Crate capos 

capOS front-door SDK.

capos is the single crate a Rust author depends on to write a capOS application against typed Cap’n Proto capability clients. The clients are written once and run over a Transport seam:

• The default ring feature provides the in-system transport: an application running inside capOS reaches the kernel through its per-process capability ring (RingTransport). This is no_std.
• The reserved remote feature is for a future host-side transport that reaches a capOS instance over the remote session connection. It is not implemented yet; see docs/backlog/capos-sdk-dual-transport.md.

For the ring feature this crate is a thin facade: it re-exports the capos_rt runtime, the typed capability clients, and the entry_point! macro, and adds a prelude of the items most applications use. Reach for the facade rather than depending on capos-rt internals directly, so client code stays transport-agnostic.

Modules

alloc

capos_capnp

capset

client

entry

prelude

The items most in-system applications use: the runtime, the transport seam (the Transport trait and its RingTransport implementation), the Client trait, the common typed clients, and the call error types (ClientError and its TransportError variant payload).

ring

syscall

transport

Transport seam shared by the typed capability clients.

Macros

entry_point

Structs

AccountStoreManagerClient

AccountStoreReaderClient

AnswerId

ApplicationException

AuditLogClient

AuditRecord

AuthorityBrokerClient

AuthorizedKeyStoreClient

BlockDeviceClient

BlockDeviceInfoResult

Result of BlockDevice.info: device geometry.

BlockDeviceReadResult

Result of BlockDevice.readBlocks: the sector bytes returned by the kernel.

BootPackageClient

Bootstrap

CallId

CapCqe

Completion Queue Entry — 32 bytes.

CapRingHeader

Ring header at the start of the shared page.

CapSet

CapSqe

Submission Queue Entry — 64 bytes.

Capability

CapabilityInfo

CapabilityManagerClient

CapabilityRef

ClientState

CompletedCall

ConsoleBootstrapPolicy

ConsoleClient

ConsolePasswordStatus

ConsolePasswordVerifyResult

CopyTransfer

CpuIsolationAccountingTarget

CpuIsolationActivationPreflight

CpuIsolationGrantMinted

A successfully minted grant: the CpuIsolationPoolGrant cap plus the grant_id that names it for a later revoke_grant.

CpuIsolationGrantMinterClient

Client for a runtime CpuIsolationGrantMinter: mints a fresh CpuIsolationPoolGrant for an operator-chosen (account, pool) at call time, bounded by the minter’s declared allowlist.

CpuIsolationGrantMinterInfo

CpuIsolationLeaseClient

CpuIsolationLeaseCreateResponse

CpuIsolationLeaseCreateResult

CpuIsolationLeaseIdentity

CpuIsolationLeaseInfo

CpuIsolationLeaseOwner

CpuIsolationLeaseRenewResponse

CpuIsolationLeaseRevokeResult

CpuIsolationLeaseSpec

CpuIsolationPoolGrantClient

Client for a bootstrap CpuIsolationPoolGrant: binds one authenticated account to one declared CPU-isolation pool. create_lease mints a CpuIsolationLease against the bound pool with the bound account stamped on, reusing the CpuIsolationLease.create result shape.

CpuIsolationPoolGrantInfo

CreatePipeResult

Result of ProcessSpawner.createPipe: typed owned caps for both halves. Drop releases each half automatically; the parent typically passes one half into a child via ProcessSpawner.spawn grants before dropping its end.

CredentialStoreClient

DeviceMmioBrokeredNvmeAdminIdentifyResult

DeviceMmioBrokeredNvmeAdminOpReadBytesResult

Result of DeviceMmio.brokeredNvmeIoSyncReadBytes @22: the bounded status/echo fields plus the full read-back transfer as data. The per-block match and block-distinctness are attested kernel-side in the release marker.

DeviceMmioBrokeredNvmeControllerEnableResult

DeviceMmioClient

DeviceMmioInfo

DeviceMmioMapAdmission

DeviceMmioRead32Result

DeviceMmioUnmapResult

DeviceMmioWrite32Admission

DirEntry

A single directory entry returned by Directory.list.

DirectoryClient

DirectoryListResult

Result of Directory.list: the entries in the directory.

DmaBufferClient

DmaBufferCompleteDescriptorAdmission

DmaBufferFreeBufferResult

DmaBufferInfo

DmaBufferMapAdmission

DmaBufferSubmitDescriptorAdmission

DmaBufferUnmapResult

DmaPoolAllocateBufferRejection

DmaPoolAllocateBufferResult

DmaPoolClient

DmaPoolInfo

EntropyFillResult

EntropySourceClient

FileClient

FileReadResult

Result of File.read: the data returned by the kernel.

FileStatResult

Result of File.stat: size plus backend-provided metadata timestamps. Timestamp values are Unix epoch nanoseconds when supplied, or zero when the backend is unstamped/unsupported.

HardwareAuditDrain

HardwareAuditLogClient

HardwareAuditRecord

HardwareAuditSnapshot

InterruptAcknowledgeAdmission

InterruptClient

InterruptInfo

InterruptMaskAdmission

InterruptUnmaskAdmission

InterruptWaitAdmission

LogReadResult

LogReaderClient

LogRecordEntry

LogSinkClient

ManualBuildInfo

The build/commit provenance returned by buildInfo.

ManualClient

ManualPage

A manual page returned by ManualClient::page_wait.

ManualPageRef

A name(section) cross-reference returned by apropos.

ManualTopic

One curated topic-index entry returned by ManualClient::topics_wait.

NamespaceClient

NamespaceListResult

NetworkConfig

NetworkManagerClient

NicClient

Typed client for the Nic capability: the Phase C userspace virtio-net driver’s frame round-trip surface. Frames cross the boundary as inline Data; the kernel copies them through the manager-owned bounce buffer, so no host-physical address or device-usable handle is exposed.

NicLinkStatusResult

Nic.linkStatus result: the bound NIC’s link state plus the evidence triple.

NicMacAddressResult

Nic.macAddress result: the bound NIC’s MAC (six bytes inline) plus the evidence triple.

NicReceivePollResult

Nic.receivePoll result: the next arrived Ethernet frame inline (when frame_present), the observed EtherType, and the evidence triple. The sustained-receive pool stays armed across calls; frame_present = false is the cheap “no frame yet” answer with no device reset.

NicReceiveResult

Nic.receive result: one received Ethernet frame inline plus the observed EtherType and the evidence triple.

NicTransmitResult

Nic.transmit admission: the result/reason/sideEffect evidence triple.

OwnedCapability

Owned runtime handle for a local capability slot.

PipeClient

PipeReadResult

Result of Pipe.read: the bytes copied out plus the EOF flag the kernel returns when the writer half has been closed and the buffer is drained.

ProcessHandleClient

ProcessSpawnerClient

PromiseId

ResourceProfileManagerClient

ResourceProfileReaderClient

RestrictedLauncherClient

RestrictedShellLauncherClient

RingClient

Runtime

RuntimeRingClient

SchedulingContextBindResult

SchedulingContextBinding

SchedulingContextClient

SchedulingContextCreateResponse

SchedulingContextCreateResult

SchedulingContextIdentity

SchedulingContextInfo

SchedulingContextNotificationSlot

SchedulingContextNotificationSnapshot

SchedulingContextRevokeResult

SchedulingContextSpec

SchedulingPolicyClient

SchedulingPolicySnapshot

SessionAuditContext

SessionInfo

SessionManagerClient

SessionStartResult

ShellBundleEndpoint

ShellBundleResult

SpawnGrant

SpawnResult

SshAuthorizedKeyDecision

SshHostKeyClient

SshHostKeyPublicKey

StdIOClient

Prototype client for the shell-serviced StdIO endpoint facet.

StdIOReadRequest

StdIOReadResult

StoreClient

StoreGetResult

StorePutResult

SystemInfoClient

TcpAcceptResult

TcpListenAuthorityClient

TcpListenResult

TcpListenerClient

TcpSocketClient

TerminalReadResult

TerminalSessionClient

ThreadControlClient

ThreadExitCode

ThreadHandleClient

ThreadSpawnerClient

TimerClient

TimerNow

UdpRecvFromResult

UdpSocketClient

UserSessionClient

VirtualMemoryCallScratch

VirtualMemoryClient

WallClockClient

WallClockTime

WorkerSpawnResult

Enums

AccountStoreManager

AccountStoreReader

AuditEventType

AuditLog

AuditReasonClass

AuditResultClass

AuthStrength

AuthorityBroker

AuthorizedKeyStore

BlockDevice

BootPackage

CapSetError

CapabilityManager

ClientError

ClockProvenance

Runtime mirror of the schema ClockProvenance enum.

Console

CpuIsolationAccountingTargetKind

CpuIsolationGrantMintOutcome

Outcome of a mintGrant: on success the minted CpuIsolationPoolGrant cap and its grant_id, otherwise the typed rejection reason with no cap.

CpuIsolationGrantMintResult

Outcome of CpuIsolationGrantMinter.mintGrant (capos-rt mirror of the schema CpuIsolationGrantMintResult enum).

CpuIsolationGrantMinter

CpuIsolationGrantRevokeResult

Outcome of CpuIsolationGrantMinter.revokeGrant (capos-rt mirror of the schema CpuIsolationGrantRevokeResult enum).

CpuIsolationLease

CpuIsolationLeaseCreateOutcome

CpuIsolationLeaseOperationResult

CpuIsolationLeaseRenewResult

CpuIsolationLeaseState

CpuIsolationMode

CpuIsolationNamedRing

CpuIsolationOwnerKind

CpuIsolationPoolGrant

CredentialCheckStatus

CredentialStore

DeviceMmio

Directory

DmaBuffer

DmaPool

DmaPoolAllocateBufferOutcome

Endpoint

EntropySource

EntropyStatus

ExceptionDecodeError

ExceptionType

File

HardwareAuditCapTag

HardwareAuditEvent

HardwareAuditLog

Interrupt

IpAddressFamily

Address family reported by NetworkConfig and carried by the socket-address Data contract (schema/capos.capnp, IpAddressFamily): a 4-byte value is Ipv4, a 16-byte value is Ipv6, and an empty value is Unspecified.

KernelCapSource

LatencyClass

LineEcho

LineStatus

LogReader

LogSeverity

Runtime mirror of the schema LogLevel enum used by the log surface so callers need not import the generated capnp types. Severity ordering is debug < info < warn < error.

LogSink

Manual

ManualSource

How a ManualPage body was produced, mirroring the schema Source enum.

MemoryObject

Namespace

NetworkManager

Nic

OverrunPolicy

ParkSpace

Pipe

PrincipalKind

ProcessHandle

ProcessSpawner

ResourceProfileManager

ResourceProfileReader

RestrictedLauncher

RestrictedShellLauncher

ResultCapError

RingClientError

SchedulingContext

SchedulingContextBindState

SchedulingContextCreateOutcome

SchedulingContextDispatchEffect

SchedulingContextNotificationKind

SchedulingContextNotificationLifecycleEvent

SchedulingContextNotificationObserverResult

SchedulingContextOperationResult

SchedulingContextState

SchedulingPolicyCap

SessionManager

SharedParkSpace

SpawnGrantMode

SpawnGrantSource

SshGateway

SshHostKey

SshTerminalFactory

StdIO

StdIOReadMode

StdIOStream

Store

SystemInfo

TcpListenAuthority

TcpListener

TcpSocket

TerminalSession

ThreadControl

ThreadHandle

ThreadSpawner

Timer

TransportError

UdpSocket

UserSession

VirtualMemory

WallClock

Constants

ACCOUNT_STORE_MANAGER_INTERFACE_ID

ACCOUNT_STORE_READER_INTERFACE_ID

AUDIT_LOG_INTERFACE_ID

AUTHORITY_BROKER_INTERFACE_ID

AUTHORIZED_KEY_STORE_INTERFACE_ID

BLOCKDEVICE_INTERFACE_ID

BOOT_PACKAGE_INTERFACE_ID

CAPABILITY_MANAGER_INTERFACE_ID

CONSOLE_INTERFACE_ID

CPU_ISOLATION_GRANT_MINTER_INTERFACE_ID

CPU_ISOLATION_LEASE_INTERFACE_ID

CPU_ISOLATION_POOL_GRANT_INTERFACE_ID

CREDENTIAL_STORE_INTERFACE_ID

DEVICEMMIO_INTERFACE_ID

DIRECTORY_INTERFACE_ID

DMABUFFER_INTERFACE_ID

DMAPOOL_INTERFACE_ID

ENDPOINT_INTERFACE_ID

ENTROPY_SOURCE_INTERFACE_ID

FILE_INTERFACE_ID

FRAME_ALLOCATOR_INTERFACE_ID

HARDWARE_AUDIT_LOG_INTERFACE_ID

HARDWARE_AUDIT_READER_INTERFACE_ID

INTERRUPT_INTERFACE_ID

LOG_READER_INTERFACE_ID

LOG_SINK_INTERFACE_ID

MANUAL_INTERFACE_ID

MEMORY_OBJECT_INTERFACE_ID

NAMESPACE_INTERFACE_ID

NETWORK_MANAGER_INTERFACE_ID

NIC_INTERFACE_ID

PARK_SPACE_INTERFACE_ID

PIPE_INTERFACE_ID

PRESERVE_CLIENT_ENDPOINT_BADGE

PROCESS_HANDLE_INTERFACE_ID

PROCESS_SPAWNER_INTERFACE_ID

RESOURCE_PROFILE_MANAGER_INTERFACE_ID

RESOURCE_PROFILE_READER_INTERFACE_ID

RESTRICTED_LAUNCHER_INTERFACE_ID

RESTRICTED_SHELL_LAUNCHER_INTERFACE_ID

SCHEDULING_CONTEXT_INTERFACE_ID

SCHEDULING_POLICY_CAP_INTERFACE_ID

SESSION_MANAGER_INTERFACE_ID

SHARED_PARK_SPACE_INTERFACE_ID

SSH_GATEWAY_INTERFACE_ID

SSH_HOST_KEY_INTERFACE_ID

SSH_TERMINAL_FACTORY_INTERFACE_ID

STDIO_INTERFACE_ID

STORE_INTERFACE_ID

SYSTEM_INFO_INTERFACE_ID

TCP_LISTENER_INTERFACE_ID

TCP_LISTEN_AUTHORITY_INTERFACE_ID

TCP_SOCKET_INTERFACE_ID

TERMINAL_SESSION_INTERFACE_ID

THREAD_CONTROL_INTERFACE_ID

THREAD_HANDLE_INTERFACE_ID

THREAD_SPAWNER_INTERFACE_ID

TIMER_INTERFACE_ID

UDP_SOCKET_INTERFACE_ID

USER_SESSION_INTERFACE_ID

VIRTUAL_MEMORY_INTERFACE_ID

VIRTUAL_MEMORY_MESSAGE_SCRATCH_BYTES

VIRTUAL_MEMORY_PARAMS_BUFFER_BYTES

VIRTUAL_MEMORY_RESULT_BUFFER_BYTES

VM_PROT_EXEC

VM_PROT_NONE

VM_PROT_READ

VM_PROT_WRITE

WALL_CLOCK_INTERFACE_ID

Traits

CapabilityType

Client

Transport

Client-side capability invocation seam over a single-owner connection.

Functions

decode_completed_call

decode_stdio_read_params

decode_stdio_write_params

default_reader_options

encode_stdio_read_result

Type Aliases

RingTransport

The in-system ring transport.