3 - Capabilities and Sharing

Capabilities and Sharing

A capability is one named thing an app may ask a worker to do. Apps are granted capabilities, not workers - {app → {capability: level}}, stored encrypted and checked on every call. A capability that was never granted is denied before the request leaves the broker.

Naming

Capabilities read as Group.Worker:Name, so a grant is unambiguous about which worker it reaches:

Time.Calendar:GetEvents
Time.Calendar:AddEvent
Time.Calendar:DeleteEvent
Spatial.WorldEvents:AddWorldEvent
Interface.Notification:AddNotification

What's exposed today

Each worker chooses a curated surface - the cross-program calls, not every method. Right now the Calendar worker carries the real one:

Capability Does
Time.Calendar:GetEvents(day) read a day's events
Time.Calendar:AddEvent(day, summary) add an event, returns its id
Time.Calendar:DeleteEvent(uid) remove an event (privileged)
The other ~26 workers currently expose a placeholder Ping capability. Their curated surfaces (e.g. Spatial.WorldEvents:AddWorldEvent, Interface.Notification:AddNotification) are the fill-in work; the pattern is identical to Calendar's.

Event sharing, worked

"Event stuff shared with different programs" means this: the Calendar worker owns the calendar. Any program the Manager grants Time.Calendar:* reads and writes the same calendar through it. Two apps, one shared store, each held to its own grant.

The demo is the Höllvania Municipal Calendar - a Warframe-1999-flavoured XRUIOS.SampleApp, built with Spectre.Console (the XRUIOS wordmark stays white; the Höllvania chrome is green). It's granted GetEvents + AddEvent but not DeleteEvent, so it shows both sides - a call that works and a call that's refused. This ran for real against the live Manager: the post-quantum handshake completed, AddEvent created an event in the Calendar worker, and DeleteEvent came back denied (see 7 - Proven at Runtime).

// connect to the Manager broker with this app's own credentials
var mgr = await EclipseSecureClient.ConnectAsync(brokerAddr, "sample-app", appPsk, identity: appId);

// granted: write an event, then read the day back (another granted app would see this event too)
string uid = await mgr.InvokeAsync<string>("AddEvent",
    new() { ["day"] = today, ["summary"] = "Ship XRUIOS" });
string events = await mgr.InvokeAsync<string>("GetEvents", new() { ["day"] = today });

// NOT granted: the broker refuses before it reaches the worker
try   { await mgr.InvokeAsync<string>("DeleteEvent", new() { ["uid"] = uid }); }
catch { /* ACCESS DENIED BY THE OPERATOR */ }

On the Manager side, the grant is two lines:

var app = apps.Register("sampleapp");            // its own app password
await permissions.GrantAsync(app.AppId, "GetEvents");
await permissions.GrantAsync(app.AppId, "AddEvent");
// DeleteEvent is deliberately withheld -> the broker denies it

Run XRUIOS.SampleApp against a running, unlocked Manager and it prints the AddEvent id, the day's events, and an ACCESS DENIED panel for the delete. Grant a second app the same two capabilities and it sees the first app's event - shared, but each still walled to what it was given.

Next: getting it running - 4 - Installing.