amadan
docs: instance moves — the door's visitor address is 192.0.0.8, not 'unknown' (P7)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+1
−1
docs/superpowers/specs/2026-09-24-instance-moves-for-every-app-design.md+1 −1
CI passed — run details
diff --git a/docs/superpowers/specs/2026-09-24-instance-moves-for-every-app-design.md b/docs/superpowers/specs/2026-09-24-instance-moves-for-every-app-design.md| index 0f092de71..a4f14a951 100644 |
| --- a/docs/superpowers/specs/2026-09-24-instance-moves-for-every-app-design.md |
| +++ b/docs/superpowers/specs/2026-09-24-instance-moves-for-every-app-design.md |
| @@ -39,7 +39,7 @@ below, the ruling wins until the next revision folds it in. |
| | M1 | **New:** before a store's final delta, the platform write-fences the bucket or prefix against every credential holder, including outstanding uploads. Prefix stores need exclusive key ownership. Shapes P8 and P5. | |
| | M2 | **New:** API/CLI inspection and forward retry of a stuck move, an explicit recovery path when a move back cannot start, durable move id and evidence, and never a silent restore of an older source over newer target data. Folds into P4. | |
| | P4 | **Differs from §13:** P4 joins the minimum path. elatromme → us needs P0, P7, P9, P6, P1, P2, P3, P4. | |
| -| P7-trust | **Differs from §8 (Paul, 2026-09-28):** the edge-local door believes no caller-supplied visitor address. A believed address changes the password gate's guess limits and any app that authorizes by IP (Astra, P7 plan review round 3). Door requests reach the app with `X-Forwarded-For: unknown`, on any box; an app that needs the buyer's address carries it in its own signed header. The door key still says which app is calling. | |
| +| P7-trust | **Differs from §8 (Paul, 2026-09-28):** the edge-local door believes no caller-supplied visitor address. A believed address changes the password gate's guess limits and any app that authorizes by IP (Astra, P7 plan review round 3). Door requests reach the app with `X-Forwarded-For: 192.0.0.8` (RFC 7600's dummy address: a valid IP, never loopback or private, so no framework falls back to a spoofable header or the loopback peer), on any box; an app that needs the buyer's address carries it in its own signed header. The door key still says which app is calling. | |
| ## 1. The problem, as found |