App, Host, and Plan
Separate reviewable authoring choices from the immutable execution input consumed by the Kernel.
Lenso uses two different documents for two different owners.
| Artifact | Owner | Purpose |
|---|---|---|
| Plugin Root plus Host Catalog | Authoring tools, product Host, and the App repository | Reviewable Plugin Releases, keyed Instances, Profiles, configuration, and disable markers |
| Resolved App Plan | lenso-app-plan |
Canonical, complete, immutable input consumed at boot |
What the project declares
- keyed Plugin Instances and entrypoints;
- explicit Capability requirements and provider bindings;
- execution classes and optional placement;
- verified
.lenso-pluginBundle inputs selected for the current Host; - exact Capability Descriptors and generated binding artifacts;
- non-secret configuration and explicit
secret_refvalues; and - optional Web profiles that select a Shell, Browser Adapter, and UI Contributions.
There is no Lenso-owned lockfile. Cargo, npm, and Bun retain ownership of their normal lock state; OCI inputs must use immutable digests.
What resolution guarantees
Resolution validates package state, Descriptor freshness, configuration schema, execution classes, provider cardinality, and every explicit binding. Canonical serialization makes the approved Plan byte-stable.
After boot, the Kernel cannot install packages, discover providers, rebind a consumer, change placement, or rewrite configuration. The Host may resolve a new Desired State into a new immutable App Generation, but existing Turns keep their leased Generation until drain completes.