amadan
docs: instance moves — a door request is a request from the box (P7)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+1
−1
docs/superpowers/specs/2026-09-24-instance-moves-for-every-app-design.md+1 −1
CI passed — run details
diff --git a/docs/superpowers/specs/2026-09-24-instance-moves-for-every-app-design.md b/docs/superpowers/specs/2026-09-24-instance-moves-for-every-app-design.md| index a4f14a951..aacfbb543 100644 |
| --- a/docs/superpowers/specs/2026-09-24-instance-moves-for-every-app-design.md |
| +++ b/docs/superpowers/specs/2026-09-24-instance-moves-for-every-app-design.md |
| @@ -39,7 +39,7 @@ below, the ruling wins until the next revision folds it in. |
| | M1 | **New:** before a store's final delta, the platform write-fences the bucket or prefix against every credential holder, including outstanding uploads. Prefix stores need exclusive key ownership. Shapes P8 and P5. | |
| | M2 | **New:** API/CLI inspection and forward retry of a stuck move, an explicit recovery path when a move back cannot start, durable move id and evidence, and never a silent restore of an older source over newer target data. Folds into P4. | |
| | P4 | **Differs from §13:** P4 joins the minimum path. elatromme → us needs P0, P7, P9, P6, P1, P2, P3, P4. | |
| -| P7-trust | **Differs from §8 (Paul, 2026-09-28):** the edge-local door believes no caller-supplied visitor address. A believed address changes the password gate's guess limits and any app that authorizes by IP (Astra, P7 plan review round 3). Door requests reach the app with `X-Forwarded-For: 192.0.0.8` (RFC 7600's dummy address: a valid IP, never loopback or private, so no framework falls back to a spoofable header or the loopback peer), on any box; an app that needs the buyer's address carries it in its own signed header. The door key still says which app is calling. | |
| +| P7-trust | **Differs from §8 (Paul, 2026-09-28):** the edge-local door believes no caller-supplied visitor address. A believed address changes the password gate's guess limits and any app that authorizes by IP (Astra, P7 plan review round 3). A door request is presented as a request from the box itself: it carries the box's own public address, exactly what the app would see if the calling process fetched the instance's public URL. Invented placeholders (`unknown`, `192.0.0.8`) each met a framework that read them as local, private or trusted. An app that needs the buyer's address carries it in its own signed header. The door key still says which app is calling. | |
| ## 1. The problem, as found |