Struct Process 

pub struct Process {
    pub metadata: ObjectMeta,
    pub spec: ProcessSpec,
    pub status: Option<ProcessStatus>,
}

Auto-generated derived type for ProcessSpec via CustomResource

Fields

metadata: ObjectMeta

spec: ProcessSpec

status: Option<ProcessStatus>

Implementations

impl Process

pub fn new(name: &str, spec: ProcessSpec) -> Self

Spec based constructor for derived custom resource

impl Process

pub const DEFAULT_NAMESPACE: &'static str = "default"

The K8s canonical default namespace — the fallback every consumer of a Process whose metadata.namespace is None substitutes. Matches the string K8s itself substitutes on namespaced resource writes with no explicit namespace.

pub const UNNAMED_PLACEHOLDER: &'static str = "unnamed"

Workspace-wide fallback for a Process’s metadata.name when it is None — the sentinel every annotation writer, claim arbiter, and owner-metadata seed substitutes so downstream grepping / label-selecting sees a stable spelling rather than a per-callsite ad-hoc placeholder ("", "<unnamed>", or the empty unwrap_or_default() fallback). A Process authored through the reconciler’s fork path always has a name; this constant covers the surface where an untyped Process value (test fixture, dynamic API response, adopted resource pre- name-resolution) surfaces without one.

pub fn namespace_or_default(&self) -> &str

Namespace slice with the Self::DEFAULT_NAMESPACE fallback applied — the ONE-line collapse of the metadata.namespace .as_deref().unwrap_or("default") incantation every consumer spelled by hand pre-lift.

Peer to Self::name_or_placeholder on the (metadata slot × fallback shape) axis; both compose through Self::coordinates_or_defaults when a consumer needs the pair together (annotation writers, claim-arbiter row builders, render owner-metadata seed).

pub fn name_or_placeholder(&self) -> &str

Name slice with the Self::UNNAMED_PLACEHOLDER fallback applied — the ONE-line collapse of the metadata.name.as_deref ().unwrap_or("unnamed") incantation every consumer spelled by hand pre-lift.

Peer to Self::namespace_or_default on the (metadata slot × fallback shape) axis; both compose through Self::coordinates_or_defaults when a consumer needs the pair together.

pub fn coordinates_or_defaults(&self) -> (&str, &str)

(namespace, name) coordinates with the workspace-wide default fallbacks applied — the ONE-line collapse of the paired metadata.namespace.as_deref().unwrap_or("default") + metadata.name.as_deref().unwrap_or("unnamed") extraction every downstream composer restated by hand pre-lift.

Return-tuple order matches the axis order of the substrate’s paired-composer primitive tatara_reconciler::ssapply::qualified_process_ref(ns, name): the (namespace, name) pair this method returns feeds that primitive positionally without an axis-swap step.

pub fn owned_coordinates_or_err(&self) -> Result<(String, String)>

(namespace, name) coordinates as owned Strings, with the namespace half fallback-defaulted to Self::DEFAULT_NAMESPACE but the name half REQUIRED — an anyhow::Error is returned when metadata.name is absent, because “unnamed” is a display placeholder, not a valid K8s API path segment. Fed straight into kube-rs API calls (Api::patch, Api::delete, Api::get) that take owned String arguments; the Self::DEFAULT_NAMESPACE fallback matches what K8s itself substitutes on namespaced resource writes with no explicit namespace, so the surface is safe against a Process whose metadata.namespace slot is absent (test fixture, dynamic API response pre-defaulting) but refuses to guess a name.

Peer to Self::coordinates_or_defaults on the (return-form × name gate) axis pair:

• borrow + name-defaulted → coordinates_or_defaults (display, annotation writers, ownership-tag composers — every consumer whose downstream drops "unnamed" in place of a missing name without an operator-visible failure);
• owned + name-required → this method (kube-rs API calls — every consumer whose downstream must NOT silently substitute a placeholder for the API call target, because the caller is about to patch/delete/get at metadata.name).

The error wording is pinned by [tests::owned_coordinates_or_err_error_message_matches_pre_lift_reconciler_wording] to match the exact spelling every pre-lift tatara-reconciler helper produced ("Process has no metadata.name") so log-line / test greps that anchored on that wording keep matching post- lift, and no operator-visible message drift lands as a side effect of the substrate move.

pub fn coordinates_or_none(&self) -> Option<(&str, &str)>

(namespace, name) coordinates in the BORROW + NAME-REQUIRED corner of the primitive family — namespace half falls back to Self::DEFAULT_NAMESPACE, but the name half is REQUIRED (None on a Process whose metadata.name is absent, so the caller stops with an else { continue; } / else { return …; } guard rather than proceeding with the empty-string sentinel every pre-lift consumer had to spell inline).

Peer to Self::coordinates_or_defaults + Self::owned_coordinates_or_err on the (return-form × name-gate) axis pair — closes the corner the family previously left open:

• borrow + name-defaulted → Self::coordinates_or_defaults (annotation writers, render owner-metadata seed — consumers whose downstream tolerates the "unnamed" display placeholder without operator-visible failure);
• borrow + name-required → this method (claim-arbiter probes, child-Process delete-fan-out — consumers that need a real API-path leaf and cleanly SKIP the row when the name is absent rather than issuing a K8s call with an empty-string name argument);
• owned + name-required → Self::owned_coordinates_or_err (kube-rs API-path calls — consumers whose downstream requires owned String arguments and rejects the missing-name corner with a load-bearing error message).

The primitive family’s None-on-missing-name semantics intentionally differs from Self::owned_coordinates_or_err’s error-on-missing-name semantics: the caller sites for this form (child-Process fan-out, claim-arbiter row probes) are non-fatal SKIPS rather than reportable failures — an Option::None at the primitive lets the caller thread that “skip” through a let-else without stringifying / logging an anyhow chain per missing-name occurrence.

The namespace fallback matches Self::coordinates_or_defaults (via Self::namespace_or_default), so a consumer that switches between the two borrow-form primitives based on its name-gate need never sees a different namespace-fallback string as a side effect.

pub fn observed_flux_resources(&self) -> &[FluxResourceRef]

Borrowed slice of the FluxCD resources this Process’s status currently persists at status.flux_resources, with the missing-status corner collapsed to an empty slice — the ONE- line collapse of the paired self.status.as_ref().map(|s| s.flux_resources.clone()).unwrap_or_default() incantation every VERIFY-phase / ATTEST-heartbeat consumer restated by hand pre-lift.

Pre-lift the 5-line .status.as_ref().map(|s| s.flux_resources .clone()).unwrap_or_default() chain was hand-authored at TWO sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold in tatara-reconciler::phase_machine:

• handle_running — the VERIFY-phase per-ref readiness probe seed that walks every ref through crate::status::FluxResourceRef::fetch_coords via ssapply::fetch_flux_ref and rebuilds an updated Vec<FluxResourceRef> with ready + message + last_check observed at reconcile time.
• handle_attested — the ATTEST-heartbeat drift detector that short-circuits on the first non-Ready ref via ssapply::fetch_flux_ref + ssapply::ready_condition.

Both sites walked the SAME 5-line chain — clone the vector eagerly for the length of the reconcile pass, then iterate it by reference — even though neither site ever mutates the vector nor keeps it alive past the enclosing async fn. Post-lift both callers borrow the slice directly from self.status; the two pre-lift .clone() calls disappear because the slice lives for the borrow of &self, and both call sites’ subsequent downstream calls (ssapply::fetch_flux_ref / the patch::patch_process_status write) do not touch the borrowed p: &Process, so the borrow lifetime holds.

Return-form axis: &[FluxResourceRef] mirrors the existing borrow-first discipline every pre-lift consumer already iterated by reference (for r in &refs), and the shape of crate::status::FluxResourceRef::fetch_coords’s per-ref borrow projection extends mechanically to the slice-level projection here. The missing-status corner collapses to the empty slice &[] so .is_empty() / .len() / iteration all behave identically on a Process whose status is None and on one whose status carries an empty flux_resources slot — matching what the pre-lift .unwrap_or_default() produced (an empty Vec).

A future normalization step (a per-ref canonicalization pass that skips duplicated refs, an owner-filter that returns only refs stamped with the CURRENT metadata.generation, a staleness gate that drops refs whose last_check predates a reconcile deadline) lands at ONE substrate method here and both downstream consumers pick up the upgrade mechanically — no per-callsite hand-edit at handle_running / handle_attested.

Sibling to the Self::coordinates_or_none borrow-first primitive on the metadata axis; this method opens the analogous borrow-first primitive on the status-projection axis. Future status projections (observed_attestation on the attestation-chain axis, observed_pid on the PID axis, observed_children on the child-fan-out axis) land as peer methods on this same axis.

Theory anchor: THEORY.md §VI.1 (generation over composition — the 5-line status-projection chain recurred at two hand- authored sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication trigger, and is lifted to ONE owner here). THEORY.md §II.1 invariant 5 (composition preserves proofs — the pins bind the missing-status corner + the slice-lifetime borrow discipline

• the byte-identical parity with the pre-lift 5-line chain, so a regression that drifted any of the three surfaces at tests::observed_flux_resources_* rather than as silent operator-facing skew between the VERIFY-phase and ATTEST- heartbeat consumers).

pub fn observed_pid(&self) -> Option<&str>

The borrow-form status-projection primitive on the PID axis: returns the hierarchical PID path (e.g. "seph.1.7") the reconciler currently persists at status.pid, with BOTH the missing-status corner AND the empty-slot corner collapsed to None — the ONE-liner collapse of the paired self.status.as_ref().and_then(|s| s.pid.clone()) incantation every consumer restated by hand pre-lift.

Pre-lift the 3-line .status.as_ref().and_then(|s| s.pid .clone()) chain was hand-authored at TWO sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold in tatara-reconciler::phase_machine:

• handle_forking — the ALLOCATE-PID gate that short- circuits the PID allocator when the reconciler already assigned a PID on a prior reconcile pass (pre-lift the chain composed with .is_some() and threw the clone away without ever reading the string).
• handle_exiting — the SIGTERM cascade that enumerates child Processes and terminates them by matching each child’s spec.identity.parent against the PID this Process currently owns (pre-lift the chain bound an owned Option<String> and threaded pid.as_str() into the downstream .as_deref() == Some(...) comparator).

Both sites walked the SAME 3-line chain — clone the String eagerly, then either drop it (the handle_forking gate) or re-borrow it through .as_str() (the handle_exiting comparator) — even though neither site ever mutates the PID nor keeps it alive past the enclosing async fn. Post-lift both callers borrow the PID directly from self.status; the pre-lift .clone() at both sites disappears because the &str lives for the borrow of &self, and both call sites’ subsequent downstream calls (the K8s API list/patch, the child-Process comparator) do not touch the borrowed p: &Process, so the borrow lifetime holds.

Return-form axis: Option<&str> mirrors the existing borrow-first discipline every pre-lift consumer already re-borrowed through .as_str() before use, and the shape of Self::coordinates_or_none’s Option<(&str, &str)> projection extends mechanically to the single-slot projection here. The missing-status corner AND the populated-status-with-pid=None corner BOTH collapse to None so .is_some() / if let Some(_) / .map(...) behave identically on a Process whose status is None and on one whose status carries an unpopulated pid slot — matching what the pre-lift .and_then(...) chain produced.

A future normalization step (a per-slot canonicalization pass that rejects malformed hierarchical PIDs, a generation-filter that returns None for a PID stamped with a stale metadata.generation, a staleness gate that drops a PID whose observing phase_since predates a reconcile deadline) lands at ONE substrate method here and both downstream consumers pick up the upgrade mechanically — no per-callsite hand-edit at handle_forking / handle_exiting.

Sibling to the peer Self::observed_flux_resources borrow-first primitive on the flux-resources axis; both methods compose the same missing-status fallback + borrow-form return-shape skeleton on distinct ProcessStatus slots. Future status projections (observed_parent on the parent-pointer axis, observed_message on the human-readable-status axis, observed_attestation on the attestation-chain axis) land as peer methods on this same axis.

Theory anchor: THEORY.md §VI.1 (generation over composition — the 3-line status-projection chain recurred at two hand-authored sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication trigger, and is lifted to ONE owner here). THEORY.md §II.1 invariant 5 (composition preserves proofs — the pins bind the missing-status corner + the empty-slot corner + the borrow-form &str lifetime + the byte-identical parity with the pre-lift 3-line chain, so a regression that drifted any surface at tests::observed_pid_* rather than as silent operator- facing skew between the ALLOCATE-PID gate and the SIGTERM cascade on the SAME Process).

pub fn observed_attestation(&self) -> Option<&ProcessAttestation>

The borrow-form status-projection primitive on the attestation-chain axis: returns the last ProcessAttestation the reconciler persisted at status.attestation, with the missing-status corner AND the empty-slot corner BOTH collapsed to None — the ONE-liner collapse of the paired self.status.as_ref().and_then(|s| s.attestation.as_ref()) incantation every consumer restated by hand pre-lift.

Pre-lift the 3-line .status.as_ref().and_then(|s| s .attestation.as_ref()) chain was hand-authored at TWO sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold in tatara-reconciler:

• phase_machine::advance_to_attested — the ATTEST composer that chains prior.next(pillars) when a prior attestation is persisted and seeds with ProcessAttestation::initial otherwise.
• render::render_export_jobs — the ephemeral-export Job builder that pulls the prior composed_root off the last persisted attestation and threads it into every rendered Job’s previousRoot env var, so the export receipt chains into the Process’s BLAKE3 attestation tree at the correct generation boundary.

Both sites walked the SAME 3-line chain — the borrow-form Option<&ProcessAttestation> shape both consumers wanted already — even though neither site ever mutated the attestation nor kept it alive past the enclosing async fn. Post-lift both callers borrow the attestation directly from self.status; the pre-lift 3-line chain shrinks to a single method call at both sites, and both consumers’ subsequent downstream calls (ProcessAttestation::next for the ATTEST composer, .composed_root.clone() for the export Job builder) do not touch the borrowed p: &Process, so the borrow lifetime holds.

Return-form axis: Option<&ProcessAttestation> mirrors the existing borrow-first discipline every pre-lift consumer already re-borrowed through .as_ref(), and the shape of the peer Self::observed_pid projection extends mechanically to the whole-attestation-record projection here. The missing- status corner AND the populated-status-with-attestation =None corner BOTH collapse to None so .is_some() / if let Some(_) / .map(...) behave identically on a Process whose status is None and on one whose status carries an unpopulated attestation slot — matching what the pre-lift .and_then(...) chain produced.

A future normalization step (a per-slot canonicalization pass that rejects a persisted attestation whose composed_root fails verify, a generation-filter that returns None for an attestation stamped with a stale metadata.generation, a staleness gate that drops an attestation whose attested_at predates a reconcile deadline) lands at ONE substrate method here and both downstream consumers pick up the upgrade mechanically — no per-callsite hand-edit at advance_to_attested / render_export_jobs.

Sibling to the peer Self::observed_pid + Self::observed_flux_resources borrow-first primitives on the PID + flux-resources axes; all three methods compose the same missing-status fallback + borrow-form return-shape skeleton on distinct ProcessStatus slots. Future status projections (observed_parent on the parent-pointer axis, observed_message on the human-readable-status axis) land as peer methods on this same axis.

Theory anchor: THEORY.md §VI.1 (generation over composition — the 3-line status-projection chain recurred at two hand- authored sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication trigger, and is lifted to ONE owner here). THEORY.md §II.1 invariant 5 (composition preserves proofs — the pins bind the missing-status corner + the empty-slot corner + the borrow-form &ProcessAttestation lifetime + the byte- identical parity with the pre-lift 3-line chain, so a regression that drifted any surface at tests::observed_attestation_* rather than as silent operator-facing skew between the ATTEST composer and the ephemeral-export receipt chain on the SAME Process).

pub fn observed_phase(&self) -> Option<ProcessPhase>

The copy-form status-projection primitive on the phase axis: returns the ProcessPhase the reconciler currently persists at status.phase, wrapped in an Option so the missing- status corner collapses to None — the ONE-liner collapse of the paired self.status.as_ref().map(|s| s.phase) incantation every consumer restated by hand pre-lift.

Peer to the borrow-form projections Self::observed_pid (PID axis, Option<&str>), Self::observed_flux_resources (flux-resources axis, &[FluxResourceRef]), and Self::observed_attestation (attestation-chain axis, Option<&ProcessAttestation>); this method opens the copy-form peer for ProcessPhase — a Copy scalar with a Default impl (Pending), so the return is Option<ProcessPhase> rather than Option<&ProcessPhase> (borrow would give the caller nothing over the copy for a 1-byte enum) and neither the missing-status corner nor a “empty slot” corner is meaningful — the underlying slot is a bare ProcessPhase, not Option<ProcessPhase>, so the primitive returns None iff status: None.

Pre-lift the 3-line .status.as_ref().map(|s| s.phase) chain was hand-authored at FIVE sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold in tatara-reconciler:

• controller::reconcile — the top-level dispatcher’s current_phase seed that feeds the deletion-preempt + signal-ingestion gates + the per-phase handler dispatch. Pre-lift .unwrap_or(ProcessPhase::Pending).
• boundary::evaluate_process_phase — the boundary evaluator’s ProcessPhase condition (a peer-Process phase-reached postcondition). Pre-lift .unwrap_or(ProcessPhase::Pending).
• boundary::check_depends_on — the depends_on pre-condition audit that stashes the observed phase into the UnmetDependency::actual: Option<ProcessPhase> slot (keeps the Option form). Pre-lift the raw .map(|s| s.phase) shape.
• phase_machine::p_current_phase_str — the released-from annotation composer that emits "Attested" for every non-Failed phase (SIGSTOP/SIGCONT release gate). Pre-lift .unwrap_or(ProcessPhase::Attested) — the ONE site whose default is not Pending; the primitive returns the raw Option so the caller’s .unwrap_or default choice stays local rather than baked in.
• table_controller::stable_name_group_key — the routing- groupby seed that pairs the phase with the PID + creation timestamp when partitioning Processes claiming the same stable name. Pre-lift .unwrap_or(ProcessPhase::Pending).

All FIVE sites walked the SAME 3-line .status.as_ref() .map(|s| s.phase) chain — three closed with unwrap_or (ProcessPhase::Pending) (the Default), one closed with unwrap_or(ProcessPhase::Attested), one kept the raw Option<ProcessPhase> — so the ONE substrate accessor returns the raw Option<ProcessPhase> and each consumer keeps its .unwrap_or(...) default choice at its own site.

A future normalization step (a generation-filter that returns None for a phase stamped with a stale metadata.generation, a staleness gate that drops a phase whose observing phase_since predates a reconcile deadline, a canonicalization pass that maps a phase that no longer belongs to the CRD’s closed set to None) lands at ONE substrate method here and all five consumers pick up the upgrade mechanically — no per-callsite hand-edit at reconcile / evaluate_process_phase / check_depends_on / p_current_phase_str / stable_name_group_key.

Future status projections (observed_parent on the parent-pointer axis, observed_message on the human- readable-status axis, observed_children on the child fan-out axis, observed_exit_code on the terminal-exit axis) land as peer methods on this same axis.

Theory anchor: THEORY.md §VI.1 (generation over composition — the 3-line status-projection chain recurred at FIVE hand-authored sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication trigger, and is lifted to ONE owner here). THEORY.md §II.1 invariant 5 (composition preserves proofs — the pins bind the missing-status corner + the per-variant enum round-trip + the byte-identical parity with the pre-lift 3-line chain, so a regression that drifted any surface at tests::observed_phase_* rather than as silent operator-facing skew between the controller’s dispatch seed and the boundary evaluator’s depends-on audit on the SAME Process within one reconcile pass).

Trait Implementations

impl Clone for Process

fn clone(&self) -> Process

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl CustomResourceExt for Process

fn crd() -> CustomResourceDefinition

Helper to generate the CRD including the JsonSchema

fn crd_name() -> &'static str

Helper to return the name of this CustomResourceDefinition in kubernetes.

fn api_resource() -> ApiResource

Helper to generate the api information type for use with the dynamic Api

fn shortnames() -> &'static [&'static str]

Shortnames of this resource type.

impl Debug for Process

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Process

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl HasSpec for Process

type Spec = ProcessSpec

The type of the spec of this resource

fn spec(&self) -> &ProcessSpec

Returns a reference to the spec of the object

fn spec_mut(&mut self) -> &mut ProcessSpec

Returns a mutable reference to the spec of the object

impl HasStatus for Process

type Status = ProcessStatus

The type of the status object

fn status(&self) -> Option<&ProcessStatus>

Returns an optional reference to the status of the object

fn status_mut(&mut self) -> &mut Option<ProcessStatus>

Returns an optional mutable reference to the status of the object

impl JsonSchema for Process

fn schema_name() -> String

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn is_referenceable() -> bool

Whether JSON Schemas generated for this type should be re-used where possible using the $ref keyword.

impl Resource for Process

type DynamicType = ()

Type information for types that do not know their resource information at compile time.

type Scope = NamespaceResourceScope

Type information for the api scope of the resource when known at compile time

fn group(_: &()) -> Cow<'_, str>

Returns group of this object

fn kind(_: &()) -> Cow<'_, str>

Returns kind of this object

fn version(_: &()) -> Cow<'_, str>

Returns version of this object

fn api_version(_: &()) -> Cow<'_, str>

Returns apiVersion of this object

fn plural(_: &()) -> Cow<'_, str>

Returns the plural name of the kind

fn meta(&self) -> &ObjectMeta

Metadata that all persisted resources must have

fn meta_mut(&mut self) -> &mut ObjectMeta

Metadata that all persisted resources must have

fn url_path(dt: &Self::DynamicType, namespace: Option<&str>) -> String

Creates a url path for http requests for this resource

fn object_ref(&self, dt: &Self::DynamicType) -> ObjectReference

Generates an object reference for the resource

fn controller_owner_ref(&self, dt: &Self::DynamicType) -> Option<OwnerReference>

Generates a controller owner reference pointing to this resource

fn owner_ref(&self, dt: &Self::DynamicType) -> Option<OwnerReference>

Generates an owner reference pointing to this resource

impl Serialize for Process

fn serialize<S: Serializer>(&self, ser: S) -> Result<S::Ok, S::Error>

Serialize this value into the given Serde serializer.