Stop linking code to a site on its application name alone

A site whose application, or one of its tags, matched a repository's
application name had that repository linked as the code behind it.  Sites
that share an application name do not all run the same code, so that match
now scores below the link threshold and shows only as a suggestion with a
Link button.  The host in the repository's web addresses, web application,
diagram or name still links it, as does anything linked by hand.

Author: hackrange

app/core/external.py

@@ -1103,10 +1103,15 @@ def add(repo_id, score, reason):
         for app in self.apps_by_host.get(asset.host, []):
             for repo_id in app["repo_ids"]:
                 add(repo_id, 90, f"part of web application {app['name']}, which lists this host")
+        # A site's application name, or a tag, that matches a repository's
+        # application name is a hint and never a link on its own.  Sites that
+        # share an application name do not all run the same repositories, so
+        # this stays below LINK_THRESHOLD: it shows as suggested, and someone
+        # who knows can link it.  Other evidence about the host still links.
         names = [asset.application] + [t.tag for t in asset.tags]
         for name in names:
             for repo_id in self.by_app.get((name or "").strip().casefold(), []):
-                add(repo_id, 70, f"application {name} matches")
+                add(repo_id, LINK_THRESHOLD - 10, f"application {name} matches")
         label = asset.host.split(".")[0]
         stem = _stem(label)
         if len(stem) >= 4:

app/web/templates/external_site.html

@@ -429,7 +429,7 @@
       <input type="hidden" name="with_fields" value="1">
       <label>Application <input type="text" name="application" maxlength="200" value="{{ asset.application }}"></label>
       <label>Tags <input type="text" name="tags" maxlength="1000" value="{{ tags | join(', ') }}">
-        <span class="faint small">Comma separated.  A tag that matches a repository's application name links them.</span></label>
+        <span class="faint small">Comma separated.  A tag that matches a repository's application name suggests it, but does not link it.</span></label>
       {{ detail_fields(asset, environments, statuses, picks_json, profiles, scan_profiles) }}
       <label class="check"><input type="checkbox" name="no_scan" value="1" {{ 'checked' if asset.no_scan }}>
         <span>No scan.  We are not allowed to scan this host{% if asset.kind == 'domain' %} or anything under it{% endif %}.</span></label>

documentation/CHANGELOG.md

@@ -6,6 +6,14 @@ moved.
 
 ## 2026-11-10
 
+**An application name alone no longer links code to a site.**  A site whose
+application, or one of its tags, matched a repository's application name had that
+repository linked as code behind it.  Sites that share an application name do not
+all run the same code, so that match is now only a suggestion on the site's page,
+with a **Link** button.  The host in the repository's web addresses, its web
+application, its diagram or its name still links it, and so does anything linked
+by hand.
+
 **After upgrading, load the curated rules.**  Several shipped rules were tightened
 and six duplicates were retired, and only loading them brings that in.  Rules you
 edited yourself are left alone.

documentation/external-sites.md

@@ -480,11 +480,13 @@ Worked out on every read, best first:
 | A web application the repository is part of lists the host | 90 |
 | The host in a diagram's addresses | 80 |
 | Another environment of the host is in its web addresses or web application | 75 |
-| The site's application or a tag equals the repository's application name | 70 |
 | The host's first label, without environment words like dev or stg, equals the repository's name or its application name | 60 |
+| The site's application or a tag equals the repository's application name | 50 |
 | One contains the other | 40 |
 
-60 and over are linked; below that they are suggestions.  **Not this one**
+60 and over are linked; below that they are suggestions.  A shared application
+name alone never links a repository: sites with the same application name do not
+all run the same code, so it is offered as a suggestion to link by hand.  **Not this one**
 hides a link until somebody pins it back, and **Unpin** sends a hand made link
 back to being worked out.  Only repositories the person can see are offered, so a group
 that narrows what someone sees narrows this too.