What is in the language

One construct

• The locus

  One construct where other languages have class, module, package, actor and service. An app, a cache, a handler and a library are all loci. Composition is a locus inside a locus.

• Lifecycle

  birth, run and dissolve; params { } with defaults; parent and child nesting with deterministic cleanup on dissolve.

• Perspectives

  Live hot code swap at the cost of a pointer flip. reperspective carries state across and re-points bus edges without dropping messages.

• Modes

  bulk, harmonic and resolution projections over capacity slots, for programs that reshape under load.

The typed bus

• Topics are declarations

  topic T { payload: P; } with wire subjects, routing keys (keyed_by), and per-topic bounds with an explicit backpressure contract (or wait).

• Traffic is declared

  Peer loci do not reference one another. They communicate through a declared topic, and messages are copies. Subscription and publish are declared surface, so the compiler sees the whole message graph.

• Topology checked at compile time

  hale check rejects payload mismatches and unconditional re-entry inside a locus. It reports orphaned topics, cross-locus cycles and statically unbounded backpressure as advisories. hale verify turns every advisory into a failing gate, so a project chooses its own strictness and the two kinds of finding stay distinct.

Types and data

• Structural interfaces

  An interface is satisfied by shape. There is no impl I for L.

• Synthesized forms

  @form(vec | hashmap | ring_buffer | lru_cache) generates type-specialized collections; bounded[T; N] gives fixed capacity. No generics on the everyday path.

• Element chains

  xs.filter(it > 2).count() compiles to one loop, allocation-free, with no closure or iterator object.

• Money and time as types

  Decimal, typed timestamps and durations. Inference for let, returns and locus params. f-strings.

• Units, quantities, identities, ranges

  A program declares units and the equations between them (unit USD = 100 cent;), then integer types counted in them: a quantity such as Money, a point such as Price, a distinct Int that never mixes with another, and an Int { range: 0..256; }. Every conversion is one exact factor; widening is free and narrowing names its rounding. The standard library's time units are declared the same way. New in 0.23.

Failure

• fallible(E) in the type

  Every call that can fail is addressed at the call site with a disposition: or default, or raise, or wait and the rest. No exceptions, no panic.

• Failure travels up

  A child's failure goes to its parent, which owns recovery. There is no sideways error channel.

• closure assertions

  Declared invariants, audited by the runtime at phase boundaries.

Effects, claims, constitutions, fleets

• Effect certificates

  Ten effect classes (syscall, block, time, entropy, alloc and five more). Opt-in assertions such as @no_block, @deterministic and @effects(only: …) are proven transitively over the whole call graph, with numeric budgets (@budget) and per-phase contracts (@phase_effects). Incompleteness fails closed.

• Claims

  Named sentences over the assembled program graph, declared in main, checked as errors, no runtime cost: forbid reaches, only edges, require, cover, count, bound, interposition with avoiding, lifecycle slices with during. A violation returns a minimal countermodel in your own names.

• Constitutions

  One claimset adopted by many entry points, composed by union only, bound per deployment target in hale.toml, and proven pairwise by hale check --matrix.

• Fleets

  Per-application topology artifacts compose into one deployment model. Cross-binary claims get cross-binary witnesses. Only an explicit route creates an edge. Signing and binary attestation carry the certificate to the machine that deploys it.

• The topology artifact

  Byte-reproducible JSON with source maps, an integrity digest and every claim verdict. Commit it, and diff the architecture in review along with the text.

Memory and runtime

• Arena per locus

  No garbage collector, no borrow checker, no lifetime annotations. Memory is freed deterministically when a locus dissolves.

• Model-checked synchronization modeled

  Hand-transcribed models of the runtime's concurrent protocols (the lock-free bus, mailboxes, rings, arenas) are explored with GenMC in CI. The models check the synchronization logic across permitted interleavings. Their match to the production runtime is maintained by hand and is part of the trusted base. What that does and does not establish.

• Static dispatch by default

  Devirtualized bus delivery and calls. Cooperative pools with epoll-backed parking. Pinned threads and replicas = K fan-out declared in main. NUMA-aware arena placement and cache-domain pinning linux.

Deployment

• Same source, many shapes

  placement { } and bindings { } in main decide threads, cores and transports. A test, one binary or a mesh of binaries is an edit to one block.

• Transports

  In-process queues, Unix sockets, zero-copy shared-memory rings, and broker adapters written as ordinary loci. Pluggable codecs.

Exposure next release

• API surfaces

  api NAME { rpc Locus::fn requires: [role]; }, or @rpc on the handler. The compiler checks the rows, folds each surface into a contract digest, and prints the description a caller may see. hale check --api prints the inventory, and --openapi, --json-schema and --mcp print a surface's client forms.

• Roles

  Declared vocabulary: role manager includes clerk;. A requirement is written once on the row; who holds a role is a source the serve site names, std::api::StaticRoles or any locus satisfying std::api::RoleSource.

• Serving

  api::serve(Surface, transport, as:, receivers:, bound:, on_full:) over unix::Rpc, http::Rpc or mcp::Rpc; a stream is a topic bound to a ws::Hub. A handler may take ctx: std::api::Context for the caller, the request id and the door it came through.

• Clients

  hale describe, call, watch, admin and mcp --app read an exposure's description and speak the contract's wire. The DNA head serves its commands the same way.

Interop

• C

  @ffi("c") bindings with [ffi] csrc compilation, in both directions across the boundary.

• WebAssembly

  A wasm32 target with @export loci and @ffi("js"). The playground runs the result in the browser.

• Packages

  hale fetch vendors pinned git dependencies. pond is the contributed library collection.

Standard library

• Path-called, no imports

  Processes, env, filesystem, TCP and UDP with zero-copy readers, TLS, HTTP (router and client), JSON including a streaming builder, metrics, logging with sinks, compression, tar, crypto and hashing, encodings, randomness, strings, regex, sets, time. hale doc --stdlib publishes each function's effect classes from the same registry the checker proves against.

Toolchain

• One binary

  build, run, check, verify, test, bench, fmt, doc, fetch and fleet, with the language server and the MCP server compiled in, so an editor, a CI job and a coding assistant read the same diagnostic. The toolchain in full.

Platforms

Three different questions, easy to run together: where a prebuilt compiler exists, where one can be built, and what a build can emit.

• Prebuilt compiler

  Linux x86-64, Linux ARM64 and macOS on Apple Silicon, on GitHub Releases, selected automatically by the install script.

• Builds from source

  The above, plus Intel macOS. Needs the LLVM 18 development libraries and clang.

• Emits

  Native binaries for Linux and macOS, and wasm32 objects for the browser. x86_64-pc-windows-msvc is named by hale --list-targets and refused with a precise error before any link step reserved.

Reserved

• Surface awaiting a workload

  async and await keywords, traits with explicit impls, macros, richer form shapes. The runtime frontier is cost: a cheaper call protocol and spawn path. The spec stays the arbiter of what ships.

• To move a priority

  The fastest signal is a real program that needs it. See community.