Module policy_set 

Project the public policy view from the component registry.

Exact round trips cover nonempty membership And/Any trees over the four defined base policies, base admin policies (Deny, AllowIfAdmin, AllowIfSuperAdmin), super-admin permission updates, and complete maps of valid supported metadata policies. Child order, duplicate children, and all condition wrappers are preserved.

A metadata field’s ALLOW_IF_SELF_OR_NON_MEMBER projects as Deny, its result on every scalar; an action entry that uses it is rejected.

This is not an identity for arbitrary PolicySet values. Admin combinators have no forward mapping. Permission updates always require a super admin (including DMs, whose legacy policy is Deny). Creation fills sparse metadata maps with defaults. These are existing limits, not additional stored state.

Enums

PolicyProjectionError

Functions

metadata_policy_to_admin_policy

Invert the constrained admin mapping. Combinators are not supported.

metadata_policy_to_membership_policy

Invert the membership mapping without changing the policy tree. Visit all children. An earlier Allow must not hide an invalid OR child.

policy_set_from_dictionary

Read the four action slots from COMPONENT_REGISTRY alone. Invalid action trees return an error; they never become a different policy. Metadata fields retain their existing per-field deny fallback.

validate_registry_action_policies

Require the action entries and validate each complete action policy tree. Use this on Welcome admission and on the final registry of a commit.