[ymote]

Follow-up to #72. Rebuilt on main bb2b219 after #70, which pins App Hub e8601b80 (with glance in KNOWN_CAPABILITIES) and Rinx 68afcf79. This PR changes no pin (Rinx, App Hub, octos, makepad): the earlier App Hub move to 59cc35eb and its README pin edits are gone. The only file changed is crates/shell/src/glance.rs.

What

• crates/shell/src/glance.rs: the os.* stopgap is gone. It is replaced by a capability check:
  • Caller::Contained { app, granted } records whether the caller holds glance. publish, withdraw and list all refuse a contained caller without it, with the error "<app> was not granted the glance capability". list now returns a Result.
  • Where the grant comes from: the Card runner's isolate gate (makepad splash_policy::service_allowed) lets glance.* out of an app's isolate only when the app's resolved policy grants glance. So a call GlanceService receives from the app itself holds the grant. A call from a host sheet runs under no app policy, so it has granted: false and is refused.
  • System apps get no exemption. They run under their own manifest's policy like any store app (App Hub's system::prepare resolves them through the same KNOWN_CAPABILITIES). A system app that publishes must request glance, the same way Mail requests mail and AI providers requests llm. Native modules (the shell's own code) are unchanged.
  • The shell's limits are unchanged: L0 only, size caps, rate limit, per-app card cap, dedupe and expiry.
• Tests:
  • a_contained_app_needs_the_glance_capability_whoever_it_is: a granted store app publishes. Without the grant, publish, list and withdraw are all refused, for os.* apps too. Native callers still publish.
  • the_runner_gate_admits_glance_only_with_the_capability: the makepad gate refuses glance.* without glance, allows all three methods with it, and glance grants nothing else.
  • The dispatch test now checks that a sheet-originated glance.publish is refused. It previously checked that a non-os.* app was refused.
• News manifest unchanged: the News bundle does not call glance.*. The demo digest (OCTOSENSE_GLANCE_DEMO) is published by the shell as a granted os.news. When News publishes from its bundle, it adds glance to apps/news/bundle/manifest.json.

Checked against the real App Hub grant (e8601b80)

A scratch crate on octosense-app-policy at e8601b80 confirmed: KNOWN_CAPABILITIES has glance; a system manifest (os.news, HostLimits::system()) that declares glance resolves with allows("glance"); a system app that does not declare it does not get it; a store app declaring it resolves with it.

Conflict with #87

#87 (sys.digest) also edits glance.rs: the old Caller::Contained(String) type and the os.* gate. Whichever of #86 and #87 merges second rebases onto the other.

Verification (local, macOS)

• python3 tools/setup.py --check --cargo: pass (.sources are hub worktrees at main's pins)
• cargo check --locked -p octosense, with and without --features mobile-apps: pass
• bash tools/check-shell-graph.sh -p octosense: pass
• from phone/: cargo check --locked -p octosense-home --features mobile-apps: pass
• from phone/: bash ../tools/check-shell-graph.sh -p octosense-home: pass
• from phone/: cargo test --locked -p octosense-app-policy --no-run: pass, not ambiguous (one App Hub now that Rinx and the shell agree)
• cargo test --locked -p octosense-shell glance: 12 passed. With --features app-hub: 13 passed, including the Card runner dispatch test.
• Not run on a device.

🤖 Generated with Claude Code