Things we will never do (to protect decision trust)

This is an internal integrity contract. If we break these, Helix stops being decision‑trust infrastructure and becomes “just another tool”.

Trust bypasses

• Never emit an artifact without a verifiable contract identity (embedded header or cryptographically linked sidecar).
• Never allow verification to succeed when required identity/policy/receipts are missing, ambiguous, or separated.
• Never add “convenience exports” that bypass trust checks or downgrade failures into warnings.

Offline verification

• Never require Helix servers (or any network service) to verify a bundle/proof.
• Never make trust depend on mutable state (“latest policy”, “current registry”) instead of pinned, content‑addressed inputs.

Drift and semantics

• Never hide drift behind “green builds” or silently changed defaults.
• Never change scoring/semantics without an explicit semantic identity change and a reviewer‑friendly diff/proof path.
• Never make “why changed?” require reading raw logs as the primary UX.

Determinism discipline

• Never introduce nondeterminism without declaring it, labeling the determinism class, and gating it behind explicit policy.
• Never ship unstable formatting/ordering that makes diffs noisy or verification brittle.

Teams positioning

• Never let Teams become collaboration software. Teams is a programmable acceptance boundary, period.

Scope and language boundary

• Never ship features or language that violate docs/positioning.md and docs/non_goals.md.