Module validate 

Workspace-wide lint checks for the .yah/ declaration tree (R470-T3).

Every check shares one shape — walk the declarations, return a list of findings, empty means clean:

• alias collision (check_alias_collisions) — alias names declared in any service component’s [aliases] block must be workspace-globally unique. Two services declaring the same alias is a consumer-site ambiguity (yah-app.toml says alias = "whisper-default-ggml" — which catalog wins?).
• port collision (check_port_collisions) — two local-tier mirror slots binding the same localhost port (R602-B4).
• inert taint (check_inert_taints) — a taints entry in .yah/infra/machines/*.toml that no scheduler path can read (W305/R742-T4).
• retired arch tag (check_retired_arch_tags) — a machine still carrying the tier:<arch> build-worker mesh tag R763 renamed.
• unroled sovereign member (check_unroled_sovereign_members) — a machine naming a sovereign_group without saying whether it votes in it (R605-F12).
• LAN dial target (check_lan_dial_targets) — a machine whose [connect].yubaba is an RFC1918 literal, i.e. a break-glass address sitting in the field every automated path dials (R605-T10).
• ingress floating IP (check_ingress_floating_ip) — a machine whose ingress_floating_ip no adapter can move, or two machines in one sovereign_group naming different ingress IPs (R859-F2).
• ingress collation (collate_workspace_ingress) — two services whose declared edges cannot share the node they both front through (W305/R742-F2). The only check here that is inherently cross-service: each service’s own yah cloud apply sees one mirror, so a hostname claimed twice on one box is invisible from either side of it.

What unites them: each catches a declaration that parses, so nothing downstream complains, but which means something other than what it reads as. That is the class of bug this module exists for — a hard error is the type system’s job, and a wrong-but-valid declaration is nobody’s until someone writes the lint.

Invoked by yah cloud validate and as a preflight in yah cloud apply.

@yah:relay(R787, “Consolidate the four .yah/infra/machines/.toml walks in oss/yubaba/crates/cloud/src/validate.rs behind one loader”) @yah:status(review) @yah:at(2026-08-20T05:26:41Z) @yah:assignee(agent:bundle-anthropic-miravel) @yah:notify_on(R555, “Re-run cd oss/yubaba && cargo test -p yah-cloud --lib validate:: — it was blocked crate-wide by R555’s in-flight AdmissionGrant.secrets field missing from crates/cloud/src/reconciler/lowering_golden.rs’s TransformRecipe fixture (E0063), unrelated to R787’s validate.rs change. Confirm the two new tests (tolerant_mode_skips_an_unparseable_toml_and_still_pairs_the_path, strict_mode_fails_the_whole_load_on_one_unparseable_toml) and the existing validate:: suite pass once that’s fixed.”) @yah:handoff(“Consolidated the four .yah/infra/machines/.toml walks (check_inert_taints, check_retired_arch_tags, check_unroled_sovereign_members, load_machines) behind one shared load_machine_tomls(workspace_root, mode) in oss/yubaba/crates/cloud/src/validate.rs. Returns Vec<(PathBuf, MachineConfig)> per the agreed shape (Ashguard/R605-F12) so lint findings still name the file.”) @yah:handoff(“MachineLoadMode::Tolerant preserves the three lints’ existing skip-and-warn behavior; MachineLoadMode::Strict preserves load_machines’ hard-fail behavior for collate_workspace_ingress’s placement resolution (R772) – no behavior change at any of the four call sites.”) @yah:handoff(“Closed the vacuous-pass trap flagged in the ticket: added assert_machine_toml_parses(), called by write_machine, write_machine_tags, and write_sovereign_machine right after writing each fixture, so a future edit that drops a required MachineConfig field fails loudly at the helper instead of being silently skipped by the tolerant loader and producing a vacuous assert-empty pass.”) @yah:handoff(“Added two new tests locking in the Strict/Tolerant contract directly: tolerant_mode_skips_an_unparseable_toml_and_still_pairs_the_path, strict_mode_fails_the_whole_load_on_one_unparseable_toml.”) @yah:handoff(“R772’s load_machines and R605-F12’s check_unroled_sovereign_members were already landed and committed on this file before this pass (verified via git diff being empty and no live session on validate.rs at pickup) – both were settled, so this was safe to do now rather than wait further.”) @yah:verify(“cargo check -p yah-cloud –lib (from repo root) – clean, 0 warnings in validate.rs (2 pre-existing unrelated warnings elsewhere: mesofact_static.rs unused imports, and one more in a different file).”) @yah:verify(“cargo test -p yah-cloud –lib validate:: (from oss/yubaba, required for dev-deps) – BLOCKED, not failing: E0063 missing field secrets in crates/cloud/src/reconciler/lowering_golden.rs’s TransformRecipe fixture, caused by R555’s in-flight uncommitted AdmissionGrant.secrets field in oss/qed/crates/velveteen-exec (git status confirms those files are live-modified, lowering_golden.rs is not). This is the same blocker R605-F12’s own verify section recorded. Filed @yah:notify_on(R555) on this ticket so whoever reopens it re-runs the suite once R555 lands.”) @yah:verify(“Manual read-through of the diff: every lint’s iteration body (finding construction) is byte-identical to before, only the walk+parse boilerplate was extracted – no logic changed at any of the four call sites.”) @yah:gotcha(“Test verification for this crate is blocked camp-wide right now by R555 (live, Ashguard) – see notify_on. Not this ticket’s bug; do not attempt to fix lowering_golden.rs or velveteen-exec from here.”)

Structs

AliasCollision

A duplicate alias declaration found across two components.

AliasSource

Where an alias is declared — points the operator at the source row.

InertTaint

A declared node taint no placement decision can read.

IngressFloatingIpProblem

A machine whose MachineConfig::ingress_floating_ip cannot mean what it says.

IngressReport

What every node in the camp must front, derived from every service’s edges.

LanDialTarget

A machine whose [connect].yubaba points at an RFC1918 private address.

LoadedMirror

One mirror, loaded with the identity every finding has to be able to name.

PortCollision

Two local-tier mirror slots that bind the same host port. Because local mirrors share the operator’s localhost, both binding the same port collide when brought up together — and the local-static adopt probe (a bare TCP connect) may then silently adopt the wrong service (R602-B4: scrabcake dev and yah-marketing pond both on 4322).

PortSource

Where a host port is declared — points the operator at the (service, env, slot) that binds it.

RetiredArchTag

A machine still declaring the retired tier:<arch> build-worker mesh tag.

UnroledSovereignMember

A machine declaring sovereign_group without an explicit sovereign_role.

Enums

IngressFloatingIpProblemKind

The three ways an ingress_floating_ip declaration can be wrong.

IngressProblem

An ingress declaration that cannot become a front door.

MachineLoadMode

How load_machine_tomls handles a .yah/infra/machines/*.toml that fails to read or parse.

Functions

check_alias_collisions

Walk every service’s static-asset components and collect all (alias → source) mappings. Returns a list of collisions (empty when clean).

check_inert_taints

Flag every taint in .yah/infra/machines/*.toml that the scheduler cannot act on (W305 finding 1 / R742-T4).

check_ingress_floating_ip

Flag every ingress_floating_ip declaration that cannot do what it claims (R859-F2).

check_lan_dial_targets

Flag every machine that has put a LAN literal in [connect].yubaba.

check_port_collisions

Walk every service mirror and flag host-port reuse across local-tier provider slots (R602-B4). Only slots that bind a port on the operator’s localhost are considered (local-static, miniflare-container, minio-container) — cloud/CF slots don’t contend for localhost.

check_retired_arch_tags

Flag every machine still carrying a tier:<arch> build-worker mesh tag.

check_unroled_sovereign_members

Flag every machine that names a sovereign group without saying whether it votes in it (R605-F12).

collate_workspace_ingress

Collate every service’s declared ingress edges into the per-node front doors they imply (W305 F2 — the node-controller half).

load_machine_tomls

Every .yah/infra/machines/*.toml, paired with the path that declared it — every lint finding names the file the operator opens, and collate_workspace_ingress’s placement resolution has no use for the path but takes it anyway rather than forcing a second loader to exist.

load_service_mirrors

Every .yah/services/<svc>/mirrors/<env>.toml in the workspace, in a deterministic order (services sorted, then envs).