Kernel: a Lens run by GitHub Actions is read only from its own workflow file

config/defaults.json

@@ -7,17 +7,20 @@
       {
         "lens": "verify",
         "check": "verify",
-        "app_id": 15368
+        "app_id": 15368,
+        "workflow": ".github/workflows/verify.yml"
       },
       {
         "lens": "secret-scan",
         "check": "Secret scan (gitleaks)",
-        "app_id": 15368
+        "app_id": 15368,
+        "workflow": ".github/workflows/ci.yml"
       },
       {
         "lens": "code-scanning",
         "check": "CodeQL",
-        "app_id": 57789
+        "app_id": 57789,
+        "workflow": null
       }
     ],
     "model": [
@@ -53,6 +56,7 @@
     "max_unmerged_closes": 1,
     "org_max_active_runs": 4,
     "max_diff_lines": 4000,
-    "max_acts_per_item": 6
+    "max_acts_per_item": 6,
+    "max_path_length": 255
   }
 }

docs/decisions/0005-each-role-writes-through-its-own-app.md

@@ -36,7 +36,7 @@ GitHub does not count an approval from an author or a last pusher, so the approv
 | Until a Consumer repo is served (slice 3), each App is installed on named repos only; from then, as decided at that cutover, against UJ-6 | `tools/check_apps.py` |
 | Every permitted Effect of every Intent is within the ceiling of that Role's App | waiting on `roles/` |
 | The Controller's `checks: write` cannot pass a Lens: a required Lens is read only from its own App, and the status on the item has one name that is no Lens's or its check's | `tests/test_decide.py::test_a_check_from_another_app_is_unreadable_for_its_lens`, `tests/test_tools.py::test_the_status_on_the_item_never_carries_a_required_lens_name` |
-| A Lens pinned to GitHub Actions is bound to any Actions job of its check's name, one a pull request adds among them: every check from the Lens's App is read and all must pass, so an extra passing one is harmless, and replacing the real job is a change to `.github/`, which only the Maintainer authors (0004). An upload to code scanning with CodeQL's tool and category, by anyone with `security_events: write`, might replace the CodeQL verdict; a follow-up story pins each Lens to its workflow file | `tests/test_decide.py::test_every_check_a_lens_reports_from_its_own_app_is_read`; the upload unverified |
+| A Lens pinned to GitHub Actions is bound to any Actions job of its check's name, one a pull request adds among them: every check from the Lens's App is read and all must pass, so an extra passing one is harmless, and replacing the real job is a change to `.github/`, which only the Maintainer authors (0004). An upload to code scanning with CodeQL's tool and category, by anyone with `security_events: write`, might replace the CodeQL verdict; a follow-up story pins each Lens to its workflow file | `tests/test_decide.py::test_every_check_a_lens_reports_from_its_own_app_is_read`, `tests/test_decide.py::test_a_check_from_another_workflow_is_unreadable_for_its_lens`; the upload unverified, `sim/grounding.py` |
 | Every write by a Factory identity matches a recorded Effect; one that does not raises an alert | waiting on `controller/` |
 | No Factory secret is readable by a workflow that runs on a Work item's branch | waiting on `harness/` |
 | The code owners file is the org's, word for word | `tests/test_tools.py::test_code_owners_are_the_orgs_word_for_word` |

docs/decisions/0015-a-lens-is-read-from-its-own-app-and-only-what-gates-holds-a-merge.md

@@ -1,10 +1,7 @@
 # 0015. A Lens is read from its own App, and only what gates holds a merge
 
-Status: accepted. Replaces `docs/decisions/0012-lenses-report-findings-and-the-kernel-decides-convergence.md`,
-and keeps all of it. It adds the Maintainer's ruling of 2026-10-14 on a Finding that does not gate
-("Kernel: what happens to a Finding that does not gate", issue 55), and the ruling on
-"The Apps' permissions as data, before any is registered" (issue 20) that a Lens is read only from
-the App that reports it ("Kernel: a Lens is read only from the App that reports it", issue 60).
+Status: replaced by `docs/decisions/0018-a-lens-is-read-from-its-own-app-and-workflow-and-only-what-gates-holds-a-merge.md`,
+which holds the rule in force and its boundaries.
 
 ## Decision
 

docs/standards/workflows.md

@@ -61,10 +61,10 @@ jobs:
       contents: read       # then only what this job needs
 ```
 
-No personal access token, no `secrets: inherit`; every checkout sets `persist-credentials: false`.
+No personal access token, no `secrets: inherit`; every checkout sets `persist-credentials: false`. No job is granted `security-events: write`: with it, an upload to code scanning could stand for CodeQL's verdict.
 
 Org standard: ci-standards.md, "Permissions Policy". Refusing a personal token and inherited secrets departs from github-settings.md, "Required secrets (all repos)": decision 0014.
-Held by: `examples/workflows/invalid/permissions.none-declared.yml`, `examples/workflows/invalid/token.a-persons-token.yml`, `examples/workflows/invalid/credentials.a-token-left-on-disk.yml`
+Held by: `examples/workflows/invalid/permissions.none-declared.yml`, `examples/workflows/invalid/token.a-persons-token.yml`, `examples/workflows/invalid/credentials.a-token-left-on-disk.yml`, `examples/workflows/invalid/permissions.security-events-on-a-job.yml`
 
 ## Text from outside is never a command
 

examples/facts.json

@@ -123,18 +123,21 @@
     {
       "name": "verify",
       "app_id": 15368,
+      "workflow": ".github/workflows/verify.yml",
       "conclusion": "success",
       "completed_at": "2026-10-11T12:06:00Z"
     },
     {
       "name": "Secret scan (gitleaks)",
       "app_id": 15368,
+      "workflow": ".github/workflows/ci.yml",
       "conclusion": "success",
       "completed_at": "2026-10-11T12:06:00Z"
     },
     {
       "name": "CodeQL",
       "app_id": 57789,
+      "workflow": null,
       "conclusion": "success",
       "completed_at": "2026-10-11T12:06:00Z"
     }

examples/invalid/config.a-change-by-a-person-skips-the-model-review.json

@@ -7,17 +7,20 @@
       {
         "lens": "verify",
         "check": "verify",
-        "app_id": 15368
+        "app_id": 15368,
+        "workflow": ".github/workflows/verify.yml"
       },
       {
         "lens": "secret-scan",
         "check": "Secret scan (gitleaks)",
-        "app_id": 15368
+        "app_id": 15368,
+        "workflow": ".github/workflows/ci.yml"
       },
       {
         "lens": "code-scanning",
         "check": "CodeQL",
-        "app_id": 57789
+        "app_id": 57789,
+        "workflow": null
       }
     ],
     "model": [
@@ -54,6 +57,7 @@
     "max_unmerged_closes": 1,
     "org_max_active_runs": 4,
     "max_diff_lines": 4000,
-    "max_acts_per_item": 6
+    "max_acts_per_item": 6,
+    "max_path_length": 255
   }
 }

examples/invalid/config.a-neutral-check-passes.json

@@ -7,17 +7,20 @@
       {
         "lens": "verify",
         "check": "verify",
-        "app_id": 15368
+        "app_id": 15368,
+        "workflow": ".github/workflows/verify.yml"
       },
       {
         "lens": "secret-scan",
         "check": "Secret scan (gitleaks)",
-        "app_id": 15368
+        "app_id": 15368,
+        "workflow": ".github/workflows/ci.yml"
       },
       {
         "lens": "code-scanning",
         "check": "CodeQL",
-        "app_id": 57789
+        "app_id": 57789,
+        "workflow": null
       }
     ],
     "model": [
@@ -53,6 +56,7 @@
     "max_unmerged_closes": 1,
     "org_max_active_runs": 4,
     "max_diff_lines": 4000,
-    "max_acts_per_item": 6
+    "max_acts_per_item": 6,
+    "max_path_length": 255
   }
 }

examples/invalid/config.a-required-lens-with-no-app.json

@@ -7,16 +7,19 @@
       {
         "lens": "verify",
         "check": "verify",
-        "app_id": 15368
+        "app_id": 15368,
+        "workflow": ".github/workflows/verify.yml"
       },
       {
         "lens": "secret-scan",
         "check": "Secret scan (gitleaks)",
-        "app_id": 15368
+        "app_id": 15368,
+        "workflow": ".github/workflows/ci.yml"
       },
       {
         "lens": "code-scanning",
-        "check": "CodeQL"
+        "check": "CodeQL",
+        "workflow": null
       }
     ],
     "model": [
@@ -52,6 +55,7 @@
     "max_unmerged_closes": 1,
     "org_max_active_runs": 4,
     "max_diff_lines": 4000,
-    "max_acts_per_item": 6
+    "max_acts_per_item": 6,
+    "max_path_length": 255
   }
 }

examples/invalid/config.a-required-lens-with-no-check.json

@@ -7,16 +7,19 @@
       {
         "lens": "verify",
         "check": "verify",
-        "app_id": 15368
+        "app_id": 15368,
+        "workflow": ".github/workflows/verify.yml"
       },
       {
         "lens": "secret-scan",
-        "app_id": 15368
+        "app_id": 15368,
+        "workflow": ".github/workflows/ci.yml"
       },
       {
         "lens": "code-scanning",
         "check": "CodeQL",
-        "app_id": 57789
+        "app_id": 57789,
+        "workflow": null
       }
     ],
     "model": [
@@ -52,6 +55,7 @@
     "max_unmerged_closes": 1,
     "org_max_active_runs": 4,
     "max_diff_lines": 4000,
-    "max_acts_per_item": 6
+    "max_acts_per_item": 6,
+    "max_path_length": 255
   }
 }

examples/invalid/config.a-required-lens-with-no-workflow.json

@@ -0,0 +1,61 @@
+{
+  "approver": "donpetry-bot",
+  "author_role": "dev-lead",
+  "owner_role": "pr-review",
+  "required_lenses": {
+    "deterministic": [
+      {
+        "lens": "verify",
+        "check": "verify",
+        "app_id": 15368
+      },
+      {
+        "lens": "secret-scan",
+        "check": "Secret scan (gitleaks)",
+        "app_id": 15368,
+        "workflow": ".github/workflows/ci.yml"
+      },
+      {
+        "lens": "code-scanning",
+        "check": "CodeQL",
+        "app_id": 57789,
+        "workflow": null
+      }
+    ],
+    "model": [
+      "pr-review"
+    ],
+    "model_not_required_for": [
+      "dependency"
+    ]
+  },
+  "status_on_item": "factory",
+  "check_conclusions": {
+    "success": "passing",
+    "failure": "failing",
+    "timed_out": "failing",
+    "queued": "pending",
+    "in_progress": "pending",
+    "pending": "pending",
+    "waiting": "pending",
+    "requested": "pending",
+    "expected": "pending",
+    "neutral": "unreadable",
+    "skipped": "unreadable",
+    "cancelled": "unreadable",
+    "stale": "unreadable",
+    "action_required": "unreadable",
+    "startup_failure": "unreadable",
+    "error": "unreadable"
+  },
+  "limits": {
+    "max_attempts": 3,
+    "max_rounds": 3,
+    "max_runs_per_item": 10,
+    "max_unmerged_closes": 1,
+    "org_max_active_runs": 4,
+    "max_diff_lines": 4000,
+    "max_acts_per_item": 6,
+    "max_path_length": 255
+  }
+}

examples/invalid/config.a-staleness-limit-copied-from-the-lifecycle.json

@@ -7,17 +7,20 @@
       {
         "lens": "verify",
         "check": "verify",
-        "app_id": 15368
+        "app_id": 15368,
+        "workflow": ".github/workflows/verify.yml"
       },
       {
         "lens": "secret-scan",
         "check": "Secret scan (gitleaks)",
-        "app_id": 15368
+        "app_id": 15368,
+        "workflow": ".github/workflows/ci.yml"
       },
       {
         "lens": "code-scanning",
         "check": "CodeQL",
-        "app_id": 57789
+        "app_id": 57789,
+        "workflow": null
       }
     ],
     "model": [
@@ -53,7 +56,8 @@
     "max_unmerged_closes": 1,
     "org_max_active_runs": 4,
     "max_diff_lines": 4000,
-    "max_acts_per_item": 6
+    "max_acts_per_item": 6,
+    "max_path_length": 255
   },
   "stale_after_minutes": {
     "draft": 1440,

examples/invalid/config.conclusion-mapped-to-nothing.json

@@ -7,17 +7,20 @@
       {
         "lens": "verify",
         "check": "verify",
-        "app_id": 15368
+        "app_id": 15368,
+        "workflow": ".github/workflows/verify.yml"
       },
       {
         "lens": "secret-scan",
         "check": "Secret scan (gitleaks)",
-        "app_id": 15368
+        "app_id": 15368,
+        "workflow": ".github/workflows/ci.yml"
       },
       {
         "lens": "code-scanning",
         "check": "CodeQL",
-        "app_id": 57789
+        "app_id": 57789,
+        "workflow": null
       }
     ],
     "model": [
@@ -53,6 +56,7 @@
     "max_unmerged_closes": 1,
     "org_max_active_runs": 4,
     "max_diff_lines": 4000,
-    "max_acts_per_item": 6
+    "max_acts_per_item": 6,
+    "max_path_length": 255
   }
 }

examples/invalid/config.no-deterministic-lens.json

@@ -37,6 +37,7 @@
     "max_unmerged_closes": 1,
     "org_max_active_runs": 4,
     "max_diff_lines": 4000,
-    "max_acts_per_item": 6
+    "max_acts_per_item": 6,
+    "max_path_length": 255
   }
 }

examples/invalid/facts.a-category-nobody-owns.json

@@ -85,18 +85,21 @@
     {
       "name": "verify",
       "app_id": 15368,
+      "workflow": ".github/workflows/verify.yml",
       "conclusion": "success",
       "completed_at": "2026-10-11T12:06:00Z"
     },
     {
       "name": "Secret scan (gitleaks)",
       "app_id": 15368,
+      "workflow": ".github/workflows/ci.yml",
       "conclusion": "success",
       "completed_at": "2026-10-11T12:06:00Z"
     },
     {
       "name": "CodeQL",
       "app_id": 57789,
+      "workflow": null,
       "conclusion": "success",
       "completed_at": "2026-10-11T12:06:00Z"
     }