feat: upgrade typell-vql from VQL-DT to VQL-UT (10-level type safety)

Replace VQL-dt++ bridge with VQL-UT's full 10-level type safety hierarchy:

New levels module (levels.rs):
- SafetyLevel enum with all 10 levels (ParseTime through Linearity)
- SafetyReport for per-level check results
- QueryPath enum (Slipstream / DT / UT) with max achievable levels
- Established (1-6) vs research-identified (7-10) tier classification

Updated bridge (bridge.rs):
- determine_safety_level() checks all 10 levels in order
- Maps VQL-dt++ extensions to their VQL-UT level equivalents:
  PROOF ATTACHED → Level 5, EFFECTS → Level 8,
  SESSION/TRANSACTION → Level 9, CONSUME AFTER/USAGE LIMIT → Level 10
- Automatic query path selection based on achieved level

Existing VQL-dt++ bridge code preserved and documented with level mappings.
All existing tests pass + 8 new tests for the levels and safety determination.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

crates/typell-vql/Cargo.toml

@@ -3,7 +3,7 @@
 
 [package]
 name = "typell-vql"
-description = "TypeLL bridge for VQL-dt++ — maps query types (modalities, sessions, effects, linear usage) into TypeLL"
+description = "TypeLL bridge for VQL-UT — maps all 10 type safety levels into TypeLL's unified type system (supersedes VQL-DT)"
 version.workspace = true
 edition.workspace = true
 license.workspace = true

crates/typell-vql/src/bridge.rs

@@ -1,25 +1,29 @@
 // SPDX-License-Identifier: PMPL-1.0-or-later
 // SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell
 
-//! Bridge from VQL-dt++ query types to TypeLL's unified types.
+//! Bridge from VQL-UT query types to TypeLL's unified types.
 //!
-//! ## VQL Extension → TypeLL Mapping
+//! Maps VQL-UT's 10-level type safety hierarchy into TypeLL concepts.
+//! Legacy VQL-dt++ extensions are preserved and mapped to their
+//! corresponding VQL-UT levels:
 //!
-//! | VQL Extension             | TypeLL Concept                           |
-//! |---------------------------|------------------------------------------|
-//! | `CONSUME AFTER N USE`     | `UsageQuantifier::Bounded(n)`            |
-//! | `WITH SESSION ReadOnly`   | `SessionType::Recv` chain                |
-//! | `EFFECTS { Read, Write }` | `Effect::Named("Read")` etc.             |
-//! | `IN TRANSACTION Active`   | `Type::Named("TxState:Active", [])`      |
-//! | `PROOF ATTACHED thm`      | Refinement predicate                     |
-//! | `USAGE LIMIT n`           | `UsageQuantifier::Bounded(n)`            |
+//! | VQL-UT Level | VQL-dt++ Extension          | TypeLL Concept                    |
+//! |--------------|-----------------------------|-----------------------------------|
+//! | 5            | `PROOF ATTACHED thm`        | Refinement predicate              |
+//! | 8            | `EFFECTS { Read, Write }`   | `Effect::Named("Read")` etc.      |
+//! | 9            | `WITH SESSION ReadOnly`     | `SessionType::Recv` chain         |
+//! | 9            | `IN TRANSACTION Active`     | `Type::Named("TxState:Active")`   |
+//! | 10           | `CONSUME AFTER N USE`       | `UsageQuantifier::Bounded(n)`     |
+//! | 10           | `USAGE LIMIT n`             | `UsageQuantifier::Bounded(n)`     |
 
 use serde::{Deserialize, Serialize};
 use typell_core::types::{
     Effect, Predicate, SessionType, Type, TypeDiscipline,
     UnifiedType, UsageQuantifier,
 };
 
+use crate::levels::{SafetyLevel, SafetyReport, LevelCheck, QueryPath};
+
 /// VQL modality (one of the 8 query modalities).
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub enum VqlModality {
@@ -233,6 +237,120 @@ fn modality_name(m: &VqlModality) -> &str {
     }
 }
 
+/// Determine the VQL-UT safety level achieved by a query.
+///
+/// Checks each level in order and stops at the first failure.
+/// Returns a safety report with per-level diagnostics.
+pub fn determine_safety_level(vql: &VqlQueryType) -> SafetyReport {
+    let mut checks = Vec::new();
+    let mut max_level = SafetyLevel::ParseTime;
+
+    // Level 1: Parse-time safety — if we have a VqlQueryType, parsing succeeded.
+    checks.push(LevelCheck {
+        level: SafetyLevel::ParseTime,
+        passed: true,
+        diagnostic: String::new(),
+    });
+
+    // Level 2: Schema-binding — result fields must be non-empty (schema resolved).
+    let l2_pass = !vql.result_fields.is_empty();
+    checks.push(LevelCheck {
+        level: SafetyLevel::SchemaBinding,
+        passed: l2_pass,
+        diagnostic: if l2_pass { String::new() } else { "No result fields bound to schema".to_string() },
+    });
+    if l2_pass { max_level = SafetyLevel::SchemaBinding; }
+
+    // Level 3: Type-compatible operations — modalities are valid enum variants.
+    let l3_pass = !vql.modalities.is_empty();
+    checks.push(LevelCheck {
+        level: SafetyLevel::TypeCompatible,
+        passed: l3_pass,
+        diagnostic: if l3_pass { String::new() } else { "No modalities specified".to_string() },
+    });
+    if l2_pass && l3_pass { max_level = SafetyLevel::TypeCompatible; }
+
+    // Level 4: Null-safety — all fields are typed (no raw strings without schema).
+    // At this stage we treat schema-bound fields as null-safe.
+    let l4_pass = l2_pass && l3_pass;
+    checks.push(LevelCheck {
+        level: SafetyLevel::NullSafe,
+        passed: l4_pass,
+        diagnostic: if l4_pass { String::new() } else { "Schema binding required for null-safety".to_string() },
+    });
+    if l4_pass { max_level = SafetyLevel::NullSafe; }
+
+    // Level 5: Injection-proof — proof attachment provides refinement predicates.
+    let l5_pass = l4_pass && vql.extensions.proof_attached.is_some();
+    checks.push(LevelCheck {
+        level: SafetyLevel::InjectionProof,
+        passed: l5_pass,
+        diagnostic: if l5_pass { String::new() } else { "PROOF ATTACHED clause required for injection-proof safety".to_string() },
+    });
+    if l5_pass { max_level = SafetyLevel::InjectionProof; }
+
+    // Level 6: Result-type safety — always passes if schema-bound (type is inferred).
+    let l6_pass = l4_pass;
+    checks.push(LevelCheck {
+        level: SafetyLevel::ResultType,
+        passed: l6_pass,
+        diagnostic: if l6_pass { String::new() } else { "Result type cannot be inferred".to_string() },
+    });
+    if l5_pass && l6_pass { max_level = SafetyLevel::ResultType; }
+
+    // Level 7: Cardinality safety — usage limit provides bounded quantifiers.
+    let l7_pass = l6_pass && vql.extensions.usage_limit.is_some();
+    checks.push(LevelCheck {
+        level: SafetyLevel::Cardinality,
+        passed: l7_pass,
+        diagnostic: if l7_pass { String::new() } else { "USAGE LIMIT clause required for cardinality safety".to_string() },
+    });
+    if l5_pass && l7_pass { max_level = SafetyLevel::Cardinality; }
+
+    // Level 8: Effect-tracking — effects clause required.
+    let l8_pass = l7_pass && vql.extensions.effects.as_ref().map_or(false, |e| !e.is_empty());
+    checks.push(LevelCheck {
+        level: SafetyLevel::EffectTracking,
+        passed: l8_pass,
+        diagnostic: if l8_pass { String::new() } else { "EFFECTS clause required for effect-tracking safety".to_string() },
+    });
+    if l8_pass { max_level = SafetyLevel::EffectTracking; }
+
+    // Level 9: Temporal safety — session protocol or transaction state required.
+    let l9_pass = l8_pass && (vql.extensions.session_protocol.is_some()
+                              || vql.extensions.transaction_state.is_some());
+    checks.push(LevelCheck {
+        level: SafetyLevel::Temporal,
+        passed: l9_pass,
+        diagnostic: if l9_pass { String::new() } else { "WITH SESSION or IN TRANSACTION clause required for temporal safety".to_string() },
+    });
+    if l9_pass { max_level = SafetyLevel::Temporal; }
+
+    // Level 10: Linearity safety — consume_after or usage_limit with linear discipline.
+    let l10_pass = l9_pass && vql.extensions.consume_after.is_some();
+    checks.push(LevelCheck {
+        level: SafetyLevel::Linearity,
+        passed: l10_pass,
+        diagnostic: if l10_pass { String::new() } else { "CONSUME AFTER clause required for linearity safety".to_string() },
+    });
+    if l10_pass { max_level = SafetyLevel::Linearity; }
+
+    // Determine query path based on max level.
+    let query_path = if max_level.as_u8() >= 7 {
+        QueryPath::Ut
+    } else if max_level.as_u8() >= 2 {
+        QueryPath::Dt
+    } else {
+        QueryPath::Slipstream
+    };
+
+    SafetyReport {
+        max_level,
+        checks,
+        query_path,
+    }
+}
+
 // ============================================================================
 // Tests
 // ============================================================================
@@ -313,4 +431,55 @@ mod tests {
         let session = session_protocol_to_session(&VqlSessionProtocol::Stream);
         assert!(matches!(session, SessionType::Rec(_, _)));
     }
+
+    #[test]
+    fn test_safety_level_basic_query() {
+        let vql = VqlQueryType {
+            modalities: vec![VqlModality::Graph],
+            result_fields: vec!["name".to_string()],
+            extensions: VqlExtensions::default(),
+        };
+        let report = determine_safety_level(&vql);
+        assert_eq!(report.max_level, SafetyLevel::NullSafe);
+        assert_eq!(report.query_path, QueryPath::Dt);
+    }
+
+    #[test]
+    fn test_safety_level_full_ut() {
+        let vql = VqlQueryType {
+            modalities: vec![VqlModality::Graph],
+            result_fields: vec!["name".to_string()],
+            extensions: VqlExtensions {
+                consume_after: Some(3),
+                session_protocol: Some(VqlSessionProtocol::ReadOnly),
+                effects: Some(vec![VqlEffectLabel::Read]),
+                transaction_state: None,
+                proof_attached: Some("integrity".to_string()),
+                usage_limit: Some(10),
+            },
+        };
+        let report = determine_safety_level(&vql);
+        assert_eq!(report.max_level, SafetyLevel::Linearity);
+        assert_eq!(report.query_path, QueryPath::Ut);
+        assert_eq!(report.checks.len(), 10);
+        assert!(report.checks.iter().all(|c| c.passed));
+    }
+
+    #[test]
+    fn test_safety_level_partial_ut() {
+        let vql = VqlQueryType {
+            modalities: vec![VqlModality::Document],
+            result_fields: vec!["content".to_string()],
+            extensions: VqlExtensions {
+                effects: Some(vec![VqlEffectLabel::Read, VqlEffectLabel::Write]),
+                proof_attached: Some("access_control".to_string()),
+                usage_limit: Some(5),
+                ..Default::default()
+            },
+        };
+        let report = determine_safety_level(&vql);
+        // Has effects + proof + usage_limit but no session/consume_after
+        assert_eq!(report.max_level, SafetyLevel::EffectTracking);
+        assert_eq!(report.query_path, QueryPath::Ut);
+    }
 }