ccf851a
@@ -0,0 +1,35 @@
# Spawn — a forge births a forge
Design for issue #389. A forge can make a child: a new org and instance with
chosen apps, the crew's briefs, its own keys and domain. The child follows its
parent, takes its updates, and proposes back. Built as linked issues; this page
is the shape they share.
## Never copied
The parent's secrets, tokens, SSH keys, agent credentials, run ledger, issues
and user accounts. The child mints its own. A test in #420 and #422 proves it.
## The order (what waits for what)
| issue | what                                                    | waits for        |
| ----- | ------------------------------------------------------- | ---------------- |
| #420  | spawn plan: one validated value, dry-run                | #383             |
| #427  | placement seam; hosted inside the parent today          | #420             |
| #421  | spawn action: org, instance, apps as repos, briefs      | #420, #427       |
| #422  | first boot: direction, own tokens, domain, claim link   | #421             |
| #423  | cross-forge following over HTTPS, read-only token       | #422            |
| #424  | propose upstream as a pull on the parent                | #423             |
| #425  | family tree across forges, signed heartbeats            | #423             |
| #426  | '+ New forge' in the studio                             | #421, #422, #339 |
External bodies (Cloudflare, Fly, metal) are decided by spike #339 and arrive
as a second implementation of the placement seam (#427), in their own issue.
## Choices
- Following across forges is HTTPS git with scoped tokens, because hosted
  children have no SSH.
- The parent never reaches into a child; children report in with a signed
  heartbeat carrying counts and version only.
- A proposal can only create branches under `child/<name>/` and open pulls.
		@@ -0,0 +1,35 @@
	1	# Spawn — a forge births a forge
	2
	3	Design for issue #389. A forge can make a child: a new org and instance with
	4	chosen apps, the crew's briefs, its own keys and domain. The child follows its
	5	parent, takes its updates, and proposes back. Built as linked issues; this page
	6	is the shape they share.
	7
	8	## Never copied
	9
	10	The parent's secrets, tokens, SSH keys, agent credentials, run ledger, issues
	11	and user accounts. The child mints its own. A test in #420 and #422 proves it.
	12
	13	## The order (what waits for what)
	14
	15	\| issue \| what \| waits for \|
	16	\| ----- \| ------------------------------------------------------- \| ---------------- \|
	17	\| #420 \| spawn plan: one validated value, dry-run \| #383 \|
	18	\| #427 \| placement seam; hosted inside the parent today \| #420 \|
	19	\| #421 \| spawn action: org, instance, apps as repos, briefs \| #420, #427 \|
	20	\| #422 \| first boot: direction, own tokens, domain, claim link \| #421 \|
	21	\| #423 \| cross-forge following over HTTPS, read-only token \| #422 \|
	22	\| #424 \| propose upstream as a pull on the parent \| #423 \|
	23	\| #425 \| family tree across forges, signed heartbeats \| #423 \|
	24	\| #426 \| '+ New forge' in the studio \| #421, #422, #339 \|
	25
	26	External bodies (Cloudflare, Fly, metal) are decided by spike #339 and arrive
	27	as a second implementation of the placement seam (#427), in their own issue.
	28
	29	## Choices
	30
	31	- Following across forges is HTTPS git with scoped tokens, because hosted
	32	children have no SSH.
	33	- The parent never reaches into a child; children report in with a signed
	34	heartbeat carrying counts and version only.
	35	- A proposal can only create branches under `child/<name>/` and open pulls.