Crate caixa_mesh

Expand description

caixa-mesh — typed renderer that emits cluster mesh primitives from an :kind Aplicacao caixa.

See theory/MESH-COMPOSITION.md for the design frame: a typed Aplicacao composes Servicos into a graph with WIT-typed contracts, mesh policies, and explicit placement. caixa-mesh is the renderer that turns that typed graph into the cluster-side primitives:

programs.yaml fan-out — one entry per :membros, consumed by lareira-fleet-programs (V0; this crate)
Cilium NetworkPolicy — one per distinct :contratos (:de, :para) pair, identity-based L7 allow-list (M3.x next)
Gateway + HTTPRoute — one per :entrada, K8s Gateway API external ingress (M3.x next)

Same caixa-<target> naming convention as [caixa_helm] + [caixa_flux]: a typed renderer that takes a typed Caixa and emits the canonical source for <target>.

V0 contract:

use caixa_core::Caixa;
use caixa_mesh::programs_for_aplicacao;

let aplicacao: Caixa = Caixa::from_lisp(src)?;
let entries: Vec<serde_yaml::Value> = programs_for_aplicacao(&aplicacao)?;
// → one entry per :membros, suitable for fan-out into the
//   cluster's lareira-fleet-programs HelmRelease.

Enums§

Error: Errors caixa-mesh can raise.

Constants§

CILIUM_API_VERSION: Canonical Cilium CRD apiVersion every cilium_network_policies- emitted CiliumNetworkPolicy document declares. Re-export of the canonical caixa_core::CILIUM_API_VERSION so the Cilium-CRD- group/version string lives in exactly one place across every caixa renderer — caixa-mesh’s cilium_network_policies per-(:de, :para) CiliumNetworkPolicy emitter (the single production-code site the prior inline literal sat at, caixa-mesh/src/lib.rs:326) and every future per-policy CiliumClusterwideNetworkPolicy / CiliumLocalRedirectPolicy emitter the M3.x absorption roadmap acknowledges now consult the same &'static str, so a future Cilium-CRD-group/version promotion (the upstream Cilium roadmap names per-CRD-group / per-version migration once the cilium.io/v3 branch lands) is a one-line edit on the canonical caixa_core::CILIUM_API_VERSION declaration, not a coordinated rewrite across this crate’s kube_resource_skeleton call site + every future per-target renderer the substrate adds. The prior inline literal would have let a Cilium-CRD bump on one axis without a coordinated edit on the matching in-file cilium_policy_carries_canonical_kube_skeleton test fixture pin (caixa-mesh/src/lib.rs:1560) silently emit a CiliumNetworkPolicy whose top-level apiVersion drifts off the lifted-test-fixture pin — apply-side: the policy lands in a stale apiserver-side CRD-version registration the Cilium operator no longer watches, every (:de, :para) intra-mesh L4 contract drops at the eBPF data plane with no field naming the version-drift root cause. Peer to the GATEWAY_API_API_VERSION re-export on the sibling canonical-K8s-Gateway-API-CRD-axis — extends the discipline onto the canonical-Cilium-CRD-axis surface. Canonical Cilium CRD apiVersion every caixa-mesh-emitted CiliumNetworkPolicy document declares. The Cilium control plane’s upstream-shipped CRD bundle registers CiliumNetworkPolicy, CiliumClusterwideNetworkPolicy, CiliumEndpoint, CiliumIdentity, CiliumNode, CiliumLocalRedirectPolicy, and the rest of the per-conformance Cilium CRD set at this exact group/version (cilium.io/v2); drift to a stale v2alpha1 (the historical pre-stable Cilium-CRD-group/version label upstream Cilium-CRD docs reference for in-flight per-CRD-version migration) silently routes the rendered CiliumNetworkPolicy outside the cluster’s Cilium-operator-side CRD-version registration and breaks at apply time with a non-self-locating “no kind ‘CiliumNetworkPolicy’ is registered for version ‘cilium.io/v2alpha1’” error far from the source caixa.lisp / the renderer’s kube_resource_skeleton call site.
CILIUM_AUTH_MODE_DISABLED: Canonical Cilium CiliumNetworkPolicy MutualAuthenticationMode OpenAPI schema enum’s disabled mTLS-skipped per-ingress[].authentication.mode scalar-value every cilium_network_policies-emitted CNP document declares under the explicit Some(false) opt-out arm of the typed :politicas :mtls-required tristate (distinct from the None slot-absent arm the renderer maps to omit-the-block-entirely). Re-export of the canonical caixa_core::CILIUM_AUTH_MODE_DISABLED so the Cilium-agent-side per-rule mutual-auth-skipped scalar-value string lives in exactly one place across every caixa renderer — caixa-mesh’s cilium_network_policies per-(:de, :para) CiliumNetworkPolicy emitter (the single-field-overlay closure’s else { … } opt-out arm the prior inline "disabled" literal sat at, plus the cnp_explicit_mtls_required_false_emits_disabled_mode test- fixture probe that pins the emitted value under the explicit-opt-out shape) and every future per-Cilium-side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str. Peer to the sibling CILIUM_AUTH_MODE_REQUIRED re-export on the affirmative arm of the same tristate. Canonical Cilium CiliumNetworkPolicy MutualAuthenticationMode OpenAPI schema enum’s disabled per-ingress[].authentication.mode mTLS-skipped scalar-value every cilium_network_policies-emitted CNP document declares under its per-rule mutual-auth-mode-discriminator leaf axis when the typed :politicas :mtls-required tristate is the explicit Some(false) opt-out arm (an author who named the axis and asked for the mTLS handshake to be skipped on this Aplicacao’s edges — e.g. a debug or legacy-bridge Aplicacao that needs to talk to non-mesh peers, distinct from the None slot-absent arm the renderer maps to omit-the-block-entirely). Peer to the sibling CILIUM_AUTH_MODE_REQUIRED mTLS-mandatory scalar-value the Some(true) affirmative arm emits under the same tristate branch — the Cilium CNP MutualAuthenticationMode OpenAPI schema enum admits the two arms as a matched author-reachable pair.
CILIUM_AUTH_MODE_REQUIRED: Canonical Cilium CiliumNetworkPolicy MutualAuthenticationMode OpenAPI schema enum’s required mTLS-mandatory per-ingress[].authentication.mode scalar-value every cilium_network_policies-emitted CNP document declares under the :mtls-required t affirmative arm of the typed :politicas :mtls-required tristate. Re-export of the canonical caixa_core::CILIUM_AUTH_MODE_REQUIRED so the Cilium-agent-side per-rule mutual-auth-mandatory scalar-value string lives in exactly one place across every caixa renderer — caixa-mesh’s cilium_network_policies per-(:de, :para) CiliumNetworkPolicy emitter (the single-field-overlay closure’s if required { … } affirmative arm the prior inline "required" literal sat at, plus the presence / fan-out / pubsub-carry-overlay-too test-fixture probes that pin the emitted value under the :mtls-required t shape) and every future per-Cilium-side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str. Peer to the sibling CILIUM_AUTH_MODE_DISABLED re-export on the explicit-opt-out arm of the same tristate — completes the per-authn-block (mode → {required, disabled}) author-reachable-scalar-value-pair re-export pair this crate’s cilium_network_policies renderer’s SPIFFE-identity-bound per-edge mTLS enforcement + explicit-opt-out contract rests on. Canonical Cilium CiliumNetworkPolicy MutualAuthenticationMode OpenAPI schema enum’s required per-ingress[].authentication.mode mTLS-mandatory scalar-value every cilium_network_policies-emitted CNP document declares under its per-rule mutual-auth-mode-discriminator leaf axis when the typed :politicas :mtls-required tristate is Some(true). Pairs with the sibling CILIUM_KEY_MODE (4289dfb) per-authn-block mode-discriminator leaf-axis key the value nests directly under, and the sibling CILIUM_AUTH_MODE_DISABLED scalar-value the Some(false) opt-out arm of the same tristate emits — the Cilium CNP MutualAuthenticationMode OpenAPI schema enum admits the closed set {"required", "disabled", "test-always- fail"} verbatim (the test-always-fail arm is an infrastructure-side debugging surface, not an author-reachable slot), so drift on the mTLS- mandatory scalar-value is exactly as load-bearing as drift on the sibling per-authn-block mode-discriminator leaf axis it nests under (a "Required" / "REQUIRED" / "mandatory" / "mtls-required" typo at either the production-code call site or a downstream probe lands outside the Cilium CNP MutualAuthenticationMode OpenAPI schema enum’s admitted set, surfacing apply-side as a Cilium-agent per-rule mutual-auth-block schema- validator drop far from the source caixa.lisp / the renderer’s single_field_overlay(mtls_required, CILIUM_KEY_MODE, …) call site — the rendered per-(:de, :para) CiliumNetworkPolicy object never enforces per-edge SPIFFE-identity-bound mutual-auth at the Cilium data-plane’s per- rule handshake gate and every intra-mesh :contratos flow the CNP was authored to protect with per-edge mTLS silently bypasses the handshake at the Cilium data-plane’s default-authentication mode with no field naming the mTLS-mandatory-scalar-value-drift root cause).
CILIUM_KEY_AUTHENTICATION: Canonical Cilium CiliumNetworkPolicy per-ingress-rule mutual-auth policy body-axis key every cilium_network_policies-emitted CNP document mounts its per-rule mTLS enforcement block under (spec.ingress[].authentication). Re-export of the canonical caixa_core::CILIUM_KEY_AUTHENTICATION so the Cilium-operator- side per-ingress-rule mutual-auth-axis-key string lives in exactly one place across every caixa renderer — caixa-mesh’s cilium_network_policies per-(:de, :para) CiliumNetworkPolicy emitter (the ingress_rule.insert("authentication", …) call in the :politicas :mtls-required overlay emit gate the prior inline "authentication" literal sat at) and every future per-Cilium- side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str, so a future Cilium-CRD rebrand on the per-ingress-rule mutual-auth axis (unlikely on the CRD’s stable cilium.io/v2 slot, but the coordination point the prior CILIUM_KEY_PORTS + CILIUM_KEY_FROM_ENDPOINTS + CILIUM_KEY_ENDPOINT_SELECTOR + CILIUM_KEY_INGRESS + CILIUM_KEY_TO_PORTS + caixa_core::KUBE_KEY_RULES + CILIUM_KIND_NETWORK_POLICY + CILIUM_API_VERSION re-exports anchor on the sibling per-CNP-body axis surface) lands in one place. The prior inline literal split across the one production emitter and nine test-fixture navigation sites (the presence pin under the :mtls-required t overlay, the absence pin under the :mtls-required unset semantic, the explicit-false-emits- disabled-mode pin under the Some(false) arm, the fan-out pin across multiple contratos, the rule-level-not-nested position pin with two nested-under-fromEndpoints[] and nested-under- toPorts[] negative-navigation guards, the pubsub-carry-overlay- too shape pin, and the yaml-string-scalar mode-value pin) would have let a Cilium-CRD mutual-auth-axis rebrand or a per-emitter typo ("auth" / "mutualAuth" / "mtls" / "authPolicy") at any one site silently emit a per-ingress[] entry whose mutual- auth-axis the Cilium CRD schema validator drops as unknown; the ingress rule falls back to the cluster-default authentication mode and every intra-mesh :contratos flow the CNP was authored to protect with per-edge SPIFFE-identity-bound mutual-auth silently bypasses the mTLS handshake at the Cilium data-plane’s default-authentication mode with no field naming the mutual- auth-axis-drift root cause. On the test-fixture side the drift silently masks the emission-side pin (.get("authentication") returns None under both the drifted emitter and the drifted probe — every downstream .and_then(|a| a.get("mode")) chain short-circuits vacuously because the outer mutual-auth-body-lookup is itself None). Peer to the CILIUM_KEY_FROM_ENDPOINTS + CILIUM_KEY_TO_PORTS re-exports on the sibling per-ingress-rule-body-axis surfaces — completes the per-ingress-rule-body triple (fromEndpoints, toPorts, authentication) this crate’s cilium_network_policies renderer’s SPIFFE-identity-bound per- edge mTLS contract rests on. Canonical Cilium CiliumNetworkPolicy per-ingress-rule mutual-auth policy body-axis key every cilium_network_policies-emitted CNP document mounts its per-rule mTLS enforcement block under (spec.ingress[].authentication). Sibling to CILIUM_KEY_FROM_ENDPOINTS (ecfa557) + CILIUM_KEY_TO_PORTS (c8d9cbf) at the per-ingress-rule body level — the Cilium CNP schema places the per-rule mutual-auth mode ({mode: required | disabled}) at the ingress-rule axis alongside the identity-source (fromEndpoints) and port-set (toPorts) axes, so drift on the authentication axis is exactly as load-bearing as drift on the sibling per-ingress-rule-body axes it pairs with (the Cilium-operator-side CRD schema validator drops any per-ingress[] entry whose mutual-auth axis carries an unrecognized key — a "auth" / "mutualAuth" / "mtls" typo silently emits a CNP whose per-(:de, :para) per-rule mTLS block the Cilium operator’s per-CNP mutual-auth SPIFFE-handshake pipeline no-ops entirely: the ingress rule falls back to the cluster-default authentication mode (typically "disabled" — no mutual-auth enforcement), and every intra-mesh :contratos flow the CNP was authored to protect with per-edge mTLS silently bypasses the SPIFFE-identity-bound mutual-auth handshake with no field naming the mutual-auth-axis-drift root cause).
CILIUM_KEY_ENDPOINT_SELECTOR: Canonical Cilium CiliumNetworkPolicy per-CNP-body destination- identity selector-axis key every cilium_network_policies-emitted CNP document mounts its L3-target LabelSelector under (spec.endpointSelector). Re-export of the canonical caixa_core::CILIUM_KEY_ENDPOINT_SELECTOR so the Cilium-operator- side per-CNP destination-identity-axis string lives in exactly one place across every caixa renderer — caixa-mesh’s cilium_network_policies per-(:de, :para) CiliumNetworkPolicy emitter (the policy_spec.insert("endpointSelector", …) call the prior inline "endpointSelector" literal sat at) and every future per-Cilium-side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str, so a future Cilium-CRD rebrand on the destination-identity axis (unlikely on the CRD’s stable cilium.io/v2 slot, but the coordination point the prior CILIUM_KEY_TO_PORTS + caixa_core::KUBE_KEY_RULES + CILIUM_KIND_NETWORK_POLICY + CILIUM_API_VERSION re-exports anchor on the sibling per-CNP-body axis surface) lands in one place. The prior inline literal split across the one production emitter and two test-fixture navigation sites (destination-endpointSelector retrieval whose downstream navigation chains ride through the same axis-key) would have let a Cilium-CRD destination-identity axis rebrand or a per-emitter typo ("endpointselector" / "endpointSelectors" / "endpoints") at any one site silently emit a CNP whose destination-identity axis the Cilium CRD schema validator drops as unknown; the policy binds against no destination pods and every intra-mesh :contratos flow the affected CNP was authored to allow drops at the eBPF data plane’s default-deny gate with no field naming the destination-identity-drift root cause, and on the test-fixture side the drift silently masks the emission-side pin (.get("endpointSelector") returns None under both the drifted emitter and the drifted probe — the downstream .and_then(|s| s.get("matchLabels")) chain short-circuits vacuously because the outer selector-lookup is itself None). Peer to the CILIUM_KEY_TO_PORTS re-export on the sibling canonical-per-CNP- body-axis surface — extends the per-CNP-body re-export set from the per-ingress-rule port-set container axis (the L4 dispatch container half of the (endpointSelector, ingress → toPorts → rules) L3/L4/ L7-triad) onto the destination-identity axis half, completing the per-CNP L3-target-selector re-export the M3 Aplicacao mesh renderer’s eBPF data-plane contract rests on. Canonical Cilium CiliumNetworkPolicy destination-identity selector- axis key every cilium_network_policies-emitted CNP document mounts its L3-target LabelSelector under (spec.endpointSelector). Pairs with the sibling CILIUM_KEY_TO_PORTS (c8d9cbf) — the Cilium CNP schema pins the destination workload through the endpointSelector axis and the admitted L4 port set through the toPorts axis, so drift on the destination-identity axis is exactly as load-bearing as drift on the port-set-container axis it accompanies (the Cilium- operator-side CRD schema validator drops any spec block whose destination-identity axis carries an unrecognized key — an "endpointselector" / "endpointSelectors" / "endpoints" typo silently emits a CNP whose L3-target selector the Cilium operator’s per-CNP identity-resolution pass no-ops entirely: the policy binds against no destination pods and every intra-mesh :contratos flow the CNP was authored to allow drops at the eBPF data plane’s default-deny gate with no field naming the destination-identity- axis-drift root cause).
CILIUM_KEY_FROM_ENDPOINTS: Canonical Cilium CiliumNetworkPolicy per-ingress-rule identity- source selector-list axis key every cilium_network_policies-emitted CNP document mounts its permitted-source LabelSelector list under (spec.ingress[].fromEndpoints[]). Re-export of the canonical caixa_core::CILIUM_KEY_FROM_ENDPOINTS so the Cilium-operator-side per-ingress-rule identity-source axis-key string lives in exactly one place across every caixa renderer — caixa-mesh’s cilium_network_policies per-(:de, :para) CiliumNetworkPolicy emitter (the ingress_rule.insert("fromEndpoints", …) call the prior inline "fromEndpoints" literal sat at) and every future per- Cilium-side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str, so a future Cilium-CRD rebrand on the identity-source axis (unlikely on the CRD’s stable cilium.io/v2 slot, but the coordination point the prior CILIUM_KEY_ENDPOINT_SELECTOR
CILIUM_KEY_HTTP: Canonical Cilium CiliumNetworkPolicy per-ingress[].toPorts[].rules L7-HTTP-rule-list-discriminator container-axis key every cilium_network_policies-emitted CNP document mounts its per- toPorts[] entry L7 URL-path-prefix predicate list under (spec.ingress[].toPorts[].rules.http). Re-export of the canonical caixa_core::CILIUM_KEY_HTTP so the Cilium-CRD per-toPorts[] L7- HTTP-rule-list-discriminator container-axis key string lives in exactly one place across every caixa renderer — caixa-mesh’s cilium_network_policies per-(:de, :para) CiliumNetworkPolicy emitter (the single production-code site the prior inline "http" literal sat at, the rules.insert("http", …) call in the WitTarget::Http L7 introspection emit branch) and every future per-Cilium-side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str, so a future Cilium-CRD rebrand on the per-toPorts[] L7-HTTP-rule-list-discriminator axis (unlikely on the CRD’s stable cilium.io/v2 slot, but the coordination point the sibling CILIUM_KEY_AUTHENTICATION / CILIUM_KEY_MODE re-exports anchor on the parent per-ingress-rule mutual-auth body/leaf axis pair) lands in one place. The prior inline literal split across the one production emitter site and two test-fixture navigation sites (the L7 fan-in path-capture pin across the multi-edge group, the per-HTTP- contract L7-path presence pin) would have let a Cilium-CRD L7-HTTP- rule-list-discriminator rebrand or a per-emitter typo ("HTTP" / "Http" / "httpRules" / "httpMatch") at any one site silently emit a per-toPorts[] entry whose L7-HTTP-rule-list-discriminator key the Cilium CRD schema validator drops as unknown; the per- toPorts[] entry falls back to L4-only enforcement — no L7 URL- path predicate is applied — silently admitting every HTTP-method / URL-path combination the ingress rule was authored to filter to the exact path prefix set the typed :contratos graph names at the L7 introspection axis, with no field naming the L7-HTTP-rule-list- discriminator-drift root cause. On the test-fixture side the drift silently masks the emission-side pin (.get("http") returns None under both the drifted-key emitter and the drifted-key probe — every downstream .and_then(|h| h.as_sequence()) chain short- circuits vacuously because the outer L7-HTTP-rule-list-lookup is itself None). Peer to the CILIUM_KEY_MODE / CILIUM_KEY_AUTHENTICATION re-exports on the sibling per- ingress-rule mutual-auth body/leaf axis pair — completes the per- toPorts[] L7-introspection (rules → http) container/protocol- discriminator axis re-export pair this crate’s cilium_network_policies renderer’s HTTP-shaped-:contratos URL- path-prefix-filtering L7-enforcement contract rests on. Canonical Cilium CiliumNetworkPolicy per-ingress[].toPorts[].rules L7-HTTP-rule-list-discriminator container-axis key every cilium_network_policies-emitted CNP document mounts its per-toPorts[] entry L7 HTTP-rule list under (spec.ingress[].toPorts[].rules.http). Nests exactly one level beneath the sibling KUBE_KEY_RULES (a205eb3) per-toPorts[] rule-list-container axis it sits inside: the Cilium CNP schema places the L7-protocol-selection discriminator (http / future kafka / future dns) as the single per-protocol keyed axis of the per-toPorts[] rules block, so drift on the L7-HTTP-rule-list- discriminator axis is exactly as load-bearing as drift on the sibling KUBE_KEY_RULES per-toPorts[] rule-list-container axis-key it nests inside (the Cilium-operator-side CNP schema validator drops any per- toPorts[] entry whose per-protocol L7-rule-list-discriminator key it recognizes as unknown — a "HTTP" / "Http" / "http/1.1" / "httpRules" typo at either the emit-side rules.insert(…) call site or a downstream renderer’s per-toPorts[] L7-rule-list upsert silently emits a per-toPorts[] entry whose L7-HTTP-rule-list-discriminator key the Cilium CRD schema validator rejects as unknown; the per-toPorts[] entry falls back to L4-only enforcement — no L7 URL-path predicate is applied — silently admitting every HTTP-method / URL-path combination the ingress rule was authored to filter to the exact path prefix set the typed :contratos graph names at the L7 introspection axis, and the emit-side/probe-side split silently masks the per-toPorts[] L7- rule-list pin (.get("http") returns None under both the drifted- key emitter and the drifted-key probe — every downstream .and_then(|h| h.as_sequence()) chain short-circuits vacuously because the outer L7-HTTP-rule-list-lookup is itself None).
CILIUM_KEY_INGRESS: Canonical Cilium CiliumNetworkPolicy per-CNP-body traffic-direction container-axis key every cilium_network_policies-emitted CNP document mounts its permitted-inbound-per-(:de, :para) ingress-rule list under (spec.ingress[]). Re-export of the canonical caixa_core::CILIUM_KEY_INGRESS so the Cilium-operator-side per- CNP inbound-traffic-dispatch container-key string lives in exactly one place across every caixa renderer — caixa-mesh’s cilium_network_policies per-(:de, :para) CiliumNetworkPolicy emitter (the policy_spec.insert("ingress", …) call the prior inline "ingress" literal sat at) and every future per-Cilium-side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str, so a future Cilium-CRD rebrand on the traffic- direction axis (unlikely on the CRD’s stable cilium.io/v2 slot, but the coordination point the prior CILIUM_KEY_ENDPOINT_SELECTOR
CILIUM_KEY_MODE: Canonical Cilium CiliumNetworkPolicy per-ingress[].authentication block mTLS-mode-discriminator leaf-scalar-axis key every cilium_network_policies-emitted CNP document mounts its per-rule mutual-auth mode leaf under (spec.ingress[].authentication.mode). Re-export of the canonical caixa_core::CILIUM_KEY_MODE so the Cilium-operator-side per-ingress-rule mutual-auth-mode-discriminator leaf-axis key string lives in exactly one place across every caixa renderer — caixa-mesh’s cilium_network_policies per-(:de, :para) CiliumNetworkPolicy emitter (the single-field-overlay call in the :politicas :mtls-required overlay emit gate the prior inline "mode" literal sat at) and every future per-Cilium-side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str, so a future Cilium-CRD rebrand on the per- authentication-block mode-discriminator leaf-axis (unlikely on the CRD’s stable cilium.io/v2 slot, but the coordination point the prior CILIUM_KEY_AUTHENTICATION re-export anchors on the parent per-ingress-rule mutual-auth-body-axis) lands in one place. The prior inline literal split across the one production emitter site and five test-fixture navigation sites (the presence pin under the :mtls-required t overlay, the explicit-false-emits-disabled- mode pin under the Some(false) arm, the fan-out pin across multiple contratos, the pubsub-carry-overlay-too shape pin, and the yaml-string-scalar mode-value pin) would have let a Cilium-CRD mutual-auth-mode-leaf rebrand or a per-emitter typo ("policy" / "authMode" / "handshakeMode") at any one site silently emit a per-ingress[] entry whose mutual-auth-block mode-discriminator- leaf-axis the Cilium CRD schema validator drops as unknown; the ingress rule falls back to the cluster-default authentication mode and every intra-mesh :contratos flow the CNP was authored to protect with per-edge SPIFFE-identity-bound mutual-auth silently bypasses the mTLS handshake at the Cilium data-plane’s default- authentication mode with no field naming the mutual-auth-mode- leaf-axis-drift root cause. On the test-fixture side the drift silently masks the emission-side pin (.get("mode") returns None under both the drifted-key emitter and the drifted-key probe — every downstream .and_then(|v| v.as_str()) chain short-circuits vacuously because the outer mode-leaf-lookup is itself None). Peer to the CILIUM_KEY_AUTHENTICATION re-export on the parent per-ingress-rule mutual-auth-body-axis surface — completes the per-rule mutual-auth (authentication → mode) body/leaf axis re-export pair this crate’s cilium_network_policies renderer’s SPIFFE-identity-bound per-edge mTLS enforcement contract rests on. Canonical Cilium CiliumNetworkPolicy per-ingress[].authentication block mTLS-mode-discriminator leaf-scalar-axis key every cilium_network_policies-emitted CNP document mounts its per-rule mutual-auth mode leaf under (spec.ingress[].authentication.mode). Nests exactly one level beneath the sibling CILIUM_KEY_AUTHENTICATION (db31108) per-ingress-rule mutual-auth body-axis it sits inside: the Cilium CNP schema places the mTLS enforcement mode discriminator ("required" / "disabled") as the single leaf-scalar axis of the per-rule authentication block, so drift on the mode-discriminator leaf axis is exactly as load-bearing as drift on the sibling per-ingress-rule mutual-auth body-axis key (authentication) it nests inside (the Cilium-operator-side CNP schema validator drops any per-ingress[] entry whose per-rule mutual-auth block carries an unrecognized leaf axis — a "policy" / "authMode" / "handshakeMode" typo at either the emit-side single- field-overlay call site or a downstream renderer’s per-rule authn leaf upsert silently emits a per-ingress[] mutual-auth block whose mode-discriminator leaf the Cilium CRD schema validator rejects as unknown; the ingress rule falls back to the cluster-default authentication mode (typically "disabled" — no mutual-auth enforcement) silently bypassing the SPIFFE-identity-bound mTLS handshake every intra-mesh :contratos flow the CNP was authored to protect with per-edge mTLS, and the emit-side/probe-side split silently masks the per-rule mutual-auth pin (.get("mode") returns None under both the drifted-key emitter and the drifted-key probe — every downstream .and_then(|v| v.as_str()) chain short-circuits vacuously because the outer mode-leaf-lookup is itself None).
CILIUM_KEY_PATH: Canonical Cilium CiliumNetworkPolicy per-ingress[].toPorts[].rules.http[] per-HTTP-rule URL-path-predicate leaf-scalar-axis key every cilium_network_policies-emitted CNP document mounts its per-HTTP-rule URL-path-prefix predicate scalar under (spec.ingress[].toPorts[].rules.http[].path). Re-export of the canonical caixa_core::CILIUM_KEY_PATH so the Cilium-CRD per-rules.http[] URL-path-predicate leaf-axis key string lives in exactly one place across every caixa renderer — caixa-mesh’s cilium_network_policies per-(:de, :para) CiliumNetworkPolicy emitter (the single production-code site the prior inline "path" literal sat at, the http_rule.insert("path", …) call in the WitTarget::Http L7 introspection emit branch) and every future per-Cilium-side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str, so a future Cilium-CRD rebrand on the per-rules.http[] URL-path-predicate leaf-axis (unlikely on the CRD’s stable cilium.io/v2 slot, but the coordination point the sibling CILIUM_KEY_HTTP re-export anchors on the parent per-toPorts[] L7-HTTP-rule-list-discriminator container-axis it nests inside) lands in one place. The prior inline literal split across the one production emitter site and one test-fixture navigation site (the per-HTTP-rule URL-path-predicate presence-and-value pin on the aplicacao fixture’s cart→catalog HTTP-shaped :contratos edge) would have let a Cilium-CRD per-HTTP-rule URL-path-predicate rebrand or a per-emitter typo ("Path" / "pathPrefix" / "regex" / "urlPath" / "pathMatch") at any one site silently emit a per-rules.http[] entry whose URL-path-predicate leaf-axis key the Cilium CRD schema validator drops as unknown; the per-rules.http[] entry falls back to a match-any-URL-path predicate — the per-toPorts[] L7 rule admits every URL path on the destination port silently, bypassing the URL-path-prefix predicate the typed :contratos HTTP-shaped edge’s :endpoint slot names at the L7 introspection axis, with no field naming the URL-path-predicate-leaf- axis-drift root cause. On the test-fixture side the drift silently masks the emission-side pin (.get("path") returns None under both the drifted-key emitter and the drifted-key probe — every downstream .and_then(|v| v.as_str()) chain short-circuits vacuously because the outer per-HTTP-rule URL-path-lookup is itself None). Peer to the CILIUM_KEY_HTTP re-export on the parent per-toPorts[] L7-HTTP- rule-list-discriminator container-axis it nests inside — completes the per-toPorts[] L7-introspection (rules → http → path) container / protocol-discriminator / URL-path-predicate axis triple re-export chain this crate’s cilium_network_policies renderer’s HTTP-shaped- :contratos URL-path-prefix-filtering L7-enforcement contract rests on. Distinct from the sibling K8s-Gateway-API-side GATEWAY_API_KEY_PATH per-HTTPRouteMatch path-matcher container-axis re-export: both re- exports carry the same underlying "path" string but name distinct schema axes on distinct CRD groups (the Cilium-side leaf on the cilium.io/v2 CiliumNetworkPolicy CRD’s per-rules.http[] entry, the Gateway-API-side container on the gateway.networking.k8s.io/v1 HTTPRoute CRD’s spec.rules[].matches[] entry), so the sibling pub use declarations stay independent for the same axis-independence reason the sibling CILIUM_KIND_NETWORK_POLICY / GATEWAY_API_KIND_GATEWAY / GATEWAY_API_KIND_HTTP_ROUTE kind- discriminator re-exports stay independent across the two CRD groups. The axis-independence discipline lives at the rustc symbol-name axis (the two pub use caixa_core::CILIUM_KEY_PATH / pub use caixa_core::GATEWAY_API_KEY_PATH symbol re-exports a future rebrand of one leaves the other structurally untouched under) rather than the runtime-address axis — Rust’s &'static str interner coalesces identical byte-sequences onto one storage allocation at codegen time, so the per-axis re-export identity pin against the canonical caixa-core declaration on each axis is what actually forbids a sibling local pub const from drifting, not a cross-axis pointer-inequality assertion. Canonical Cilium CiliumNetworkPolicy per-ingress[].toPorts[].rules.http[] per-HTTP-rule URL-path-predicate leaf-scalar-axis key every cilium_network_policies-emitted CNP document mounts its per-HTTP-rule URL-path-prefix predicate scalar under (spec.ingress[].toPorts[].rules.http[].path). Nests exactly one level beneath the sibling CILIUM_KEY_HTTP (ccd81e8) per-toPorts[] L7-HTTP-rule-list-discriminator container-axis it sits inside: the Cilium CNP schema places the per-HTTP-rule URL-path predicate scalar (the exact URL-path regex the Cilium L7 dispatch pass matches the observed HTTP request line’s path segment against) as the single load-bearing leaf- scalar axis of the per-rules.http[] entry — so drift on the per-HTTP- rule URL-path-predicate leaf axis is exactly as load-bearing as drift on the sibling CILIUM_KEY_HTTP per-toPorts[] L7-HTTP-rule-list- discriminator container-axis key it nests inside (the Cilium-operator- side CNP schema validator drops any per-rules.http[] entry whose per- HTTP-rule URL-path-predicate leaf key it recognizes as unknown — a "Path" / "pathPrefix" / "regex" / "urlPath" / "pathMatch" typo at either the emit-side http_rule.insert(…) call site or a downstream renderer’s per-rules.http[] URL-path leaf upsert silently emits a per- rules.http[] entry whose URL-path-predicate leaf-axis key the Cilium CRD schema validator rejects as unknown; the per-rules.http[] entry falls back to a match-any-URL-path predicate — the per-toPorts[] L7 rule admits every URL path on the destination port silently, bypassing the URL-path-prefix predicate the typed :contratos HTTP-shaped edge’s :endpoint slot names at the L7 introspection axis, and the emit- side/probe-side split silently masks the per-rules.http[] URL-path pin (.get("path") returns None under both the drifted-key emitter and the drifted-key probe — every downstream .and_then(|v| v.as_str()) chain short-circuits vacuously because the outer per-HTTP-rule URL- path-lookup is itself None).
CILIUM_KEY_PORTS: Canonical Cilium CiliumNetworkPolicy per-toPorts[]-entry L4 port-tuple-list-container axis key every cilium_network_policies- emitted CNP document mounts its per-port-set [{port, protocol}] list under (spec.ingress[].toPorts[].ports[]). Re-export of the canonical caixa_core::CILIUM_KEY_PORTS so the Cilium-operator- side per-toPorts[]-entry L4-port-tuple-list-container-axis-key string lives in exactly one place across every caixa renderer — caixa-mesh’s cilium_network_policies per-(:de, :para) CiliumNetworkPolicy emitter (the to_port.insert("ports", …) call the prior inline "ports" literal sat at) and every future per- Cilium-side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str, so a future Cilium-CRD rebrand on the L4 port-tuple-list-container axis (unlikely on the CRD’s stable cilium.io/v2 slot, but the coordination point the prior CILIUM_KEY_FROM_ENDPOINTS + CILIUM_KEY_ENDPOINT_SELECTOR + CILIUM_KEY_INGRESS + CILIUM_KEY_TO_PORTS + caixa_core::KUBE_KEY_RULES + CILIUM_KIND_NETWORK_POLICY + CILIUM_API_VERSION re-exports anchor on the sibling per-CNP-body axis surface) lands in one place. The prior inline literal split across the one production emitter and two test-fixture navigation sites (cilium_pubsub_contracts_skip_l7_rules — the to_ports.get("ports").is_some() presence pin the L4-yes-L7-no separation invariant hinges on; cnp_l4_fallback_port_reflects_default_servico_port — the .and_then(|tp| tp.get("ports")) navigation whose downstream .and_then(|s| s.first()).and_then(|p| p.get("port")) chain reads the per-port-set L4 port-tuple value the DEFAULT_SERVICO_PORT fallback pins) would have let a Cilium-CRD L4 port-tuple-list- container axis rebrand or a per-emitter typo ("port" / "portList" / "L4Ports") at any one site silently emit a per- toPorts[] entry whose L4 port-tuple-list-container axis the Cilium CRD schema validator drops as unknown; the port-set admits no (port, protocol) tuple, and every intra-mesh :contratos flow the affected CNP was authored to allow drops at the eBPF data plane’s default-deny gate with no field naming the L4-port-tuple-list- container-drift root cause, and on the test-fixture side the drift silently masks the emission-side pin (.get("ports") returns None under both the drifted emitter and the drifted probe — every downstream navigation short-circuits vacuously because the outer L4- port-tuple-list-container-lookup is itself None). Peer to the CILIUM_KEY_TO_PORTS re-export on the sibling canonical-per-CNP- dispatch-axis surface — nests the per-port-set L4 port-tuple-list- container axis structurally beneath the sibling CILIUM_KEY_TO_PORTS port-set-container axis, extending the per- CNP L3/L4/L7-triad (endpointSelector, ingress → toPorts → ports / rules) re-export with the L4-half’s port-tuple-list-container axis this crate’s cilium_network_policies renderer’s eBPF data-plane L4-allow contract rests on. Canonical Cilium CiliumNetworkPolicy per-toPorts[]-entry L4 port-tuple-list-container axis key every cilium_network_policies- emitted CNP document mounts its per-port-set [{port, protocol}] list under (spec.ingress[].toPorts[].ports[]). Nests inside the sibling CILIUM_KEY_TO_PORTS (c8d9cbf) — the Cilium CNP schema pins the per-ingress-rule port-set-container axis through the toPorts[] list and the per-port-set L4 port-tuple list through the ports[] axis beneath each entry, so drift on the L4 port-tuple-list-container axis is exactly as load-bearing as drift on the port-set container axis it nests inside (the Cilium-operator-side CRD schema validator drops any per-toPorts[] entry whose port-tuple-list-container axis carries an unrecognized key — a "port" / "portList" / "L4Ports" typo silently emits a CNP whose per-(:de, :para) per-port-set L4 port-tuple list the Cilium operator’s per-CNP L4-allow eBPF-program generation pass no-ops entirely: the port-set admits no (port, protocol) tuple and every intra-mesh :contratos flow the CNP was authored to allow drops at the eBPF data plane’s default-deny gate with no field naming the L4-port-tuple-list-container-axis-drift root cause).
CILIUM_KEY_TO_PORTS: Canonical Cilium CiliumNetworkPolicy per-ingress-rule port-set container-axis key every cilium_network_policies-emitted CNP document mounts its per-ingress-rule [{ports: […], rules: {…}}] list under (spec.ingress[].toPorts[]). Re-export of the canonical caixa_core::CILIUM_KEY_TO_PORTS so the Cilium-operator-side per-CNP L4/L7-dispatch container-key string lives in exactly one place across every caixa renderer — caixa-mesh’s cilium_network_policies per-(:de, :para) CiliumNetworkPolicy emitter (the ingress_rule.insert("toPorts", …) call the prior inline "toPorts" literal sat at) and every future per-Cilium-side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str, so a future Cilium-CRD rebrand on the port-set container axis (unlikely on the CRD’s stable cilium.io/v2 slot, but the coordination point the prior KUBE_KEY_RULES + CILIUM_KIND_NETWORK_POLICY + CILIUM_API_VERSION re-exports anchor on the sibling per-CNP-dispatch-axis surface) lands in one place. The prior inline literal split across the one production emitter and six test-fixture navigation sites (2 CNP presence / absence pins, 1 fan-in-per-pair invariant pin, 1 mTLS-overlay nesting pin — via the pair of contains_key + .get navigations, 1 L4-fallback port pin) would have let a Cilium-CRD port-set- container rebrand or a per-emitter typo ("toport" / "toPort" / "targetPorts") at any one site silently emit a per-ingress-rule entry whose port-set container the Cilium CRD schema validator drops as unknown; every intra-mesh :contratos flow the affected CNP was authored to allow drops at the eBPF data plane’s default- deny gate with no field naming the container-drift root cause, and on the test-fixture side the drift silently masks the emission-side pin (.get("toPorts") returns None under both the drifted emitter and the drifted probe — the cilium_pubsub_contracts_skip_\ l7_rules absence pin’s downstream to_ports.get("rules").is_none() assertion succeeds vacuously because to_ports is itself None). Peer to the caixa_core::KUBE_KEY_RULES re-export on the sibling canonical-per-CNP-dispatch-axis surface — completes the per-CNP L4/L7-dispatch-container (toPorts, rules) re-export pair this crate’s cilium_network_policies renderer’s eBPF data-plane contract rests on. Canonical Cilium CiliumNetworkPolicy L4/L7 per-ingress-rule port-set container-axis key every cilium_network_policies-emitted CNP document mounts its per-ingress-rule [{ports: […], rules: {…}}] list under (spec.ingress[].toPorts[]). Pairs with the sibling KUBE_KEY_RULES (a205eb3) — the Cilium L7-dispatch schema nests spec.ingress[].toPorts[].rules.http[] under the shared (toPorts, rules) container-key pair, so drift on the toPorts axis is exactly as load-bearing as drift on the rules axis it wraps (the Cilium-operator-side CRD schema validator drops any spec.ingress[] entry whose port-set container carries an unrecognized key — a "toports" / "toPort" / "targetPorts" typo silently emits an ingress rule whose per-port set the Cilium operator’s per-CNP L4/L7 dispatch pass no-ops entirely: every intra-mesh :contratos flow the CNP was authored to allow now drops at the eBPF data plane’s default-deny gate with no field naming the port-set-container-drift root cause).
CILIUM_KIND_NETWORK_POLICY: Canonical Cilium CRD kind discriminator every cilium_network_policies-emitted CiliumNetworkPolicy document declares at its top-level caixa_core::KUBE_KEY_KIND axis. Re-export of the canonical caixa_core::CILIUM_KIND_NETWORK_POLICY so the Cilium-operator-side CRD kind discriminator string lives in exactly one place across every caixa renderer — caixa-mesh’s cilium_network_policies per-(:de, :para) CiliumNetworkPolicy emitter (the single production-code site the prior inline "CiliumNetworkPolicy" literal sat at, caixa-mesh/src/lib.rs:382 — the kube_resource_skeleton kind argument) and every future per-Cilium-side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str, so a future Cilium-CRD rebrand (e.g. an upstream rename to CiliumNetworkPolicyV2) is a one-line edit on the canonical caixa_core::CILIUM_KIND_NETWORK_POLICY declaration, not a coordinated rewrite across this crate’s kube_resource_skeleton call site + every future per-target renderer the substrate adds. The prior inline literal would have let a Cilium-CRD bump on the kind axis without a coordinated edit on the matching in-file cilium_policy_carries_canonical_kube_skeleton test fixture pin silently emit a CiliumNetworkPolicy whose top-level kind drifts off the lifted-test-fixture pin — apply-side: the policy lands outside the Cilium-operator-side CRD registration, every (:de, :para) intra-mesh L4/L7 contract drops at the eBPF data plane with no field naming the kind-drift root cause. Peer to the CILIUM_API_VERSION re-export on the sibling canonical-Cilium-CRD-apiVersion-axis — extends the discipline from the apiVersion half of the (apiVersion, kind) CRD-lookup tuple onto the kind half, completing the per-Cilium-CRD kind+apiVersion re-export pair this crate’s cilium_network_policies renderer’s eBPF data-plane contract rests on. Canonical Cilium CRD kind discriminator the rendered CiliumNetworkPolicy document declares at its top-level KUBE_KEY_KIND axis. Pairs with the sibling CILIUM_API_VERSION (279d611) — the K8s apiserver-side CRD resolution contract is the (apiVersion, kind) tuple keyed against the registered CustomResourceDefinition, so drift on the kind axis is exactly as load-bearing as drift on the apiVersion axis it accompanies (the apiserver’s RESTMapper consults both together; a ("cilium.io/v2", "CilumNetworkPolicy") typo at the production-code call site lands outside the registered Cilium-operator-side CiliumNetworkPolicy CRD’s RESTKind lookup, surfacing apply-side as a non-self-locating “no kind ‘CilumNetworkPolicy’ is registered for version ‘cilium.io/v2’” error far from the source caixa.lisp / the renderer’s kube_resource_skeleton call site).
CONTRATO_EDGE_LABEL_SEPARATOR: Canonical M3 :contratos edge-direction separator byte-string every caixa-mesh emitter that encodes a typed edge as a K8s-name-shaped scalar reads from — the per-(:de, :para) LABEL_CONTRATO value threaded through contrato_edge_label and the per-(:de, :para) CiliumNetworkPolicy metadata.name threaded through cilium_network_policy_name. Re-export of the canonical caixa_core::CONTRATO_EDGE_LABEL_SEPARATOR so the load-bearing -to- byte-string lives in exactly one place across every caixa renderer — caixa-mesh’s cilium_network_policies per-(:de, :para) group (the two writer sites the prior inline format! literals sat at) and every future per-target renderer that encodes a typed M3 edge as a K8s-name-shaped scalar. A future edge-encoding rebrand (-to- → -> for compactness, -to- → _to_ to reserve - for embedded DNS-1123-label boundaries, an edge-direction-arrow migration to UTF-8 shapes) lands at the canonical caixa_core::CONTRATO_EDGE_LABEL_SEPARATOR declaration, not at this crate’s per-group writer sites. Peer with the contrato_edge_label / cilium_network_policy_name composer re-exports that consume this const — together the three items close the canonical per-(:de, :para) CNP identity pair (metadata.labels.pleme.pleme.io/contrato, metadata.name) onto one shared edge-encoding source of truth. Canonical M3 :contratos edge-direction separator byte-string every caixa-mesh emitter that encodes a typed edge as a K8s-name-shaped scalar (the LABEL_CONTRATO label value carried on every per-(:de, :para) CiliumNetworkPolicy’s metadata.labels, and the per-(:de, :para) CiliumNetworkPolicy’s metadata.name itself) inserts between the :de and :para halves of the typed edge tuple. Load-bearing on both the writer half (the CNP renderer) and the reader half (Hubble flow grouping by contrato label, per-CNP operator filters, kubectl get cnp -l pleme.pleme.io/contrato=<de>-to-<para> grep-by-label). Until this lift landed the -to- byte-string sat in two verbatim inline-format! sites at the caixa-mesh cilium_network_policies emitter — one at the LABEL_CONTRATO labels.insert(...) call and one at the kube_resource_skeleton name: argument — with no compile-time link between them. A future edge-encoding rebrand (-to- → -> for compactness, -to- → _to_ to reserve - for embedded DNS-1123-label boundaries, an edge-direction-arrow migration to UTF-8 shapes) would have had to be threaded through both sites in lockstep or the two would silently split: one CNP’s metadata.name keys off the drifted encoding, its own metadata.labels.pleme.pleme.io/contrato value keys off the original, and every operator-side grep-by-label query (kubectl get cnp -l pleme.pleme.io/contrato=cart-to-catalog) finds the label but the resulting CNP’s metadata.name no longer matches the queried edge encoding. Every downstream consumer that joins the two axes (the M4 mesh-graph audit, the future Hubble-side contrato-flow renderer, the operator’s per-edge policy inspector) silently loses the join. Lifted onto one &'static str so a future edge-encoding rebrand lands at one const, and every downstream consumer picks up the new encoding by construction.
DEFAULT_GATEWAY_CLASS_NAME: Canonical K8s Gateway API GatewayClass name every gateway_routes-emitted Gateway document declares at its spec.gatewayClassName axis. Re-export of the canonical caixa_core::DEFAULT_GATEWAY_CLASS_NAME so the substrate’s chosen Gateway API controller-discriminator lives in exactly one place across every caixa renderer — caixa-mesh’s gateway_routes per-:entrada Gateway emitter (the single production-code site the prior inline "cilium".into() literal sat at — the spec.gatewayClassName field of the emitted Gateway’s spec block) and every future per-Aplicacao materializer the M3.x + M4 absorption roadmap acknowledges (the future mesh.pleme.io/v1alpha1/Aplicacao CR materializer’s Gateway synthesis, a future per-cluster / per-edge Gateway renderer for non-HTTP :entrada shapes) now consult the same &'static str, so a future substrate-side Gateway API controller migration (Cilium → Envoy Gateway / Istio Gateway or any per-edition Gateway API v1.x GA controller variant the SIG-Network roadmap names) is a one-line edit on the canonical caixa_core::DEFAULT_GATEWAY_CLASS_NAME declaration, not a coordinated rewrite across this crate’s gateway_routes call site
DEFAULT_NAMESPACE: Default namespace for emitted cluster objects when the Aplicacao doesn’t pin one. Re-export of the canonical caixa_core::DEFAULT_NAMESPACE so the namespace string lives in exactly one place across every renderer — caixa-mesh’s programs fan-out / CiliumNetworkPolicy / Gateway / HTTPRoute emitters and caixa-flux’s programs.yaml / GitRepository / HelmRelease / Kustomization emitters now consult the same &'static str, so a future per-cluster-namespace rebrand is a one-line edit on the canonical caixa_core::DEFAULT_NAMESPACE declaration, not a coordinated rewrite across this crate, caixa-flux, and every future per-target renderer the substrate adds. The prior local pub const declaration explicitly acknowledged the duplication (“Mirrors caixa_flux::DEFAULT_NAMESPACE”); this re-export closes the drift footgun structurally — a future rebrand on one side without a coordinated edit on the other would otherwise have silently emitted Servicos into one namespace and their Aplicacao’s NetworkPolicies / Gateways / HTTPRoutes into a drifted one, with the apply-time symptom (CiliumNetworkPolicy endpointSelector matches no pods, every L7 contrato flow silently drops) far from the rebrand commit’s source. Default cluster-wide K8s namespace every caixa renderer emits objects into when the source caixa doesn’t pin its own. The single source of truth both caixa-flux’s programs.yaml / GitRepository / HelmRelease / Kustomization emitters and caixa-mesh’s programs fan-out / CiliumNetworkPolicy / Gateway / HTTPRoute emitters consult — re-exported by each renderer’s lib as pub use caixa_core::DEFAULT_NAMESPACE, so a future per-cluster-namespace rebrand (e.g. moving to pleme-system once tatara-system outlives its scoping intent) is a one-line edit here, not a coordinated rewrite across every renderer crate’s metadata.namespace slot.
GATEWAY_API_API_VERSION: Canonical K8s Gateway API CRD apiVersion every gateway_routes- emitted Gateway / HTTPRoute document declares. Re-export of the canonical caixa_core::GATEWAY_API_API_VERSION so the Gateway-API-conformant CRD-group/version string lives in exactly one place across every caixa renderer — caixa-mesh’s gateway_routes Gateway + HTTPRoute emitters (the two production- code sites the prior inline literal sat at, caixa-mesh/src/lib.rs:455, 496) and every future per-edge TCPRoute / TLSRoute / GRPCRoute emitter the M3.x absorption- roadmap acknowledges now consult the same &'static str, so a future K8s Gateway API GA promotion (the upstream SIG-Network roadmap names per-CRD-group / per-version migration once the v1 GA branch matures) is a one-line edit on the canonical caixa_core::GATEWAY_API_API_VERSION declaration, not a coordinated rewrite across this crate’s two kube_resource_skeleton call sites + every future per-target renderer the substrate adds. The prior inline literals would have let a Gateway-API GA bump on one axis without a coordinated edit on the other silently emit a Gateway / HTTPRoute pair pointing at distinct CRD versions — apply-side: the Gateway and HTTPRoute land in two distinct apiserver-side CRD registrations, the per-route attached-policy resolution pipeline never binds, every external :entrada flow drops at the gateway with no field naming the version-drift root cause. Peer to the DEFAULT_NAMESPACE re-export on the sibling canonical-load-bearing-string axis — extends the discipline onto the canonical-K8s-Gateway-API-CRD-axis surface. Canonical K8s Gateway API CRD apiVersion every caixa-mesh-emitted Gateway / HTTPRoute document declares. The K8s apiserver-side SIG-Network Gateway API conformance registers the Gateway / HTTPRoute / GatewayClass / TCPRoute / TLSRoute / GRPCRoute CRDs at this exact group/version (gateway.networking.k8s.io/v1); drift to a stale v1beta1 / v1alpha2 (the pre-GA Gateway API betas every upstream conformance doc names) silently routes the rendered Gateway / HTTPRoute outside the apiserver’s CRD-version registration and breaks at apply time with a non-self-locating “no kind ‘Gateway’ is registered for version ‘gateway.networking.k8s.io/v1beta1’” error far from the source caixa.lisp / the renderer’s kube_resource_skeleton call site.
GATEWAY_API_KEY_ATTEMPTS: Canonical K8s Gateway API HTTPRoute per-rule retry-policy attempts leaf scalar-key. Re-export of the canonical caixa_core::GATEWAY_API_KEY_ATTEMPTS so the per-rule retry- attempts leaf key lives in exactly one place across every caixa renderer — this crate’s one production emitter site (gateway_routes’s per-HTTPRoute per-rule single_field_overlay(spec.politicas.retries, …) call that seeds the typed u32 attempt count into the sibling GATEWAY_API_KEY_RETRY container axis under spec.rules[].retry.attempts, the leaf the Gateway API v1 CRD schema pins as HTTPRouteRetry.attempts and whose scalar value the Gateway-API-implementation-side per-rule request-dispatch loop compares each failed backend attempt count against before giving up on the in-flight backend call) and this crate’s five test-side per-rule retry-attempts traversal sites (the httproute_carries_politicas_retries_on_every_rule typed-u64- value pin, the httproute_retry_renders_every_rule_independently per-rule fan-out attempt-count pin under multi-:entrada :paths, the httproute_retry_round_trips_typed_attempt_count typed-u32- round-trip pin, the httproute_retry_attempts_serialized_as_yaml_number YAML integer-scalar-kind pin, and the retries-only arm of httproute_timeouts_and_retry_coexist_independently pinning the leaf attempt count survives when only the sibling :retries slot is set) now consult the same &'static str as the peer caixa-core- side const definition.
GATEWAY_API_KEY_BACKEND_REFS: Canonical K8s Gateway API HTTPRoute per-rule backend-destination container-axis key every gateway_routes-emitted HTTPRoute per- rule block mounts its [{name, port}] backend fan-out list under (spec.rules[].backendRefs[]). Re-export of the canonical caixa_core::GATEWAY_API_KEY_BACKEND_REFS so the Gateway-API- implementation-side per-rule backend-destination-container-axis-key string lives in exactly one place across every caixa renderer — caixa-mesh’s gateway_routes per-Aplicacao HTTPRoute emitter (the rule.insert("backendRefs", …) call the prior inline "backendRefs" literal sat at, caixa-mesh/src/lib.rs:1414) and every future per-Gateway-API-side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str, so a future Gateway API rebrand on the per-rule backend-destination axis (an upstream Gateway API v2 rename to backends / forwardTo / to, coordinated with the upstream SIG-Network Gateway API deprecation cycle) is a one-line edit on the canonical caixa_core::GATEWAY_API_KEY_BACKEND_REFS declaration, not a coordinated rewrite across this crate’s gateway_routes renderer + every future per-target renderer the substrate adds. The prior inline literal at the one production emitter site + two test-side fixture pins (httproute_routes_to_entrada_para’s .get("backendRefs") navigation, httproute_rule_keys_pin_overlay_position’s contains_key("backendRefs") presence pin) would have let a Gateway-API-CRD per-rule backend-destination-axis rebrand or a per- emitter typo ("backendRef" / "backends" / "forwardTo") silently emit an HTTPRoute whose per-rule backend-destination axis the Gateway API CRD schema validator drops as unknown — no backend is picked at the per-rule L7 dispatch, and every external :entrada request the rule was authored to route drops at the gateway-class- controller’s per-rule reconcile with no field naming the backend- destination-drift root cause. A drift on the test-fixture side silently masks the emission-side pin (.get("backendRefs") returns None under both the drifted-key emitter and the drifted-key probe — the downstream .and_then(|b| b.as_sequence()) / .and_then(|s| s.first()) chain short-circuits vacuously because the outer per-rule backend-destination lookup is itself None). Peer to the GATEWAY_API_KEY_PARENT_REFS re-export on the sibling canonical-Gateway-API-HTTPRoute-body-axis surface — extends the per-Gateway-API-HTTPRoute-body-axis canonical-string re-export set (parentRefs, backendRefs, future hostnames) this crate’s gateway_routes renderer’s external :entrada ingress contract rests on across the Gateway API HTTPRoute-side per-route body- shape. Canonical K8s Gateway API HTTPRoute per-rule backend-destination container-axis key every gateway_routes-emitted HTTPRoute document mounts its per-rule [{name, port}] backend list under (spec.rules[].backendRefs[]). Pairs with the sibling GATEWAY_API_KEY_PARENT_REFS (f44e823) — the Gateway API v1 CRD schema pins the per-HTTPRoute route→Gateway attachment through the spec.parentRefs[] container axis and the per-rule route→Servico backend fan-out through the spec.rules[].backendRefs[] axis beneath each rule entry, so drift on the per-rule backend-destination axis is exactly as load-bearing as drift on the per-HTTPRoute parent-Gateway-binding axis it accompanies (the K8s apiserver-side Gateway API CRD schema validator drops any per-rule block whose backend-destination container axis carries an unrecognized key — a "backendRef" / "backends" / "forwardTo" typo silently emits an HTTPRoute whose per-rule backend fan-out the Gateway API implementation’s per-rule L7 dispatch loop no-ops entirely: no backend is picked, and every external :entrada request the rule was authored to route drops at the gateway-class-controller’s per-rule reconcile with no field naming the backend-destination- axis-drift root cause).
GATEWAY_API_KEY_GATEWAY_CLASS_NAME: Canonical K8s Gateway API Gateway per-Gateway controller-binding scalar-axis key every gateway_routes-emitted Gateway document mounts its per-Gateway GatewayClass.metadata.name reference under (spec.gatewayClassName). Re-export of the canonical caixa_core::GATEWAY_API_KEY_GATEWAY_CLASS_NAME so the Gateway-API-implementation-side per-Gateway controller-binding scalar-axis-key string lives in exactly one place across every caixa renderer — caixa-mesh’s gateway_routes per-Aplicacao Gateway emitter (the g_spec.insert("gatewayClassName", …) call the prior inline "gatewayClassName" literal sat at) and every future per-Gateway-API-side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str, so a future Gateway API rebrand on the per-Gateway controller-binding scalar axis (an upstream Gateway API v2 rename to className / gatewayClassRef, coordinated with the upstream SIG-Network Gateway API deprecation cycle) is a one-line edit on the canonical caixa_core::GATEWAY_API_KEY_GATEWAY_CLASS_NAME declaration, not a coordinated rewrite across this crate’s gateway_routes renderer + every future per-target renderer the substrate adds. The prior inline literal at the one production emitter site + one test-side fixture pin (gateway_gateway_class_name_uses_lifted_default_gateway_class_name’s .get("gatewayClassName") navigation) would have let a Gateway- API-CRD per-Gateway controller-binding-axis rebrand or a per- emitter typo ("gatewayClass" / "className" / "gatewayClassRef") silently emit a Gateway whose controller- binding scalar-axis the Gateway API CRD schema validator drops as unknown — no GatewayClass is resolved, no controllerName is looked up, and every external :entrada flow the Gateway was authored to accept drops at the gateway-class-controller’s per- Gateway reconcile with no field naming the controller-binding- drift root cause. A drift on the test-fixture side silently masks the emission-side pin (.get("gatewayClassName") returns None under both the drifted-key emitter and the drifted-key probe — the downstream .and_then(|c| c.as_str()) chain short-circuits vacuously because the outer per-Gateway controller-binding lookup is itself None). Peer to the GATEWAY_API_KEY_LISTENERS + GATEWAY_API_KEY_HOSTNAME re-exports on the sibling canonical- Gateway-API-CRD-per-Gateway-body-axis surface. Sibling of the peer DEFAULT_GATEWAY_CLASS_NAME re-export on the canonical- Gateway-API-(key, value)-pair-lift surface this re-export closes the KEY half of. Canonical K8s Gateway API Gateway per-Gateway controller-binding scalar-axis key every gateway_routes-emitted Gateway document mounts its per-Gateway GatewayClass.metadata.name reference under (spec.gatewayClassName). Pairs with the sibling DEFAULT_GATEWAY_CLASS_NAME (d9b0743) — the K8s Gateway API v1 CRD schema pins the per-Gateway controller-binding through the scalar spec.gatewayClassName axis (each Gateway names exactly one GatewayClass.metadata.name; the sibling spec.listeners[] + spec.addresses[] container axes carry the L7-listener fan-out + per-Gateway address hint under the same spec block), so drift on the per-Gateway controller-binding scalar-axis KEY is exactly as load-bearing as drift on the sibling DEFAULT_GATEWAY_CLASS_NAME VALUE the axis wraps (the K8s apiserver-side Gateway API CRD schema validator drops any spec block whose controller-binding scalar- axis carries an unrecognized key — a "gatewayClass" / "className" / "gatewayClassRef" typo silently emits a Gateway whose controller-binding the Gateway API implementation’s per- Gateway reconcile loop no-ops entirely: no GatewayClass is resolved, no controllerName is looked up, and every external :entrada flow the Gateway was authored to accept drops at the gateway-class-controller’s per-Gateway reconcile with no field naming the controller-binding-axis-drift root cause).
GATEWAY_API_KEY_HOSTNAME: Canonical K8s Gateway API Gateway per-listener DNS-host-discriminator axis key every gateway_routes-emitted Gateway document mounts each listener’s virtual-host filter under (spec.listeners[].hostname). Re- export of the canonical caixa_core::GATEWAY_API_KEY_HOSTNAME so the Gateway-API-implementation-side per-listener DNS-host-discriminator- axis-key string lives in exactly one place across every caixa renderer — caixa-mesh’s gateway_routes per-Aplicacao Gateway emitter (the per-listener listener.insert("hostname", …) call the prior inline "hostname" literal sat at, seeded from the Aplicacao’s :entrada :host slot) and every future per-Gateway-API-side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str, so a future Gateway API rebrand on the per-listener DNS-host discriminator axis (an upstream Gateway API v2 rename to host / vhost / serverName, coordinated with the upstream SIG-Network Gateway API deprecation cycle) is a one-line edit on the canonical caixa_core::GATEWAY_API_KEY_HOSTNAME declaration, not a coordinated rewrite across this crate’s gateway_routes renderer + every future per-target renderer the substrate adds. The prior inline literal at the one production emitter site + one test-side fixture pin (gateway_listener_carries_aplicacao_host’s .get("hostname") navigation) would have let a Gateway-API-CRD per-listener DNS-host- discriminator-axis rebrand or a per-emitter typo ("host" / "vhost" / "serverName") silently emit a Gateway whose per- listener virtual-host filter axis the Gateway API CRD schema validator drops as unknown — the listener accepts traffic on the wildcard host rather than the typed :entrada :host the Aplicacao author declared, and every external :entrada flow the listener was authored to accept lands on the wrong virtual-host filter with no field naming the DNS-host-discriminator-drift root cause. A drift on the test-fixture side silently masks the emission-side pin (.get("hostname") returns None under both the drifted-key emitter and the drifted-key probe — the downstream .and_then(|h| h.as_str()) chain short-circuits vacuously because the outer per-listener DNS- host discriminator lookup is itself None). Peer to the GATEWAY_API_KEY_LISTENERS + GATEWAY_API_KEY_PARENT_REFS + GATEWAY_API_KEY_BACKEND_REFS re-exports on the sibling canonical-Gateway-API-CRD-body-axis surface — nests the per-Gateway- API-CRD-body-axis canonical-string re-export set one level deeper onto the per-listener body-axis surface (parentRefs, backendRefs, listeners, hostname, future hostnames) this crate’s gateway_routes renderer’s external :entrada ingress contract rests on across the Gateway API CRD-side body-shape. Canonical K8s Gateway API Gateway per-listener DNS-host-discriminator axis key every gateway_routes-emitted Gateway document mounts each listener’s virtual-host name under (spec.listeners[].hostname). Pairs with the sibling GATEWAY_API_KEY_LISTENERS (29f2415) — the Gateway API v1 CRD schema pins the per-Gateway L7-listener-set fan-out through the spec.listeners[] container axis (each entry names one listener the Gateway accepts external traffic on) and pins each entry’s per-listener DNS-host discriminator under the nested hostname axis (Gateway API v1 Listener.hostname — PreciseHostname string, optional per-listener virtual-host filter the Gateway-API-implementation-side per-Gateway reconcile loop honors when routing external inbound traffic against SNI at the TLS handshake / Host: header at the HTTP request line), so drift on the per-listener DNS-host discriminator axis is exactly as load-bearing as drift on the per-Gateway L7-listener-set container axis it nests under (the K8s apiserver-side Gateway API CRD schema validator drops any per-listener entry whose DNS-host discriminator axis carries an unrecognized key — a "host" / "vhost" / "serverName" typo silently emits a Gateway whose per-listener virtual-host filter the Gateway API implementation’s per-listener SNI / Host: header dispatch loop no-ops entirely: the listener accepts traffic on the wildcard host rather than the typed :entrada :host the Aplicacao author declared, and every external :entrada flow the listener was authored to accept lands on the wrong virtual-host filter with no field naming the DNS-host-discriminator-axis-drift root cause).
GATEWAY_API_KEY_HOSTNAMES: Canonical K8s Gateway API HTTPRoute spec-level DNS-host-filter axis key every gateway_routes-emitted HTTPRoute document mounts the route’s per-route virtual-host filter list under (spec.hostnames[]). The plural sibling of GATEWAY_API_KEY_HOSTNAME — same Gateway-API-CRD DNS-host-discriminator convention nested one level up on the sibling HTTPRoute per-route body-axis surface, distinct spelling (hostnames — plural — is the HTTPRoute spec-level filter list; the singular hostname axis it pairs against is the per- Gateway-listener virtual-host discriminator). Re-export of the canonical caixa_core::GATEWAY_API_KEY_HOSTNAMES so the Gateway- API-implementation-side per-route DNS-host-filter-axis-key string lives in exactly one place across every caixa renderer — caixa-mesh’s gateway_routes per-Aplicacao HTTPRoute emitter (the spec-level r_spec.insert("hostnames", …) call the prior inline "hostnames" literal sat at, seeded from the Aplicacao’s :entrada :host slot as a single-element sequence) and every future per-Gateway-API-side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str, so a future Gateway API rebrand on the per-route DNS-host filter axis (an upstream Gateway API v2 rename to hosts / vhosts / serverNames, coordinated with the upstream SIG-Network Gateway API deprecation cycle) is a one-line edit on the canonical caixa_core::GATEWAY_API_KEY_HOSTNAMES declaration, not a coordinated rewrite across this crate’s gateway_routes renderer + every future per-target renderer the substrate adds. The prior inline literal at the one production emitter site would have let a Gateway- API-CRD per-route DNS-host-filter-axis rebrand or a per-emitter typo ("hosts" / "vhosts" / "serverNames") silently emit an HTTPRoute whose per-route virtual-host filter axis the Gateway API CRD schema validator drops as unknown — the route accepts traffic on every host the parent Gateway’s listener accepts rather than the typed :entrada :host the Aplicacao author declared, and every external :entrada flow the route was authored to accept lands on the wildcard virtual-host filter with no field naming the DNS-host- filter-drift root cause. Peer to the GATEWAY_API_KEY_HOSTNAME + GATEWAY_API_KEY_LISTENERS + GATEWAY_API_KEY_PARENT_REFS + GATEWAY_API_KEY_BACKEND_REFS re-exports on the sibling canonical-Gateway-API-CRD-body-axis surface — closes the per-Gateway- API-CRD HTTPRoute per-route body-axis re-export pair across the singular / plural DNS-host discriminator surface (hostname at the parent-Gateway per-listener discriminator + hostnames at the child HTTPRoute per-route filter list), so both halves of the DNS-host- discriminator convention across the (Gateway, HTTPRoute) pair this crate’s gateway_routes renderer’s external :entrada ingress contract emits together now carry one lifted canonical &'static str re-export apiece. Canonical K8s Gateway API HTTPRoute spec-level DNS-host-filter axis key every gateway_routes-emitted HTTPRoute document mounts the route’s per-route virtual-host filter list under (spec.hostnames[]). The plural sibling of GATEWAY_API_KEY_HOSTNAME (c96fa22) — same Gateway-API-CRD DNS-host-discriminator convention nested one level up on the sibling HTTPRoute per-route body-axis surface, distinct spelling (hostnames — plural — is the HTTPRoute spec-level filter list; the singular hostname axis it pairs against is the per-Gateway-listener virtual-host discriminator).
GATEWAY_API_KEY_LISTENERS: Canonical K8s Gateway API Gateway per-listener-set container-axis key every gateway_routes-emitted Gateway document mounts its per- Gateway [{name, port, protocol, hostname}] L7-listener fan-out list under (spec.listeners[]). Re-export of the canonical caixa_core::GATEWAY_API_KEY_LISTENERS so the Gateway-API- implementation-side per-Gateway L7-listener-set-container-axis-key string lives in exactly one place across every caixa renderer — caixa-mesh’s gateway_routes per-Aplicacao Gateway emitter (the g_spec.insert("listeners", …) call the prior inline "listeners" literal sat at) and every future per-Gateway-API-side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str, so a future Gateway API rebrand on the per-Gateway L7-listener-set axis (an upstream Gateway API v2 rename to servers / endpoints / bindings, coordinated with the upstream SIG-Network Gateway API deprecation cycle) is a one-line edit on the canonical caixa_core::GATEWAY_API_KEY_LISTENERS declaration, not a coordinated rewrite across this crate’s gateway_routes renderer + every future per-target renderer the substrate adds. The prior inline literal at the one production emitter site + one test- side fixture pin (gateway_listener_carries_aplicacao_host’s .get("listeners") navigation) would have let a Gateway-API-CRD per-Gateway L7-listener-set-axis rebrand or a per-emitter typo ("listener" / "listen" / "servers") silently emit a Gateway whose L7-listener-set axis the Gateway API CRD schema validator drops as unknown — no listener is opened, and every external :entrada flow the Gateway was authored to accept drops at the gateway-class-controller’s per-Gateway reconcile with no field naming the L7-listener-set-drift root cause. A drift on the test- fixture side silently masks the emission-side pin (.get("listeners") returns None under both the drifted-key emitter and the drifted- key probe — the downstream .and_then(|l| l.as_sequence()) / .and_then(|s| s.first()) chain short-circuits vacuously because the outer per-Gateway L7-listener-set lookup is itself None). Peer to the GATEWAY_API_KEY_PARENT_REFS + GATEWAY_API_KEY_BACKEND_REFS re-exports on the sibling canonical-Gateway-API-HTTPRoute-body-axis surface — extends the per-Gateway-API-CRD-body-axis canonical-string re-export set (parentRefs, backendRefs, listeners, future hostnames) this crate’s gateway_routes renderer’s external :entrada ingress contract rests on across the Gateway API CRD-side body-shape. Canonical K8s Gateway API Gateway per-listener-set container-axis key every gateway_routes-emitted Gateway document mounts its per-Gateway [{name, port, protocol, hostname}] L7-listener fan-out list under (spec.listeners[]). Pairs with the sibling GATEWAY_API_KEY_PARENT_REFS (f44e823) + GATEWAY_API_KEY_BACKEND_REFS (a6c5679) — the Gateway API v1 CRD schema pins the per-Gateway L7-listener fan-out through the spec.listeners[] container axis (each entry names one listener the Gateway accepts external traffic on; the sibling spec.parentRefs[] + spec.rules[].backendRefs[] container axes carry the per-HTTPRoute parent-Gateway attachment + per-rule backend-destination fan-out halves under the paired HTTPRoute spec block), so drift on the per-Gateway L7-listener-set axis is exactly as load-bearing as drift on the per-HTTPRoute parent-Gateway- binding + per-rule backend-destination axes it accompanies (the K8s apiserver-side Gateway API CRD schema validator drops any spec block whose L7-listener-set container axis carries an unrecognized key — a "listener" / "listen" / "servers" typo silently emits a Gateway whose L7-listener fan-out the Gateway API implementation’s per-Gateway reconcile loop no-ops entirely: no listener is opened, and every external :entrada flow the Gateway was authored to accept drops at the gateway-class-controller’s per- Gateway HTTP-listener fan-in with no field naming the L7-listener- set-axis-drift root cause).
GATEWAY_API_KEY_MATCHES: Canonical K8s Gateway API HTTPRoute per-rule route-match container- axis key every gateway_routes-emitted HTTPRoute per-rule block mounts its per-rule [{path: {type, value}}] route-match fan-out list under (spec.rules[].matches[]). Re-export of the canonical caixa_core::GATEWAY_API_KEY_MATCHES so the Gateway-API- implementation-side per-rule route-match-container-axis-key string lives in exactly one place across every caixa renderer — caixa-mesh’s gateway_routes per-Aplicacao HTTPRoute emitter (the rule.insert("matches", …) call the prior inline "matches" literal sat at, seeded from the Aplicacao’s :entrada :paths slot) and every future per-Gateway-API-side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str, so a future Gateway API rebrand on the per-rule route-match axis (an upstream Gateway API v2 rename to match / routeMatches / predicates, coordinated with the upstream SIG- Network Gateway API deprecation cycle) is a one-line edit on the canonical caixa_core::GATEWAY_API_KEY_MATCHES declaration, not a coordinated rewrite across this crate’s gateway_routes renderer + every future per-target renderer the substrate adds. The prior inline literal at the one production emitter site + one test-side fixture pin (httproute_rule_keys_pin_overlay_position’s contains_key("matches") presence pin) would have let a Gateway- API-CRD per-rule route-match-axis rebrand or a per-emitter typo ("match" / "routeMatches" / "predicates") silently emit an HTTPRoute whose per-rule request-selection axis the Gateway API CRD schema validator drops as unknown — the per-rule predicate degrades to the wildcard match at the gateway-class-controller’s per-rule reconcile, the rule matches every request unconditionally, and every external :entrada path filter the rule was authored to enforce drops with no field naming the route-match-drift root cause. A drift on the test-fixture side silently masks the emission-side pin (contains_key("matches") returns false under both the drifted-key emitter and the drifted-key probe). Peer to the GATEWAY_API_KEY_BACKEND_REFS / GATEWAY_API_KEY_PARENT_REFS re-exports on the sibling canonical-Gateway-API-HTTPRoute-body- axis surface — completes the per-rule top-level-axis re-export set (matches, backendRefs, timeouts, retry) the httproute_rule_keys_pin_overlay_position pin binds against, so every one of the four per-rule top-level axes now threads a lifted &'static str apiece. Canonical K8s Gateway API HTTPRoute per-rule route-match container-axis key every gateway_routes-emitted HTTPRoute per-rule block mounts its per-rule [{path: {type, value}}] route-match fan-out list under (spec.rules[].matches[]). Pairs with the sibling GATEWAY_API_KEY_BACKEND_REFS (a6c5679) — the Gateway API v1 CRD schema pins per-rule request-selection through the spec.rules[].matches[] container axis (each entry names one HTTPRouteMatch predicate the request line + headers + query must satisfy for the rule’s backend fan-out to apply) alongside the per-rule route→Servico backend fan-out under spec.rules[].backendRefs[], so drift on the per-rule route-match axis is exactly as load-bearing as drift on the sibling per-rule backend-destination axis it accompanies (the K8s apiserver-side Gateway API CRD schema validator drops any per-rule block whose route-match container axis carries an unrecognized key — a "match" / "routeMatches" / "predicates" typo silently emits an HTTPRoute whose per-rule request-selection axis the Gateway API implementation’s per-rule L7 dispatch loop no-ops entirely: no request predicate is evaluated, the rule matches every request unconditionally at the wildcard predicate, and every external :entrada path filter the rule was authored to enforce drops at the gateway-class-controller’s per-rule reconcile with no field naming the route-match-axis-drift root cause).
GATEWAY_API_KEY_PARENT_REFS: Canonical K8s Gateway API HTTPRoute parent-Gateway-binding container- axis key every gateway_routes-emitted HTTPRoute document mounts its per-route parent-Gateway [{name}] attachment list under (spec.parentRefs[]). Re-export of the canonical caixa_core::GATEWAY_API_KEY_PARENT_REFS so the Gateway-API- implementation-side per-HTTPRoute parent-Gateway-binding-container- axis-key string lives in exactly one place across every caixa renderer — caixa-mesh’s gateway_routes per-Aplicacao HTTPRoute emitter (the r_spec.insert("parentRefs", …) call the prior inline "parentRefs" literal sat at, caixa-mesh/src/lib.rs:1389) and every future per-Gateway-API-side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str, so a future Gateway API rebrand on the parent-Gateway-binding axis (an upstream Gateway API v2 rename to parents / parentGateways / attachedTo, coordinated with the upstream SIG-Network Gateway API deprecation cycle) is a one-line edit on the canonical caixa_core::GATEWAY_API_KEY_PARENT_REFS declaration, not a coordinated rewrite across this crate’s gateway_routes renderer + every future per-target renderer the substrate adds. The prior inline literal at the one production emitter site would have let a Gateway-API-CRD parent-Gateway-binding-axis rebrand or a per- emitter typo ("parentRef" / "parents" / "parentGateways") silently emit an HTTPRoute whose parent-Gateway-binding axis the Gateway API CRD schema validator drops as unknown — the route lands unattached to any Gateway, and every external :entrada flow the HTTPRoute was authored to accept drops at the Gateway API implementation’s per-Gateway HTTP-listener fan-in with no field naming the parent-Gateway-binding-drift root cause. Peer to the GATEWAY_API_KIND_HTTP_ROUTE + GATEWAY_API_KIND_GATEWAY re-exports on the sibling canonical-Gateway-API-CRD-kind- discriminator surface — pivots this crate’s per-CNP-body-axis re-export discipline onto the sibling per-HTTPRoute-body-axis surface, beginning the per-Gateway-API-HTTPRoute-body-axis canonical-string re-export set (parentRefs, future hostnames) this crate’s gateway_routes renderer’s external :entrada ingress contract rests on across the Gateway API HTTPRoute-side per-route body-shape. Canonical K8s Gateway API HTTPRoute parent-Gateway-binding container- axis key every gateway_routes-emitted HTTPRoute document mounts its per-route parent-Gateway [{name}] list under (spec.parentRefs[]). Pairs with the sibling GATEWAY_API_KIND_HTTP_ROUTE (1adccc0) + GATEWAY_API_KIND_GATEWAY (fb4639c) — the Gateway API v1 CRD schema pins the per-HTTPRoute parent-Gateway identity through the spec.parentRefs[] container axis (each entry names the parent Gateway the route attaches to; the sibling hostnames + rules container axes carry the per-route host-match + per-rule L7-dispatch halves under the same spec block), so drift on the parent-Gateway- binding axis is exactly as load-bearing as drift on the per-HTTPRoute kind discriminator axis it accompanies (the K8s apiserver-side Gateway API CRD schema validator drops any spec block whose parent- binding container axis carries an unrecognized key — a "parentRef" / "parents" / "parentGateways" typo silently emits an HTTPRoute whose parent-Gateway attachment the Gateway API implementation’s per-HTTPRoute reconcile loop no-ops entirely: the route lands unattached to any Gateway, and every external :entrada flow the HTTPRoute was authored to accept drops at the Gateway API implementation’s per-Gateway HTTP-listener fan-in with no field naming the parent-Gateway-binding-axis-drift root cause).
GATEWAY_API_KEY_PATH: Canonical K8s Gateway API HTTPRoute per-HTTPRouteMatch path-matcher container-axis key every gateway_routes-emitted HTTPRoute per-rule matches[] entry mounts its per-match {type, value} path-selection predicate under (spec.rules[].matches[].path). Re-export of the canonical caixa_core::GATEWAY_API_KEY_PATH so the Gateway-API- implementation-side per-HTTPRouteMatch path-matcher-container-axis- key string lives in exactly one place across every caixa renderer — caixa-mesh’s gateway_routes per-Aplicacao HTTPRoute emitter (the per-match match_entry.insert("path", …) call the prior inline "path" literal sat at, seeded from the Aplicacao’s :entrada :paths slot) and every future per-Gateway-API-side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str, so a future Gateway API rebrand on the per-HTTPRouteMatch path- matcher axis (an upstream Gateway API v2 rename to pathMatch / prefix / url, coordinated with the upstream SIG-Network Gateway API deprecation cycle) is a one-line edit on the canonical caixa_core::GATEWAY_API_KEY_PATH declaration, not a coordinated rewrite across this crate’s gateway_routes renderer + every future per-target renderer the substrate adds. The prior inline literal at the one production emitter site would have let a Gateway-API-CRD per-HTTPRouteMatch path-matcher-axis rebrand or a per-emitter typo ("pathMatch" / "prefix" / "url") silently emit an HTTPRoute whose per-match path-selection axis the Gateway API CRD schema validator drops as unknown — the per-match path predicate degrades to the wildcard match at the gateway-class-controller’s per-rule reconcile, the rule matches every request path unconditionally, and every external :entrada path filter the rule was authored to enforce drops with no field naming the path-matcher-drift root cause. Peer to the GATEWAY_API_KEY_MATCHES / GATEWAY_API_KEY_BACKEND_REFS / GATEWAY_API_KEY_PARENT_REFS re-exports on the sibling canonical-Gateway-API-HTTPRoute-body- axis surface — nests the per-Gateway-API-HTTPRoute-per-rule-body- axis canonical-string re-export set (matches, backendRefs, timeouts, retry) one level deeper onto the per-HTTPRouteMatch body-axis surface this crate’s gateway_routes renderer’s external :entrada ingress contract rests on across the Gateway API HTTPRoute-side per-match body-shape. Canonical K8s Gateway API HTTPRoute per-HTTPRouteMatch path-matcher container-axis key every gateway_routes-emitted HTTPRoute per-rule matches[] entry mounts its per-match {type, value} path-selection predicate under (spec.rules[].matches[].path). Nests one level beneath the sibling GATEWAY_API_KEY_MATCHES (b9ede1a) per-rule route-match container-axis it hangs off of — the Gateway API v1 CRD schema pins per-HTTPRouteMatch request-path selection through the spec.rules[].matches[].path container axis (each match entry names one path-selection predicate the request line’s :path pseudo-header must satisfy under a type discriminator of Exact | PathPrefix | RegularExpression) alongside the sibling per- HTTPRouteMatch headers[] / queryParams[] / method axes it nests under, so drift on the per-match path-matcher container axis is exactly as load-bearing as drift on the per-rule route-match axis it nests inside of (the K8s apiserver-side Gateway API CRD schema validator drops any per-match block whose path-matcher container axis carries an unrecognized key — a "pathMatch" / "prefix" / "url" typo silently emits an HTTPRoute whose per- match path-selection axis the Gateway API implementation’s per-rule L7 dispatch loop no-ops entirely: no path predicate is evaluated, the match degrades to the wildcard predicate at the gateway-class- controller’s per-rule reconcile, the rule matches every request path unconditionally, and every external :entrada path filter the rule was authored to enforce drops with no field naming the path- matcher-axis-drift root cause).
GATEWAY_API_KEY_REQUEST: Canonical K8s Gateway API HTTPRoute per-rule request-timeout-policy request leaf scalar-key. Re-export of the canonical caixa_core::GATEWAY_API_KEY_REQUEST so the per-rule request- deadline leaf key lives in exactly one place across every caixa renderer — this crate’s one production emitter site (gateway_routes’s per-HTTPRoute per-rule single_field_overlay(spec.politicas.timeout, …) call that seeds the typed Duration request-deadline string into the sibling GATEWAY_API_KEY_TIMEOUTS container axis under spec.rules[].timeouts.request, the leaf the Gateway API v1 CRD schema pins as HTTPRouteTimeouts.request and whose scalar value the Gateway-API-implementation-side per-rule request-dispatch loop commits to as the per-request wall-clock deadline every inbound request is bounded against before the resolved backend even sees the call) and this crate’s five test-side per-rule request- deadline traversal sites (the httproute_carries_politicas_timeout_on_every_rule typed-&str- value pin, the httproute_timeout_renders_every_rule_independently per-rule fan-out request-deadline pin under multi-:entrada :paths, the httproute_timeout_uses_canonical_kube_duration_format typed- Duration-round-trip pin, the httproute_timeout_renders_minute_window_canonically canonical- minute-form pin, and the timeout-only arm of httproute_timeouts_and_retry_coexist_independently pinning the leaf request-deadline survives when only the sibling :timeout slot is set) now consult the same &'static str as the peer caixa-core-side const definition.
GATEWAY_API_KEY_RETRY: Canonical K8s Gateway API HTTPRoute per-rule retry-policy body-axis key. Re-export of the canonical caixa_core::GATEWAY_API_KEY_RETRY so the per-rule retry-policy field name lives in exactly one place across every caixa renderer — this crate’s one production emitter site (gateway_routes’s per-HTTPRoute per-rule spec.rules[].retry insert the Aplicacao’s typed :politicas :retries overlay lands under, the sub-shape the Gateway API v1 CRD schema pins as HTTPRouteRetry and whose attempts scalar the Gateway-API-implementation-side per-rule request-dispatch loop compares each failed attempt count against before giving up on the in-flight backend call) and this crate’s eight test-side per-rule retry-policy traversal sites (the httproute_rule_keys_pin_overlay_position rule-level top-key-set pin, the httproute_carries_politicas_retries_on_every_rule presence pin, the httproute_omits_retry_when_politicas_retries_unset absence pin, the httproute_retry_renders_every_rule_independently per-rule fan-out pin under multi-:entrada :paths, the httproute_retry_round_trips_typed_attempt_count typed-u32-round- trip pin, the httproute_retry_attempts_serialized_as_yaml_number YAML integer-scalar-kind pin, and two httproute_timeouts_and_retry_coexist_independently presence-only + absence-only pins pinning independent-axis coexistence with the sibling timeouts per-rule request-timeout-policy axis) now consult the same &'static str as the peer caixa-core-side const definition.
GATEWAY_API_KEY_SECTION_NAME: Canonical K8s Gateway API HTTPRoute per-spec.parentRefs[] entry listener-selector sub-axis key every gateway_routes-emitted HTTPRoute document mounts under each parent-Gateway attachment (spec.parentRefs[].sectionName). Re-export of the canonical caixa_core::GATEWAY_API_KEY_SECTION_NAME so the Gateway-API- implementation-side per-parentRef listener-selector-sub-axis-key string lives in exactly one place across every caixa renderer — caixa-mesh’s gateway_routes per-Aplicacao HTTPRoute emitter (the per-parentRef parent_ref.insert(<KEY>, …) call whose paired GATEWAY_API_DEFAULT_HTTP_LISTENER_NAME &'static str value binds the emitted route to the same listener the parent Gateway’s sole listener.insert(GATEWAY_API_KEY_NAME, …) call names) and every future per-Gateway-API-side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str, so a future Gateway API rebrand on the per-parentRef listener-selector sub-axis (an upstream Gateway API v2 rename to listenerName / listener / attachTo, coordinated with the upstream SIG-Network Gateway API deprecation cycle) is a one-line edit on the canonical caixa_core::GATEWAY_API_KEY_SECTION_NAME declaration, not a coordinated rewrite across this crate’s gateway_routes renderer
GATEWAY_API_KEY_TIMEOUTS: Canonical K8s Gateway API HTTPRoute per-rule request-timeout-policy body-axis key. Re-export of the canonical caixa_core::GATEWAY_API_KEY_TIMEOUTS so the per-rule request- timeout-policy field name lives in exactly one place across every caixa renderer — this crate’s one production emitter site (gateway_routes’s per-HTTPRoute per-rule spec.rules[].timeouts insert the Aplicacao’s typed :politicas :timeout overlay lands under, the sub-shape the Gateway API v1 CRD schema pins as HTTPRouteTimeouts and whose request scalar the Gateway-API-implementation-side per-rule request-dispatch loop compares each accepted request’s wall-clock elapsed time against before cancelling the in-flight backend call) and this crate’s eight test-side per-rule timeout-policy traversal sites (the httproute_carries_politicas_timeout_on_every_rule / httproute_omits_timeouts_when_politicas_timeout_unset / httproute_timeout_renders_every_rule_independently / httproute_timeout_uses_canonical_kube_duration_format / httproute_timeout_renders_minute_window_canonically / httproute_rule_keys_pin_overlay_position / httproute_timeouts_and_retry_coexist_independently pins asserting the overlay’s presence, absence, canonical-duration- format contract, per-rule fan-out under multi-:entrada :paths, and independent-axis coexistence with the sibling retry per- rule retry-policy axis) now consult the same &'static str as the peer caixa-core-side const definition.
GATEWAY_API_KEY_VALUE: Canonical K8s Gateway API v1 HTTPPathMatch scalar-payload axis key every gateway_routes-emitted HTTPRoute per-match path block mounts its per-match request-path-selection scalar payload under (spec.rules[].matches[].path.value). Re-export of the canonical caixa_core::GATEWAY_API_KEY_VALUE so the Gateway-API- implementation-side per-HTTPPathMatch scalar-payload-axis-key string lives in exactly one place across every caixa renderer — caixa-mesh’s gateway_routes per-Aplicacao HTTPRoute emitter (the per-match path_match.insert("value", …) call the prior inline "value" literal sat at, seeded from the Aplicacao’s :entrada :paths slot) and every future per-Gateway-API-side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str, so a future Gateway API rebrand on the per-HTTPPathMatch scalar-payload axis (an upstream Gateway API v2 rename to path / pattern / expression, coordinated with the upstream SIG-Network Gateway API deprecation cycle) is a one-line edit on the canonical caixa_core::GATEWAY_API_KEY_VALUE declaration, not a coordinated rewrite across this crate’s gateway_routes renderer
GATEWAY_API_KIND_GATEWAY: Canonical K8s Gateway API CRD kind discriminator every gateway_routes-emitted Gateway document declares at its top-level caixa_core::KUBE_KEY_KIND axis. Re-export of the canonical caixa_core::GATEWAY_API_KIND_GATEWAY so the Gateway-API-conformant CRD kind discriminator string lives in exactly one place across every caixa renderer — caixa-mesh’s gateway_routes per-Aplicacao Gateway emitter (the single production-code site the prior inline "Gateway" literal sat at, caixa-mesh/src/lib.rs:578 — the kube_resource_skeleton kind argument) and every future per- Gateway-API-side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str, so a future Gateway-API rebrand (e.g. an upstream rename to GatewayV1 post-GA) is a one-line edit on the canonical caixa_core::GATEWAY_API_KIND_GATEWAY declaration, not a coordinated rewrite across this crate’s kube_resource_skeleton call site + every future per-target renderer the substrate adds. The prior inline literal would have let a Gateway-API kind rebrand on the caixa-mesh side without a coordinated edit on the matching in-file gateway_carries_canonical_kube_skeleton_without_labels / render_all_includes_every_artifact_kind test fixture pins silently emit a Gateway whose top-level kind drifts off the lifted-test- fixture pins — apply-side: the Gateway lands outside the apiserver- side CRD registration, every external :entrada flow drops at the gateway-class-controller’s reconcile loop with no field naming the kind-drift root cause. Peer to the GATEWAY_API_API_VERSION re-export on the sibling canonical-Gateway-API-CRD-apiVersion-axis — extends the discipline from the apiVersion half of the (apiVersion, kind) CRD-lookup tuple onto the kind half on the same Gateway-API-CRD-axis, beginning the per-Gateway-API-CRD kind+apiVersion re-export pair this crate’s gateway_routes renderer’s external :entrada ingress contract rests on. Peer to the CILIUM_KIND_NETWORK_POLICY re-export on the sibling canonical-Cilium-CRD-kind-discriminator surface. Canonical K8s Gateway API CRD kind discriminator the rendered Gateway document declares at its top-level KUBE_KEY_KIND axis. Pairs with the sibling GATEWAY_API_API_VERSION (3c6cfc3) — the K8s apiserver-side CRD resolution contract is the (apiVersion, kind) tuple keyed against the registered CustomResourceDefinition, so drift on the kind axis is exactly as load-bearing as drift on the apiVersion axis it accompanies (the apiserver’s RESTMapper consults both together; a ("gateway.networking.k8s.io/v1", "Gatway") typo at the production- code call site lands outside the registered Gateway-API-conformant Gateway CRD’s RESTKind lookup, surfacing apply-side as a non-self-locating “no kind ‘Gatway’ is registered for version ‘gateway.networking.k8s.io/v1’” error far from the source caixa.lisp / the renderer’s kube_resource_skeleton call site).
GATEWAY_API_KIND_HTTP_ROUTE: Canonical K8s Gateway API CRD kind discriminator every gateway_routes-emitted HTTPRoute document declares at its top-level caixa_core::KUBE_KEY_KIND axis. Re-export of the canonical caixa_core::GATEWAY_API_KIND_HTTP_ROUTE so the Gateway-API-conformant CRD kind discriminator string lives in exactly one place across every caixa renderer — caixa-mesh’s gateway_routes per-Aplicacao HTTPRoute emitter (the single production-code site the prior inline "HTTPRoute" literal sat at, caixa-mesh/src/lib.rs:663 — the kube_resource_skeleton kind argument) and every future per-Gateway-API-side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str, so a future Gateway-API rebrand (e.g. an upstream rename to HTTPRouteV1 post-GA) is a one-line edit on the canonical caixa_core::GATEWAY_API_KIND_HTTP_ROUTE declaration, not a coordinated rewrite across this crate’s kube_resource_skeleton call site + every future per-target renderer the substrate adds. The prior inline literal would have let a Gateway-API kind rebrand on the caixa-mesh side without a coordinated edit on the matching in-file httproute_carries_canonical_kube_skeleton_without_labels / render_all_includes_every_artifact_kind test fixture pins silently emit an HTTPRoute whose top-level kind drifts off the lifted-test-fixture pins — apply-side: the HTTPRoute lands outside the apiserver-side CRD registration, every external :entrada flow drops at the gateway-class-controller’s reconcile loop with no field naming the kind-drift root cause. Peer to the GATEWAY_API_KIND_GATEWAY re-export on the sibling canonical- Gateway-API-CRD-kind-discriminator surface — completes the per-Gateway-API-CRD kind-axis re-export pair this crate’s gateway_routes renderer’s external :entrada ingress contract rests on across the (Gateway, HTTPRoute) pair the renderer emits together. Canonical K8s Gateway API CRD kind discriminator the rendered HTTPRoute document declares at its top-level KUBE_KEY_KIND axis. Pairs with the sibling GATEWAY_API_API_VERSION (3c6cfc3) and the peer GATEWAY_API_KIND_GATEWAY (fb4639c) — the K8s apiserver-side CRD resolution contract is the (apiVersion, kind) tuple keyed against the registered CustomResourceDefinition, so drift on the kind axis is exactly as load-bearing as drift on the apiVersion axis it accompanies (the apiserver’s RESTMapper consults both together; a ("gateway.networking.k8s.io/v1", "HTTPRout") typo at the production-code call site lands outside the registered Gateway-API- conformant HTTPRoute CRD’s RESTKind lookup, surfacing apply-side as a non-self-locating “no kind ‘HTTPRout’ is registered for version ‘gateway.networking.k8s.io/v1’” error far from the source caixa.lisp / the renderer’s kube_resource_skeleton call site).
GATEWAY_API_PATH_MATCH_TYPE_PATH_PREFIX: Canonical K8s Gateway API v1 PathMatchType OpenAPI schema enum’s PathPrefix per-HTTPRouteMatch path-selection-predicate discriminator value every gateway_routes-emitted HTTPRoute per-rule matches[] entry declares under its per-match spec.rules[].matches[].path.type scalar axis. Re-export of the canonical caixa_core::GATEWAY_API_PATH_MATCH_TYPE_PATH_PREFIX so the Gateway- API-implementation-side per-HTTPRouteMatch request-path-selection- predicate discriminator scalar value lives in exactly one place across every caixa renderer — caixa-mesh’s gateway_routes per-Aplicacao HTTPRoute emitter (the single production-code site the prior inline "PathPrefix".into() literal sat at, caixa-mesh/src/lib.rs — the per-match path_match.insert("type", "PathPrefix") scalar-value emit) and every future per-Gateway-API-side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str, so a future Gateway API PathMatchType enum rebrand (e.g. an upstream rename to Prefix / PathPrefixMatch per the SIG-Network per-version-scope proposal) is a one-line edit on the canonical caixa_core::GATEWAY_API_PATH_MATCH_TYPE_PATH_PREFIX declaration, not a coordinated rewrite across this crate’s gateway_routes renderer’s per-match path_match.insert scalar-value emit + every future per-Gateway-API-side renderer the substrate adds. The prior inline literal at the one production emitter site would have let a Gateway-API PathMatchType rebrand on the caixa-mesh side without a coordinated caixa-core edit silently emit an HTTPRoute whose per- match path-selection-predicate scalar drifts off the canonical caixa_core::GATEWAY_API_PATH_MATCH_TYPE_PATH_PREFIX value — apply-side: the K8s apiserver-side Gateway API v1 PathMatchType OpenAPI schema enum admits the closed set {"Exact", "PathPrefix", "RegularExpression"} verbatim, so any drifted value lands the emitted HTTPRoute outside the enum’s admitted set and every external :entrada path-filtered flow drops at the gateway-class-controller’s admission gate with no field naming the path-match-type-drift root cause. Peer to the GATEWAY_API_PROTOCOL_HTTP re-export on the sibling per-Gateway- listener L7-parser-selection scalar-value axis — extends the canonical-Gateway-API-v1-OpenAPI-schema-enum-value single-sourcing re-export discipline the ProtocolType.HTTP re-export established onto the sibling PathMatchType.PathPrefix per-HTTPRouteMatch path-selection-predicate discriminator the same gateway_routes external :entrada ingress emitter carries under the shared HTTPRoute body. Canonical K8s Gateway API v1 PathMatchType OpenAPI schema enum’s PathPrefix per-HTTPRouteMatch path-selection-predicate discriminator value every gateway_routes-emitted HTTPRoute per-rule matches[] entry declares under its per-match spec.rules[].matches[].path.type scalar axis. Pairs with the sibling GATEWAY_API_KEY_PATH (9f45aa4) per-HTTPRouteMatch path-matcher container-axis key it nests one level beneath — the Gateway API v1 CRD schema pins per-HTTPRouteMatch request-path selection through the spec.rules[].matches[].path container axis (each match entry names one path-selection predicate the request line’s :path pseudo-header must satisfy under a type discriminator scalar value; the Gateway API v1 PathMatchType OpenAPI schema enum admits the closed set {"Exact", "PathPrefix", "RegularExpression"} verbatim), so drift on the path-match-type value is exactly as load-bearing as drift on the sibling GATEWAY_API_PROTOCOL_HTTP (1b57473) per-listener L7-parser-selection scalar value the peer spec.listeners[].protocol axis carries (a "pathPrefix" / "path_prefix" / "Prefix" / "path-prefix" typo at the production-code call site lands outside the Gateway API v1 PathMatchType OpenAPI schema enum’s admitted set, surfacing apply-side as a non-self-locating “spec.rules[0].matches[0].path.type: Unsupported value: "pathPrefix": supported values: "Exact", "PathPrefix", "RegularExpression"” apiserver admission-rejection far from the source caixa.lisp / the renderer’s path_match.insert(…) call site — the rendered per-Aplicacao HTTPRoute object never reconciles at the gateway-class-controller’s per-rule L7 dispatch loop and every external :entrada path-filtered flow drops at the gateway-class-controller’s admission gate with no field naming the path-match-type-drift root cause).
GATEWAY_API_PROTOCOL_HTTP: Canonical K8s Gateway API v1 ProtocolType OpenAPI schema enum’s HTTP listener-protocol scalar value every gateway_routes-emitted Gateway document’s first (and V0-only) listener declares under its caixa_core::KUBE_KEY_PROTOCOL axis. Re-export of the canonical caixa_core::GATEWAY_API_PROTOCOL_HTTP so the Gateway-API- implementation-side per-listener L7-parser-selection scalar value lives in exactly one place across every caixa renderer — caixa-mesh’s gateway_routes per-:entrada Gateway emitter (the single production-code site the prior inline "HTTP".into() literal sat at, caixa-mesh/src/lib.rs:2123 — the per-listener KUBE_KEY_PROTOCOL scalar-value emit) and every future per-Gateway-API-side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str, so a future Gateway API ProtocolType enum rebrand (e.g. an upstream rename to HTTP/1.1 / HTTP/2 per the SIG-Network per-version-scope proposal) is a one-line edit on the canonical caixa_core::GATEWAY_API_PROTOCOL_HTTP declaration, not a coordinated rewrite across this crate’s gateway_routes renderer’s per-listener KUBE_KEY_PROTOCOL-scalar-value emit + the matching in-file gateway_listener_carries_aplicacao_host test’s assert_eq!(…, Some("HTTP")) listener-protocol-value pin + every future per-Gateway-API-side renderer the substrate adds. The prior inline literal would have let a Gateway-API ProtocolType rebrand on the caixa-mesh side without a coordinated edit on the matching in-file test pin silently emit a Gateway whose listener-protocol scalar drifts off the lifted-test-fixture pin — apply-side: the gateway-class-controller’s per-listener bind loop rejects the Gateway at admission (the K8s Gateway API v1 ProtocolType OpenAPI schema enum admits the closed set {"HTTP", "HTTPS", "TCP", "TLS", "UDP"} verbatim), and every external :entrada HTTP flow drops at the gateway-class-controller’s admission gate with no field naming the listener-protocol-drift root cause. Peer to the GATEWAY_API_KIND_GATEWAY + GATEWAY_API_KIND_HTTP_ROUTE re-exports on the sibling canonical-Gateway-API-CRD-kind- discriminator surface + the DEFAULT_GATEWAY_CLASS_NAME re-export on the sibling Gateway-controller-binding-scalar-value axis — extends the Gateway-API-CRD-kind-value + Gateway-controller- binding-value re-export set onto the sibling per-Gateway spec.listeners[].protocol listener-protocol-scalar-value axis the same gateway_routes renderer’s external :entrada ingress contract carries under the shared Gateway body. Canonical K8s Gateway API Gateway.spec.listeners[].protocol HTTP listener-protocol scalar value the rendered Gateway document’s first (and V0-only) listener declares under its KUBE_KEY_PROTOCOL axis. Pairs with the sibling GATEWAY_API_KIND_GATEWAY (fb4639c) + GATEWAY_API_KIND_HTTP_ROUTE (1adccc0) — the K8s Gateway API v1 CRD schema pins the per-listener L7 parser + TLS-termination strategy through the spec.listeners[].protocol scalar value (the gateway-class-controller’s per-listener bind loop selects the L7 parser + TLS termination strategy from this exact byte-sequence; the Gateway API v1 ProtocolType OpenAPI schema enum admits the closed set {"HTTP", "HTTPS", "TCP", "TLS", "UDP"} verbatim), so drift on the listener-protocol value is exactly as load-bearing as drift on the sibling GATEWAY_API_KIND_GATEWAY + GATEWAY_API_KIND_HTTP_ROUTE CRD kind discriminators the pair declares together (a ("Gateway", "http") / ("Gateway", "Http") / ("Gateway", "http/1.1") typo at the production-code call site lands outside the Gateway API v1 ProtocolType OpenAPI schema enum, surfacing apply-side as a non-self-locating “spec.listeners[0].protocol: Unsupported value: "http": supported values: "HTTP", "HTTPS", "TCP", "TLS", "UDP"” apiserver admission-rejection far from the source caixa.lisp / the renderer’s listener.insert(…) call site — the rendered per-Aplicacao Gateway object never reconciles at the gateway-class-controller’s per-listener bind loop and every external :entrada HTTP flow drops at the gateway-class- controller’s admission gate with no field naming the listener-protocol-drift root cause).
KUBE_KEY_API_VERSION: Canonical K8s CR top-level apiVersion key. Re-export of the canonical caixa_core::KUBE_KEY_API_VERSION so the per-CR- apiVersion-axis retrieval key lives in exactly one place across every caixa renderer — caixa-mesh’s cilium_network_policies + gateway_routes test-side (:kind, :apiVersion) CRD-lookup-tuple pins (every p.get("apiVersion") / gateway.get("apiVersion") / route.get("apiVersion") retrieval that traverses the multi-doc sequence the gateway_routes / cilium_network_policies emitters return to assert the top-level apiVersion axis on each per-CNP / per-Gateway / per-HTTPRoute document binds to the lifted CILIUM_API_VERSION / GATEWAY_API_API_VERSION CRD-group/ version) now consult the same &'static str as the peer caixa-core-side kube_resource_skeleton production emitter (which already inserts KUBE_KEY_API_VERSION under caixa-core/src/render.rs:7177 on the KUBE_KEY_API_VERSION + KUBE_KEY_KIND axis pair every rendered CR carries). The prior inline "apiVersion" literals at every drift-detection / CRD- group-version pin test-side site in this crate would have let a typo on any one site (e.g. "ApiVersion", "api-version", "apiVerison") silently miss the per-CR apiVersion retrieval — the equality assertion would then compare None against Some("cilium.io/v2") / Some("gateway.networking.k8s.io/v1") rather than the expected CRD-group/version string, masking the true sibling CILIUM_API_VERSION / GATEWAY_API_API_VERSION axis drift. The lift routes every K8s-CR-top-level-apiVersion- axis retrieval through the same &'static str so drift between any two sites becomes a single-edit fix at the caixa-core const definition. Same shape as the KUBE_KEY_SPEC + KUBE_KEY_METADATA
KUBE_KEY_KIND: Canonical K8s CR top-level kind discriminator key. Re-export of the canonical caixa_core::KUBE_KEY_KIND so the per-CR-kind-axis retrieval key lives in exactly one place across every caixa renderer — caixa-mesh’s cilium_network_policies + gateway_routes + render_all test-side (:kind, :apiVersion) CRD-lookup-tuple traversal predicates (every docs.iter().find(|d| d.get("kind")…) + for p in &policies { p.get("kind")… } filter that separates the rendered Gateway / HTTPRoute / CiliumNetworkPolicy documents inside the multi-doc sequence the gateway_routes / render_all emitters return) now consult the same &'static str as the peer caixa-core-side kube_resource_skeleton production emitter (which already inserts KUBE_KEY_KIND under caixa-core/src/render.rs:7181 on the caixa_core::KUBE_KEY_API_VERSION + KUBE_KEY_KIND axis pair every rendered CR carries). The prior inline "kind" literals at every drift-detection / policy-traversal / render- determinism test-side site in this crate would have let a typo on any one site (e.g. "Kind", "kinds", "knid") silently miss the per-CR kind-axis retrieval — the equality assertion would then compare None against Some("CiliumNetworkPolicy") / Some("Gateway") / Some("HTTPRoute") rather than the expected kind discriminator, and the docs.iter().find(|d| d.get(…) == Some(…)) predicate would silently miss the per-kind document inside the multi-doc sequence (the .expect("Gateway present") unwrap that names the offending axis would fire instead of the intended assertion, masking the true drift). The lift routes every K8s-CR-top-level-kind-axis retrieval through the same &'static str so drift between any two sites becomes a single-edit fix at the caixa-core const definition. Same shape as the KUBE_KEY_SPEC + KUBE_KEY_METADATA re-exports on the sibling K8s-CR top-level-spec / top-level-metadata axes — completes the per-K8s-CR top-level (apiVersion, kind, metadata, spec) axis re-export set on the kind half, which every downstream docs.iter().find(|d| d.get(KUBE_KEY_KIND)…) predicate the multi-doc render_all sequence-consumer needs to distinguish the emitted Cilium / Gateway / HTTPRoute documents by rests on. Canonical K8s API key naming the resource’s kind discriminator (e.g. CiliumNetworkPolicy, Gateway, HTTPRoute, ComputeUnit).
KUBE_KEY_LABELS: Canonical K8s CR metadata.labels nested-axis key. Re-export of the canonical caixa_core::KUBE_KEY_LABELS so the per-CR labels-axis retrieval key lives in exactly one place across every caixa renderer — caixa-mesh’s cilium_policy_metadata_labels_use_lifted_consts test-side retrieval of the per-CNP metadata.labels mapping (the LABEL_APLICACAO + LABEL_CONTRATO drift-detection pin’s entry point), caixa-mesh’s cilium_policy_carries_canonical_kube_skeleton + gateway_carries_canonical_kube_skeleton_without_labels + httproute_carries_canonical_kube_skeleton_without_labels per-CR metadata-block .get("labels") probes (the presence-of-labels / empty-labels-skip semantic pins on CiliumNetworkPolicy / Gateway / HTTPRoute), and the cilium_policy_metadata_block_iterates_alphabetically render- determinism-contract fixture (the alphabetical-iteration vec!["labels", "name", KUBE_KEY_NAMESPACE] fixture whose first entry the alphabetical- key-ordering metadata: block emission pins). The prior five inline "labels" literals at every drift-detection / render-determinism test-side site in this crate would have let a typo on any one site (e.g. "Labels", "lables", the canonical transposition "lablels") silently miss the per-CR metadata.labels retrieval — the .get("labels") chain would then return None and the trailing .expect("policy metadata.labels mapping") would panic with the mapping-shape message, masking the true label-key drift, or the presence-of-labels / empty-labels-skip semantic pins would compare Some(...)/None under the wrong retrieval so the empty-labels-skip contract’s true drift never surfaces, or the alphabetical-iteration render-determinism fixture would fire on the drifted-fixture rather than the true render-determinism property. The lift routes every K8s- CR-metadata-labels-axis retrieval + fixture through the same &'static str so drift between any two sites becomes a single-edit fix at the caixa-core const definition. Extends the per-K8s-CR top-level (apiVersion, kind, metadata, spec) axis re-export quartet + the load-bearing nested metadata.namespace axis onto the load-bearing nested metadata.labels axis — the axis every rendered CiliumNetworkPolicy document carries at the pleme.pleme.io/ aplicacao + pleme.pleme.io/contrato grouping key (the Hubble flow- grouping / operator-policy-filter selection axis every consumer of the rendered mesh bundle keys off) so exactly one canonical byte- sequence must reach every rendered artifact. Canonical K8s API key naming the resource’s labels (under metadata).
KUBE_KEY_MATCH_LABELS: Canonical K8s LabelSelector.matchLabels nested-axis key. Re-export of the canonical caixa_core::KUBE_KEY_MATCH_LABELS so the per-CR selector-axis retrieval key lives in exactly one place across every caixa renderer — caixa-mesh’s cilium_policies_are_identity_based (the endpointSelector.matchLabels presence pin + the ingress[0].fromEndpoints[0].matchLabels two-axis-selector pin that check the pleme.pleme.io/program + pleme.pleme.io/aplicacao identity keys the Cilium data plane matches on), the cilium_endpoint_selector_is_program_only destination-selector-axis pin (single-axis LABEL_PROGRAM-only selector — the destination-endpointSelector.matchLabels retrieval whose selector.len() == 1 assertion pins the program-only semantic the canonical pleme_program_selector helper emits), and the cilium_from_endpoints_carries_aplicacao_scoped_selector source- selector-axis pin (two-axis LABEL_PROGRAM + LABEL_APLICACAO selector — the source-fromEndpoints[0].matchLabels retrieval whose from.len() == 2 assertion pins the program-in-Aplicacao-scoped semantic the canonical pleme_program_in_aplicacao_selector helper emits, guarding the safety property that a same-named program in a different Aplicacao cannot satisfy the policy’s ingress rule) now consult the same &'static str as the peer caixa-core-side label_selector production emitter (which already inserts KUBE_KEY_MATCH_LABELS under caixa-core/src/render.rs:7112 on every {matchLabels: <mapping>} envelope the typed selector helpers emit). The prior four inline "matchLabels" literals at every drift-detection / selector-axis test-side site in this crate would have let a typo on any one site (e.g. "MatchLabels", "match_labels", "match-labels", the canonical camelCase-drift "matchlabels" — the K8s apiserver’s OpenAPI v3 schema property name is strict camelCase matchLabels) silently miss the per-CR selector-mapping retrieval — the .get("matchLabels") chain would then return None under the presence pin so the true selector-axis drift never surfaces, or the surrounding .expect("endpointSelector.matchLabels mapping") / .expect("fromEndpoints[0].matchLabels mapping") panic-message tag would fire with the mapping-shape message rather than the true selector-key drift, or the selector.len() == 1 / from.len() == 2 axis-count assertion would compare against the wrong retrieval so the destination-program-only / source-program- in-Aplicacao selector-shape contract’s true drift is masked. The lift routes every K8s-LabelSelector.matchLabels-axis retrieval through the same &'static str so drift between any two sites becomes a single-edit fix at the caixa-core const definition. Extends the per-K8s-CR top-level (apiVersion, kind, metadata, spec) axis re-export quartet + the load-bearing nested metadata.{name, namespace, labels} triplet onto the load-bearing nested LabelSelector.matchLabels axis — the equality-projection axis every rendered CiliumNetworkPolicy document carries at both spec.endpointSelector.matchLabels (the destination-identity selector the Cilium data plane matches pod-identity keys against) and spec.ingress[*].fromEndpoints[*].matchLabels (the source- identity selector the same data plane checks on the admitted- source side). Peer to the sibling load-bearing nested LabelSelector.matchLabels axis re-exports every downstream consumer of the rendered mesh bundle keys off (the Cilium operator’s per-CNP endpointSelector and per-ingress-rule fromEndpoints navigate the same K8s-LabelSelector-schema projection). Canonical K8s API key naming the matchLabels axis of a LabelSelector — the equality-based projection of the selector schema (the other axis, matchExpressions, is set-based and intentionally out-of-scope for the V0 label_selector helper). Spelled exactly as the K8s apiserver expects (camelCase matchLabels, not match_labels / MatchLabels / match-labels) so the rendered YAML round-trips through every K8s schema parser (Cilium CRDs, Gateway API, ComputeUnit, future mesh.pleme.io/v1alpha1/Aplicacao) without per-renderer string drift.
KUBE_KEY_METADATA: Canonical K8s CR top-level metadata key. Re-export of the canonical caixa_core::KUBE_KEY_METADATA so the per-kind metadata block key lives in exactly one place across every caixa renderer — caixa-mesh’s cilium_network_policies per-(:de, :para) CiliumNetworkPolicy emitter (the metadata.{name, namespace, labels} block every policy carries) and gateway_routes Gateway + HTTPRoute emitter (the metadata.{name, namespace} block each doc carries) now consult the same &'static str as the peer caixa-flux renderer’s KUBE_KEY_METADATA re-export. The prior inline "metadata" literals at every drift-detection / policy-traversal test-side site in this crate would have let a typo on any one site (e.g. "Metadata", "meta-data", "medadata") silently miss the per-CNP / per-Gateway / per-HTTPRoute metadata retrieval — the equality assertion would then compare None against Some("checkout") rather than the expected label value; the lift routes every K8s-CR-top-level- metadata-axis retrieval through the same &'static str so drift between any two sites becomes a single-edit fix at the caixa-core const definition. Same shape as the KUBE_KEY_SPEC re-export on the sibling K8s-CR top-level-spec-axis. Canonical K8s API key naming the resource’s metadata block.
KUBE_KEY_NAME: Canonical K8s CR metadata.name nested-axis key. Re-export of the canonical caixa_core::KUBE_KEY_NAME so the per-CR name-axis retrieval key lives in exactly one place across every caixa renderer — caixa-mesh’s cilium_policy_carries_canonical_kube_skeleton + gateway_carries_canonical_kube_skeleton_without_labels + httproute_carries_canonical_kube_skeleton_without_labels per-CR metadata-block .get("name") retrievals (the presence + equality pins on CiliumNetworkPolicy / Gateway / HTTPRoute), the six per-CNP metadata.name-axis lookup navigations across the cilium_policy_metadata_names_span_all_edges / cilium_fans_same_de_para_edges_into_one_policy / cilium_http_contracts_emit_l7_rules / cilium_pubsub_contracts_skip_l7_rules / cnp_l4_fallback_port_routes_through_lifted_default_servico_port / cilium_mtls_required_contract_emits_authentication_required test-side policies.iter().find(|p| p.get(KUBE_KEY_METADATA) .and_then(|m| m.get(KUBE_KEY_NAME))) filters (the per-CNP <aplicacao>-<de>-to-<para> metadata.name binding that names every CiliumNetworkPolicy document the per-(:de, :para) fan-out emits), and the cilium_policy_metadata_block_iterates_alphabetically render-determinism-contract fixture (the alphabetical-iteration vec![KUBE_KEY_LABELS, "name", KUBE_KEY_NAMESPACE] fixture whose middle entry the alphabetical-key-ordering metadata: block emission pins). The prior ten inline "name" literals at every drift-detection / per-CNP-lookup / render-determinism test-side site in this crate would have let a typo on any one site (e.g. "Name", "nmae", the canonical transposition "naem") silently miss the per-CR metadata.name retrieval — the .get("name") chain would then return None under the presence pin so the true metadata-name-axis drift never surfaces, or compare Some(<other>) against the expected caixa name/route name under the equality pins so the caixa-nome → metadata-name binding’s true drift is masked, or slip past the per-CNP metadata.name filter under the six per-(:de, :para) lookup navigations so the true policy-identity → edge-shape binding under fan-in / L7-emission / L4-fallback / mTLS-authentication drift never surfaces (each .find(|p| p.get(KUBE_KEY_METADATA) .and_then(|m| m.get("name"))) chain would silently return .unwrap()-panicking None on the first per-CNP lookup or match the wrong policy under the equality-comparison filter, masking the true fan-in / L7-rule / L4-port / mTLS-authentication mode property), or trip the alphabetical-iteration determinism fixture against the drifted-fixture rather than the true render-determinism property. The lift routes every K8s-CR-metadata-name-axis retrieval
KUBE_KEY_NAMESPACE: Canonical K8s CR metadata.namespace nested-axis key. Re-export of the canonical caixa_core::KUBE_KEY_NAMESPACE so the per-CR namespace-axis retrieval key lives in exactly one place across every caixa renderer — caixa-mesh’s cilium_policy_carries_canonical_kube_skeleton / gateway_carries_canonical_kube_skeleton_without_labels / cilium_policy_metadata_block_iterates_alphabetically test-side metadata.namespace retrievals + alphabetical-iteration determinism pin (the three inline "namespace" sites this crate’s rendered multi-doc mesh bundle’s per-CR metadata.{name, namespace, labels} / metadata.{name, namespace} block traversal navigates) now consult the same &'static str as the peer caixa-core-side kube_resource_skeleton production emitter (which already inserts KUBE_KEY_NAMESPACE under caixa-core/src/render.rs:9019 on the per-CR metadata block every rendered mesh bundle document carries). The prior inline "namespace" literals at every drift-detection / render-determinism test-side site in this crate would have let a typo on any one site (e.g. "Namespace", "name space", the canonical transposition "namesapce") silently miss the per-CR metadata.namespace retrieval — the equality assertion would then compare None against Some(DEFAULT_NAMESPACE) rather than the expected namespace value, masking the true sibling DEFAULT_NAMESPACE axis drift; the alphabetical-iteration determinism pin’s vec!["labels", "name", "namespace"] fixture would compare against the actually-iterated key sequence and fire on the drifted-fixture rather than the true render-determinism property. The lift routes every K8s-CR-metadata-namespace-axis retrieval + fixture through the same &'static str so drift between any two sites becomes a single-edit fix at the caixa-core const definition. Peer to caixa_flux::KUBE_KEY_NAMESPACE (44bebfe) on the sibling renderer crate — extends the discipline from the Flux v2 controller-triplet + ComputeUnit-side metadata.namespace drift-detection pins onto the Cilium + Gateway API controller-pair metadata.namespace drift-detection pins in this crate. Extends the per-K8s-CR top-level (apiVersion, kind, metadata, spec) axis re-export quartet onto the load-bearing nested metadata.namespace axis — the axis every rendered CiliumNetworkPolicy / Gateway / HTTPRoute document binds to on the deploy path (the Cilium operator’s per-CNP endpointSelector matches pods in this namespace; the gateway-class-controller’s per-Gateway listener attaches only to HTTPRoutes in this namespace; every apiserver-side CR admission- time schema validates against it) so exactly one canonical byte-sequence must reach every rendered artifact. Canonical K8s API key naming the resource’s namespace (under metadata).
KUBE_KEY_PORT: Canonical K8s CR L4-port scalar-axis key. Re-export of the canonical caixa_core::KUBE_KEY_PORT so the per-CR L4-port scalar field name lives in exactly one place across every caixa renderer — this crate’s three production-code emission sites (cilium_network_policies’s per-toPorts[].ports[] port-tuple port: scalar the Cilium data plane’s per-tuple bpf policy dispatch loop compares against the observed TCP/UDP L4 header port value, gateway_routes’s per-Gateway per-listener spec.listeners[].port scalar the gateway-class-controller’s per-listener bind loop opens the listener socket on, gateway_routes’s per-HTTPRoute per-rule spec.rules[].backendRefs[].port scalar the gateway-class- controller’s per-rule backend-dispatch loop forwards the matched request to on the resolved Service / ExternalName backend) and this crate’s two test-side L4-port traversal sites (the cilium_l4_ports_default_to_servico_port .get("port") under toPorts[].ports[] L7-fallback-port-content pin threading through [DEFAULT_SERVICO_PORT], the gateway_emits_gateway_plus_httproute_pair .get("port") under backendRefs[] HTTPRoute-backend-port-content pin) now consult the same &'static str as the peer caixa-core-side const definition.
KUBE_KEY_PROTOCOL: Canonical K8s CR L4/L7 protocol scalar-discriminator-axis key. Re-export of the canonical caixa_core::KUBE_KEY_PROTOCOL so the per-CR protocol scalar-discriminator field name lives in exactly one place across every caixa renderer — this crate’s two production-code emission sites (cilium_network_policies’s per-toPorts[].ports[] port-tuple protocol: scalar the Cilium data plane’s per-tuple bpf policy dispatch loop compares against the observed L4 header protocol before applying the port match, gateway_routes’s per-Gateway per-listener spec.listeners[].protocol scalar the gateway-class-controller’s per-listener bind loop selects the L7 parser + TLS termination strategy from) and this crate’s one test-side protocol-scalar traversal site (the gateway_emits_gateway_plus_httproute_pair .get("protocol") retrieval on the emitted Gateway’s first listener pinning the canonical HTTP listener-protocol content) now consult the same &'static str as the peer caixa-core-side const definition.
KUBE_KEY_RULES: Canonical K8s CR rules collection-axis key. Re-export of the canonical caixa_core::KUBE_KEY_RULES so the per-CR rule-list container key lives in exactly one place across every caixa renderer — this crate’s two production-code emitters (cilium_network_policies’s per-toPorts[] rules: L7 rule-list mapping the Cilium data plane dispatches HTTP / Kafka / DNS L7 rules under, gateway_routes’s HTTPRoute spec.rules[] sequence the gateway-class-controller dispatches per-rule matches[] + backendRefs[] + timeouts / retries overlay under) and this crate’s five test-side rule-list traversal sites (the httproute_carries_paths_from_http_endpoints .get("rules") under toPorts[] L7-path-content pin, the cilium_l7_rules_are_http_only .get("rules") under toPorts[] L7-http-only-shape pin, the cilium_pubsub_contracts_skip_l7_rules to_ports.get("rules").is_none() pubsub-contracts-carry-no-L7-rules absence pin, the gateway_emits_gateway_plus_httproute_pair .get("rules") under spec HTTPRoute-backendRefs-shape pin, and the httproute_rules test-fixture helper .get("rules") under spec HTTPRoute-rule- sequence retrieval every downstream policy-timeout / retries / mtls / rate-limit determinism pin reaches through) now consult the same &'static str as the peer caixa-core-side const definition.
KUBE_KEY_SPEC: Canonical K8s CR top-level spec key. Re-export of the canonical caixa_core::KUBE_KEY_SPEC so the per-kind body key lives in exactly one place across every caixa renderer — caixa-mesh’s cilium_network_policies per-(:de, :para) CiliumNetworkPolicy emitter (the endpointSelector + ingress block under spec), caixa-mesh’s gateway_routes Gateway + HTTPRoute emitter (the listeners / rules / parentRefs / hostnames block under spec), and every future per-target renderer that materializes a CR (the M4 mesh.pleme.io/v1alpha1/Aplicacao materializer’s per-policy spec block, the future per-Servico ComputeUnit schema reroute) consults the same &'static str. The prior inline "spec".into() literals at the three production-code call sites in this crate would have let a typo / camelCase drift on any one of the three sites silently emit a CR with no recognizable spec (the apiserver-side CRD schema validator drops the malformed document at apply time, naming the unrecognized key but not the source-side renderer call site). Peer to the GATEWAY_API_API_VERSION / CILIUM_API_VERSION re-exports on the sibling canonical-K8s-API-axis surfaces. Canonical K8s API key naming the resource’s per-kind body (sibling to KUBE_KEY_METADATA at the K8s CR top level). Every typed substrate renderer that materializes a CR populates spec.* from the source caixa.lisp — caixa-mesh’s cilium_network_policies per-(:de, :para) CiliumNetworkPolicy emitter (the policy’s endpointSelector / ingress block lives under spec), caixa-mesh’s gateway_routes Gateway + HTTPRoute emitter (the listeners / rules / parentRefs block lives under spec), caixa-flux’s programs_yaml_entry + upsert_into_helmrelease_programs (the fleet HelmRelease’s spec.values.programs[] axis), caixa-helm’s values.yaml builder (the upstream ComputeUnit YAML’s spec.* axis the rendered lareira-<nome> chart re-routes through the library alias). Spelled exactly as the K8s apiserver expects (the canonical OpenAPI v3 schema property name K8s machinery validates against on every CR registration), so the rendered YAML round-trips through every K8s schema parser without per-renderer string drift. Lifted on the trajectory the peer KUBE_KEY_API_VERSION / KUBE_KEY_KIND / KUBE_KEY_METADATA / KUBE_KEY_NAME / KUBE_KEY_NAMESPACE / KUBE_KEY_LABELS / KUBE_KEY_MATCH_LABELS canonical-K8s- API-key constants establish.
KUBE_KEY_TYPE: Canonical K8s CR discriminated-union type scalar-discriminator- axis key. Re-export of the canonical caixa_core::KUBE_KEY_TYPE so the per-CR discriminated-union type scalar-discriminator field name lives in exactly one place across every caixa renderer — this crate’s one production-code emission site (gateway_routes’s per- rule per-HTTPRouteMatch spec.rules[].matches[].path.type scalar the gateway-class-controller’s per-rule L7 dispatch pass selects the path-match strategy from) and this crate’s test-side traversal sites navigating the rendered HTTPRoute’s per-match path-selection- predicate discriminator now consult the same &'static str as the peer caixa-core-side const definition. Pairs with the sibling GATEWAY_API_PATH_MATCH_TYPE_PATH_PREFIX re-export on the per- HTTPRouteMatch path-selection-predicate discriminator scalar-VALUE axis the discriminator scalar-KEY here holds under, closing the per-HTTPRouteMatch path-selection-predicate (type key → PathPrefix value) scalar-key/scalar-value discriminator axis pair this crate’s gateway_routes renderer’s external :entrada per- path L7-filtering ingress contract rests on — the same shape the sibling KUBE_KEY_PROTOCOL key + KUBE_PROTOCOL_TCP / GATEWAY_API_PROTOCOL_HTTP value pair already carries on the L4/L7-protocol scalar-discriminator surface.
KUBE_PROTOCOL_TCP: Canonical K8s core Protocol OpenAPI schema enum’s TCP L4-transport- protocol scalar value every cilium_network_policies-emitted CiliumNetworkPolicy document’s per-spec.ingress[].toPorts[].ports[] port-tuple declares under its per-tuple caixa_core::KUBE_KEY_PROTOCOL axis. Re-export of the canonical caixa_core::KUBE_PROTOCOL_TCP so the K8s-core-Protocol-enum-side per-port-tuple L4-transport-selection scalar value lives in exactly one place across every caixa renderer — caixa-mesh’s cilium_network_policies per-(:de, :para) CNP emitter (the single production-code site the prior inline "TCP".into() literal sat at, caixa-mesh/src/lib.rs — the per-toPorts[].ports[] port-tuple KUBE_KEY_PROTOCOL scalar-value emit) and every future per-Cilium-CNP-side / K8s-core-Protocol-side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str, so a future K8s core Protocol enum rebrand (e.g. the KEP-3675 QUIC transport proposal’s "QUIC" addition to the enum, coordinated with the upstream SIG-Network per-version deprecation cycle) is a one-line edit on the canonical caixa_core::KUBE_PROTOCOL_TCP declaration, not a coordinated rewrite across this crate’s cilium_network_policies renderer’s per-port-tuple KUBE_KEY_PROTOCOL-scalar-value emit + every future per-Cilium-CNP-side renderer the substrate adds. The prior inline literal would have let a K8s core Protocol rebrand on the caixa-mesh side without a coordinated edit silently emit a CiliumNetworkPolicy whose per-toPorts[].ports[] port-tuple L4-transport-protocol scalar drifts off the K8s core Protocol enum’s admitted closed set — apply-side: the Cilium operator’s per-CNP L4 dispatch pass rejects the object at admission (the K8s core Protocol OpenAPI schema enum admits the closed set {"TCP", "UDP", "SCTP"} verbatim), and every intra-mesh :contratos L4-tuple-gated flow drops at the Cilium operator’s admission gate with no field naming the L4- transport-protocol-drift root cause; worse — because the protocol scalar carries a schema-side default of TCP on the K8s core Protocol enum, a silently-elided drift on the emit lands a CiliumNetworkPolicy whose ingress rule falls back to the default L4-transport-protocol and every port-match on a non-default transport silently misses at the eBPF data plane’s per-tuple dispatch. Peer to the GATEWAY_API_PROTOCOL_HTTP + GATEWAY_API_PATH_MATCH_TYPE_PATH_PREFIX re-exports on the sibling canonical-Gateway-API-v1-OpenAPI-schema-enum-value surface — extends the Gateway-API-v1-OpenAPI-schema-enum-value re-export pair onto the sibling K8s-core-Protocol-OpenAPI-schema-enum-value axis the same cilium_network_policies renderer’s intra-mesh L4-tuple-gating contract carries under the shared CiliumNetworkPolicy body. Canonical K8s core Protocol OpenAPI schema enum’s TCP L4-transport- protocol scalar value every cilium_network_policies-emitted CiliumNetworkPolicy document’s per-spec.ingress[].toPorts[].ports[] port-tuple declares under its per-tuple KUBE_KEY_PROTOCOL axis. Pairs with the sibling KUBE_KEY_PROTOCOL (0307950) per-CR L4/L7 protocol-scalar-discriminator container-axis key the value nests directly under — the K8s core Protocol schema pins per-ContainerPort / ServicePort / EndpointPort / NetworkPolicyPort L4-transport selection through the protocol scalar (each port entry names one L4-transport-protocol discriminator the CNI / kube-proxy / eBPF-data- plane bpf policy dispatch loop keys off before applying the port match; the K8s core Protocol OpenAPI schema enum admits the closed set {"TCP", "UDP", "SCTP"} verbatim — see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1/#protocol-v1-core), so drift on the L4-transport-protocol value is exactly as load-bearing as drift on the sibling GATEWAY_API_PROTOCOL_HTTP (1b57473) per- listener L7-parser-selection scalar value the peer Gateway-API v1 ProtocolType OpenAPI schema enum admits under the same KUBE_KEY_PROTOCOL container-axis key (a "tcp" / "Tcp" / "TCP/IP" / "transport-tcp" typo at the production-code call site lands outside the K8s core Protocol OpenAPI schema enum’s admitted set, surfacing apply-side as a non-self-locating “spec.ingress[0].toPorts[0].ports[0].protocol: Unsupported value: "tcp": supported values: "SCTP", "TCP", "UDP"” apiserver admission-rejection far from the source caixa.lisp / the renderer’s port_entry.insert(…) call site — the rendered per-(:de, :para) CiliumNetworkPolicy object never reconciles at the Cilium operator’s per-CNP L4 dispatch pass and every intra-mesh :contratos L4-tuple- gated flow drops at the Cilium operator’s admission gate with no field naming the L4-transport-protocol-drift root cause; worse — because the protocol scalar carries a schema-side default of TCP on the K8s core Protocol enum, a silently-elided drift on the emit lands a CiliumNetworkPolicy whose ingress rule falls back to the default L4- transport-protocol and every port-match on a non-default transport silently misses at the eBPF data plane’s per-tuple dispatch).
M3_PLACEMENT_ESTRATEGIA_REPLICATED: Canonical M3 caixa_core::aplicacao::PlacementStrategy::Replicated variant discriminator scalar-value the Serialize derive on the un-renamed enum emits under caixa_core::M3_PLACEMENT_KEY_ESTRATEGIA on every programs_for_aplicacao-emitted programs.yaml entry authored with :placement (:estrategia Replicated …) (and — because the enum’s default() is Replicated — every programs.yaml entry authored without an explicit :estrategia slot). Re-export of the canonical caixa_core::M3_PLACEMENT_ESTRATEGIA_REPLICATED. The programs_entry_placement_carries_strategy test-fixture probe pins the emitted value against this re-export so a future variant rename or rename_all attribute at the aplicacao module reaches the caixa- mesh probe by construction rather than silently rebranding the substrate’s default distribution posture. Peer to the sibling M3_PLACEMENT_ESTRATEGIA_SINGLE_NODE / M3_PLACEMENT_ESTRATEGIA_SHARDED re-exports on the other two arms of the same closed enum surface. Canonical M3 crate::aplicacao::PlacementStrategy::Replicated variant discriminator scalar-value — the exact byte-string the Serialize derive on the un-renamed enum emits under M3_PLACEMENT_KEY_ESTRATEGIA whenever the typed slot’s distribution strategy is the every-cluster-active-active arm (the enum’s default() and the canonical happy-path per MESH-COMPOSITION.md §II.1).
M3_PLACEMENT_ESTRATEGIA_SHARDED: Canonical M3 caixa_core::aplicacao::PlacementStrategy::Sharded variant discriminator scalar-value the Serialize derive on the un-renamed enum emits under caixa_core::M3_PLACEMENT_KEY_ESTRATEGIA on every programs_for_aplicacao-emitted programs.yaml entry authored with :placement (:estrategia Sharded :shard-key …) — the one arm on which the sibling caixa_core::M3_PLACEMENT_KEY_SHARD_KEY sub-block is required (AplicacaoSpec::validate_placement gates shard_key.is_some() == matches!(estrategia, Sharded) as a structural partition of every validated Placement). Re-export of the canonical caixa_core::M3_PLACEMENT_ESTRATEGIA_SHARDED. The programs_entry_placement_carries_shard_key_when_sharded test-fixture probe pins the emitted value against this re-export so a future variant rename or rename_all attribute at the aplicacao module reaches the caixa-mesh probe by construction rather than silently collapsing the hash-keyed distribution back onto the aggregator’s default. Peer to the sibling M3_PLACEMENT_ESTRATEGIA_SINGLE_NODE / M3_PLACEMENT_ESTRATEGIA_REPLICATED re-exports on the other two arms of the same closed enum surface. Canonical M3 crate::aplicacao::PlacementStrategy::Sharded variant discriminator scalar-value — the exact byte-string the Serialize derive on the un-renamed enum emits under M3_PLACEMENT_KEY_ESTRATEGIA whenever the typed slot’s distribution strategy is the hash-keyed-across-clusters arm (Akka cluster sharding, MESH-COMPOSITION.md §II.4). The one arm on which the typed M3_PLACEMENT_KEY_SHARD_KEY sub-block is required — AplicacaoSpec::validate_placement gates shard_key.is_some() == matches!(estrategia, Sharded) as a structural partition of every validated crate::aplicacao::Placement.
M3_PLACEMENT_ESTRATEGIA_SINGLE_NODE: Canonical M3 caixa_core::aplicacao::PlacementStrategy::SingleNode variant discriminator scalar-value the Serialize derive on the un-renamed enum emits under caixa_core::M3_PLACEMENT_KEY_ESTRATEGIA on every programs_for_aplicacao-emitted programs.yaml entry authored with :placement (:estrategia SingleNode …). Re-export of the canonical caixa_core::M3_PLACEMENT_ESTRATEGIA_SINGLE_NODE so the OTP-style single-cluster-takeover distribution-strategy scalar lives in exactly one place across every caixa renderer and every caixa-mesh test-fixture probe that dispatches on the strategy string. Peer to the sibling M3_PLACEMENT_ESTRATEGIA_REPLICATED / M3_PLACEMENT_ESTRATEGIA_SHARDED re-exports on the other two arms of the same closed enum surface — together the three constants name every author-reachable arm of the M3 distribution-strategy discriminator. Canonical M3 crate::aplicacao::PlacementStrategy::SingleNode variant discriminator scalar-value — the exact byte-string the Serialize derive on the un-renamed enum emits under M3_PLACEMENT_KEY_ESTRATEGIA whenever the typed slot’s distribution strategy is the single-cluster-active-at-a-time arm (OTP distributed-application takeover, MESH-COMPOSITION.md §II.1).

Functions§

cilium_auth_mode: Canonical bool → &'static str bijection projection every consumer of the Cilium CiliumNetworkPolicy MutualAuthenticationMode OpenAPI schema enum’s closed-set author-reachable scalar-value pair (CILIUM_AUTH_MODE_REQUIRED / CILIUM_AUTH_MODE_DISABLED) consults so the per-tristate-arm dispatch — Some(true) (mTLS handshake mandatory) → CILIUM_AUTH_MODE_REQUIRED, Some(false) (mTLS handshake skipped, explicit opt-out) → CILIUM_AUTH_MODE_DISABLED — lives in exactly one place. Re-export of the canonical caixa_core::cilium_auth_mode so a future Cilium CNP MutualAuthenticationMode enum rebrand (either arm’s scalar-value or the per-arm dispatch shape) lands at the two consts + one projection body rather than at scattered per-emitter inline closure bodies. Consumed by the cilium_network_policies per-(:de, :para) emitter’s single_field_overlay(spec.politicas.mtls_required, CILIUM_KEY_MODE, |required| serde_yaml::Value::String(cilium_auth_mode(required).into())) closure body the prior inline if required { CILIUM_AUTH_MODE_REQUIRED } else { CILIUM_AUTH_MODE_DISABLED } per-arm dispatch sat at (plus the caixa-core in-file single_field_overlay_threads_typed_value_through_ closure generic-helper pin that mirrors the production overlay’s shape letter-for-letter and now threads through the same projection). Peer to the CILIUM_AUTH_MODE_REQUIRED / CILIUM_AUTH_MODE_DISABLED re-export pair the two arms of the same enum land on — completes the canonical (closed-set-CRD-schema-enum-value pair, per-typed-arm dispatch projection) compound re-export triple this crate’s cilium_network_policies renderer’s SPIFFE-identity-bound per-edge mTLS enforcement + explicit-opt-out contract rests on. Canonical bool → &'static str bijection projection every consumer of the Cilium CiliumNetworkPolicy MutualAuthenticationMode OpenAPI schema enum’s closed-set author-reachable scalar-value pair (CILIUM_AUTH_MODE_REQUIRED / CILIUM_AUTH_MODE_DISABLED) consults so the per-tristate-arm dispatch — Some(true) (mTLS handshake mandatory) → CILIUM_AUTH_MODE_REQUIRED, Some(false) (mTLS handshake skipped, explicit opt-out) → CILIUM_AUTH_MODE_DISABLED — lives in exactly one place. The two arms of the :politicas :mtls-required tristate’s non-None value-space each land on a distinct MutualAuthenticationMode scalar; the None slot-absent arm is the caller’s single_field_overlay emission-gate concern (the helper returns None and the outer authentication: block is omitted entirely), not this projection’s — see the per-emit-site if let Some(overlay) = mtls_overlay { rule.insert(CILIUM_KEY_AUTHENTICATION, overlay.clone()) } guard.
cilium_network_policies: Render one CiliumNetworkPolicy-shaped YAML per distinct (:de, :para) pair across :contratos. The policy whitelists the :de → :para flow at L4 (every contract); HTTP contracts add L7 rules (path) keyed by the :wit shape.
cilium_network_policy_name: Canonical per-(:de, :para) CiliumNetworkPolicy metadata.name composer — the <aplicacao>-<de>-to-<para> K8s-name-shaped scalar every caixa-mesh cilium_network_policies emitter mounts its per-edge CNP under. Re-export of the canonical caixa_core::cilium_network_policy_name composer so the per-CNP name construction lives in exactly one place across every caixa renderer. Composes on the lifted contrato_edge_label helper so the two writer-side axes — the CNP metadata.labels.pleme.pleme.io/contrato value and the CNP metadata.name — share one canonical edge-encoding source of truth (CONTRATO_EDGE_LABEL_SEPARATOR). Peer of contrato_edge_label on the parent-composition axis — the two writer-side composers close the canonical (LABEL_CONTRATO-value, metadata.name) per-CNP identity pair so a future edge-encoding rebrand or a per-emitter typo can’t silently split the two axes at emit time and orphan every operator-side grep-by-label query at apply time far from the source caixa.lisp. Canonical per-(:de, :para) CiliumNetworkPolicy metadata.name K8s-name-shaped scalar every caixa-mesh cilium_network_policies emitter mounts its per-edge CNP under. Composes on the lifted contrato_edge_label helper (the CNP name is the parent Aplicacao’s :nome joined to the contrato-edge-label by a canonical - separator: format!("{aplicacao}-{edge}")), so the two axes — the CNP metadata.labels.pleme.pleme.io/contrato value and the CNP metadata.name — share one canonical edge-encoding source of truth (CONTRATO_EDGE_LABEL_SEPARATOR).
contrato_edge_label: Canonical M3 :contratos edge label value composer — the <de>-to-<para> K8s-name-shaped scalar every per-(:de, :para) CiliumNetworkPolicy document carries at its metadata.labels.pleme.pleme.io/contrato axis. Re-export of the canonical caixa_core::contrato_edge_label composer so the per-CNP LABEL_CONTRATO-value construction lives in exactly one place across every caixa renderer. Reads from the lifted CONTRATO_EDGE_LABEL_SEPARATOR byte-string so a future edge-encoding rebrand lands at one canonical composition. Peer of cilium_network_policy_name on the sibling per-CNP metadata.name composition axis — the two composers close the canonical (LABEL_CONTRATO-value, metadata.name) per-CNP identity pair on one shared edge-encoding source of truth (CONTRATO_EDGE_LABEL_SEPARATOR). Canonical M3 :contratos edge label value — the <de>-to-<para> K8s-name-shaped scalar every per-(:de, :para) CiliumNetworkPolicy document carries at its metadata.labels.pleme.pleme.io/contrato axis (the LABEL_CONTRATO label key). Composes on the lifted CONTRATO_EDGE_LABEL_SEPARATOR byte-string so a future edge-encoding rebrand lands at one canonical composition, and every downstream consumer that grep-by-label picks up the new encoding by construction.
gateway_api_http_route_name: Canonical per-:entrada HTTPRoute metadata.name composer — the <aplicacao>-<para> K8s-name-shaped scalar every caixa-mesh gateway_routes emitter mounts its per-:entrada HTTPRoute under. Re-export of the canonical caixa_core::gateway_api_http_route_name composer so the per-HTTPRoute name construction lives in exactly one place across every caixa renderer. Peer of the sibling cilium_network_policy_name composer on the per-Aplicacao per-CR K8s-name-shaped-identity-scalar axis: the CNP-name composer carries the per-(:de, :para) L4/L7 policy CR name and this composer carries the per-:entrada L7 route CR name — both share the same “aplicacao-prefixed sub-identity” discipline (an aplicacao-prefix joined to a per-CR sub-axis by a canonical - separator) so a future substrate-side per-Aplicacao Gateway API axis extension (GRPCRoute on grpc-shaped :contratos payloads, TCPRoute on l4-only tcp payloads, per-:entrada HTTPRouteFilter / BackendTLSPolicy overlays) reaches the shared naming discipline through this composer’s peer-shape by construction.
gateway_routes: Render the Gateway + HTTPRoute pair for :entrada, when set. Returns an empty Vec when the Aplicacao has no external entry point (internal-only meshes).
programs_for_aplicacao: Render one programs.yaml entry per :membros in the Aplicacao.
render_all: One-shot bundle that renders every cluster artifact for an Aplicacao:
typed_view: Compose a single typed view of the entire Aplicacao for downstream renderers (Cilium, Gateway, observability). Convenience wrapper that routes the compound require_kind + aplicacao_view + validate cascade through the canonical substrate primitive caixa_core::require_aplicacao_view, sibling to the per-Servico caixa_core::require_v0_servico_shape compound entry gate every caixa-helm / caixa-flux renderer already routes through. The wrapper stays for turbofish elision at this crate’s three call sites (programs_for_aplicacao / cilium_network_policies / gateway_routes), matching the shape the sibling caixa-flux / caixa-helm renderers read the compound V0-Servico gate as, and every future per-Aplicacao consumer (caixa-tatara’s spec-consuming validate arm when it lands, the deferred mesh.pleme.io/v1alpha1/Aplicacao CR materializer’s admission webhook) gets the compound three-arm gate for free with one call rather than re-inlining the cascade — same discipline the peer caixa_core::require_v0_servico_shape lift closed on the per-Servico renderer axis.

Crate caixa_mesh

Crate caixa_mesh Copy item path

Enums§

Constants§

Functions§

Crate caixa_mesh