Function cilium_auth_mode 

pub fn cilium_auth_mode(required: bool) -> &'static str

Canonical bool → &'static str bijection projection every consumer of the Cilium CiliumNetworkPolicy MutualAuthenticationMode OpenAPI schema enum’s closed-set author-reachable scalar-value pair (CILIUM_AUTH_MODE_REQUIRED / CILIUM_AUTH_MODE_DISABLED) consults so the per-tristate-arm dispatch — Some(true) (mTLS handshake mandatory) → CILIUM_AUTH_MODE_REQUIRED, Some(false) (mTLS handshake skipped, explicit opt-out) → CILIUM_AUTH_MODE_DISABLED — lives in exactly one place. The two arms of the :politicas :mtls-required tristate’s non-None value-space each land on a distinct MutualAuthenticationMode scalar; the None slot-absent arm is the caller’s single_field_overlay emission-gate concern (the helper returns None and the outer authentication: block is omitted entirely), not this projection’s — see the per-emit-site if let Some(overlay) = mtls_overlay { rule.insert(CILIUM_KEY_AUTHENTICATION, overlay.clone()) } guard.

The single source of truth the rendered Aplicacao Cilium-CNP-side per-edge mutual-auth-mode-discriminator scalar-value dispatch reaches for:

• the rendered CiliumNetworkPolicy document’s per-rule spec.ingress[].authentication.mode leaf value (caixa-mesh/src/lib.rs — the cilium_network_policies per-(:de, :para) single_field_overlay(spec.politicas.mtls_required, CILIUM_KEY_MODE, |required| serde_yaml::Value::String(cilium_auth_mode(required).into())) closure body).
• the generic-helper pin in this crate’s single_field_overlay_threads_typed_value_through_closure test that mirrors the production overlay’s shape letter-for-letter and now threads through the same shared projection.

The PRIME DIRECTIVE duplication-budget rule (THEORY.md §I.3.5, “every recurring shape becomes a generator before it becomes a pattern; every pattern becomes a library before it becomes duplicated code. The duplication budget is zero.”) promotes the per-tristate-arm dispatch body onto a shared projection on the same trajectory the sibling CILIUM_AUTH_MODE_REQUIRED / CILIUM_AUTH_MODE_DISABLED closed-set-scalar-value lifts established for the two arms of the same MutualAuthenticationMode enum — closes the pair of related lift trajectories the (value-space, arm-dispatch) per-authn-block leaf’s canonical decomposition rests on. The prior inline if required { CILIUM_AUTH_MODE_REQUIRED } else { CILIUM_AUTH_MODE_DISABLED } body split across the two occurrences — the caixa-mesh production emitter’s closure and the caixa-core generic-helper pin’s closure — would have let a per-arm reassignment (e.g. an upstream Cilium v3 schema rename swap of the required ↔ disabled scalars, or the addition of a third MutualAuthenticationMode variant that reshapes the closed set) drift on one closure body but not the peer, silently letting a Cilium data-plane pod either enforce mTLS where the author asked for skip or skip it where the author asked for enforce.

Pairs with the CILIUM_KEY_MODE per-authentication-block mode- discriminator leaf-axis key at the caller’s single_field_overlay(spec.politicas.mtls_required, CILIUM_KEY_MODE, |required| serde_yaml::Value::String(cilium_auth_mode(required).into())) call: the key is the field name the leaf mounts under, this projection is the scalar the leaf carries. Same-shape peer to the K8s core Protocol closed-set enum’s future bool → {"TCP", "UDP"} / K8s Gateway API v1 PathMatchType closed-set enum’s future variant- pick projections the M3.x absorption roadmap acknowledges — the M3 mesh renderer’s MutualAuthenticationMode bijection surface is the first landed instance of the canonical (closed-set-CRD-schema-enum- value pair, per-typed-arm dispatch projection) compound.