Constant FLUX_GITREPOSITORY_API_VERSION 

pub const FLUX_GITREPOSITORY_API_VERSION: &str = "source.toolkit.fluxcd.io/v1";

Canonical FluxCD GitRepository CRD apiVersion every caixa-flux gitrepository.yaml document emits. The Flux v2 source-controller watches resources at this exact group/version (source.toolkit.fluxcd.io/v1); drift to a stale v1beta1 / v1beta2 (the pre-GA Flux v2 source-controller betas every upstream Flux GA- migration doc names) silently routes the rendered GitRepository outside the controller’s Watches and breaks at apply time with a non-self-locating “no kind ‘GitRepository’ is registered for version ‘source.toolkit.fluxcd.io/v1beta2’” error far from the source caixa.lisp / the renderer’s format-string template.

The single source of truth the gitrepository.yaml apiVersion axis reaches for (caixa-flux/src/lib.rs:436 — the gitrepo format-string template). The Flux v2 source/helm/kustomize controller triple pairs each CRD-group/version against its sibling controller’s Watches registration: the rendered GitRepository is the chart-source the sibling HelmRelease document’s spec.chart.spec.sourceRef.kind: GitRepository references, and the parent Kustomization’s spec.sourceRef.kind: GitRepository also points at this same CRD group/version. A future Flux v3 promotion on this axis without a coordinated edit on the sibling FLUX_HELMRELEASE_API_VERSION / future-FLUX_KUSTOMIZATION_API_VERSION axes would silently land the rendered GitRepository outside the source-controller’s Watches (controller-side: never reconciled, the dependent HelmRelease’s chart: sourceRef dangles, every per-Servico apply silently comes up with the prior reconciled state).

Until this lift landed the axis carried an inline source.toolkit.fluxcd.io/v1 literal inside [cluster_bundle]’s gitrepository.yaml format-string template — one occurrence today, promoted to a typed substrate-side &'static str on the same trajectory the FLUX_HELMRELEASE_API_VERSION (55f0fd9) / DEFAULT_FLUX_SYSTEM_NAMESPACE (7197d38) lifts established on the sibling Flux-v2-load-bearing-string surface. The render-side consumer now threads the same &'static str through its format-string template so a future Flux v3 promotion lands in one place; every future renderer that reaches for the canonical Flux v2 GitRepository apiVersion (the future M4 mesh.pleme.io/v1alpha1/Aplicacao CR materializer’s per-Aplicacao GitRepository, a future per-edge GitRepository the operator emits for the CiliumClusterwideEnvoyConfig pipeline, a future caixa-otel collector-pipeline GitRepository) inherits the same value by construction with no opportunity for per-renderer drift.

Same “the typed constant lives in one place” discipline the DEFAULT_NAMESPACE (a085b26) / DEFAULT_LIBRARY_NAME (41438dc) / crate::DEFAULT_SERVICO_PORT (1e22add) / crate::DEFAULT_PUBLISH_TAG_PREFIX (0a6a602) / DEFAULT_FLUX_SYSTEM_NAMESPACE (7197d38) / FLUX_HELMRELEASE_API_VERSION (55f0fd9) lifts apply on the peer canonical-load-bearing-string surface.