Function kube_seq_first 

pub fn kube_seq_first<'a>(value: &'a Value, field: &str) -> Option<&'a Value>

Read the first entry of a sub-<field>[] YAML sequence nested one hop under an arbitrary &serde_yaml::Value mapping receiver as Option<&serde_yaml::Value> — the value-level three-hop navigation primitive that folds .get(<field>) → as_sequence → first into a single helper call. Peer of the spec-anchored kube_spec_seq_first (b7babfe) at one altitude below: where the spec-anchored accessor folds the outer spec → as_mapping → get(<field>) prelude before the same sequence-head selector, this accessor drops the outer three-hop and stays parametric on the mapping receiver — so a caller already holding a nested &Value (a spec.ingress[0] bracket returned from kube_spec_seq_first, a spec.rules[0] first-rule bracket from the sibling per-HTTPRoute readback, any two-hop nested-mapping bracket the M3 renderer set exposes) reaches for this accessor directly instead of re-inlining the three-line .and_then(|v| v.get(<K>)).and_then(|v| v.as_sequence()) .and_then(|s| s.first()) block. Together with kube_spec_seq_first the pair closes the head-selector arity on both the outer sub-spec.<field>[] axis and the inner nested sub- <field>[] axis every routed spec.<outer>[0].<inner>[0] readback (the per-CNP spec.ingress[0].toPorts[0] L4-port bracket pair, the per-CNP spec.ingress[0].fromEndpoints[0] source-endpoint selector bracket, the per-HTTPRoute spec.rules[0].backendRefs[0] first-backend pin, the per-HTTPRoute spec.rules[0].matches[0] first-match pin, MESH-COMPOSITION §III.2) walks through — the outer hop via the spec-anchored peer, the inner hop via this one.

Returns None on any of the four short-circuit arms folded through the underlying three-hop composition: the receiver value carries a YAML type without a get(<field>) navigation surface (serde_yaml::Value::get returns None on scalar arms — string, bool, number, null — that expose no per-key lookup), the requested <field> axis-key is absent from the receiver’s mapping (serde_yaml::Value::get trailing miss), the sub-field value is present but carries a non-sequence YAML type (the trailing .as_sequence() shape-gate short-circuit — a schema-invalid nested- sub-field type per the K8s apiserver’s OpenAPI schema but tolerated here as None so the readback stays a total function), or the sequence is present but empty (the trailing .first() head-selector none-arm — a legally-emitted zero-cardinality sub-block per every routed inner sub-field’s empty arm). The returned &Value borrows into the input Value — the caller decides whether to further- navigate (.get(<KEY>), .as_str(), .as_u64(), .and_then(kube_kind)) or unwrap.

The canonical shape 20 test-side per-spec.<outer>[0].<inner>[0] readback sites in caixa-mesh previously carried inline as the three-line composition

<value>
    .and_then(|v| v.get(<FIELD>))
    .and_then(|v| v.as_sequence())
    .and_then(|s| s.first())
    ...

around a one-token semantic payload (the <FIELD> sub-field axis- key — CILIUM_KEY_TO_PORTS / CILIUM_KEY_PORTS on the per-CNP L4-tuple spec.ingress[0].toPorts[0].ports[0] port-tuple bracket chain, CILIUM_KEY_FROM_ENDPOINTS on the per-CNP source-endpoint selector bracket, CILIUM_KEY_HTTP on the per-CNP L7 HTTP-rule bracket, GATEWAY_API_KEY_BACKEND_REFS on the per-HTTPRoute first-backend bracket, GATEWAY_API_KEY_MATCHES on the per- HTTPRoute first-match bracket). After this lift every routed consumer folds the three-line navigation onto kube_seq_first(<value>, <FIELD>) — the three-hop get → as_sequence → first walk happens once inside the helper, and the caller keeps its downstream continuation idiom (.get(<KEY>), .as_u64(), .and_then(|v| v.as_str()), .and_then(kube_match_labels), .expect(...)) unchanged — the lift closes the navigation surface, not the per-site continuation posture.

Every future nested sub-<field>[0] first-entry readback (the future per-:politicas CiliumClusterwideEnvoyConfig per-policy nested bracket chain, the app-operator’s per-Aplicacao mesh.pleme.io/v1alpha1/Aplicacao CR materializer’s nested spec.entrada.paths[0] / spec.placement.clusters[0] brackets, the future caixa-otel per-Servico OpenTelemetry-Collector CR’s per-receivers.<name>.protocols nested bracket, every future test- side nested-first probe the M3.x + M4 renderer set adds) reaches this same helper by construction — no per-consumer three-hop chain re-inline, no coordinated rewrite across every nested-first bracket on a future serde_yaml surface rebrand or a shift in the head- selector semantics.