NEXT temporary cross-cutting contract — Determinism, offline, security and authority rules

01Frozen cross-cutting requirement source from refined plan revision 4 section 7. It complements domain contracts and must be promoted clause by clause; no product implementation or completion is asserted here.

02Requirement: | Surface | Offline/unattended behavior | Authority / effects | |---|---|---| | spec/resource resolve | Captured classified source only; exact proof or honest unavailable | Trusted selected context, no writes/fetch | | choices query | Cached frozen catalog; missing unavailable | Never chooses/persists silently | | install/reconfigure | Explicit requests or explicit allow-defaults; otherwise NeedsSelection, no prompt JSON/non-TTY | Full solve/trust/plan before project mutation | | reinstall/update | Exact captures; preserve chosen intent; definition drift explicit | Same-version never sole identity | | change read/analysis | Complete captured observations or explicit incomplete | No provider/adoption/write | | migrate/scaffold/answer/promote/close | Explicit operation, preconditions and source epoch | Preserve source values/ownership, CAS/recovery | | scoped create/verify | Offline propagated; hosted no provider; verify only reused/completed producer | Exact request/transition, no hidden repair | | adapter inspect/plan | Prepared descriptor/capability observations | Requested paths/keys aren't grants; no probes/hydration | | adapter prepare/apply | Explicit allowed probes/effects; unattended supplies exact grant/policy | Existing engine receipts/locks, no arbitrary data-script execution | | derivative read/derive/rebase | Retained base + local bytes; missing base unavailable | New identity; no execution from derivation | | brownfield observe/propose | No tools/network unless explicit analyzer/assist operation | Exclusions and capture; promotion separate | | release prepare/preflight | Local plan offline; external source/probe explicit | Default smoke or explicit skipped policy; trusted subject | | release apply | Current A approval; future B only enabled bounded policy | Same plan digest, pre-write policy/target recheck | | debugger inspect/explain/compare | Existing snapshots, chunked/paged across same ID | No total boot quota, no hidden compiler/provider | | debugger preview | Pure builtin hypothetical calculation over captures; unknown stages honest | Exact graph from same resolver; effectful preparation separate | | environment inspect/plan | Captured catalogs/locks/installed inventory; no hidden native probe | Target binding and expected generation supplied by trusted surface | | environment apply/update/remove | Exact runtime closure, native backend constraints; no silent latest solve | Complete target-bound effects; shared dependencies/config/data preserved | | profile activate/rollback/GC | Retained generations, live-use/recovery roots; no network needed | Owned store/profile only; atomic pointer claim scoped to actual backend | | image prepare/build | Explicit fetch; replay uses complete captures with network off | Linux executor, explicit mounts/principals; target hooks cannot act on host | | image export/load/push | Distinct operations and exact image subjects | Local tests separate; public push current A | | service catalog/probe/call | Pure descriptors; explicit bound probe/call can be offline-unavailable | Discovery not trust/grant; runtime credentials only intended target | | mirror/cache/substitute | Exact recursive capture/closure/target/prefix/producer checks | No obligatory GitHub; missing offline input explicit, no fallback trust | | capability/model/schema discovery | Captured registered schemas and actual applicability | No native load/probe/network/permission grant | | overlay/query/diagnostics | Client-local versioned buffers plus compatible disk capture | Pure analysis; no autosave, installed-state change or cross-client leakage | | action prepare/apply | Exact saved-state plan and typed input; dirty/stale explicitly refused | One transaction owner, target/principal/policy revalidated | | operation events/attach/control | Retained domain status/cursors; gap/expired/unknown explicit | Reauthorize context; cancellation not automatic rollback; retry not duplicate submit | | internal trace inspect/capture | Recorded snapshots pure; new capture/export explicit | No writer-open/retention sweep/rerun hidden in reads; redaction/missing portions typed | | package rename | Complete scoped typed references and exact edits/regeneration | Owned source only; saved-state preconditions, journal, immutable history and publication kept separate |

| Surface | Offline/unattended behavior | Authority / effects |
|---|---|---|
| spec/resource resolve | Captured classified source only; exact proof or honest unavailable | Trusted selected context, no writes/fetch |
| choices query | Cached frozen catalog; missing unavailable | Never chooses/persists silently |
| install/reconfigure | Explicit requests or explicit allow-defaults; otherwise NeedsSelection, no prompt JSON/non-TTY | Full solve/trust/plan before project mutation |
| reinstall/update | Exact captures; preserve chosen intent; definition drift explicit | Same-version never sole identity |
| change read/analysis | Complete captured observations or explicit incomplete | No provider/adoption/write |
| migrate/scaffold/answer/promote/close | Explicit operation, preconditions and source epoch | Preserve source values/ownership, CAS/recovery |
| scoped create/verify | Offline propagated; hosted no provider; verify only reused/completed producer | Exact request/transition, no hidden repair |
| adapter inspect/plan | Prepared descriptor/capability observations | Requested paths/keys aren't grants; no probes/hydration |
| adapter prepare/apply | Explicit allowed probes/effects; unattended supplies exact grant/policy | Existing engine receipts/locks, no arbitrary data-script execution |
| derivative read/derive/rebase | Retained base + local bytes; missing base unavailable | New identity; no execution from derivation |
| brownfield observe/propose | No tools/network unless explicit analyzer/assist operation | Exclusions and capture; promotion separate |
| release prepare/preflight | Local plan offline; external source/probe explicit | Default smoke or explicit skipped policy; trusted subject |
| release apply | Current A approval; future B only enabled bounded policy | Same plan digest, pre-write policy/target recheck |
| debugger inspect/explain/compare | Existing snapshots, chunked/paged across same ID | No total boot quota, no hidden compiler/provider |
| debugger preview | Pure builtin hypothetical calculation over captures; unknown stages honest | Exact graph from same resolver; effectful preparation separate |
| environment inspect/plan | Captured catalogs/locks/installed inventory; no hidden native probe | Target binding and expected generation supplied by trusted surface |
| environment apply/update/remove | Exact runtime closure, native backend constraints; no silent latest solve | Complete target-bound effects; shared dependencies/config/data preserved |
| profile activate/rollback/GC | Retained generations, live-use/recovery roots; no network needed | Owned store/profile only; atomic pointer claim scoped to actual backend |
| image prepare/build | Explicit fetch; replay uses complete captures with network off | Linux executor, explicit mounts/principals; target hooks cannot act on host |
| image export/load/push | Distinct operations and exact image subjects | Local tests separate; public push current A |
| service catalog/probe/call | Pure descriptors; explicit bound probe/call can be offline-unavailable | Discovery not trust/grant; runtime credentials only intended target |
| mirror/cache/substitute | Exact recursive capture/closure/target/prefix/producer checks | No obligatory GitHub; missing offline input explicit, no fallback trust |
| capability/model/schema discovery | Captured registered schemas and actual applicability | No native load/probe/network/permission grant |
| overlay/query/diagnostics | Client-local versioned buffers plus compatible disk capture | Pure analysis; no autosave, installed-state change or cross-client leakage |
| action prepare/apply | Exact saved-state plan and typed input; dirty/stale explicitly refused | One transaction owner, target/principal/policy revalidated |
| operation events/attach/control | Retained domain status/cursors; gap/expired/unknown explicit | Reauthorize context; cancellation not automatic rollback; retry not duplicate submit |
| internal trace inspect/capture | Recorded snapshots pure; new capture/export explicit | No writer-open/retention sweep/rerun hidden in reads; redaction/missing portions typed |
| package rename | Complete scoped typed references and exact edits/regeneration | Owned source only; saved-state preconditions, journal, immutable history and publication kept separate |

04Domain-separated hashes bind meaningful identities, recipes/interpretations and ordered semantics; counts use integer-safe wire forms. Large boot handled by streaming/paging rather than rejecting customer budget. Parser/platform failures and cancellation are explicit technical outcomes, never a product token quota or guessed empty result.

05Foreign data may contain active instructions; inert parsing is not LLM trust admission. Native providers not OS-sandboxed by typed reply validation. Source credentials never copied into outputs/argv/receipts. Grants bind exact prepared effects and policy generation; future autonomy does not waive explicit Redbook version choice.