Constant CILIUM_KEY_ENDPOINT_SELECTOR 

pub const CILIUM_KEY_ENDPOINT_SELECTOR: &str = "endpointSelector";

Canonical Cilium CiliumNetworkPolicy destination-identity selector- axis key every cilium_network_policies-emitted CNP document mounts its L3-target LabelSelector under (spec.endpointSelector). Pairs with the sibling CILIUM_KEY_TO_PORTS (c8d9cbf) — the Cilium CNP schema pins the destination workload through the endpointSelector axis and the admitted L4 port set through the toPorts axis, so drift on the destination-identity axis is exactly as load-bearing as drift on the port-set-container axis it accompanies (the Cilium- operator-side CRD schema validator drops any spec block whose destination-identity axis carries an unrecognized key — an "endpointselector" / "endpointSelectors" / "endpoints" typo silently emits a CNP whose L3-target selector the Cilium operator’s per-CNP identity-resolution pass no-ops entirely: the policy binds against no destination pods and every intra-mesh :contratos flow the CNP was authored to allow drops at the eBPF data plane’s default-deny gate with no field naming the destination-identity- axis-drift root cause).

The single source of truth the rendered Aplicacao Cilium-side mesh bundle’s per-CNP destination-identity-axis-naming reaches for:

• the rendered CiliumNetworkPolicy document’s spec.endpointSelector axis (caixa-mesh/src/lib.rs:990 — the cilium_network_policies per-(:de, :para) policy’s policy_spec.insert("endpointSelector", …) call).

The destination-identity axis names the same Cilium-operator-side per-CNP L3-target selector as the sibling CILIUM_KEY_TO_PORTS per-ingress-rule port-set-container axis and must move together on any future Cilium CRD schema rebrand (an upstream cilium.io/v3 rename of the destination-identity axis from endpointSelector to endpoints / targetSelector / destinationSelector, coordinated with the Cilium project’s periodic CRD schema-migration passes). Until this lift landed the axis carried an inline endpointSelector literal at the one production-code occurrence in caixa-mesh/src/lib.rs:990 (the cilium_network_policies policy_spec.insert("endpointSelector", …) call) plus a matching set inside the in-file cilium_policy_endpoint_selector_targets_destination_program / cnp_endpoint_selector_carries_program_only_single_axis_shape test- fixture navigations — three occurrences of the same load-bearing Cilium-CRD-endpointSelector-axis-key convention, drift-prone by construction. A drift on any one production or test-fixture site to "endpointselector" / "endpointSelectors" / "endpoints" would have surfaced as a Cilium-operator-side schema validator drop at apply time (the affected spec block’s destination-identity axis the CRD schema validator recognizes as unknown), with every intra- mesh :contratos flow the CNP was authored to allow dropping at the eBPF data plane’s default-deny gate with no field naming the destination-identity-drift root cause. A drift on the test-fixture side silently masks the emission-side pin (.get("endpointSelector") returns None under both the drifted-key emitter and the drifted-key probe — the downstream .and_then(|s| s.get("matchLabels")) chain short-circuits vacuously because the outer selector-lookup is itself None).

The PRIME DIRECTIVE duplication-budget rule (THEORY.md §I.3.5, “every recurring shape becomes a generator before it becomes a pattern; every pattern becomes a library before it becomes duplicated code. The duplication budget is zero.”) promotes the constant to a typed substrate-side &'static str on the same trajectory the CILIUM_KEY_TO_PORTS (c8d9cbf) / KUBE_KEY_RULES (a205eb3) / CILIUM_KIND_NETWORK_POLICY (eac85cb) / CILIUM_API_VERSION (279d611) lifts established on the sibling canonical-Cilium-CNP-dispatch-axis / canonical-Cilium-CRD-kind / canonical-Cilium-CRD-apiVersion surfaces — extends the discipline from the outer (apiVersion, kind, spec) shell of the Cilium CNP and the per-ingress-rule toPorts.rules L4/L7-dispatch axis onto the destination-identity half of the (endpointSelector, ingress) per-CNP-body key pair, completing the per-CNP L3/L4/L7-triad lift set the M3 Aplicacao mesh renderer’s eBPF data-plane contract rests on. The render-side consumer now threads the same &'static str through its policy_spec.insert(…) call so a future Cilium-CRD rebrand on the destination-identity axis (or an upstream Cilium project rename to a per-CRD sibling name — unlikely but the same coordination point the prior lifts anchor for) lands in one place; every future renderer that reaches for the canonical per-CNP destination-identity-axis (the future M4 mesh.pleme.io/v1alpha1/Aplicacao CR materializer’s per-Aplicacao CiliumNetworkPolicy fan-out, a future CiliumClusterwideNetworkPolicy renderer that emits cluster-scoped baseline-allow rules with the same spec.endpointSelector shape, a future CiliumLocalRedirectPolicy renderer whose per-Servico local- redirect selector nests under the same destination-identity axis convention) inherits the same value by construction with no opportunity for per-renderer drift.

Same “the typed constant lives in one place” discipline the CILIUM_KEY_TO_PORTS (c8d9cbf) / KUBE_KEY_RULES (a205eb3) / CILIUM_KIND_NETWORK_POLICY (eac85cb) / CILIUM_API_VERSION (279d611) lifts apply on the peer canonical-Cilium-CNP-body-axis surface.