Its included in the complete grammar, otherwise it can't be tested.
Note that that the PEP body refers to the IETF document for the
definition of URIs. e.g. exactly what you suggest.

doesn't this imply any possible URI can theoretically be a PEP440 direct reference URI ?

Is that true?

It's unclear to me what PEP440's definition really is with words like "The exact URLs and targets supported will be tool dependent"

Will "direct references" ever be well-defined? or open to whatever any tool decides can be an artifact reference?