Function with_data 

pub fn with_data(
    name: &str,
    ns: &str,
    data: BTreeMap<String, String>,
    labels: Option<BTreeMap<String, String>>,
) -> ConfigMap

Compose a namespaced ConfigMap resource carrying a typed String → String BTreeMap payload, optionally labeled.

Owns the wire-shape chain

let cm = ConfigMap {
    metadata: ObjectMeta {
        name: Some(<name>.to_string()),
        namespace: Some(<ns>.to_string()),
        labels: <labels>,
        ..Default::default()
    },
    data: Some(<data>),
    ..Default::default()
};

that every workspace consumer building a String-payload ConfigMap through the K8s wire format hand-authored pre-lift at each construction site. Peer to namespaced on the same axis — the namespaced binder covers the Api handle-side; this composer covers the resource-body side.

Pre-lift the 5-link struct-literal recurred at TWO hand-authored consumer sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold:

• tatara-closed-loop-probe::main::write_receipt — the closed- loop auth probe’s receipt-CM writer. Labeled with "tatara.pleme.io/receipt" → "tatara-receipt/v1" so operators can kubectl get cm -l tatara.pleme.io/receipt=tatara-receipt/v1.
• tatara-export-worker::main::write_receipt — the export worker’s receipt-CM writer. No labels (SSA writer against a name the operator already knows via the ExportSpec channel).

Each site consumes the returned ConfigMap either through a crate::create::default(&api, &cm).await writer chain (the closed-loop-probe consumer’s create-then-409-patch idempotent write) or an api.patch(name, &pp, &Patch::Apply(&cm)) SSA-writer chain (the export-worker consumer’s SSA-side apply) — the composer returns a fresh owned ConfigMap verbatim so the downstream write- verb dispatch rides unchanged.

The labels slot is Option-shaped so consumers that need no metadata labels pass None and get an unlabeled ObjectMeta, while consumers that need labels pass Some(<map>) and get them stamped on the ObjectMeta — matching the underlying ObjectMeta field’s own Option<BTreeMap<String, String>> shape (a Some(<empty map>) and None are distinguishable at the K8s API server, so the composer surfaces both shapes rather than collapsing them).

The binary_data slot on ConfigMap rides ..Default::default() — both hand-authored consumer sites emit None (either implicit via their own ..Default::default() at the export-worker site, or explicit as Option::<BTreeMap<String, ByteString>>::None at the same site pre-lift, which is byte-equivalent to the implicit default). A future binary-payload writer composes a peer with_binary_data primitive on this module rather than widening this one — the string-payload posture (data: Some(<map>)) is the invariant this composer names.

Theory anchor: THEORY.md §VI.1 (generation over composition — the 5-link struct-literal chain recurred at 2 hand-authored sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication trigger and is lifted onto the ONE workspace-wide substrate owner here). THEORY.md §II.1 invariant 5 (composition preserves proofs — the pin block below binds the composer at fail-before-pass-after granularity, so a regression that swapped a slot’s default (data: None when a consumer expected Some(<data>), metadata.name: None when the K8s API server needs a name for the create-verb call, labels leaking off the passed slot into a hard-coded map) surfaces at configmap::tests::* rather than as silent operator-facing receipt-writer skew across the two consumer sites).