Function kube_root_str_field 

pub fn kube_root_str_field<'a>(value: &'a Value, field: &str) -> Option<&'a str>

Read the string-scalar value at a top-level <field> axis-key on a K8s custom resource YAML document — the root-level readback peer to kube_metadata_str_field on the sub-metadata: axis. Returns None when either the requested <field> scalar is absent (defensively tolerated — the caller’s own unwrap_or(...) / expect(...) names the axis) or the scalar is present but carries a non-string YAML type (a numeric, boolean, or nested mapping — invalid K8s CR shape per the apiserver’s OpenAPI schema but tolerated here as None so the readback stays a total function). The returned &str borrows into the input Value — the caller decides whether to compare (==), clone (.to_string()), or unwrap-then-panic. The two-hop navigation happens in one function call the caller reads as intent (kube_root_str_field(<value>, <FIELD>) — “read this K8s CR’s top-level <FIELD> string-scalar”) rather than two hand-spelled positional artifacts (the get(<FIELD>) outer hop, the and_then(|n| n.as_str()) shape gate).

The canonical shape 32 call sites across caixa-mesh (24) + caixa-flux (8) previously carried inline as the two-line block

value
    .get(<FIELD>)
    .and_then(|n| n.as_str())

around a one-token semantic payload (the <FIELD> axis-key — KUBE_KEY_KIND on 22 sites, KUBE_KEY_API_VERSION on 10 sites). Every routed caller keeps its downstream idiom (.unwrap(), .expect(...), == Some(<KIND>), assert_eq!(..., Some(<API_VERSION>))) unchanged — the lift closes the navigation surface, not the per-site error-handling posture.

Sites lifted include:

• caixa-flux’s cluster_bundle_helmrelease_uses_lifted_flux_api_version
  • peer test-side pins on the emitted helmrelease.yaml, gitrepository.yaml, kustomization.yaml per-document top-level KUBE_KEY_API_VERSION axis;
• caixa-flux’s per-document top-level KUBE_KEY_KIND axis pins across the same cluster_bundle multi-file sequence;
• caixa-mesh’s docs.iter().find(|d| d.get(KUBE_KEY_KIND). and_then(|k| k.as_str()) == Some(<KIND>)) per-CR filter over the emitted Gateway + HTTPRoute multi-doc sequence — the 15 gateway_routes test-harness find sites plus the sibling CILIUM_KIND_NETWORK_POLICY filter in cilium_authentication_mode_serialized_as_yaml_string;
• caixa-mesh’s per-CR top-level KUBE_KEY_API_VERSION + KUBE_KEY_KIND discriminator-pair pins across cilium_network_policies_emit_per_de_para_edges + gateway_routes_emit_gateway_and_httproute_per_aplicacao + sibling gateway/route pins.

Peer to sibling kube_metadata_str_field (6809867) on the K8s CR-document readback surface: kube_metadata_str_field closes the metadata.<field> string-scalar readback at the sub-metadata: axis; this closes the root-level <field> string-scalar readback at the top-level axis. The two together bracket the K8s-CR YAML readback surface so every navigation into a rendered K8s CR document — the top-level (apiVersion, kind) discriminator pair, the sub-metadata.(name, namespace) identity pair — reaches through one canonical lifted helper. A future K8s API-machinery rebrand on either axis (a hypothetical apiVersionV2: scalar under a wrapper CRD group’s schema-migration, a Server-Side-Apply-driven metadata.name rename under per-field ownership annotations) reaches every consumer through one lifted helper, not a coordinated rewrite across every renderer + every test-side per-CR readback path.

The field axis stays parametric (rather than pinned to KUBE_KEY_KIND or KUBE_KEY_API_VERSION as two separate helpers) so the same lift closes every top-level string-scalar axis a future K8s API-machinery revision surfaces (e.g. the caixa-otel per-Servico OpenTelemetry-Collector CR’s top-level scalar pins, the future mesh.pleme.io/v1alpha1/Aplicacao CR materializer’s per-CR discriminator readback in the app-operator, MESH-COMPOSITION §III.2 #5) — each new axis reaches for the same helper with a new [KUBE_KEY_<AXIS>] const, not a fresh per-axis helper.