Module gate_rules 

Scripted taint-gate rules: load ~/.config/leviath/rules/*.rhai and build the ScriptRuleChecker the runtime’s taint gate consults after the static allowlist. The daemon owns the Rhai engine (leviath-runtime has no scripting dependency), so the checker is installed as a world resource.

Functions

build_gate_script_checker

Build a ScriptRuleChecker from every *.rhai file in rules_dir. When the directory is absent/unreadable or holds no rule scripts, a no-op checker (that never allows anything) is returned, so the daemon can install it unconditionally. Each script receives a context map (tool / target / taint_level) and should evaluate to true to allow the call; the first script that allows wins and its file stem is the rule name.