Constant CILIUM_KIND_NETWORK_POLICY 

pub const CILIUM_KIND_NETWORK_POLICY: &str = "CiliumNetworkPolicy";

Canonical Cilium CRD kind discriminator the rendered CiliumNetworkPolicy document declares at its top-level KUBE_KEY_KIND axis. Pairs with the sibling CILIUM_API_VERSION (279d611) — the K8s apiserver-side CRD resolution contract is the (apiVersion, kind) tuple keyed against the registered CustomResourceDefinition, so drift on the kind axis is exactly as load-bearing as drift on the apiVersion axis it accompanies (the apiserver’s RESTMapper consults both together; a ("cilium.io/v2", "CilumNetworkPolicy") typo at the production-code call site lands outside the registered Cilium-operator-side CiliumNetworkPolicy CRD’s RESTKind lookup, surfacing apply-side as a non-self-locating “no kind ‘CilumNetworkPolicy’ is registered for version ‘cilium.io/v2’” error far from the source caixa.lisp / the renderer’s kube_resource_skeleton call site).

The single source of truth the rendered Aplicacao Cilium-side mesh bundle’s CiliumNetworkPolicy-naming axis reaches for:

• the rendered CiliumNetworkPolicy document’s top-level KUBE_KEY_KIND axis (caixa-mesh/src/lib.rs:382 — the cilium_network_policies per-(:de, :para) policy kube_resource_skeleton call).

The kind axis names the same Cilium-operator-side CRD discriminator as the sibling CILIUM_API_VERSION apiVersion axis and must move together on any future cilium.io/v3 rebrand. Until this lift landed the axis carried an inline CiliumNetworkPolicy literal at the one production-code occurrence in caixa-mesh/src/lib.rs:382 (the cilium_network_policies kube_resource_skeleton kind argument) plus a matching set inside the in-file cilium_policy_carries_canonical_kube_skeleton / render_all_includes_every_artifact_kind / cilium_policy_metadata_block_iterates_alphabetically test fixtures — occurrences of the same load-bearing Cilium-CRD-kind-discriminator convention, drift-prone by construction. A drift on the top-level CiliumNetworkPolicy kind axis would have surfaced as a non-self-locating “no kind ‘CilumNetworkPolicy’ is registered for version ‘cilium.io/v2’” error far from the source caixa.lisp at apply parse time, with the rendered per-(:de, :para) CNP never landing in the Cilium-operator-side CRD registration and every intra-mesh L4/L7 contrato flow dropping at the eBPF data plane with no field naming the kind-discriminator-drift root cause.

The PRIME DIRECTIVE duplication-budget rule (THEORY.md §I.3.5, “every recurring shape becomes a generator before it becomes a pattern; every pattern becomes a library before it becomes duplicated code. The duplication budget is zero.”) promotes the constant to a typed substrate-side &'static str on the same trajectory the FLUX_KIND_KUSTOMIZATION (4114773) / FLUX_KIND_HELM_RELEASE (e24ea3c) / FLUX_KIND_GIT_REPOSITORY (dbbcf29) / CILIUM_API_VERSION (279d611) / GATEWAY_API_API_VERSION (3c6cfc3) lifts established on the sibling cluster-side-CRD-kind-discriminator + canonical-CRD- group/version axes — extends the discipline from the apiVersion half of the (apiVersion, kind) CRD-lookup tuple onto the kind half on the same Cilium-CRD-axis, completing the per-Cilium-CRD kind+apiVersion lift pair the M3 Aplicacao mesh renderer’s eBPF data-plane contract rests on. The render-side consumer now threads the same &'static str through its kube_resource_skeleton call so a future cilium.io/v3 rebrand lands in one place; every future renderer that reaches for the canonical Cilium CiliumNetworkPolicy kind (the future M4 mesh.pleme.io/v1alpha1/Aplicacao CR materializer’s per-Aplicacao CiliumNetworkPolicy fan-out, a future per-cluster baseline-allow / baseline-deny renderer that emits the peer CiliumClusterwideNetworkPolicy, a future per-Servico local-redirect renderer that emits the peer CiliumLocalRedirectPolicy) inherits the same value by construction with no opportunity for per-renderer drift.

Same “the typed constant lives in one place” discipline the FLUX_KIND_KUSTOMIZATION (4114773) / FLUX_KIND_HELM_RELEASE (e24ea3c) / FLUX_KIND_GIT_REPOSITORY (dbbcf29) / CILIUM_API_VERSION (279d611) / GATEWAY_API_API_VERSION (3c6cfc3) / DEFAULT_FLUX_SYSTEM_NAMESPACE (7197d38) lifts apply on the peer canonical-cluster-side-CRD-discriminator surface.