Engineering Compiler

The Package Integrity Check verifies that each submitted or resolved package is identifiable, internally complete, structurally consistent, and unaltered relative to its declared publication state.

The check shall examine, as applicable:

package manifest;

package identity and version;

publisher identity;

file and object inventory;

content hashes;

digital signatures;

certificate status;

dependency declarations;

schema declarations;

permitted extensions;

archive structure;

duplicate or unexpected content;

path and reference safety;

declared licensing and usage restrictions.

Every manifest entry shall correspond to the correct packaged object. Missing, substituted, duplicated, corrupted, or unlisted safety-significant objects shall cause the affected package to fail integrity verification.

The compiler shall protect against malicious or unsafe package structures, including path traversal, hidden executable content, conflicting filenames, decompression abuse, circular package references, and unauthorized plugin inclusion.

A package signature confirms a relationship between packaged content and a signing identity. It does not establish engineering correctness, regulatory acceptance, compatibility, or fitness for the requested target.

Unsigned or partially verified packages may be permitted for research, conceptual work, or controlled development where policy allows. Their trust limitations shall remain visible, and they shall not enter higher-assurance outputs without the required verification.

The compiler shall not silently repair a failed package by replacing objects from another version or source.

The Package Integrity Check shall produce an integrity record identifying verified objects, failed checks, accepted exceptions, trust status, and restrictions imposed upon downstream compilation.