Constant CILIUM_KEY_TO_PORTS 

pub const CILIUM_KEY_TO_PORTS: &str = "toPorts";

Canonical Cilium CiliumNetworkPolicy L4/L7 per-ingress-rule port-set container-axis key every cilium_network_policies-emitted CNP document mounts its per-ingress-rule [{ports: […], rules: {…}}] list under (spec.ingress[].toPorts[]). Pairs with the sibling KUBE_KEY_RULES (a205eb3) — the Cilium L7-dispatch schema nests spec.ingress[].toPorts[].rules.http[] under the shared (toPorts, rules) container-key pair, so drift on the toPorts axis is exactly as load-bearing as drift on the rules axis it wraps (the Cilium-operator-side CRD schema validator drops any spec.ingress[] entry whose port-set container carries an unrecognized key — a "toports" / "toPort" / "targetPorts" typo silently emits an ingress rule whose per-port set the Cilium operator’s per-CNP L4/L7 dispatch pass no-ops entirely: every intra-mesh :contratos flow the CNP was authored to allow now drops at the eBPF data plane’s default-deny gate with no field naming the port-set-container-drift root cause).

The single source of truth the rendered Aplicacao Cilium-side mesh bundle’s per-CNP port-set-container-naming axis reaches for:

• the rendered CiliumNetworkPolicy document’s spec.ingress[].toPorts[] axis (caixa-mesh/src/lib.rs:939 — the cilium_network_policies per-(:de, :para) policy’s ingress_rule.insert("toPorts", …) call).

The port-set-container axis names the same Cilium-operator-side per-ingress-rule dispatch container as the sibling KUBE_KEY_RULES nested L7-dispatch container axis and must move together on any future Cilium CRD schema rebrand (an upstream cilium.io/v3 rename of the port-set container from toPorts to ports / portSet / endpoints, coordinated with the Cilium project’s periodic CRD schema-migration passes). Until this lift landed the axis carried an inline toPorts literal at the one production-code occurrence in caixa-mesh/src/lib.rs:939 (the cilium_network_policies ingress_rule.insert("toPorts", …) call) plus a matching set inside the in-file cilium_http_contracts_emit_l7_rules / cilium_pubsub_contracts_skip_l7_rules / cilium_multiple_edges_same_pair_fold_into_one_policy / cnp_authentication_carries_mtls_overlay_at_ingress_rule_level / cnp_l4_fallback_port_routes_through_lifted_default_servico_port test-fixture navigations — six occurrences of the same load-bearing Cilium-CRD-toPorts-container-key convention, drift-prone by construction. A drift on any one production or test-fixture site to "toports" / "toPort" / "targetPorts" would have surfaced as a Cilium-operator-side schema validator drop at apply time (the affected spec.ingress[] entry’s port-set container the CRD schema validator recognizes as unknown), with every intra-mesh :contratos flow the CNP was authored to allow dropping at the eBPF data plane’s default-deny gate with no field naming the container-drift root cause. A drift on the test-fixture side silently masks the emission-side pin (.get("toPorts") returns None under both the drifted-key emitter and the drifted-key probe — the cilium_pubsub_contracts_skip_l7_rules absence pin’s downstream to_ports.get("rules").is_none() assertion succeeds vacuously because to_ports is itself None).

The PRIME DIRECTIVE duplication-budget rule (THEORY.md §I.3.5, “every recurring shape becomes a generator before it becomes a pattern; every pattern becomes a library before it becomes duplicated code. The duplication budget is zero.”) promotes the constant to a typed substrate-side &'static str on the same trajectory the KUBE_KEY_RULES (a205eb3) / CILIUM_KIND_NETWORK_POLICY (eac85cb) / CILIUM_API_VERSION (279d611) lifts established on the sibling canonical-K8s-CR-rule-list-axis / canonical-Cilium-CRD-kind / canonical-Cilium-CRD-apiVersion surfaces — extends the discipline from the outer (apiVersion, kind, spec) shell of the Cilium CNP down through the load-bearing spec.ingress[].toPorts[].rules dispatch axis onto the port-set container half of the (toPorts, rules) L4/L7-dispatch container-key pair, completing the per-CNP L4/L7-dispatch-axis lift pair the M3 Aplicacao mesh renderer’s eBPF data-plane contract rests on. The render-side consumer now threads the same &'static str through its ingress_rule.insert(…) call so a future Cilium-CRD rebrand on the port-set-container axis (or an upstream Cilium project rename to a per-CRD sibling name — unlikely but the same coordination point the prior lifts anchor for) lands in one place; every future renderer that reaches for the canonical per-CNP port-set-container-axis (the future M4 mesh.pleme.io/v1alpha1/Aplicacao CR materializer’s per-Aplicacao CiliumNetworkPolicy fan-out, a future CiliumClusterwideNetworkPolicy renderer that emits cluster-scoped baseline-allow rules with the same spec.ingress[].toPorts[] shape, a future CiliumClusterwideEnvoyConfig renderer whose per-edge Envoy configuration nests under the same port-set container-key convention) inherits the same value by construction with no opportunity for per-renderer drift.

Same “the typed constant lives in one place” discipline the KUBE_KEY_RULES (a205eb3) / CILIUM_KIND_NETWORK_POLICY (eac85cb) / CILIUM_API_VERSION (279d611) lifts apply on the peer canonical-Cilium-CNP-dispatch-axis surface.