amadan
docs: instance moves — Paul's ruling: the edge-local door believes no visitor address (P7)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+1
−0
docs/superpowers/specs/2026-09-24-instance-moves-for-every-app-design.md+1 −0
CI passed — run details
diff --git a/docs/superpowers/specs/2026-09-24-instance-moves-for-every-app-design.md b/docs/superpowers/specs/2026-09-24-instance-moves-for-every-app-design.md| index f2b9f23c6..0f092de71 100644 |
| --- a/docs/superpowers/specs/2026-09-24-instance-moves-for-every-app-design.md |
| +++ b/docs/superpowers/specs/2026-09-24-instance-moves-for-every-app-design.md |
| @@ -39,6 +39,7 @@ below, the ruling wins until the next revision folds it in. |
| | M1 | **New:** before a store's final delta, the platform write-fences the bucket or prefix against every credential holder, including outstanding uploads. Prefix stores need exclusive key ownership. Shapes P8 and P5. | |
| | M2 | **New:** API/CLI inspection and forward retry of a stuck move, an explicit recovery path when a move back cannot start, durable move id and evidence, and never a silent restore of an older source over newer target data. Folds into P4. | |
| | P4 | **Differs from §13:** P4 joins the minimum path. elatromme → us needs P0, P7, P9, P6, P1, P2, P3, P4. | |
| +| P7-trust | **Differs from §8 (Paul, 2026-09-28):** the edge-local door believes no caller-supplied visitor address. A believed address changes the password gate's guess limits and any app that authorizes by IP (Astra, P7 plan review round 3). Door requests reach the app with `X-Forwarded-For: unknown`, on any box; an app that needs the buyer's address carries it in its own signed header. The door key still says which app is calling. | |
| ## 1. The problem, as found |