Security engineering
Kotoba fit support NIST CSF 2.0 program?
Evidence-led guide to capability boundaries, attack paths and the operating controls wey still dey needed around Kotoba.
Read the assessment and attack scenariosKotoba engineering notes
Evidence before slogans
Short notes about language design, measurements, shipped boundaries, and wetin still remain unqualified.
31 August 2026 · Benchmarks
A fifth benchmark, and di claim say e no go support
Di four benchmarks all build program wey small to fit one screen, wey measure how fast toolchain start instead of how long developer dey wait. Di new build-scaling suite generate di same program for eight sizes, build am through every toolchain for di host, then execute wetin each one produce.
Executing artifact na wetin make am benchmark no be stopwatch. The released Kotoba CLI dey emit invalid WebAssembly module wey get pass 128 functions and e exit successful, so unvalidated harness for record best numbers exactly where e stop to work. Two more Kotoba lanes stop for declared bounds — call-fuel budget and function-count admission limit — na opposite result and dem suppose report am like that.
Di suite add to show build speed as strength. E show di released binary wey get lowest cold-start build cost for any lane wey dem measure, and e show say for big sizes build speed no be Kotoba strength now. Both halves dey for di same table.
29 August 2026 · Benchmarks
Four benchmarks dey answer four different questions
Compiler startup dey measure one small source-to-artifact path. Di developer-loop suite separate resolution, checking, clean and no-change builds, and first result across eleven toolchain paths. Native runtime dey measure already-built programs. Di fourth suite dey compare strings, collections, allocation, I/O, concurrency, and small real application across six representative runtime paths. Kotoba dey publish dem separately so one fast phase no go fit be mistaken for universal speed.
Every emitted result dey checked, but all speed rankings still dey withheld because recorded host-load gates fail.
28 August 2026 · Language design
No ambient authority na language boundary
Kotoba programs no dey start wit implicit filesystem, network, process, clock, model, or secret access. Source dey declare effects, admission dey intersect grants and policy, and the host na only the resulting capabilities e bind.
Dat design dey complement operating-system isolation; e no replace di compiler, verifier, runtime, provider, key custody, or host policy for di trusted computing base.