The closed built-in rule vocabulary accepted from configuration. prepare binds capabilities without accepting arbitrary evaluation closures.

DenyIfCve's configured behaviour: a separate record rather than fields on the constructor, so its selectors stay total under the sum (-Wpartial-fields).

DenyIfEpss's configured behaviour, the EPSS twin of DenyIfCveParams.

A stable, human-facing name for a rule: its identity, derived from the data. It is the boot-order tiebreak and the credited identity in logs and denial messages.

Whether a rule reads the advisory database. A rule set with none never needs one, and a set with one is worth waiting a bounded while for the first sync before deciding anything.

Whether a rule denies on the advisory database rather than abstaining without one. A rule set holding one cannot decide anything until an artifact loads, which is what makes a store mandatory.

A rule with explicit precedence, ordered highest first and then by name through bootOrder. No derived Ord defines policy order.

Use the rule type's default when configuration omits precedence. See bootOrder for tie-breaking. Identity allows override both advisory denies, while install-code and identity denies outrank every allow.

Default precedence of AllowIfOlderThan: the lowest band, a passive quarantine that yields to an explicit allow-list and to every deny.

Admit security fixes ahead of quarantine. Yield to AllowScope, whose trusted packages need no advisory probe.

Default precedence of AllowScope: above the quarantine, because an explicit allow-list is a stronger statement than the time gate. Still below every deny.

Outrank quarantine, remediation, and scope allows. Yield to AllowByIdentity so an operator can override an advisory denial.

Default precedence of DenyIfEpss: the same rung as DenyIfCve, which reads the same database and answers to the same identity-pin override. A tie resolves by name.

An identity pin overrides both advisory denies. DenyInstallTimeExecution and DenyByIdentity retain higher default precedence.

Default precedence of DenyInstallTimeExecution: the deny band, strictly above every allow default, so a matching deny overrides any allow out of the box.

Whether the evidence set carries one fact. Known wraps the fact's own vocabulary, so a determined absence (Known Nothing) stays distinct from Unread, which is no reading at all.

What the engine reads about one version, one entry per fact the rule vocabulary consults. Identity is unconditional, because a store listing establishes it without any metadata read.

Every fact present, the shape the serve, admission, and mirror paths always hold.

Identity alone, which an authenticated store listing establishes with no manifest. A rule reading any further fact cannot decide over it.

Ambient information a rule may need that is not part of the package itself.

Build the shared context from the mount's injected clock, never an ad-hoc wall clock. The advisory ETag is audit-only and cannot affect the decision.

A human-facing reason a rule attaches to its result, kept for the audit trail.

A deterministic verdict that the harness never retries. Allow, Deny, and fail-closed CannotVet are decisive. Other verdict reasons enter the deny-by-default audit trail in boot order.

The harness alone creates Unavailable from faults. Decisive verdicts and fail-closed faults determine the decision. Other outcomes contribute their reasons to the audit trail.

Choose refusal or abstention when a rule cannot vet or its evaluation faults. There is no failure alignment that admits unvetted bytes.

The overall decision for a package version against a whole rule set. It credits the deciding rule by name (see ruleName), independent of how the engine evaluates it.

A configured check the winning allow did not benefit from. The two kinds stay apart so no consumer reads a check the engine never ran as one that passed.

The skipped-check evidence a decision carries: an admission's, and none for any other outcome.

Serve transient outages, rate limits, timeouts, and open breakers as 503. Serve internal or parse faults as 500. WillResolve and WontResolve encode that distinction.

A Retry-After delay, in whole seconds. A 'newtype' so a raw count of seconds is never confused with some other integer when it reaches a response header or a sweep's wait.