Module capability 

Capability names. Constants rather than loose strings so a typo in a test cannot silently opt out of the requirement it meant to declare.

Constants

BWRAP

Linux bwrap — the tier-2 sandbox backend.

CONTAINER

A container runtime (docker/podman/nerdctl/container) whose daemon can run the shipped Linux images.

GIT

git on PATH. Every mission test needs it; a skip here is close to a total loss of coverage.

GREP

POSIX grep, for the assertions that are ABOUT its exit-status semantics and cannot be rewritten portably.

KEYCHAIN

macOS security able to CREATE a login keychain under a relocated HOME. The GitHub macOS runner image 20260831.0337.3 broke this (image 20260728.0273.1 did not); the cursor keychain tests probe it and skip rather than report a runner regression as a code failure.

SANDBOX_EXEC

macOS sandbox-exec — the Seatbelt backend.