[Evanfeenstra]

Plans only, no code. It rewrites plans/app-payments.md §4.4 and points plans/app-repos.md at it.

Why

A public app on a box the person isn't signed in to needs to know who its players are (app-repos item 4, #624). The person's wallet is Peel, which already keeps a per-app connection with consent and a budget. So signing in should ride that connection rather than a new browser wallet. In the owner's words: "We already have a wallet! It's called Peel!"

What changed

plans/app-payments.md

• §4.4 rewritten: "Identity: signing in through the connection" (R6).
  • One sheet. Signing in is one more thing the connection grants, beside the budget: "you" (the root Sphinx key, the default) or "a new identity for this app" (a LUD-05 child key, also used when the app requires one).
  • The guard. Only strut's visitor challenge is signed, and only when its host is the seller's domain. That closes sphinx-bridge's old hole (one app minting another's login) by binding the signature to a domain, not by keeping the identity key out of it.
  • The verifier and the actor. A new ln-message verifier checks the signature, and the actor is secp:<pubkey>, the same key payments come from.
  • This replaces the 2026-11-04 rule "a per-app linking key, never the identity key".
• sign_in is a HOST request, beside Remote public apps: any strut UI hosts another server's public app, one-tap payment in Peel #625's buy_credit in specs/WALLET.md §1.2, and listed by host_capability. It is not a strut/wallet/* method; sign_message stays "never".
• §5.3 and R7: a stranger's public app on each device.
  • The Mac uses Remote public apps: any strut UI hosts another server's public app, one-tap payment in Peel #625's remote mode: the person's own strut UI is the outer page.
  • The iPhone has no local strut, so it opens the served box directly, with every connection and sheet keyed by the origin Peel loaded and the page's own claims ignored. This is R5's rule for orgs, applied to any origin.
  • Later: bundling strut's UI in Peel lets the iPhone use remote mode too, and that bundle is only static files.
• Work item 9 is the first test: sign in to a public app through Peel, write a row as yourself, then tip through the same connection. It lists the strut half and the Peel half.

plans/app-repos.md

• Peel through its wallet connection is the next sign-in (§5.3, 7).
• The browser and passkey Sphinx wallets (items 5 and 6) are now marked "later".
• A closing note says that Sphinx identity is planned in app-payments, not here.

For reviewers

• It depends on two open PRs: Remote public apps: any strut UI hosts another server's public app, one-tap payment in Peel #625 (remote public apps, buy_credit, specs/WALLET.md §1.2) and Signed-in visitors: a public app's players sign in with a key (app-repos work item 4) #624 (signed-in visitors, the challenge and the verifier seam). It merges cleanly with both.
• R6 and R7 are the owner's rulings from 2026-11-10.