Package Manifest And Lockfile

0x0 now has a checked local package manifest. This is the first package slice:

it records the repository package identity, source roots, and local path

dependencies, then locks that text into a deterministic generated file.

This is not a package registry or dependency solver yet. Compiler imports can

resolve checked local dependencies through the generated lockfile with

(↥ "pkg:<dependency-name>"). The package gate exists so future libraries and

frameworks have a concrete manifest format and a lockfile invariant before

distribution grows around it.

Files

• 0x0.pkg: root package manifest, edited by maintainers.
• 0x0.lock: generated lockfile, checked into the repository.
• tools/pkg-lock.0x0: 0x0 implementation of manifest validation and lockfile

generation.

• tools/pkg-lock.sh: shell wrapper for checking or regenerating the lockfile.

Manifest Format

The manifest is line-oriented:

package 0x0
version 0.1.0

source compiler/main.0x0
source lib/core/option.0x0

dep core-option lib/core/option.0x0

Supported directives:

• package <name>: exactly one package name.
• version <version>: exactly one package version.
• source <path>: a source file owned by the package.
• dep <name> <path>: a local path dependency available to the package.

Blank lines are allowed. Lines whose first non-space character is # are

comments.

Validation Rules

tools/pkg-lock.0x0 enforces the current safety rules:

• 0x0.pkg must end with a newline.
• Manifest lines must not contain raw tabs or trailing spaces.
• There must be exactly one package line and exactly one version line.
• There must be at least one source line.
• Source paths must be unique.
• Dependency names must be unique.
• Source and dependency paths must be relative.
• Paths must not contain parent traversal.
• Paths must end in .0x0.
• Paths must point at readable files.
• Dependency names must not contain /.
• Dependency paths must also be listed as package sources.

Package Imports

Source files may import a local dependency by name:

(↥ "pkg:core-map")
(↥ "pkg:web-router")

The compiler reads 0x0.lock, finds the matching dep <name> <path> entry, and

loads that source path. This keeps import names stable while package-local paths

move. Relative imports inside the dependency continue to resolve from that

dependency file's directory.

If the dependency name is not present in 0x0.lock, compilation fails with a

package dependency not found diagnostic.

Commands

Check the lockfile:

make package-check

Build the library OISA cache:

make libs-compile

Compiled library artifacts are generated under build/libs/oisa.

They are keyed by library source hash and compiler hash, so repeated runs reuse

unchanged artifacts and rebuild only changed libraries. The default rebuild path

uses one compiler process at a time; set LIBS_COMPILE_JOBS only for

an intentional parallel run.

Check that every library stands alone:

make libs-standalone-check

This compiles every libs/<package>/src/lib.0x0 as an independent OISA

artifact and runs every package-local libs/<package>/tests/smoke.0x0 through

its relative ../src/lib.0x0 import. The smoke runner also defaults to one

compiler process at a time; set LIBS_SMOKE_JOBS only when the host

can safely absorb the extra compiler processes.

Regenerate it after changing 0x0.pkg:

make package-lock
make package-check

The package check is part of make lint, make test, and

make bootstrap-from-seed. The standalone library check is part of make lint.