Module capability 

Capability tokens, scoped grants, attenuation, and governed execution metadata.

Capability submodules are the public API. This root intentionally contains no flat re-export layer so callers import the domain they depend on.

Modules

aggregate_invocation

attenuation

caveat

crypto_floor

cumulative_approval

features

governance

runtime_attestation

scope

supplemental_authorization

threshold_approval

token

trust_policy

validation

workload_identity