Expand description
The capability ceiling a spawned capsule must fit inside, and the comparison that refuses one that does not.
A delegating capsule hands its child a manifest of the child’s own, and the runtime lowers that
manifest independently of the parent’s. Without a comparison between the two, delegation is a
privilege-escalation ladder: a capsule granted one network host, no shell and a narrow
filesystem scope can spawn a child declaring unrestricted network, a full shell allow-list and
the whole workdir. SpawnEnvelope::contains is the comparison, and it names the axis and the
exact entry that exceeded.
Refusing, not narrowing. This is the opposite of
[crate::network_policy::ToolCapabilityGrant::derive], which clamps a per-artifact allow-list
to the capsule ceiling and reports the dropped entries as W-SEC-007. An artifact’s declared
capabilities are its author’s wish list, so keeping the covered subset is right — the
operator did not write them. A child capsule’s manifest is the operator’s own declaration, so a
mismatch is a mistake in something they control. A refusal is auditable and fixable; a silent
narrowing produces a child that runs and mysteriously cannot do its job.
One covering predicate per grammar. The install axes compare capabilities.install
entries with murmur_artifact::install_pattern::covers, the predicate that shares its grammar
with the murmur_artifact::install_pattern::matches the pull gate decides a name with. A
child that declares no install block holds no install grant; nothing reaches it from its
parent.
One subset predicate. Both paths decide “is this network entry covered?” with
[crate::network_policy::NetworkAllowRule::covers], which errs toward deny on ambiguity — a
bare example.com is not covered by a ceiling of https://example.com, because the bare form
spans both schemes and every port. There is one subset rule in the workspace, not two, and the
shared case table in this module’s tests drives both call sites and fails if their verdicts
ever diverge.
Structs§
- Envelope
Violation - The first axis a child exceeded its parent on, with the exact declaration that did it.
- Spawn
Envelope - One capsule’s declared capability surface, in the shape the spawn comparison needs.
Enums§
- Envelope
Axis - Every axis two capsules are compared on, and the manifest key each one renders as in a refusal.