Struct MeshPolicy

Source

pub struct MeshPolicy {
    pub timeout: Option<Duration>,
    pub retries: Option<u32>,
    pub circuit_breaker: Option<CircuitBreaker>,
    pub mtls_required: Option<bool>,
    pub rate_limit: Option<RateLimit>,
}

Expand description

Mesh policies that apply to every :contratos edge unless overridden per-edge in M4. V0 is a single global policy block.

Fields§

§timeout: Option<Duration>

Per-call timeout. Authored as a duration string ("30s").

§retries: Option<u32>

Number of retries on transient failure. None = no retries.

§circuit_breaker: Option<CircuitBreaker>

Circuit breaker config. Trips after N failures within W duration; closes after a cooldown.

§mtls_required: Option<bool>

Whether mTLS is required for every contrato. Default: true (sandboxing-by-default; explicit opt-out only).

§rate_limit: Option<RateLimit>

Token-bucket rate limit. Authored as "100/s" or "5000/m"; stored as (rate, window).

Implementations§

Source §

impl MeshPolicy

Source

pub const fn is_empty(&self) -> bool

True when no :politicas axis carries a value — every field is None. The same emptiness contract every other M2/M3 typed surface carries (crate::LimitsSpec::is_empty, crate::BehaviorSpec::is_empty): renderers that overlay the typed slot onto a cluster artifact key off this predicate to decide “emit the slot” vs “skip the slot entirely”, so an authored-but-unset :politicas (()) round-trips to a rendered artifact that’s structurally identical to one that omits the slot. Lifted as a typed predicate (rather than per-renderer inline politicas.timeout.is_none() && politicas.retries.is_none() && … chains) so a future axis added to MeshPolicy (per-edge :politicas overlay in M4, per-Aplicacao traffic-shaping in M5) is one struct-field edit + one && self.<axis>.is_none() here, not a coordinated rewrite of every consumer that’s reaching for the emptiness semantic.

Source

pub const fn breaker_window_observes_timeout(&self) -> bool

Substrate-canonical cross-axis coherence predicate on the :politicas slot: does the :circuit-breaker :window rolling failure-observation interval span at least one full :timeout-bounded call?

The first cross-axis invariant on the :politicas surface — every prior gate (AplicacaoSpec::validate_politicas’s four zero-floor + canonical-form + cap brackets) validates one axis in isolation, so a MeshPolicy whose axes are each individually well-formed could still name a structurally inert pair. The pair { timeout: 30s, circuit_breaker: { window: 10s, .. } } passes every per-axis bracket (30s ≤ POLICY_TIMEOUT_MAX, 10s ≤ POLICY_BREAKER_WINDOW_MAX, both integer-millisecond, both above the zero floor) and is nonetheless a breaker that cannot trip on the failure mode it exists to catch: a call dispatched at t=0 is declared failed at t=30s, by which point the 10s window open at dispatch has rolled twice over, so no window can ever hold even one timeout-derived failure however high the call volume. Envoy’s outlier_detection.interval carries the identical relation against the per-route request timeout; Hystrix ships the canonical ratio in its defaults (10s metrics.rollingStats.timeInMilliseconds against a 1s execution.isolation.thread.timeoutInMilliseconds).

Vacuously true when either axis is absent — a :politicas that names only one of the pair declares no relation for the substrate to hold it to (:timeout alone is a per-call deadline with no breaker; :circuit-breaker alone is a breaker whose failures arrive from the transport’s own error signal rather than from a substrate-imposed deadline, so no dispatch-to-report lag is knowable at author time). This is the same “unset means the cluster default applies, not zero” partition MeshPolicy::is_empty and every per-axis accessor’s None arm already carry.

Lifted as a typed predicate on the substrate primitive rather than open-coded at the validate gate so every downstream consumer of the pair reaches the invariant through one dispatch: the AplicacaoSpec::validate_politicas gate below, the future CiliumClusterwideEnvoyConfig per-:politicas overlay (MESH-COMPOSITION §III.2 #3) that must emit outlier_detection.interval and the per-route timeout as one coherent Envoy block, the future M4 mesh.pleme.io/v1alpha1/Aplicacao CR materializer’s admission webhook, and the future per-:contratos-edge :politicas override that same roadmap acknowledges — which resolves an effective pair per edge (edge-level :timeout against the Aplicacao-level :window, or vice versa) and so must re-check the relation on a pair neither axis’s declaration site can see whole. Naming the invariant once means that resolver folds this predicate over its resolved pair instead of re-deriving the comparison, exactly as the sibling cross-slot [PlacementStrategy::is_shard_keyed] predicate names the :placement/:shard-key relation for its own consumers.

Source

pub const fn breaker_can_trip_under_rate_limit(&self) -> bool

Substrate-canonical cross-axis coherence predicate on the :politicas slot: can the token-bucket rate declared by :rate-limit dispatch enough calls inside :circuit-breaker :window to reach :max-failures?

The second cross-axis invariant on the :politicas surface — sibling to MeshPolicy::breaker_window_observes_timeout on the (:timeout, :circuit-breaker :window) pair, extended onto the (:rate-limit, :circuit-breaker) pair. Each axis in the pair is validated in isolation by the per-axis brackets in AplicacaoSpec::validate_politicas (rate zero-floor + cap, max-failures zero-floor + cap, both windows zero-floor + integer-millisecond + cap, rate-limit window canonical-form), so a MeshPolicy whose axes are each individually well-formed can still name a structurally inert pair. The pair { rate-limit: "1/h", circuit-breaker: (:max-failures 5 :window "10s") } passes every per-axis bracket and is nonetheless a breaker that cannot trip on the failure mode it exists to catch: the token bucket admits rate × (cb.window / rl.window) = 1 × (10s / 3600s) ≈ 0 calls per rolling breaker window, so no window can accumulate five failures however catastrophically the upstream is failing. Envoy’s outlier_detection.consecutive_5xx paired against local_rate_limit.token_bucket.max_tokens / fill_interval carries the identical relation; every production playbook that pairs the two axes (Envoy, Istio, AWS App Mesh, Kong) recommends sizing the rate at or above the breaker’s minimum-request-volume threshold for exactly this reason.

The typed test is the integer inequality rate × cb.window.as_nanos() >= max_failures × rl.window.as_nanos() (rearranged from rate × cb.window / rl.window >= max_failures so no floating-point division mediates the comparison and so the sub-second rl.window arms — "n/s" = 1s — are treated exactly). Both multiplicands are saturating_mul’d into u128 so a struct-literal MeshPolicy whose per-axis fields have not yet passed AplicacaoSpec::validate_politicas (e.g. rate: u32::MAX, cb_window: Duration::MAX) does not panic the predicate; a saturated pair collapses to the “vacuously coherent” branch the peer per-axis brackets reject via their own zero-floor / cap arms first.

Vacuously true when either axis is absent — a :politicas that names only one of the pair declares no relation for the substrate to hold it to (:rate-limit alone is a per-edge token-bucket declaration with no failure counter to starve; :circuit-breaker alone is a rolling-window failure counter whose call rate is unconstrained by the substrate, so no bucket-derived upper bound on calls-per-window is knowable at author time). Same “unset means the cluster default applies, not zero” partition MeshPolicy::is_empty and the sibling MeshPolicy::breaker_window_observes_timeout predicate carry.

Lifted as a typed predicate on the substrate primitive rather than open-coded at the validate gate so every downstream consumer of the pair reaches the invariant through one dispatch: the AplicacaoSpec::validate_politicas gate below, the future CiliumClusterwideEnvoyConfig per-:politicas overlay (MESH-COMPOSITION §III.2 #3) that must emit local_rate_limit.token_bucket.{max_tokens, fill_interval} alongside outlier_detection.consecutive_5xx / outlier_detection.interval as one coherent Envoy block, the future M4 mesh.pleme.io/v1alpha1/Aplicacao CR materializer’s admission webhook, and the future per-:contratos-edge :politicas override the same roadmap acknowledges — which resolves an effective pair per edge (edge-level :rate-limit against the Aplicacao-level :circuit-breaker, or vice versa) and so must re-check the relation on a pair neither axis’s declaration site can see whole. Naming the invariant once means that resolver folds this predicate over its resolved pair instead of re-deriving the comparison, exactly as the sibling cross-axis MeshPolicy::breaker_window_observes_timeout predicate names the (:timeout, :window) relation for its own consumers.

Source

pub const fn retries_fit_under_breaker_trip_threshold(&self) -> bool

Substrate-canonical cross-axis coherence predicate on the :politicas slot: can one client’s declared :retries all complete before :circuit-breaker :max-failures trips the breaker mid-retry?

The third cross-axis invariant on the :politicas surface — sibling to MeshPolicy::breaker_window_observes_timeout on the (:timeout, :circuit-breaker :window) pair and MeshPolicy::breaker_can_trip_under_rate_limit on the (:rate-limit, :circuit-breaker) pair, extended onto the (:retries, :circuit-breaker :max-failures) pair. Each axis in the pair is validated in isolation by the per-axis brackets in AplicacaoSpec::validate_politicas (retries zero-floor + cap, max-failures zero-floor + cap), so a MeshPolicy whose axes are each individually well-formed can still name a structurally-inert retry policy. The pair { :retries 3, :circuit-breaker (:max-failures 3 :window "1s") } passes every per-axis bracket and is nonetheless a retry policy the substrate cannot honor: one client’s initial attempt plus three retries is four attempts, but the breaker trips on the third failure — the fourth attempt (the last declared retry) is blocked by the open breaker, so the substrate declared four attempts and structurally allows three.

The typed test is the integer inequality cb.max_failures() > retries — the retries count is the number of retry attempts beyond the initial (Envoy’s retry_policy.num_retries semantics), so a client makes at most retries + 1 attempts per client call, each of which may fail. For the breaker to admit the retry policy through completion, its trip threshold must not be reached by one client’s failures alone: retries + 1 <= max_failures, equivalently retries < max_failures, equivalently max_failures > retries. The boundary case max_failures == retries + 1 accepts (the R+1th failure — the last retry — trips the breaker exactly as it completes; retries are fully executed). The strict-below case max_failures <= retries rejects (the breaker trips before retries exhaust, silently truncating the declared retry policy mid-run — the same declared-but-structurally-inert footgun the sibling per-axis cap arms close on the single-axis surfaces).

Vacuously true when either axis is absent — a :politicas that names only one of the pair declares no relation for the substrate to hold it to (:retries alone is a client-retry policy with no failure counter to trip; :circuit-breaker alone is a failure counter whose per-client attempt count is unconstrained by the substrate, so no per-client saturation bound on failures-per-client-call is knowable at author time). Same “unset means the cluster default applies, not zero” partition MeshPolicy::is_empty and the sibling MeshPolicy::breaker_window_observes_timeout / MeshPolicy::breaker_can_trip_under_rate_limit predicates carry.

Lifted as a typed predicate on the substrate primitive rather than open-coded at the validate gate so every downstream consumer of the pair reaches the invariant through one dispatch: the AplicacaoSpec::validate_politicas gate below, the future CiliumClusterwideEnvoyConfig per-:politicas overlay (MESH-COMPOSITION §III.2 #3) that must emit retry_policy.num_retries alongside outlier_detection.consecutive_5xx as one coherent Envoy block, the future M4 mesh.pleme.io/v1alpha1/Aplicacao CR materializer’s admission webhook, and the future per-:contratos-edge :politicas override the same roadmap acknowledges — which resolves an effective pair per edge (edge-level :retries against the Aplicacao-level :circuit-breaker, or vice versa) and so must re-check the relation on a pair neither axis’s declaration site can see whole. Naming the invariant once means that resolver folds this predicate over its resolved pair instead of re-deriving the comparison, exactly as the sibling cross-axis MeshPolicy::breaker_window_observes_timeout and MeshPolicy::breaker_can_trip_under_rate_limit predicates name the (:timeout, :window) and (:rate-limit, :circuit-breaker) relations for their own consumers.

Source

pub const fn rate_limit_admits_retry_burst(&self) -> bool

Substrate-canonical cross-axis coherence predicate on the :politicas slot: does the :rate-limit token-bucket capacity admit one client’s full :retries + 1 attempt burst inside a single refill window?

The fourth cross-axis invariant on the :politicas surface, completing the triangle of pairs the three sibling gates carve out — sibling to MeshPolicy::breaker_window_observes_timeout on the (:timeout, :circuit-breaker :window) pair, MeshPolicy::breaker_can_trip_under_rate_limit on the (:rate-limit, :circuit-breaker) pair, and MeshPolicy::retries_fit_under_breaker_trip_threshold on the (:retries, :circuit-breaker :max-failures) pair, extended onto the (:retries, :rate-limit) pair — the last cross-axis relation among the three scalar :politicas axes (:retries, :rate-limit, :circuit-breaker) whose axis-triple defines the coherence surface every production overlay (Envoy, Istio, resilience4j, AWS App Mesh) resolves as one block. Each axis in the pair is validated in isolation by the per-axis brackets in AplicacaoSpec::validate_politicas (retries zero-floor + cap, rate zero-floor + cap, window canonical-form), so a MeshPolicy whose axes are each individually well-formed can still name a structurally-truncated retry policy the rate limiter refuses to admit. The pair { :retries 5, :rate-limit "3/s" } passes every per-axis bracket and is nonetheless a retry policy the substrate cannot honor: one client’s initial attempt plus five retries is six attempts, but the token bucket admits at most three tokens per one-second refill window, so the fourth attempt onward is blocked by the rate limiter itself — the substrate declared six attempts and structurally allows three. Envoy’s local_rate_limit.token_bucket.max_tokens paired against retry_policy.num_retries carries the identical relation; every production playbook that pairs the two axes recommends sizing the bucket capacity above any single client’s retry budget so the retry policy is not silently truncated by the same rate limiter it feeds through.

The typed test is the integer inequality rl.rate() >= retries + 1 — the retries count is the number of retry attempts beyond the initial (Envoy’s retry_policy.num_retries semantics), so a client makes at most retries + 1 attempts per client call, each of which consumes one token from the local rate-limit bucket. For the bucket to admit the retry burst without dropping tokens, its capacity must not be reached by one client’s attempts alone: retries + 1 <= rate, equivalently rate >= retries + 1. The boundary case rate == retries + 1 accepts (the bucket admits exactly one client’s full retry sequence per refill window — retries fully executed). The strict-below case rate <= retries rejects (the bucket exhausts before retries complete, silently truncating the declared retry policy mid-run — the same declared-but-structurally-inert footgun the sibling per-axis cap arms close on the single-axis surfaces). The equivalent coherent-direction form rl.rate() > retries sidesteps the retries + 1 addition entirely (both rate and retries are u32; the > comparison is total on the type with no overflow against past-the-guard struct-literal retries values a caller might pass before validate runs), matching the peer MeshPolicy::retries_fit_under_breaker_trip_threshold direct- >-comparison discipline on the sibling (:retries, :max-failures) pair.

Vacuously true when either axis is absent — a :politicas that names only one of the pair declares no relation for the substrate to hold it to (:retries alone is a client-retry policy with no rate limiter to saturate; :rate-limit alone is a token-bucket declaration whose per-client attempt count is unconstrained by the substrate, so no per-client saturation bound on tokens-per-client-call is knowable at author time). Same “unset means the cluster default applies, not zero” partition MeshPolicy::is_empty and the three sibling cross-axis predicates (MeshPolicy::breaker_window_observes_timeout, MeshPolicy::breaker_can_trip_under_rate_limit, MeshPolicy::retries_fit_under_breaker_trip_threshold) carry.

Lifted as a typed predicate on the substrate primitive rather than open-coded at the validate gate so every downstream consumer of the pair reaches the invariant through one dispatch: the AplicacaoSpec::validate_politicas gate below, the future CiliumClusterwideEnvoyConfig per-:politicas overlay (MESH-COMPOSITION §III.2 #3) that must emit local_rate_limit.token_bucket.max_tokens alongside retry_policy.num_retries as one coherent Envoy block, the future M4 mesh.pleme.io/v1alpha1/Aplicacao CR materializer’s admission webhook, and the future per-:contratos-edge :politicas override the same roadmap acknowledges — which resolves an effective pair per edge (edge-level :retries against the Aplicacao-level :rate-limit, or vice versa) and so must re-check the relation on a pair neither axis’s declaration site can see whole. Naming the invariant once means that resolver folds this predicate over its resolved pair instead of re-deriving the comparison, exactly as the three sibling cross-axis predicates name the (:timeout, :window) / (:rate-limit, :circuit-breaker) / (:retries, :max-failures) relations for their own consumers, closing the fourth and last cross-axis relation on the scalar :politicas axis-triple.

Source

pub fn first_cross_axis_violation(&self) -> Option<AplicacaoError>

Substrate-canonical fold over the four cross-axis coherence predicates on the :politicas slot — returns the first cross-axis violation (as its AplicacaoError variant) in the canonical “more-foundational-cross-axis first” ordering MeshPolicy::breaker_window_observes_timeout on (:timeout, :circuit-breaker :window) → MeshPolicy::breaker_can_trip_under_rate_limit on (:rate-limit, :circuit-breaker) → MeshPolicy::retries_fit_under_breaker_trip_threshold on (:retries, :circuit-breaker :max-failures) → MeshPolicy::rate_limit_admits_retry_burst on (:retries, :rate-limit). Returns None when every cross-axis relation holds (the vacuous shape MeshPolicy::is_empty and the fully- coherent shape both land here).

The ordering discipline this method encodes was open-coded four times at AplicacaoSpec::validate_politicas — each cross-axis gate was an if !<predicate>() { let <a> = self.<axis>().expect( "cross-axis gate fires only when :<axis> is present"); let = self.<axis>().expect(…); return Err(<variant>) } block whose axis-fetch step depended on the predicate having just returned false (structurally guaranteed both paired axes are Some, but the compiler cannot see through the predicate body, so every arm re-called the accessor with .expect(…) to reach the axis it just tested). Two unsound consequences: (1) the validate gate carried eight .expect(…) panic call sites the predicate contract already forbids on every well-typed input but the type system does not enforce; (2) the “which-cross-axis-fires-first-when-two-apply” contract lived twice — once in each predicate’s own doc comments and once at the validate call site’s four-arm cascade. Lifting the four-arm cascade onto this substrate primitive collapses both duplications: the predicate contract and the axis-fetch step live in the same body (no .expect(…) — the pattern match at each arm rebinds the paired axes so their Some presence is a compile-time property of the local scope), and the ordering discipline lives once at the top of the primitive rather than scattered across four sibling doc-comment blocks that must stay in lockstep.

Every downstream cross-axis consumer (the [AplicacaoSpec:: validate_politicas] gate below, the future M4 mesh.pleme.io/ v1alpha1/Aplicacao CR materializer’s admission webhook, the per-:contratos-edge :politicas override MESH-COMPOSITION §III.2 #3 acknowledges — the last of which resolves an effective per-edge pair and must emit the same diagnostic on the same paired-axis input as feira build) reaches through one call rather than re-inlining the four pattern-matches + accessor-fetches + variant-constructions + ordering-cascade.

Returns owned copies of every axis carried into the diagnostic: Duration and u32 are Copy, so no String allocation occurs on the happy path when no violation fires.

Source

pub fn validate(&self) -> Result<(), AplicacaoError>

Substrate-canonical compound entry gate over the whole :politicas typed slot — folds every per-axis bracket (:timeout / :retries / :circuit-breaker :max-failures / :circuit-breaker :window / :rate-limit rate / :rate-limit window-canonical-form) and the compound cross-axis fold MeshPolicy::first_cross_axis_violation into one call every consumer of a validated MeshPolicy reaches through.

Returns the first violation as its AplicacaoError variant, or Ok(()) when every per-axis value lies in its accept-set and every cross-axis relation holds. Per-axis brackets run strictly before the cross-axis fold — the sibling AplicacaoSpec::validate_politicas gate carried the same ordering discipline for the same reason: a per-axis structurally-invalid value (a Duration::ZERO :window, an above-cap :rate-limit rate) surfaces its own self-locating diagnostic first, ahead of any cross-axis arm that would send the author to reconcile two values one of which is not a meaningful window at all. Within the per-axis phase, arms fire in the same slot-order the peer per-axis brackets carry (:timeout → :retries → :circuit-breaker → :rate-limit, each internally ordered zero-floor before canonical-form before cap by crate::render::require_positive_bounded_u32 / crate::render::require_positive_canonical_bounded_duration); within the cross-axis phase, arms fire in the canonical more-foundational-cross-axis-first ordering MeshPolicy::first_cross_axis_violation encodes.

Lifted as a typed method on the substrate primitive so every downstream consumer of a validated MeshPolicy reaches the invariant through one dispatch: the AplicacaoSpec::validate_politicas gate below (whose whole body collapses to self.politicas().validate()), the future M4 mesh.pleme.io/v1alpha1/Aplicacao CR materializer’s admission webhook, the future per-:contratos-edge :politicas override MESH-COMPOSITION §III.2 #3 acknowledges — the last of which resolves an effective per-edge MeshPolicy and must emit the same diagnostic on the same input as feira build. Naming the compound gate once on the substrate primitive means every downstream consumer inherits both the per-axis brackets and the cross-axis fold through one call, rather than re-inlining the four-per-axis + one-cross-axis cascade in lockstep with validate_politicas.

Peer of the per-kind compound entry gates lifted at crate::render::require_aplicacao_view (7242d45 / 3aefefb), crate::render::require_supervisor_view (8d8a5c3), and crate::render::require_v0_servico_shape on the per-Caixa layout axis, and the sibling compound cross-axis fold MeshPolicy::first_cross_axis_violation on the same :politicas axis — extended here onto the per-slot per-axis + cross-axis compound entry gate that folds both surfaces.

Source

pub const fn timeout(&self) -> Option<Duration>

Substrate-canonical per-:politicas :timeout Gateway-API-mesh per-call-deadline scalar accessor every consumer of the Aplicacao’s Gateway API v1.x per-rule request-timeout keys off — returns the author-declared :politicas :timeout typed Duration verbatim as an Option<Duration>, copied out of the typed slot’s own Option<Duration> storage (Option<Duration> is Copy, so the accessor returns by value; no borrow of &self past the call). None when the slot is absent (the “cluster default applies — typically the gateway class’s implementation-side per-request wall-clock cap” arm caixa-mesh’s timeout_overlay builder documents at caixa-mesh/src/lib.rs:2911 — MeshPolicy::is_empty’s timeout.is_none() arm reads this predicate too, so an authored-but-unset :politicas (:timeout ()) round-trips to a rendered HTTPRoute structurally identical to one that omits the slot).

The :politicas :timeout slot carries the “no infinite blocking” per-call deadline contract (MESH-COMPOSITION §V CSE invariant) — the typed slot’s Option<Duration> accept-set (zero-floor rejected through AplicacaoError::PolicyTimeoutZero, canonical- form rejected through AplicacaoError::PolicyTimeoutNotCanonical, upper-bounded by POLICY_TIMEOUT_MAX) maps onto the Gateway API v1.x HTTPRoute.spec.rules[].timeouts.request per-rule request- deadline scalar the caixa-mesh timeout_overlay builder writes. Every downstream consumer that reads the per-call cap keys off this scalar (the MeshPolicy::is_empty emptiness predicate the renderers key off to decide “emit :politicas overlay” vs “skip entirely”, the caixa-mesh per-:entrada HTTPRoute timeouts.request builder at caixa-mesh/src/lib.rs:2979 that fans the deadline into every rule via crate::render::single_field_overlay, the future M4 per- Aplicacao Gateway API reconciler materialization pass, the future per-:contratos-edge timeout-override overlay the MESH-COMPOSITION §III.2 roadmap acknowledges).

Prior to this lift the .timeout field was accessed inline at two sites — MeshPolicy::is_empty’s self.timeout.is_none() arm and caixa-mesh’s single_field_overlay(spec.politicas.timeout, …) call — two open-coded field-accesses that expressed no compile-time link back to the typed slot. A future extension of the :politicas :timeout axis to a richer author surface — a per-:contratos-edge timeout override the operator pins through a future :contratos :timeout slot the MESH-COMPOSITION §III.2 roadmap acknowledges, a per-cluster timeout-default overlay the M4 CR materializer resolves per-CR, a split of the single per-call Duration into a richer {request, backendRequest} pair once the Gateway API’s per-rule timeouts block grows the upstream-facing backendRequest arm alongside the client-facing request arm — would have had to be threaded through both open- coded copies in lockstep or the emptiness predicate and the caixa-mesh emit path would silently disagree on which per-call deadline a given MeshPolicy resolves to (a :politicas block whose only axis is a Some :timeout would satisfy is_empty() == false while the renderer’s overlay-emit path silently read a drifted other value, or vice versa: an author’s :timeout "30s" would omit the HTTPRoute timeouts.request block while the emptiness predicate still classified the policy as non- empty, and every kubectl -n tatara-system get httproute -o yaml | grep -A2 timeouts audit would land on a route whose author’s typed slot value silently vanished at the renderer layer). Lifting the resolution to a typed method on the substrate primitive means every downstream consumer of the Aplicacao’s per-:politicas deadline surface reaches for exactly one typed dispatch — the resolver’s accept-set migrates as a unit on any future axis addition.

Third Option<Copy-T>-return accessor on the M3 mesh-slot family (sibling of the peer per-:politicas MeshPolicy::retries bdfb399 Option<u32> accessor and the per-:politicas MeshPolicy::mtls_required c0110f1 Option<bool> accessor — same “one typed dispatch on the substrate primitive, thin projections at each consumer” discipline extended onto the peer per-:politicas typed- Duration optional-scalar axis; closes the “optional per-slot numeric-Copy-T scalar” projection pattern the sibling Option<u32> / Option<bool> lifts opened, since every remaining MeshPolicy axis (circuit_breaker: Option<CircuitBreaker>, rate_limit: Option<RateLimit>) carries a struct payload rather than a scalar). Named timeout() to match the storage field’s name; the accessor’s identity maps onto the canonical MESH- COMPOSITION §III.2 vocabulary the slot’s docstring already carries.

Source

pub const fn retries(&self) -> Option<u32>

Substrate-canonical per-:politicas :retries transient-failure- retry-budget scalar accessor every consumer of the Aplicacao’s Gateway API v1.x per-rule retry-cap keys off — returns the author-declared :politicas :retries typed u32 verbatim as an Option<u32>, copied out of the typed slot’s own Option<u32> storage (Option<u32> is Copy, so the accessor returns by value; no borrow of &self past the call). None when the slot is absent (the “cluster default applies — typically ‘no retries beyond a single dispatch attempt’” arm the caixa-mesh retry_overlay builder documents at caixa-mesh/src/lib.rs:2985 — MeshPolicy::is_empty’s retries.is_none() arm reads this predicate too, so an authored-but-unset :politicas (:retries ()) round-trips to a rendered HTTPRoute structurally identical to one that omits the slot).

The :politicas :retries slot carries the “transient failure retry cap” contract (MESH-COMPOSITION §III.2 #2) — the typed slot’s Option<u32> accept-set (lower-bounded by 1 through AplicacaoSpec::validate_politicas, upper-bounded by POLICY_RETRIES_MAX) maps onto the Gateway API v1.x HTTPRoute.spec.rules[].retry.attempts per-rule retry-attempt- count scalar the caixa-mesh retry_overlay builder writes. Every downstream consumer that reads the retry cap keys off this scalar (the MeshPolicy::is_empty emptiness predicate the renderers key off to decide “emit :politicas overlay” vs “skip entirely”, the caixa-mesh per-:entrada HTTPRoute retry.attempts builder at caixa-mesh/src/lib.rs:3007 that fans the value into every rule via crate::render::single_field_overlay, the future M4 per-Aplicacao Gateway API reconciler materialization pass, the future per-:contratos-edge retry- override overlay the MESH-COMPOSITION §III.2 #2 roadmap acknowledges).

Prior to this lift the .retries field was accessed inline at two sites — MeshPolicy::is_empty’s self.retries.is_none() arm and caixa-mesh’s single_field_overlay(spec.politicas.retries, …) call — two open-coded field-accesses that expressed no compile-time link back to the typed slot. A future extension of the :politicas :retries axis to a richer author surface — a per-:contratos-edge retry override the operator pins through a future :contratos :retries slot, a per-cluster retry-default overlay the M4 CR materializer resolves per-CR, a promotion of the plain u32 attempt-count to a richer {attempts, codes, backoff} sub-block once the Gateway API grows the peer retry.codes / retry.backoff axes — would have had to be threaded through both open-coded copies in lockstep or the emptiness predicate and the caixa-mesh emit path would silently disagree on which retry budget a given MeshPolicy resolves to (a :politicas block whose only axis is a Some :retries would satisfy is_empty() == false while the renderer’s overlay-emit path silently read a drifted other value, or vice versa: an author’s :retries 3 would omit the HTTPRoute retry.attempts block while the emptiness predicate still classified the policy as non-empty). Lifting the resolution to a typed method on the substrate primitive means every downstream consumer of the Aplicacao’s per-:politicas retry surface reaches for exactly one typed dispatch — the resolver’s accept-set migrates as a unit on any future axis addition.

Second Option<Copy-T>-return accessor on the M3 mesh-slot family (sibling of the peer per-:politicas MeshPolicy::mtls_required c0110f1 Option<bool> accessor — same “one typed dispatch on the substrate primitive, thin projections at each consumer” discipline extended onto the peer per-:politicas typed-u32 optional-scalar axis; opens the “optional per-slot numeric-Copy-T scalar” projection pattern the sibling per-:politicas :timeout (Option) / per-CircuitBreaker :max-failures / :window future lifts fold on). Named retries() to match the storage field’s name; the accessor’s identity maps onto the canonical MESH-COMPOSITION §III.2 vocabulary the slot’s docstring already carries.

Source

pub const fn mtls_required(&self) -> Option<bool>

Substrate-canonical per-:politicas :mtls-required mTLS- enforcement-toggle scalar accessor every consumer of the Aplicacao’s Cilium-mesh L4 mutual-authentication policy keys off — returns the author-declared :politicas :mtls-required typed bool verbatim as an Option<bool>, copied out of the typed slot’s own Option<bool> storage (Option<bool> is Copy, so the accessor returns by value; no borrow of &self past the call). None when the slot is absent (the “cluster default applies — typically ‘disabled’ cluster-wide” arm the caixa-mesh mtls_overlay builder documents at caixa-mesh/src/lib.rs:2540 — MeshPolicy::is_empty’s mtls_required.is_none() arm reads this predicate too, so an authored-but-unset :politicas (:mtls-required ()) round-trips to a rendered CiliumNetworkPolicy structurally identical to one that omits the slot).

The :politicas :mtls-required slot carries the “explicit opt- out only, sandboxing-by-default” mTLS-enforcement toggle (MESH-COMPOSITION §III.2 #3) — the typed slot’s three-way {None, Some(true), Some(false)} accept-set maps onto the Cilium authentication.mode bijection through crate::cilium_auth_mode: Some(true) → "required" (mTLS handshake enforced), Some(false) → "disabled" (handshake skipped — the debug-edge opt-out), None → omit the block (cluster default applies). Every downstream consumer that reads the toggle keys off this scalar (the MeshPolicy::is_empty emptiness predicate the renderers key off to decide “emit :politicas overlay” vs “skip entirely”, the caixa-mesh per-(:de, :para) CNP mtls_overlay builder at caixa-mesh/src/lib.rs:2549 that fans the toggle into every ingress rule via crate::render::single_field_overlay, the future M4 per-Aplicacao Cilium authentication.mode reconciler materialization pass, the future per-:contratos-edge mTLS override MESH-COMPOSITION §III.2 #3 roadmap acknowledges).

Prior to this lift the .mtls_required field was accessed inline at two sites — MeshPolicy::is_empty’s self.mtls_required.is_none() arm and caixa-mesh’s single_field_overlay(spec.politicas.mtls_required, …) call — two open-coded field-accesses that expressed no compile-time link back to the typed slot. A future extension of the :politicas :mtls-required axis to a richer author surface — a per-:contratos-edge mTLS override the operator pins through a future :contratos :mtls slot the MESH-COMPOSITION §III.2 #3 roadmap acknowledges, a per-cluster mTLS-default overlay the M4 CR materializer resolves per-CR, a three-valued {None, Some(true), Some(false), Some(Optional)} promotion once Cilium’s authentication.mode grows an "optional" arm — would have had to be threaded through both open-coded copies in lockstep or the emptiness predicate and the caixa-mesh emit path would silently disagree on which toggle a given MeshPolicy resolves to (a :politicas block whose only axis is a Some :mtls-required would satisfy is_empty() == false while the renderer’s overlay-emit path silently read a drifted other value, or vice versa). Lifting the resolution to a typed method on the substrate primitive means every downstream consumer of the Aplicacao’s per-:politicas mTLS-toggle surface reaches for exactly one typed dispatch — the resolver’s accept-set migrates as a unit on any future axis addition.

First Option<Copy-T>-return accessor on the M3 mesh-slot family (peer of the sibling per-:placement Placement::shard_key 7cd2a28 Option<&str> accessor — same “one typed dispatch on the substrate primitive, thin projections at each consumer” discipline extended onto the peer per-:politicas typed-bool optional-scalar axis; opens the “optional per-slot Copy-T scalar” projection pattern the sibling per-:politicas :retries (Option) / :timeout (Option) future lifts fold on). Named mtls_required() to match the storage field’s name; the accessor’s identity maps onto the canonical MESH-COMPOSITION §III.2 vocabulary the slot’s docstring already carries.

Source

pub const fn rate_limit(&self) -> Option<RateLimit>

Substrate-canonical per-:politicas :rate-limit Envoy- local_rate_limit-mesh token-bucket-declaration scalar accessor every consumer of the Aplicacao’s per-:politicas per-(rate, window) rate-limit surface keys off — returns the author-declared :politicas :rate-limit typed RateLimit verbatim as an Option<RateLimit>, copied out of the typed slot’s own Option<RateLimit> storage (RateLimit is Copy, so the accessor returns by value; no borrow of &self past the call). None when the slot is absent (the “cluster default applies — typically ‘no per-Aplicacao rate declaration, gateway-class per-listener default applies’” arm the future caixa-mesh local_rate_limit_overlay emitter MESH-COMPOSITION §III.2 #3 names — MeshPolicy::is_empty’s rate_limit().is_none() arm reads this predicate too, so an authored-but-unset :politicas (:rate-limit ()) round-trips to a rendered CiliumClusterwideEnvoyConfig structurally identical to one that omits the slot).

The :politicas :rate-limit slot carries the “per-Aplicacao token-bucket rate declaration” contract (MESH-COMPOSITION §III.2 #3) — the typed slot’s Option<RateLimit> accept-set (rate lower-bounded by 1 through AplicacaoSpec::validate_politicas, upper-bounded by POLICY_RATE_LIMIT_MAX, window canonically bijected to the three-unit {"s", "m", "h"} [rate_limit_codec] table through [is_canonical_rate_limit_window]) maps onto the Envoy local_rate_limit.token_bucket.{max_tokens, fill_interval} bijection the future CiliumClusterwideEnvoyConfig per- :politicas overlay emits. Every downstream consumer that reads the rate declaration keys off this scalar (the MeshPolicy::is_empty emptiness predicate the renderers key off to decide “emit :politicas overlay” vs “skip entirely”, the AplicacaoSpec::validate_politicas per-value-shape gate that brackets rl.rate against POLICY_RATE_LIMIT_MAX and pins rl.window against [is_canonical_rate_limit_window], the future M4 per-Aplicacao Envoy reconciler materialization pass, the future per-:contratos-edge rate-limit override the MESH-COMPOSITION §III.2 #3 roadmap acknowledges).

Prior to this lift the .rate_limit field was accessed inline at two sites — MeshPolicy::is_empty’s self.rate_limit.is_none() arm and the validate_politicas gate’s if let Some(rl) = &p.rate_limit bind — two open-coded field-accesses that expressed no compile-time link back to the typed slot. A future extension of the :politicas :rate-limit axis to a richer author surface — a per-:contratos-edge rate-limit override the operator pins through a future :contratos :rate-limit slot the MESH-COMPOSITION §III.2 #3 roadmap acknowledges, a per-cluster rate-limit-default overlay the M4 CR materializer resolves per-CR, a promotion of the plain (rate, window) scalar pair to a richer {rate, window, burst, key} sub-block once Envoy’s local_rate_limit grows the peer burst_size / descriptor_key axes — would have had to be threaded through both open-coded copies in lockstep or the emptiness predicate and the validate gate would silently disagree on which rate declaration a given MeshPolicy resolves to (a :politicas block whose only axis is a Some :rate-limit would satisfy is_empty() == false while the validate path silently read a drifted other value, or vice versa: an author’s :rate-limit "100/s" would omit the value-shape gate while the emptiness predicate still classified the policy as non-empty). Lifting the resolution to a typed method on the substrate primitive means every downstream consumer of the Aplicacao’s per-:politicas rate-limit surface reaches for exactly one typed dispatch — the resolver’s accept-set migrates as a unit on any future axis addition.

First Option<Copy-composite-T>-return accessor on the M3 mesh-slot family — closes the last un-lifted per-:politicas scalar-value axis. Peer of the sibling per-:politicas MeshPolicy::timeout (7073d0f) / MeshPolicy::retries (bdfb399) / MeshPolicy::mtls_required (c0110f1) Option<Copy-T> accessors on the primitive-Copy axes — same “one typed dispatch on the substrate primitive, thin projections at each consumer” discipline extended onto the peer per-:politicas composite-Copy shape (RateLimit is #[derive(Copy)]; peer of CircuitBreaker which lives behind CircuitBreaker::max_failures / CircuitBreaker::window sub-accessors rather than a top-level accessor because consumers reach for the axes not the aggregate). Named rate_limit() to match the storage field’s name; the accessor’s identity maps onto the canonical MESH-COMPOSITION §III.2 vocabulary the slot’s docstring already carries.

Source

pub const fn circuit_breaker(&self) -> Option<CircuitBreaker>

Substrate-canonical per-:politicas :circuit-breaker Envoy-outlier_detection-mesh consecutive-failure-ejection- declaration scalar accessor every consumer of the Aplicacao’s per-:politicas breaker declaration keys off — returns the author-declared :politicas :circuit-breaker typed CircuitBreaker verbatim as an Option<CircuitBreaker>, copied out of the typed slot’s own Option<CircuitBreaker> storage (CircuitBreaker is Copy, so the accessor returns by value; no borrow of &self past the call). None when the slot is absent (the “cluster default applies — typically ‘no per-Aplicacao breaker declaration, gateway-class per-listener default applies’” arm the future caixa-mesh outlier_detection_overlay emitter MESH-COMPOSITION §III.2 #3 names — MeshPolicy::is_empty’s circuit_breaker().is_none() arm reads this predicate too, so an authored-but-unset :politicas (:circuit-breaker ()) round-trips to a rendered CiliumClusterwideEnvoyConfig structurally identical to one that omits the slot).

The :politicas :circuit-breaker slot carries the “per-Aplicacao consecutive-transient-failure trip declaration” contract (MESH-COMPOSITION §III.2 #3) — the typed slot’s Option<CircuitBreaker> accept-set (per-:max-failures zero-floor rejected through AplicacaoError::PolicyBreakerZeroFailures, upper-bounded by POLICY_BREAKER_MAX_FAILURES_MAX; per-:window zero-floor rejected through AplicacaoError::PolicyBreakerZeroWindow, upper-bounded by POLICY_BREAKER_WINDOW_MAX, canonical-form pinned through AplicacaoError::PolicyBreakerWindowNotCanonical) maps onto the Envoy outlier_detection.{consecutive_5xx, interval} bijection the future CiliumClusterwideEnvoyConfig per-:politicas overlay emits. Every downstream consumer that reads the breaker declaration keys off this scalar (the MeshPolicy::is_empty emptiness predicate the renderers key off to decide “emit :politicas overlay” vs “skip entirely”, the AplicacaoSpec::validate_politicas per-sub-struct-axis gate that brackets cb.max_failures() against POLICY_BREAKER_MAX_FAILURES_MAX and cb.window() against POLICY_BREAKER_WINDOW_MAX via crate::render::require_positive_canonical_bounded_duration, the future M4 per-Aplicacao Envoy reconciler materialization pass, the future per-:contratos-edge breaker override the MESH-COMPOSITION §III.2 #3 roadmap acknowledges).

Prior to this lift the .circuit_breaker field was accessed inline at two sites — MeshPolicy::is_empty’s self.circuit_breaker.is_none() arm and the validate_politicas gate’s if let Some(cb) = &p.circuit_breaker bind — two open-coded field-accesses that expressed no compile-time link back to the typed slot. A future extension of the :politicas :circuit-breaker axis to a richer author surface — a per-:contratos-edge breaker override the operator pins through a future :contratos :circuit-breaker slot the MESH-COMPOSITION §III.2 #3 roadmap acknowledges, a per-cluster breaker-default overlay the M4 CR materializer resolves per-CR, a promotion of the plain (max_failures, window) scalar pair to a richer {max_failures, window, base_ejection_time, max_ejection_percent} sub-block once Envoy’s outlier_detection grows the peer ejection-percentage / ejection-time axes — would have had to be threaded through both open-coded copies in lockstep or the emptiness predicate and the validate gate would silently disagree on which breaker declaration a given MeshPolicy resolves to (a :politicas block whose only axis is a Some :circuit-breaker would satisfy is_empty() == false while the validate path silently read a drifted other value, or vice versa: an author’s (:circuit-breaker (:max-failures 5 :window "60s")) would omit the value-shape gate while the emptiness predicate still classified the policy as non-empty). Lifting the resolution to a typed method on the substrate primitive means every downstream consumer of the Aplicacao’s per-:politicas breaker surface reaches for exactly one typed dispatch — the resolver’s accept-set migrates as a unit on any future axis addition.

Second Option<Copy-composite-T>-return accessor on the M3 mesh-slot family (sibling of the peer per-:politicas MeshPolicy::rate_limit 21a6c3b Option<RateLimit> accessor on the same composite-Copy shape, and of the sibling per- :politicas MeshPolicy::timeout 7073d0f Option<Duration> / MeshPolicy::retries bdfb399 Option<u32> / MeshPolicy::mtls_required c0110f1 Option<bool> accessors on the sibling primitive-Copy axes — same “one typed dispatch on the substrate primitive, thin projections at each consumer” discipline extended onto the last unlifted per-:politicas scalar-value axis (the composite-Copy Option<CircuitBreaker> arm). Named circuit_breaker() to match the storage field’s name; the accessor’s identity maps onto the canonical MESH-COMPOSITION §III.2 vocabulary the slot’s docstring already carries. Closes the last unlifted MeshPolicy accessor axis so every downstream per-:politicas reader now routes through a typed dispatch on the substrate primitive.