feat(kernel): add Revoke syscall for generation-based capability revocation

crates/kernel/src/tests/capability.rs

@@ -143,3 +143,46 @@ fn revoke_does_not_affect_other_resources() {
     let outcome = k.handle_syscall(Syscall::Receive { endpoint: slot2 });
     assert!(matches!(outcome, SyscallOutcome::BlockCaller(_)));
 }
+
+#[test]
+fn revoke_syscall_invalidates_via_generation() {
+    let (mut k, pid) = kernel_with_process();
+    let ep_id = k.create_endpoint_for_test();
+
+    let cap_slot = k.grant_cap_for_test(
+        pid,
+        Resource::Endpoint(ep_id),
+        PermissionSet::empty()
+            .with(Permission::Read)
+            .with(Permission::Revoke),
+    );
+
+    // Revoke via syscall
+    let outcome = k.handle_syscall(Syscall::Revoke { slot: cap_slot });
+    assert!(matches!(outcome, SyscallOutcome::Complete(SyscallResult::Ok)));
+
+    // The cap itself is now revoked (generation mismatch)
+    let outcome = k.handle_syscall(Syscall::Receive { endpoint: cap_slot });
+    assert!(matches!(
+        outcome,
+        SyscallOutcome::Complete(SyscallResult::Error(domain::error::KernelError::RevokedCapability(_)))
+    ));
+}
+
+#[test]
+fn revoke_syscall_without_revoke_permission_fails() {
+    let (mut k, pid) = kernel_with_process();
+    let ep_id = k.create_endpoint_for_test();
+
+    let cap_slot = k.grant_cap_for_test(
+        pid,
+        Resource::Endpoint(ep_id),
+        PermissionSet::empty().with(Permission::Read),
+    );
+
+    let outcome = k.handle_syscall(Syscall::Revoke { slot: cap_slot });
+    assert!(matches!(
+        outcome,
+        SyscallOutcome::Complete(SyscallResult::Error(_))
+    ));
+}