Constant CILIUM_AUTH_MODE_DISABLED 

pub const CILIUM_AUTH_MODE_DISABLED: &str = "disabled";

Canonical Cilium CiliumNetworkPolicy MutualAuthenticationMode OpenAPI schema enum’s disabled per-ingress[].authentication.mode mTLS-skipped scalar-value every cilium_network_policies-emitted CNP document declares under its per-rule mutual-auth-mode-discriminator leaf axis when the typed :politicas :mtls-required tristate is the explicit Some(false) opt-out arm (an author who named the axis and asked for the mTLS handshake to be skipped on this Aplicacao’s edges — e.g. a debug or legacy-bridge Aplicacao that needs to talk to non-mesh peers, distinct from the None slot-absent arm the renderer maps to omit-the-block-entirely). Peer to the sibling CILIUM_AUTH_MODE_REQUIRED mTLS-mandatory scalar-value the Some(true) affirmative arm emits under the same tristate branch — the Cilium CNP MutualAuthenticationMode OpenAPI schema enum admits the two arms as a matched author-reachable pair.

The single source of truth the rendered Aplicacao Cilium-CNP-side per-edge mutual-auth-mode-discriminator negative-value-naming reaches for:

• the rendered CiliumNetworkPolicy document’s per-rule spec.ingress[].authentication.mode leaf value (caixa-mesh/src/lib.rs — the cilium_network_policies per-(:de, :para) single_field_overlay(spec.politicas.mtls_required, CILIUM_KEY_MODE, |required| …) closure’s else { … } arm the prior inline "disabled".into() literal sat at, plus the cnp_explicit_mtls_required_false_emits_disabled_mode test-fixture probe that pins the explicit-opt-out arm’s rendered value).

Same drift-mode risk as the sibling CILIUM_AUTH_MODE_REQUIRED pin: a "Disabled" / "DISABLED" / "off" / "skip" typo lands outside the Cilium CNP MutualAuthenticationMode OpenAPI schema enum’s admitted set; the rendered per-(:de, :para) CiliumNetworkPolicy object never reaches the Cilium agent’s per-rule mutual-auth-block schema validator’s admitted set and the author’s explicit-opt-out intent silently collapses onto the cluster-default authentication mode (typically also “disabled” today, but environment-divergent — take effect) with no field naming the mTLS- skipped-scalar-value-drift root cause.

The PRIME DIRECTIVE duplication-budget rule (THEORY.md §I.3.5, “every recurring shape becomes a generator before it becomes a pattern; every pattern becomes a library before it becomes duplicated code. The duplication budget is zero.”) promotes the constant to a typed substrate- side &'static str on the same trajectory the sibling CILIUM_AUTH_MODE_REQUIRED mTLS-mandatory scalar-value lift establishes on the affirmative arm of the same MutualAuthenticationMode enum — completes the per-authn-block (mode → {required, disabled}) leaf-axis / author-reachable-scalar-value-pair single-sourcing the M3 Aplicacao mesh renderer’s SPIFFE-identity-bound per-edge mTLS enforcement + explicit- opt-out contract rests on across the two arms of the :politicas :mtls-required tristate.