Struct CapabilityManager 

pub struct CapabilityManager<const N: usize = DEFAULT_CAP_TABLE_CAPACITY> { /* private fields */ }

The main capability manager.

Coordinates capability table, derivation tree, and proof verifier to provide complete capability lifecycle management.

Implementations

impl<const N: usize> CapabilityManager<N>

pub const fn new(config: CapManagerConfig) -> Self

Creates a new capability manager with the given configuration.

pub const fn with_defaults() -> Self

Creates a new capability manager with default configuration.

pub const fn config(&self) -> &CapManagerConfig

Returns the current configuration.

pub const fn stats(&self) -> &ManagerStats

Returns the current statistics.

pub const fn epoch(&self) -> u32

Returns the current epoch.

pub const fn len(&self) -> usize

Returns the number of active capabilities.

pub const fn is_empty(&self) -> bool

Returns true if there are no active capabilities.

pub fn increment_epoch(&mut self)

Increments the global epoch, invalidating stale handles.

pub fn create_root_capability( &mut self, cap_type: CapType, rights: CapRights, badge: u64, owner: PartitionId, ) -> CapResult<(u32, u32)>

Creates a root capability for a new kernel object (unchecked).

This is the kernel-internal path; for authorization-checked creation, use create_root_capability_checked.

Errors

Returns a CapError if the table is full or the derivation tree cannot be updated.

pub fn create_root_capability_checked( &mut self, cap_type: CapType, rights: CapRights, badge: u64, owner: PartitionId, caller_id: PartitionId, ) -> CapResult<(u32, u32)>

Creates a root capability with authorization check.

Only PartitionId::HYPERVISOR (the hypervisor itself) is authorized to create root capabilities. All other callers are rejected with CapError::GrantNotPermitted.

Errors

Returns CapError::GrantNotPermitted if caller_id is not the hypervisor. Returns a CapError if the table is full or the derivation tree cannot be updated.

pub fn grant( &mut self, source_index: u32, source_generation: u32, requested_rights: CapRights, badge: u64, target_owner: PartitionId, ) -> CapResult<(u32, u32)>

Grants a derived capability to another partition.

caller_id identifies the partition performing the grant and is checked against the source capability’s owner. Pass None to skip the owner check (kernel-internal use only).

Errors

Returns a CapError if the source is invalid, the caller does not own the source, rights escalation is attempted, or the delegation depth limit is exceeded.

pub fn grant_checked( &mut self, source_index: u32, source_generation: u32, requested_rights: CapRights, badge: u64, target_owner: PartitionId, caller_id: PartitionId, ) -> CapResult<(u32, u32)>

Like grant but verifies the caller owns the source capability.

Errors

Returns a CapError if the source capability is invalid, stale, or not owned by caller_id, or if the requested rights exceed those of the source capability.

pub fn revoke(&mut self, index: u32, generation: u32) -> CapResult<RevokeResult>

Revokes a capability and all its descendants.

Errors

Returns a CapError if the handle is invalid or already revoked.

pub fn verify_p1( &self, cap_index: u32, cap_generation: u32, required_rights: CapRights, ) -> Result<(), ProofError>

P1 verification: capability existence + rights check (< 1 us).

Errors

Returns ProofError if the handle is invalid, stale, or lacks the required rights.

pub fn verify_p2( &mut self, cap_index: u32, cap_generation: u32, ctx: &PolicyContext, ) -> Result<(), ProofError>

P2 verification: structural invariant validation (< 100 us).

Errors

Returns ProofError::PolicyViolation if any structural check fails.

pub fn verify_p3( &self, cap_index: u32, cap_generation: u32, max_depth: u8, ) -> Result<(), ProofError>

P3: Deep proof — derivation chain integrity verification.

Walks the derivation tree from the capability back to its root, verifying that every ancestor is valid, depth is monotonic, and epochs are non-decreasing.

Errors

Returns ProofError::DerivationChainBroken if the chain is invalid.

pub fn table(&self) -> &CapabilityTable<N>

Returns a reference to the underlying table.

Trait Implementations

impl<const N: usize> Default for CapabilityManager<N>

fn default() -> Self

Returns the “default value” for a type.