rvm-cap

Capability-based access control with derivation trees and tiered proof verification.

Implements the three-layer proof system from ADR-135. Capabilities are unforgeable kernel-managed tokens with a rights bitmap. Derivation trees enforce monotonic attenuation: a partition can only grant capabilities it holds, and granted rights must be equal or fewer. Delegation depth is bounded at 8 levels.

Key Types and Traits

• CapabilityManager -- central manager: issue, derive, revoke, verify
• CapabilityTable -- per-partition capability slot table (default 256 slots)
• DerivationTree, DerivationNode -- parent-child derivation tracking
• GrantPolicy -- grant policy with GRANT_ONCE non-transitive delegation
• RevokeResult -- revocation result with cascade propagation info
• ProofVerifier -- P1 (capability check) and P2 (policy validation) verifier
• CapSlot -- individual slot in a capability table
• CapError, ProofError -- error types for capability operations
• ManagerStats -- runtime statistics for the capability manager

Example

use rvm_cap::{CapabilityManager, CapManagerConfig, CapRights, CapType};

let config = CapManagerConfig::default();
let mut mgr = CapabilityManager::new(config);
// Issue, derive, revoke, and verify capabilities through the manager.

Design Constraints

• DC-3: Capabilities are unforgeable, monotonically attenuated
• DC-8: Capabilities follow objects during partition split (type only)
• DC-15: #![no_std], #![forbid(unsafe_code)], #![deny(missing_docs)]
• ADR-135: P1 < 1 us, P2 < 100 us, P3 deferred

Workspace Dependencies

• rvm-types
• spin (spinlock for no_std mutual exclusion)