Supply-chain risk
Capabilities, not trust
A logging crate that never received network authority can't exfiltrate anything —
the whole class of "malicious dependency" attacks is structurally defanged.
INDUSTRY PACKET · THE SIGIL LANGUAGE · DEVELOPER PLATFORM
A systems language where authority is explicit and safety is proven.
For programmers · capability-secure · effect-typed · contract-carrying · self-hosting
Rust made memory safety mainstream. Sigil takes the next step: authority and effects become part of the type system, and contracts are proven before the code runs — then erased, so you pay nothing at runtime. It's designed to be written by AI and audited by humans, and the entire OS under it is the existence proof.
The idea in three sentences
- No ambient authority. A side effect needs an unforgeable capability handed down
from
main; a dependency you never gave the filesystem cannot touch it. Capabilities attenuate —read_only(subdir(fs, "sandbox"))mints a strictly weaker one for code you trust less. - Effects are in the type. Every function declares what it may do
(
! {io.write}); an undeclared effect is a compile error, and no annotation means provably pure. - Contracts carry blame, proven where possible.
requires/ensures/invariant; with a solver,sigil verifyproves clauses statically, thensigil builderases every proven check from the binary — safety with no runtime tax.
Why a programmer should care
"What does this do?"
Effects in the signature
The type tells you every side effect a function can have. Reviewing and reasoning
about code — human or AI — starts from a guarantee, not a guess.
Correctness
Proven, then erased
Push invariants into the type system and prove them at build. You get the
assurance of a formal method with the runtime cost of neither asserts nor checks.
Trust the toolchain
Self-hosting, reproducible
The compiler compiles itself to a bit-identical binary (fixpoint-verified) from a
byte-reproducible seed. Verify the artifact; don't trust the build.
AI-written code
AI-native by design
Built to be generated by models and checked by the compiler — the language makes
the machine state what it's doing and proves it can't lie.
All the way down
Language + a real OS
Not a toy: an EFI stub, kernel, drivers, and desktop are all Sigil. The language's
claims are load-bearing on real metal.
Where it sits vs. Python / Rust / Go
Python and Go give you productivity, not memory safety or the metal. Rust gives you memory safety, but not capabilities, effects-in-types, or proven contracts by default. Sigil aims to carry memory safety + capability security + effect typing + provable contracts in one language — and back it with a full OS. That's the bet, and we're honest that it's early.
Where we actually are — no hype
- REAL The language, the self-hosting native compiler (cc0), and the capability/effect/contract model exist and run today — you can read it and build it.
- An entire OS is written in it and boots on real hardware — the strongest possible proof the model is load-bearing.
- YOUNG The ecosystem is early: tooling, package story, docs, and libraries are all in active build. This is a ground-floor language, not a mature one — yet.
- HONEST We're not telling you to port your production service to Sigil this year. We're inviting the programmers who want to shape a language while it's still being shaped.
Who this is for
Systems programmers, security-minded engineers, and language enthusiasts who've felt the ceiling of memory-safety-alone and want capabilities, effects, and proofs in the language itself — and who'd rather help define a platform than wait for it to arrive. Start with the docs; the OS is the demo.