Module capability_gate 

Dispatch-side capability authorization (PLAN_F F-1, dispatch half).

Tools declare the capabilities they invoke (EffectRow::invokes, wm-core vocabulary). This module maps that vocabulary onto the governance CapabilitySet (wm-governance) and validates a presented engagement credential before dispatch proceeds:

• A credential presented under args["_engagement"] ({ "token": <EngagementToken>, "issuer_public_key": "<hex>" }) is always verified when present: Ed25519 signature → revocation → expiry → scope-derived capability coverage. A failing credential refuses the call in every mode — presented evidence must be valid.
• Without a credential, behavior depends on the gate mode:
  • CapabilityGateMode::Advisory (default): dispatch proceeds; the unmet requirement is logged at debug level for observability.
  • CapabilityGateMode::Strict (WM_REQUIRE_CAPABILITIES=1): tools whose invokes map to a non-empty capability set are refused with an actionable error.

The credential key is removed from the args before execution, so tokens never reach tool bodies, the write-audit digest, or the flight recorder.

Scope note (v1): Ed25519 engagement tokens are the only verifiable evidence path. AdminGovernance, MemoryDelete, and SealAdapt are not grantable by any current EngagementScope, so strict mode refuses tools that declare them until a signed-grant path exists — that is the intended conservative default, not a bug.

Trust-anchor limitation (v1): the issuer key is presented alongside the token, so a valid credential proves integrity + scope coverage, not issuer authority — dispatch has no bound-identity anchor the way the mesh transport binds issuer keys to peer keys. Pinning issuer keys (configured allowlist or bound peers) is the next hardening step.

Structs

DispatchEngagementCredential

Credential shape — mirrors the mesh transport’s EngagementCredential without taking a dependency on wm-sangha.

Enums

CapabilityGateMode

How the pipeline treats a missing credential for a capability-requiring tool.

GateOutcome

Outcome of a capability-gate evaluation.

Constants

ENGAGEMENT_KEY

Key under which a dispatch caller presents an engagement credential.

Functions

evaluate

Evaluate the capability gate for one dispatch.

required_capabilities

Map a tool’s wm-core invokes list onto the governance capability vocabulary.