Struct MeshPolicy 

pub struct MeshPolicy {
    pub timeout: Option<Duration>,
    pub retries: Option<u32>,
    pub circuit_breaker: Option<CircuitBreaker>,
    pub mtls_required: Option<bool>,
    pub rate_limit: Option<RateLimit>,
}

Mesh policies that apply to every :contratos edge unless overridden per-edge in M4. V0 is a single global policy block.

Fields

timeout: Option<Duration>

Per-call timeout. Authored as a duration string ("30s").

retries: Option<u32>

Number of retries on transient failure. None = no retries.

circuit_breaker: Option<CircuitBreaker>

Circuit breaker config. Trips after N failures within W duration; closes after a cooldown.

mtls_required: Option<bool>

Whether mTLS is required for every contrato. Default: true (sandboxing-by-default; explicit opt-out only).

rate_limit: Option<RateLimit>

Token-bucket rate limit. Authored as "100/s" or "5000/m"; stored as (rate, window).

Implementations

impl MeshPolicy

pub const fn is_empty(&self) -> bool

True when no :politicas axis carries a value — every field is None. The same emptiness contract every other M2/M3 typed surface carries (crate::LimitsSpec::is_empty, crate::BehaviorSpec::is_empty): renderers that overlay the typed slot onto a cluster artifact key off this predicate to decide “emit the slot” vs “skip the slot entirely”, so an authored-but-unset :politicas (()) round-trips to a rendered artifact that’s structurally identical to one that omits the slot. Lifted as a typed predicate (rather than per-renderer inline politicas.timeout.is_none() && politicas.retries.is_none() && … chains) so a future axis added to MeshPolicy (per-edge :politicas overlay in M4, per-Aplicacao traffic-shaping in M5) is one struct-field edit + one && self.<axis>.is_none() here, not a coordinated rewrite of every consumer that’s reaching for the emptiness semantic.

pub const fn timeout(&self) -> Option<Duration>

Substrate-canonical per-:politicas :timeout Gateway-API-mesh per-call-deadline scalar accessor every consumer of the Aplicacao’s Gateway API v1.x per-rule request-timeout keys off — returns the author-declared :politicas :timeout typed Duration verbatim as an Option<Duration>, copied out of the typed slot’s own Option<Duration> storage (Option<Duration> is Copy, so the accessor returns by value; no borrow of &self past the call). None when the slot is absent (the “cluster default applies — typically the gateway class’s implementation-side per-request wall-clock cap” arm caixa-mesh’s timeout_overlay builder documents at caixa-mesh/src/lib.rs:2911 — MeshPolicy::is_empty’s timeout.is_none() arm reads this predicate too, so an authored-but-unset :politicas (:timeout ()) round-trips to a rendered HTTPRoute structurally identical to one that omits the slot).

The :politicas :timeout slot carries the “no infinite blocking” per-call deadline contract (MESH-COMPOSITION §V CSE invariant) — the typed slot’s Option<Duration> accept-set (zero-floor rejected through AplicacaoError::PolicyTimeoutZero, canonical- form rejected through AplicacaoError::PolicyTimeoutNotCanonical, upper-bounded by POLICY_TIMEOUT_MAX) maps onto the Gateway API v1.x HTTPRoute.spec.rules[].timeouts.request per-rule request- deadline scalar the caixa-mesh timeout_overlay builder writes. Every downstream consumer that reads the per-call cap keys off this scalar (the MeshPolicy::is_empty emptiness predicate the renderers key off to decide “emit :politicas overlay” vs “skip entirely”, the caixa-mesh per-:entrada HTTPRoute timeouts.request builder at caixa-mesh/src/lib.rs:2979 that fans the deadline into every rule via crate::render::single_field_overlay, the future M4 per- Aplicacao Gateway API reconciler materialization pass, the future per-:contratos-edge timeout-override overlay the MESH-COMPOSITION §III.2 roadmap acknowledges).

Prior to this lift the .timeout field was accessed inline at two sites — MeshPolicy::is_empty’s self.timeout.is_none() arm and caixa-mesh’s single_field_overlay(spec.politicas.timeout, …) call — two open-coded field-accesses that expressed no compile-time link back to the typed slot. A future extension of the :politicas :timeout axis to a richer author surface — a per-:contratos-edge timeout override the operator pins through a future :contratos :timeout slot the MESH-COMPOSITION §III.2 roadmap acknowledges, a per-cluster timeout-default overlay the M4 CR materializer resolves per-CR, a split of the single per-call Duration into a richer {request, backendRequest} pair once the Gateway API’s per-rule timeouts block grows the upstream-facing backendRequest arm alongside the client-facing request arm — would have had to be threaded through both open- coded copies in lockstep or the emptiness predicate and the caixa-mesh emit path would silently disagree on which per-call deadline a given MeshPolicy resolves to (a :politicas block whose only axis is a Some :timeout would satisfy is_empty() == false while the renderer’s overlay-emit path silently read a drifted other value, or vice versa: an author’s :timeout "30s" would omit the HTTPRoute timeouts.request block while the emptiness predicate still classified the policy as non- empty, and every kubectl -n tatara-system get httproute -o yaml | grep -A2 timeouts audit would land on a route whose author’s typed slot value silently vanished at the renderer layer). Lifting the resolution to a typed method on the substrate primitive means every downstream consumer of the Aplicacao’s per-:politicas deadline surface reaches for exactly one typed dispatch — the resolver’s accept-set migrates as a unit on any future axis addition.

Third Option<Copy-T>-return accessor on the M3 mesh-slot family (sibling of the peer per-:politicas MeshPolicy::retries bdfb399 Option<u32> accessor and the per-:politicas MeshPolicy::mtls_required c0110f1 Option<bool> accessor — same “one typed dispatch on the substrate primitive, thin projections at each consumer” discipline extended onto the peer per-:politicas typed- Duration optional-scalar axis; closes the “optional per-slot numeric-Copy-T scalar” projection pattern the sibling Option<u32> / Option<bool> lifts opened, since every remaining MeshPolicy axis (circuit_breaker: Option<CircuitBreaker>, rate_limit: Option<RateLimit>) carries a struct payload rather than a scalar). Named timeout() to match the storage field’s name; the accessor’s identity maps onto the canonical MESH- COMPOSITION §III.2 vocabulary the slot’s docstring already carries.

pub const fn retries(&self) -> Option<u32>

Substrate-canonical per-:politicas :retries transient-failure- retry-budget scalar accessor every consumer of the Aplicacao’s Gateway API v1.x per-rule retry-cap keys off — returns the author-declared :politicas :retries typed u32 verbatim as an Option<u32>, copied out of the typed slot’s own Option<u32> storage (Option<u32> is Copy, so the accessor returns by value; no borrow of &self past the call). None when the slot is absent (the “cluster default applies — typically ‘no retries beyond a single dispatch attempt’” arm the caixa-mesh retry_overlay builder documents at caixa-mesh/src/lib.rs:2985 — MeshPolicy::is_empty’s retries.is_none() arm reads this predicate too, so an authored-but-unset :politicas (:retries ()) round-trips to a rendered HTTPRoute structurally identical to one that omits the slot).

The :politicas :retries slot carries the “transient failure retry cap” contract (MESH-COMPOSITION §III.2 #2) — the typed slot’s Option<u32> accept-set (lower-bounded by 1 through AplicacaoSpec::validate_politicas, upper-bounded by POLICY_RETRIES_MAX) maps onto the Gateway API v1.x HTTPRoute.spec.rules[].retry.attempts per-rule retry-attempt- count scalar the caixa-mesh retry_overlay builder writes. Every downstream consumer that reads the retry cap keys off this scalar (the MeshPolicy::is_empty emptiness predicate the renderers key off to decide “emit :politicas overlay” vs “skip entirely”, the caixa-mesh per-:entrada HTTPRoute retry.attempts builder at caixa-mesh/src/lib.rs:3007 that fans the value into every rule via crate::render::single_field_overlay, the future M4 per-Aplicacao Gateway API reconciler materialization pass, the future per-:contratos-edge retry- override overlay the MESH-COMPOSITION §III.2 #2 roadmap acknowledges).

Prior to this lift the .retries field was accessed inline at two sites — MeshPolicy::is_empty’s self.retries.is_none() arm and caixa-mesh’s single_field_overlay(spec.politicas.retries, …) call — two open-coded field-accesses that expressed no compile-time link back to the typed slot. A future extension of the :politicas :retries axis to a richer author surface — a per-:contratos-edge retry override the operator pins through a future :contratos :retries slot, a per-cluster retry-default overlay the M4 CR materializer resolves per-CR, a promotion of the plain u32 attempt-count to a richer {attempts, codes, backoff} sub-block once the Gateway API grows the peer retry.codes / retry.backoff axes — would have had to be threaded through both open-coded copies in lockstep or the emptiness predicate and the caixa-mesh emit path would silently disagree on which retry budget a given MeshPolicy resolves to (a :politicas block whose only axis is a Some :retries would satisfy is_empty() == false while the renderer’s overlay-emit path silently read a drifted other value, or vice versa: an author’s :retries 3 would omit the HTTPRoute retry.attempts block while the emptiness predicate still classified the policy as non-empty). Lifting the resolution to a typed method on the substrate primitive means every downstream consumer of the Aplicacao’s per-:politicas retry surface reaches for exactly one typed dispatch — the resolver’s accept-set migrates as a unit on any future axis addition.

Second Option<Copy-T>-return accessor on the M3 mesh-slot family (sibling of the peer per-:politicas MeshPolicy::mtls_required c0110f1 Option<bool> accessor — same “one typed dispatch on the substrate primitive, thin projections at each consumer” discipline extended onto the peer per-:politicas typed-u32 optional-scalar axis; opens the “optional per-slot numeric-Copy-T scalar” projection pattern the sibling per-:politicas :timeout (Option) / per-CircuitBreaker :max-failures / :window future lifts fold on). Named retries() to match the storage field’s name; the accessor’s identity maps onto the canonical MESH-COMPOSITION §III.2 vocabulary the slot’s docstring already carries.

pub const fn mtls_required(&self) -> Option<bool>

Substrate-canonical per-:politicas :mtls-required mTLS- enforcement-toggle scalar accessor every consumer of the Aplicacao’s Cilium-mesh L4 mutual-authentication policy keys off — returns the author-declared :politicas :mtls-required typed bool verbatim as an Option<bool>, copied out of the typed slot’s own Option<bool> storage (Option<bool> is Copy, so the accessor returns by value; no borrow of &self past the call). None when the slot is absent (the “cluster default applies — typically ‘disabled’ cluster-wide” arm the caixa-mesh mtls_overlay builder documents at caixa-mesh/src/lib.rs:2540 — MeshPolicy::is_empty’s mtls_required.is_none() arm reads this predicate too, so an authored-but-unset :politicas (:mtls-required ()) round-trips to a rendered CiliumNetworkPolicy structurally identical to one that omits the slot).

The :politicas :mtls-required slot carries the “explicit opt- out only, sandboxing-by-default” mTLS-enforcement toggle (MESH-COMPOSITION §III.2 #3) — the typed slot’s three-way {None, Some(true), Some(false)} accept-set maps onto the Cilium authentication.mode bijection through crate::cilium_auth_mode: Some(true) → "required" (mTLS handshake enforced), Some(false) → "disabled" (handshake skipped — the debug-edge opt-out), None → omit the block (cluster default applies). Every downstream consumer that reads the toggle keys off this scalar (the MeshPolicy::is_empty emptiness predicate the renderers key off to decide “emit :politicas overlay” vs “skip entirely”, the caixa-mesh per-(:de, :para) CNP mtls_overlay builder at caixa-mesh/src/lib.rs:2549 that fans the toggle into every ingress rule via crate::render::single_field_overlay, the future M4 per-Aplicacao Cilium authentication.mode reconciler materialization pass, the future per-:contratos-edge mTLS override MESH-COMPOSITION §III.2 #3 roadmap acknowledges).

Prior to this lift the .mtls_required field was accessed inline at two sites — MeshPolicy::is_empty’s self.mtls_required.is_none() arm and caixa-mesh’s single_field_overlay(spec.politicas.mtls_required, …) call — two open-coded field-accesses that expressed no compile-time link back to the typed slot. A future extension of the :politicas :mtls-required axis to a richer author surface — a per-:contratos-edge mTLS override the operator pins through a future :contratos :mtls slot the MESH-COMPOSITION §III.2 #3 roadmap acknowledges, a per-cluster mTLS-default overlay the M4 CR materializer resolves per-CR, a three-valued {None, Some(true), Some(false), Some(Optional)} promotion once Cilium’s authentication.mode grows an "optional" arm — would have had to be threaded through both open-coded copies in lockstep or the emptiness predicate and the caixa-mesh emit path would silently disagree on which toggle a given MeshPolicy resolves to (a :politicas block whose only axis is a Some :mtls-required would satisfy is_empty() == false while the renderer’s overlay-emit path silently read a drifted other value, or vice versa). Lifting the resolution to a typed method on the substrate primitive means every downstream consumer of the Aplicacao’s per-:politicas mTLS-toggle surface reaches for exactly one typed dispatch — the resolver’s accept-set migrates as a unit on any future axis addition.

First Option<Copy-T>-return accessor on the M3 mesh-slot family (peer of the sibling per-:placement Placement::shard_key 7cd2a28 Option<&str> accessor — same “one typed dispatch on the substrate primitive, thin projections at each consumer” discipline extended onto the peer per-:politicas typed-bool optional-scalar axis; opens the “optional per-slot Copy-T scalar” projection pattern the sibling per-:politicas :retries (Option) / :timeout (Option) future lifts fold on). Named mtls_required() to match the storage field’s name; the accessor’s identity maps onto the canonical MESH-COMPOSITION §III.2 vocabulary the slot’s docstring already carries.

pub const fn rate_limit(&self) -> Option<RateLimit>

Substrate-canonical per-:politicas :rate-limit Envoy- local_rate_limit-mesh token-bucket-declaration scalar accessor every consumer of the Aplicacao’s per-:politicas per-(rate, window) rate-limit surface keys off — returns the author-declared :politicas :rate-limit typed RateLimit verbatim as an Option<RateLimit>, copied out of the typed slot’s own Option<RateLimit> storage (RateLimit is Copy, so the accessor returns by value; no borrow of &self past the call). None when the slot is absent (the “cluster default applies — typically ‘no per-Aplicacao rate declaration, gateway-class per-listener default applies’” arm the future caixa-mesh local_rate_limit_overlay emitter MESH-COMPOSITION §III.2 #3 names — MeshPolicy::is_empty’s rate_limit().is_none() arm reads this predicate too, so an authored-but-unset :politicas (:rate-limit ()) round-trips to a rendered CiliumClusterwideEnvoyConfig structurally identical to one that omits the slot).

The :politicas :rate-limit slot carries the “per-Aplicacao token-bucket rate declaration” contract (MESH-COMPOSITION §III.2 #3) — the typed slot’s Option<RateLimit> accept-set (rate lower-bounded by 1 through AplicacaoSpec::validate_politicas, upper-bounded by POLICY_RATE_LIMIT_MAX, window canonically bijected to the three-unit {"s", "m", "h"} [rate_limit_codec] table through [is_canonical_rate_limit_window]) maps onto the Envoy local_rate_limit.token_bucket.{max_tokens, fill_interval} bijection the future CiliumClusterwideEnvoyConfig per- :politicas overlay emits. Every downstream consumer that reads the rate declaration keys off this scalar (the MeshPolicy::is_empty emptiness predicate the renderers key off to decide “emit :politicas overlay” vs “skip entirely”, the AplicacaoSpec::validate_politicas per-value-shape gate that brackets rl.rate against POLICY_RATE_LIMIT_MAX and pins rl.window against [is_canonical_rate_limit_window], the future M4 per-Aplicacao Envoy reconciler materialization pass, the future per-:contratos-edge rate-limit override the MESH-COMPOSITION §III.2 #3 roadmap acknowledges).

Prior to this lift the .rate_limit field was accessed inline at two sites — MeshPolicy::is_empty’s self.rate_limit.is_none() arm and the validate_politicas gate’s if let Some(rl) = &p.rate_limit bind — two open-coded field-accesses that expressed no compile-time link back to the typed slot. A future extension of the :politicas :rate-limit axis to a richer author surface — a per-:contratos-edge rate-limit override the operator pins through a future :contratos :rate-limit slot the MESH-COMPOSITION §III.2 #3 roadmap acknowledges, a per-cluster rate-limit-default overlay the M4 CR materializer resolves per-CR, a promotion of the plain (rate, window) scalar pair to a richer {rate, window, burst, key} sub-block once Envoy’s local_rate_limit grows the peer burst_size / descriptor_key axes — would have had to be threaded through both open-coded copies in lockstep or the emptiness predicate and the validate gate would silently disagree on which rate declaration a given MeshPolicy resolves to (a :politicas block whose only axis is a Some :rate-limit would satisfy is_empty() == false while the validate path silently read a drifted other value, or vice versa: an author’s :rate-limit "100/s" would omit the value-shape gate while the emptiness predicate still classified the policy as non-empty). Lifting the resolution to a typed method on the substrate primitive means every downstream consumer of the Aplicacao’s per-:politicas rate-limit surface reaches for exactly one typed dispatch — the resolver’s accept-set migrates as a unit on any future axis addition.

First Option<Copy-composite-T>-return accessor on the M3 mesh-slot family — closes the last un-lifted per-:politicas scalar-value axis. Peer of the sibling per-:politicas MeshPolicy::timeout (7073d0f) / MeshPolicy::retries (bdfb399) / MeshPolicy::mtls_required (c0110f1) Option<Copy-T> accessors on the primitive-Copy axes — same “one typed dispatch on the substrate primitive, thin projections at each consumer” discipline extended onto the peer per-:politicas composite-Copy shape (RateLimit is #[derive(Copy)]; peer of CircuitBreaker which lives behind CircuitBreaker::max_failures / CircuitBreaker::window sub-accessors rather than a top-level accessor because consumers reach for the axes not the aggregate). Named rate_limit() to match the storage field’s name; the accessor’s identity maps onto the canonical MESH-COMPOSITION §III.2 vocabulary the slot’s docstring already carries.

pub const fn circuit_breaker(&self) -> Option<CircuitBreaker>

Substrate-canonical per-:politicas :circuit-breaker Envoy-outlier_detection-mesh consecutive-failure-ejection- declaration scalar accessor every consumer of the Aplicacao’s per-:politicas breaker declaration keys off — returns the author-declared :politicas :circuit-breaker typed CircuitBreaker verbatim as an Option<CircuitBreaker>, copied out of the typed slot’s own Option<CircuitBreaker> storage (CircuitBreaker is Copy, so the accessor returns by value; no borrow of &self past the call). None when the slot is absent (the “cluster default applies — typically ‘no per-Aplicacao breaker declaration, gateway-class per-listener default applies’” arm the future caixa-mesh outlier_detection_overlay emitter MESH-COMPOSITION §III.2 #3 names — MeshPolicy::is_empty’s circuit_breaker().is_none() arm reads this predicate too, so an authored-but-unset :politicas (:circuit-breaker ()) round-trips to a rendered CiliumClusterwideEnvoyConfig structurally identical to one that omits the slot).

The :politicas :circuit-breaker slot carries the “per-Aplicacao consecutive-transient-failure trip declaration” contract (MESH-COMPOSITION §III.2 #3) — the typed slot’s Option<CircuitBreaker> accept-set (per-:max-failures zero-floor rejected through AplicacaoError::PolicyBreakerZeroFailures, upper-bounded by POLICY_BREAKER_MAX_FAILURES_MAX; per-:window zero-floor rejected through AplicacaoError::PolicyBreakerZeroWindow, upper-bounded by POLICY_BREAKER_WINDOW_MAX, canonical-form pinned through AplicacaoError::PolicyBreakerWindowNotCanonical) maps onto the Envoy outlier_detection.{consecutive_5xx, interval} bijection the future CiliumClusterwideEnvoyConfig per-:politicas overlay emits. Every downstream consumer that reads the breaker declaration keys off this scalar (the MeshPolicy::is_empty emptiness predicate the renderers key off to decide “emit :politicas overlay” vs “skip entirely”, the AplicacaoSpec::validate_politicas per-sub-struct-axis gate that brackets cb.max_failures() against POLICY_BREAKER_MAX_FAILURES_MAX and cb.window() against POLICY_BREAKER_WINDOW_MAX via crate::render::require_positive_canonical_bounded_duration, the future M4 per-Aplicacao Envoy reconciler materialization pass, the future per-:contratos-edge breaker override the MESH-COMPOSITION §III.2 #3 roadmap acknowledges).

Prior to this lift the .circuit_breaker field was accessed inline at two sites — MeshPolicy::is_empty’s self.circuit_breaker.is_none() arm and the validate_politicas gate’s if let Some(cb) = &p.circuit_breaker bind — two open-coded field-accesses that expressed no compile-time link back to the typed slot. A future extension of the :politicas :circuit-breaker axis to a richer author surface — a per-:contratos-edge breaker override the operator pins through a future :contratos :circuit-breaker slot the MESH-COMPOSITION §III.2 #3 roadmap acknowledges, a per-cluster breaker-default overlay the M4 CR materializer resolves per-CR, a promotion of the plain (max_failures, window) scalar pair to a richer {max_failures, window, base_ejection_time, max_ejection_percent} sub-block once Envoy’s outlier_detection grows the peer ejection-percentage / ejection-time axes — would have had to be threaded through both open-coded copies in lockstep or the emptiness predicate and the validate gate would silently disagree on which breaker declaration a given MeshPolicy resolves to (a :politicas block whose only axis is a Some :circuit-breaker would satisfy is_empty() == false while the validate path silently read a drifted other value, or vice versa: an author’s (:circuit-breaker (:max-failures 5 :window "60s")) would omit the value-shape gate while the emptiness predicate still classified the policy as non-empty). Lifting the resolution to a typed method on the substrate primitive means every downstream consumer of the Aplicacao’s per-:politicas breaker surface reaches for exactly one typed dispatch — the resolver’s accept-set migrates as a unit on any future axis addition.

Second Option<Copy-composite-T>-return accessor on the M3 mesh-slot family (sibling of the peer per-:politicas MeshPolicy::rate_limit 21a6c3b Option<RateLimit> accessor on the same composite-Copy shape, and of the sibling per- :politicas MeshPolicy::timeout 7073d0f Option<Duration> / MeshPolicy::retries bdfb399 Option<u32> / MeshPolicy::mtls_required c0110f1 Option<bool> accessors on the sibling primitive-Copy axes — same “one typed dispatch on the substrate primitive, thin projections at each consumer” discipline extended onto the last unlifted per-:politicas scalar-value axis (the composite-Copy Option<CircuitBreaker> arm). Named circuit_breaker() to match the storage field’s name; the accessor’s identity maps onto the canonical MESH-COMPOSITION §III.2 vocabulary the slot’s docstring already carries. Closes the last unlifted MeshPolicy accessor axis so every downstream per-:politicas reader now routes through a typed dispatch on the substrate primitive.

Trait Implementations

impl Clone for MeshPolicy

fn clone(&self) -> MeshPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for MeshPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for MeshPolicy

fn default() -> MeshPolicy

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for MeshPolicy

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for MeshPolicy

impl PartialEq for MeshPolicy

fn eq(&self, other: &MeshPolicy) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for MeshPolicy

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for MeshPolicy