From 9b0df6340b35e143919d4bae93f3bac43b87449f Mon Sep 17 00:00:00 2001 From: "Joshua J. Bouw" Date: Sun, 7 Jun 2026 02:38:35 +0400 Subject: [PATCH 1/3] feat(sys): add enumerate-capabilities to astrid:sys@1.0.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Argument-free, ungated host fn returning the calling capsule's own held capability NAMES (categories like host_process/net_connect/fs_read, not scoped args) — the list dual of check-capsule-capability. Manifest-derived; capsule capabilities are not runtime-revoked (grant/revoke is principal-scoped). Resolves the capability-introspection-depth unresolved question in RFC host_abi (#22). --- host/sys@1.0.0.wit | 29 +++++++++++++++++++++++++++-- 1 file changed, 27 insertions(+), 2 deletions(-) diff --git a/host/sys@1.0.0.wit b/host/sys@1.0.0.wit index af39e06..a8f47aa 100644 --- a/host/sys@1.0.0.wit +++ b/host/sys@1.0.0.wit @@ -133,10 +133,35 @@ interface host { /// Audit: not recorded (read-only, no side effects). random-bytes: func(length: u64) -> result, error-code>; - /// Check whether a capsule has a specific manifest capability. + /// Check whether a capsule has a specific manifest capability — self or + /// any other capsule (by UUID). The per-name dual of + /// `enumerate-capabilities`. /// /// Fail-closed: returns `allowed: false` for unknown UUIDs and /// unknown capabilities. Returns `registry-unavailable` when the - /// registry itself can't be consulted. + /// registry itself can't be consulted. Ungated: capability posture is + /// structural metadata, not a secret (enforce-don't-conceal) — knowing a + /// capability conveys no ability to use it. Audit: not recorded. check-capsule-capability: func(request: capability-check-request) -> result; + + /// Enumerate the CALLING capsule's OWN held capability NAMES — the + /// categories the kernel enforces at host-call time (e.g. `host_process`, + /// `net_connect`, `fs_read`), NOT the scoped arguments within them (a + /// `host_process` allowlist, `host:port`, paths). It is the list dual of + /// `check-capsule-capability`: the set of names for which a self-`check` + /// returns true. + /// + /// Argument-free — the kernel already knows the caller. The set is the + /// capsule's manifest-declared capabilities as the kernel registered them; + /// capsule capabilities are not revoked at runtime (the grant/revoke model + /// is principal-scoped, a separate axis), so "what I declared" and "what I + /// can do" coincide at the capsule level. + /// + /// Ungated, like `check-capsule-capability`: a capsule grounds its + /// behaviour in what it can actually do — a reusable supervisor binary + /// deployed under different manifests reads its real set instead of + /// hard-coding it; any capsule avoids code-vs-manifest drift by grounding + /// on the registered set. Audit: not recorded (read-only self- + /// introspection). See RFC: host_abi ("Capability introspection"). + enumerate-capabilities: func() -> result, error-code>; } From b2ebdd12dea9296c3bcc2e53b422987ab4f719ec Mon Sep 17 00:00:00 2001 From: "Joshua J. Bouw" Date: Sun, 7 Jun 2026 02:51:05 +0400 Subject: [PATCH 2/3] =?UTF-8?q?fix(sys):=20address=20review=20=E2=80=94=20?= =?UTF-8?q?pre-1.0=20DRAFT=20header,=20infallible=20enumerate-capabilities?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit (1) The 'Frozen / never edit this file' header was premature: pre-launch every @1.0.0 file is a DRAFT edited in place; the frozen ABI-evolution discipline takes effect at 1.0. Header reworded to say so (resolves the gemini/copilot frozen-file objection). (2) enumerate-capabilities is now infallible (-> list): argument-free self-introspection of the caller's own registered set has no failure mode (empty list = no caps), so a result wrapper is needless overhead — like clock-ms. --- host/sys@1.0.0.wit | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/host/sys@1.0.0.wit b/host/sys@1.0.0.wit index a8f47aa..c512735 100644 --- a/host/sys@1.0.0.wit +++ b/host/sys@1.0.0.wit @@ -15,8 +15,11 @@ /// kernel-side impls dispatch to unikernel syscalls instead of /// wasmtime-wasi-backed futures. /// -/// Frozen per the ABI evolution discipline (RFC: host_abi). Shape changes -/// ship as a new file at a new version path; never edit this file. +/// **Pre-1.0 DRAFT.** This file is the full shape of the `astrid:sys@1.0.0` +/// contract, edited in place while the ABI stabilises before launch. The +/// frozen ABI-evolution discipline (RFC: host_abi) — shape changes ship as a +/// new file at a new version path, never editing a released file — takes +/// effect once 1.0 ships; until then this `@1.0.0` file is the working draft. package astrid:sys@1.0.0; @@ -163,5 +166,9 @@ interface host { /// hard-coding it; any capsule avoids code-vs-manifest drift by grounding /// on the registered set. Audit: not recorded (read-only self- /// introspection). See RFC: host_abi ("Capability introspection"). - enumerate-capabilities: func() -> result, error-code>; + /// + /// Infallible: the kernel always knows the caller's own registered set, so + /// there is no failure mode (an empty list is the valid "no capabilities" + /// answer) — like `clock-ms` / `clock-monotonic-ns`, no `result` wrapper. + enumerate-capabilities: func() -> list; } From 850096ad0c5dc9ada43c549f05392b7d42da6f0b Mon Sep 17 00:00:00 2001 From: "Joshua J. Bouw" Date: Sun, 7 Jun 2026 02:55:02 +0400 Subject: [PATCH 3/3] revert(sys): keep the canonical Frozen header (consistency with sibling files) Maintainer preference: keep the standard 'Frozen per the ABI evolution discipline' header that every other domain file carries, rather than re-wording it to DRAFT for one file. In-place pre-1.0 edits remain the working practice regardless of the header text. The infallible enumerate-capabilities signature from b2ebdd1 is unaffected. --- host/sys@1.0.0.wit | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/host/sys@1.0.0.wit b/host/sys@1.0.0.wit index c512735..138653e 100644 --- a/host/sys@1.0.0.wit +++ b/host/sys@1.0.0.wit @@ -15,11 +15,8 @@ /// kernel-side impls dispatch to unikernel syscalls instead of /// wasmtime-wasi-backed futures. /// -/// **Pre-1.0 DRAFT.** This file is the full shape of the `astrid:sys@1.0.0` -/// contract, edited in place while the ABI stabilises before launch. The -/// frozen ABI-evolution discipline (RFC: host_abi) — shape changes ship as a -/// new file at a new version path, never editing a released file — takes -/// effect once 1.0 ships; until then this `@1.0.0` file is the working draft. +/// Frozen per the ABI evolution discipline (RFC: host_abi). Shape changes +/// ship as a new file at a new version path; never edit this file. package astrid:sys@1.0.0;