Module level 

Safety levels as predicates over profiles (v1.4 §4.1).

A Level is a disjunction of allow Clauses plus an allow-only set of deny clauses (the yolo subtractive primitive, §4.1). A Clause is a conjunction of per-facet bounds — an ordinal ceiling/floor (OrdBound) or a categorical set — and an omitted facet is unconstrained. A capability is admissible iff some allow clause admits every one of its facets and no deny clause matches it; a profile passes iff every capability is admissible.

Nothing here parses TOML or ships a default level yet — this is the algebra and its contract. Level authoring (TOML → Level) and the default set arrive next.

Structs

Clause

A conjunction of per-facet constraints. A default (all-None) clause admits every capability. Each ordinal facet takes an OrdBound; each categorical facet an allowed set. Fields are flattened per axis — a compound facet is never a single constraint (the R25 discipline).

Level

A safety level: a name, its allow clauses (disjunction), and its deny clauses (allow-only subtractive corners, §4.1).

OrdBound

An ordinal bound: min ≤ term ≤ max, either side optional. at_most is a ceiling (the common risk-facet form); at_least a floor (trust facets like pinning). An omitted side is unconstrained.