Distributed capabilities
Cursors capabilities are signed, attenuating delegations designed for disconnected and distributed execution. They are not Linux capability bits and not opaque bearer URLs.
Grant
A grant binds:
- issuer and subject identities;
- a hierarchical resource scope;
- a set of rights;
- step, byte, and child budgets;
- a validity interval;
- an optional parent grant and split allocation;
- a nonce preventing accidental record collision.
A cryptographically valid root is not automatically trusted. A verifier still chooses accepted root issuers for the world or operation.
Reforge
The current subject signs a child grant. Reforging can:
- narrow resource scope;
- remove rights;
- reduce budgets;
- shorten the validity interval;
- change the subject.
It cannot widen any dimension. The reference implementation rejects escalation before signing and verifies the rule again when resolving the chain.
Split
Independent child grants cannot prove that their aggregate budgets fit the parent. Cursors therefore signs a split envelope containing the complete allocation vector. Each child commits the split ID and allocation index.
Verifiers check:
- the split signer is the parent subject;
- every allocation attenuates the parent;
- the number of allocations respects the child budget;
- sums of consumable budgets do not exceed the parent;
- each child exactly matches its committed allocation.
A production redemption service must additionally mark an exclusive split as consumed or use a double-spend-resistant ledger appropriate to its threat domain. The current model demonstrates the signed structure, not global Byzantine settlement.
Redeem and receipt
Using authority for a consumable effect produces a receipt. A stable effect key makes retries return the original receipt rather than repeat the effect. Depending on the resource, the redeemer may be:
- one local kernel body;
- a replicated authority service;
- a hardware device queue;
- a threshold group;
- a delay-tolerant ledger reconciled later.
No single global ledger is mandated. The consistency requirement belongs to the effect being protected.
Join authority
Data and execution branches may join without their authority automatically joining. A program must present a grant sufficient for the join operation. Authority union is never implicit: combining two references cannot synthesize rights neither branch could delegate.
Revocation
Offline capability systems cannot promise instantaneous universal revocation. Cursors combines:
- short validity windows for high-risk grants;
- issuer-signed revocation objects;
- monotonic world epochs;
- online redemption for expensive effects;
- key rotation and successor manifests;
- bounded budgets that limit damage while disconnected.
The cockpit should show why a grant is accepted, expired, attenuated, revoked, or untrusted. Invisible ambient authority is considered a design failure.