controller

const (
	// ReasonSuspended is InControl=True: the Kustomization is suspended, the last suspend handled, and
	// nothing applies.
	ReasonSuspended = "Suspended"
	// ReasonApplying is InControl=True while an operation of a branch worker is in flight and followed:
	// the Kustomization is resumed for it, and suspended again when it ends.
	ReasonApplying = "Applying"
	// ReasonSuspending is InControl=False while the token of the suspend is not handled yet.
	ReasonSuspending = "Suspending"
	// ReasonNotConfigured is InControl=Unknown on an applier claim that is not Configured: nothing is held, or
	// the Kustomization is left suspended as the applier claim last held it (the message says which).
	ReasonNotConfigured = "NotConfigured"
	// ReasonReleasing is InControl=False on an applier claim that held its Kustomization and is handing
	// it back: it is being deleted, or no eligible GitTarget references it any more. InControl=False with
	// applier.ReasonNotReferenced is an applier claim with nothing to hold.
	ReasonReleasing = "Releasing"
	// ReasonRevoking is InControl=False on an applier claim that held its applier and is handing it back
	// because its KubeProvider's spec.allowedApplierClaims no longer admit it. The hand-back finishes
	// even if a grant admits the applier claim again meanwhile, which then adopts its applier anew.
	ReasonRevoking = "Revoking"
	// EventReasonAdopted is a Kustomization suspended, or an Application's automated sync switched
	// off, for the first time.
	EventReasonAdopted = "Adopted"
	// EventReasonClaimedResourceReconciled is a held applier found changed by somebody else, and put
	// back as the applier claim holds it: a Kustomization resumed (`flux resume`) and suspended again, or an
	// Application's automated sync switched on and off again.
	EventReasonClaimedResourceReconciled = "ClaimedResourceReconciled"
	// EventReasonReleased is an applier handed back to Flux or Argo CD, or left held for the applier claim
	// next in line, when its applier claim was deleted or no eligible GitTarget references it any more.
	EventReasonReleased = "Released"
	// EventReasonReleaseFailed is a retiring applier claim that could not hand its applier back.
	EventReasonReleaseFailed = "ReleaseFailed"
)

const (
	ClusterWatchRuleReasonValidating            = "Validating"
	ClusterWatchRuleReasonAccessDenied          = "AccessDenied"
	ClusterWatchRuleReasonGitTargetNotFound     = "GitTargetNotFound"
	ClusterWatchRuleReasonGitDestinationInvalid = "GitDestinationInvalid"
	ClusterWatchRuleReasonReady                 = ReasonSucceeded
	// ClusterWatchRuleReasonCatalogNotReady is ResourcesResolved=False: the source cluster's discovery
	// catalog is not ready, so no selector can be resolved yet. A selector that matches nothing
	// the cluster serves is not this: it resolves True, watching zero types.
	ClusterWatchRuleReasonCatalogNotReady = "CatalogNotReady"

	// ClusterWatchRuleReasonGitTargetNamespaceNotAuthorized is the terminal reason when the
	// referenced GitTarget's namespace is not admitted by that target's KubeProvider. It is
	// re-exported from internal/watch, where the shared compile path both bootstrap and this
	// reconciler call decides it, so the two can never drift.
	ClusterWatchRuleReasonGitTargetNamespaceNotAuthorized = watch.ClusterWatchRuleReasonGitTargetNamespaceNotAuthorized
)

const (
	// ConditionTypeReady indicates whether the resource is ready.
	ConditionTypeReady = "Ready"
	// ConditionTypeResourcesResolved indicates whether rule resources resolved to concrete GVRs.
	ConditionTypeResourcesResolved = "ResourcesResolved"
	// ConditionTypeReconciling is the kstatus progress condition. It is abnormal-true.
	ConditionTypeReconciling = "Reconciling"
	// ConditionTypeStalled is the kstatus blocked condition. It is abnormal-true.
	ConditionTypeStalled = "Stalled"
	// ConditionTypeStreamsRunning indicates whether watched type streams are routing live events.
	ConditionTypeStreamsRunning = "StreamsRunning"
	// ConditionTypeGitPathAccepted indicates whether the GitTarget path is safe to materialize.
	ConditionTypeGitPathAccepted = "GitPathAccepted"
	// ConditionTypeRenderMatchesLive indicates whether every current render scope agrees with live.
	ConditionTypeRenderMatchesLive = "RenderMatchesLive"
	// ConditionTypeGitTargetReady indicates whether the referenced GitTarget is ready for writes.
	ConditionTypeGitTargetReady = "GitTargetReady"
	// ConditionTypeSourceNamespaceAuthorized reports whether a rule's EFFECTIVE source namespace
	// is authorized for the observed generation. It is positive and state-style, and it is set for
	// every rule, its own namespace included, so the effective authorization is always visible and
	// automation has ONE condition to inspect.
	//
	// It is deliberately distinct from GitTargetReady, which stays the health of the referenced
	// GitTarget and must never be reused for source authorization. Its three values are not
	// interchangeable: False is a refusal (terminal, Stalled=True), while Unknown means the answer is
	// still being established (the rule is blocked by validation), which must not be rendered as a
	// permanent failure.
	ConditionTypeSourceNamespaceAuthorized = "SourceNamespaceAuthorized"
	// ConditionTypeAuthorAttributed indicates whether a CommitRequest's commit author
	// was named from the submitter captured at admission. It is binary and immediately
	// settled (no Unknown, no timeout): True (AttributedFromAdmission) when the
	// validate-operator-types webhook recorded the submitter, False (CommitterFallback) when
	// capture ran but found no record, or False (AuthorCaptureDisabled) when capture is off.
	// False is not a failure and does not affect Ready: the
	// request claims no actor and can attach only to an unnamed watch window
	// (docs/architecture.md#commitrequest-finalize).
	ConditionTypeAuthorAttributed = "AuthorAttributed"
	// ConditionTypePushed indicates whether a CommitRequest's commit reached the
	// remote repository.
	ConditionTypePushed = "Pushed"

	// KubeProviderConditionValidated reports whether a KubeProvider's credential is safe and
	// resolvable: an inCluster provider is Validated while the installation lists it in
	// --in-cluster-kube-providers; a secretRef provider once its kubeconfig Secret is present,
	// keyed, and passes the exec/TLS/file-reference safety policy. It is asserted WITHOUT a network
	// dial — runtime reachability is the GitTarget's SourceClusterReachable.
	KubeProviderConditionValidated = "Validated"

	// KubeProviderConditionAuditFactsReceived reports whether an attribution fact has ever been
	// published on this provider's audit route (spec.attribution.auditRoute, defaulting to
	// <namespace>.<name>). It is Unknown from creation until the first fact, with the reason naming
	// which silence it is (see the three below), and True (ReasonFactsReceived) from then on. It
	// NEVER regresses: the persisted status is the latch, so a restart — or the memory transport,
	// whose in-process state is lost with the process — keeps it True. Later silence is a quiet cluster, not a fault, which is why there is
	// no False state, no grace window and no timer.
	//
	// It is deliberately NOT part of Ready: a provider reading a route nobody posts under mirrors
	// perfectly and loses only the commit AUTHOR, so reporting it through Ready would tell every
	// kstatus reader the object is broken. It is absent entirely when the operator runs with
	// --author-attribution=false, where no fact was ever expected.
	KubeProviderConditionAuditFactsReceived = "AuditFactsReceived"

	// ReasonTransportUnavailable is the AuditFactsReceived=Unknown reason when the last append to
	// the fact transport failed. Nothing can be concluded about any route's configuration while
	// this holds. The fix is the operator's transport, not the reader's audit webhook.
	ReasonTransportUnavailable = "TransportUnavailable"
	// ReasonNoAuditDelivery is the AuditFactsReceived=Unknown reason when no audit request has ever
	// reached this operator, on any route. Nothing is posting to it, so the fix is the API server's
	// audit webhook configuration and its connectivity, never this provider's route.
	ReasonNoAuditDelivery = "NoAuditDelivery"
	// ReasonRouteUnused is the AuditFactsReceived=Unknown reason when audit requests ARE arriving
	// and nothing has ever landed on this provider's route. That is the one case where the route
	// itself is the thing to look at.
	//
	// It deliberately does not claim the facts went to some OTHER route, which would be the sharper
	// message: requests can also arrive and produce no fact anywhere, when the audit policy's level
	// or verbs leave nothing attributable. This reason stays true for both.
	ReasonRouteUnused = "RouteUnused"
	// ReasonFactsReceived is the AuditFactsReceived=True reason: a fact has arrived on the route,
	// and that answer is latched.
	ReasonFactsReceived = "Received"

	// ReasonInCluster is the Validated=True reason for an inCluster provider the installation
	// allows. A secretRef provider that validates reports the shared ReasonSucceeded instead.
	ReasonInCluster = "InCluster"
	// ReasonKubeConfigInvalid is the Validated=False reason for a malformed or unsafe kubeconfig
	// whose specific cause is carried in the message.
	ReasonKubeConfigInvalid = "KubeConfigInvalid"

	// MsgSnapshotCompleted is returned as the condition message when the initial
	// cluster snapshot has been successfully committed to Git.
	MsgSnapshotCompleted = "Initial snapshot reconciliation completed"

	// RequeueSteadyInterval is the unified control-plane periodic reconcile fallback.
	// The control plane no longer watches Secrets (docs/rbac.md),
	// so out-of-band credential and age-key changes are picked up on this steady cadence
	// instead of via a Secret informer. It replaces the former split of a 2-minute
	// transient-retry, a 5-minute auth/secret, and a 10-minute revalidation interval with
	// a single 5-minute fallback for the GitProvider, GitTarget, WatchRule, and
	// ClusterWatchRule reconcilers. The fast stream-settle loop below is separate.
	RequeueSteadyInterval = 5 * time.Minute
	// RemotePublicationInterval is the FLOOR on how often one GitTarget writes status.remote: at
	// most one such write per target per interval, whatever the branch's commit rate.
	//
	// It is a floor and not a deadline. What a target publishes is what it holds when it
	// reconciles, so the lag is its own cadence; this only stops a target reconciling in a tight
	// loop from writing the stanza every time. The one place it also acts as a delay is a
	// reconcile that has just ASKED the remote where the branch is, which comes back after this
	// long to publish the answer rather than leaving it undelivered for a tick.
	//
	// One minute: short enough that a target being asked questions answers promptly, long enough
	// that ten folders sharing a busy branch cost ten status writes a minute, not ten per commit.
	RemotePublicationInterval = 1 * time.Minute
	// DefaultGitRefreshInterval is how often an IDLE branch's remote state is re-proved. A target
	// that is publishing renews its observation on every push and never waits for this.
	DefaultGitRefreshInterval = 10 * time.Minute
	// DefaultCommitRequestTTL is how long a CommitRequest is kept once it finishes. Each save leaves
	// one object behind, so without an expiry they accumulate in etcd for as long as the namespace
	// lives. Two days leaves a weekend's worth of saves to inspect.
	DefaultCommitRequestTTL = 48 * time.Hour
	// RequeueStreamSettleInterval is the requeue interval while a Ready GitTarget still
	// has streams pending replay completion. Stream status is computed during reconcile, so
	// this keeps status.streams fresh while watches converge.
	RequeueStreamSettleInterval = 10 * time.Second
	// RequeueCollectionOverlapInterval is how often a rule refused for a CollectionOverlap
	// re-checks the conflict. It is a fallback: the stream-state event of the sibling rule that
	// cleared it usually arrives first, but that event is best-effort.
	RequeueCollectionOverlapInterval = 30 * time.Second
	// RequeueReceiverTokenInterval is how often a GitReceiver whose token Secret or "token" key is
	// missing looks again. Secrets are not watched, so nothing else tells it the token arrived, and
	// until it does no delivery can reach the receiver: Flux or Argo CD applying a GitReceiver and
	// its Secret in one pass, in either order, must not leave the path unpublished for a steady
	// interval.
	RequeueReceiverTokenInterval = 30 * time.Second
	// RequeueWriteLostInterval is how soon a reconcile whose status write lost the optimistic-lock
	// race comes back. It is short because there is nothing to wait FOR: the write was rejected
	// against a resourceVersion this reconcile had already read, so the only thing that has to
	// happen before the retry can succeed is the informer cache catching up with a write that is
	// already durable — milliseconds, not a settle window.
	//
	// It used to borrow RequeueStreamSettleInterval, which put the recovery ten seconds out and
	// made every lost write a ten-second window of published-but-stale status. Two unrelated
	// cadences shared one constant; only the coincidence that both were "soon" hid it.
	RequeueWriteLostInterval = 100 * time.Millisecond

	// RetryInitialDuration is the initial duration for exponential backoff retry.
	RetryInitialDuration = 100 * time.Millisecond
	// RetryBackoffFactor is the multiplicative factor for exponential backoff.
	RetryBackoffFactor = 2.0
	// RetryBackoffJitter is the jitter factor for retry backoff.
	RetryBackoffJitter = 0.1
	// RetryMaxSteps is the maximum number of retry attempts.
	RetryMaxSteps = 5

	// ReasonSucceeded is the reason on a healthy, fully reconciled object. It replaces the former
	// "OK"/"Ready" spellings, which restated the condition type instead of answering "why".
	ReasonSucceeded = fluxmeta.SucceededReason
	// ReasonProgressing indicates that a stream or control-plane gate is still converging.
	ReasonProgressing = fluxmeta.ProgressingReason

	// ReasonFailed indicates that reconciliation is blocked until a human fixes the object or
	// dependency. fluxmeta has no Stalled reason, and a reason restating the Stalled type would
	// answer nothing, so this is the upstream Failed.
	ReasonFailed = fluxmeta.FailedReason
	// ReasonSecretNotFound indicates that the referenced secret was not found.
	ReasonSecretNotFound = "SecretNotFound"
	// ReasonSecretMalformed indicates that the referenced secret is invalid.
	ReasonSecretMalformed = "SecretMalformed"
	// ReasonConnectionFailed indicates that the connection to the provider failed.
	ReasonConnectionFailed = "ConnectionFailed"
	// ReasonCommitConfigInvalid indicates the commit configuration is invalid.
	ReasonCommitConfigInvalid = "CommitConfigInvalid"
	// ReasonEncryptionConfigInvalid indicates encryption configuration is invalid.
	ReasonEncryptionConfigInvalid = "EncryptionConfigInvalid"
)

const (
	// GitBranchReasonGitProviderNotFound is the stall for a GitBranch whose GitProvider does not
	// exist.
	GitBranchReasonGitProviderNotFound = "GitProviderNotFound"
	// GitBranchReasonGitProviderNotReady is the progress reason while the GitProvider is not Ready.
	GitBranchReasonGitProviderNotReady = "GitProviderNotReady"
	// GitBranchReasonBranchNotAllowed is the stall for a branch outside the patterns the
	// GitProvider's spec.allowedGitBranches give this GitBranch's namespace.
	GitBranchReasonBranchNotAllowed = authz.ReasonBranchNotAllowed
	// GitBranchReasonNamespaceNotAuthorized is the stall for a GitBranch whose namespace no grant in
	// the GitProvider's spec.allowedGitBranches admits.
	GitBranchReasonNamespaceNotAuthorized = authz.ReasonNamespaceNotAuthorized
	// GitBranchReasonPushSessionFailed is the progress reason while the credential cannot open a
	// push (receive-pack) session on the remote. A GitBranch that holds its branch keeps it.
	GitBranchReasonPushSessionFailed = "PushSessionFailed"
	// GitBranchReasonBranchConflict is the stall for a GitBranch whose repository branch another,
	// older GitBranch holds.
	GitBranchReasonBranchConflict = "BranchConflict"
	// GitBranchReasonParentBranchNotFound is the stall for a branch that cannot be created: the
	// remote carries neither it nor the parent it would be created from.
	GitBranchReasonParentBranchNotFound = "ParentBranchNotFound"
	// GitBranchReasonRecoveringParentBranch is progress while the parent branch has been found again
	// but the branch worker has not yet published the writes it kept while the parent was missing.
	GitBranchReasonRecoveringParentBranch = "RecoveringParentBranch"
)

const (
	GitTargetConditionReady                = ConditionTypeReady
	GitTargetConditionReconciling          = ConditionTypeReconciling
	GitTargetConditionStalled              = ConditionTypeStalled
	GitTargetConditionValidated            = "Validated"
	GitTargetConditionEncryptionConfigured = "EncryptionConfigured"
	GitTargetConditionGitPathAccepted      = ConditionTypeGitPathAccepted
	GitTargetConditionRenderMatchesLive    = ConditionTypeRenderMatchesLive
	// GitTargetConditionStreamsRunning is the source data-plane axis: True when every tracked type's
	// watch has crossed its replay watermark or resumed from a durable cursor.
	GitTargetConditionStreamsRunning = ConditionTypeStreamsRunning
)

const (
	// GitTargetReasonOK is the healthy reason. It is the shared Succeeded vocabulary rather than
	// a per-kind spelling; the name is kept for call-site stability.
	GitTargetReasonOK = ReasonSucceeded
	// GitTargetReasonGitBranchNotFound is the Validated=False reason for a GitTarget whose
	// spec.gitBranchRef names no GitBranch, or is not set.
	GitTargetReasonGitBranchNotFound    = "GitBranchNotFound"
	GitTargetReasonTargetConflict       = "TargetConflict"
	GitTargetReasonNotChecked           = "NotChecked"
	GitTargetReasonBlocked              = "Blocked"
	GitTargetReasonNotStarted           = "NotStarted"
	GitTargetReasonNotRequired          = "NotRequired"
	GitTargetReasonMissingSecret        = "MissingSecret"
	GitTargetReasonInvalidConfig        = "InvalidConfig"
	GitTargetReasonSecretCreateDisabled = "SecretCreateDisabled"
	GitTargetReasonUnsupportedContent   = "UnsupportedContent"
	// GitTargetReasonIgnoreShadowsManagedPath is the terminal reason for the one
	// unrecoverable .gittargetignore footgun (docs/spec/gitpath-foreign-content-stringency.md
	// §4.3): an ignore pattern matches a path the operator writes, which would blind it to its
	// own file. The writer's write-plan precondition refuses the flush before any byte is
	// written and the GitTarget is failed with this reason. The string must stay in sync with
	// the watch package's gitPathRefusalReason.
	GitTargetReasonIgnoreShadowsManagedPath = "IgnoreShadowsManagedPath"
	// GitTargetReasonWriteBoundaryRefused is the reason for a write the operator refused
	// because it had nowhere safe to land, rather than because the folder holds content the
	// operator cannot manage
	// (docs/design/support-boundary/gittarget-granularity-and-cross-environment-edits.md §1): a
	// planned write escaping spec.path (L1), or an in-place edit of a source file more than
	// one kustomize render root reaches (L2, write-fan-in > 1). Nothing was committed. The
	// string must stay in sync with the watch package's gitPathRefusalReason.
	GitTargetReasonWriteBoundaryRefused = "WriteBoundaryRefused"
	// GitTargetReasonMultipleSourceNamespaces is the terminal reason for a target that declared
	// its folder namespace-free (spec.serializeNamespace: false) and that more than one source
	// namespace reaches. Two namespaces produce documents whose identities are equal once the
	// namespace is stripped, so each write flips one document between two live objects; the writer
	// refuses the flush before any byte is written. The remedy is a GitTarget or WatchRule edit.
	// The string must stay in sync with manifestanalyzer.GitPathRefusalReason.
	GitTargetReasonMultipleSourceNamespaces = "MultipleSourceNamespaces"
	// GitTargetReasonUnrenderedPlacement is the terminal reason for a placement under
	// spec.placement.useKustomize that no kustomization would render: the folder already has a
	// render root and the resolved path is outside it. Nothing is written, because a document in
	// Git that nothing applies looks mirrored and is not. The remedy is the target's own template
	// or path. The string must stay in sync with manifestanalyzer.GitPathRefusalReason.
	GitTargetReasonUnrenderedPlacement    = "UnrenderedPlacement"
	GitTargetReasonRenderDoesNotMatchLive = "RenderDoesNotMatchLive"
	GitTargetReasonRenderRechecking       = "Rechecking"

	GitTargetReadyReasonValidationFailed        = "ValidationFailed"
	GitTargetReadyReasonEncryptionNotConfigured = "EncryptionNotConfigured"
	GitTargetReadyReasonWorkerUnavailable       = "WorkerUnavailable"
	// GitTargetReasonWatchPlanFailing is Ready=False/Reconciling=True while the watch-plane
	// owner's pass for this GitTarget keeps failing and being retried on its backoff ladder. It
	// is deliberately a PROGRESSING reason rather than a stall: a pass fails on a source cluster
	// that is unreachable or a catalog that is not observable yet, both of which recover on their
	// own. What it buys is that such a target does not read as idle.
	GitTargetReasonWatchPlanFailing = "WatchPlanFailing"

	GitTargetStreamsRunningReasonNotReady = "NotReady"

	// GitTargetReasonSuspended is Ready=True on a target whose spec.suspend stops it writing. It
	// is True on purpose: suppressing writes on request is a configured outcome, not ill health.
	GitTargetReasonSuspended = fluxmeta.SuspendedReason
)

const (
	// GitTargetReasonAmbiguousLayout is a GitTarget path covering more than one kustomize render
	// root. The string must stay in sync with the watch package's gitPathRefusalReason, which
	// maps the corresponding write refusal onto GitPathAccepted.
	GitTargetReasonAmbiguousLayout = "AmbiguousLayout"
	// GitTargetReasonLayoutNotScanned is the pre-scan state: the target has not read its folder
	// yet, so nothing is known about its layout. Distinct from a folder that resolved to nothing.
	GitTargetReasonLayoutNotScanned = "NotScanned"
)

const (
	// GitTargetConditionSourceClusterReachable is the RUNTIME reachability of the source
	// cluster a GitTarget mirrors from: True (reason LocalCluster) for an inCluster provider,
	// Unknown before the data plane's first discovery, False after a real failed attempt. It is
	// distinct from Validated: a missing/malformed kubeconfig is Validated=False (an input the
	// controller reads without a network dial); an otherwise-valid kubeconfig whose API server
	// cannot be contacted is SourceClusterReachable=False.
	GitTargetConditionSourceClusterReachable = "SourceClusterReachable"
	// GitTargetConditionGitBranchReady projects the referenced GitBranch's Ready onto the GitTarget,
	// and whether it holds its repository branch, so one `kubectl get gittarget` separates
	// source-side (SourceClusterReachable) from destination-side (GitBranchReady) failure.
	GitTargetConditionGitBranchReady = "GitBranchReady"

	// GitTargetReasonGitBranchNotReady is the GitBranchReady=False reason: the GitBranch exists but
	// does not hold its branch, or reports itself not Ready.
	GitTargetReasonGitBranchNotReady = "GitBranchNotReady"

	// GitTargetConditionKubeProviderReady projects the referenced KubeProvider's Ready onto
	// the GitTarget, so one `kubectl get gittarget` shows whether the SOURCE cluster's provider is
	// healthy — distinct from SourceClusterReachable (the data plane's runtime reach) and
	// GitBranchReady (the destination). It follows the GitBranchReady contract: only an
	// EXPLICIT Ready=False downgrades the GitTarget; a provider that has not reported readiness yet
	// is Unknown and does not. A MISSING provider never reaches this projection at all — that is the
	// Validated gate's hard denial (GitTargetReasonKubeProviderNotFound), not a readiness axis.
	GitTargetConditionKubeProviderReady = "KubeProviderReady"
	// GitTargetReasonKubeProviderNotReady is the KubeProviderReady=False/Unknown reason.
	GitTargetReasonKubeProviderNotReady = "KubeProviderNotReady"
)

const (
	WatchRuleReasonValidating            = "Validating"
	WatchRuleReasonAccessDenied          = "AccessDenied"
	WatchRuleReasonGitTargetNotFound     = "GitTargetNotFound"
	WatchRuleReasonGitDestinationInvalid = "GitDestinationInvalid"
	WatchRuleReasonReady                 = ReasonSucceeded
	// WatchRuleReasonCatalogNotReady is ResourcesResolved=False: the source cluster's discovery
	// catalog is not ready, so no selector can be resolved yet. A selector that matches nothing
	// the cluster serves is not this: it resolves True, watching zero types.
	WatchRuleReasonCatalogNotReady = "CatalogNotReady"
)

const (
	// WatchRuleReasonSourceNamespaceAllowed is the True reason when every item watches a namespace the
	// KubeProvider's grants give the GitTarget.
	WatchRuleReasonSourceNamespaceAllowed = authz.ReasonSourceNamespaceAllowed
	// WatchRuleReasonSourceNamespaceNotAllowed is the TERMINAL False reason for a refusal.
	WatchRuleReasonSourceNamespaceNotAllowed = authz.ReasonSourceNamespaceNotAllowed
)

const ApplierClaimConditionConfigured = "Configured"

const ApplierClaimConditionInControl = applier.ApplierClaimConditionInControl

const CommitRequestDeleteAfterAnnotation = "configbutler.ai/delete-after"

const DefaultUnfollowedGrace = time.Minute

const EventReasonOperationUnfollowed = "OperationUnfollowed"

const GitBranchFinalizer = "configbutler.ai/git-branch"

const GitBranchProviderIndex = "configbutler.ai/gitbranch-provider"

const GitReceiverReasonListenerDisabled = "ListenerDisabled"

const GitTargetConditionApplierClaimReady = "ApplierClaimReady"

const GitTargetConditionLayoutResolved = "LayoutResolved"

const GitTargetReasonKubeProviderNotFound = authz.ReasonKubeProviderNotFound

const GitTargetReasonNamespaceNotAuthorized = authz.ReasonNamespaceNotAuthorized

const ReasonApplierClaimNotFound = "ApplierClaimNotFound"

const ReasonAutomatedSyncOff = "AutomatedSyncOff"

const ReasonOperationUnresolved = "OperationUnresolved"

const ReconcileRequestAnnotation = "reconcile.configbutler.ai/requestedAt"