Package Management

The MIND package manager design is specified in mind-spec with modern dependency resolution, supply chain security, and compliance features. A runtime implementation ships in the commercial mind-runtime; the open-source toolchain does not include one yet. The interfaces and workflows described here reflect the specification and are subject to change.

Architecture

┌───────────────────────────────────────────────────────────┐
│                    Package Manager CLI                    │
├─────────────────────────────┬─────────────────────────────┤
│       Manifest Parser       │       Lockfile Manager      │
├─────────────────────────────┼─────────────────────────────┤
│       PubGrub Resolver      │  Content-Addressed Storage  │
├─────────────────────────────┼─────────────────────────────┤
│       Sparse Registry       │      Workspace Manager      │
├─────────────────────────────┴─────────────────────────────┤
│            Security: Audit | SBOM | Provenance            │
└───────────────────────────────────────────────────────────┘

Specified Features

PubGrub CDCL Resolver

Modern satisfiability-based dependency resolution using the PubGrub algorithm (same as Cargo and pub). Features:

Content-Addressed Storage

All packages are stored by SHA-256 content hash, enabling:

Lockfile Integrity

# mind.lock
[metadata]
version = "1"
generated = "2026-01-20T21:45:00Z"

[[package]]
name = "tensor-utils"
version = "2.1.0"
source = "registry+https://packages.mindlang.dev"
integrity = "sha256-a1b2c3d4e5f6..."
dependencies = ["core@1.0", "math@2.0"]

Security & Compliance

Security Audit (OSV)

Integrated vulnerability scanning using the Open Source Vulnerabilities database:

use mind_runtime::package::{SecurityAuditor, AuditConfig};

let auditor = SecurityAuditor::new(AuditConfig::default());
let report = auditor.audit(&lockfile.packages)?;

for advisory in report.advisories {
    println!("{}: {} ({})",
        advisory.id,
        advisory.summary,
        advisory.severity
    );
}

SLSA Provenance

Supply chain attestations following the SLSA framework (specification; signing reuses the RFC 0016 post-quantum evidence-chain profile, ML-DSA-87 + SLH-DSA-SHAKE-256s, not Ed25519):

SBOM Generation

Software Bill of Materials in industry-standard formats:

use mind_runtime::package::{SbomGenerator, SbomConfig, SbomFormat};

let generator = SbomGenerator::new(SbomConfig {
    format: SbomFormat::CycloneDx,  // or SbomFormat::Spdx
    include_dev_deps: false,
    ..Default::default()
});

let sbom = generator.generate(&lockfile)?;
sbom.save("sbom.json")?;

Supports SPDX 3.0 and CycloneDX 1.5 formats for regulatory compliance.

Policy Enforcement

Configurable security gates with three policy levels:

Workspace Support

Monorepo management with shared dependencies and workspace inheritance:

# mind.toml (workspace root)
[workspace]
members = ["packages/*", "apps/*"]

[workspace.dependencies]
core = "1.0"
tensor = { version = "2.0", features = ["gpu"] }

# packages/my-lib/mind.toml
[package]
name = "my-lib"

[dependencies]
core.workspace = true  # inherits from workspace

Sparse Registry Protocol

HTTP-based package index with efficient caching:

Learn More

See the Package Management Specification for the full technical details, and the Roadmap for the feature status. Enterprise customers can access the runtime implementation via Enterprise license.