Module capability 

Capability set — the frozen access-control mechanism (Phase A wire contract v1).

A token carries a set of capability strings. A route declares a required-capability; an access decision is a set-membership check. The literal "*" is a wildcard that satisfies every capability check.

Only this mechanism is contractual (frozen). The capability vocabulary (which strings exist, e.g. exec, session.read) and role presets are non-contract and grow additively — new strings may be added, but renaming, removing, or tightening an existing string is breaking. See the Phase A spec.

Structs

CapabilitySet

An unordered set of capability strings held by a token.

Constants

WILDCARD

The wildcard capability: a token holding it passes every capability check.

Functions

preset

Resolve a role preset name to its capability set (spec §6).