Constant DEFAULT_NAMESPACE 

pub const DEFAULT_NAMESPACE: &str = "tatara-system";

Default cluster-wide K8s namespace every caixa renderer emits objects into when the source caixa doesn’t pin its own. The single source of truth both caixa-flux’s programs.yaml / GitRepository / HelmRelease / Kustomization emitters and caixa-mesh’s programs fan-out / CiliumNetworkPolicy / Gateway / HTTPRoute emitters consult — re-exported by each renderer’s lib as pub use caixa_core::DEFAULT_NAMESPACE, so a future per-cluster-namespace rebrand (e.g. moving to pleme-system once tatara-system outlives its scoping intent) is a one-line edit here, not a coordinated rewrite across every renderer crate’s metadata.namespace slot.

Until this lift landed both renderers carried their own pub const DEFAULT_NAMESPACE: &str = "tatara-system" declarations (caixa-flux/src/lib.rs:77, caixa-mesh/src/lib.rs:172), with the caixa-mesh site’s doc-comment explicitly acknowledging the duplication (“Mirrors caixa_flux::DEFAULT_NAMESPACE”); a future rebrand on either side without a coordinated edit on the other would have silently emitted into two distinct namespaces on the same cluster’s apply — Servicos at programs.yaml’s namespace, their Aplicacao’s NetworkPolicies / Gateways / HTTPRoutes at a drifted one — and the CiliumNetworkPolicy’s endpointSelector would match no pods (different namespace), silently dropping every L7 contrato flow at apply time with no diagnostic naming the namespace-drift root cause.

Lifting it to caixa-core’s render-constants block alongside the peer LABEL_APLICACAO / LABEL_PROGRAM / LABEL_CONTRATO label-namespace constants and the canonical KUBE_KEY_NAMESPACE API-key constant makes the namespace-axis discipline structural: every renderer that reaches for the default namespace consults the same &'static str, and every future renderer (the M4 mesh.pleme.io/v1alpha1/Aplicacao CR materializer, the future per-edge CiliumClusterwideEnvoyConfig emitter, the future caixa-otel collector-pipeline emitter) inherits the same value by construction, with no opportunity for per-renderer drift. Same “the typed constant lives in one place” discipline the PLEME_LABEL_PREFIX (a8d4d57) and KUBE_KEY_API_VERSION / KUBE_KEY_KIND / KUBE_KEY_METADATA lifts apply on the peer shared-string axes.