Trait ValidationContext 

pub trait ValidationContext {
    // Required methods
    fn image_exists(&self, image: &ImageRef) -> Result<bool, ContextError>;
    fn secret_exists(&self, secret: &SecretRef) -> Result<bool, ContextError>;
    fn mesh_ident_known(
        &self,
        ident: &MeshIdent,
        batch: &[MeshIdent],
    ) -> Result<bool, ContextError>;
    fn cf_zone_owned(&self, hostname: &str) -> Result<bool, ContextError>;
    fn tailscale_tag_known(&self, tag: &str) -> Result<bool, ContextError>;
    fn capacity_for(
        &self,
        spec: &WorkloadSpec,
        machine_id: &MachineId,
    ) -> Result<bool, ContextError>;
}

Read-only view of yubaba state used for semantic validation.

Defined here so clients (desktop, CLI, agents) can run semantic checks without depending on the yubaba crate. Yubaba implements this trait.

Each method returns Result<bool, ContextError> so transient failures are distinguishable from definitive “not found” answers.

Required Methods

fn image_exists(&self, image: &ImageRef) -> Result<bool, ContextError>

True when the registry confirms the image exists.

fn secret_exists(&self, secret: &SecretRef) -> Result<bool, ContextError>

True when the named secret exists in the yubaba secret store.

fn mesh_ident_known( &self, ident: &MeshIdent, batch: &[MeshIdent], ) -> Result<bool, ContextError>

True when ident is a known deployed workload OR appears in batch (the set of specs co-deployed in the same request — allows forward references within a single deployment batch).

fn cf_zone_owned(&self, hostname: &str) -> Result<bool, ContextError>

True when hostname falls under a Cloudflare zone owned by this cluster.

fn tailscale_tag_known(&self, tag: &str) -> Result<bool, ContextError>

True when tag (e.g. "tag:noisetable-ops") is in the cluster’s Tailscale ACL tag list.

fn capacity_for( &self, spec: &WorkloadSpec, machine_id: &MachineId, ) -> Result<bool, ContextError>

True when machine_id has sufficient remaining capacity to host the given spec’s resource requirements.

Implementors: read memory via WorkloadSpec::memory_request_mb, not spec.resources.memory_mb. The latter is a cgroup ceiling, and using it as a capacity floor is what made every build-worker smaller than for_forge’s 32 GiB ceiling unschedulable in admit_workload. Only a test implementation of this trait exists today, so the bug is not live here — this note is to keep it from arriving with the first real one.

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors