Nazm

نظم — systematic order, well-formed arrangement.

Nazm is a natively compiled programming language with explicit, specified semantics, deterministic memory reclamation without a garbage collector or lifetime annotations, structured concurrency, compiler-checked effects, authority and data provenance, and machine-readable tooling for people and coding agents alike. A second compiler, written in Nazm for a declared subset of the language, compiles itself.

Current release: 1.0.0 — the first stable language and toolchain release

Nazm 1.0.0 is the first stable language/toolchain release. A program valid under stable Nazm 1.0, using only stable public surfaces, does not silently change meaning under a later 1.x toolchain: docs/stability.md is that contract — what is stable, what is experimental or internal, and what a patch, minor or major release may change — and tests/compat/v1/ is the corpus every 1.x toolchain is held to.

A stable contract is not a complete ecosystem. Optional subsystems — GPU kernels, smart contracts, the freestanding and WebAssembly targets, the agent and editor tooling — remain experimental or partial where documented, and nothing in Nazm is certified, proved correct or claimed free of defects. Native compilation passes through one shared low-level IR into LLVM and Cranelift, the hosted runtime runs tasks on a structured M:N scheduler, and the release is backed by contained bootstrap, mutation, fuzzing, platform and artifact-verification evidence.

Not yet released. The tree says 1.0.0; no v1.0.0 tag exists. The v1 programme’s later gates and its final release gate stand between this tree and one, and a licensing decision is required before public release (docs/licensing.md). Gate 1 found a memory defect — a closure stored into a Vec it captured was never reclaimed — and Gate 1-C1 closed it by refusing the capture (N0616, docs/spec.md, Cycles). The last published candidate is v0.3.0 (docs/releases/7a16a40.md).

A taste

trait Area {
    fn area(self: Self) -> Int;
}

struct Rect {
    w: Int,
    h: Int,
}

impl Area for Rect {
    fn area(self: Rect) -> Int { self.w * self.h }
}

fn doubled[T: Area](shape: T) -> Int {
    shape.area() * 2
}

fn main() -> Int {
    let r = Rect(w: 3, h: 4);
    r.area() + doubled(r)
}

$ nazm run taste.nz
36
$ nazm build taste.nz -o taste && ./taste
taste
36

nazm run checks and interprets; nazm build compiles the same program to a native executable, which gives the same answer.

Install

You need the Rust toolchain pinned in rust-toolchain.toml (rustup installs it on first use) and clang, which nazm build uses for the runtime and the link — Apple’s on macOS (Xcode command-line tools), your distribution’s clang package on Linux.

git clone https://github.com/mdferdousalam/nazm
cd nazm
cargo build --release -p nazm-cli            # target/release/nazm
# or: cargo install --path crates/nazm-cli --locked
nazm --version                                # nazm 1.0.0

The binary carries the standard library inside it and needs no installation directory. Nothing else is required for the language itself. Optional tools unlock optional features only:

Try it

docs/getting-started.md goes from nothing to a checked, tested, formatted, natively built program and a package in about ten minutes, and the test suite runs every command on it. In short:

nazm run FILE.nz        # check, then interpret; prints main's value
nazm check FILE.nz      # type-check only; --json for nazm.diagnostic/1
nazm build FILE.nz -o OUT [--backend llvm|cranelift] [--debug]
nazm test DIR           # every NAME.nz with a NAME.expected, interpreted and compiled
nazm fmt FILE…          # the one layout; --check to verify
nazm inspect FILE.nz    # everything the compiler knows about a program, as JSON
nazm init DIR --template cli    # a new package: cli, library, server, embedded, wasm, contract

examples/tour/ has small programs for records and enums, Result and ?, generics, closures and named functions as values, traits, and tasks under a scope with the authority to start them — each checked, run and built under both backends by the suite — and examples/worker-pool.nz shows a larger concurrent program.

What is in the language

• Values and types: Int (64-bit, every operation checked — overflow and division by zero stop the program, never wrap), Bool, Str (bytes); records, enums with exhaustive match, first-order generics with Equality and trait bounds, traits and methods (nominal, static dispatch), closures and function values.
• Errors as values: Result, Option and ?. No exceptions, no null.
• Memory: values are reclaimed deterministically without a garbage collector or lifetime annotations; sequences are shared handles, by specification (docs/spec.md, The memory constitution).
• Effects, authority, provenance: a function may declare its effects (! { io }, ! {}); authority to touch the outside world is a value passed down from main, never ambient; data from files and arguments is tracked to the sinks it may not reach. All checked statically — none of it is a sandbox.
• Concurrency: scope / spawn with typed channels, select and deadlines; no task outlives its scope. Compiled programs run tasks on a bounded M:N worker pool by default.
• Modules and packages: a file is a module, pub exports; nazm.toml, a lockfile with BLAKE3 digests, a local registry and a backtracking resolver.
• Native code: one shared LIR, translated by LLVM or Cranelift; C interop (a stated ABI subset); WebAssembly and two freestanding boards; restriction profiles (embedded, realtime, critical, cyber, web3, …) that refuse whole classes of construct.
• Tooling: formatter, machine-applicable fixes, LSP server, a read-only MCP server, JSON output under versioned schemas for every command, build provenance, SBOMs and signed attestations.

What each of these does not do is in docs/limitations.md.

Platforms

Windows, 32-bit hosted and big-endian targets are not supported. docs/support.md has the full matrix — debuggers, runtime restrictions, the optional features (GPU, WebAssembly, EVM, sBPF, JIT, formal proof) and the evidence for each cell — and is checked against the compiler’s own table. Every emitted LLVM module still carries the note it was first given, “verified on aarch64-apple-darwin with Apple clang; other targets are unverified rather than unsupported”; the matrix is the current answer.

What is experimental, and what is not done

The core above is what 1.0 makes stable. Around it, eight capability areas remain partial — GPU and HPC, LSP and MCP, package tooling, the debugger and profiler, performance measurement, reproducibility and provenance, the platform matrix, and smart contracts — and four things are blocked by something outside this repository: an in-process JIT (it needs unsafe, which the workspace forbids), theorem proving (no proof assistant; formal evidence is bounded model checking), sBPF/Solana execution (no toolchain or validator), and a second GPU provider (no Metal or SPIR-V toolchain). Among the language’s own boundaries: no trait objects, no effect handlers, no networking in the standard library, and a compiled program has no iteration budget — nazm run stops a runaway loop after --max-iterations, a native executable does not.

docs/limitations.md is the full list; docs/capability-matrix.md is the evidence, area by area.

Evidence

Every claim above is backed by a test or a recorded run, and the evidence is described by what it does not establish as carefully as by what it does:

• Differential testing: the interpreter, both native backends and LIR’s own interpreter are held to the same results on a shared corpus; passing says nothing about bugs all of them share.
• Self-hosting: compiler/*.nz is a compiler for a declared subset of Nazm, written in Nazm. The bootstrap (Rust → C1 → C2 → C3) reaches a fixpoint — C2 and C3 byte-identical — which shows it reproduces itself, and it agrees with the reference compiler on its conformance corpus (34 cases and 30 refusals) and 21 parity probes. It does not cover the whole language — string escapes, :: and as, packages, Chan[T], select, the clock, device registers and most of the C boundary are outside its subset — and the Rust compiler remains the reference. A fixpoint is not an independent proof of semantics (docs/bootstrap.md).
• Mutation testing: a catalogue of deliberately injected defects, 1,285 entries, each required to be caught by a named test; all 1,268 it held at the core release gate were caught there, and the seventeen added since in their own responsibility-mapped campaigns (docs/releases/82936f6.md, docs/releases/7a16a40.md). Zero survivors describes the catalogue, not the absence of bugs.
• Fuzzing: coverage-guided fuzzing of five targets with a replayed corpus.
• Contained gates: the heavy work runs only inside a bounded container (memory, swap, pids, disk and time all capped), because a runaway compiler stage once took the development machine down (docs/runbook.md).
• Artifacts: a release is assembled by scripts/release-candidate.sh with a SHA-256 manifest of every file, a provenance record, and a BLAKE3-indexed evidence bundle with an SBOM. The v0.3.0 candidate was assembled twice from one commit, in one image on one host, and the two archives were byte-identical (docs/releases/7a16a40.md).

“Verified-correct” does not appear anywhere in this project.

Documentation

Developing Nazm

cargo build --workspace
cargo lint                      # clippy, as CI runs it
cargo xtask check               # architectural and documentation gates
cargo xtask workspace-tests --host-safe --jobs 4 --workers 1 --test-threads 4 --shape ci
cargo xtask contained tests     # the whole suite, selfhost included, in the bounded runner
cargo xtask contained bootstrap # C1 → C2 → C3

The generated compiler stages, the selfhost suite, the bootstrap, fuzzing and the mutation catalogue run only through cargo xtask contained; they refuse to run on a bare host. CI runs the host-safe subset (docs/runbook.md). CONTRIBUTING.md has the rest.

Alongside the compiler: nazm-mcp, a read-only Model Context Protocol server over the same compilation (docs/mcp.md); nazm-tokens, which counts text under four pinned tokenizers; and nazm-bench and nazm-agent-bench, the agent-cost evaluation harness (docs/background.md). Nothing that ships depends on them.

Command reference

An empty nazm.root file marks the directory it sits in as the project’s source root, so a module keeps one identity whichever file a compilation started from. --source-root DIR says the same thing without writing a file. With neither, the root is the directory of the file you named. The marker must be empty: it says where a project begins and owns nothing else.

--json on any of them emits machine-readable output under a named, versioned schema; the schemas are in schema/ and the compatibility rules are in docs/diagnostics.md. scripts/repair.sh is the whole repair loop as one command: apply every automatic fix until a pass changes nothing, lay the result out, and report what is left as JSON.

Licence

Apache-2.0. See LICENSE. Whether the runtime and standard library need an exception clause, as Swift and LLVM use, so that compiled programs are unambiguously unencumbered, is an open question. LICENSING DECISION REQUIRED BEFORE PUBLIC v1.0.0 RELEASE — the technical audit of what a compiled program contains, and what a human must decide, is docs/licensing.md.

Built from commit 4a43836.