Enum Level 

pub enum Level {
    None,
    ReadOnly,
    Sandboxed,
    Loopback,
    ReadWrite,
    Allowlist,
    Full,
}

Trust level along a single dimension. Levels are totally ordered from None (no authority) upward; the numeric discriminant is the order, so <=/max/min on the rank give the lattice operations.

The levels are shared across dimensions (a deliberately small vocabulary) but not every level is meaningful on every dimension — the canonical readings are:

rank	Filesystem	Network	Exec
0	none	none	none
1	read-only	loopback	sandboxed
2	read-write	allowlist	(none)
3	full	full	full

Sandboxed aliases rank 1 for exec; Allowlist aliases rank 2 for network. They are distinct enum variants for legibility but compare purely by Level::rank.

Exec has no rank-2 level, and this table used to claim rank 2 read as = full there. It did not: nothing requires exec above rank 1 (effect_requirement maps proc to Sandboxed), so the only thing rank 2 changed was lex-os’s isolation floor, which gives rank 2 a gVisor boundary while Full demands a microVM. An author following the old table asked for full-exec semantics and received a weaker boundary than full exec requires.

A level is therefore only accepted on a dimension that gives it a meaning — see Dimension::permits_level — so the gap is a refusal rather than a silently weaker box (alpibrusl/lex-lang#808).

Variants

None

rank 0 — the effect is physically absent from the box.

ReadOnly

rank 1 — read-only / loopback-only / sandboxed-exec.

Sandboxed

rank 1 — exec spelled for legibility (same rank as ReadOnly).

Loopback

rank 1 — network loopback only.

ReadWrite

rank 2 — read-write filesystem.

Allowlist

rank 2 — network restricted to an allowlist.

Full

rank 3 — unrestricted authority on the dimension.

Implementations

impl Level

pub fn rank(self) -> u8

The position of this level in the total order. Lattice operations are defined on the rank.

pub fn leq(self, other: Level) -> bool

self ≤ other in the trust order (self grants no more than other). This is the per-dimension subtyping relation.

pub fn join(self, other: Level) -> Level

Least upper bound (join): the tighter of two levels that still covers both. Returns the higher-ranked level.

pub fn meet(self, other: Level) -> Level

Greatest lower bound (meet): the most authority both allow. Returns the lower-ranked level.

pub fn as_str(self) -> &'static str

impl Level

pub fn json_name(self) -> &'static str

The spelling this level has in a manifest.

Distinct from Level::as_str, which is the lowercase prose form used in messages about a grant. A refusal is read by whoever is writing the JSON, so quoting sandboxed at them when the parser wants Sandboxed would send them round again — the exact loop these refusals exist to end.

Trait Implementations

impl Clone for Level

fn clone(&self) -> Level

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for Level

impl Debug for Level

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Level

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Display for Level

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for Level

impl Hash for Level

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for Level

fn eq(&self, other: &Level) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for Level

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Level