CONTENT-ADDRESSED LIBRARIES

Names help you find code. Hashes say what it is.

Kotoba CLI inspects and publishes the same CID graph it compiles. GitHub is provenance, a namespace is discovery, and immutable CIDs identify definitions, releases, builds, and artifacts.

Inspect with Kotoba CLI 日本語 Machine-readable contract Package registry (EDN)

One library, several identities

DEFINITION CID

Meaning or checked KIR

A name, full CID, and unambiguous #hash abbreviation resolve to the same definition.

RELEASE CID

Executable release root

One immutable IPLD root binds the namespace head, exact definitions, raw Wasm artifacts, compile receipts, and reproducibility evidence.

SOURCE · BUILD · ARTIFACT

Keep provenance layers separate

Source bytes, declared build inputs, and emitted bytes have different identities. None grants execution authority.

GITHUB

Provenance, not identity

Repository and commit links help review origin. They cannot replace CIDs or authorize a namespace update.

Inspect, sign, publish, discover

# install the live dual-signed release; execution is then local and CID-locked
kotoba package add kotoba-lang/reference-math@0.1.0 --catalog-cid bafkreidcy5stqvnyfpmud6ozz5qz3supd3r3uzk7glmntuv36ezliaxstm
kotoba package run kotoba-lang/reference-math  # 42

Post-quantum cryptography is the Kotoba admission floor, not an optional mode. This reference package is verified with Ed25519 and FIPS 204 ML-DSA-65 before installation and again before safe execution. External Passkeys and transport remain separately qualified boundaries.

kotoba library inspect quadruple \
  --store .kotoba/codebase --namespace demo \
  --github https://github.com/kotoba-lang/demo

# dry-run is the default
kotoba library publish \
  --store .kotoba/codebase --namespace demo --hosted

# replicate the exact release closure to two storage origins
kotoba library publish \
  --store .kotoba/codebase --namespace demo --hosted --dry-run false \
  --pqc-seed-file <ml-dsa-seed> \
  --provider east=https://east.example --provider-token-file <east-token> \
  --provider west=https://west.example --provider-token-file <west-token>

# verify every byte and two routed peer IDs, then run by release CID
kotoba library verify ipfs://<release-cid> --store .kotoba/codebase \
  --provider east=https://east.example --provider west=https://west.example
kotoba library run ipfs://<release-cid> --entry answer \
  --store .kotoba/codebase \
  --provider east=https://east.example --provider west=https://west.example

1 · INSPECT

Resolve the exact graph

Resolve the namespace head, definition CIDs, dependency CIDs, identity layer, and optional GitHub provenance before creating a release.

2 · AUTHORIZE

Sign the namespace head

The local operator key signs publication. Passkey confirms the Stable Principal, while ML-DSA-65 signs every publication field and is pinned to that Principal; none of the three gates replaces another.

3 · REPLICATE + VERIFY

Two stores, two peers, every byte

The CLI re-fetches the full DAG and raw artifacts from each storage origin, then counts distinct libp2p peer IDs observed through delegated routing.

4 · NAME + RUN

Approve a name; execute a hash

Passkey plus the pinned ML-DSA-65 key controls the mutable IPNS relay. This application-layer co-approval does not make the authenticator's Passkey post-quantum. Wasm execution addresses the immutable release CID and export.

Every public repository, filterable

The 2,215 public repositories in the kotoba-lang organisation, with the tag vocabulary the organisation's GitHub topics use. Filter by name, by description, or by any combination of tags.

Showing 2,215 of 2,215 repositories

Filtering runs in the browser and no query leaves it; with JavaScript off the complete list is still rendered above. 1,055 of these repositories carry a GitHub description, so a domain tag has that much evidence to work from — 255 match no domain rule and are shown untagged rather than assigned the nearest label. A repository list is discovery. It is not the package registry: exactly one library is published through the content-addressed registry described above, and a repository here is neither a released package nor an API-stability claim.

Tag vocabulary: site/library-taxonomy.edn. Repository snapshot: site/library-catalog.edn, fetched 2026-09-07.

Current boundary

LIVE

Executable release closure

The CLI builds and transfers one CID closure containing definitions, raw Wasm, compile receipts, compiler contract, policy, and package-lock evidence.

bafyreico7jriisjhv77xftmezhcpkrjbnacqk2jtrcly7vgxikkfgolr64

LIVE

Passkey-hosted publish

The CLI replicates the immutable closure and returns a fragment-only approval URL containing an ML-DSA-65 signature. kotoba.cloud requires the Passkey session and atomically pins the first valid ML-DSA key to the Stable Principal without receiving either signing seed or storage tokens.

STATUS

distributed release gated

A release remains pending until two byte-complete storage origins and two distinct routed peer IDs produce an availability-proof CID. One gateway never qualifies.

SOURCE

Review the implementation

Kotoba CLI

Language and catalog authority

Content-addressed codebase

Hosted Passkey publication: implemented. Content identity is never execution authority.

Compare libraries with the boundary attached

A comparison is evidence only when it names the exact library CID, workload, target, host, toolchain, sample count, measurement time, verified result, receipt, and residual limit.

Do not compare mutable latest aliases as if they were immutable releases.
Separate API coverage, target compatibility, compile performance, runtime performance, and operational qualification.
A faster isolated kernel is not a general production-performance claim.
Unsupported or unmeasured cells stay explicit; they are not silently scored as zero.