feat(capability): value types for the capability table (RFC-0003, part 1) - #11
Merged
Conversation
…t 1)
The accepted capability design turns into code, first increment. A new
no_std workspace crate, setonix-capability, holds the pure logic of the
capability spine so it can be host-unit-tested — a bare-metal target has no
test harness, and this is the most security-critical logic in the kernel,
so it lives where it can be exercised exhaustively away from the hardware.
This part is the value types the flat table is built from, each carrying a
compiler-checked invariant rather than a rule a reviewer must remember:
- Rights: a closed bitmask (DUPLICATE, TRANSFER, READ, WRITE, REVOKE)
whose sole attenuation operation, diminish, is subset-only. O-2
(non-widenability) is a property of the type — there is no constructor
from arbitrary bits and no operation that adds a right. An exhaustive
test checks over all 32 combinations that a successful diminish returns
a subset of its source.
- Generation: a 64-bit counter, fail-closed on exhaustion (next returns
None rather than wrapping to a value a stale handle could match). This
is the mechanism behind O-1's reuse case and O-3's destruction case,
and the fail-closed width is the RFC-0003 amendment made concrete.
- Handle: the userspace-facing name — a table index plus the generation
its slot held when minted. Carries no authority by itself.
- CapabilityError: a fail-closed error for every table operation.
Per the RFC-0003 prior-art amendment, the crate doc states plainly that the
compile-time guarantees cover the kernel's internal handling; the
userspace-observable cross-process transfer is a runtime table operation
the generation scheme secures — the borrow checker cannot span protection
domains, so the crate does not pretend it does.
Authorship is AI-first under amended §5.3; this is pure architecture-
independent logic with no unsafe and no assembly, so it is ordinary
review, not the boot/asm sparring-partner regime. The crate is standalone
for now — the kernel wires it in once there are kernel objects for
capabilities to reference.
Verified locally: fmt, spelling, pins, markdown clean; clippy clean under
-D warnings; 12 host tests pass; builds for both Tier-1 targets (proving it
stays no_std). CI gains a capability host-test group and a per-target build.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The accepted capability design (RFC-0003) becomes code — the first increment, and the first time paper meets a compiler. A new
no_stdcratesetonix-capabilityholds the pure logic of the capability spine, in its own crate so it can be host-unit-tested (a bare-metal target has no test harness, and this is the kernel's most security-critical logic).This part is the value types; the owned no-
CloneCapabilityand the flat table follow next (§5.3 — small, reviewable steps).Rights— closed bitmask; only attenuation isdiminish(subset-only). O-2 is a type property: no constructor from arbitrary bits, no operation that widens. Exhaustive test over all 32 combinations confirms a successfuldiminishis always a subset of its source.Generation— 64-bit, fail-closed on exhaustion (the RFC-0003 amendment made concrete); the mechanism behind O-1 reuse and O-3 destruction.Handle— index + generation; the userspace-facing name, no authority by itself.CapabilityError— fail-closed for every operation.Crate doc scopes the compile-time claim to kernel-internal handling per the prior-art amendment (the borrow checker can't span protection domains).
Which pillar does this serve?
Pillar 2 — the capability system's enforcement mechanism, now executable.
Borrow Ledger
Microkernel core (capabilities) — write ourselves, AI-first authorship under amended §5.3, maintainer reviews line by line. Pure logic, no
unsafe, no assembly — ordinary review, not the boot/asm sparring-partner regime.unsaferegisterunsafeblocks: None. The crate is safe Rust throughout;unsafe_code = "deny"(workspace) applies with no opt-in module.Checklist
no_std); clippy clean under-D warningsCHANGELOG.mdupdated;CLAUDE.mdlayout notes the crate + the host-test patternStandalone for now; the kernel links it once there are kernel objects for capabilities to reference.
🤖 Generated with Claude Code