The supply chain as a language problem

Chapter 3 argued that several properties of the incumbent package model made it a poor fit for machine authorship. This chapter states what we think replaces them. Most of it is not novel — the last decade produced the answers piecemeal, and a project starting now can adopt them without carrying the decisions that predate them.

Section 01Names resolve at build time, against a log

A dependency reference should be resolved when the program is checked, not when a package manager runs, and it should resolve against a transparency log that makes tampering detectable. One major ecosystem has run deterministic, solver-free resolution plus a checksum log at scale for years, to the point that not even a package's author can move a published version without the change being visible.^[16]

The consequence for the hallucination class is direct: an invented name has nothing to resolve to. It is a compile error — and, in the shape the diagnostic protocol requires, an error that names the nearest real alternatives, so the repair is mechanical rather than a search. The attack in Chapter 2 depends on an invented name silently becoming an installed package. Remove the silence and the attack has no channel.^[3]

Section 02The build executes nothing the package supplied

This is a one-way door in our design constraints, meaning it is a precommitment rather than a default: the toolchain never executes package-provided code during resolve, build, or check. No install scripts, no build hooks, no plugin that runs at dependency-graph time. Where compile-time computation is genuinely needed it happens in a sandbox with no access to the outside world.

The ecosystem has been converging on this the hard way — several major package managers now disable install scripts by default, and at least one major language never had them — which is a widely-shared admission that the original default was wrong.^[17] Our position is that a default is not enough. Anything configurable will be configured off by somebody under deadline pressure, and the self-replicating package worms of 2025–26 propagate through exactly this channel.^[7]

Two properties follow. The build has no network, so a compromised dependency has nowhere to send anything even if it could run. And the build is reproducible, so a third party can rebuild the artifact and compare — which is what turns "we believe this is what we shipped" into something checkable.

Section 03A package's permissions are a checked signature

The most consequential idea here is also the least visible. In the incumbent model, a dependency's authority is whatever the process has. Two serious attempts to constrain that after the fact both failed, and taught the same lesson from different directions: process-granular flags cannot express per-module trust, and runtime permission systems cannot be retrofitted onto a language that assumed ambient authority.

If authority is already an explicit value that code must be handed — Chapter 7 — then a package's authority requirements are simply part of its checked signature. What a dependency can reach becomes a static property the checker enforces and a reviewer can read, and a dependency that begins wanting network access is a visible change to a signature rather than a silent change in behaviour.

That is what we mean by calling the supply chain a language problem. The control is not a scanner looking at packages; it is the same mechanism the language already spends its departure budget on, pointed at a different question.

Section 04Versions computed rather than promised

Semantic versioning is broken at a measurable rate — roughly one release in thirty-one of the top thousand packages in one ecosystem study, with about one package in six having violated it at some point.^[16] For a human, that is an afternoon lost. For an agent regenerating a dependency graph, it is a behavioural change nobody attributed to anything.

There is a proven alternative: derive the version bump from a typed difference of the public interface, so the number is computed rather than chosen. One ecosystem has shipped this since 2014. It turns a promise into a theorem, and it costs nothing in unfamiliarity because the author never types it.

Section 05What we deliberately rent

Nothing in this chapter argues for building a package ecosystem from scratch. The registry model, the transparency log, the cooldown defaults, the provenance envelopes and the reproducible-build playbook are all rented from prior art that works, and named as such in our constraint set. Interoperating with the existing ecosystem is treated as a foreign, effectful region behind a validating boundary with an explicit authority envelope — not as a trusted extension of the language.

The build-versus-rent decision is made per layer, in writing, with a measurable trigger for changing our minds. Chapter 17 describes that discipline.

Section 06What this does not solve