Section 15: Package Management and Distribution¶

TECHSPEC-15 — Section 15 · Version 0.1 · Status: Initial Draft

Status: draft. This section is an Initial Draft (Section 57 is a Working Register). It describes intended or proposed behavior, not a finalized, implemented language rule. Do not treat examples here as normative.

1. Package Philosophy¶

External packages must be identifiable, reproducible, and independently assessable.

Installing a package must never imply that its code is safe, correct, or trustworthy.

The package system must preserve the distinction between package availability, integrity, compatibility, and verification.

2. Package Identity¶

Every package must have a unique identity.

A package declaration must identify:

Package name.
Publisher or namespace.
Package version.
Language compatibility.
Public interface.
Dependency requirements.
Required permissions.
Integrity information.

Package identities must not be silently reassigned to different publishers.

3. Versioning¶

Packages must use explicit version numbers.

The initial system follows semantic versioning:

MAJOR: Incompatible public interface or behavioral changes.
MINOR: Backward-compatible functionality additions.
PATCH: Backward-compatible corrections.

Rules: - Published versions must be immutable. - Existing version identifiers cannot be reused for different package contents. - Breaking changes must increment the major version. - Dependency resolution must record the exact version installed. - Version compatibility must not be treated as proof of behavioral compatibility.

4. Dependency Management¶

Packages must declare their dependencies.

Rules: - Dependencies must be explicit. - Dependency versions must be constrained. - Resolved versions must be recorded in a lockfile. - Transitive dependencies must be visible. - Dependency conflicts must be reported. - Unresolved dependencies must prevent a validated build. - Dependency updates must trigger appropriate compatibility and verification checks.

5. Package Integrity and Provenance¶

The package manager must verify package integrity before installation.

It should record: - Package content hash. - Publisher identity. - Publication information. - Dependency tree. - Build provenance, when available. - Available verification evidence. - Known security advisories.

Rules: - Content hashes must be checked against the package's recorded integrity information. - Publisher identity must be distinguishable from package content integrity. - A valid signature establishes provenance under its signing trust model, not code correctness. - Missing verification evidence must be reported as UNKNOWN or UNVERIFIED.

6. Permissions and Trust¶

Packages must declare the effects and permissions they require.

Rules: - Installing a package must not automatically grant unrestricted permissions. - Package permissions must be reviewed and granted explicitly. - Dependencies must not inherit permissions automatically. - Permission changes must be visible. - Packages with unknown or undeclared effects must not be treated as harmless. - Package trust must not be inferred solely from popularity, publisher identity, or successful installation.

7. Package Distribution¶

The package system must support: - Publishing packages. - Installing packages. - Updating packages. - Removing packages. - Inspecting package metadata. - Inspecting dependency trees. - Reviewing verification evidence. - Reviewing security advisories.

Published packages must retain identifiable versions and integrity records.

8. Compiler and Package Manager Responsibilities¶

The system must: - Resolve package identities. - Validate version constraints. - Generate and enforce lockfiles. - Verify package integrity. - Detect dependency conflicts. - Expose transitive dependencies. - Report package permissions and effects. - Preserve package provenance and verification records.

9. Design Goal¶

AI agents must be able to use external code without blindly trusting it.

Every dependency must have a traceable identity, reproducible version, explicit permission requirements, and clearly stated verification limitations.

Source file: TECHSPEC-15.md (preserved in source-original/LANG/). See the specification index, the glossary, and the cross-reference index.