amadan
docs: instance moves — Paul's rulings (2026-09-25)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+26
−0
docs/superpowers/specs/2026-09-24-instance-moves-for-every-app-design.md+26 −0
CI passed — run details
diff --git a/docs/superpowers/specs/2026-09-24-instance-moves-for-every-app-design.md b/docs/superpowers/specs/2026-09-24-instance-moves-for-every-app-design.md| index af17dd338..f2b9f23c6 100644 |
| --- a/docs/superpowers/specs/2026-09-24-instance-moves-for-every-app-design.md |
| +++ b/docs/superpowers/specs/2026-09-24-instance-moves-for-every-app-design.md |
| @@ -14,6 +14,32 @@ instance; it does not reopen the cut ordering. |
| `teamtito/titogo` `docs/superpowers/specs/2026-09-24-moves-on-the-platform-design.md` |
| (branch `docs-controld-onto-platform-design`). |
| +## 0. Rulings (Paul, 2026-09-25) |
| + |
| +Taken one at a time from Astra's recommendations |
| +(`CODEX-RULINGS-INSTANCE-MOVES.md`, brief `CODEX-RULINGS-BRIEF-INSTANCE-MOVES.md`). |
| +Each followed the recommendation. Where a ruling differs from the text |
| +below, the ruling wins until the next revision folds it in. |
| + |
| +| id | ruling | |
| +|---|---| |
| +| R1 | Accepted: the platform owns the freeze. | |
| +| R2 | Accepted with additions: hook calls are idempotent and keyed by move id; one fixed deadline across retries; per-state eligibility to pass P0's fence rather than a blanket bypass; hook paths refused on the public and the local edge door. | |
| +| R3 | Accepted: only declared, platform-provisioned stores or exclusive instance prefixes follow. | |
| +| R4 | Accepted: rollback is a move back; P3 makes home a placement. | |
| +| R5 | Accepted: one box-local edge door; every enrolled consumer (G18) moves to it before P9. | |
| +| Q1 | Allow the freeze to lapse over a stopped process. Measured cut time informs estimates and warnings, never gates the cut. One persisted deadline, never extended. Freeze expiry and total downtime are reported separately. | |
| +| Q2 | Refuse to move a home that has replicas until a replica-aware transition exists. | |
| +| Q3 | **Differs from §8:** the door authenticates an app-scoped credential restricted to the local door, checks the requested host's account and app, and strips the credential before forwarding. Unix permissions stay as a second check, not the identity. | |
| +| Q4 | The authoritative control plane (records, bundles, secrets, move log) stays in the home region, stated plainly in docs/site. Runtime copies and source retention are described separately. | |
| +| Q5 | Move mutations for accounts other than the deployment's own are operator-only until #171 is fixed and verified. | |
| +| Q6 | **Differs from §7.1:** a platform-run copy with a move-scoped IAM user whose policy carries an enforced date condition, plus a reaper for abandoned users. Deletion at the terminal state is not what makes it short-lived. | |
| +| Q7 | Direct-mode `carlos add` requires `--account` or `--account-id` (no silent `ops` default) and refuses a conflict with an established owner. P6 transfers ownership explicitly. | |
| +| Q8 | A scheduled per-account stop window for adoption, measured through first successful service. Replicate-then-cut adoption is later, so import sessions stay separate from record creation. | |
| +| M1 | **New:** before a store's final delta, the platform write-fences the bucket or prefix against every credential holder, including outstanding uploads. Prefix stores need exclusive key ownership. Shapes P8 and P5. | |
| +| M2 | **New:** API/CLI inspection and forward retry of a stuck move, an explicit recovery path when a move back cannot start, durable move id and evidence, and never a silent restore of an older source over newer target data. Folds into P4. | |
| +| P4 | **Differs from §13:** P4 joins the minimum path. elatromme → us needs P0, P7, P9, P6, P1, P2, P3, P4. | |
| + |
| ## 1. The problem, as found |
| Paul, 2026-09-24: *"This is something that anyone using the platform should |