feat: implement kernel capability model

programs/src/shell/Makefile

@@ -18,6 +18,7 @@ endif
 PROG_INC := ../../include
 LINK_LD  := ../../link.ld
 BINDIR   := ../../bin
+LIBDIR   := ../../lib
 OBJDIR   := obj
 
 # ---- C++ compiler flags ----
@@ -63,9 +64,9 @@ TARGET := $(BINDIR)/os/shell.elf
 
 all: $(TARGET)
 
-$(TARGET): $(OBJS) $(LINK_LD) Makefile
+$(TARGET): $(OBJS) $(LINK_LD) Makefile $(LIBDIR)/libc/liblibc.a
 	mkdir -p $(BINDIR)/os
-	$(CXX) $(CXXFLAGS) $(LDFLAGS) $(OBJS) -o $@
+	$(CXX) $(CXXFLAGS) $(LDFLAGS) $(OBJS) $(LIBDIR)/libc/liblibc.a -o $@
 
 $(OBJDIR)/%.o: %.cpp shell.h Makefile
 	mkdir -p $(OBJDIR)

programs/src/shell/builtins.cpp

@@ -68,6 +68,7 @@ void cmd_help() {
     montauk::print("  fontscale [n]   Set terminal font scale (1-8)\n");
     montauk::print("  reset           Reboot the system\n");
     montauk::print("  shutdown        Shut down the system\n");
+    montauk::print("  suspend         Suspend the system\n");
     montauk::print("\n");
     montauk::print("Network commands:\n");
     montauk::print("  ping <ip>       Send ICMP echo requests\n");

programs/src/shell/exec.cpp

@@ -41,7 +41,17 @@ static void print_exit_code(int code) {
 
 static bool try_exec(const char* path, const char* args) {
     if (!file_exists(path)) return false;
-    int pid = montauk::spawn(path, args);
+    // Least-privilege hygiene, NOT a security boundary: this never decides
+    // what may run, only which capabilities a tool receives.  The user in an
+    // admin console can already do everything these tools do, so the point is
+    // to keep a bug in one tool from reaching authority it has no use for.
+    // The shell delegates on the same terms as the desktop; the table decides
+    // per binary, and the kernel re-checks the bound on every spawn.
+    montauk::abi::SpawnCapabilities caps =
+        montauk::caps::for_binary(path, shell_delegable_caps);
+    int pid = (caps.permitted != 0)
+        ? montauk::spawn_with_caps(path, args, nullptr, caps)
+        : montauk::spawn(path, args);
     if (pid < 0) return false;
     print_exit_code(montauk::waitpid(pid));
     return true;

programs/src/shell/main.cpp

@@ -13,6 +13,7 @@ int current_drive = 0;
 int last_exit = 0;
 char session_user[32] = "";
 char session_home[64] = "";
+uint64_t shell_delegable_caps = 0;
 
 void sync_cwd() {
     char abs[128];
@@ -46,6 +47,8 @@ void read_session() {
 
     scopy(session_home, "0:/users/", sizeof(session_home));
     scat(session_home, session_user, sizeof(session_home));
+
+    shell_delegable_caps = montauk::caps::self_delegable();
 }
 
 // ---- Command history ----
@@ -184,6 +187,29 @@ static int process_command(const char* line) {
     if (streq(cmd, "true")) { return 0; }
     if (streq(cmd, "false")) { return 1; }
 
+    // Route interactive power actions through the trusted login supervisor.
+    // Posting the request and exiting lets terminal.elf close, after which
+    // login performs filesystem/Bluetooth cleanup and the final power syscall.
+    if (streq(cmd, "shutdown") || streq(cmd, "poweroff") || streq(cmd, "halt") ||
+        streq(cmd, "reboot") || streq(cmd, "reset")) {
+        int action = (streq(cmd, "reboot") || streq(cmd, "reset"))
+            ? montauk::abi::POWER_REQ_REBOOT
+            : montauk::abi::POWER_REQ_SHUTDOWN;
+        int rc = montauk::power_request(action);
+        if (rc == 0) montauk::exit(0);
+        montauk::print(rc == montauk::abi::SYS_ERR_PERMISSION
+            ? "power: permission denied\n"
+            : "power: request failed\n");
+        return 1;
+    }
+
+    if (streq(cmd, "suspend")) {
+        int rc = montauk::suspend();
+        if (rc == montauk::abi::SYS_ERR_PERMISSION)
+            montauk::print("suspend: permission denied\n");
+        return rc == 0 ? 0 : 1;
+    }
+
     if (streq(cmd, "pwd")) {
         sync_cwd();
         char path[128];

programs/src/shell/shell.h

@@ -10,6 +10,7 @@
 #include <montauk/string.h>
 #include <montauk/heap.h>
 #include <montauk/config.h>
+#include <montauk/capabilities.h>
 
 using montauk::slen;
 using montauk::streq;
@@ -55,6 +56,7 @@ extern int current_drive;
 extern int last_exit;
 extern char session_user[32];
 extern char session_home[64];
+extern uint64_t shell_delegable_caps;
 
 // ---- Inline path helpers ----
 
@@ -144,4 +146,4 @@ constexpr const char* shell_builtins[] = {
     "true",
     "false",
     "exit"
-};
+};