feat: implement kernel capability model

programs/src/desktop/apps/app_external_launchers.cpp

@@ -6,33 +6,31 @@
 
 #include "apps_common.hpp"
 
-static void spawn_app(const char* path, const char* args = nullptr) {
-    if (path && path[0]) {
-        montauk::spawn(path, args);
-    }
+static void spawn_app(DesktopState* ds, const char* path, const char* args = nullptr) {
+    if (path && path[0]) desktop_spawn_app(ds, path, args);
 }
 
 void open_terminal(DesktopState* ds) {
     const char* home = (ds && ds->home_dir[0]) ? ds->home_dir : nullptr;
-    spawn_app("0:/apps/terminal/terminal.elf", home);
+    spawn_app(ds, "0:/apps/terminal/terminal.elf", home);
 }
 
 void open_calculator(DesktopState* ds) {
     (void)ds;
-    spawn_app("0:/apps/calculator/calculator.elf");
+    spawn_app(ds, "0:/apps/calculator/calculator.elf");
 }
 
 void open_texteditor(DesktopState* ds) {
     (void)ds;
-    spawn_app("0:/apps/texteditor/texteditor.elf");
+    spawn_app(ds, "0:/apps/texteditor/texteditor.elf");
 }
 
 void open_syslog(DesktopState* ds) {
     (void)ds;
-    spawn_app("0:/apps/klog/syslog.elf");
+    spawn_app(ds, "0:/apps/syslog/syslog.elf");
 }
 
 void open_wordprocessor(DesktopState* ds) {
     (void)ds;
-    spawn_app("0:/apps/wordprocessor/wordprocessor.elf");
+    spawn_app(ds, "0:/apps/wordprocessor/wordprocessor.elf");
 }

programs/src/desktop/apps/apps_common.hpp

@@ -25,6 +25,12 @@ inline void* operator new(unsigned long, void* p) { return p; }
 
 using namespace gui;
 
+// Central launch policy implemented by desktop_catalog.cpp.  Standalone app
+// wrappers include this header directly, so keep the declaration here rather
+// than only in desktop_internal.hpp.
+int desktop_spawn_app(DesktopState* ds, const char* path,
+                      const char* args = nullptr);
+
 // ============================================================================
 // Minimal snprintf
 // ============================================================================
@@ -261,8 +267,8 @@ void open_sleep_dialog(DesktopState* ds);
 // user returns to the login screen, where the shutdown stages run (Bluetooth
 // teardown, filesystem flush) before the final ACPI power-off / reset. Pass
 // montauk::abi::POWER_REQ_SHUTDOWN or montauk::abi::POWER_REQ_REBOOT.
-[[noreturn]] inline void desktop_request_power(int action) {
-    montauk::power_request(action);
-    montauk::exit(0);
+inline void desktop_request_power(int action) {
+    if (montauk::power_request(action) == 0)
+        montauk::exit(0);
 }
 bool desktop_poll_external_windows(DesktopState* ds);

programs/src/desktop/desktop_catalog.cpp

@@ -5,6 +5,7 @@
 */
 
 #include "desktop_internal.hpp"
+#include <montauk/capabilities.h>
 
 namespace {
 
@@ -24,6 +25,18 @@ static void sort_item_indices(DesktopState* ds, int* indices, int count) {
 
 } // namespace
 
+int desktop_spawn_app(DesktopState* ds, const char* path, const char* args) {
+    if (!ds || !path || !path[0]) return -1;
+    // The grant table decides what each program may receive; the kernel bounds
+    // it by what this session was actually delegated, so a non-admin session
+    // clamps to nothing without the desktop having to decide that itself.
+    montauk::abi::SpawnCapabilities caps =
+        montauk::caps::for_binary(path, montauk::caps::self_delegable());
+    // Applications inherit the desktop's kernel-owned owner identity.  An
+    // explicit user override is reserved for trusted session creators.
+    return montauk::spawn_with_caps(path, args, nullptr, caps);
+}
+
 int desktop_list_item_indices(DesktopState* ds,
                               DesktopItemSection section,
                               int* out,
@@ -54,9 +67,9 @@ bool desktop_launch_item(DesktopState* ds, const DesktopItem* item) {
     case DESKTOP_ITEM_LAUNCH_EXECUTABLE:
         if (!item->binary_path[0]) return false;
         if (item->launch_with_home) {
-            return montauk::spawn(item->binary_path, ds->home_dir) >= 0;
+            return desktop_spawn_app(ds, item->binary_path, ds->home_dir) >= 0;
         }
-        return montauk::spawn(item->binary_path) >= 0;
+        return desktop_spawn_app(ds, item->binary_path) >= 0;
     default:
         return false;
     }

programs/src/desktop/input.cpp

@@ -381,9 +381,9 @@ void gui::desktop_handle_mouse(DesktopState* ds) {
                     } else if (!row.is_category) {
                         if (row.external) {
                             if (row.launch_with_home) {
-                                montauk::spawn(row.binary_path, ds->home_dir);
+                                desktop_spawn_app(ds, row.binary_path, ds->home_dir);
                             } else {
-                                montauk::spawn(row.binary_path);
+                                desktop_spawn_app(ds, row.binary_path);
                             }
                         } else {
                             desktop_launch_builtin(ds, row.app_id);

programs/src/desktop/main.cpp

@@ -834,6 +834,19 @@ void gui::desktop_run(DesktopState* ds) {
 
         if (now >= nextClockPollMs) {
             nextClockPollMs = now + 1000;
+
+            // A power request can be posted by anything in this session that
+            // holds CAP_POWER_REQUEST -- the shell's shutdown builtin, run in
+            // a terminal window, is the common case. login only reads it once
+            // the session leader exits, so ending the session is our job; it
+            // is the same handoff desktop_request_power() performs, just
+            // reached from a request we did not originate.
+            int pendingPower = montauk::power_request_pending();
+            if (pendingPower == montauk::abi::POWER_REQ_SHUTDOWN ||
+                pendingPower == montauk::abi::POWER_REQ_REBOOT) {
+                montauk::exit(0);
+            }
+
             uint64_t clockToken = desktop_clock_token();
             if (clockToken != lastClockToken) {
                 lastClockToken = clockToken;

programs/src/desktop/wifi.cpp

@@ -328,7 +328,7 @@ bool desktop_wifi_poll(DesktopState* ds, uint64_t now) {
     if (ds->wifi_dhcp_pending && info.connected && ds->cached_net_cfg.ipAddress == 0) {
         ds->wifi_dhcp_pending = false;
         ds->wifi_dhcp_waiting = true;
-        montauk::spawn("0:/os/dhcp.elf");
+        desktop_spawn_app(ds, "0:/os/dhcp.elf");
         wifi_set_status(ds, "Requesting an address...");
         changed = true;
     } else if (ds->wifi_dhcp_pending && info.connected) {