Function kube_spec_seq_first 

pub fn kube_spec_seq_first<'a>(
    value: &'a Value,
    field: &str,
) -> Option<&'a Value>

Read the first entry of the sub-spec.<field>[] YAML sequence on a K8s custom resource YAML document as Option<&serde_yaml::Value> — the composed first-entry-arity accessor peer that stands on the composed sequence-arity kube_spec_seq_field (fc64ed7) accessor, folding the trailing .and_then(|s| s.first()) head-of-sequence closure into the helper for callers that always want the first entry (the canonical “there is exactly one” pin every emit-side per-CR sequence-shaped body-sub-field carries — spec.ingress[0] on the CiliumNetworkPolicy per-:contratos L4/L7 rule-set (each emitted CiliumNetworkPolicy carries exactly one ingress rule bracketing one (from, toPorts) pair — MESH-COMPOSITION §III.2), spec.parentRefs[0] on the Gateway API HTTPRoute per-:entrada parent-Gateway pin, spec.listeners[0] on the Gateway API Gateway per-:entrada HTTP-listener pin, spec.rules[0] on the Gateway API HTTPRoute per-rule fan-out first-rule pin, spec.healthChecks[0] on the Flux v2 Kustomization first-health- check pin). Structural mirror of the sibling composed-shape-gate accessors on the same sub-spec.<field> axis (kube_spec_str_field, kube_spec_seq_field, kube_spec_map_field) that fold a trailing shape-gate closure onto kube_spec_field; where those three close .as_str() / .as_sequence() / .as_mapping() shape gates onto the two-hop spec → sub-field navigation, this closes the sequence-head .first() head-selector onto the three-hop spec → sub-field → as_sequence navigation. Stays parametric on the per-<field> sub-field axis-key for the same reason the sibling accessors do — the K8s API-machinery admits an open-ended per-CR body-sub-field surface, and pinning a specific <field> would foreclose reuse across the sub-field set on the per-CR body.

Returns None on any of the five short-circuit arms folded through the underlying composition: the outer spec: block is absent (the kube_spec outer-arm short-circuit), the spec: value is present but carries a non-Mapping YAML type (the kube_spec shape-gate short-circuit), the requested sub-field <field> axis-key is absent from the spec: sub-mapping (the kube_spec_field trailing Mapping::get none-arm), the sub-field value is present but carries a non-sequence YAML type (the kube_spec_seq_field trailing .as_sequence() shape-gate short-circuit — a schema- invalid per-CR body-sub-field type per the K8s apiserver’s OpenAPI schema but tolerated here as None so the readback stays a total function), or the sequence is present but empty (the trailing .first() head-selector none-arm — a legally-emitted empty sub-block per every routed sub-field’s zero-cardinality arm, but folded here to the same None verdict every caller downstream treats it as). The returned &Value borrows into the input Value — the caller decides whether to look up a nested key (.get(<KEY>)), further-shape-gate (.as_mapping(), .as_str()), or commit (.expect(...)).

The canonical shape 25 caixa-mesh + 1 caixa-flux test-side per-CR first-entry readback sites previously carried inline as the three- token composition

kube_spec_seq_field(<value>, <FIELD>)
    .and_then(|s| s.first())
    ...

around a one-token semantic payload (the <FIELD> sub-field axis- key — CILIUM_KEY_INGRESS on the per-CNP first-ingress-rule pin, GATEWAY_API_KEY_PARENT_REFS on the per-HTTPRoute first-parent- Gateway pin, GATEWAY_API_KEY_LISTENERS on the per-Gateway first-listener pin, KUBE_KEY_RULES on the per-HTTPRoute first- rule pin, FLUX_KEY_HEALTH_CHECKS on the per-Kustomization first- health-check pin). After this lift, every routed consumer folds the three-hop-plus-head-selector navigation onto kube_spec_seq_first(<value>, <FIELD>) — the outer spec → as_mapping → get(<field>) → as_sequence → first walk happens once inside the helper, and the caller keeps its downstream idiom (.and_then(|i| i.get(<SUB_KEY>)), .and_then(kube_kind), .expect(...)) unchanged — the lift closes the navigation surface, not the per-site continuation posture.

Every future per-CR first-entry readback (the future per-:politicas CiliumClusterwideEnvoyConfig emitter’s per-policy first-rule pin, MESH-COMPOSITION §III.2 #3; the app-operator’s per-Aplicacao mesh.pleme.io/v1alpha1/Aplicacao CR materializer’s first-membros / first-contratos pin, §III.2 #5; the future caixa-otel per- Servico OpenTelemetry-Collector CR’s first-receivers pin; every future test-side spec.<field>[0] first-entry probe the M3.x + M4 renderer set adds) reaches this same helper by construction — no per-consumer three-hop-plus-head-selector chain re-inline, no per- consumer KUBE_KEY_SPEC axis-key drift, no coordinated rewrite across every per-CR body-sub-field first-entry readback on a future K8s API-machinery rebrand of the top-level spec: axis.