# Distributed capabilities

Cursors capabilities are signed, attenuating delegations designed for disconnected and distributed execution. They are not Linux capability bits and not opaque bearer URLs.

![Authority flow](images/authority-flow.svg)

## Grant

A grant binds:

- issuer and subject identities;
- a hierarchical resource scope;
- a set of rights;
- step, byte, and child budgets;
- a validity interval;
- an optional parent grant and split allocation;
- a nonce preventing accidental record collision.

A cryptographically valid root is not automatically trusted. A verifier still chooses accepted root issuers for the world or operation.

## Reforge

The current subject signs a child grant. Reforging can:

- narrow resource scope;
- remove rights;
- reduce budgets;
- shorten the validity interval;
- change the subject.

It cannot widen any dimension. The reference implementation rejects escalation before signing and verifies the rule again when resolving the chain.

## Split

Independent child grants cannot prove that their aggregate budgets fit the parent. Cursors therefore signs a **split envelope** containing the complete allocation vector. Each child commits the split ID and allocation index.

Verifiers check:

1. the split signer is the parent subject;
2. every allocation attenuates the parent;
3. the number of allocations respects the child budget;
4. sums of consumable budgets do not exceed the parent;
5. each child exactly matches its committed allocation.

A production redemption service must additionally mark an exclusive split as consumed or use a double-spend-resistant ledger appropriate to its threat domain. The current model demonstrates the signed structure, not global Byzantine settlement.

## Redeem and receipt

Using authority for a consumable effect produces a receipt. A stable effect key makes retries return the original receipt rather than repeat the effect. Depending on the resource, the redeemer may be:

- one local kernel body;
- a replicated authority service;
- a hardware device queue;
- a threshold group;
- a delay-tolerant ledger reconciled later.

No single global ledger is mandated. The consistency requirement belongs to the effect being protected.

## Join authority

Data and execution branches may join without their authority automatically joining. A program must present a grant sufficient for the join operation. Authority union is never implicit: combining two references cannot synthesize rights neither branch could delegate.

## Revocation

Offline capability systems cannot promise instantaneous universal revocation. Cursors combines:

- short validity windows for high-risk grants;
- issuer-signed revocation objects;
- monotonic world epochs;
- online redemption for expensive effects;
- key rotation and successor manifests;
- bounded budgets that limit damage while disconnected.

The cockpit should show *why* a grant is accepted, expired, attenuated, revoked, or untrusted. Invisible ambient authority is considered a design failure.