Constant KUBE_PROTOCOL_TCP 

pub const KUBE_PROTOCOL_TCP: &str = "TCP";

Canonical K8s core Protocol OpenAPI schema enum’s TCP L4-transport- protocol scalar value every cilium_network_policies-emitted CiliumNetworkPolicy document’s per-spec.ingress[].toPorts[].ports[] port-tuple declares under its per-tuple KUBE_KEY_PROTOCOL axis. Pairs with the sibling KUBE_KEY_PROTOCOL (0307950) per-CR L4/L7 protocol-scalar-discriminator container-axis key the value nests directly under — the K8s core Protocol schema pins per-ContainerPort / ServicePort / EndpointPort / NetworkPolicyPort L4-transport selection through the protocol scalar (each port entry names one L4-transport-protocol discriminator the CNI / kube-proxy / eBPF-data- plane bpf policy dispatch loop keys off before applying the port match; the K8s core Protocol OpenAPI schema enum admits the closed set {"TCP", "UDP", "SCTP"} verbatim — see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1/#protocol-v1-core), so drift on the L4-transport-protocol value is exactly as load-bearing as drift on the sibling GATEWAY_API_PROTOCOL_HTTP (1b57473) per- listener L7-parser-selection scalar value the peer Gateway-API v1 ProtocolType OpenAPI schema enum admits under the same KUBE_KEY_PROTOCOL container-axis key (a "tcp" / "Tcp" / "TCP/IP" / "transport-tcp" typo at the production-code call site lands outside the K8s core Protocol OpenAPI schema enum’s admitted set, surfacing apply-side as a non-self-locating “spec.ingress[0].toPorts[0].ports[0].protocol: Unsupported value: "tcp": supported values: "SCTP", "TCP", "UDP"” apiserver admission-rejection far from the source caixa.lisp / the renderer’s port_entry.insert(…) call site — the rendered per-(:de, :para) CiliumNetworkPolicy object never reconciles at the Cilium operator’s per-CNP L4 dispatch pass and every intra-mesh :contratos L4-tuple- gated flow drops at the Cilium operator’s admission gate with no field naming the L4-transport-protocol-drift root cause; worse — because the protocol scalar carries a schema-side default of TCP on the K8s core Protocol enum, a silently-elided drift on the emit lands a CiliumNetworkPolicy whose ingress rule falls back to the default L4- transport-protocol and every port-match on a non-default transport silently misses at the eBPF data plane’s per-tuple dispatch).

The single source of truth the rendered Aplicacao Cilium-CNP-side intra-mesh L4-tuple-gating bundle’s per-toPorts[].ports[] port-tuple L4-transport-protocol-discriminator-value-naming reaches for:

• the rendered CiliumNetworkPolicy document’s per-tuple spec.ingress[].toPorts[].ports[].protocol axis (caixa-mesh/src/lib.rs — the cilium_network_policies per-(:de, :para) port_entry.insert(KUBE_KEY_PROTOCOL, "TCP") call the prior inline "TCP".into() literal sat at).

The L4-transport-protocol value names the same K8s-core-Protocol- enum-side per-port-tuple L4-transport-selection discriminator as the sibling KUBE_KEY_PROTOCOL key-axis discriminator carries the value under, and must move together with the sibling K8s core Protocol OpenAPI schema enum on any future K8s core Protocol rebrand (an upstream K8s core Protocol rename or extension — e.g. the KEP-3675 QUIC transport proposal’s "QUIC" addition to the enum, coordinated with the upstream SIG-Network per-version deprecation cycle — would land at this one const rather than scattered across every per-emitter L4-port-block-insertion site).

The PRIME DIRECTIVE duplication-budget rule (THEORY.md §I.3.5, “every recurring shape becomes a generator before it becomes a pattern; every pattern becomes a library before it becomes duplicated code. The duplication budget is zero.”) promotes the constant to a typed substrate-side &'static str on the same trajectory the GATEWAY_API_PROTOCOL_HTTP (1b57473) / GATEWAY_API_PATH_MATCH_TYPE_PATH_PREFIX (530705d) / GATEWAY_API_KIND_GATEWAY (fb4639c) / GATEWAY_API_KIND_HTTP_ROUTE (1adccc0) / DEFAULT_GATEWAY_CLASS_NAME (d9b0743) lifts established on the sibling per-listener L7-parser-selection scalar-value + per-match path-selection-predicate discriminator-value + Gateway-API-CRD- kind-discriminator + Gateway-controller-binding scalar-value axes — extends the canonical-cluster-side-OpenAPI-schema-enum-value single- sourcing discipline the Gateway-API v1 ProtocolType.HTTP / PathMatchType.PathPrefix lifts established onto the sibling K8s-core Protocol.TCP per-port-tuple L4-transport-protocol- discriminator the cilium_network_policies intra-mesh L4-tuple-gating emitter carries under the shared CiliumNetworkPolicy body.

A future Cilium-CNP-side / K8s-core-Protocol-side renderer the M3.x absorption roadmap names — a sibling KUBE_PROTOCOL_UDP / KUBE_PROTOCOL_SCTP const value the same Protocol enum admits, the future M4 mesh.pleme.io/v1alpha1/Aplicacao materializer’s per- Aplicacao multi-transport fan-out over {TCP, UDP, SCTP} for nats:pub-sub / wasi:sockets/udp contratos, a future per-contrato :transport <TCP|UDP|SCTP> typed slot admitting a per-edge transport- protocol axis — inherits the canonical TCP L4-transport-protocol value by construction with no opportunity for per-renderer drift.