Struct Process 

pub struct Process {
    pub metadata: ObjectMeta,
    pub spec: ProcessSpec,
    pub status: Option<ProcessStatus>,
}

Auto-generated derived type for ProcessSpec via CustomResource

Fields

metadata: ObjectMeta

spec: ProcessSpec

status: Option<ProcessStatus>

Implementations

impl Process

pub fn new(name: &str, spec: ProcessSpec) -> Self

Spec based constructor for derived custom resource

impl Process

pub const DEFAULT_NAMESPACE: &'static str = "default"

The K8s canonical default namespace — the fallback every consumer of a Process whose metadata.namespace is None substitutes. Matches the string K8s itself substitutes on namespaced resource writes with no explicit namespace.

pub const UNNAMED_PLACEHOLDER: &'static str = "unnamed"

Workspace-wide fallback for a Process’s metadata.name when it is None — the sentinel every annotation writer, claim arbiter, and owner-metadata seed substitutes so downstream grepping / label-selecting sees a stable spelling rather than a per-callsite ad-hoc placeholder ("", "<unnamed>", or the empty unwrap_or_default() fallback). A Process authored through the reconciler’s fork path always has a name; this constant covers the surface where an untyped Process value (test fixture, dynamic API response, adopted resource pre- name-resolution) surfaces without one.

pub fn namespace_or_default(&self) -> &str

Namespace slice with the Self::DEFAULT_NAMESPACE fallback applied — the ONE-line collapse of the metadata.namespace .as_deref().unwrap_or("default") incantation every consumer spelled by hand pre-lift.

Peer to Self::name_or_placeholder on the (metadata slot × fallback shape) axis; both compose through Self::coordinates_or_defaults when a consumer needs the pair together (annotation writers, claim-arbiter row builders, render owner-metadata seed).

pub fn name_or_placeholder(&self) -> &str

Name slice with the Self::UNNAMED_PLACEHOLDER fallback applied — the ONE-line collapse of the metadata.name.as_deref ().unwrap_or("unnamed") incantation every consumer spelled by hand pre-lift.

Peer to Self::namespace_or_default on the (metadata slot × fallback shape) axis; both compose through Self::coordinates_or_defaults when a consumer needs the pair together.

pub fn coordinates_or_defaults(&self) -> (&str, &str)

(namespace, name) coordinates with the workspace-wide default fallbacks applied — the ONE-line collapse of the paired metadata.namespace.as_deref().unwrap_or("default") + metadata.name.as_deref().unwrap_or("unnamed") extraction every downstream composer restated by hand pre-lift.

Return-tuple order matches the axis order of the substrate’s paired-composer primitive tatara_reconciler::ssapply::qualified_process_ref(ns, name): the (namespace, name) pair this method returns feeds that primitive positionally without an axis-swap step.

pub fn owned_coordinates_or_err(&self) -> Result<(String, String)>

(namespace, name) coordinates as owned Strings, with the namespace half fallback-defaulted to Self::DEFAULT_NAMESPACE but the name half REQUIRED — an anyhow::Error is returned when metadata.name is absent, because “unnamed” is a display placeholder, not a valid K8s API path segment. Fed straight into kube-rs API calls (Api::patch, Api::delete, Api::get) that take owned String arguments; the Self::DEFAULT_NAMESPACE fallback matches what K8s itself substitutes on namespaced resource writes with no explicit namespace, so the surface is safe against a Process whose metadata.namespace slot is absent (test fixture, dynamic API response pre-defaulting) but refuses to guess a name.

Peer to Self::coordinates_or_defaults on the (return-form × name gate) axis pair:

• borrow + name-defaulted → coordinates_or_defaults (display, annotation writers, ownership-tag composers — every consumer whose downstream drops "unnamed" in place of a missing name without an operator-visible failure);
• owned + name-required → this method (kube-rs API calls — every consumer whose downstream must NOT silently substitute a placeholder for the API call target, because the caller is about to patch/delete/get at metadata.name).

The error wording is pinned by [tests::owned_coordinates_or_err_error_message_matches_pre_lift_reconciler_wording] to match the exact spelling every pre-lift tatara-reconciler helper produced ("Process has no metadata.name") so log-line / test greps that anchored on that wording keep matching post- lift, and no operator-visible message drift lands as a side effect of the substrate move.

pub fn coordinates_or_none(&self) -> Option<(&str, &str)>

(namespace, name) coordinates in the BORROW + NAME-REQUIRED corner of the primitive family — namespace half falls back to Self::DEFAULT_NAMESPACE, but the name half is REQUIRED (None on a Process whose metadata.name is absent, so the caller stops with an else { continue; } / else { return …; } guard rather than proceeding with the empty-string sentinel every pre-lift consumer had to spell inline).

Peer to Self::coordinates_or_defaults + Self::owned_coordinates_or_err on the (return-form × name-gate) axis pair — closes the corner the family previously left open:

• borrow + name-defaulted → Self::coordinates_or_defaults (annotation writers, render owner-metadata seed — consumers whose downstream tolerates the "unnamed" display placeholder without operator-visible failure);
• borrow + name-required → this method (claim-arbiter probes, child-Process delete-fan-out — consumers that need a real API-path leaf and cleanly SKIP the row when the name is absent rather than issuing a K8s call with an empty-string name argument);
• owned + name-required → Self::owned_coordinates_or_err (kube-rs API-path calls — consumers whose downstream requires owned String arguments and rejects the missing-name corner with a load-bearing error message).

The primitive family’s None-on-missing-name semantics intentionally differs from Self::owned_coordinates_or_err’s error-on-missing-name semantics: the caller sites for this form (child-Process fan-out, claim-arbiter row probes) are non-fatal SKIPS rather than reportable failures — an Option::None at the primitive lets the caller thread that “skip” through a let-else without stringifying / logging an anyhow chain per missing-name occurrence.

The namespace fallback matches Self::coordinates_or_defaults (via Self::namespace_or_default), so a consumer that switches between the two borrow-form primitives based on its name-gate need never sees a different namespace-fallback string as a side effect.

pub fn annotation(&self, key: &str) -> Option<&str>

Borrowed lookup of ONE key in metadata.annotations, with BOTH the missing-annotations corner AND the missing-key corner collapsed to None — the ONE-liner collapse of the paired self.metadata.annotations.as_ref().and_then(|m| m.get(key)).map(String::as_str) incantation every consumer restated by hand pre-lift.

Pre-lift the 3-line .metadata.annotations.as_ref().and_then (|m| m.get(KEY)) chain (in three tail variants — .cloned(), .cloned().unwrap_or_default(), .map(String::as_str)) was hand-authored at THREE sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold across the workspace:

• tatara-reconciler::signals::ingest — SIGNAL annotation lookup (pre-lift .cloned() for owned parsing).
• tatara-reconciler::phase_machine::released_from_annotation — RELEASED_FROM annotation lookup (pre-lift .cloned() .unwrap_or_default() for match v.as_str()).
• tatara-pool-reconciler::controller_pool::process_belongs_to_pool — POOL annotation lookup (pre-lift .map(String::as_str) for == Some(pool_name)).

All THREE sites walked the SAME 3-line chain — read the annotations map, gate on presence, index by key — differing only in the tail that shaped the result. Post-lift each caller routes through the ONE substrate primitive here and applies its own tail at its own site (.map(str::to_string) / bare match / ==).

Return-form axis: Option<&str> mirrors the existing borrow- first discipline of the peer metadata primitives Self::namespace_or_default, Self::name_or_placeholder, Self::coordinates_or_none. The two corners the chain swallowed pre-lift (missing metadata.annotations map, missing key inside the map) BOTH collapse to None so .is_some() / if let Some(_) / Option::map behave identically on a Process whose annotations block is None and on one whose annotations block is populated but omits the key — matching what the pre-lift .and_then(...) chain produced.

A future normalization step (a key-canonicalization pass, a case-fold lookup, a per-key alias table for renamed annotations across API versions, a per-namespace override substrate) lands at ONE substrate method here and all three downstream consumers pick up the upgrade mechanically — no per-callsite hand-edit at ingest / released_from_annotation / process_belongs_to_pool.

Sibling to the peer metadata primitives (Self::namespace_or_default, Self::name_or_placeholder, Self::coordinates_or_defaults, Self::coordinates_or_none, Self::owned_coordinates_or_err) on the metadata axis; this method opens the borrow-form peer on the ANNOTATION axis. Future annotation projections (a paired label(&str) -> Option<&str> on metadata.labels, a has_annotation(&str) -> bool boolean gate for presence- only consumers) land as peer methods on this same axis.

Theory anchor: THEORY.md §VI.1 (generation over composition — the 3-line annotation-lookup chain recurred at three hand-authored sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication trigger, and is lifted to ONE owner here). THEORY.md §II.1 invariant 5 (composition preserves proofs — the pins bind the missing-annotations corner + the missing-key corner + the borrow-form &str lifetime + the byte-identical parity with the pre-lift 3-line chain, so a regression that drifted any surface at tests::annotation_* rather than as silent operator-facing skew between the SIGNAL / RELEASED_FROM / POOL annotation readers).

pub fn uid_or_empty(&self) -> &str

Borrow-form metadata-projection primitive on the metadata.uid axis: returns the K8s-API-server-assigned uid as a &str, with the missing-uid corner collapsed to the load-bearing empty-string sentinel — the ONE-liner collapse of the paired self.metadata.uid.as_deref().unwrap_or("") incantation every owner-reference-emitting consumer restated by hand pre-lift.

The empty-string fallback is NOT arbitrary — it is the exact sentinel value the sibling substrate composer crate::owner_references_json gates on (if uid.is_empty() { vec![] } else { vec![owner_reference_json(name, uid)] }) to stamp metadata.ownerReferences: [] on a resource whose owning Process pre-dates the API server’s metadata.uid assignment (test fixture, mid-Forking snapshot before the first patch round-trip, dynamic API response pre-uid-resolution). Pre-lift each consumer spelled the fallback as .unwrap_or("") at its callsite; the two literals in two files could drift silently to .unwrap_or_default(), .unwrap_or("<unknown>"), or an if let Some(u) = &process.metadata.uid gate that returned a different owner-refs shape for the missing-uid corner. Post-lift the sentinel value is composed at ONE substrate site so the empty-uid gate at owner_references_json and its per-callsite producers share the SAME "" byte-string, and a rename of the sentinel would land at ONE substrate site rather than at every downstream owner_references_json(name, uid) call.

Peer to Self::namespace_or_default + Self::name_or_placeholder on the metadata-slot × fallback- shape axis: namespace_or_default returns the K8s-canonical "default" fallback (matching what the API server substitutes on namespaced writes with no explicit namespace); name_or_placeholder returns the workspace-wide "unnamed" sentinel (a display placeholder for downstream grepping / label-selecting); this method returns the empty-string sentinel (a load-bearing gate value that composes with crate::owner_references_json’s is_empty check). The three primitives partition the metadata-slot family by whether the consumer wants a K8s-canonical fallback (namespace), a display placeholder (name), or a gate sentinel (uid).

Pre-lift the .metadata.uid.as_deref().unwrap_or("") chain was hand-authored at TWO sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold in tatara-reconciler::render, both feeding a downstream owner-reference emitter:

• render_routing — the routing-edge seed that binds process_uid into every routing-form EdgeContext (Ingress + DNSEndpoint) built inside the fanout loop over RoutingSpec::hostnames; each Edge::render impl then walks its EdgeContext through build_owner_refs → crate::owner_references_json to stamp metadata.ownerReferences on the emitted resource.
• render_export_jobs — the ephemeral-export Job builder that passes the same uid slice to tatara_process:: owner_references_json(name, uid) per rendered Job, stamping the export-Job’s metadata.ownerReferences back at the owning Process.

Both sites walked the SAME .as_deref().unwrap_or("") chain and both wanted the &str form the primitive returns — as the second positional argument to owner_references_json(name, uid) on the ownership-tag axis. Post-lift each callsite reads let uid = process.uid_or_empty(); and the produced slice feeds the same downstream composer unchanged.

Return-form axis: &str mirrors the existing borrow-first discipline of the peer metadata-fallback primitives (Self::namespace_or_default, Self::name_or_placeholder); all three return owned-metadata borrows with a slot-specific fallback baked in so downstream consumers compose the slice directly into their next call without re-spelling the fallback.

A future normalization step (a canonicalization pass that rejects a malformed uid before the owner-ref stamp, a cross- cluster uid rewrite for multi-tenant control planes, a stale- uid warning annotation for a Process whose uid changed under the reconciler mid-generation) lands at ONE substrate method here and both downstream owner_references_json consumers pick up the upgrade mechanically — no per-callsite hand-edit at render_routing / render_export_jobs.

Theory anchor: THEORY.md §VI.1 (generation over composition — the .metadata.uid.as_deref().unwrap_or("") chain recurred at two hand-authored sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication trigger, and is lifted to ONE owner here). THEORY.md §II.1 invariant 5 (composition preserves proofs — the pins bind the missing-uid corner + the empty-string sentinel byte-shape + the borrow-form &str lifetime + the byte-identical parity with the pre-lift chain + the composition coherence with crate::owner_references_json’s is_empty gate, so a regression that drifted any surface at tests::uid_or_empty_* rather than as silent operator-facing skew between the two owner-reference emitters on the SAME Process).

pub fn declared_parent_pid(&self) -> Option<&str>

Borrow-form spec-projection primitive on the declared parent-PID axis: returns the hierarchical PID path (e.g. "seph.1") the author declared at spec.identity.parent, with the empty-slot corner collapsed to None — the ONE-liner collapse of the paired self.spec.identity.parent.as_deref() incantation every consumer restated by hand pre-lift.

Pre-lift the .spec.identity.parent.as_deref() chain was hand- authored at TWO sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold in tatara-reconciler::phase_machine:

• handle_forking — the ALLOCATE-PID composer that threads the declared parent PID into [pid::allocate_pid] and also into the status patch payload ({ "pid": new_pid, "parent": parent_pid }), so the reconciler-observed ProcessStatus::parent slot mirrors the author-declared IdentitySpec::parent at fork time. The info! tracing span also reads the same slice as the parent field on the PID-assigned log line.
• handle_exiting — the SIGTERM cascade’s child-fan-out filter that enumerates every Process cluster-wide and picks children whose spec.identity.parent equals this Process’s currently- observed PID (.filter(|c| c.spec.identity.parent.as_deref() == Some(pid))). The filter runs per candidate child, so the borrow-form projection avoids allocating one String clone per non-matching row in the cluster-wide list.

Both sites walked the SAME .as_deref() chain and both wanted the Option<&str> form the primitive returns — the handle_forking site to feed positionally into pid::allocate_pid(&identity, parent_pid, next_seq) and the tracing span’s parent = ?parent_pid debug print + the JSON payload’s "parent": parent_pid slot; the handle_exiting filter to compare directly against Some(pid) where pid: &str came off the borrow-form peer Self::observed_pid.

Return-form axis: Option<&str> mirrors the borrow-first discipline of every peer primitive on the metadata / status slot family (Self::namespace_or_default, Self::name_or_placeholder, Self::observed_pid, Self::annotation). The empty-slot corner (spec.identity.parent = None, matching init / PID 1 with no parent) collapses to None so .is_some() / if let Some(_) / .map(...) behave identically on a Process authored at cluster init (PID 1, parent absent) and on any PID-N child (parent present) — matching the pre-lift .as_deref() chain’s None byte-identically.

Peer to Self::observed_pid on the (spec-declared × status-observed) axis pair: observed_pid returns the PID path this Process currently OWNS (the reconciler-persisted child position in the hierarchy), while declared_parent_pid returns the PID path this Process’s parent OWNS (the author- declared upstream position). The SIGTERM cascade at handle_exiting composes both: it reads its own Self::observed_pid and matches each candidate child’s Self::declared_parent_pid against that value — the child- fan-out relation IS the spec-declared × status-observed axis pair collapsed to a single comparator, both sides routed through the same borrow-form skeleton.

A future normalization step (a per-slot canonicalization pass that rejects malformed hierarchical PIDs, a case-fold lookup against a table of renamed identities, a cross-cluster prefix stripper, an alias-table lookup that maps a legacy PID to its current spelling) lands at ONE substrate method here and both downstream consumers pick up the upgrade mechanically — no per-callsite hand-edit at handle_forking / handle_exiting.

Sibling to the peer metadata-projection primitives (Self::namespace_or_default, Self::name_or_placeholder, Self::coordinates_or_defaults, Self::coordinates_or_none, Self::owned_coordinates_or_err, Self::annotation) on the metadata axis; this method opens the borrow-form peer on the declared-identity axis. Future identity projections (declared_name_override on the spec.identity.name_override axis, a paired declared_identity composite that returns both halves) land as peer methods on this same axis.

Theory anchor: THEORY.md §VI.1 (generation over composition — the .spec.identity.parent.as_deref() chain recurred at two hand-authored sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication trigger, and is lifted to ONE owner here). THEORY.md §II.1 invariant 5 (composition preserves proofs — the pins bind the empty-slot corner + the borrow-form &str lifetime + the byte-identical parity with the pre-lift .as_deref() chain, so a regression that drifted any surface at tests::declared_parent_pid_* rather than as silent operator- facing skew between the ALLOCATE-PID composer and the SIGTERM cascade’s child-fan-out filter on the SAME parent-child pair).

pub fn declared_name_override(&self) -> Option<&str>

Borrow-form spec-projection primitive on the declared name-override axis: returns the human name the author declared at spec.identity.name_override (used verbatim instead of the content-hash-derived name in [derive_identity]), with the empty-slot corner collapsed to None — the ONE-liner collapse of the paired self.spec.identity.name_override.as_deref() incantation every consumer restated by hand pre-lift.

Pre-lift the .spec.identity.name_override.as_deref() chain was hand-authored at TWO sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold in tatara-reconciler::phase_machine, both feeding the second positional argument of [derive_identity]:

• handle_pending — the DECLARE composer that computes the Process’s Identity on entry to the state machine (before patch::phase_status writes it into status.identity).
• handle_forking — the ALLOCATE-PID composer that recomputes the same Identity on a rehydration path (status may already carry an identity from a prior reconcile, in which case the .and_then(|s| s.identity.clone()) short-circuit takes it; otherwise this .unwrap_or_else branch fires and recomputes the identity fresh from the spec) so pid:: allocate_pid sees the SAME Identity the DECLARE phase produced.

Both sites walked the SAME .as_deref() chain and both wanted the Option<&str> form the primitive returns — as the second positional argument to derive_identity(&self.spec, …), which internally trims + filters empty strings + dispatches on Some(non_empty) (verbatim name, name_override: true) vs None | Some(empty | whitespace) (content-hash-derived name, name_override: false). The primitive itself preserves the raw slot byte-identically (the trim happens IN derive_identity, not at the borrow site), so the two live paths compose through the SAME borrow-form skeleton.

Return-form axis: Option<&str> mirrors the borrow-first discipline of every peer primitive on the metadata / status / spec-identity slot family (Self::namespace_or_default, Self::name_or_placeholder, Self::observed_pid, Self::annotation, Self::declared_parent_pid). The empty-slot corner (spec.identity.name_override = None, matching a Process authored WITHOUT the human-name-override escape hatch — the default; derive_identity then computes the name from the content hash) collapses to None so .is_some() / if let Some(_) / .map(...) behave identically on the two Process shapes an operator can author.

Peer to Self::declared_parent_pid on the (parent × name- override) sub-axis of the declared-identity axis: both primitives project a Option<String> slot on IdentitySpec through the SAME borrow-form skeleton, so a future declared_identity composite that returns both halves together (e.g. as a (Option<&str>, Option<&str>) tuple or a borrow-form DeclaredIdentityView<'_> newtype) lands as ONE method that COMPOSES the two peer primitives, not as three hand-authored .as_deref() chains restated at each callsite.

A future normalization step (a per-slot canonicalization pass that rejects malformed names, a case-fold lookup against a table of renamed identities, an alias-table lookup that maps a legacy name-override to its current spelling, a whitespace- trim lift OUT of derive_identity INTO the primitive so both consumers see the trimmed form) lands at ONE substrate method here and both downstream consumers pick up the upgrade mechanically — no per-callsite hand-edit at handle_pending / handle_forking.

Sibling to the peer spec-identity projection Self::declared_parent_pid on the declared-identity axis; this method opens the borrow-form peer on the name-override sub-axis of the same closed set (IdentitySpec { parent, name_override }). Future identity projections (a paired declared_identity composite that returns both halves together) land as peer methods on this same axis.

Theory anchor: THEORY.md §VI.1 (generation over composition — the .spec.identity.name_override.as_deref() chain recurred at two hand-authored sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication trigger, and is lifted to ONE owner here). THEORY.md §II.1 invariant 5 (composition preserves proofs — the pins bind the empty-slot corner + the borrow-form &str lifetime + the byte-identical parity with the pre-lift .as_deref() chain + the invariance under [derive_identity]’s internal trim/filter step, so a regression that drifted any surface at tests::declared_name_override_* rather than as silent operator-facing skew between the DECLARE composer and the ALLOCATE-PID rehydration branch on the SAME Process spec).

pub fn observed_flux_resources(&self) -> &[FluxResourceRef]

Borrowed slice of the FluxCD resources this Process’s status currently persists at status.flux_resources, with the missing-status corner collapsed to an empty slice — the ONE- line collapse of the paired self.status.as_ref().map(|s| s.flux_resources.clone()).unwrap_or_default() incantation every VERIFY-phase / ATTEST-heartbeat consumer restated by hand pre-lift.

Pre-lift the 5-line .status.as_ref().map(|s| s.flux_resources .clone()).unwrap_or_default() chain was hand-authored at TWO sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold in tatara-reconciler::phase_machine:

• handle_running — the VERIFY-phase per-ref readiness probe seed that walks every ref through crate::status::FluxResourceRef::fetch_coords via ssapply::fetch_flux_ref and rebuilds an updated Vec<FluxResourceRef> with ready + message + last_check observed at reconcile time.
• handle_attested — the ATTEST-heartbeat drift detector that short-circuits on the first non-Ready ref via ssapply::fetch_flux_ref + ssapply::ready_condition.

Both sites walked the SAME 5-line chain — clone the vector eagerly for the length of the reconcile pass, then iterate it by reference — even though neither site ever mutates the vector nor keeps it alive past the enclosing async fn. Post-lift both callers borrow the slice directly from self.status; the two pre-lift .clone() calls disappear because the slice lives for the borrow of &self, and both call sites’ subsequent downstream calls (ssapply::fetch_flux_ref / the patch::patch_process_status write) do not touch the borrowed p: &Process, so the borrow lifetime holds.

Return-form axis: &[FluxResourceRef] mirrors the existing borrow-first discipline every pre-lift consumer already iterated by reference (for r in &refs), and the shape of crate::status::FluxResourceRef::fetch_coords’s per-ref borrow projection extends mechanically to the slice-level projection here. The missing-status corner collapses to the empty slice &[] so .is_empty() / .len() / iteration all behave identically on a Process whose status is None and on one whose status carries an empty flux_resources slot — matching what the pre-lift .unwrap_or_default() produced (an empty Vec).

A future normalization step (a per-ref canonicalization pass that skips duplicated refs, an owner-filter that returns only refs stamped with the CURRENT metadata.generation, a staleness gate that drops refs whose last_check predates a reconcile deadline) lands at ONE substrate method here and both downstream consumers pick up the upgrade mechanically — no per-callsite hand-edit at handle_running / handle_attested.

Sibling to the Self::coordinates_or_none borrow-first primitive on the metadata axis; this method opens the analogous borrow-first primitive on the status-projection axis. Future status projections (observed_attestation on the attestation-chain axis, observed_pid on the PID axis, observed_children on the child-fan-out axis) land as peer methods on this same axis.

Theory anchor: THEORY.md §VI.1 (generation over composition — the 5-line status-projection chain recurred at two hand- authored sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication trigger, and is lifted to ONE owner here). THEORY.md §II.1 invariant 5 (composition preserves proofs — the pins bind the missing-status corner + the slice-lifetime borrow discipline

• the byte-identical parity with the pre-lift 5-line chain, so a regression that drifted any of the three surfaces at tests::observed_flux_resources_* rather than as silent operator-facing skew between the VERIFY-phase and ATTEST- heartbeat consumers).

pub fn observed_pid(&self) -> Option<&str>

The borrow-form status-projection primitive on the PID axis: returns the hierarchical PID path (e.g. "seph.1.7") the reconciler currently persists at status.pid, with BOTH the missing-status corner AND the empty-slot corner collapsed to None — the ONE-liner collapse of the paired self.status.as_ref().and_then(|s| s.pid.clone()) incantation every consumer restated by hand pre-lift.

Pre-lift the 3-line .status.as_ref().and_then(|s| s.pid .clone()) chain was hand-authored at TWO sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold in tatara-reconciler::phase_machine:

• handle_forking — the ALLOCATE-PID gate that short- circuits the PID allocator when the reconciler already assigned a PID on a prior reconcile pass (pre-lift the chain composed with .is_some() and threw the clone away without ever reading the string).
• handle_exiting — the SIGTERM cascade that enumerates child Processes and terminates them by matching each child’s spec.identity.parent against the PID this Process currently owns (pre-lift the chain bound an owned Option<String> and threaded pid.as_str() into the downstream .as_deref() == Some(...) comparator).

Both sites walked the SAME 3-line chain — clone the String eagerly, then either drop it (the handle_forking gate) or re-borrow it through .as_str() (the handle_exiting comparator) — even though neither site ever mutates the PID nor keeps it alive past the enclosing async fn. Post-lift both callers borrow the PID directly from self.status; the pre-lift .clone() at both sites disappears because the &str lives for the borrow of &self, and both call sites’ subsequent downstream calls (the K8s API list/patch, the child-Process comparator) do not touch the borrowed p: &Process, so the borrow lifetime holds.

Return-form axis: Option<&str> mirrors the existing borrow-first discipline every pre-lift consumer already re-borrowed through .as_str() before use, and the shape of Self::coordinates_or_none’s Option<(&str, &str)> projection extends mechanically to the single-slot projection here. The missing-status corner AND the populated-status-with-pid=None corner BOTH collapse to None so .is_some() / if let Some(_) / .map(...) behave identically on a Process whose status is None and on one whose status carries an unpopulated pid slot — matching what the pre-lift .and_then(...) chain produced.

A future normalization step (a per-slot canonicalization pass that rejects malformed hierarchical PIDs, a generation-filter that returns None for a PID stamped with a stale metadata.generation, a staleness gate that drops a PID whose observing phase_since predates a reconcile deadline) lands at ONE substrate method here and both downstream consumers pick up the upgrade mechanically — no per-callsite hand-edit at handle_forking / handle_exiting.

Sibling to the peer Self::observed_flux_resources borrow-first primitive on the flux-resources axis; both methods compose the same missing-status fallback + borrow-form return-shape skeleton on distinct ProcessStatus slots. Future status projections (observed_parent on the parent-pointer axis, observed_message on the human-readable-status axis, observed_attestation on the attestation-chain axis) land as peer methods on this same axis.

Theory anchor: THEORY.md §VI.1 (generation over composition — the 3-line status-projection chain recurred at two hand-authored sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication trigger, and is lifted to ONE owner here). THEORY.md §II.1 invariant 5 (composition preserves proofs — the pins bind the missing-status corner + the empty-slot corner + the borrow-form &str lifetime + the byte-identical parity with the pre-lift 3-line chain, so a regression that drifted any surface at tests::observed_pid_* rather than as silent operator- facing skew between the ALLOCATE-PID gate and the SIGTERM cascade on the SAME Process).

pub fn observed_attestation(&self) -> Option<&ProcessAttestation>

The borrow-form status-projection primitive on the attestation-chain axis: returns the last ProcessAttestation the reconciler persisted at status.attestation, with the missing-status corner AND the empty-slot corner BOTH collapsed to None — the ONE-liner collapse of the paired self.status.as_ref().and_then(|s| s.attestation.as_ref()) incantation every consumer restated by hand pre-lift.

Pre-lift the 3-line .status.as_ref().and_then(|s| s .attestation.as_ref()) chain was hand-authored at TWO sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold in tatara-reconciler:

• phase_machine::advance_to_attested — the ATTEST composer that chains prior.next(pillars) when a prior attestation is persisted and seeds with ProcessAttestation::initial otherwise.
• render::render_export_jobs — the ephemeral-export Job builder that pulls the prior composed_root off the last persisted attestation and threads it into every rendered Job’s previousRoot env var, so the export receipt chains into the Process’s BLAKE3 attestation tree at the correct generation boundary.

Both sites walked the SAME 3-line chain — the borrow-form Option<&ProcessAttestation> shape both consumers wanted already — even though neither site ever mutated the attestation nor kept it alive past the enclosing async fn. Post-lift both callers borrow the attestation directly from self.status; the pre-lift 3-line chain shrinks to a single method call at both sites, and both consumers’ subsequent downstream calls (ProcessAttestation::next for the ATTEST composer, .composed_root.clone() for the export Job builder) do not touch the borrowed p: &Process, so the borrow lifetime holds.

Return-form axis: Option<&ProcessAttestation> mirrors the existing borrow-first discipline every pre-lift consumer already re-borrowed through .as_ref(), and the shape of the peer Self::observed_pid projection extends mechanically to the whole-attestation-record projection here. The missing- status corner AND the populated-status-with-attestation =None corner BOTH collapse to None so .is_some() / if let Some(_) / .map(...) behave identically on a Process whose status is None and on one whose status carries an unpopulated attestation slot — matching what the pre-lift .and_then(...) chain produced.

A future normalization step (a per-slot canonicalization pass that rejects a persisted attestation whose composed_root fails verify, a generation-filter that returns None for an attestation stamped with a stale metadata.generation, a staleness gate that drops an attestation whose attested_at predates a reconcile deadline) lands at ONE substrate method here and both downstream consumers pick up the upgrade mechanically — no per-callsite hand-edit at advance_to_attested / render_export_jobs.

Sibling to the peer Self::observed_pid + Self::observed_flux_resources borrow-first primitives on the PID + flux-resources axes; all three methods compose the same missing-status fallback + borrow-form return-shape skeleton on distinct ProcessStatus slots. Future status projections (observed_parent on the parent-pointer axis, observed_message on the human-readable-status axis) land as peer methods on this same axis.

Theory anchor: THEORY.md §VI.1 (generation over composition — the 3-line status-projection chain recurred at two hand- authored sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication trigger, and is lifted to ONE owner here). THEORY.md §II.1 invariant 5 (composition preserves proofs — the pins bind the missing-status corner + the empty-slot corner + the borrow-form &ProcessAttestation lifetime + the byte- identical parity with the pre-lift 3-line chain, so a regression that drifted any surface at tests::observed_attestation_* rather than as silent operator-facing skew between the ATTEST composer and the ephemeral-export receipt chain on the SAME Process).

pub fn observed_identity(&self) -> Option<&Identity>

The borrow-form status-projection primitive on the resolved- identity axis: returns the Identity the reconciler currently persists at status.identity (name + content hash + override flag), with the missing-status corner AND the empty-slot corner BOTH collapsed to None — the ONE-liner collapse of the paired self.status.as_ref().and_then(|s| s.identity.as_ref()) incantation every consumer restated by hand pre-lift.

Pre-lift the paired .status.as_ref().and_then(|s| s.identity.<clone|as_ref>()) chain was hand-authored at TWO sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold in tatara-reconciler:

• phase_machine::handle_forking — the FORK-time identity seed that reuses the reconciler-persisted Identity if present and falls back to a fresh derive_identity(&spec, name_override) otherwise. Pre-lift the site cloned the whole Identity off the borrow before threading it through .unwrap_or_else(...) even though the fallback path allocates its own owned Identity — the pre-lift clone allocated a fresh Identity on the happy path just so the Option’s shape matched the fallback’s Identity return type.
• ssapply::inject_annotations — the SSA-time annotation composer that stamps the content-hash annotation onto every owned resource. Pre-lift the site nested the identity borrow-form check inside a manual if let Some(status) = &process.status { … } guard alongside sibling status.pid and status.attestation accesses — three siblings the peer primitives Self::observed_pid and Self::observed_attestation already own, so the outer status guard was the last hand-authored .status.as_ref() destructure at this composer.

Both sites walked the SAME 3-line chain (one via .clone(), one via .as_ref()) — the borrow-form Option<&Identity> shape both consumers wanted already, even though the FORK-time seed then had to .clone() off the borrow to compose with the owned-Identity fallback. Post- lift the seed calls .observed_identity().cloned() at the exact composition point where the owned value is required (the empty-borrow corner clones nothing, since Option::cloned on None is None), and the SSA-time consumer drops the outer status guard entirely — the three-sibling primitive family (pid + identity + attestation) now peers through observed_pid + observed_identity + observed_attestation at ONE call each with no shared status destructure between them.

Return-form axis: Option<&Identity> mirrors the existing borrow-first discipline every pre-lift consumer already re-borrowed through .as_ref() / re-cloned through .clone(), and the shape of the peer Self::observed_attestation projection extends mechanically to the whole-Identity-record projection here. The missing-status corner AND the populated-status-with- identity=None corner BOTH collapse to None so .is_some() / if let Some(_) / .map(...) behave identically on a Process whose status is None and on one whose status carries an unpopulated identity slot — matching what the pre-lift .and_then(...) chain produced.

A future normalization step (a per-slot canonicalization pass that rejects an Identity whose content_hash fails re-derivation against the current spec, a generation-filter that returns None for an identity stamped with a stale metadata.generation, a staleness gate that drops an identity whose observing phase_since predates a reconcile deadline) lands at ONE substrate method here and both downstream consumers pick up the upgrade mechanically — no per-callsite hand-edit at handle_forking / inject_annotations.

Sibling to the peer Self::observed_pid + Self::observed_attestation + Self::observed_flux_resources borrow-first primitives on the PID + attestation-chain + flux-resources axes; all four methods compose the same missing-status fallback + borrow-form return-shape skeleton on distinct ProcessStatus slots. Future status projections (observed_parent on the parent-pointer axis, observed_message on the human- readable-status axis) land as peer methods on this same axis.

Theory anchor: THEORY.md §VI.1 (generation over composition — the 3-line status-projection chain recurred at two hand- authored sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication trigger, and is lifted to ONE owner here). THEORY.md §II.1 invariant 5 (composition preserves proofs — the pins bind the missing-status corner + the empty-slot corner + the borrow-form &Identity lifetime + the byte-identical parity with the pre-lift 3-line chain, so a regression that drifted any surface at tests::observed_identity_* rather than as silent operator-facing skew between the FORK-time identity seed and the SSA-time content-hash annotation stamp on the SAME Process).

pub fn observed_phase(&self) -> Option<ProcessPhase>

The copy-form status-projection primitive on the phase axis: returns the ProcessPhase the reconciler currently persists at status.phase, wrapped in an Option so the missing- status corner collapses to None — the ONE-liner collapse of the paired self.status.as_ref().map(|s| s.phase) incantation every consumer restated by hand pre-lift.

Peer to the borrow-form projections Self::observed_pid (PID axis, Option<&str>), Self::observed_flux_resources (flux-resources axis, &[FluxResourceRef]), and Self::observed_attestation (attestation-chain axis, Option<&ProcessAttestation>); this method opens the copy-form peer for ProcessPhase — a Copy scalar with a Default impl (Pending), so the return is Option<ProcessPhase> rather than Option<&ProcessPhase> (borrow would give the caller nothing over the copy for a 1-byte enum) and neither the missing-status corner nor a “empty slot” corner is meaningful — the underlying slot is a bare ProcessPhase, not Option<ProcessPhase>, so the primitive returns None iff status: None.

Pre-lift the 3-line .status.as_ref().map(|s| s.phase) chain was hand-authored at FIVE sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold in tatara-reconciler:

• controller::reconcile — the top-level dispatcher’s current_phase seed that feeds the deletion-preempt + signal-ingestion gates + the per-phase handler dispatch. Pre-lift .unwrap_or(ProcessPhase::Pending).
• boundary::evaluate_process_phase — the boundary evaluator’s ProcessPhase condition (a peer-Process phase-reached postcondition). Pre-lift .unwrap_or(ProcessPhase::Pending).
• boundary::check_depends_on — the depends_on pre-condition audit that stashes the observed phase into the UnmetDependency::actual: Option<ProcessPhase> slot (keeps the Option form). Pre-lift the raw .map(|s| s.phase) shape.
• phase_machine::p_current_phase_str — the released-from annotation composer that emits "Attested" for every non-Failed phase (SIGSTOP/SIGCONT release gate). Pre-lift .unwrap_or(ProcessPhase::Attested) — the ONE site whose default is not Pending; the primitive returns the raw Option so the caller’s .unwrap_or default choice stays local rather than baked in.
• table_controller::stable_name_group_key — the routing- groupby seed that pairs the phase with the PID + creation timestamp when partitioning Processes claiming the same stable name. Pre-lift .unwrap_or(ProcessPhase::Pending).

All FIVE sites walked the SAME 3-line .status.as_ref() .map(|s| s.phase) chain — three closed with unwrap_or (ProcessPhase::Pending) (the Default), one closed with unwrap_or(ProcessPhase::Attested), one kept the raw Option<ProcessPhase> — so the ONE substrate accessor returns the raw Option<ProcessPhase> and each consumer keeps its .unwrap_or(...) default choice at its own site.

A future normalization step (a generation-filter that returns None for a phase stamped with a stale metadata.generation, a staleness gate that drops a phase whose observing phase_since predates a reconcile deadline, a canonicalization pass that maps a phase that no longer belongs to the CRD’s closed set to None) lands at ONE substrate method here and all five consumers pick up the upgrade mechanically — no per-callsite hand-edit at reconcile / evaluate_process_phase / check_depends_on / p_current_phase_str / stable_name_group_key.

Future status projections (observed_parent on the parent-pointer axis, observed_message on the human- readable-status axis, observed_children on the child fan-out axis, observed_exit_code on the terminal-exit axis) land as peer methods on this same axis.

Theory anchor: THEORY.md §VI.1 (generation over composition — the 3-line status-projection chain recurred at FIVE hand-authored sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication trigger, and is lifted to ONE owner here). THEORY.md §II.1 invariant 5 (composition preserves proofs — the pins bind the missing-status corner + the per-variant enum round-trip + the byte-identical parity with the pre-lift 3-line chain, so a regression that drifted any surface at tests::observed_phase_* rather than as silent operator-facing skew between the controller’s dispatch seed and the boundary evaluator’s depends-on audit on the SAME Process within one reconcile pass).

pub fn is_being_deleted(&self) -> bool

Copy-form metadata-projection primitive on the deletion-tombstone axis: returns true iff the K8s API server has stamped a metadata.deletionTimestamp on this Process (the moment the object entered the “being deleted” corner of its lifecycle, after which further mutating writes are refused and finalizers are drained before the object is actually removed) — the ONE- liner collapse of the paired self.metadata.deletion_timestamp .is_some() incantation every consumer restated by hand pre-lift.

Pre-lift the .metadata.deletion_timestamp.is_some() chain was hand-authored at TWO sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold in tatara-reconciler, both projecting the SAME tombstone-presence predicate on a Process value:

• controller::reconcile — the top-level dispatcher’s deletion-preempt gate that forces the SIGTERM cascade (→ Exiting) as soon as the API server stamps the tombstone, before the phase handler for the current ProcessPhase gets a chance to run. Composed with ProcessPhase::is_alive so the preempt only fires on a Process still in an alive phase — a Process already in Zombie / Reaped / Failed runs its normal handler.
• phase_machine::handle_exiting — the SIGTERM cascade’s child-fan-out loop that enumerates every child Process and skips ones the API server has already tombstoned (so the reconciler does not re-issue a DELETE against a child whose deletion the API server is already draining through its own finalizer). The skip composes with Self::coordinates_or_none’s name-required probe so a child missing either its tombstone-absent gate or its metadata.name slot is a clean continue rather than an attempted child_api.delete("") no-op.

Both sites walked the SAME .metadata.deletion_timestamp .is_some() chain and both wanted the bool form the primitive returns — the controller::reconcile site to gate the SIGTERM preempt with && current_phase.is_alive() and the handle_exiting site to gate the DELETE-skip with a bare if child.is_being_deleted() { continue; }. Post-lift each callsite reads process.is_being_deleted() and the produced bool feeds the same downstream gate unchanged.

Return-form axis: bool matches the copy-form discipline of Self::observed_phase (an Option<Copy> scalar) — the underlying slot is a wire-format Option<Time> that carries only presence information at this axis (the RFC-3339 timestamp payload itself is not what the two consumers read; both only probe presence to detect the tombstone-stamped state). Returning the raw Option<&Time> would push the .is_some() probe back to every callsite, restating the pre-lift chain one link shorter without collapsing the primitive.

Peer to the metadata-fallback primitives Self::namespace_or_default, Self::name_or_placeholder, Self::uid_or_empty, Self::coordinates_or_defaults, Self::coordinates_or_none, Self::owned_coordinates_or_err, Self::annotation on the metadata axis; this method opens the copy-form peer for the presence-probe corner. Future metadata-presence projections (an is_being_finalized projection on metadata.finalizers.is_empty()’s negation, a has_owner projection on metadata.owner_references.is_empty()’s negation) land as peer methods on this same axis.

A future normalization step (a per-tombstone staleness gate that returns false for a tombstone older than the reconciler’s grace-period budget, a canonicalization pass that treats a tombstone from a paused controller as absent, a cross-cluster tombstone-observation clock skew guard) lands at ONE substrate method here and both downstream consumers pick up the upgrade mechanically — no per-callsite hand-edit at controller::reconcile / phase_machine::handle_exiting.

Theory anchor: THEORY.md §VI.1 (generation over composition — the .metadata.deletion_timestamp.is_some() chain recurred at two hand-authored sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication trigger, and is lifted to ONE owner here). THEORY.md §II.1 invariant 5 (composition preserves proofs — the pins bind the missing-tombstone corner + the present- tombstone corner + the copy-form bool return + the byte- identical parity with the pre-lift .is_some() chain, so a regression that drifted any surface at tests::is_being_deleted_* rather than as silent operator- facing skew between the top-level dispatcher’s SIGTERM preempt and the SIGTERM cascade’s child-fan-out DELETE-skip on the SAME Process within one reconcile pass).

Trait Implementations

impl Clone for Process

fn clone(&self) -> Process

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl CustomResourceExt for Process

fn crd() -> CustomResourceDefinition

Helper to generate the CRD including the JsonSchema

fn crd_name() -> &'static str

Helper to return the name of this CustomResourceDefinition in kubernetes.

fn api_resource() -> ApiResource

Helper to generate the api information type for use with the dynamic Api

fn shortnames() -> &'static [&'static str]

Shortnames of this resource type.

impl Debug for Process

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Process

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl HasSpec for Process

type Spec = ProcessSpec

The type of the spec of this resource

fn spec(&self) -> &ProcessSpec

Returns a reference to the spec of the object

fn spec_mut(&mut self) -> &mut ProcessSpec

Returns a mutable reference to the spec of the object

impl HasStatus for Process

type Status = ProcessStatus

The type of the status object

fn status(&self) -> Option<&ProcessStatus>

Returns an optional reference to the status of the object

fn status_mut(&mut self) -> &mut Option<ProcessStatus>

Returns an optional mutable reference to the status of the object

impl JsonSchema for Process

fn schema_name() -> String

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn is_referenceable() -> bool

Whether JSON Schemas generated for this type should be re-used where possible using the $ref keyword.

impl Resource for Process

type DynamicType = ()

Type information for types that do not know their resource information at compile time.

type Scope = NamespaceResourceScope

Type information for the api scope of the resource when known at compile time

fn group(_: &()) -> Cow<'_, str>

Returns group of this object

fn kind(_: &()) -> Cow<'_, str>

Returns kind of this object

fn version(_: &()) -> Cow<'_, str>

Returns version of this object

fn api_version(_: &()) -> Cow<'_, str>

Returns apiVersion of this object

fn plural(_: &()) -> Cow<'_, str>

Returns the plural name of the kind

fn meta(&self) -> &ObjectMeta

Metadata that all persisted resources must have

fn meta_mut(&mut self) -> &mut ObjectMeta

Metadata that all persisted resources must have

fn url_path(dt: &Self::DynamicType, namespace: Option<&str>) -> String

Creates a url path for http requests for this resource

fn object_ref(&self, dt: &Self::DynamicType) -> ObjectReference

Generates an object reference for the resource

fn controller_owner_ref(&self, dt: &Self::DynamicType) -> Option<OwnerReference>

Generates a controller owner reference pointing to this resource

fn owner_ref(&self, dt: &Self::DynamicType) -> Option<OwnerReference>

Generates an owner reference pointing to this resource

impl Serialize for Process

fn serialize<S: Serializer>(&self, ser: S) -> Result<S::Ok, S::Error>

Serialize this value into the given Serde serializer.