allow := allowValue(expect.mtlsSucceeds)
								if from.Config().IsNaked() {
									allow = allowValue(expect.plaintextSucceeds)
								}

								if allow {
									opts.Check = check.OK()
								} else {
									opts.Check = check.ErrorOrStatus(http.StatusForbidden)
								}

								mtlsString := "mtls"
								if from.Config().IsNaked() {
									mtlsString = "plaintext"
								}

func (c Config) IsHeadless() bool {
	return c.Headless
}

func (c Config) IsStatefulSet() bool {
	return c.StatefulSet
}

// IsNaked checks if the config has no sidecar.
// Note: instances that mix subsets with and without sidecars are considered 'naked'.
func (c Config) IsNaked() bool {
	for _, s := range c.Subsets {
		if s.Annotations != nil && s.Annotations[annotation.SidecarInject.Name] == "false" {

			}
		}
		return false
	}
}

var fromNaked condition = func(from echo.Instance, _ echo.CallOptions) bool {
	return from.Config().IsNaked()
}

var toNaked condition = func(_ echo.Instance, opts echo.CallOptions) bool {
	return opts.To.Config().IsNaked()
}

var toHeadless condition = func(_ echo.Instance, opts echo.CallOptions) bool {
	return opts.To.Config().IsHeadless()
}

		{app: headless1, expect: false},
		{app: naked1, expect: true},
		{app: external1, expect: true},
	}
	for _, tt := range tests {
		t.Run(tt.app.Config().Service, func(t *testing.T) {
			if got := tt.app.Config().IsNaked(); got != tt.expect {
				t.Errorf("got %v expected %v", got, tt.expect)
			}
		})
	}
}

var _ echo.Instance = fakeInstance{}

var NotExternal = Not(External)

// Naked matches instances with any subset marked with SidecarInject equal to false.
var Naked Matcher = func(i echo.Instance) bool {
	return i.Config().IsNaked()
}

// AllNaked matches instances where every subset has SidecarInject set to false.
var AllNaked Matcher = func(i echo.Instance) bool {
	return i.Config().IsAllNaked()
}

		match.NotWaypoint,
	)
}

// reachableFromNaked filters out all virtual machines and any instance that isn't on the same network
func reachableFromNaked(from echo.Instance) match.Matcher {
	if !from.Config().IsNaked() {
		return match.Any
	}
	return match.And(
		match.Network(from.Config().Cluster.NetworkName()),
		match.NotVM)

			// mtlsOnExpect defines our expectations for when mTLS is expected when its enabled
			mtlsOnExpect := func(from echo.Instance, opts echo.CallOptions) bool {
				if from.Config().IsNaked() || opts.To.Config().IsNaked() {
					// If one of the two endpoints is naked, we don't send mTLS
					return false
				}
				if opts.To.Config().IsHeadless() && opts.To.Instances().Contains(from) {

    val reservedFlag3 = b0 and B0_FLAG_RSV3 != 0
    if (reservedFlag3) throw ProtocolException("Unexpected rsv3 flag")

    val b1 = source.readByte() and 0xff

    val isMasked = b1 and B1_FLAG_MASK != 0
    if (isMasked == isClient) {
      // Masked payloads must be read on the server. Unmasked payloads must be read on the client.
      throw ProtocolException(
        if (isClient) {

			}

			if schema.Properties != nil {
				isNamed = true
			} else if schema.AdditionalProperties != nil {
				isNamed = false
			} else {
				return nil, nil, fmt.Errorf("does not refer to a valid field")
			}
			if err := appendToPath(unescaped, isNamed); err != nil {
				return nil, nil, err
			}
			if !scanner.Scan() {

                    )
                }
            }

            registerProvider provider@{ element: KtValueArgument ->
                if (element.isNamed()) return@provider null
                val annotationEntry = element.getParentOfTypeAndBranch<KtAnnotationEntry> { valueArgumentList } ?: return@provider null