Spike (g): apiextensions + cel-go cost, and the driver-independent store validator

v, err := validator.New()                                  // embedded CRDs; ~13 ms
err = v.Validate(ctx, obj, old)                            // store.Store.Apply: old == nil on create
err = v.ValidateStatus(ctx, obj, old)                      // store.Store.UpdateStatus
err = v.ValidateUnstructured(ctx, u, oldU)                 // API / `kudurru apply -f` / objects.d, before typing
if ve, ok := validator.AsError(err); ok { ve.HTTPStatus(); ve.Key(); ve.Message(); ve.Hint(); ve.Causes }
ve, ok := validator.FromStatusError(apiserverErr)          // kube driver: 422 -> same *Error
v.Kinds(); v.GroupVersionKind(kind); validator.EmbeddedCRDs() // introspection; NewFromCRDs(docs...) for tests

export CGO_ENABLED=0
GOCACHE=$(mktemp -d) go build -a -trimpath -ldflags "-s -w" -o kudurru-cold ./cmd/kudurru   # cold, empty cache
go build -a -trimpath -ldflags "-s -w" -o kudurru-a ./cmd/kudurru                           # cold, -a, shared cache
go build -trimpath -ldflags "-s -w" -o kudurru ./cmd/kudurru && rm kudurru
go build -trimpath -ldflags "-s -w" -o kudurru ./cmd/kudurru                                 # warm: cached compile, relink
stat -c %s kudurru
go version -m kudurru | grep -c $'^\tdep\t'

#!/usr/bin/env bash
# setup-src.sh — extract HEAD into one source tree per measured variant and
# apply the measurement-only patches (never committed).
#   base      HEAD as committed (cmd does not import the validator)
#   store     + api/v1alpha1 scheme and the memory store (object model cost)
#   validator + internal/store/validator (spike-validator cmd, New() in serve)
#   kube      + controller-runtime manager/client (kube driver proxy)
#   kubeval   kube + validator
set -euo pipefail
T=/home/vercel-sandbox/kudurru/.claude/worktrees/wf_cd87f6f4-670-4/.spike-tools
P=$T/patches
export PATH=/usr/local/go/bin:$PATH
CR_VERSION=${CR_VERSION:-v0.25.2}
for d in base store validator kube kubeval; do
  rm -rf "$T/src-$d"
  mkdir -p "$T/src-$d"
  tar -xf "$T/head.tar" -C "$T/src-$d"
done
for d in store validator kube kubeval; do
  cp "$P/spike_registry.go" "$T/src-$d/cmd/kudurru/"
  (cd "$T/src-$d" && patch -p1 -s < "$P/cmd-registry.diff")
done
cp "$P/spike_store.go" "$T/src-store/cmd/kudurru/"
for d in validator kubeval; do
  cp "$P/spike_validator.go" "$T/src-$d/cmd/kudurru/"
  (cd "$T/src-$d" && patch -p1 -s < "$P/cmd-serve.diff")
done
for d in kube kubeval; do
  cp "$P/spike_kube.go" "$T/src-$d/cmd/kudurru/"
  (cd "$T/src-$d" && go get "sigs.k8s.io/controller-runtime@${CR_VERSION:?}" >/dev/null 2>&1 && go mod tidy >/dev/null 2>&1)
done
echo ok

#!/usr/bin/env bash
# measure2.sh ROUNDS VARIANT... — release-style builds of each variant tree
# (src-<variant>, see setup-src.sh), alternating variants every round so
# machine load (other agents build in parallel) hits all variants alike.
set -euo pipefail
T=/home/vercel-sandbox/kudurru/.claude/worktrees/wf_cd87f6f4-670-4/.spike-tools
RS=$T/bin/runstat
export PATH=/usr/local/go/bin:$PATH CGO_ENABLED=0
rounds=$1
shift
for r in $(seq 1 "$rounds"); do
  for v in "$@"; do
    src=$T/src-$v
    out=$T/out2/$v
    mkdir -p "$out"
    cd "$src"
    load=$(cut -d' ' -f1-3 /proc/loadavg)
    cache=$T/cache-$v-$r
    rm -rf "$cache"
    cold=$(GOCACHE=$cache $RS go build -a -trimpath -ldflags "-s -w" -o "$out/kudurru-cold" ./cmd/kudurru | tail -1)
    rm -rf "$cache"
    colda=$($RS go build -a -trimpath -ldflags "-s -w" -o "$out/kudurru-a" ./cmd/kudurru | tail -1)
    go build -trimpath -ldflags "-s -w" -o "$out/kudurru" ./cmd/kudurru
    rm -f "$out/kudurru"
    warm=$($RS go build -trimpath -ldflags "-s -w" -o "$out/kudurru" ./cmd/kudurru | tail -1)
    size=$(stat -c %s "$out/kudurru")
    go version -m "$out/kudurru" > "$out/deps.txt"
    deps=$(grep -c $'^\tdep\t' "$out/deps.txt")
    echo "$v r$r load[$load] size=$size deps=$deps | cold(fresh GOCACHE,-a) $cold | cold(-a) $colda | warm(relink) $warm"
  done
done

#!/usr/bin/env bash
# inittrace.sh BINARY [RUNS] — total package-init clock time and allocations
# (GODEBUG=inittrace=1) per run of `BINARY version`, plus max RSS.
set -euo pipefail
T=/home/vercel-sandbox/kudurru/.claude/worktrees/wf_cd87f6f4-670-4/.spike-tools
bin=$1
runs=${2:-7}
for i in $(seq 1 "$runs"); do
  GODEBUG=inittrace=1 "$bin" version 2>"$T/it.txt" >/dev/null
  init=$(awk '{t+=$5; a+=$8; n++} END {printf "init=%.2fms alloc=%dKiB pkgs=%d", t, a/1024, n}' "$T/it.txt")
  rss=$("$T/bin/runstat" "$bin" version 2>/dev/null | sed -E 's/.*maxrss=([0-9]+KB).*/\1/')
  echo "$init version-maxrss=$rss"
done

// runstat runs a command and prints wall time, CPU time and max RSS.
// With -sample D it starts the command, waits D, reads VmRSS/VmHWM from
// /proc and kills it (for long-running servers).
package main

import (
	"flag"
	"fmt"
	"os"
	"os/exec"
	"strings"
	"syscall"
	"time"
)

func main() {
	sample := flag.Duration("sample", 0, "sample RSS after this delay and kill")
	flag.Parse()
	args := flag.Args()
	cmd := exec.Command(args[0], args[1:]...)
	cmd.Stdout, cmd.Stderr = os.Stderr, os.Stderr
	cmd.Env = os.Environ()
	start := time.Now()
	if err := cmd.Start(); err != nil {
		fmt.Fprintln(os.Stderr, err)
		os.Exit(1)
	}
	if *sample > 0 {
		time.Sleep(*sample)
		b, _ := os.ReadFile(fmt.Sprintf("/proc/%d/status", cmd.Process.Pid))
		for _, l := range strings.Split(string(b), "\n") {
			if strings.HasPrefix(l, "VmRSS") || strings.HasPrefix(l, "VmHWM") {
				fmt.Println(strings.Join(strings.Fields(l), " "))
			}
		}
		_ = cmd.Process.Signal(syscall.SIGTERM)
	}
	err := cmd.Wait()
	wall := time.Since(start)
	ru := cmd.ProcessState.SysUsage().(*syscall.Rusage)
	fmt.Printf("wall=%.2fs user=%.2fs sys=%.2fs maxrss=%dKB exit=%v\n", wall.Seconds(),
		time.Duration(ru.Utime.Nano()).Seconds(), time.Duration(ru.Stime.Nano()).Seconds(), ru.Maxrss, err)
}

"""sizes.py NMFILE DEPSFILE — sum `go tool nm -size` symbol bytes per module.

Symbols are attributed to the longest module path (from `go version -m`)
that prefixes the symbol's package path; everything else is "std/runtime".
"""
import re
import sys

nm_file, deps_file = sys.argv[1], sys.argv[2]
mods = ["github.com/robertherbaugh/kudurru"]
for line in open(deps_file):
    parts = line.split()
    if len(parts) >= 3 and parts[0] == "dep":
        mods.append(parts[1])
mods.sort(key=len, reverse=True)

sizes = {}
total = 0
for line in open(nm_file):
    parts = line.split(None, 3)
    if len(parts) < 4:
        continue
    try:
        size = int(parts[1])
    except ValueError:
        continue
    if parts[2] in ("B", "b", "U"):
        continue  # bss and undefined symbols take no file space
    name = parts[3].strip()
    name = re.sub(r"^(type:\.?(eq\.)?|go:itab\.|go:string\.|go:)", "", name)
    name = name.lstrip("*").lstrip("(").lstrip("*")
    key = "std/runtime/other"
    for m in mods:
        if name.startswith(m + ".") or name.startswith(m + "/"):
            key = m
            break
    sizes[key] = sizes.get(key, 0) + size
    total += size

for k, v in sorted(sizes.items(), key=lambda kv: -kv[1])[:30]:
    print(f"{v/1e6:8.2f} MB  {k}")
print(f"{total/1e6:8.2f} MB  total symbol bytes")

#!/usr/bin/env bash
# licenses.sh DEPSFILE — print a licence guess for every module linked into a
# binary (from `go version -m` output), by sniffing its LICENSE file.
set -euo pipefail
M=/home/vercel-sandbox/go/pkg/mod
grep -P '^\tdep\t' "$1" | while read -r _ mod ver _; do
  esc=$(echo "$mod" | sed -E 's/([A-Z])/!\L\1/g')
  dir="$M/$esc@$ver"
  f=$(ls "$dir"/LICENSE* "$dir"/COPYING* 2>/dev/null | head -1 || true)
  lic="?"
  if [ -n "$f" ]; then
    if grep -qi 'GNU GENERAL PUBLIC\|GNU LESSER\|EUPL\|Mozilla Public' "$f"; then lic="COPYLEFT!"
    elif grep -qi 'Apache License' "$f"; then lic="Apache-2.0"
    elif grep -qi 'Permission is hereby granted, free of charge' "$f"; then lic="MIT"
    elif grep -qi 'Redistribution and use in source and binary forms' "$f"; then lic="BSD"
    else lic="other"; fi
  fi
  echo "$lic $mod $ver"
done | sort

# Spike-only config: unusual ports so parallel agents do not collide.
node:
  name: spike
  dataDir: /home/vercel-sandbox/kudurru/.claude/worktrees/wf_cd87f6f4-670-4/.spike-tools/data
listeners:
  dns:
    - address: "127.0.0.1:25353"
      protocols: [udp, tcp]
  api: { address: "127.0.0.1:28080" }
  ops: { address: "127.0.0.1:28081" }
  metrics: { address: "127.0.0.1:29153" }
upstreams:
  groups:
    default:
      servers: ["1.1.1.1:53"]
      strategy: parallel_best
      timeout: 2s
log:
  level: info
  format: text

#!/usr/bin/env bash
# setup-fallback.sh — src-fallback: HEAD + the risk #10 fallback prototype
# (santhosh-tekuri/jsonschema/v6 + cel-go directly, no apiextensions).
set -euo pipefail
T=/home/vercel-sandbox/kudurru/.claude/worktrees/wf_cd87f6f4-670-4/.spike-tools
P=$T/patches
export PATH=/usr/local/go/bin:$PATH
rm -rf "$T/src-fallback"
mkdir -p "$T/src-fallback"
tar -xf "$T/head.tar" -C "$T/src-fallback"
cp "$P/spike_registry.go" "$P/spike_fallback.go" "$T/src-fallback/cmd/kudurru/"
cd "$T/src-fallback"
patch -p1 -s < "$P/cmd-registry.diff"
go get github.com/santhosh-tekuri/jsonschema/v6@v6.0.3 github.com/google/cel-go@v0.29.2 >/dev/null 2>&1
go mod tidy >/dev/null 2>&1
grep -E 'jsonschema|cel-go' go.mod
echo ok

#!/usr/bin/env bash
# measure-fallback.sh — size and smoke-test the risk #10 fallback prototype.
set -euo pipefail
T=/home/vercel-sandbox/kudurru/.claude/worktrees/wf_cd87f6f4-670-4/.spike-tools
RS=$T/bin/runstat
export PATH=/usr/local/go/bin:$PATH CGO_ENABLED=0
out=$T/out2/fallback
mkdir -p "$out"
cd "$T/src-fallback"
$RS go build -trimpath -ldflags "-s -w" -o "$out/kudurru" ./cmd/kudurru | tail -1
size=$(stat -c %s "$out/kudurru")
go version -m "$out/kudurru" > "$out/deps.txt"
echo "fallback size=$size deps=$(grep -c $'^\tdep\t' "$out/deps.txt")"
grep -P '^\tdep\t' "$T/out2/base/deps.txt" | awk '{print $2}' > "$T/base.mods"
grep -P '^\tdep\t' "$out/deps.txt" | awk '{print $2, $3}' | grep -v -F -f "$T/base.mods" || true
echo "--- valid sample"
"$out/kudurru" spike-fallback config/crd/bases/kudurru.io_blocklists.yaml config/samples/kudurru.io_v1alpha1_blocklist.yaml
echo "--- invalid (enum + one-of)"
"$out/kudurru" spike-fallback config/crd/bases/kudurru.io_blocklists.yaml "$T/bad-blocklist.yaml"
echo "--- version RSS"
for i in 1 2 3; do $RS "$out/kudurru" version 2>/dev/null; done

apiVersion: kudurru.io/v1alpha1
kind: BlockList
metadata:
  name: bad
  namespace: dns
spec:
  mode: deny
  sources:
    - url: https://a.example/
      inline: [ads.example]

"""summarize.py LOG — markdown tables (medians over rounds) from measure2.log."""
import re
import statistics
import sys

rows = {}
order = []
pat = re.compile(
    r"^(\S+) r(\d+) load\[([^\]]*)\] size=(\d+) deps=(\d+) \| "
    r"cold\(fresh GOCACHE,-a\) wall=([\d.]+)s user=([\d.]+)s sys=([\d.]+)s.*?\| "
    r"cold\(-a\) wall=([\d.]+)s user=([\d.]+)s sys=([\d.]+)s.*?\| "
    r"warm\(relink\) wall=([\d.]+)s user=([\d.]+)s sys=([\d.]+)s"
)
for line in open(sys.argv[1]):
    m = pat.match(line.strip())
    if not m:
        continue
    v = m.group(1)
    if v not in rows:
        rows[v] = []
        order.append(v)
    g = m.groups()
    rows[v].append({
        "load": g[2].split()[0], "size": int(g[3]), "deps": int(g[4]),
        "cold_wall": float(g[5]), "cold_cpu": float(g[6]) + float(g[7]),
        "a_wall": float(g[8]), "a_cpu": float(g[9]) + float(g[10]),
        "warm_wall": float(g[11]),
    })

def med(v, k):
    return statistics.median(r[k] for r in rows[v])

base = rows["base"][0]["size"]
kube = rows["kube"][0]["size"] if "kube" in rows else None
print("| Variant | Bytes | MB | Δ vs base | Δ vs kube | Linked modules |")
print("|---|---|---|---|---|---|")
for v in order:
    s = rows[v][0]["size"]
    assert all(r["size"] == s for r in rows[v]), v
    dk = f"{(s - kube)/1e6:+.2f} MB" if kube and v.startswith("kube") else ""
    print(f"| `{v}` | {s:,} | {s/1e6:.2f} | {(s-base)/1e6:+.2f} MB | {dk} | {rows[v][0]['deps']} |".replace(",", " "))
print()
print(f"| Variant | Rounds | Cold, empty GOCACHE + `-a`: wall / CPU (s) | Cold `-a`, shared cache: wall / CPU (s) | Warm relink wall (s) | 1-min load at start |")
print("|---|---|---|---|---|---|")
for v in order:
    loads = ", ".join(r["load"] for r in rows[v])
    print(f"| `{v}` | {len(rows[v])} | {med(v,'cold_wall'):.1f} / {med(v,'cold_cpu'):.0f} | {med(v,'a_wall'):.1f} / {med(v,'a_cpu'):.0f} | {med(v,'warm_wall'):.2f} | {loads} |")

package main

import "github.com/spf13/cobra"

// spikeCmds collects measurement-only hidden commands (spike g).
var spikeCmds []func() *cobra.Command

--- a/cmd/kudurru/main.go
+++ b/cmd/kudurru/main.go
@@ -43,6 +43,9 @@ func newRoot() *cobra.Command {
 		newDoctorCmd(&configPath),
 		newConfigCmd(&configPath),
 	)
+	for _, f := range spikeCmds {
+		root.AddCommand(f())
+	}
 	return root
 }

diff --git a/cmd/kudurru/serve.go b/cmd/kudurru/serve.go
index 0ec9f11..746c25e 100644
--- a/cmd/kudurru/serve.go
+++ b/cmd/kudurru/serve.go
@@ -45,6 +45,11 @@ milestone (docs/architecture.md §13).`,
 			}
 			ctx, stop := signal.NotifyContext(c.Context(), os.Interrupt, syscall.SIGTERM)
 			defer stop()
+			if _, d, err := spikeBuildValidator(); err != nil {
+				return err
+			} else {
+				fmt.Fprintln(os.Stderr, "spike: validator.New() took", d)
+			}
 			return runServe(ctx, cfg)
 		},
 	}

package main

// TEMPORARY, measurement only (spike g, docs/spikes/store-validator.md).
// Not committed: it links internal/store/validator into the binary the way
// the sqlite driver will, so size, init time and RSS can be measured.

import (
	"context"
	"fmt"
	"os"
	"runtime"
	"strings"
	"time"

	"github.com/spf13/cobra"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

	"github.com/robertherbaugh/kudurru/api/v1alpha1"
	"github.com/robertherbaugh/kudurru/internal/store/validator"
)

var spikeStart = time.Now()

func spikeRSS() string {
	b, _ := os.ReadFile("/proc/self/status")
	var out []string
	for _, l := range strings.Split(string(b), "\n") {
		if strings.HasPrefix(l, "VmRSS") || strings.HasPrefix(l, "VmHWM") {
			out = append(out, strings.Join(strings.Fields(l), " "))
		}
	}
	return strings.Join(out, " ")
}

func spikeZone(name, zoneName string) *v1alpha1.DNSZone {
	return &v1alpha1.DNSZone{
		ObjectMeta: metav1.ObjectMeta{Name: name},
		Spec: v1alpha1.DNSZoneSpec{
			ZoneName: zoneName, Type: v1alpha1.ZoneTypePrimary,
			SOA:         &v1alpha1.SOASpec{MName: "ns1." + zoneName, RName: "hostmaster." + zoneName},
			Nameservers: []string{"ns1." + zoneName},
		},
	}
}

// spikeBuildValidator is what the sqlite driver would do at startup.
func spikeBuildValidator() (*validator.Validator, time.Duration, error) {
	t0 := time.Now()
	v, err := validator.New()
	return v, time.Since(t0), err
}

func init() { spikeCmds = append(spikeCmds, newSpikeValidatorCmd) }

func newSpikeValidatorCmd() *cobra.Command {
	return &cobra.Command{
		Use:    "spike-validator",
		Hidden: true,
		RunE: func(c *cobra.Command, _ []string) error {
			ctx := context.Background()
			sinceStart := time.Since(spikeStart)
			rss0 := spikeRSS()
			v, tNew, err := spikeBuildValidator()
			if err != nil {
				return err
			}
			rss1 := spikeRSS()
			t1 := time.Now()
			if err := v.Validate(ctx, spikeZone("home", "home.example."), nil); err != nil {
				return err
			}
			tFirst := time.Since(t1)
			t2 := time.Now()
			if err := v.Validate(ctx, spikeZone("lab", "lab.example."), nil); err != nil {
				return err
			}
			tSecond := time.Since(t2)
			old := spikeZone("home", "home.example.")
			old.ResourceVersion, old.UID, old.Generation = "1", "u1", 1
			upd := spikeZone("home", "other.example.")
			t3 := time.Now()
			errUpd := v.Validate(ctx, upd, old)
			tUpd := time.Since(t3)
			const n = 2000
			t4 := time.Now()
			for i := 0; i < n; i++ {
				_ = v.Validate(ctx, spikeZone("home", "home.example."), old)
			}
			per := time.Since(t4) / n
			rss2 := spikeRSS()
			var ms runtime.MemStats
			runtime.ReadMemStats(&ms)
			fmt.Printf("process start -> main: %v (rss %s)\n", sinceStart, rss0)
			fmt.Printf("validator.New(): %v (rss after %s)\n", tNew, rss1)
			fmt.Printf("first Validate (create): %v\n", tFirst)
			fmt.Printf("second Validate (create): %v\n", tSecond)
			fmt.Printf("update with immutable zoneName change: %v (rejected=%v)\n", tUpd, validator.IsInvalid(errUpd))
			fmt.Printf("steady-state Validate (update, CEL transition rule): %v/op over %d\n", per, n)
			fmt.Printf("rss after %d validations: %s; heap in use %d KiB\n", n, rss2, ms.HeapInuse/1024)
			return nil
		},
	}
}

package main

// TEMPORARY, measurement only (spike g): links what every store-backed build
// links anyway (api/v1alpha1, apimachinery, the memory store), so the
// validator's own cost can be separated from the object model's.

import (
	"context"
	"fmt"

	"github.com/spf13/cobra"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/runtime"

	"github.com/robertherbaugh/kudurru/api/v1alpha1"
	"github.com/robertherbaugh/kudurru/internal/store"
	"github.com/robertherbaugh/kudurru/internal/store/memory"
)

func init() { spikeCmds = append(spikeCmds, newSpikeStoreCmd) }

func newSpikeStoreCmd() *cobra.Command {
	return &cobra.Command{
		Use:    "spike-store",
		Hidden: true,
		RunE: func(c *cobra.Command, _ []string) error {
			s := runtime.NewScheme()
			if err := v1alpha1.AddToScheme(s); err != nil {
				return err
			}
			st := memory.New()
			z := &v1alpha1.DNSZone{ObjectMeta: metav1.ObjectMeta{Name: "home"}, Spec: v1alpha1.DNSZoneSpec{ZoneName: "home.example.", Type: v1alpha1.ZoneTypePrimary}}
			out, err := st.Apply(context.Background(), z, store.ApplyOptions{Manager: store.ManagerAPI})
			if err != nil {
				return err
			}
			fmt.Println(store.KeyOf(out), len(s.AllKnownTypes()))
			return nil
		},
	}
}

package main

// TEMPORARY, measurement only (spike g): links a controller-runtime manager
// and client over the kudurru scheme, roughly what the kube driver adds to
// the single binary, so the validator's marginal cost in the final product
// can be measured.

import (
	"fmt"

	"github.com/spf13/cobra"
	"k8s.io/apimachinery/pkg/runtime"
	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
	"k8s.io/client-go/rest"
	ctrl "sigs.k8s.io/controller-runtime"
	"sigs.k8s.io/controller-runtime/pkg/client"

	"github.com/robertherbaugh/kudurru/api/v1alpha1"
)

func init() { spikeCmds = append(spikeCmds, newSpikeKubeCmd) }

func newSpikeKubeCmd() *cobra.Command {
	return &cobra.Command{
		Use:    "spike-kube",
		Hidden: true,
		RunE: func(c *cobra.Command, _ []string) error {
			s := runtime.NewScheme()
			if err := clientgoscheme.AddToScheme(s); err != nil {
				return err
			}
			if err := v1alpha1.AddToScheme(s); err != nil {
				return err
			}
			cfg := &rest.Config{Host: "https://127.0.0.1:6443"}
			mgr, err := ctrl.NewManager(cfg, ctrl.Options{Scheme: s, LeaderElection: true, LeaderElectionID: "kudurru", LeaderElectionNamespace: "kudurru"})
			if err != nil {
				return err
			}
			cl, err := client.New(cfg, client.Options{Scheme: s})
			if err != nil {
				return err
			}
			fmt.Println(mgr != nil, cl != nil)
			return nil
		},
	}
}

package main

// TEMPORARY, measurement only (spike g, risk #10 fallback): validate a
// kudurru object with a plain JSON Schema validator
// (github.com/santhosh-tekuri/jsonschema/v6) plus cel-go used directly for
// the x-kubernetes-validations rules, without k8s.io/apiextensions-apiserver.
// Deliberately crude: no defaulting, ratcheting, list-type, metadata or
// apiserver-identical messages; it exists to size the fallback.

import (
	"bytes"
	"encoding/json"
	"fmt"
	"os"
	"strings"

	"github.com/google/cel-go/cel"
	"github.com/santhosh-tekuri/jsonschema/v6"
	"github.com/spf13/cobra"
	"sigs.k8s.io/yaml"
)

func init() { spikeCmds = append(spikeCmds, newSpikeFallbackCmd) }

type celRule struct {
	path []string // property path; "[]" descends into list items
	rule string
	msg  string
	prg  cel.Program
}

func collectRules(s map[string]any, path []string, out *[]celRule) {
	if xs, ok := s["x-kubernetes-validations"].([]any); ok {
		for _, x := range xs {
			m := x.(map[string]any)
			msg, _ := m["message"].(string)
			*out = append(*out, celRule{path: append([]string(nil), path...), rule: m["rule"].(string), msg: msg})
		}
	}
	if props, ok := s["properties"].(map[string]any); ok {
		for k, v := range props {
			collectRules(v.(map[string]any), append(path, k), out)
		}
	}
	if items, ok := s["items"].(map[string]any); ok {
		collectRules(items, append(path, "[]"), out)
	}
}

func nodes(v any, path []string, at string, f func(string, any)) {
	if len(path) == 0 {
		f(at, v)
		return
	}
	if path[0] == "[]" {
		l, _ := v.([]any)
		for i, it := range l {
			nodes(it, path[1:], fmt.Sprintf("%s[%d]", at, i), f)
		}
		return
	}
	m, _ := v.(map[string]any)
	if c, ok := m[path[0]]; ok {
		nodes(c, path[1:], strings.TrimPrefix(at+"."+path[0], "."), f)
	}
}

func newSpikeFallbackCmd() *cobra.Command {
	return &cobra.Command{
		Use:    "spike-fallback CRD OBJECT",
		Hidden: true,
		Args:   cobra.ExactArgs(2),
		RunE: func(c *cobra.Command, args []string) error {
			crdDoc, err := os.ReadFile(args[0])
			if err != nil {
				return err
			}
			objDoc, err := os.ReadFile(args[1])
			if err != nil {
				return err
			}
			var crd map[string]any
			if err := yaml.Unmarshal(crdDoc, &crd); err != nil {
				return err
			}
			schema := crd["spec"].(map[string]any)["versions"].([]any)[0].(map[string]any)["schema"].(map[string]any)["openAPIV3Schema"].(map[string]any)
			sj, _ := json.Marshal(schema)
			sdoc, err := jsonschema.UnmarshalJSON(bytes.NewReader(sj))
			if err != nil {
				return err
			}
			comp := jsonschema.NewCompiler()
			if err := comp.AddResource("crd.json", sdoc); err != nil {
				return err
			}
			sch, err := comp.Compile("crd.json")
			if err != nil {
				return err
			}
			var rules []celRule
			collectRules(schema, nil, &rules)
			env, err := cel.NewEnv(cel.Variable("self", cel.DynType), cel.Variable("oldSelf", cel.DynType))
			if err != nil {
				return err
			}
			for i := range rules {
				ast, iss := env.Compile(rules[i].rule)
				if iss.Err() != nil {
					return iss.Err()
				}
				if rules[i].prg, err = env.Program(ast); err != nil {
					return err
				}
			}
			oj, err := yaml.YAMLToJSON(objDoc)
			if err != nil {
				return err
			}
			odoc, err := jsonschema.UnmarshalJSON(bytes.NewReader(oj))
			if err != nil {
				return err
			}
			if err := sch.Validate(odoc); err != nil {
				fmt.Println("schema:", err)
			}
			var obj any
			_ = json.Unmarshal(oj, &obj)
			for _, r := range rules {
				if strings.Contains(r.rule, "oldSelf") {
					continue // transition rules need the old object
				}
				nodes(obj, r.path, "", func(at string, v any) {
					out, _, err := r.prg.Eval(map[string]any{"self": v})
					if err != nil || out.Value() != true {
						fmt.Printf("cel: %s: %s\n", at, r.msg)
					}
				})
			}
			fmt.Println("done")
			return nil
		},
	}
}

// Probe: does `omitzero` drop a zero metav1.Duration in the encoders a
// Kubernetes client uses?
package main

import (
	"encoding/json"
	"fmt"

	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/runtime"
)

type withOmitEmpty struct {
	TTL metav1.Duration `json:"ttl,omitempty"`
}

type withOmitZero struct {
	TTL metav1.Duration `json:"ttl,omitzero"`
}

func main() {
	a, _ := json.Marshal(withOmitEmpty{})
	b, _ := json.Marshal(withOmitZero{})
	ua, _ := runtime.DefaultUnstructuredConverter.ToUnstructured(&withOmitEmpty{})
	ub, _ := runtime.DefaultUnstructuredConverter.ToUnstructured(&withOmitZero{})
	fmt.Printf("encoding/json omitempty: %s\nencoding/json omitzero:  %s\n", a, b)
	fmt.Printf("unstructured omitempty: %v\nunstructured omitzero:  %v\n", ua, ub)
}

#!/usr/bin/env bash
# setup-kubefb.sh — src-kubefb: the kube variant plus the fallback prototype
# instead of the validator, then a release build and its size.
set -euo pipefail
T=/home/vercel-sandbox/kudurru/.claude/worktrees/wf_cd87f6f4-670-4/.spike-tools
P=$T/patches
export PATH=/usr/local/go/bin:$PATH CGO_ENABLED=0
rm -rf "$T/src-kubefb"
cp -r "$T/src-kube" "$T/src-kubefb"
cp "$P/spike_fallback.go" "$T/src-kubefb/cmd/kudurru/"
cd "$T/src-kubefb"
go get github.com/santhosh-tekuri/jsonschema/v6@v6.0.3 >/dev/null 2>&1
go mod tidy >/dev/null 2>&1
mkdir -p "$T/out2/kubefb"
go build -trimpath -ldflags "-s -w" -o "$T/out2/kubefb/kudurru" ./cmd/kudurru
go version -m "$T/out2/kubefb/kudurru" > "$T/out2/kubefb/deps.txt"
echo "kubefb size=$(stat -c %s "$T/out2/kubefb/kudurru") deps=$(grep -c $'^\tdep\t' "$T/out2/kubefb/deps.txt")"