From 7d6375efb9ad7ffd1f71a20c8d839abf78c41e37 Mon Sep 17 00:00:00 2001 From: Matej Gomboc Date: Thu, 30 Jul 2026 19:08:26 +0200 Subject: [PATCH] =?UTF-8?q?docs(rfc):=20RFC-0003=20accepted=20=E2=80=94=20?= =?UTF-8?q?flat=20capability=20table,=20verdict=20recorded?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The maintainer's acceptance, dated, in the same form as RFC-0001's: the flat per-process handle table is the representation, derivation is subset-only, transfer is a move, and the syscall ABI is capability-indexed from its first syscall. Selective transitive revocation stays expressly open for RFC-0003a — acceptance does not pre-empt that verdict — and the acceptance note records that whatever the first implementation PR proves wrong comes back as a dated amendment. This closes the small contradiction the merge created: a document on main that still said it was awaiting the verdict its merge had delivered. Co-Authored-By: Claude Fable 5 --- docs/CHANGELOG.md | 3 ++- docs/rfcs/0003-capability-table.md | 9 ++++++++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 3243211..e7c1ac9 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -12,7 +12,8 @@ recorded is indistinguishable from law that was never agreed. ### Added -- `docs/rfcs/0003-capability-table.md` — **proposed**, the first Phase 1 design RFC and the first to +- `docs/rfcs/0003-capability-table.md` — **accepted** (2026-07-30; selective revocation's final + verdict expressly deferred to RFC-0003a), the first Phase 1 design RFC and the first to cite the threat model's obligations by number, discharging O-1, O-2 and O-4 and part of O-3. Argues for a flat per-process handle table (Zircon lineage) carrying seL4's invariants — handles as indices, kernel-owned capabilities, monotone subset-only derivation, generation counters against diff --git a/docs/rfcs/0003-capability-table.md b/docs/rfcs/0003-capability-table.md index d5ecc59..dda372f 100644 --- a/docs/rfcs/0003-capability-table.md +++ b/docs/rfcs/0003-capability-table.md @@ -4,12 +4,19 @@ | Field | Value | |-------|-------| -| Status | **Proposed** — the paper the design is argued on, awaiting the maintainer's verdict | +| Status | **Accepted** — 2026-07-30, by the maintainer | | Author | Drafted by Claude Code as sparring partner; verdict the maintainer's | | Date | 2026-07-30 | | Affects | Constitution §3 (kernel doctrine), pillar 2; the syscall ABI; every later subsystem | | Discharges | Threat-model obligations O-1 (unforgeability), O-2 (non-widenability), O-3 (revocability), O-4 (no ambient authority) | +> **Accepted.** The flat per-process handle table (§4, Option B) is the capability representation; +> derivation is subset-only; transfer is a move; the syscall ABI is capability-indexed from its first +> syscall (§9). Selective transitive revocation remains **open**, deferred to RFC-0003a with B3 +> (badges + shallow derivation records) as the proposal on the table — accepting this RFC does not +> pre-empt that verdict. The open questions in §14 are the next design work, and anything the first +> implementation PR proves wrong comes back here as a dated amendment, per house practice. + ## 1. The question **How does a process hold, use, narrow, hand on, and lose the authority to touch a kernel object —