Status and roadmap

This page is an honest inventory. Everything in the first list is built, gated, and green in the repository today. Everything in the second list is planned, deferred, or simply not done.

The toolchain is early. The claims below are backed by the gates in the repository, and a claim without a gate does not appear here.

The current release is v0.7.1. The v0.7.0 release renamed the language to Geas across every surface, before anything was published, so nothing downstream carries an older name. v0.7.1 brought Map and tuple across the gRPC bridge as ordered wrapper messages.

What works today

The full pipeline. geas carries lexer through type checker through codegen over the full grammar. check runs the whole static analysis, build links a loadable .geas.so, and two builds of one source emit byte identical C.

Contracts with the whole feature set.

• Vows, pledges, clauses, subcontracts, and requirements policies.
• Records and sums, exhaustive match, loops, and error propagation with ?.
• Imports with package visibility and the internal boundary.
• The standard library under lib/std.

C runtime enforcement. The runtime enforces the lifecycle with per pledge latching, runs fulfillments on a worker pool, owns every allocation an instance makes, and reclaims it all at break. Contracts are discovered through the iname table by mangled name and shape hash.

C and Python hosts. A C host drives everything through the documented ABI. Python does the same through ctypes with no C written and no bindings generated. Both hosts sign the same contracts, override the same vows, bind the same abstract pledges, and read the same partial surface.

Standalone binaries. build --bin links a real executable around the Main contract: Ok(n) becomes the exit code, Err renders to stderr and exits 1.

The store layer with SQLite.

• A schema is a vow that locks at sign and joins the shape hash.
• A transactional subcontract runs as one all or nothing episode.
• Pledges read and write rows through std.store.
• The SQLite backend is vendored into libgeasrt, so the store gates are hermetic and need no server.
• The store is invisible across the C ABI: a host signs, fulfills, and breaks a store backed contract with the same calls it always used.

Park and resume. An instance’s durable state parks into a store row, the vows, the latches, the error payloads, and the transactional fates in one row, and resumes in another process, from the C surface and from inside the language alike. The resume is one shot: two servers can share one park store, and when both race the same token exactly one wins.

The gRPC bridge with Go and Node clients.

• geas emit-proto writes the wire surface and its Go and TypeScript session wrappers.
• A reference server holds the runtime over the C ABI and serves it.
• Clients in Python, Go, and Node drive the whole lifecycle from the emitted artifacts alone.
• The gates include a server killed between a park and a resume, and a failover across two replicas sharing one park store.

A working example that composes the pieces. The repository ships a small process supervisor whose service state machine is a contract instance, one instance per run: Signed is starting, Partial is running, Fulfilled is a clean exit, Broken is a crash. The host binds the spawn and the health pass over abstract pledges, the run record and the crash count live on the store, and a supervisor restart is a park and a resume, the service process surviving in between.

Sanitizer and determinism gates.

• Address and leak sanitizer runs over the end to end check.
• Thread sanitizer gates over the worker pool.
• A determinism gate that builds twice and demands byte identical output.
• Golden and compile fail suites, and store gates against a real SQLite file.

What is planned or not done

The mesh, layer 4. Planned, not started. Layers 1 and 2 are done, layer 3 is in progress, and the mesh is the layer after that.

Parts of the store surface. The store layer is in progress. Store.query grew a predicate grammar, ordering, and limits, and the aggregates landed, but a partial record form of update is still landing, and the surface is marked where it is not final.

A Postgres backend. The store interface is designed so a second backend sits behind the same surface. Today the only backend is SQLite. Postgres is planned behind the same store interface, not a different one.

Migrations. Out of scope for v1. A schema reconciles at sign, an absent table is created, a present one is validated column for column, and a divergent one fails the sign. Evolving a live table is a later problem, deliberately.

Hot reloading. Not supported. A loaded module stays loaded, and geas_runtime_freeze exists to make the registry immutable on purpose, not to swap it.

A deadlock detector. Reserved, absent. The lock order is documented and fixed, but nothing watches for a host that violates it.

A package format. Not settled. A directory is a package and imports resolve by path; there is no registry, no manifest, and no versioned dependency story yet.

A license. Not settled. The repository says TBD, and that is the current state.

Language surface deliberately deferred. Generic user declarations, map literals, compound assignment, ranges, an async fulfillment surface, and provisional clauses that require pledges are all kept out of the first version on purpose. Each has a reserved spelling or a stated path so adding it later breaks nothing. See Grammar for the full list.

Reading the history

The changelog in the repository carries every released version, newest first, with the design notes a commit message has no room for. Entries older than the rename keep the names they shipped with, because a changelog that rewrites its own past is not one.

For what the language guarantees today, the reference pages are normative, starting with Overview and philosophy. For running the toolchain, see The geas CLI and Getting started.