Crate rvm_cap 

Capability system for the RVM coherence-native microhypervisor.

Implements the three-layer proof system specified in ADR-135:

Layer	Name	Budget	v1 Status
P1	Capability Check	< 1 us	Ship
P2	Policy Validation	< 100 us	Ship
P3	Deep Proof	< 10 ms	Deferred

Core Concepts

• Capability: Unforgeable kernel-managed token with rights bitmap.
• Derivation Tree: Parent-child relationships with monotonic attenuation.
• Delegation Depth: Max 8 levels to prevent unbounded chains.
• Epoch-based revocation: Stale handles detected via epoch counter.

Design Principles (ADR-135)

1. A partition can only grant capabilities it holds
2. Granted rights must be equal or fewer than held rights
3. Revocation propagates through the derivation tree
4. GRANT_ONCE provides non-transitive delegation
5. Epoch-based invalidation detects stale handles

Structs

CapManagerConfig

Configuration for the capability manager.

CapRights

Access rights bitmap carried by a capability (ADR-132, DC-3/DC-8).

CapSlot

A slot in the capability table.

CapToken

An unforgeable capability token.

CapabilityManager

The main capability manager.

CapabilityTable

Fixed-size capability table for a partition.

DerivationNode

A node in the derivation tree.

DerivationTree

Derivation tree for tracking parent-child capability relationships.

GrantPolicy

Policy configuration for capability grants.

ManagerStats

Statistics about capability manager operations.

ProofVerifier

Three-layer proof verifier.

RevokeResult

Result of a revocation operation.

Enums

CapError

Errors from capability table and derivation operations.

CapType

The type of resource a capability refers to.

ProofError

Errors from proof verification (ADR-135 three-layer system).

Constants

DEFAULT_CAP_TABLE_CAPACITY

Default capability table capacity per partition.

DEFAULT_MAX_DELEGATION_DEPTH

Default maximum delegation depth (ADR-135 Section: Capability Derivation Tree).

Functions

revoke_single

Revokes a single capability without propagation.

Type Aliases

CapResult

Shorthand result type for capability operations.