fix(capsule): preserve device attenuation in dispatch

[joshuajbouw]

Linked Issue

Closes #1239

Refs #1237 and astrid-runtime/rfcs#36.

Summary

Carries the authenticated device into capsule dispatch so execution and inventory use the same live authority already enforced at the kernel boundary. The change is generic to Astrid and introduces no product-specific role or trust path.

Changes

• resolve one principal/profile/group/device snapshot per stamped event
• reject disabled, malformed, unknown, and revoked identities before matching or grant signalling
• use device-effective capsule:list only for global describe visibility
• activate exact device-effective capsule:access:any for unrestricted execution and candidate expansion
• preserve exact per-principal capsule grants, no-device/Full behavior, and principal-less lifecycle dispatch
• emit one GrantRequired only for a valid in-view denied match
• preserve legacy dispatch when no access resolver is installed
• preserve merged authority-cache refresh, pairing preflight, audit classification, and caller-boundary audit behavior
• require base self:auth:pair authority for pair issuance while retaining the additional self:auth:pair:admin gate and elevated audit classification for Full, preset-Full, and explicit-universal scopes
• add a dedicated device-scope dispatch regression suite

Verification

• restacked onto main after feat(cli): grant installed distro capsules to the target principal #1196, fix(kernel): preserve device attenuation across authority views #1238, and fix(kernel): fail closed at bootstrap authority boundaries #1257 merged
• signed head: 57ec31340db1a1749d5f137a25f4352bb6cb401f
• cargo fmt --all -- --check
• git diff --check origin/main...HEAD
• cargo test --locked -p astrid-capsule — 563 passed
• cargo test --locked -p astrid-kernel admin_cap_without_base_pair_capability_cannot_issue_full_token -- --nocapture
• cargo clippy --locked -p astrid-capsule -p astrid-kernel --all-features --tests -- -D warnings
• replacement GitHub CI is the complete integration and execution gate

Checklist

• Linked to an issue
• CHANGELOG.md updated under [Unreleased]

No release is created or published by this change.

[Copilot]

Pull request overview

Updates capsule dispatch to carry the authenticated device scope into access resolution so dispatch decisions (candidate expansion, execution gating, and grant signalling) reflect the same attenuated authority enforced at the kernel boundary (Issue #1239 / RFC #36).

Changes:

• Thread device_key_id through dispatcher matching and resolve a single immutable (principal/profile/groups/device-scope) access snapshot per stamped event.
• Enforce fail-closed behavior for disabled/invalid/unknown/revoked identities before interceptor matching and before emitting GrantRequired.
• Add a dedicated regression suite covering device-scoped inventory vs execution authority and legacy no-resolver behavior.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
crates/astrid-capsule/src/dispatcher.rs	Carries device key id into matching, resolves per-event access snapshot, and updates candidate expansion + grant-on-use behavior.
crates/astrid-capsule/src/dispatcher_tests.rs	Updates existing tests to the new find_matching_interceptors signature.
crates/astrid-capsule/src/dispatcher_device_scope_tests.rs	Adds device-scope focused dispatch regression tests (inventory vs execution, invalid identities, legacy path).
crates/astrid-capsule/src/access.rs	Introduces ResolvedCapsuleAccess snapshot and device-scoped capability evaluation for capsule:list and capsule:access:any.
CHANGELOG.md	Documents the security behavior change under [Unreleased].

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

[joshuajbouw]

@copilot review exact head fcc31fe

[Copilot]

@copilot review exact head fcc31fe

Reviewed fcc31fe locally and against the current GitHub checks. I did not find an actionable issue to change in the exact head. Targeted validation also passed: cargo test -p astrid-capsule device_scope_tests -- --nocapture (5 passed).

[joshuajbouw]

@copilot review exact head 0d61c07

[Copilot]

@copilot review exact head 0d61c07

Reviewed exact head 0d61c07 locally and against the current PR checks. I did not find an actionable issue to change in this head. Targeted validation passed: cargo fmt --all -- --check, cargo test -p astrid-kernel pair_device_tests -- --nocapture, cargo test -p astrid-capsule device_scope_tests -- --nocapture, and git diff --check. Current GitHub checks are green where completed; the remaining jobs are still in progress rather than failing.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.