Safe code. Built for machine speed.

Build broadly, constrain later

A general-purpose program starts with ambient semantics. Sandboxes, IAM, containers, policy, and signing are added around it to recover the intended boundary.

Grant narrowly, then compile

Effects and capabilities are part of the admitted computation. If the target cannot prove and bind the grant, it does not emit or run the artifact.

Code as readable data

Immutable values, ordinary functions, explicit data, and a composable syntax are easy for humans and models to produce and inspect.

Say what may happen

Effects, capabilities, resources, dependencies, and targets are visible inputs to admission—not surprises discovered after deployment.

Less language, harder boundary

No ambient interop, runtime code loading, unrestricted mutation, guest-defined macros, or unbounded concurrency in the admitted component surface.

Declarative intent

A small, Clojure-shaped surface keeps programs readable and excludes ambient escape hatches.

Checked KIR

Types and transitive effects become a target-independent, inspectable representation.

Intersect authority

Requested, delegated, local-policy, resource, and target grants can only narrow.

Address the artifact

Code, dependencies, policy, compiler contract, and target ABI bind the computation's identity.

Bind at the host

The runtime and provider bind only admitted capabilities, enforce finite budgets, and emit receipts.

What code?

The CID selects a hash-verified checked-KIR definition and its CID-only dependency closure.

May it run here?

The exact interface, complete effect row, current allowance, fuel, and decreasing eval depth are bound before execution.

What came back?

The typed result is persisted as content-addressed evidence. Its hash cannot retroactively authorize an effect.

Build faster. Run faster. Keep the boundary.

Kotoba publishes compiler-startup, developer-loop, native-runtime, and workload-domain measurements with exact-result checks. Current speed ranks remain withheld until their quiet-host gates pass; security admission is never removed to win a timing.

Storage without a language ceiling.

Kotobase uses content identity, range reads, immutable history, and provider-neutral storage. Physical capacity, tenancy, retention, cost, replication, and execution budgets remain explicit; this is not an infinite-disk claim.

Post-quantum cryptography by default.

Every new Kotoba cryptographic boundary must name ML-KEM or ML-DSA evidence and reject a classical-only downgrade. Existing Passkeys, transport, implementations, and key custody remain separately qualified boundaries.

Authentication present. Authority denied by default.

Passkey identity belongs at the control boundary. A verified identity still receives no filesystem, network, storage, model, secret, payment, or GPU authority until an explicit scoped grant survives local policy and host checks.

Flexible delegation that can only narrow.

Requested, delegated, local-policy, resource, and target scopes intersect. Delegation can be composed and attenuated, but cannot mint ambient authority or widen its issuer's grant.

Web3 ready, chain-neutral at the root.

A stable Kotoba Principal and Passkey controller are primary. CAIP-10 accounts, ERC-1271, and ERC-6492 are explicit linked-account proofs; a wallet address never silently becomes storage or execution authority.

Zero-copy where ownership permits; one copy where a boundary requires it.

Columnar byte views retain vector, direct ByteBuffer, and Uint8Array backing. Arrow projection can keep uncompressed buffers columnar through the authorized Kotobase lake path. Network ingress, decompression, GPU upload, and immutable persistent updates remain named copy boundaries.

Arrow-shaped data. Explicit CPU SIMD and device-native GPU kernels.

On Apple M4, an uncompressed, non-nullable Arrow float32 column retained one WebAssembly linear-memory backing while Num executed an explicit v128 f32x4 kernel over its borrowed values slice with zero Arrow-to-SIMD copies; a scalar tail covered the remaining rows. In three qualified runs of the same 262,147-element scale workload and artifact, that SIMD kernel completed 3.66-3.72x faster than scalar Wasm. This is a kernel-and-host result, not a general runtime claim. The same bounded column path also retains one ArrayBuffer through its CPU views, crosses the GPU ownership boundary with one measured WebGPU upload, executes on Metal, and returns one four-byte scalar. Nullable columns, other Arrow dtypes, unified-memory upload removal, broader kernels, and universal CPU/GPU qualification remain pending.

AI first. Agent-safe by default.

Kotoba is designed for programs written or operated by AI agents and bots. The stronger the model, the more important explicit effects, finite resources, capability confinement, receipts, and host enforcement become.

AGI-ready boundaries, not an AGI claim.

The architecture is intended to keep authority explicit as models become more capable. Kotoba does not claim that AGI exists here, that generated programs are trustworthy, or that confinement removes the compiler, runtime, provider, key-custody, and OS trusted computing base.

33 cores

Internal production dogfooding

The wider Kotoba stack runs 33 inference cores internally. This proves the team operates its own stack; it is not customer traction, paid adoption, or revenue.

8 claims

Boundaries are machine-readable

Safety claims name their trusted computing base, negative evidence, and residual risk instead of collapsing into an 'unhackable' slogan.

deny by default

No grant, no host effect

An empty policy grants no filesystem, network, process, clock, model, or secret authority. Providers must also validate concrete resource scope.

4 toolchains, 21 runs each

Kotoba 40.998 ms · Rust 126.422 ms · C 146.324 ms · JVM 961.248 ms median.

21 rotating process-cold samples · load1 30.79 → 39.79 · required ≤ 1 · 2026-08-29 · Apple M4

6 workloads × 5 comparators

Amu native is exercised against Rust, Clang / C11, Zig, Go c-shared, Swift through one common native call boundary.

30/30 comparator/workload pairs · exact answers verified

19 of 30 pairs

Amu native wins 19 of the 30 comparator/workload pairs by at least 5%, separated from the arms' own spread. The bounded fastest claim needs every pair, so it stays unqualified — the count is the informative half.

At least 2 of those pairs cannot be won at all. On narrow-arithmetic, amu, Apple clang -O3 and rustc -O3 compile the kernel to the same 61-instruction sequence — clang and rustc byte-identical, amu differing only in register numbers. A 5% margin over identical code does not exist, so the bounded claim is unattainable rather than merely unmet.

Median of 5 host-qualified runs; the score ranged 19–20 and 19 of the 30 pairs qualified in every one. A single noisy sample can disqualify several pairs at once, so a one-run score is not precise to one pair.

busy-CPU 0.090 → 0.069 → 0.076 · required ≤ 0.10 · 2026-09-07

11 toolchain paths

Dependency resolution, checking, clean and no-change builds, and process-cold first result are recorded separately.

7 samples per measured stage · load1 20.84 → 24.49 · required ≤ 1

8 source sizes

The same program from one function to 2048, built by every toolchain on the host and then executed. The released binary has the lowest cold-start cost here and a correctness ceiling above 128 functions.

artifacts checked after the clock stops · load1 2.73 → 2.73 · required ≤ 1 · 2026-08-31

6 domains × 6 runtime paths

Strings, collections, allocation, file I/O, four-worker concurrency, and a request-admission policy application kernel are correctness checked.

7 samples in both process-cold and amortized lanes · load1 13.87 → 12.38 · rank withheld

Narrow arithmetic

Wide register pressure

Deep spill pressure

Call preservation

Branch + call control flow

Loop call back edge

String

Collection

Allocation

I/O

Concurrency

Real application

Admitted components cannot address runtime/native memory and component memory operations are bounded or trap.

Trusted computing base

bounded reader · frontend admission · artifact verifier · Wasm/native runtime

Residual risk

• runtime-engine vulnerabilities remain in the TCB
• native loaders require a second OS isolation boundary

Every transitive component effect is declared and admitted before emission, including effects used by Kotoba-written providers.

Trusted computing base

effect inference · capability catalog · frontend call graph

Residual risk

• kotoba and compiler grammar/effect parity must be continuously compared

An ungranted capability is absent or unbound and cannot reach a provider or native handler.

Trusted computing base

policy intersection · compiler import emission · tender import binding · host guard

Residual risk

• provider and native implementations must independently validate resource scope
• production effective grants must forbid wildcard scope

The same admitted source, target, policy and lock produce the same observable pure result and artifact bytes.

Trusted computing base

canonical reader · deterministic lowering · pinned toolchain

Residual risk

• host effects are deterministic only where their capability contract says so

Source, admission, execution, memory and output use explicit finite bounds.

Trusted computing base

admission limits · fuel meter · runtime quota · supervisor timeout

Residual risk

• platform supervisors do not yet have equal production isolation evidence

Release admission binds artifact identity, trusted signer, validity and reproducible evidence.

Trusted computing base

signature verifier · trusted signer configuration · clock · revocation set

Residual risk

• key custody and external revocation distribution remain operational TCB

A shared portable component has equal acceptance, result and effect trace across qualified backends.

Trusted computing base

shared conformance manifest · backend adapters · comparison runner

Residual risk

• compiler-only features are not portable and must be rejected by portable profiles

A component import reaches its provider or native handler only with a concrete post-intersection resource scope and emits a receipt.

Trusted computing base

capability intersection · host guard · provider handler · receipt sink

Residual risk

• provider-specific path, redirect, symlink and tenant checks require Q5 kits

Profile 6

package contract 1

v0.7.0

profile binding: verified

RELEASED

:docs/release-bound-profile

Install and self-check

brew tap kotoba-lang/kotoba
brew trust kotoba-lang/kotoba
brew install kotoba
kotoba selfhost check --json

Accept a valid response with an empty problem list.

A first program

(defn main []
  (+ 40 2))

This program requests no host imports; the emitted module has no imports.

Docs by intent

Start with installation, learn the admitted language, or inspect the normative semantics and conformance data.

One source, one answer

The example below is the exact source compiled into the browser demo—not a JavaScript reimplementation.

Execute in this page

Load a same-origin, digest-bound WebAssembly artifact and call its exported Kotoba main function.

Libraries and contracts

Browse bounded core names, foundational libraries, package rules, and their current maturity boundary.

;; W1 pure representative: ordinary Clojure-shaped values/functions only.
(ns examples.w1-pure)

(defn double [n]
  (+ n n))

(defn main []
  (double 21))

Highlighting authority: kotoba-lang/grammar → kotoba.grammar.highlight/tokenize → build-time HTML. Editor scope contract: source.kotoba. Browser highlighter dependency: none. Inspect dependencies

Compile locally: kotoba compile double-21.kotoba --target wasm32-browser --output double-21.wasm

Generated symbol reference

Search the names admitted by the current bounded standard-library contract.

Data, effects, I/O, tooling

Start with coll, spec, json, text, wit, async, time, fs, http, test, fmt, lint, and LSP contracts.

Content-addressed dependencies

Inspect exact dependency CIDs, identity layers, GitHub provenance, and the current publication boundary.

One versioned contract

Keep grammar, effects, checked KIR, target adapters, qualification, and first-run documentation aligned.

Close provider gaps

Expand typed request/result conformance, adversarial testing, receipts, revocation, and reproducible release operations.

Earn wider deployment

Widen production use after provider, host-isolation, rollback, and soak evidence—and grow inspectable declarative libraries.

Language issues

Ask a design question, propose a documentation improvement, or report a reproducible language-contract problem.

Compiler and CLI issues

Follow implementation work, releases, target support, and runtime integration in the installable implementation.

Report privately

Use the published security policy for vulnerabilities; do not disclose exploitable details in a public issue.

GitHub Sponsors

No sponsorship payment can be made through kotoba-lang.org while the GitHub profile is not live.

See sponsorship status and principles

Support is not authority

Sponsorship does not buy a feature, roadmap priority, support SLA, private access, or a security exception.

Evidence before slogans

Read short engineering notes that connect product claims to measurements, authority files, and remaining gates.

Controlled execution

Kotoba Cloud connects identity and deploy control to the execution environment. Discovery is live; hosted apply is not yet offered. Compute remains provided by separately governed services.

Trusted graph state

Kotobase is the content-addressed graph database for AI state and knowledge: explicit relationships, identifiable history, and scoped access.

Compute and inference plane

Fleet compute and model-serving infrastructure. Availability and route qualification remain service-specific.

Agent work plane

Continuing agent work across workspaces, goals, evidence, tools, approvals, and governed effects.

kotoba-lang/kotoba-lang

Grammar, semantics, capability contracts, safety claims, CLI contract, documentation, and conformance fixtures.

kotoba-lang/kotoba

CLI, host integrations, providers, runtime adapters, integration tests, and target-specific qualification evidence.

Learn, build, or evaluate

Separate paths for first use, language reference, backend implementation, security boundaries, and maturity evidence.