Repository navigation
Kernel: a Lens is read only from the App that reports it #60
Description
Part of the epic "Epic: nine gaps in the Kernel, found in review".
Why. The facts key a check by name alone, so any App that can write checks can post a passing check under a required Lens's name. The ruleset pins the App; the Kernel does not.
Done when facts.checks carries the reporting App's id, and the configuration names each required Lens's App. A check with a Lens's name from another App is unreadable for that Lens (#35). The status on the item has one fixed name in the configuration, and a check refuses that name if it is also a required Lens's name.
Raised by the security pass on story #20, "The Apps' permissions as data"; ruling on that issue.
Activity
don-petry commentedon Oct 15, 2026
Added scope, from the security pass on "Kernel: a dependency update needs no model review" (2026-10-14):
kernel/derive.pyreads checks by Lens name, and the last entry with a name wins. A probe with[code-scanning: failure, …, code-scanning: success]converged and was approved. Once a dependency update is judged by the deterministic Lenses alone, that is its only judge. Done when: any failing entry for a Lens fails it, or entries from an App other than the Lens's own are unreadable for that Lens.Decisions: 0015 replaces 0012; a model Lens is named once too (#60)
Kernel: a check is matched to a Lens by its check run's exact name (#60)