A programming language designed for AI agents to write kernel code
If an AI can read a file and fully understand it in one pass, the language is doing its job. Foundation removes everything that exists to help humans manage complexity that AI doesn't struggle with.
// memory.f — this file IS the memory object
page_size: u64 = 4096
free_pages: []ptr = []
fn allocate(size: u64) -> (ptr, err):
// ...
return (address, OK)
fn free(address: ptr) -> err:
// ...
return OK
export allocate, freeProperties are state. Functions operate on them. Import to use as singleton, new to instantiate. The consumer decides.
u8 u16 u32 u64 i8 i16 i32 i64 f32 f64 ptr bool byte err — types exist because the CPU needs them.
loop: with break and continue. No for, no while. One way to loop.
new gives defaults. Set properties directly. Call functions. Dead simple.
import for compile-time linking. load is specified for future runtime hot-swap modules.
The bootstrap compiler currently runs 13 regression tests. Formal .f.test module support is specified but not implemented yet.
| Feature | Why Not |
|---|---|
| Classes / inheritance | The file is the object |
| Generics | AI can duplicate code trivially |
| Async / await | Concurrency is the scheduler's job |
| Exceptions | Return errors explicitly |
| Macros | What you see is what runs |
| Garbage collector | Manual memory, tests catch mistakes |
| Package manager | Files import files — the project IS the package |
The bootstrap compiler is written in C and passes 13 regression tests. The Foundation compiler also has a reproducible three-generation proof:
make -C bootstrap test-self-hostThe runner copies the exact Foundation sources into a temporary workspace, so generated assembly, objects, and binaries do not overwrite files beside the repository's .f sources. Generation-2 and generation-3 assembly is byte-identical for all 10/10 compiler and stdlib modules.
The generation-3 compiler then compiles, links, and runs the published subset with these exact results: hello=42, math=0, loop=0, nested=0, multireturn=0, manyargs2=42, and import=0.
PASS 3-generation self-hosting proof: stable assembly and 7/7 runtime testsThe proof uses explicit lists and does not claim every fc_self/*_test.f file passes. Type words such as err are reserved keywords; the current parser_test.f uses err as a local identifier and is deliberately excluded.
make -C kernel test-shell-runtimeThis separate fresh-ISO, no-network x86_64 QEMU proof emits 12 exact PASS lines and passed three independent fresh boots (36/36 markers) plus one post-forced-build 12/12 run on 2026-08-17. The original eleven arithmetic-JIT, initrd, text/binary transfer, literal/overlap, managed-return, sysmon, and warmed-memory checks remain. The added lifetime fixture keeps two gated FCC programs live on distinct PMM pages, restarts one at the same entry, executes an intervening compile, then releases both independently. Its warmed restart accounting is PMM free +16 pages, heap live allocations -1, and lower live bytes; the two image exits then return exactly one PMM page each. The exact marker is PASS independent FCC images survived concurrent spawn, intervening compile, restart, and exact lifecycle release.
Every successful FCC compile owns an independent page. Instructions grow upward and decoded literals downward through 4080 usable bytes; a trusted 16-byte trailer holds magic plus the exact entry. Synchronous callers release after return, while asynchronous spawn transfers ownership to the Manager's scheduler-aligned 64-slot map, which passed 11/11 after alignment, for transactional restart and final release. The release/handoff APIs are trusted kernel interfaces and are not FCC-registered. The first concurrency boot historically exposed 48 83 EC 80 sign-extending its frame size, moving RSP above the stack, and corrupting the adjacent image; 48 81 EC 80 00 00 00 fixed it and passed after a forced rebuild. Remaining limits are RWX shared ring-0 execution without W^X, ownership metadata rather than isolation, the 4080-byte cap, PMM-base-zero validation, 16 safe u64 locals despite 32 declared, a >64-break patch-table overrun debt, and future TCP CAP_EXEC transient cleanup. Binary receive and physical-input scope retain their documented limits.
Some language features are still specified ahead of implementation: float codegen, array/map/tuple literals, field access, match codegen, dynamic load, new instance dispatch, and tuple unpacking.
Operator precedence is explicit in the specification. Comparisons bind more tightly than bitwise operators, so kernel mask checks assign the bitwise result to a temporary; make test-precedence enforces that rule across all kernel Foundation modules.
Concise LLM view: llms.txt
Full language specification: foundation.md