# NEXT temporary cross-cutting contract — Architectural principles and boundaries {#root}

@status:impl/plan

[p01] @fact:NEXT-G02-SCOPE Frozen cross-cutting requirement source from refined plan revision 4 section 2. It complements domain contracts and must be promoted clause by clause; no product implementation or completion is asserted here. @status:spec/done

[p02] @fact:NEXT-G02-U001 Requirement: 1. **Owner rulings before derived state.** §12 governs this programme; M-13 переносит решения в product contracts до зависимого runtime. Stale repository notes не переоткрывают уже принятые предпочтения. 2. **Одна capability — одна library authority.** CLI, interactive viewer и MCP используют общую domain operation; IDE работает через versioned structured protocol. No text-output scraping. 3. **Facts ≠ work ≠ execution ≠ evidence ≠ acceptance.** Existing requirements/terminality не получают hidden policy; change не scheduler. 4. **Exact identity имеет domain/recipe.** Meaningful inputs, canonical order/length framing; SemVer, slug, timestamp и filepath сами не proof. 5. **Prototype policy explicit.** Current own product/package line 1.0.0. Graduation только owner declaration; major-breaking-change commitments включаются после неё. Generic frozen/channel concepts не silently удаляются; Redbook automatic roster bump superseded specifically. 6. **Format ≠ semantics ≠ loading ≠ trust.** Source descriptor, а не suffix/directory/namespace, решает interpretation. Foreign resources сохраняют bytes и default non-Vibe semantics. 7. **Requests ≠ grants.** External adapter задаёт requested new paths/keys/client capabilities; host-issued authorization разрешает exact effects. Derived content не наследует upstream identity/permissions. 8. **Pure inspect, explicit prepare/apply.** Inspect/list/explain/compare работают с captures и не hydrate/invoke/write. Preview явно рассчитывает hypothetical world; pure builtin compiler allowed in memory, effectful stages требуют separate admitted preparation. 9. **No boot quotas.** Размер/tokens не veto установки/сборки. Transport pagination, parser safety и cancellation обеспечивают работоспособность, не вводят скрытый total boot limit. Оценки/unknown states не заменяются фиктивной точностью. 10. **Failure prefix truthful.** Prepared plan/preconditions/authority before effects; journal/receipts/recovery сохраняют выполненное. Произвольные native/remote effects не объявляются reversible или sandboxed. 11. **A and B share pipeline.** Approval receipt A сейчас; bounded policy grant B может разрешить тот же exact prepared plan позже. Unknown/out-of-scope/revoked authority fails closed. 12. **Implementation choices remain engineering work.** Формальные схемы/recipe spelling freeze перед кодом; это не повод повторно спрашивать принятые owner preferences. Открытый D-022 явно отделён. 13. **Definition ≠ realization ≠ target instance.** Desired packages/lock, produced runtime closure и local root/principal/generation имеют отдельную identity; executor OS не target OS. 14. **One authority per package domain/resource.** Vibe source solver и external backend сохраняют собственную semantics; runtime profiles reference exact closures. No competing writable package DBs. 15. **Nix-inspired, host-independent supply chain.** Declared inputs/isolated builds/generations, explicit reproducibility levels and replaceable mirrors/caches. No mandatory GitHub, privileged /nix store or Nix DSL. 16. **Offline population ≠ live activation.** Build a Linux image without starting host services; future system effects require the exact target's authority. 17. **Extreme Total Observability.** Every supported feature and semantic internal model has a discoverable structured inspection/explanation/action/result/error/event path. No hidden CLI/TUI/prose-only authority; unavailable/redacted/uncaptured states explicit. 18. **IDE readiness is architectural.** Domain services own behavior; context/snapshot/overlay/operation identities and safe edit boundaries serve any client. Per-domain coverage gates precede any plugin/MVP planning. 19. **Observe without changing meaning.** Internal capture is separate from domain execution, uses versioned semantic models and does not change solver/compiler results; graph views compose existing authorities. 20. **Connection is not the operation.** Idempotent durable operation identity, responsive controls and truthful partial/recovery results survive transport loss within explicit supported policies. @status:spec/done

[p03]
```text
1. **Owner rulings before derived state.** §12 governs this programme; M-13 переносит решения в product contracts до зависимого runtime. Stale repository notes не переоткрывают уже принятые предпочтения.
2. **Одна capability — одна library authority.** CLI, interactive viewer и MCP используют общую domain operation; IDE работает через versioned structured protocol. No text-output scraping.
3. **Facts ≠ work ≠ execution ≠ evidence ≠ acceptance.** Existing requirements/terminality не получают hidden policy; change не scheduler.
4. **Exact identity имеет domain/recipe.** Meaningful inputs, canonical order/length framing; SemVer, slug, timestamp и filepath сами не proof.
5. **Prototype policy explicit.** Current own product/package line 1.0.0. Graduation только owner declaration; major-breaking-change commitments включаются после неё. Generic frozen/channel concepts не silently удаляются; Redbook automatic roster bump superseded specifically.
6. **Format ≠ semantics ≠ loading ≠ trust.** Source descriptor, а не suffix/directory/namespace, решает interpretation. Foreign resources сохраняют bytes и default non-Vibe semantics.
7. **Requests ≠ grants.** External adapter задаёт requested new paths/keys/client capabilities; host-issued authorization разрешает exact effects. Derived content не наследует upstream identity/permissions.
8. **Pure inspect, explicit prepare/apply.** Inspect/list/explain/compare работают с captures и не hydrate/invoke/write. Preview явно рассчитывает hypothetical world; pure builtin compiler allowed in memory, effectful stages требуют separate admitted preparation.
9. **No boot quotas.** Размер/tokens не veto установки/сборки. Transport pagination, parser safety и cancellation обеспечивают работоспособность, не вводят скрытый total boot limit. Оценки/unknown states не заменяются фиктивной точностью.
10. **Failure prefix truthful.** Prepared plan/preconditions/authority before effects; journal/receipts/recovery сохраняют выполненное. Произвольные native/remote effects не объявляются reversible или sandboxed.
11. **A and B share pipeline.** Approval receipt A сейчас; bounded policy grant B может разрешить тот же exact prepared plan позже. Unknown/out-of-scope/revoked authority fails closed.
12. **Implementation choices remain engineering work.** Формальные схемы/recipe spelling freeze перед кодом; это не повод повторно спрашивать принятые owner preferences. Открытый D-022 явно отделён.
13. **Definition ≠ realization ≠ target instance.** Desired packages/lock, produced runtime closure и local root/principal/generation имеют отдельную identity; executor OS не target OS.
14. **One authority per package domain/resource.** Vibe source solver и external backend сохраняют собственную semantics; runtime profiles reference exact closures. No competing writable package DBs.
15. **Nix-inspired, host-independent supply chain.** Declared inputs/isolated builds/generations, explicit reproducibility levels and replaceable mirrors/caches. No mandatory GitHub, privileged /nix store or Nix DSL.
16. **Offline population ≠ live activation.** Build a Linux image without starting host services; future system effects require the exact target's authority.
17. **Extreme Total Observability.** Every supported feature and semantic internal model has a discoverable structured inspection/explanation/action/result/error/event path. No hidden CLI/TUI/prose-only authority; unavailable/redacted/uncaptured states explicit.
18. **IDE readiness is architectural.** Domain services own behavior; context/snapshot/overlay/operation identities and safe edit boundaries serve any client. Per-domain coverage gates precede any plugin/MVP planning.
19. **Observe without changing meaning.** Internal capture is separate from domain execution, uses versioned semantic models and does not change solver/compiler results; graph views compose existing authorities.
20. **Connection is not the operation.** Idempotent durable operation identity, responsive controls and truthful partial/recovery results survive transport loss within explicit supported policies.
```