Skip to content

Source status: no status is stated in the source document, so none is assigned here. Do not treat this page as a finalized specification. The normative rules are in the Technical Specification.

Package and Distribution System

The language will provide a package ecosystem for creating, distributing, installing, and maintaining reusable software components.

1. Package Structure

  • Packages must have unique identities.
  • Every package must declare its version.
  • Dependencies must be explicitly listed.
  • Public interfaces must be documented.
  • Package contents must be identifiable and traceable.

2. Package Verification

  • Packages must include compiler validation results.
  • Declared contracts must be available to consuming projects.
  • Verification evidence must identify the exact package version.
  • Unverified properties must remain visible.
  • Package authors cannot claim formal verification without supporting evidence.

3. Installation and Updates

  • Package versions must be explicitly controlled.
  • Dependency resolution must be reproducible.
  • Updates must trigger compatibility checks.
  • Breaking changes must be identified.
  • Packages must support rollback to previous versions.

4. Trust and Security

  • Packages must have verifiable publisher identities.
  • Package integrity must be checked using cryptographic hashes.
  • Dependencies must not inherit application permissions automatically.
  • Package provenance must be recorded.
  • Vulnerable or compromised packages must be identifiable.

5. Package Registry

The ecosystem should support: - Publishing packages. - Searching and discovering packages. - Version management. - Dependency inspection. - Security advisories. - Verification report access.

Design Goal

AI agents should be able to discover, evaluate, install, and use third-party code without blindly trusting its author or its claims of correctness.

Source and authority

This page migrates ECOSYSTEM.md in full. It is an explanatory / implementation document, not the normative specification. Where it simplifies a rule, the Technical Specification governs. The original file is preserved in source-original/LANG/.