Module identity, imports, interfaces, and generation authority.
Core-0 Modules, Packages, and Authority
Status: normative
Modules and imports
C0-MOD-001 — Module identity. A module’s dotted identity is derived from
the relative path of its .zl.md beneath the package authority root. The
generated .zl declaration must equal that identity. Paths are UTF-8,
workspace-relative, /-separated, and cannot contain an empty, . or ..
component or escape through a symlink.
C0-MOD-002 — Direct imports. Each external declaration used by source is named by one direct import. Imports expose only the named public declaration, do not re-export, do not leak transitive imports, and cannot shadow another visible name.
C0-MOD-003 — Acyclic graph. The direct module graph is acyclic. Resolution is independent of filesystem enumeration order. A cycle diagnostic reports the complete canonical cycle.
C0-MOD-004 — Local collection. Top-level declarations in one module are collected before bodies resolve, permitting local forward references. No module-level mutable state or top-level execution exists in Core-0.
Package manifest
C0-PKG-001 — Explicit package. A package manifest selects exactly one edition, implementation profile, numeric preset, authority root, generated release root, module graph, entry point, and acceptance policy. The source grammar does not infer those values.
The generator object pins backend, model, output_schema, protocol,
reasoning, and recipe independently of promotion policy. All are required
bounded strings; generation compares them byte-for-byte with the validated
transport and local generation-adapter contracts before invoking a package
provider.
C0-PKG-002 — Canonical manifest. zerglang.package/1 is canonicalized as
RFC 8785 JSON before hashing. Arrays retain order only where the schema says
order is semantic; module and dependency collections are canonicalized by
module identity.
Unknown required schema versions fail closed.
C0-PKG-003 — Exact graph. Every manifest module has exactly one existing
.zl.md, at most one .zli.md, a declared visibility, and an exact set of
direct module dependencies. Imports and declared dependencies must agree in
both directions.
English and generated authority
C0-AUTH-001 — Implementation authority. Every module has exactly one
human- or authorized-agent-written .zl.md. It governs implementation intent,
invariants, algorithms, safety expectations, and non-public behavior. It is
never derived from current generated code.
C0-AUTH-002 — Public authority. A public module has exactly one .zli.md
in the self-host package. Core-0 generally permits it to be absent, but when
present it governs observable public intent wherever it and .zl.md overlap.
C0-AUTH-003 — No prose bypass. English authority cannot weaken edition syntax, types, ownership, effects, contracts, capabilities, or safety. Alignment with prose is an explicit evidence obligation rather than a claim made by the parser.
C0-AUTH-004 — Bounded generation context. A module generation request
contains only its .zl.md, its .zli.md when present, cited normative clause
bodies, direct dependency .zli files in canonical order, named tests, the
active profile, and a versioned recipe. The whole repository or design archive
is not implicit authority.
For a selfhost-0 package request, the active profile is not a name alone. The
request additionally carries separate length-delimited records containing the
exact UTF-8 bytes and domain-separated SHA-256 identities of
core-0.ebnf, selfhost-0.md, selfhost-intrinsics-v1.md,
schema-1.9-semantic-identities-v1.json, and the intrinsic catalog lock. The exact repository-relative identities are
spec/editions/core-0/core-0.ebnf, spec/bootstrap/selfhost-0.md,
spec/bootstrap/selfhost-intrinsics-v1.md, and
spec/bootstrap/schema-1.9-semantic-identities-v1.json, and
spec/bootstrap/selfhost-intrinsics-v1.lock. A summary, path without bytes,
unverified digest, or ambient repository access cannot substitute for any
record.
The request and returned attestation bind all five content identities and the
catalog ID zerglang.selfhost-intrinsics/1. The current generation adapter does not yet supply this complete grammar/profile/catalog closure, so it cannot
generate or promote a schema-1.9 selfhost byte-kernel candidate. This target
does not weaken the narrower implemented generation transaction.
Generated interfaces
C0-IFACE-001 — Derived contract. The generator proposes both .zl and
.zli; the parent compiler independently emits canonical .zli from checked
.zl. Promotion requires byte equality between the proposed and emitted
interfaces.
C0-IFACE-002 — Public contents. A .zli includes every public declaration,
signature, receiver, domain, openness, generic requirement, effect, contract,
numeric dependency, and complete public enum/error schema. It excludes bodies,
private/module state, and executable initialization. For the bounded
schema-1.8 value substrate it includes the complete public field record and
public initializer signature, including exact result and effects, but excludes
the initializer body and all initializer-local ownership/cleanup records.
For a schema-1.9 declaration it includes every public field and variant,
receiver kind, catalog type instance, effect set, contract, rich carrier
schema, and transient-loan restriction. It never contains a runtime-context
ID, opaque handle, allocator token, loan interval, private storage field, or
function-local cleanup edge.
C0-IFACE-003 — Dependency identity. A consumer binds a dependency’s canonical interface identity to its checked semantic identity. A stale, noncanonical, or mismatched pair is rejected before checking dependents.
C0-IFACE-004 — No manual machine authority. Manual edits to generated
.zl or .zli do not acquire authority. A behavior change starts in English
authority and public tests, then passes the generation and promotion gate.