capabilities: a registry, and a server that refuses to boot without one

permissions are capabilities, not routes. a capability is a feature — the
unit the owner grants, the dock filters on and the acl enforces — declaring
the api prefixes, websocket providers and screens it expands to.

four kinds. core is every account and is not grantable because it is not
deniable. app is the grantable surface. admin is the platform administering
itself. execution is never grantable at any level: terminal, chat, tasks,
files, desktop and browser all run as the owner's os user in the owner's
home, so granting one is co-ownership of the machine rather than a feature.

the part that matters is assertCapabilityTotality. the websocket hole fixed
in 2873948 was not a wrong rule — it was a door added without telling the
rule, because bun's route table matches /api/terminal/ws before the /api/*
catch-all that reaches hono's middleware. so the server now refuses to start
unless every mounted prefix and every user-facing socket maps to exactly one
capability. hono.ts mounts from a table and exports it, so the check reads
the real surface instead of a copy that can drift from it.

verified: passes against the live surface, and refuses all four ways — an
ungated router, an ungated socket, a claim on a deleted router, a claim on a
deleted socket.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/server.tsx

@@ -1,7 +1,8 @@
 import './servers/bootstrap';
 import type { ServerWebSocket } from 'bun';
 import { serve } from 'bun';
-import { honoServer } from './servers/hono';
+import { honoServer, PROTECTED_API_PREFIXES, UNPROTECTED_API_PREFIXES } from './servers/hono';
+import { assertCapabilityTotality } from './servers/capabilities/totality';
 import { verify } from './servers/jwt';
 import { isSuperAdmin } from './servers/super-admin';
 import { isWsProviderAllowedForNonOwner } from './servers/_middlewares';
@@ -139,6 +140,16 @@ const handlers: Record<string, any> = {
   sidecar: sidecarWebsocket,
 };
 
+// Both doors into the platform, checked against the capability registry before either opens.
+//
+// This throws rather than warns, and it throws HERE — before serve() — so a surface nobody has gated
+// cannot be reached even once. The HTTP half comes from hono.ts's own mount table and the socket half
+// from the map directly above, so neither list can be a stale copy of the thing it describes.
+assertCapabilityTotality({
+  apiPrefixes: [...PROTECTED_API_PREFIXES, ...UNPROTECTED_API_PREFIXES],
+  wsProviders: Object.keys(handlers),
+});
+
 async function upgradeWs(
   req: Request,
   server: any,