Status: tooling experimental Target line: N/M 0.2 Last updated: 2026-07-13

Problem

N/M 0.1 accepts both use std.bell; and use std.bell@0.1;. The first form resolves the current non-deprecated registry entry and is convenient for lessons, but it cannot be a reproducible package dependency. Direct registry identifiers can also become ambiguous as workspace and package namespaces grow.

Canonical proposal

module exact_consumer;

use package.std.bell@0.1;
use package.ml.vqc_layer@0.1;
use workspace.local_helpers;

package. selects the package registry and requires an exact version.
workspace. selects a module pinned by the workspace manifest and therefore forbids a source @version.
Existing exact syntax such as use std.bell@0.1; remains accepted during the experimental transition, but the AST records it as legacy-registry rather than canonical package syntax.
With experimental.exactImports=true, any unversioned registry import is rejected.

Compatibility

The stable 0.1 parser default remains unchanged. package. syntax produces NM-PARSE-053 unless the experimental flag is enabled. Existing unversioned lesson source keeps running without the flag. Enabling the flag is an explicit reproducibility check and may reject that source with NM-PARSE-054.

AST contract

The parser records direct imports with namespace, id, exact version where applicable, source spelling, exactness, and line. This slice reuses the current curated resolver after removing the experimental package. carrier; it does not implement a general dependency solver. CLI parse/execution/export commands negotiate with --experimental-exact-imports. Language Server and VS Code use initializationOptions.nm.experimental.exactImports=true; all defaults remain disabled.

nm-lock.json is a separate strict 0.1 artifact rather than a breaking workspace-manifest field. It records sorted exact package identities and their registry source digests, then protects the complete lock with canonical FNV-1a integrity. Source/lock validation reports missing and stale entries and registry digest drift. FNV integrity is tamper evidence, not publisher authentication.

Non-goals

SemVer ranges, network resolution, transitive solving, aliases, re-exports, multiple versions of one package, or runtime loading.
Changing workspace manifest resolution or allowing workspace.name@version.
Promoting unsigned or unlicensed registry artifacts.

Promotion sequence

Parser flag and AST evidence, strict lock semantic validation, CLI create/check, and explicitly negotiated LSP diagnostics/symbols are implemented. Remaining promotion work is cross-platform performance/conformance, signed-registry publication evidence, and 0.2 preview evaluation.

The G6 ratchet reads, canonicalizes, serializes, and rereads a 100-package strict lock whose JSON carrier is at least 180,000 bytes, then creates a real two-package lock from canonical source. Five packed-Core samples must remain within the versioned p95/RSS budgets and produce byte-identical serialization. CI runs this check on Windows and Linux with Node 20 and 22; local success does not close the remote gate.