The doctrine every feature follows
Air-gapped console. Lens is a desktop app for macOS (Intel and Apple Silicon) and Windows. It talks to servers over the operator's own SSH logins and to nothing else. LockFlare runs no service Lens depends on: licenses are signed keys opened on the computer, the key drive is the identity, and the only server-side infrastructure LockFlare keeps is the license issuer. Nothing Lens does phones home; the model catalog for Themis is refreshed only from a button.
Nothing installed on the box. Every reading is a command over the session already open; every change is a script run as root through the same sudo path. There is no agent, no daemon, no port opened for Lens. What must run while Lens is closed is a file Lens writes on the box — a cron line, a systemd unit, a hook — never a Lens process. Lens is a configuration tool that acts when the operator opens it, not an alerting system.
Every job runs detached on the box. Long work (installs, restores, upgrades, data moves, cluster builds) is started detached on the box, in its own folder under /var/lib/lens/jobs, and survives Lens closing. The screen shows one lightbox listing the job's own steps with Stop; blocking jobs keep it up, others offer "Keep working". Multi-box jobs read the whole board first — shells, root, tools, room — and show what is in the way with the fix beside each line; nothing writes until the list is empty.
Proved before kept. Changes that can lock the operator out (sshd hardening, a network address, a bridge) arm a revert first and are kept only after a fresh login or reachability check succeeds; otherwise the previous file comes back and the screen says "reverted". Firewall rules never remove the operator's own SSH cover; the SSH port is allowed before the firewall is turned on and cannot be denied.
Being logged in is the authentication. No Touch ID per action. Root is the saved login's password through sudo, sealed under the drive key and asked once if missing. Touch ID is used only to unlock Lens and for the ceremonies (uninstall, wipe, duplicating the key), where Go asks a second time so no screen can skip it.
Consistency of the frame. Every screen wears the same head: a state band that says the verdict in one line, tabs, findings worst-first with the fix on the row, a row that opens into the thing's own page, quiet background re-reads that never disturb an open form, and a job console with live output wherever something runs for minutes.
