These invariants define the end-product contract across languages, providers, runtimes, deployment targets, and interfaces. A selected profile's exact support claims and applicable evidence establish which capabilities are available; this list does not establish implementation support by itself.
Meaning and ownership
- Every stable identity and contract has one semantic owner.
- Cross-system consumers use public owned records, never sibling internals.
- Authored syntax is a projection; normalized owner meaning is not coupled to tokens, field order, parser trees, or implementation-language bodies.
- Independent domains retain their own namespaces and compose through explicit directional mappings.
- Every One-owned source form, imported name, trait application, generated symbol, command, and owner record resolves to an exact snapshot-bound definition or an explicit unavailable/stale result.
Closure and selection
- Every root receives an independently computed semantic, implementation, provider, schema, codec, artifact, resource, permission, and Build closure.
- Only explicit reachable edges activate optional contributions.
- Workspace membership, package installation, Cargo features, generated files, and available providers never create semantic activation.
- Planning is deterministic for the same exact inputs and records every inclusion, alternative, conflict, and cost.
Stage separation
- Requirements are not grants.
- Declarations are not implementations.
- Implementation claims are not selections.
- Selections are not artifacts.
- Selected provider profiles are not provider realization receipts.
- Artifact bytes are not Build evidence.
- Plans and approvals are not mutation authority.
- Provider acknowledgement is not semantic convergence.
- Observations and historical assertions retain their provenance and do not become truth merely because they were recorded.
Authority and effects
- A grant can satisfy or narrow a requirement; it cannot widen one.
- Runtime tokens are attenuated, expiring, scoped to exact subjects, and validated at the real enforcement boundary.
- Secret values remain outside source, locks, plans, artifacts, diagnostics, histories, and generated projections.
- Every consequential external effect retains intent, authorization, attempt, fence, dispatch, acknowledgement, observation, and reconciliation as applicable.
- An outcome that may have crossed its boundary remains unknown until safely reconciled.
Build and supply chain
- Build consumes a locked physical selection without reselecting.
- Every artifact retains its complete action, source, toolchain, dependency, target, provenance, and verification closure.
- Generated projections are disposable; the source contract and projection receipt remain authoritative.
- First-party and third-party tools and providers cross the same claim-scoped admission boundary.
- Dependency and toolchain demands retain their exact consumer, role, source, constraint, resolution envelope, provenance, and private-workspace projection; deduplicated bytes grant no reachability.
Deployment and recovery
- Apply starts or resumes one immutable reviewed operation.
- Desired state, observed state, provider application, and verified postconditions remain distinct.
- Rollout, rollback, restore, failover, migration, compensation, and deletion are forward plans with their own authority and evidence.
- External history is never rewritten to simulate reversal.
Inspection and automation
- Every meaningful decision resolves to an inspectable owner record and proof path, subject to declared retention and erasure policy.
- Missing, stale, unresolved, unsupported, and unsatisfied states are typed and visible; no interface invents a value from weaker evidence.
- Human, SDK, automation, MCP, and agent interfaces project the same public operations and cannot bypass the lifecycle.
- End-user product surfaces describe user work and outcomes; deliberate evidence views expose architecture and operational proof.
Example
An illustrative unsupported target remains explicit instead of falling back:
{
"kind": "unsatisfied",
"requirement": "durable transactional state",
"root": "parcelhub#OrdersApi@1",
"eligible_realizations": []
}Normative source: repository architecture.