Module success_expr 

successExpr: a sandboxed CEL pass/fail predicate over a verification result (ADR-0005 §4/§15).

A verification (ADR-0005 §4) can run blob-level kopia snapshot verify or a deep scratch-restore. successExpr lets a user assert the result is good — killing the silent “0 files” success (a verify that technically succeeds but restored nothing). Example: "stats.files > 0 && stats.errors == 0".

This reuses the cel/*Expr foundation from crate::identity (ADR-0004 §5): compile → execute → require a typed result, length-capped as the cost-budget surrogate, out-of-scope variables rejected at admission. The difference is the environment and the required result type: successExpr returns a bool over a verify-result environment, where identity expressions return a string over an identity environment.

CEL environment

• stats — a map {files, bytes, errors} (integers). Always present.
• snapshot — a map of snapshot metadata (the snapshot id under id). Always present (possibly empty).
• restored — a map {files, checksumMatches} for the deep (scratch-restore) tier. Present (possibly empty) so an expression that only references it under a guard validates; a quick verify leaves it empty.
• tier — the string "quick" or "deep", so a single predicate can branch on the tier (e.g. tier == 'deep' ? restored.checksumMatches : stats.files > 0).

Each value is supplied by the mover from the real verify result and evaluated there; admission validation (validate_success_expr) trial-evaluates against a representative environment so a typo / out-of-scope variable / non-bool result is rejected on kubectl apply rather than at first verify run.

Structs

RestoredStats

The optional deep-restore stats, exposed as restored. None for the quick (blob-level) tier; the environment then exposes an empty restored map.

SuccessExprInputs

The full environment a successExpr evaluates against.

VerifyStats

The integer stats a verification reports, exposed to successExpr as stats. Used both by the mover (filled from the real kopia result) and by validate_success_expr (a representative trial value).

Functions

eval_success_expr

Evaluate a compiled successExpr [Program] against inputs, requiring a bool result. Maps an evaluation failure to ValidationError::SuccessExprEval and a non-bool result to ValidationError::SuccessExprType.

validate_success_expr

Validate a successExpr at admission (ADR-0005 §4/§15): it must compile, and — because CEL reports an out-of-scope variable only at evaluation time — it must trial-evaluate against a representative environment without referencing an undeclared variable, returning a bool. Missing map keys (e.g. snapshot.tags['x'] when the trial data lacks x) are tolerated as data-dependent, mirroring crate::identity::validate_identity_expr.