Link package manager design in spec

Author: olwang

RSScript_v0.5_Spec.md

@@ -2269,6 +2269,35 @@ Agent, GPU, HTTP, networking, and model-client packages are use-case libraries,
 
 ---
 
+## 29.4 Package Manager Design
+
+RSScript package management is specified separately from the core language syntax.
+
+The package-manager direction is defined in:
+
+```text
+RSScript_Package_Manager_Design.md
+```
+
+See [RSScript Package Manager Design](RSScript_Package_Manager_Design.md).
+
+That design is compatible with this v0.5 spec because it preserves the same implementation boundary:
+
+```text
+RSScript packages expose reviewable .rssi semantic contracts.
+RSScript source lowers to Rust through the compiler pipeline.
+Rust native wrappers are built by Cargo.
+Cargo remains the Rust build and crate dependency substrate.
+Package review metadata reports semantic risk instead of hiding it.
+Unknown package risk is classified as unknown, not safe.
+```
+
+Package features declared in `rsspkg.toml` are package selection features. They are not the same as RSScript file features declared with `features:` at the top of a `.rss` or `.rssi` file.
+
+If a package feature enables native code, unsafe code, build scripts, proc macros, linked libraries, or another advanced boundary, package review metadata must report that risk explicitly.
+
+---
+
 # 30. Native Core and FFI Boundary
 
 v0.5 supports controlled native core boundaries.

src/syntax/parser.rs

@@ -52,7 +52,11 @@ impl Parser<'_> {
                 if let Some(item) = self.parse_type_decl() {
                     items.push(Item::Type(item));
                 }
-            } else if self.at_ident("pub") || self.at_ident("async") || self.at_ident("fn") {
+            } else if self.at_ident("pub")
+                || self.at_ident("async")
+                || self.at_ident("native")
+                || self.at_ident("fn")
+            {
                 if let Some(item) = self.parse_function_decl() {
                     items.push(Item::Function(item));
                 }
@@ -158,13 +162,17 @@ impl Parser<'_> {
         let span = self.current()?.span.clone();
         let mut is_public = false;
         let mut is_async = false;
-        while self.at_ident("pub") || self.at_ident("async") {
+        let mut is_native = false;
+        while self.at_ident("pub") || self.at_ident("async") || self.at_ident("native") {
             if self.at_ident("pub") {
                 is_public = true;
             }
             if self.at_ident("async") {
                 is_async = true;
             }
+            if self.at_ident("native") {
+                is_native = true;
+            }
             self.index += 1;
         }
         if !self.at_ident("fn") {
@@ -204,6 +212,13 @@ impl Parser<'_> {
             effects = parse_effects(self.tokens, open + 1, close);
             self.index = close + 1;
         }
+        if is_native
+            && !effects
+                .iter()
+                .any(|effect| matches!(effect, EffectDecl::Name(name) if name == "native"))
+        {
+            effects.push(EffectDecl::Name("native".to_string()));
+        }
 
         let body = if self.at_symbol("{") {
             let open = self.index;
@@ -388,6 +403,7 @@ fn starts_top_level_item(tokens: &[Token], index: usize) -> bool {
         || token.is_ident_text("fn")
         || token.is_ident_text("pub")
         || token.is_ident_text("async")
+        || token.is_ident_text("native")
 }
 
 fn parse_params(tokens: &[Token], start: usize, end: usize) -> Vec<Param> {

tests/checker.rs

@@ -3,7 +3,7 @@ use std::path::{Path, PathBuf};
 use std::process::Command;
 use std::time::{SystemTime, UNIX_EPOCH};
 
-use rsscript::syntax::ast::Item;
+use rsscript::syntax::ast::{EffectDecl, Item};
 use rsscript::syntax::parse_source;
 use rsscript::{
     ReviewMapClassification, ReviewMapFileRisk, ReviewRisk, analyze_source,
@@ -1000,8 +1000,7 @@ fn copy(path: read Path) -> Result<Unit, FileError> {
 #[test]
 fn rust_lowering_maps_native_call_boundaries() {
     let source = r#"
-fn host_emit(message: read String) -> Unit
-    effects(native)
+native fn host_emit(message: read String) -> Unit
 
 pub fn run() -> Unit {
     host_emit(message: read "host")
@@ -1016,8 +1015,8 @@ pub fn run() -> Unit {
         .collect::<Vec<_>>();
 
     assert_eq!(native_calls.len(), 2);
+    assert!(native_calls.iter().any(|entry| entry.source.line == 5));
     assert!(native_calls.iter().any(|entry| entry.source.line == 6));
-    assert!(native_calls.iter().any(|entry| entry.source.line == 7));
 }
 
 #[test]
@@ -1605,6 +1604,29 @@ fn checksum(data: read Bytes) -> UInt64
     }));
 }
 
+#[test]
+fn review_reports_native_fn_as_native_boundary() {
+    let old_source = r#"
+fn host_emit(message: read String) -> Unit
+{
+    Log.write(message: read message)
+}
+"#;
+    let new_source = r#"
+native fn host_emit(message: read String) -> Unit
+"#;
+
+    let findings = review_sources("old.rss", old_source, "new.rss", new_source);
+    let unsafe_finding = findings
+        .iter()
+        .find(|finding| finding.code == "RSR012")
+        .expect("expected native boundary review finding");
+
+    assert_eq!(unsafe_finding.risk, ReviewRisk::Unsafe);
+    assert_eq!(unsafe_finding.before.as_deref(), Some("<none>"));
+    assert_eq!(unsafe_finding.after.as_deref(), Some("native"));
+}
+
 #[test]
 fn review_reports_removed_guarantees() {
     let old_source = r#"
@@ -1869,6 +1891,26 @@ async fn fetch(url: read Url) -> Result<fresh Bytes, NetworkError>
     assert!(analyze_source("net.rssi", source).is_empty());
 }
 
+#[test]
+fn parser_accepts_native_function_declaration() {
+    let source = r#"
+native fn Host.emit(message: read String) -> Unit
+"#;
+    let program = parse_source("host.rssi", source);
+
+    let Item::Function(function) = &program.items[0] else {
+        panic!("expected native function declaration");
+    };
+    assert_eq!(function.name, "Host.emit");
+    assert!(
+        function
+            .effects
+            .iter()
+            .any(|effect| matches!(effect, EffectDecl::Name(name) if name == "native"))
+    );
+    assert!(analyze_source("host.rssi", source).is_empty());
+}
+
 #[test]
 fn checker_rejects_unknown_file_features() {
     let source = r#"