Permissive Learning Mode 4/6 Capability

[lilybarkley-msft]

📖 Description

PR 4 of 6 — stacked on PR3. Adds capability extraction.

• New extract_caps module: decodes the DACL ACE blob attached to each EventID=14 event and resolves capability SIDs to names via DeriveCapabilitySidsFromName.
  • Process-static capability table (built once via build_capability_table) so the per-event hot path avoids the syscall + LocalAlloc/LocalFree round-trip.
  • CapabilityIndex for O(1) SID-bytes → name resolution per ACE.
• event_parser:
  • ParsedEvent gains complex_data_4_idx (index of the 5th <ComplexData> sibling — the ACE blob) so the largest per-event field is borrowed, not cloned.
  • ParseAccumulator gains the capability table/index.
• access_failure::consume_access_failure walks the ACE blob through extract_caps_with_index_into and accumulates requested_capabilities.
• config::merge_capabilities — full body replaces the PR3 stub. Resolves the containment sub-object case-insensitively, dedupes case-insensitively, sorts via an allocation-free ASCII compare, and emits a stderr warning when the backend has no capabilities array.
• New plm extract-caps CLI subcommand for parser debugging on a single hex ACE blob.

UI policy lands in PR5.

🔗 References

• Base: PR3 (user/lilybarkley/plm-pr3-config-gen)
• Next: PR5 — UI policy (EventID=27 decode + uiPolicy merge)

🔍 Validation

• cargo build -p plm --target x86_64-pc-windows-msvc — clean
• cargo fmt --all -- --check — clean
• cargo clippy -p plm --target x86_64-pc-windows-msvc --all-targets -- -D warnings — clean
• cargo test -p plm --target x86_64-pc-windows-msvc — 52 passed (15 new: ACE blob decode, capability dedupe/sort, merge_capabilities with mixed-case inputs and unsupported-backend warning path).

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)

📋 Issue Type

• Bug fix
• Feature
• Task

---

GitHub Actions runs the PR validation build automatically. The ADO pipeline
(MXC-PR-Build) is the official build pipeline that signs the binaries; it
runs on merge to main and nightly, and Microsoft reviewers can trigger it
on a PR with /azp run. See docs/pull-requests.md.

Microsoft Reviewers: Open in CodeFlow