Static copy

Copied from docs/en/decisions/adp-007.md in https://github.com/poppy-team/aipo-lang (MIT). Pinned to revision ce47c4e070404fc41722ccd8e2b7b808b99062a8, blob e8f20475b7cdc79f76c32eac0b68f1dd8d9df13d. The source repository remains canonical; this copy is refreshed through a sync pull request, not live.

ADP-007 — Package Identity & Distribution

• Status: Approved & Implemented
• Deciders: Poppy Team
• Phase: Wave 5 (P04)

---

Context

The language needed a modern dependency management system avoiding historical pitfalls found in package ecosystems like npm and PyPI: dependency confusion/typosquatting, non-deterministic dynamic downloads, and builds broken by network outages.

---

Decisions Taken

1. Unambiguous Coordinates:

   • Every package is declared under namespace.package.

2. GitHub Remote Dependencies Pinned by Commit SHA:

   • Floating tags and branch names (main, master, v1.x) are rejected in aipo.toml.
   • Manifests strictly require a 40-character hexadecimal commit SHA.

3. Cryptographic Verification with SHA-256 Hashes:

   • Every retrieved package has its contents verified against SHA-256 tree digests recorded in aipo.lock.

4. 100% Offline-First Operation:

   • Standard build and execution commands never access the network. Packages must be fetched into .aipo/cache.