Module capability 

Typed capability handles for service code - §7.

Services never see raw Capability structs; the kernel manages the cap table. Services hold opaque CapHandle values (slot indices) and pass them to syscall wrappers. The kernel resolves them against the task’s cap table.

Structs

CapHandle

Opaque handle to a capability slot in the calling task’s cap table. Not a raw pointer; the kernel does the resolution.

Enums

CapError

Errors mirrored from the kernel’s CapError (§7.7).

Constants

RIGHT_GRANT

RIGHT_READ

Capability right bits, mirroring the kernel Rights bitfield (§7.4). Used with the delegated-resource calls (resource_mint/resource_invoke, §7.10): a file cap minted RIGHT_READ | RIGHT_WRITE | RIGHT_GRANT, a read invoked with RIGHT_READ, a write with RIGHT_WRITE (a cap lacking the invoked right fails - the non-escalation check).

RIGHT_WRITE