# Non-negotiable invariants

Read this before changing ABI, wheel, resolver, or compiler behavior.

1. `python-runtime/abi/extension-abi.json` is the source of truth for target
   identity and compile/link compatibility. Recipes cannot override ABI flags.
2. A host-native ELF, Mach-O, `.node`, or other binary is never accepted or
   relabeled as WebAssembly.
3. A native wheel must match both its Python wheel tag and SandboxedJS
   `abiId`.
4. Build tools run on the build machine. Target code and target libraries are
   compiled for wasm32. Never put target artifacts on the host interpreter's
   import path.
5. Build, host, Python-runtime, and native-target dependencies are separate
   concepts and must be represented separately.
6. Sources and build-tool artifacts are version-pinned and hash-verifiable.
7. Generic behavior lives in generic machinery. Package-specific behavior is
   visible in a recipe and/or patch, never hidden behind `if package == ...`.
8. The package's own metadata is authoritative. Recipes may constrain or add
   target facts, but must not silently duplicate drifting `Requires-Dist` data.
9. Installer operations remain transactional. Failed resolution, download, or
   installation must not leave a partial environment.
10. A build is supported only after the wheel installs and its compiled module
    executes under the owned SandboxedJS CPython runtime.
11. Browser compatibility remains mandatory. Runtime TypeScript must not gain
    unconditional Node builtin imports.
12. Unsupported operating-system capabilities fail honestly. Package success
    must not be manufactured by fake sockets, fake processes, or silent skips.

## Forbidden shortcuts

- Weakening `verify_side_module` or ABI checks to make a fixture pass.
- Adding arbitrary recipe compiler/link flags.
- Copying metadata solely from a handwritten recipe when upstream metadata can
  be generated.
- Installing unpinned build requirements from the network in a release build.
- Treating "wheel file exists" as an acceptance result.
- Starting with NumPy-specific branches in the generic pipeline.
- Running full tests repeatedly when a focused test identifies the defect.