Invariant decision matrix

An invariant connects evidence to an approved or rejected ecosystem choice. The normalized model can relate a package category, approved package, banned package, runtime, optional framework package, severity, reason, replacement example, and migration URL. Approved and banned packages must not be the same record.

Evidence fields

The stable matrix is keyed by language and invariant identity. Evidence can include runtime, lockfile, manifest paths, and package-manager identity. The Rust invariant endpoint evaluates that evidence and returns structured diagnostics; it does not accept a client-supplied compliant shortcut.

Supported severity values are info, warning, error, and critical. Reasons explain the policy, replacement examples show an approved direction, and migration URLs point to supporting material when an authoritative record exists.

The catalog covers exactly 25 language identities, but the current checked-out fixture uses synthetic identifiers such as package-<slug> and package-alt-<slug>. Those are fixture examples, not real banned libraries or recommended migrations. This page intentionally publishes no concrete package policy or migration recipe until a validated checked-in registry export provides one.