Constant CILIUM_API_VERSION 

pub const CILIUM_API_VERSION: &str = "cilium.io/v2";

Canonical Cilium CRD apiVersion every caixa-mesh-emitted CiliumNetworkPolicy document declares. The Cilium control plane’s upstream-shipped CRD bundle registers CiliumNetworkPolicy, CiliumClusterwideNetworkPolicy, CiliumEndpoint, CiliumIdentity, CiliumNode, CiliumLocalRedirectPolicy, and the rest of the per-conformance Cilium CRD set at this exact group/version (cilium.io/v2); drift to a stale v2alpha1 (the historical pre-stable Cilium-CRD-group/version label upstream Cilium-CRD docs reference for in-flight per-CRD-version migration) silently routes the rendered CiliumNetworkPolicy outside the cluster’s Cilium-operator-side CRD-version registration and breaks at apply time with a non-self-locating “no kind ‘CiliumNetworkPolicy’ is registered for version ‘cilium.io/v2alpha1’” error far from the source caixa.lisp / the renderer’s kube_resource_skeleton call site.

The single source of truth the rendered Aplicacao Cilium-side mesh bundle’s CRD-group/version axis reaches for:

• CiliumNetworkPolicy apiVersion — the top-level CRD-group/ version every emitted CNP document declares (caixa-mesh/src/lib.rs:326 — the cilium_network_policies per-(:de, :para) policy skeleton call). Until this lift landed both the production-code emit at the per-policy skeleton call site and the matching in-file cilium_policy_carries_canonical_kube_skeleton test fixture pin (caixa-mesh/src/lib.rs:1560) carried inline "cilium.io/v2" string literals — two occurrences of the same load-bearing Cilium-CRD-group/version convention, drift-prone by construction. The Cilium project bumps the per-conformance Cilium-CRD set as a unit; a future Cilium-CRD-group/version promotion (the upstream Cilium roadmap names per-CRD-group / per-version migration once the cilium.io/v3 branch lands) on one axis without a coordinated edit on the other would have silently emitted a CiliumNetworkPolicy document whose top-level apiVersion drifts off the lifted-test-fixture pin — apply-side: the policy lands in a stale CRD-version registration the Cilium operator no longer watches, every (:de, :para) intra-mesh L4 contract drops at the eBPF data plane with no field naming the version-drift root cause.

The PRIME DIRECTIVE duplication-budget rule (THEORY.md §I.3.5, “every recurring shape becomes a generator before it becomes a pattern; every pattern becomes a library before it becomes duplicated code. The duplication budget is zero.”) promotes the constant to a typed substrate-side &'static str on the same trajectory the GATEWAY_API_API_VERSION (3c6cfc3) / FLUX_HELMRELEASE_API_VERSION (55f0fd9) / FLUX_GITREPOSITORY_API_VERSION (8a6c8a3) / FLUX_KUSTOMIZATION_API_VERSION (d2dd1b1) / DEFAULT_FLUX_SYSTEM_NAMESPACE (7197d38) lifts established on the peer K8s Gateway API ingress / Flux v2 reconcile canonical- load-bearing-string axes — extends the discipline from the cluster-side K8s Gateway API ingress + Flux v2 reconcile contracts onto the cluster-side Cilium identity-based mesh contract (the eBPF-anchored Cilium control plane that materializes every per-(:de, :para) L4 / L7 contrato as an identity-keyed eBPF allow rule). The render-side consumer now threads the same &'static str through its kube_resource_skeleton call so a future Cilium-CRD-group/version promotion lands in one place; every future renderer that reaches for the canonical Cilium-CRD apiVersion (the future M4 mesh.pleme.io/v1alpha1/Aplicacao CR materializer’s per-Aplicacao CiliumNetworkPolicy fan-out, a future CiliumClusterwideNetworkPolicy the caixa-mesh emits for cluster-scoped baseline-allow / baseline-deny rules, a future CiliumLocalRedirectPolicy the operator emits for per-Servico local-redirect coordination) inherits the same value by construction with no opportunity for per-renderer drift.