SCUA is getting a package manager, and this week the decisions got made and the first working core got built. The design has strong opinions, so it deserves an early post.
It is a separate binary, scua-pkg, with its own
repository and release stream. The scua toolchain stays
package-manager aware, scua add dispatches to
scua-pkg on your PATH the way git subcommands do, but
running a script never requires the tool, and all fetch, TLS, and
registry code lives outside the runtime. A build of scua
with zero network code stays a supported configuration.
The rules we consider load-bearing, and enforce rather than document: no code ever runs at install or resolve time, no install scripts, no executable manifests. A package's identity is a content hash anyone can recompute from the canonical bytes, so mirrors are trustless and the store checks itself. Version selection is minimal-version selection, the maximum of everyone's minimums, so a resolve is boring and reproducible instead of a solver adventure. And the registry protocol is a static file layout: a directory, a network share, a bucket, or a CDN is a registry, with no instance for anyone to operate.
If half of those sound like reactions to the last decade of supply-chain incidents in other ecosystems, that is what they are. SCUA's audience includes AI agents that write and run code unattended, and a package manager for that world has to be paranoid by construction, not by policy.
The offline core already works end to end: add, vendor, lock, verify, run. What remains is the longer road of every verb, the trust machinery, and a public registry, and we will post again when there is something to show.