Core-0normative target; implementation partial

Module identity, imports, interfaces, and generation authority.

Core-0 Modules, Packages, and Authority

Status: normative

Modules and imports

C0-MOD-001 — Module identity. A module’s dotted identity is derived from the relative path of its .zl.md beneath the package authority root. The generated .zl declaration must equal that identity. Paths are UTF-8, workspace-relative, /-separated, and cannot contain an empty, . or .. component or escape through a symlink.

C0-MOD-002 — Direct imports. Each external declaration used by source is named by one direct import. Imports expose only the named public declaration, do not re-export, do not leak transitive imports, and cannot shadow another visible name.

C0-MOD-003 — Acyclic graph. The direct module graph is acyclic. Resolution is independent of filesystem enumeration order. A cycle diagnostic reports the complete canonical cycle.

C0-MOD-004 — Local collection. Top-level declarations in one module are collected before bodies resolve, permitting local forward references. No module-level mutable state or top-level execution exists in Core-0.

Package manifest

C0-PKG-001 — Explicit package. A package manifest selects exactly one edition, implementation profile, numeric preset, authority root, generated release root, module graph, entry point, and acceptance policy. The source grammar does not infer those values.

The generator object pins backend, model, output_schema, protocol, reasoning, and recipe independently of promotion policy. All are required bounded strings; generation compares them byte-for-byte with the validated transport and local generation-adapter contracts before invoking a package provider.

C0-PKG-002 — Canonical manifest. zerglang.package/1 is canonicalized as RFC 8785 JSON before hashing. Arrays retain order only where the schema says order is semantic; module and dependency collections are canonicalized by module identity. Unknown required schema versions fail closed.

C0-PKG-003 — Exact graph. Every manifest module has exactly one existing .zl.md, at most one .zli.md, a declared visibility, and an exact set of direct module dependencies. Imports and declared dependencies must agree in both directions.

English and generated authority

C0-AUTH-001 — Implementation authority. Every module has exactly one human- or authorized-agent-written .zl.md. It governs implementation intent, invariants, algorithms, safety expectations, and non-public behavior. It is never derived from current generated code.

C0-AUTH-002 — Public authority. A public module has exactly one .zli.md in the self-host package. Core-0 generally permits it to be absent, but when present it governs observable public intent wherever it and .zl.md overlap.

C0-AUTH-003 — No prose bypass. English authority cannot weaken edition syntax, types, ownership, effects, contracts, capabilities, or safety. Alignment with prose is an explicit evidence obligation rather than a claim made by the parser.

C0-AUTH-004 — Bounded generation context. A module generation request contains only its .zl.md, its .zli.md when present, cited normative clause bodies, direct dependency .zli files in canonical order, named tests, the active profile, and a versioned recipe. The whole repository or design archive is not implicit authority.

For a selfhost-0 package request, the active profile is not a name alone. The request additionally carries separate length-delimited records containing the exact UTF-8 bytes and domain-separated SHA-256 identities of core-0.ebnf, selfhost-0.md, selfhost-intrinsics-v1.md, schema-1.9-semantic-identities-v1.json, and the intrinsic catalog lock. The exact repository-relative identities are spec/editions/core-0/core-0.ebnf, spec/bootstrap/selfhost-0.md, spec/bootstrap/selfhost-intrinsics-v1.md, and spec/bootstrap/schema-1.9-semantic-identities-v1.json, and spec/bootstrap/selfhost-intrinsics-v1.lock. A summary, path without bytes, unverified digest, or ambient repository access cannot substitute for any record.

The request and returned attestation bind all five content identities and the catalog ID zerglang.selfhost-intrinsics/1. The current generation adapter does not yet supply this complete grammar/profile/catalog closure, so it cannot generate or promote a schema-1.9 selfhost byte-kernel candidate. This target does not weaken the narrower implemented generation transaction.

Generated interfaces

C0-IFACE-001 — Derived contract. The generator proposes both .zl and .zli; the parent compiler independently emits canonical .zli from checked .zl. Promotion requires byte equality between the proposed and emitted interfaces.

C0-IFACE-002 — Public contents. A .zli includes every public declaration, signature, receiver, domain, openness, generic requirement, effect, contract, numeric dependency, and complete public enum/error schema. It excludes bodies, private/module state, and executable initialization. For the bounded schema-1.8 value substrate it includes the complete public field record and public initializer signature, including exact result and effects, but excludes the initializer body and all initializer-local ownership/cleanup records. For a schema-1.9 declaration it includes every public field and variant, receiver kind, catalog type instance, effect set, contract, rich carrier schema, and transient-loan restriction. It never contains a runtime-context ID, opaque handle, allocator token, loan interval, private storage field, or function-local cleanup edge.

C0-IFACE-003 — Dependency identity. A consumer binds a dependency’s canonical interface identity to its checked semantic identity. A stale, noncanonical, or mismatched pair is rejected before checking dependents.

C0-IFACE-004 — No manual machine authority. Manual edits to generated .zl or .zli do not acquire authority. A behavior change starts in English authority and public tests, then passes the generation and promotion gate.

Projected fromspec/editions/core-0/modules-packages-and-authority.md