space.capability reference

space.capability is the permission list for one partition, the concrete form of the capability envelope. Space CLI creates it while resolving a deployment, signs it, and includes its digest in the release. The runner checks the file before it starts a service. Operators inspect this object through space deploy --plan; they do not edit it by hand.

Example

schema: space.capability
version: "1"
project_id: wildfire
partition_id: payload
rootfs_digest: sha256:<64-hex-digits>
verity_root_hash: sha256:<64-hex-digits>
allowed_apids: [288, 289]
routes: [ground]
storage_extents:
  - device: payload-data
    start_block: 0
    block_count: 262144
network_policy: [payload-net]
runtime_handles: [gpu0]
epoch: 7
rollback_index: 4
public_key_ids: [mission-command]
delegate_key: |
  -----BEGIN PUBLIC KEY-----
  <public-key>
  -----END PUBLIC KEY-----

Fields

Field	Type	Required	Description
schema	string	yes	Must be space.capability. Unknown fields are rejected.
version	string	yes	Schema version. The current version is "1".
project_id	string	yes	Project that owns the services.
partition_id	string	yes	Partition receiving these permissions.
rootfs_digest	SHA-256 digest	yes	Exact root filesystem the runner may start.
verity_root_hash	SHA-256 digest	yes	Root hash dm-verity uses to verify filesystem blocks.
allowed_apids	list of integers	no (default: [])	CCSDS APID stream numbers the partition may use. Values range from 0 through 2047.
routes	list of strings	no (default: [])	Destinations to which the partition may send messages.
storage_extents	list	no (default: [])	Exact block ranges the storage service may attach.
network_policy	list of strings	no (default: [])	Network bridges and rules assigned to the partition.
runtime_handles	list of strings	no (default: [])	Target devices or accelerator queues assigned to the partition.
epoch	integer	no (default: 0)	Permission generation. A newer generation replaces an older one.
rollback_index	integer	no (default: 0)	Lowest accepted security version for this partition.
public_key_ids	list of strings	no (default: [])	Keys the partition may ask space-secret to use.
delegate_key	PEM public key	no (default: empty)	Key that must prove possession before the runner accepts this permission list.

Storage extent

Field	Type	Required	Description
device	string	yes	Logical storage device from the target profile.
start_block	integer	yes	First 4 KiB block granted to the partition.
block_count	integer	yes	Number of 4 KiB blocks. Must be positive.

Inspect the resolved permissions

space deploy payload:release --target sat-42 --plan

Check the partition name, image digest, message routes, storage range, device handles, and key IDs. The deploy command signs those exact values before it queues the release.