# Draconyx

> A programming language designed for code written by AI models and used by AI agents. Pre-release research project: a 522-page specification and a working compiler, public at the first release. Each mechanism below states what ships today and what is only specified.

Status as of 18 October 2026: Specification: 31 normative sections, a 522-page PDF with 563 code blocks that the corpus tool turns into test oracles. Toolchain: Lexer, parser, resolver, type checker, ownership checker, interpreter with law runner, canonical formatter, agent daemon and native code generation. Agent daemon: 20 JSON-RPC methods, among them outline, get-def, slice, search, put-def, put-defs, fork, verify, `delta-card` and `resume-card`. Diagnostics: 129 codes, each with an explain entry; a test enforces the coverage. Self-hosting: The lexer, parser, resolver, type checker and ownership checker are written in Draconyx itself, about 51,000 lines. The ownership checker port is the stage in progress. Latest full gate: 9 October 2026, all green on the shared test corpus: lexer 775/775, parser 1270/1270, resolver 966/966, type checker 1015/1015, ownership 1015/1015, native code vs interpreter 105/105. Design record: 209 numbered rulings ratified into the spec; four example packages, among them an online shop, event sourcing and FlashAttention, and a 3,426-line standard library generated from the spec. Release: Pre-release research project, first commit 20 July 2026. The first public release comes when the first compiler written entirely in Draconyx is ready.

## Mechanisms

- [Errors are data. Not prose.](https://draconyx.ai/#diagnostics): Every checker emits one Diagnostic value: a stable AXnnnn code, byte-precise spans, an explanation, and suggested edits. Each edit carries an applicability (`always` or `maybe`), can carry `also` spans that apply all-or-nothing across files, and a `consequence`: the fact about the program that the edit makes true. Status: Ships today: the JSON channel, the ownership checker's two-file edits with consequences, ranked candidates (by edit distance so far), explain for all 129 catalogued codes. Spec references: 25-tooling:9-26, 25-tooling:65-106, 25-tooling:143-165, 26-agent-interface:387-400
- [Edit by name. Never by line number.](https://draconyx.ai/#edit-by-name): The agent daemon addresses code by qualified name (`inventory.reprice`), never by file and line. Writes are transactional: a write may carry the tree hash it was based on, and if the tree has moved, it is refused with the current hash and the current text. Status: Ships today in `drx serve` and `drx rpc`. Still owed: auto-import, canonical splicing of nested members, a crash-atomic disk mirror, and re-reading the workspace before a write (today `base` is checked against the daemon's in-memory tree, so edits made outside it are missed). Spec references: 26-agent-interface:66-89, 26-agent-interface:412-494, 25-tooling:565
- [No global open(). Every service on the record.](https://draconyx.ai/#authority): The rule is “no ambient permission”: there is no global `open` and no standard function that reaches the world on its own authority. Every permission comes from the `System` passed into `main` and flows down by explicit provision. Status: Ships today: AX0501 with call chains, uses/needs in the outline. Specified, not yet enforced: unforgeable handles. Today's checker still lets user code construct standard handles such as `File(descriptor)`; closing that comes before we claim “by construction”. Spec references: 12-services-di-permissions:221-263, 12-services-di-permissions:83-106, 12-services-di-permissions:299-314, 26-agent-interface:228-234
- [Prompt injection meets the type checker.](https://draconyx.ai/#tainted): `tainted` is a type qualifier. Model completions, console input, network reads and process arguments are born tainted at their standard-library signatures. A tainted value where a plain type is expected is compile error AX1022, and every parameter that steers what the program does is such a position: a prompt's instruction, SQL identifiers, process arguments, permission-minting arguments. Status: Ships today: AX1022 at every argument, field, return, binding and collection element; taint through field projection and generic code; the prompt-instruction barrier. Specified, not yet built: the SQL and process-argument barriers, and taint through string interpolation. Spec references: 12-services-di-permissions:460-517
- [Laws are checked. Not trusted.](https://draconyx.ai/#laws): Capabilities carry algebraic laws as syntax, and a law with no mode is checked. `drx test` synthesizes a property test for it, draws inputs from a fixed seed, shrinks any failure to a minimal counter-example and records it in a regression file that later runs replay first. Release builds require checked laws to pass; skipping one takes an explicit `trust`, and the test target warns about each. Status: Ships today in the v0 toolchain. Specified, not yet built: the violation report that lists every site resting on the law and offers exactly two repairs. Spec references: 13-law-verification:4-97, 13-law-verification:319-345, 13-law-verification:400-409, 10-capabilities:88-101
- [Every named call tells the truth.](https://draconyx.ai/#calls): Named arguments are mandatory at every call of a declared function with two or more arguments; an unlabelled one is AX0256, and the error lists the callee's labels. Ownership is spelled the same at both ends of a call: unmarked is read-only, `borrow` is exclusive mutation, `transfer` consumes. A mismatch is AX0306, and using a value after it moved is AX0312. Status: Ships today: all three diagnostics. Spec references: 05-syntax-conventions:3-4, 04-core-language:251-272, 04-core-language:1624-1640, 07-memory-model:253-285
- [No exceptions. No missing arms. No mercy.](https://draconyx.ai/#failure): There are no exceptions and no try/catch. Failure is `Ok/Err`, and `?` has an exact desugaring into a match. A panic is for bugs only, no construct catches it locally, and every panicking operation has a total twin that returns `Option`. Status: Ships today: AX0601 and AX0602 as errors. Spec references: 04-core-language:545-645, 11-type-system:444-498
- [Same tree, same answer. Every time.](https://draconyx.ai/#determinism): `drx serve` is a local JSON-RPC 2.0 daemon. Every response is a pure function of the toolchain hash, the lockfile and the source-tree hash, and carries that tree hash; the one exception is a verify cut short by its time budget, and the response says so. Lists paginate deterministically and are never silently truncated, and errors carry a stable kind that code can branch on. Status: Ships today. Spec references: 26-agent-interface:31-61, 26-agent-interface:91-127, 25-tooling:501-522
- [Every surprise in the language, on one 2,000-token card.](https://draconyx.ai/#context): Draconyx doesn't wait for models to learn it from the internet: the toolchain brings the knowledge straight into the context window, in name-shaped, budgeted pieces. `outline` gives each definition's signature, derived facts such as uses and needs, its evidence line and the first line of its documentation. `slice` returns the minimal reading set for editing one definition and degrades deterministically to fit a token budget (docs first, then private helper signatures, never public ones); `search` returns ranked results that paginate deterministically. Status: Ships today: outline, slice, search, `delta-card` and `resume-card` as daemon methods. Card contents are partial: the dialect grammar cards the spec requires are not emitted yet, and the resume card's budget is still measured over its JSON envelope. Token budgets use a declared bytes/4 estimate until the specified reference tokenizer is pinned. Spec references: 26-agent-interface:183, 26-agent-interface:228-234, 26-agent-interface:648, 26-agent-interface:306-324, 26-agent-interface:739-740

## Language

- [Capabilities: named, but never declared](https://draconyx.ai/#language): Write the functions and the type conforms. No impl blocks, and no two modules can give one type two meanings. (Types and algebra; ships)
- [Algebraic laws as code, checked at build time](https://draconyx.ai/#language): In C++ and Rust, associativity is a line in the docs. In Draconyx it is a `law` line, and a false one fails the build with a shrunk counter-example. (Types and algebra; partly built)
- [Dispatch on algebra](https://draconyx.ai/#language): Write the parallel reduction once. The compiler picks it only for types that assert the laws that make it correct. (Types and algebra; ships)
- [Generics that infer the hard parts](https://draconyx.ai/#language): Variance, associated types and const-generic shapes are worked out by the compiler, not annotated by the model. (Types and algebra; partly built)
- [Ownership spelled at both ends](https://draconyx.ai/#language): Every handover is written where the value is given and again where it is taken, so a model never has to guess who owns what. (Memory and ownership; ships)
- [Borrow checking with zero lifetime syntax](https://draconyx.ai/#language): Rust-grade memory safety without a single `'a`: you never write a lifetime, and the compiler works out every one. (Memory and ownership; ships)
- [Views inferred, not annotated](https://draconyx.ai/#language): Put a borrow in a struct and it becomes a safe view on its own: no keyword, no lifetime parameter. (Memory and ownership; ships)
- [No garbage collector, deterministic drops](https://draconyx.ai/#language): No tracing GC and no pauses: each value is freed the moment its last owner lets go. (Memory and ownership; partly built)
- [Data-race freedom by construction](https://draconyx.ai/#language): No Send, no Sync, no annotations: the ownership authorities you already write decide what may cross a task boundary. (Concurrency and distribution; partly built)
- [Structured concurrency with `with nursery`](https://draconyx.ai/#language): Tasks can't leak, and child tasks may mutably borrow the parent's data with no locks. (Concurrency and distribution; partly built)
- [Move-only channels and a fair, replayable `select`](https://draconyx.ai/#language): Every message exists in exactly one place at a time, and `select` timeouts run on a Clock you can fast-forward in tests. (Concurrency and distribution; partly built)
- [Actors and OTP supervision without exceptions](https://draconyx.ai/#language): Erlang-style let-it-crash supervision trees, with errors staying plain Ok/Err data. (Concurrency and distribution; partly built)
- [Remote values that cannot hide failure](https://draconyx.ai/#language): In Draconyx a network call never looks like a local call: `remote` is in the type, and every way it can fail is a value you have to match on. (Concurrency and distribution; partly built)
- [Bundled distributed runtime](https://draconyx.ai/#language): Cluster membership, Raft consensus and CRDTs live in every binary as ordinary types: no ZooKeeper, no Consul, no sidecar. (Concurrency and distribution; in the spec)
- [Hot code swap with checked state migration](https://draconyx.ai/#language): Erlang-style hot swap for compiled code: the swap point is proven safe, state is handed over as a linear move, and migrations are functions the compiler checks. (Concurrency and distribution; in the spec)
- [Native binaries today; unikernel and Wasm next](https://draconyx.ai/#language): `drx build` produces a native executable; the same source targets a unikernel that needs no OS underneath, or a WebAssembly module. (Concurrency and distribution; partly built)
- [Services and dependency injection](https://draconyx.ai/#language): Declare a service, `provide` it once in main, and every function underneath can use it. You get no constructor plumbing, no effect rows, and a compile error if a provider is missing. (Safety and effects; ships)
- [Object-capability permissions (no ambient authority)](https://draconyx.ai/#language): No global `open` and no importable `Network`: the only way code gets authority is to be handed it. Starting from main's `System` powerbox, it can only be narrowed, never widened. (Safety and effects; partly built)
- [`tainted`: a typed defense against prompt injection](https://draconyx.ai/#language): Model output, console input and the command line are born `tainted`. Passing one to an unmarked parameter, or to a prompt's instruction slot, is compile error AX1022. (Safety and effects; partly built)
- [`trust` blocks: unsafe code that names its reason](https://draconyx.ai/#language): Draconyx has no `unsafe`. It has `trust "why this holds":`, where every unchecked call site carries a mandatory written rationale an auditor can grep. (Safety and effects; partly built)
- [With blocks: one keyword for receiver, destructuring and scoped release](https://draconyx.ai/#language): One `with` covers Python's context managers, Rust's RAII and multi-value destructuring, even at the end of a pipeline. (Safety and effects; ships)
- [Shapes and named axes in the type](https://draconyx.ai/#language): A tensor's dtype, axis names and sizes belong to its type, so a mismatched matmul fails at compile time, before any array is allocated. (AI and numerics; partly built)
- [grad, vmap, jit as typed function transforms, with schedules certified by laws](https://draconyx.ai/#language): Autodiff, auto-batching and fusion are plain functions over functions, and schedule rewrites are gated by laws instead of being trusted. (AI and numerics; in the spec)
- [Hygienic, typed dialects (macros, elab, comptime)](https://draconyx.ai/#language): Dialects extend the syntax with Racket-grade hygiene and type-directed elaboration, without textual macros. (AI and numerics; in the spec)

## Docs

- [Full page as Markdown](https://draconyx.ai/index.md): every mechanism with samples and status
- [Why the name](https://draconyx.ai/#name): Draconyx, Draco's written laws and the axones
- [Contact](mailto:info@draconyx.ai): design discussion, collaboration, model training or evaluation
- [Launch updates](https://lists.draconyx.ai/subscription/form): mailing list for the launch and new features (double opt-in)