refactor(proofs): split into per-topic modules with shared helpers across types, domain, and kernel

crates/kernel/src/proofs/revocation.rs

@@ -0,0 +1,63 @@
+use domain::capability::{Capability, CapabilityTable};
+use domain::resource::Resource;
+use super::{arbitrary_endpoint_cap, insert_cap};
+use types::generation::Generation;
+use types::id::EndpointId;
+use types::permission::PermissionSet;
+
+#[kani::proof]
+fn revoke_invalidates_cap_slot() {
+    let bits: u8 = kani::any();
+    let ep_id: u16 = kani::any();
+    kani::assume(ep_id < 256);
+
+    let mut table = CapabilityTable::new();
+    let slot = insert_cap(&mut table, arbitrary_endpoint_cap(bits, ep_id));
+
+    assert!(table.get(slot).is_ok());
+    table.remove(slot).unwrap();
+    assert!(table.get(slot).is_err());
+}
+
+#[kani::proof]
+fn revoke_does_not_affect_other_slots() {
+    let bits_a: u8 = kani::any();
+    let bits_b: u8 = kani::any();
+
+    let cap_a = Capability::new(
+        Resource::ProcessCreate,
+        PermissionSet::from_bits(bits_a),
+        Generation::initial(),
+    );
+    let cap_b = Capability::new(
+        Resource::Endpoint(EndpointId::from_raw(0)),
+        PermissionSet::from_bits(bits_b),
+        Generation::initial(),
+    );
+
+    let mut table = CapabilityTable::new();
+    let slot_a = insert_cap(&mut table, cap_a);
+    let slot_b = insert_cap(&mut table, cap_b);
+
+    table.remove(slot_a).unwrap();
+
+    assert!(table.get(slot_a).is_err());
+    assert!(table.get(slot_b).is_ok());
+    assert!(*table.get(slot_b).unwrap().permissions() == PermissionSet::from_bits(bits_b));
+}
+
+#[kani::proof]
+fn grant_cap_preserves_resource_identity() {
+    let ep_id: u16 = kani::any();
+    kani::assume(ep_id < 256);
+    let bits: u8 = kani::any();
+
+    let mut table = CapabilityTable::new();
+    let slot = insert_cap(&mut table, arbitrary_endpoint_cap(bits, ep_id));
+
+    let retrieved = table.get(slot).unwrap();
+    match retrieved.resource() {
+        Resource::Endpoint(id) => assert!(id.raw() == ep_id),
+        _ => panic!("resource type changed"),
+    }
+}