refactor: capabilities - add unified launch routine

programs/src/desktop/desktop_catalog.cpp

@@ -30,11 +30,8 @@ int desktop_spawn_app(DesktopState* ds, const char* path, const char* args) {
     // The grant table decides what each program may receive; the kernel bounds
     // it by what this session was actually delegated, so a non-admin session
     // clamps to nothing without the desktop having to decide that itself.
-    montauk::abi::SpawnCapabilities caps =
-        montauk::caps::for_binary(path, montauk::caps::self_delegable());
-    // Applications inherit the desktop's kernel-owned owner identity.  An
-    // explicit user override is reserved for trusted session creators.
-    return montauk::spawn_with_caps(path, args, nullptr, caps);
+    // Applications inherit the desktop's kernel-owned owner identity.
+    return montauk::caps::launch(path, {.args = args});
 }
 
 int desktop_list_item_indices(DesktopState* ds,

programs/src/init/main.cpp

@@ -83,9 +83,7 @@ static bool run_service(const char* path, const char* name, bool wait = true) {
 
     // Grants are keyed on the executable, not the service id, so repointing a
     // privileged entry in init.toml at another program transfers no authority.
-    montauk::abi::SpawnCapabilities caps =
-        montauk::caps::for_binary(path, montauk::caps::self_delegable());
-    int pid = montauk::spawn_with_caps(path, nullptr, "system", caps);
+    int pid = montauk::caps::launch(path, {.user = "system"});
     if (pid < 0) {
         snprintf(msg, sizeof(msg), "Failed to start %s", name);
         log_err(msg);

programs/src/network/main.cpp

@@ -7,6 +7,7 @@
 #include <montauk/syscall.h>
 #include <montauk/string.h>
 #include <montauk/wifi.h>
+#include <montauk/capabilities.h>
 #include <gui/mtk.hpp>
 #include <gui/mtk/settings.hpp>
 #include <gui/standalone.hpp>
@@ -951,13 +952,10 @@ static void render() {
 }
 
 static void launch_dhcp() {
-    montauk::abi::SpawnCapabilities caps{
-        montauk::abi::CAP_NETWORK_ADMIN,
-        montauk::abi::CAP_NETWORK_ADMIN,
-        0
-    };
-    int pid = montauk::spawn_with_caps("0:/os/dhcp.elf", nullptr,
-                                       nullptr, caps);
+    // The grant table already declares network_admin for dhcp.elf, and this
+    // process is delegable for exactly that, so the lookup reproduces the
+    // mask that used to be spelled out here -- without a second copy to drift.
+    int pid = montauk::caps::launch("0:/os/dhcp.elf");
     if (pid >= 0) {
         set_status("DHCP client started");
     } else {

programs/src/shell/exec.cpp

@@ -41,17 +41,8 @@ static void print_exit_code(int code) {
 
 static bool try_exec(const char* path, const char* args) {
     if (!file_exists(path)) return false;
-    // Least-privilege hygiene, NOT a security boundary: this never decides
-    // what may run, only which capabilities a tool receives.  The user in an
-    // admin console can already do everything these tools do, so the point is
-    // to keep a bug in one tool from reaching authority it has no use for.
-    // The shell delegates on the same terms as the desktop; the table decides
-    // per binary, and the kernel re-checks the bound on every spawn.
-    montauk::abi::SpawnCapabilities caps =
-        montauk::caps::for_binary(path, shell_delegable_caps);
-    int pid = (caps.permitted != 0)
-        ? montauk::spawn_with_caps(path, args, nullptr, caps)
-        : montauk::spawn(path, args);
+    
+    int pid = montauk::caps::launch(path, {.args = args});
     if (pid < 0) return false;
     print_exit_code(montauk::waitpid(pid));
     return true;

programs/src/shell/main.cpp

@@ -13,7 +13,6 @@ int current_drive = 0;
 int last_exit = 0;
 char session_user[32] = "";
 char session_home[64] = "";
-uint64_t shell_delegable_caps = 0;
 
 void sync_cwd() {
     char abs[128];
@@ -47,8 +46,6 @@ void read_session() {
 
     scopy(session_home, "0:/users/", sizeof(session_home));
     scat(session_home, session_user, sizeof(session_home));
-
-    shell_delegable_caps = montauk::caps::self_delegable();
 }
 
 // ---- Command history ----

programs/src/shell/shell.h

@@ -56,7 +56,6 @@ extern int current_drive;
 extern int last_exit;
 extern char session_user[32];
 extern char session_home[64];
-extern uint64_t shell_delegable_caps;
 
 // ---- Inline path helpers ----