Constant CILIUM_KEY_HTTP 

pub const CILIUM_KEY_HTTP: &'static str;

Canonical Cilium CiliumNetworkPolicy per-ingress[].toPorts[].rules L7-HTTP-rule-list-discriminator container-axis key every cilium_network_policies-emitted CNP document mounts its per- toPorts[] entry L7 URL-path-prefix predicate list under (spec.ingress[].toPorts[].rules.http). Re-export of the canonical caixa_core::CILIUM_KEY_HTTP so the Cilium-CRD per-toPorts[] L7- HTTP-rule-list-discriminator container-axis key string lives in exactly one place across every caixa renderer — caixa-mesh’s cilium_network_policies per-(:de, :para) CiliumNetworkPolicy emitter (the single production-code site the prior inline "http" literal sat at, the rules.insert("http", …) call in the WitTarget::Http L7 introspection emit branch) and every future per-Cilium-side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str, so a future Cilium-CRD rebrand on the per-toPorts[] L7-HTTP-rule-list-discriminator axis (unlikely on the CRD’s stable cilium.io/v2 slot, but the coordination point the sibling CILIUM_KEY_AUTHENTICATION / CILIUM_KEY_MODE re-exports anchor on the parent per-ingress-rule mutual-auth body/leaf axis pair) lands in one place. The prior inline literal split across the one production emitter site and two test-fixture navigation sites (the L7 fan-in path-capture pin across the multi-edge group, the per-HTTP- contract L7-path presence pin) would have let a Cilium-CRD L7-HTTP- rule-list-discriminator rebrand or a per-emitter typo ("HTTP" / "Http" / "httpRules" / "httpMatch") at any one site silently emit a per-toPorts[] entry whose L7-HTTP-rule-list-discriminator key the Cilium CRD schema validator drops as unknown; the per- toPorts[] entry falls back to L4-only enforcement — no L7 URL- path predicate is applied — silently admitting every HTTP-method / URL-path combination the ingress rule was authored to filter to the exact path prefix set the typed :contratos graph names at the L7 introspection axis, with no field naming the L7-HTTP-rule-list- discriminator-drift root cause. On the test-fixture side the drift silently masks the emission-side pin (.get("http") returns None under both the drifted-key emitter and the drifted-key probe — every downstream .and_then(|h| h.as_sequence()) chain short- circuits vacuously because the outer L7-HTTP-rule-list-lookup is itself None). Peer to the CILIUM_KEY_MODE / CILIUM_KEY_AUTHENTICATION re-exports on the sibling per- ingress-rule mutual-auth body/leaf axis pair — completes the per- toPorts[] L7-introspection (rules → http) container/protocol- discriminator axis re-export pair this crate’s cilium_network_policies renderer’s HTTP-shaped-:contratos URL- path-prefix-filtering L7-enforcement contract rests on. Canonical Cilium CiliumNetworkPolicy per-ingress[].toPorts[].rules L7-HTTP-rule-list-discriminator container-axis key every cilium_network_policies-emitted CNP document mounts its per-toPorts[] entry L7 HTTP-rule list under (spec.ingress[].toPorts[].rules.http). Nests exactly one level beneath the sibling KUBE_KEY_RULES (a205eb3) per-toPorts[] rule-list-container axis it sits inside: the Cilium CNP schema places the L7-protocol-selection discriminator (http / future kafka / future dns) as the single per-protocol keyed axis of the per-toPorts[] rules block, so drift on the L7-HTTP-rule-list- discriminator axis is exactly as load-bearing as drift on the sibling KUBE_KEY_RULES per-toPorts[] rule-list-container axis-key it nests inside (the Cilium-operator-side CNP schema validator drops any per- toPorts[] entry whose per-protocol L7-rule-list-discriminator key it recognizes as unknown — a "HTTP" / "Http" / "http/1.1" / "httpRules" typo at either the emit-side rules.insert(…) call site or a downstream renderer’s per-toPorts[] L7-rule-list upsert silently emits a per-toPorts[] entry whose L7-HTTP-rule-list-discriminator key the Cilium CRD schema validator rejects as unknown; the per-toPorts[] entry falls back to L4-only enforcement — no L7 URL-path predicate is applied — silently admitting every HTTP-method / URL-path combination the ingress rule was authored to filter to the exact path prefix set the typed :contratos graph names at the L7 introspection axis, and the emit-side/probe-side split silently masks the per-toPorts[] L7- rule-list pin (.get("http") returns None under both the drifted- key emitter and the drifted-key probe — every downstream .and_then(|h| h.as_sequence()) chain short-circuits vacuously because the outer L7-HTTP-rule-list-lookup is itself None).

The single source of truth the rendered Aplicacao Cilium-CNP-side intra-mesh L7-tuple-gating bundle’s per-toPorts[] L7-HTTP-rule-list- discriminator-axis naming reaches for:

• the rendered CiliumNetworkPolicy document’s per-toPorts[] entry rules.http L7-HTTP-rule-list-discriminator axis (caixa-mesh/src/lib.rs — the cilium_network_policies per-(:de, :para) policy’s rules.insert("http", …) call in the WitTarget::Http L7- introspection emit branch, the exact per-protocol keyed axis of the per-toPorts[] rules block the L7 URL-path predicate lands under).

The L7-HTTP-rule-list-discriminator axis names the same Cilium-operator- side per-toPorts[] L7 URL-path predicate selection as the sibling KUBE_KEY_RULES per-toPorts[] rule-list-container axis-key it nests inside, and must move together on any future Cilium CRD schema rebrand (an upstream cilium.io/v3 rename of the L7-HTTP-rule-list- discriminator from http to httpRules / l7Http / httpMatch, coordinated with the Cilium project’s periodic CRD schema-migration passes). Until this lift landed the axis carried an inline http literal at the one production-code emitter site (the cilium_network_policies per-(:de, :para) rules.insert("http", …) call in the WitTarget::Http L7 introspection emit branch) plus a matching set inside the in-file cilium_l7_rules_fan_in_captures_every_ http_edge / cilium_http_contracts_carry_l7_path test-fixture navigations — three occurrences of the same load-bearing Cilium-CRD- L7-HTTP-rule-list-discriminator convention, drift-prone by construction. A drift on any one production or test-fixture site to "HTTP" / "Http" / "httpRules" would surface as a Cilium-operator- side schema-validator drop at apply time (the affected per- toPorts[] entry’s L7-rule-list-discriminator key the CRD schema validator recognizes as unknown), with every intra-mesh HTTP-shaped :contratos flow the CNP was authored to filter to a URL-path prefix silently bypassing the L7 path predicate at the Cilium data-plane’s L4-only fallback dispatch with no field naming the L7-HTTP-rule-list- discriminator-drift root cause.

The PRIME DIRECTIVE duplication-budget rule (THEORY.md §I.3.5, “every recurring shape becomes a generator before it becomes a pattern; every pattern becomes a library before it becomes duplicated code. The duplication budget is zero.”) promotes the constant to a typed substrate-side &'static str on the same trajectory the CILIUM_KEY_MODE (4289dfb) / CILIUM_KEY_AUTHENTICATION (db31108) / CILIUM_KEY_PORTS (1087693) / CILIUM_KEY_FROM_ENDPOINTS (ecfa557) / CILIUM_KEY_ENDPOINT_SELECTOR (7088789) / CILIUM_KEY_INGRESS (0400a9b) / CILIUM_KEY_TO_PORTS (c8d9cbf) / KUBE_KEY_RULES (a205eb3) / CILIUM_KIND_NETWORK_POLICY (eac85cb) / CILIUM_API_VERSION (279d611) lifts established on the sibling canonical-Cilium-CNP-body-axis surfaces — descends the per- toPorts[] L7-HTTP-rule-list-discriminator axis one level beneath the parent KUBE_KEY_RULES per-toPorts[] rule-list-container axis-key it nests inside, completing the per-toPorts[] L7-introspection (rules → http) container/protocol-discriminator axis pair the M3 Aplicacao mesh renderer’s HTTP-shaped-:contratos URL-path-prefix- filtering L7-enforcement contract rests on.