/home/paulca/amadan.net/carlos/platform-instance-moves-p7/internal/edge/homemap.go:767), [edge.go:1370](/home/paulca/amadan.net/carlos/platform-instance-moves-p7/internal/edge/edge.go:1370)

+The comparison assumes the published address equals the actual egress address. `readPublicIP` reads EC2’s `public-ipv4` metadata; it does not verify that equality. [agent.go:2133](/home/paulca/amadan.net/carlos/platform-instance-moves-p7/internal/host/agent.go:2133) Also, local door service avoids DNS and certificate availability dependencies. Those are limits to “exactly equivalent,” not demonstrated new authorization bypasses in this checkout.

+The plan is ready to build.

\ No newline at end of file