Struct SpawnEnvelope 

pub struct SpawnEnvelope {
    pub network_allow: Vec<String>,
    pub unix_sockets_allowed: bool,
    pub peer_fetch_allow: Vec<String>,
    pub shell_allow: Vec<String>,
    pub spawn_allow: Vec<String>,
    pub env_allow: Vec<String>,
    pub filesystem_scope: Option<String>,
    pub workdir_exec_allowed: bool,
    pub state_stores: BTreeSet<String>,
    pub containment_floor: ContainmentClass,
}

One capsule’s declared capability surface, in the shape the spawn comparison needs.

Narrower than crate::types::CapabilityPolicy on most axes, and wider on one. Narrower: limits, resources and the shell_strip_env/baseline_env/interpreter_runtime grants are bounds and plumbing rather than reach, so a child that sets them differently is not escalating. Wider: Self::state_stores is per artifact, so it is not on the capsule-wide policy at all, and a child whose artifacts open a store the parent’s do not is reaching durable state outside every workdir that its parent cannot see.

Fields

network_allow: Vec<String>

capabilities.network.allow, unparsed. Held as declared so a refusal quotes the operator’s own line; parsing happens inside Self::contains, where an unparseable entry is uncovered rather than an error (validate_capability_policy refuses it again, with the parse error, if a spawn ever gets as far as staging).

unix_sockets_allowed: bool

peer_fetch_allow: Vec<String>

shell_allow: Vec<String>

spawn_allow: Vec<String>

capabilities.spawn.allow. Compared as an axis like any other — a child that can spawn a name its parent cannot has widened the delegation graph, not just its own reach. This is a different question from the name check mur-roost runs first, which asks whether this child is a name the parent may spawn at all.

env_allow: Vec<String>

filesystem_scope: Option<String>

workdir_exec_allowed: bool

state_stores: BTreeSet<String>

Every store name this capsule’s artifacts would open, with the capsule-name default already applied by [crate::state_store::resolve_store_name] — so two capsules that both declare a bare capabilities.state compare as the different directories they actually open.

A set rather than a list: the axis is “which stores are opened”, and an artifact list that names one store twice is not a wider grant.

containment_floor: ContainmentClass

capabilities.containment. The one axis where more is safer, so it is the one axis compared with >= rather than by containment of a set — see Self::contains.

Implementations

impl SpawnEnvelope

pub fn from_runtime_manifest(manifest: &RuntimeManifest) -> Self

Lower a capsule’s manifest into the envelope it both holds and imposes.

Every capsule-wide axis is read off crate::types::capability_policy_from_runtime_manifest rather than off the manifest again, so the envelope compared here and the crate::types::CapabilityPolicy the session is actually staged with cannot read the same manifest two different ways.

pub fn contains(&self, child: &Self) -> Result<(), EnvelopeViolation>

Ok(()) when child holds no more capability than self on any axis, otherwise the first axis it exceeded.

Containment is the exception to “the child must be a subset”: a floor is a requirement rather than a grant, so a child may only ever raise it. ContainmentClass lists its variants weakest-first and derives Ord for exactly this comparison.

Axis order is the order a refusal reports in, and matters only when a child exceeds on more than one: it is the table order in the reference docs, so the page and the daemon agree about which refusal an operator sees first.

Trait Implementations

impl Clone for SpawnEnvelope

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SpawnEnvelope

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SpawnEnvelope

fn default() -> Self

Returns the “default value” for a type.

impl Eq for SpawnEnvelope

impl PartialEq for SpawnEnvelope

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for SpawnEnvelope