63 points jordan_bonecut 2 hours ago 48 comments

jordan_bonecut 2 hours ago | parent

This language has been something I've wanted to build for years. For a while I thought I'd get my PhD and build it there. But now it's very possible to have Claude build it while I'm at work and give it intense code review every day. It's still not in a "useful" place yet, but I'm curious what fellow programmers think of a language like this. If I continue work is this something anyone thinks they'd enjoy using? Would love some feedback, thanks!

sblom 2 hours ago | parent

It's a really great concept. What guarantees are made by the prover?

Success in programming languages is not simply if-you-build-it-they-will-come. Bootstrapping a community that loves programming in it is the hard part. You'll either need a killer interop story with an already built ecosystem, or you'll need your own HTTP server, JSON parser, etc. etc. etc.

Best of luck! I'll watch this space.

jordan_bonecut 2 hours ago | parent

Thanks! The guarantee is that, without the use of trustme (which can prove any fact), you cannot address memory as the wrong type. The compiler also ensures that a pointer/reference to a value is live at compile time, so it’s not possible to create an invalid pointer (without the use of trustme). You can also claim any fact which the compiler must prove in order to continue compilation.

That is good advice, I’m definitely planning on including some batteries soon, once I’m very happy with where the compiler is at.

0c3ca83 1 hour ago | parent

It's so strange how much effort goes into producing a language that people don't even intend to write.

gchamonlive 1 hour ago | parent

What's strange is only seeing value in manually writing code when clearly AI is very useful to produce quality code here.

0c3ca83 47 minutes ago | parent

you can ask ai to write code in existing languages with large training sets, and it'll do better because of the large volume of training data.

if you're all-in on ai, you want to prioritize familiarity for agents.

gchamonlive 44 minutes ago | parent

The objective of this project isn't to make a language fit for AI to write but to make a "probably safe system language" regardless of who's doing the coding.

jeremyloy_wt 1 hour ago | parent

To me it’s about determinism and feedback. Agents will make mistakes but if they get clear feedback from the tools they use, they will produce a good result.

There are a shrinking number of reasons to geenfield projects with non-strict or unsafe languages now.

empath75 26 minutes ago | parent

This isn't so much directed at you, as other people that get inspired by this. I have been working on my own Rust like language with claude for a few months and there are a _lot_ of projects like that out there.

Mine has a formally proven borrow checker built on linear types, along with algebraic effects, with an LLVM compiler written in lean -- the type checker uses exactly the proven calculus.

If you are going to build a language with claude, I highly, highly recommend writing it in Lean or Coq and starting by formalizing a pre-existing paper or system that has the properties you want.

Claude gets confused and takes shortcuts constantly, and if you don't have a proven base, you are really going ot struggle. I had to throw away months of work as i got bogged down trying to resolve special cases and bugs that just evaporated when i switched to a proven calculus.

TofuLover 2 hours ago | parent

Is this just "Rust with dependent types"? Not saying that as a criticism, I think this is genuinely useful.

jordan_bonecut 1 hour ago | parent

Dependent types are part of it, yeah! There are definitely some things I dislike about Rust which I am not planning on including, mainly lifetimes and some ways they handle pointer mutability. One thing I particularly dislike about Rust is:

let x = vec![1,2,3]; let a = &mut x[0]; let b = &mut x[1]; swap(a, b);

This is not allowed. And actually in the compiler’s mind it’s for the same reason as this:

let x = vec![1,2]; let a = &mut x[0]; x.push(3); a = a + 1;

Which is definitely not safe and should be rejected. But the compiler cannot reason that the above case is actually safe, because they both fail to compile for lifetime reasons.

Another thing I’m working on are “patterns” which are like enums on steroids. In Rust you cannot define how an enum is laid out, thus requiring optimizations for types like Option<&T> to be in the compiler. In evergreen this will be in the language via a similar process to trait implementation.

nicce 1 hour ago | parent

> not planning on including, mainly lifetimes and some ways they handle pointer mutability

How are you going to solve the problem with other means? Lifetimes basically guarantee, that there are no use-after-free bugs.

jordan_bonecut 1 hour ago | parent

The compiler statically tracks “where” everything lives. It also knows “when” the “where” is valid.

Each “where” is called a plane, which is a tree. The stack plane contains all your function calls memory, a structure allocated on the stack has a child plane for each field. The compiler tags which plane something is from at compile time and tracks when it dies.

Things do get complicated in scenarios like:

fn max(a: &usize, b: &usize) -> &usize {

  if *a > *b { a } else { b }
}

In such a scenario the compiler tags the result with both of the input planes. However, you cannot define add a postcondition ensures clause to make it more precise

0c3ca83 1 hour ago | parent

And what about allocations and threads?

jordan_bonecut 1 hour ago | parent

Allocations live in their own plane, the root allocated typed being the root node of that plane. For threads, I’m still working on that, don’t have a super cool answer yet

0c3ca83 48 minutes ago | parent

how does that prevent use after free? pretty sure your algorithm is either very poorly explained or doesnt' actually work.

jordan_bonecut 36 minutes ago | parent

The compiler tracks all of the currently living planes. The compiler tracks from which plane each borrow is borrowed. Once the plane it is borrowed from dies that borrow is no longer valid

jordan_bonecut 28 minutes ago | parent

Another thing - when a value is moved or dropped the plane’s type changes from T to shape(T). shape(T) contains unspecified data but has the size and alignment of a T. So you couldn’t safely prove that a moved out/dropped shape(T) is a T

tancop 1 hour ago | parent

Sounds a lot like group borrowing from Valen, but that one still has annotations like `entity in world.entities[] mut`. Are you tracking the same things implicitly with post conditions?

throwaway17_17 1 hour ago | parent

Since you are replying, I’ll go ahead and you answer…

In a sibling comment I said the types seem more likely to be refinement (or Liquid) types instead of being full-spectrum dependent types. Is this correct? I certainly haven’t been through enough of the docs to be confident, but I took a swing when I posted my comment.

jordan_bonecut 33 minutes ago | parent

What I’ve showcased is definitely not full fledged dependent types. Support is planned via ideal generics but it’s lower on the priority list to nail down

throwaway17_17 1 hour ago | parent

The introductory examples look more like refinement type (or Liquid types) which are limited to those operations and restrictions one’s that are provable by the compiler utilizing a restricted subset of operations and computational constructs subject to deterministic proving via SAT solving. I’m going to look closer at the docs so I could be mistaken on that point. It certainly seems to have taken the ownership and ‘borrowing’ concepts for memory semantics from Rust at a quick glance at the first few pages.

jordan_bonecut 1 hour ago | parent

Dependent types can be achieved via “ideal Generics”. Very undocumented and not ready to commit to how they work yet, but the basic idea is that a type can be generic on a value.

ch4s3 1 hour ago | parent

How long have you been working on this?

jordan_bonecut 1 hour ago | parent

I have been building little prototype languages for years. This iteration which is heavily AI powered is a couple weeks old

ch4s3 1 hour ago | parent

Oh cool, it's amazing how quickly you can stand up a language now, I love it. I'd love to exchange ideas, I really like what you're doing.

How are you doing resolution of your dependent(refined?) types? I've been using Z3, but you're clearly doing something else here.

ch4s3 1 hour ago | parent

Yeah it definitely looks like refinement vs actual dependent types. I do the same thing here[1] in my language (pardon the mess). Adding liquid types to basically rust is IMHO a good idea.

[1] https://march-lang.org/docs/refinement-types/

gtutino 2 hours ago | parent

That's basically SPARK (the Ada subset) but with c-like syntax (more or less).

LiamPowell 1 hour ago | parent

I see minor differences; however, the author does nothing to highlight them. That's the number one thing that any new language should show when it's trying to fit into a niche that a language already exists for: What makes this language different?

jordan_bonecut 24 minutes ago | parent

A compare and contrast is good feedback, will work on this

skybrian 1 hour ago | parent

It sounds like you know what you’re doing but the documentation seems rather shallow and I don’t quite get it. I think you’re going to need a real language specification. I like how Go does it.

There is some apparently AI-generated prose that needs rewriting for clarity. For example, in the tutorial:

> The caller proves where; the implementation proves ensures. A precondition failure stops compilation before any program runs.

Fron the readme:

> I think you get it now.

Nope, I skimmed, because the syntax is unfamiliar.

> Memory model is in a tree of "planes". The stack is a tree. Each function is a node. Each variable is another node. If it's a struct then it's also a node. Down to the most atomic types, which are just the integers.

Meaning what? This needs to be explained better.

jordan_bonecut 1 hour ago | parent

Yeah the repo/documentation is pretty rough right now. TBH I am not quite ready to spend a ton of time on docs yet as some of these things are changing on the fly. But the core concept/syntax should remain the same. The code is not super interesting yet, though

skybrian 1 hour ago | parent

Yeah, if I were motivated I’m sure I could figure it out from the tutorial.

jordan_bonecut 1 hour ago | parent

And, to be clear, the README was mostly an initial prompt for the AI. I’ll prioritize making a much clearer and legible README soon

assumed_throwaw 28 minutes ago | parent

A good tip is to actually polish your README before sharing it with everyone.

kreco 53 minutes ago | parent

Sorry for the non constructive comment:

I wish we would stop xxx::yyy::zzz for namespace.

It was horrible in C++ from day one, and is still horrible in Rust.

It had some reason to be this way in C++ but not in any other newer language.

Real negative part: it looks to me that the authors of those languages are parroting other languages rather than understanding the reason of those language choice.

This simply worries me because I judge the level of expertise and makes me not consider the language in the first place.

(I know C++ and Rust are alive but they share their fair share of poor design choice)

aeve890 48 minutes ago | parent

Hard agree. PHP did it right with backslashes.

jordan_bonecut 20 minutes ago | parent

That, sir, is a hot take

edf13 35 minutes ago | parent

Any links to the historical reason for C++ using ::?

kreco 23 minutes ago | parent

I don't have a link but you can search on the web. I have the .pdf on my computer.

From "A History of C++: 1979− 1991".

> In C with Classes, a dot was used to express membership of a class as well as expressing selection of a member of a particular object. This had been the cause of some minor confusion and could also be used to construct ambiguous examples. To alleviate this, :: was introduced to mean membership of class and . was retained exclusively for membership of object.

It was taken from Algol68.

Then, this was reused for namespaces for consistency reason.

jordan_bonecut 29 minutes ago | parent

This is good feedback. I will chew on this…

mantomat 21 minutes ago | parent

> It was horrible in C++ from day one, and is still horrible in Rust.

I don't get it. Is it syntactically horrible or are there real reasons that I'm missing?

ModernMech 2 minutes ago | parent

For me, I guess it’s just that foo/bar is standard and fewer characters so it’s the obvious and ergonomic choice. But we can’t use that because of infix math, which is also a choice.

packetlost 16 minutes ago | parent

My favorite namespacing syntax is ironically Clojures. module/func or fully.qualified.module/func or just func if you explicitly import the symbol. I vastly prefer shallow namespacing (module/func) most of the time.

I write Rust mostly for my day job (and it's also my preferred language on the side these days), so I usually end up explicitly importing all the symbols I actually use because module::func is just additional noise in an already pretty verbose language and is what's considered 'idiomatic'.

I don't really get the issue with :: being the separator used here. It's slightly ugly, but it's visually distinct from . for field access, which I do appreciate.

roarcher 5 minutes ago | parent

> it looks to me that the authors of those languages are parroting other languages rather than understanding the reason of those language choice.

I don't mean this to sound combative, but I think you are the one who doesn't understand the reason for the language choice. I assume you're objecting to the fact that these languages use different operators for module/namespace paths (`::`) and object member/method access (`.`), not the `::` symbol specifically.

You seem to assume that Rust blindly imitated C++, but that's not the case. The `::` syntax allows the compiler to know which paths can be resolved statically, before type inference and other analysis. This is important because macros are expanded between these stages, and can in turn introduce more static names which must also be resolved before any further compilation.

You might be able to introduce a rule that any `.`-path that can be resolved statically will be, trumping any non-static members (or maybe not, it might cause ambiguities I'm not thinking of), but Rust's design philosophy has always favored explicitness.

solatic 25 minutes ago | parent

I didn't delve too deeply, but I don't get it. How do you get provable runtime safety (in a dependent types sense) in a system which gives you direct control over memory, and without introducing the kind of overhead that would be inappropriate for a systems language?

Your "overflow, then inspect" example illustrates this incoherency. If overflow is allowed, and you try to fit 250 + 10 into a u8, so the value should be 4, which is less than 10, so it should fit your precondition, not violate it. And this is a simple example where 250+10 is known at compile-time - what happens when a user provides the number at run-time? Does the compiler attempt to provide the proof anyway? How?

I mean.... I have a lot of respect for Haskell and Idris and the goals they set out. But they're not systems languages.

jordan_bonecut 12 minutes ago | parent

Overflow is allowed. Overflow behavior is unspecified, like C++

jordan_bonecut 10 minutes ago | parent

If you want to assume that overflow wraps either:

Your hardware does this OR You implement it in software