# NEXT temporary contract 3.14 — Installable tools, payloads and dependency closure {#root}

@status:impl/plan

[p01] @fact:NEXT-A14-SCOPE Temporary normative staging unit. Its body is the accepted architecture from refined plan revision 4, section 3.14. Before production code cites this law, promote the relevant clauses into permanent specifications. This file is consumed only after semantic coverage, implemented behavior and retained evidence are accepted. The task/retirement checker cannot perform semantic acceptance. @status:spec/done

[p02] @fact:NEXT-A14-U001 **Recommendation:** единый lifecycle source→build/package artifact→realize payload→activate profile. Существующий bare install сохраняет project materialization/boot contract. Новый explicit env apply или tool install --environment удобный вход составляет уже существующие операции по полному плану; не вызывает agent create или scripts по скрытому hook. Необходимость production возвращается отдельно. Legacy bin list/path/exec migrates to the same recorded artifact validation; existence/debug-first fallback не источник installed-runtime truth (E31). @status:spec/done

[p03] @fact:NEXT-A14-U002 Package may supply captured prebuilt archives/files or an explicit deterministic build recipe. Source tree, build record and installed payload — разные identities. A realization binds exact input captures, dependency roles, provider/recipe/config, executor/target/platform ABI, output digest and complete install metadata. Reuse existing A2/artifact storage where it proves these facts; extend its schema/observers for missing facts, no parallel pretend evidence engine. Native providers remain explicit trusted executable code. @status:spec/done

[p04] @fact:NEXT-A14-U003 **Payload manifest:** files/directories/links, raw content digest, relative target path, executable/mode semantics, ownership mapping, allowed metadata, exported commands/libs/data, configuration templates, runtime dependency closure and optional service descriptors. Linux UID/GID mappings are target principals, never Windows host IDs. Unsupported xattrs/capabilities/device nodes fail explicitly. M-15 supports the ordinary tools subset (files, directories, safe symlinks, modes); full OS metadata vocabulary and admission seams are fixed now, privileged node realization is future work. @status:spec/done

[p05] @fact:NEXT-A14-U004 Source-address portable grammar stays scoped to spec/resource addressing. Linux package paths have their own target filesystem grammar; a global Windows filename blacklist must not reject valid Linux payloads. Validate archives before writes: traversal, duplicate/overlapping entries, hardlink/symlink escape, case collision under the selected target policy and metadata escalation. Legitimate rootfs absolute links describe target-namespace paths; extraction never follows them into the host. A Linux executor or metadata-preserving image writer handles POSIX semantics; copying through NTFS and assuming chmod/chown survived is invalid. @status:spec/done

[p06] @fact:NEXT-A14-U005 **Dependencies:** reuse M-05 Vibe algebra within a resolution domain; add typed roles build, tool/executor and runtime, explicit target constraints and backend-qualified package references. Each environment may choose a different Vibe version/configuration; inside one shared instance incompatible requests still conflict. Backend-native versions (including Arch epoch/pkgrel) are opaque to Vibe SemVer ordering. Requested roots and exact resolved transitive closure remain separate. ABI/runtime libraries must be either captured payload dependencies or named verified platform requirements; ambient PATH/libc does not silently satisfy a hermetic promise. @status:spec/done

[p07] @fact:NEXT-A14-U006 Home first-wave packages must actually run from their chosen prefix: static/relocatable payload, supported runtime closure or a declared compatible host ABI. Prefix-bound binaries carry that constraint; no promise that arbitrary /usr-oriented Arch packages work under HOME. A wrapper setting PATH cannot repair every ELF loader/RPATH/shebang issue. relocate is a tested capability or requires rebuild; unsupported relocation explicit. @status:spec/done

[p08] @fact:NEXT-A14-U007 Environment generation may share verified immutable payloads via an existing/adapted content store. Do not mutate source slots into runtime payloads. Profile command conflicts require explicit selection/alias, never last-writer wins. env exec resolves a selected generation with a controlled environment; shell activation emits an explicit script/diff and only changes shell startup files when requested. Each invocation pins its generation; switching active profile does not retarget an already running process. @status:spec/done

[p09] @fact:NEXT-A14-U008 Package-manager operations form one library/CLI/MCP lifecycle: discover/search, inspect/explain dependencies/files/owners, resolve/lock, fetch, plan, install/apply, update, remove, verify/repair, activate, list generations, rollback and GC. E1 implementation may group verbs, but cannot claim package-manager completion from install alone. Remove recomputes the desired closure and reverse dependencies, preserves shared/explicit roots and mutable user data; cascade must be explicitly included in the plan. GC separately considers all retained generations, live uses, rollback pins, build inputs and other environments; no implicit quota or unproven reference-count-only deletion. @status:spec/done