Constant PROCESS_WIRE_IDENTITY 

pub const PROCESS_WIRE_IDENTITY: K8sWireIdentity;

Typed K8s wire-form identity of the tatara Process CRD — the k8s_wire_identity::K8sWireIdentity projection carrying (apiVersion, kind) = (API_VERSION, PROCESS_KIND) at ONE compile-time const.

Peer on the K8s-wire-form-identity axis-family to the three pre-existing closed-set .wire_identity() projections:

• k8s_builtin_resource::K8sBuiltinResource::wire_identity owns the K8s built-in axis (Job / ConfigMap) — the resources the reconciler fetches from Kubernetes itself.
• flux_resource::FluxResource::wire_identity owns the FluxCD-controller axis (Kustomization / HelmRelease / OCIRepository).
• routing_edge_resource::RoutingEdgeResource::wire_identity owns the routing-edge axis (Ingress / DNSEndpoint).
• PROCESS_WIRE_IDENTITY (this const) owns the tatara Process CRD’s own wire-form identity — pre-lift the fourth arm was the open corner every peer closed-set called out in its own docs as “the tatara Process CRD’s (apiVersion, kind) pair” but which itself lived only as two disjoint consts + a runtime api_version fn threaded through the owner_reference_json composer’s hand-inlined json! slots.

Together the four owners partition every K8s wire-form identity the workspace’s reconcilers reach at run time; the pin [owner_reference_tests::process_wire_identity_is_disjoint_from_every_peer_wire_form_axis] binds the four axes pairwise-distinct at fail-before-pass-after granularity so a future variant addition on any peer that accidentally overlapped this pair (a hypothetical K8sBuiltinResource::Process copy-paste, a Flux-side Process naming collision) surfaces at that pin rather than as silent cross-axis ambiguity at every reconciler dispatch.

Consumed by owner_reference_json via k8s_wire_identity::K8sWireIdentity::resource_json — pre-lift the OwnerReference composer hand-inlined the (apiVersion, kind) pair as two adjacent json! slots referencing api_version + PROCESS_KIND separately, leaving a silent-drift path where a copy-paste that dropped ONE reference (an apiVersion bump that missed the sibling kind, a rename of one const that didn’t touch the other) would emit an OwnerReference no K8s controller recognizes (a 404 at wire time diagnosed as a broken CRD). Post- lift the emit routes through the ONE typed pair, and the drift trap is unrepresentable — a caller cannot skew the two slots because the composer takes the identity as a single struct.

A future consumer of the tatara Process wire-form identity — a second OwnerReference emit site (P3 kenshi-runner’s TestSuiteBinding owner-ref, a P1 caixa-tatara-emitted HelmRelease’s parent-Process reference), a future admission- webhook that filters on the CRD’s (apiVersion, kind) pair, a fleet-wide audit walker enumerating every tatara-owned resource — reads through this ONE const rather than re-composing the pair from API_VERSION + PROCESS_KIND separately.

Theory grounding: THEORY.md §II.1 invariant 5 — composition preserves proofs. The two-slot (apiVersion, kind) composition lives at ONE typed algebra projection here; a regression that drifted either slot surfaces at this module’s pins rather than as silent operator-visible OwnerReference skew. THEORY.md §III — typescape. The typed k8s_wire_identity::K8sWireIdentity pair bounds the axis of variation at the type level — a callsite that receives a K8sWireIdentity cannot skew the two slots at compose time.