Module packages 

packages.lock parsing, digest verification, and capability mapping.

A foundation package is a verified, immutable record. oxicode reads the lockfile, verifies each package’s on-disk content against the recorded digest, and decides (a) whether the package is eligible to load and (b) which of oxicode’s existing policy gates must approve the declared requirements.

Structs

LockedPackage

A single resolved package record.

PackagesFile

Typed packages.lock.

Enums

CapabilityDecision

Result of mapping a package requirement to oxicode’s policy.

Requirement

Abstract requirement declared by a foundation package. oxicode maps these to its existing policy in map_requirement.

Trust

Trust decision recorded in the lockfile. Anything other than verified is rejected at load time.

Functions

map_requirement

Map a parsed requirement to oxicode’s policy. The decision is read-only — it does not mutate state. The caller is responsible for translating Allow into the right port wiring.

read

Read and verify packages.lock. The on-disk content under packages_root is verified against the declared digests.