Module capability_verify 

Pure capability verification.

Given a CapabilityToken, a trusted-issuer key set, and a clock, this module answers: “is the signature valid, is the issuer trusted, and is the capability inside its validity window right now?”. It does NOT check:

• Revocation (stateful, lives in chio-kernel::revocation_runtime).
• Delegation-chain lineage against the receipt store (IO-dependent).
• Scope match against a request (use crate::scope::resolve_capability_grants).
• DPoP subject binding (lives in chio-kernel::dpop).

All four are orchestrated by chio-kernel::ChioKernel::evaluate_tool_call_sync, which calls into this module for the pure pieces and its own async/std plumbing for the rest.

Verified-core boundary note: formal/proof-manifest.toml includes this module in the bounded verified core because it performs only issuer-trust, signature, and time-window checks over an in-memory capability token. Revocation stores, delegation lineage joins, and transport-bound subject proof remain excluded surfaces.

Structs

CapabilityFeatureContext

Negotiated optional-feature profile and authenticated family-root evidence.

VerifiedCapability

The subset of a verified capability that portable callers actually need.

Enums

CapabilityError

Errors raised by verify_capability.

Traits

TrustRootResolver

Resolver returning the trust-root scope hash bound to a given issuer public key. Kernels supply this so the verifier can bind attenuation_proof.parent_scope_hash to the issuing CA’s authority hash on direct-issue attenuated tokens.

Functions

verify_capability

Verify the signature, issuer trust, and time-bounds of a capability token.

verify_capability_full

Full verifier entry point for current capability semantics without signed optional-family root evidence.

verify_capability_full_with_root

Full verifier entry point with authenticated optional-family root evidence for delegated tokens.

verify_capability_with_floor

Verify a capability token while enforcing the configured crypto floor and sibling-sum budget split.

verify_capability_with_floor_and_resolver

Resolver-driven variant of verify_capability_with_floor_and_trust_root.

verify_capability_with_floor_and_trust_root

Chain-binding entry point. Verify a capability token while also enforcing the chain-binding rule required for delegation soundness.

verify_capability_with_negotiated_floor

Verify a capability token while enforcing the configured crypto floor. The peer profile is still accepted so federation callers can keep one call surface, but Chio-owned capability schemas are single-version until first release.

verify_capability_with_trusted

Convenience wrapper around verify_capability that returns the trusted-issuer list as a Vec so adapters can build it lazily.

verify_capability_with_trusted_and_floor

Convenience wrapper around verify_capability_with_floor for callers that build the trusted issuer set lazily. Uses a NoopBudgetRegistry; new callers that care about sibling-sum enforcement should call verify_capability_with_floor with their own registry.