Sovereignty has a stack.
We started where Europe can win.
A computer is a stack of layers, each inheriting the one beneath it. The real question was never "can Europe build everything?" It was: which layer can Europe own first, and is that enough to protect people?
At the bottom are the chips and the machines. Sovereign European silicon is real, necessary work, but it is a decade away, maybe two. The operating system sits on that hardware, bound so tightly it inherits whatever the hardware decides. You would expect that to be where you start. It is not. You cannot wait two decades for your data to be safe.
So we asked a different question: which layer can we own today? The language, the layer above the operating system, where the applications live. That is something we can build now, in the core, with the software written on top of it.
Take the network, where a cloud-native language lives. kern is built for the cloud: your software runs as services talking to other services and clients constantly, over networks and infrastructure you do not own. The cables and undersea fibre your data crosses are foreign-owned, and will be for a generation. But you do not need to own the wire if you own the encryption that rides over it. Encrypt before the data leaves the machine and it no longer matters whose network carries it.
That is the pattern everywhere. The language is where data is shaped, encrypted, and moved, so owning it means owning the security and privacy that reach the user. That is kern: not a promise to out-build the world's chip foundries, but the layer we can build today that walls off your data, so no foreign party, and no foreign nation, can follow your citizens, your patients, or your state.
European. Cloud‑native.
AI‑first.
The backend language for European digital sovereignty. GDPR, DORA, NIS2,
and the EU AI Act enforced at compile time and verified at runtime, with
article-level mapping (GDPR Art. 5 to 44, DORA Art. 5/9/10/11, NIS2 Art. 21/23).
v1.0.0-rc2: the language implementation is 1.0-grade. It self-hosts,
the full suite is green, the concurrency model is race-free and the build is locally
reproducible. The RC label is deliberate and honest: the headline goal, verifiable trust,
is mid-roadmap (Steps 2 to 7 of 12 done), so the trust claims are real: the compiler IR
now reproduces byte-for-byte across two machines and two operating systems (macOS and
Linux, manually verified 2026-07-13), with the end-to-end binary byte-identical on the
Linux box, but not yet gated by per-commit CI or externally audited. The core is capability-secure:
all authority-bearing entry points require explicit Cap<T> capabilities,
enforced unconditionally by compile error E0404. SQL, shell, URL, regex and template
injection are compile errors rather than runtime checks. The container engine is
self-contained — it pulls and runs real OCI images with no docker, podman or runc —
and Linux now boots on Kern's own hypervisor (ARM64 via Virtualization.framework on
macOS) for native macOS container development. Generics (selective monomorphization),
async on cooperative kern routines with libuv-backed IO
(spawn / spawn_thread / await),
Secure<T, State> compile-time IO governance with EU-sovereign cloud KMS,
CapTP distributed object-capability protocol,
and kern-pkg ported to Kern. All shipped. 1,042 tests at 100% pass.
272 stdlib modules with 1,961 public functions. Zero US dependencies.
import std.ai.llm as llm
async fn main():
model = llm.ollama("mistral")
prompts = [
{"role": "Summarize this document"},
{"role": "Translate to German"},
]
results = await async.all(
prompts.map(|p| model.complete(prompt: p))
)
for r in results:
print(r)Three pillars. One language.
Compliance is a type system problem. Infrastructure is a sovereignty problem. AI is a privacy problem. kern solves all three at compile time.
No US dependency.
Not today. Not in 2040.
Every byte of kern's supply chain is European. No CLOUD Act exposure. No executive order risk. GDPR is enforced at compile time. std.compliance maps every operation (collect, store, transfer, delete, encrypt) to its specific GDPR Art. 5–44, DORA Art. 5/9/10/11, and NIS2 Art. 21/23 obligation — auditor-readable. net.tls classifies cipher suites against BSI TR-02102-2. PersonalData<T> can't reach analytics, logs, or AI without consent. user.forget() implements Article 17 directly.
- Compile-time GDPR, DORA, NIS2 & EU CRA enforcement
- Zero CLOUD Act / US jurisdiction exposure
- Secure<T> — graduated protection with mlock & zero-on-drop
- Built for public sector, defense & critical infrastructure
Easier than Rust.
Deploys like Go.
kern sits in the sweet spot: Python's readability, Go's deployment model, Rust's safety guarantees, and more opinionated than all three on security and privacy. gRPC with real protobuf, HTTP/2 via nghttp2, SSH, NATS, S3 — all in the stdlib. Green threads at 100K concurrent routines. Static binaries under a millisecond cold start.
- gRPC, HTTP/2, SSH, NATS, S3 in stdlib
- OAuth2, migrations, cron, Prometheus metrics
- Sub-millisecond cold starts, static binaries
- TLS via mbedTLS, PostgreSQL, JWT in stdlib
Multi-provider LLM.
Privacy enforced by the compiler.
Built-in LLM API proxy for Claude, OpenAI, Mistral, and Ollama — multi-turn chat, token counting, SSE streaming. Qdrant vector DB client for RAG pipelines. PersonalData<T> passed to any LLM call is a compile error, with taint propagation across variable assignments. EU AI Act audit logging is automatic and cannot be disabled. BLAKE2b cryptographic event logs for tamper-proof audit trails.
- Claude, OpenAI, Mistral, Ollama in the stdlib
- Qdrant vector DB & RAG pipelines built in
- PersonalData taint propagation — PII to LLM = compile error
- BLAKE2b audit logs & EU AI Act compliance
Designed after the requirements existed.
Go, Rust, Python, and Node are governed by US corporations or foundations. They were designed before GDPR fines exceeded €4 billion, before the EU AI Act, before NIS2 made supply chain sovereignty a legal obligation. They bolt compliance on. kern compiles it in.
| Feature | Python | Go | Node.js | Rust | Kern |
|---|---|---|---|---|---|
| Readable syntax | Yes | Verbose | JS baggage | Complex | Yes |
| Single binary | No | Yes | No | Yes | Yes |
| Native async | Bolted on | Goroutines | Yes | Complex | Yes |
| Null safety | No | No | No | Yes | Yes |
| GDPR built in | No | No | No | No | Yes |
| AI native stdlib | No | No | No | No | Yes |
| Container native | No | No | No | No | Yes |
| AI agent framework | No | No | No | No | Yes |
| WASM target | No | Limited | No | Yes | Yes |
| European governed | No | No | No | No | Yes |
| Error handling | Exceptions | Values | Exceptions | Values | Values |
| Learning curve | Low | Medium | Medium | Very high | Low |
Best of Go, Rust, Python.
None of the baggage.
Type-Safe by Default
Type checker enabled on every build. Traits with Rust-model static vtables and dynamic dispatch. Secure<T> zeroes on drop, mlocks Confidential data, and blocks plaintext logging.
Traits & Algebraic Types
Trait definitions with impl blocks and Rust-model static vtables for dynamic dispatch. 9 standard traits (Display, Debug, Eq, Hash, Ord, Clone, Default, Serialize, Deserialize). Result<T>/Option<T> as first-class unions. Match guards, range patterns, and struct destructuring.
Concurrent Async Runtime
Async codegen shipped in v0.8: spawn / await on cooperative kern routines (16 KB guard-paged stack, configurable via KERN_ROUTINE_STACK_SIZE); spawn_thread routes CPU-bound work onto the libuv worker pool. Routine-aware libuv IO (file / DNS / TCP), libpq, and mbedTLS — await parks the calling routine, never an OS thread. Two spawned sleep_ms(80) tasks complete in ≈82 ms. Mark-and-sweep GC, SSE streaming, secure WebSocket (wss://), channels, Mutex, RwLock, semaphores.
Fully Bootstrapped Compiler
All 11 compiler source files self-host. 36,871 lines of Kern via LLVM. Generics shipped: selective monomorphization for stdlib hot paths (List<T>, Map<K,V>, Result<T>, Option<T>, Decimal) emitted as linkonce_odr typed wrappers; @monomorphize opt-in for user code. Module visibility (pub/private), auto-derive (Eq, Hash, Clone, Display, Debug), “Did you mean?” suggestions, DWARF debug info, kern doctor.
Integrated Toolchain
15-feature LSP (go-to-definition, references, rename, semantic tokens, inlay hints). 1,042 tests at 100% pass rate (807 conformance, 235 negative; both gates CI-blocking). 5 libFuzzer targets plus a structure-aware parser fuzzer harness (tools/fuzz_parser.sh, five mutators) waiting out its 24 h soak. ASAN/UBSAN/TSAN sanitizers in CI. Reproducible builds verified byte-for-byte identical via SOURCE_DATE_EPOCH. 6 cross-compilation targets, CycloneDX 1.5 and SPDX 2.3 SBOM, GDPR Art. 30 records.
Pipe-First & String Interpolation
Data flows left to right — readable like Python. "Hello ${name}" string interpolation, int()/float() conversions, and default field values make code concise without sacrificing clarity.
Expressive by nature.
kern's syntax reads as easily as it's written. See for yourself.
# In Python, this compiles and ships:
# analytics.track(user.email) -- GDPR violation
# send_to_ml(user.email) -- GDPR violation
# In Kern, it's a compile error:
fn send_email(user: User):
analytics.track(user.email.value)
# ERROR E0091: PersonalData<str> cannot be
# passed without a valid ConsentRecord
# The only way to use personal data:
fn send_email_safe(user: User):
email = user.email.access(
reason: "send welcome email",
consent: user.consent_record
)
analytics.track_event("signup") # OK
send(email, "Welcome!") # OKGDPR enforced by the compiler
No other language enforces GDPR at the type system level. PersonalData<T> cannot be passed to analytics, logging, or AI models without explicit consent and a documented reason. Violations are compile errors, not fines.
- PersonalData<T> tracks consent at the type level
- Every access is logged with reason and consent
- Passing PII to AI models is a compile error
- user.forget() implements GDPR Article 17
import net.http
import std.cloud.health
import std.cloud.telemetry
# A cloud-native HTTP service in 15 lines
async fn handle_user(req: http.Request) -> http.Response:
id = req.params.get("id")?
user = await db.find_user(id)?
return http.ok(user)
fn main():
server = http.Server(port: 8080)
server.get("/users/:id", handle_user)
server.with(telemetry.middleware())
server.with(health.check("/healthz"))
server.listen()Cloud-native by default
Health checks, structured logging, and distributed tracing are part of the standard library — not afterthoughts bolted on via third-party packages.
- Built-in OpenTelemetry tracing
- Kubernetes-ready health probes
- Pipe-friendly middleware composition
import std.ai.agent as agent
import std.ai.llm as llm
# AI agent with tools, memory, and privacy
# EU AI Act audit logging is automatic.
async fn main():
support = agent.Agent(
name: "support-bot",
model: llm.ollama("mistral"),
system: "You help users with kern.",
tools: [search_docs, create_ticket],
memory: agent.memory(max_turns: 50)
)
result = await support.run("How do I deploy?")?
print(result.text)
print(result.audit_log) # EU AI ActMulti-provider LLM with audit trail
Built-in LLM API proxy for Claude, OpenAI, Mistral, and Ollama. Qdrant vector DB for RAG. PersonalData passed to any LLM is a compile error — taint propagation tracks it across assignments. BLAKE2b cryptographic event logs for tamper-proof audit trails.
- Claude, OpenAI, Mistral, Ollama in stdlib
- Qdrant vector DB & RAG pipelines
- PersonalData taint propagation
- BLAKE2b audit logs & EU AI Act compliance
1.0-grade implementation.
Independently verifiable.
A real backend toolbox.
Not a language demo.
Backends need TLS, a database, an auth scheme, metrics, and config — not a roadmap. kern's standard library ships with all of them, no third-party packages required. Recently landed:
The language implementation is 1.0-grade: it self-hosts, the full suite is green (807 conformance + 235 negative, 1,042 tests at 100% pass; both gates CI-blocking), the concurrency model is race-free (thread-safe GC, ThreadSanitizer-verified) and the build is locally reproducible byte-for-byte. The release-candidate label is deliberate: the project's headline goal is verifiable trust, and that program is mid-roadmap — Steps 2 to 7 of 12 are done; cap-audit tooling, sound flow analysis, supply chain, formal proofs and the external audit remain. The conformance and negative suites are CI-blocking gates, but reproducibility is still checked by hand, not a per-commit CI gate. Reproducibility has moved past single-machine, though: the compiler IR is now byte-for-byte identical across two machines and two operating systems (all 102 .ll files match on macOS and Linux, manually verified 2026-07-13), with the end-to-end binary byte-identical on the Linux box. So the trust claims are real but not yet gated by per-commit CI or externally audited. The live TRUST.md dashboard tracks exactly what is and isn't verified; 1.0.0 final follows CI enablement and a soak. The flagship privacy claim, PersonalData<T> to AI is a compile error, now extends to every sink: display, file, database and HTTP, not just the LLM call.
Every Kern binary now seals itself, before user code runs, to a seccomp-BPF filter that permits only the syscalls its capability set grants, and that set is derived by the compiler from the program's own types. A program that never mints Cap<Net> gets a kernel that denies socket(); one that never mints Cap<Process> cannot execve. E0404 already made ambient authority a compile error; the sandbox makes the same guarantee kernel-enforced at runtime, so a later RCE cannot exceed what the type system permitted. Nothing to configure, installed with NO_NEW_PRIVS so a spawned process inherits the filter. Self-hosting survives the seal: the compiler seals itself to FS|PROCESS and still bootstraps the next generation, running clang under the inherited filter. Landlock completes the filesystem story: the seccomp gate decides whether a program may open files, KERN_SANDBOX_FS_RO/RW decide which paths, layered on the seal and a clean no-op on kernels without Landlock.
A Kern service's identity on the network is now the SHA-256 of its own reproducible binary: kern_attest_self_hash() measures the running executable, so peers recognise a service by a hash they can rebuild themselves, with no certificate authority. Ed25519-signed challenges prove liveness, capability tokens carry what a caller may ask, the compiler injects a per-call guard on RPC serve, and the server attests back in an X-Kern-Server-Attest header. The mesh is bidirectional: the token proves who is calling and what they may ask, the attestation proves which build is answering. Unset config means disabled, fully backward compatible. Forensic record-replay welds nondeterminism to the audit chain: KERN_RECORD captures every clock read and random draw to a SHA-256-chained trace, KERN_REPLAY re-executes the incident run with byte-identical inputs, and kern_replay_verify() detects a trace edited after the fact. Built for DORA/NIS2 incident reconstruction, and a debugging tool for the heisenbug class.
The container engine's full mode (host bridge, veth pairs, NAT, inter-container networking) now runs for a non-root launcher: install-caps.sh grants cap_net_admin,cap_sys_admin to the binary once, the Docker-daemon privilege model but daemonless, and every later run by any user gets full networking. True-rootless mode adds inbound port publishing, AppArmor userns profiles and cgroup delegation (box-validated on cgroups v2), and compose service DNS resolves container names in capability and rootless mode. On the TLS side, serve_tls_managed(domain, handler) is a drop-in Caddy replacement: a built-in ACME v2 client (Let's Encrypt) issues the certificate end to end, including PKCS#10 CSR generation, and auto-renews it in the background. HTTPS without a reverse proxy, a cert file, or a cron job.
http_static(prefix, dir) now actually serves files, over both plain HTTP and HTTPS (it was a no-op that recorded the mount but never read it). Content type is set by extension, index.html is served for directories, requests are GET/HEAD only, and a strict path-traversal guard rejects any .. with a 403 before a file is ever opened (verified it will not serve /etc/passwd); the TLS path was refactored around a write sink so the same implementation serves plaintext and TLS sockets correctly. persist(s) is the epoch-GC escape hatch: under request-scoped GC (KERN_HTTP_EPOCH_GC) every object allocated during an HTTP request is reclaimed at request end, so a request-derived key stored into a long-lived global map (a rate-limiter's client-IP table, a cache) would dangle; persist copies the bytes onto the permanent heap so they survive, implemented as a thread-local allocator redirect that leaves epoch and collection semantics untouched.
Two adopter-requested tools turn claims into checks. A one-line .kern-version file pins the toolchain: kern build / run / check compare it to the running compiler and print warning: kern-version-mismatch when a compiler upgrade or a stale binary drifts from what the project expects (warning-only, so it never breaks a build; CI that wants hard enforcement greps for the line). kern audit-docker <file> walks a program's full resolved import graph and reports whether it takes any Docker dependency (an import of sys.docker, which shells out to the docker CLI, or a /var/run/docker.sock reference): a clean program prints audit-docker: PASS, a Docker dependency is FLAGGED and the command exits non-zero so CI can gate on it. “Docker-free” becomes auditable: a Kern binary is native and links no Docker client.
The OWASP injection family is eliminated at the level of the grammar, not patched at runtime. Five @<kind>_literal annotations (@sql_literal, @shell_literal, @url_literal, @regex_literal, @template_literal) require the decorated argument to be a string literal at every call site, so a query or command built from user input does not type-check. A Url<Trusted, Untrusted> type-state closes SSRF for URLs built at runtime: parse_url yields Url<Untrusted>, and only trust_url(raw, allowed_hosts) promotes it after a host-allowlist check. @url_literal also rejects any literal that does not start with https://. The promise is concrete: an AST shape an attacker would need to land the bug does not exist in valid Kern source.
Injection prevention stops a query built from user input from type-checking. The typechecker now goes one step further and validates the SQL itself against your declared schema, before the program runs. A query against a table that does not exist, or a SELECT / INSERT naming a column that is not in that table, is a compile error (E0311) — not a 500 in production at 2am. The whole class of “typo in a column name” and “migration drifted from the code” bugs moves from runtime to kern build. Combined with the @sql_literal rule, a Kern SQL statement is checked for both injection safety and schema correctness at the same compile step.
The container subsystem used to shell out to a host Docker or Podman. It is now a complete OCI engine compiled into the language. It pulls and runs real images (debian:bookworm-slim, alpine:3.19) with nothing on the host but the Kern binary, a Linux kernel 5.15 or newer, and libc. No docker, podman, runc, crun, skopeo, iptables, nft or iproute2 required. HTTPS and tar extraction run in-tree (vendored mbedTLS plus a statically linked libarchive). Network setup is hand-rolled netlink (RTM_NEWLINK / NEWADDR / NEWROUTE), and outbound NAT installs an inet kern_nat nftables table directly over NFNETLINK_NFT. oci_pull_image_verified() checks a cosign-compatible Ed25519 signature and pins the manifest digest. A build gate (make check-container-no-shellout) fails if popen or system appears in the container runtime sources, and a CI leg apt-purges every shellout binary before running the suite under an strace execve tripwire.
The container engine now extends beyond Linux namespaces. On macOS, Kern boots a full Linux kernel via Apple's Virtualization.framework — ARM64 with GIC emulation, virtiofs file sharing, and virtio-console. Multi-container lifecycle works on macOS: cgroups v2, NAT networking, log capture, and port forwarding, all running inside the VM. On Linux, containers run directly via namespaces as before. Production deploys still need only the Kern binary + Linux kernel 5.15+ + libc, but development on macOS now runs real Linux containers without Docker Desktop.
All authority-bearing entry points — network, filesystem, process, FFI, environment access — now require explicit Cap<T> capabilities. Only the entry module can mint root capabilities; every other module must receive them as arguments. Compile error E0404 enforces this unconditionally. The entire conformance suite threads capabilities. Combined with the five @literal injection rules, kern's security model covers both ambient authority and injection attacks at compile time — two of the three classic attack surfaces (the third, memory safety, is mitigated by the GC and stack guards).
Generics (v0.7): selective monomorphization for stdlib hot paths — List<T>, Map<K,V>, Result<T>, Option<T>, Decimal — emitted as linkonce_odr typed wrappers so multiple compilation units share them without link conflicts; @monomorphize opt-in for user code; type-erased fallback. Async (v0.8): real spawn/await codegen, cooperative kern routines (16 KB guard-paged stack, configurable via KERN_ROUTINE_STACK_SIZE), routine-aware libuv IO (file/DNS/TCP), routine-aware libpq + mbedTLS, spawn_thread for CPU-bound work via the libuv worker pool. Two spawned sleep_ms(80) tasks complete in ≈82 ms. ABI-breaking decisions are now behind us, not ahead.
kern-pkg ported to Kern (full surface): init / build / run / test / add / remove / verify / install / publish / search / update with manifest [dependencies] / [dev-dependencies] parsing. The Python shim is gone. EU-sovereign cloud KMS providers: KERN_KMS_PROVIDER routes kms_encrypt / kms_decrypt to Scaleway (EU-native), Azure Key Vault (with AAD bearer cache), or an OVH stub; local AES-256-GCM remains the default. Chain-hashed AI audit log: every record carries prev_hash + record_hash (SHA-256 over the previous hash plus canonical body); kern_ai_audit_verify() replays the file and refuses appends if any link mismatches, and the kern ai-audit verify CLI runs that replay from the shell. This closes the EU AI Act traceability gate.
TLS & HTTPS
End-to-end encryption via mbedTLS. https_serve, https_post, and tls_gen_self_signed live in net.http. No OpenSSL, no Rustls.
PostgreSQL
First-class libpq client in db.postgres. Real connections, parameterised queries, atomic transaction batches, LISTEN/NOTIFY, and a pool with per-query timeouts and utilisation metrics — finally stop bridging through Python. SQL is schema-checked at compile time (E0311).
JWT & libsodium crypto
HS256 JWT, base64url, and production-grade crypto via libsodium — Argon2, ChaCha20-Poly1305, Ed25519, X25519, BLAKE2b. The same primitives Signal uses.
Prometheus metrics
Counters, gauges, and histograms exported in OpenMetrics text format. Scrape-ready from any kern HTTP server with one import. The DB connection pool publishes its own gauges — size, in-use, idle, and waiting — so pool saturation shows up on a dashboard, not in a postmortem. SLOs without third-party agents.
gRPC & HTTP/2
Real gRPC with protobuf wire format, verified against grpcbin Docker. HTTP/2 client via nghttp2. SSH, NATS, and S3 with AWS Sig V4 — all in the standard library.
Ed25519 signed releases
Every release binary is signed with Ed25519 via libsodium. sign_file and verify_file in the stdlib. Verifiable builds from a European supply chain.
Kern routines (green threads)
Assembly context switching with guard pages and stack pools. 100,000 concurrent routines in 133ms. Lighter than goroutines, safer than threads. Production-ready concurrency without a garbage collector.
OAuth2, migrations & cron
OAuth2 authorization flows, database migrations, background job scheduling, and cron in the stdlib. Query builder with pagination. Go-parity ecosystem features without third-party packages.
BLAKE2b audit log & DORA/NIS2
Append-only BLAKE2b chain hash with flock(2) per append, periodic fsync, and full chain re-verification on open — tamper detection plus crash safety. std.compliance maps each runtime operation to GDPR Art. 5–44 / DORA Art. 5/9/10/11 / NIS2 Art. 21/23 with consent validation, classification, and adequacy/SCC checks for cross-border transfers.
CycloneDX SBOM & EU CRA
kern sbom generates CycloneDX 1.5 JSON listing all runtime dependencies — libkern_bridge, libuv, libsodium, mbedTLS. Compliance-scanner ready for the EU Cyber Resilience Act. Stack protector (-fstack-protector-strong) enabled on all binaries.
Decimal — exact base-10
std.decimal ships a real Decimal struct on top of arbitrary-precision integers. Parse, format, add/sub/mul/div, six rounding modes (HALF_EVEN/UP/DOWN, CEILING, FLOOR, DOWN, UP), locale formatting (en_US/de_DE/nl_NL/fr_FR), currency (€/$/£), JSON round-trip. IEEE-754 floats are not acceptable for currency, taxation, or regulatory reporting — this unblocks finance and government deployment.
LLM & Qdrant resilience
Per-provider circuit breaker (opens after 5 consecutive failures, stays open 30 s, then admits a single half-open probe), bounded retry (3 attempts) with exponential backoff + jitter, JSON sanity-check on every response. Thread-safe via C11 atomics. Wraps both kern_llm_api_call and kern_qdrant_request. Production resilience, not best-effort.
Event log durability
kern_eventlog_open verifies the BLAKE2b chain before accepting any new append — refuses to open a tampered log. Each append takes an exclusive flock(2). Default fsync every 16 appends; tune with eventlog_set_fsync_interval or force with eventlog_sync. Multi-process safe, crash-safe.
SSE production polish
sse_send_heartbeat emits comment frames to keep idle connections alive across reverse proxies. sse_send_event_id writes the id: line so clients can reconnect via Last-Event-ID. Server-Sent Events that survive real network paths.
net.tls passive audit
TLS version validation, cipher suite classification (forward-secrecy / AEAD / BSI TR-02102-2), connection audit reports, strict policy enforcement (TLS 1.3 + AEAD + FS). The German Federal Office for Information Security's cipher-suite recommendations, codified in the standard library.
std.compliance article mapping
Operations (collect / store / process / transfer / delete / access / encrypt) map to specific GDPR Art. 5–44, DORA Art. 5/9/10/11, and NIS2 Art. 21/23. Consent validation, data classification (standard / sensitive / special-category), cross-border transfer checks (adequacy / SCCs), retention recommendations, audit entries — auditor-readable, not lawyer-readable. std.compliance.render_art30_register() emits a GDPR Art. 30 record-of-processing-activities document.
kern-pkg — ported to Kern
The package manager is no longer a Python shim. init / build / run / test / add / remove / verify / install / publish / search / update all run on Kern. Manifest [dependencies] / [dev-dependencies] parse into a typed List<Dependency>. Lockfile read/write with chain-integrity verify. Closes the toolchain self-hosting gate.
EU-sovereign cloud KMS
Secure<T, State> with KERN_KMS_PROVIDER env routing to Scaleway (EU-native, fr-par/nl-ams) or Azure Key Vault (with AAD bearer-token caching). OVH stub awaits real-account exercise. Local AES-256-GCM via mbedTLS remains the default. The compile-time IO-sink check rejects Secure<_, Plain> flowing into db_* / http_* with a clear diagnostic.
Self-contained container engine
oci_run_image() pulls and runs real OCI images (debian, alpine) with nothing on the host but the Kern binary, a Linux kernel 5.15+, and libc. No docker, podman, runc, skopeo, iptables or iproute2. Namespaces + cgroup v2 + overlayfs + pivot_root for isolation, hand-rolled netlink and native nftables NAT for networking, all in-tree. oci_pull_image_verified() checks a cosign-compatible Ed25519 signature and pins the manifest digest. A source-level build gate refuses any popen or system shellout in the runtime.
Capability-secure core (E0404)
All authority-bearing entry points — network, filesystem, process, FFI, environment — require explicit Cap<T> capabilities. Only the entry module can mint root capabilities; every other module must receive them as arguments. Compile error E0404 enforces this unconditionally. 9 capability modules: cap_net, cap_fs, cap_db, cap_process, cap_ai, cap_container, cap_kms, cap_random, cap_time.
CapTP — distributed capabilities
Object-capability transfer protocol for distributed systems. 7 modules: codec, in-process transport, message framing, network layer, promise pipelining, vat state management, and Ed25519 signed gift tokens. Capability security that extends across network boundaries — not just within a single process.
Kern hypervisor (macOS)
Linux boots on Kern's own hypervisor — ARM64 via Apple's Virtualization.framework with full GIC emulation, virtiofs file sharing, and virtio-console. Multi-container lifecycle works on macOS without Docker Desktop: cgroups v2, NAT networking, log capture, and port forwarding inside the VM. container_run_image on macOS now runs real Linux containers.
Chain-hashed AI audit log
Every record carries prev_hash + record_hash (SHA-256 over the previous hash + canonical body). On open, kern_ai_audit_verify() replays the file and refuses appends if any link mismatches. The event-log verifier also recomputes each record's hash from seq | ts | type | data | prev_hash and rejects tampered payloads even when the chain link is kept consistent. Tamper-evident by construction — closes the EU AI Act gate.
Generics — selective monomorphization
Stdlib hot paths — List<T>, Map<K,V>, Result<T>, Option<T>, Decimal — emit monomorphized typed accessors as linkonce_odr, so multiple compilation units share them without link conflicts. Generic call sites compile to the monomorphized typed wrappers when available; type-erased path is the fallback. @monomorphize annotation is the opt-in marker for user-level generics.
Async — spawn, await, spawn_thread
Direct spawn f(args...) synthesizes a per-call-site wrapper plus kern_async_coro_spawn. await <task> calls kern_async_coro_await and unboxes the typed return. Bodies run on cooperative kern routines (16 KB guard-paged stack, configurable). await from inside a routine parks it on the awaitee — no OS thread held during suspension. kern_sleep_ms and routine-aware libuv file/DNS/TCP IO yield cooperatively. spawn_thread routes CPU-bound work onto the libuv worker pool. Two spawned 80 ms tasks complete in ≈82 ms.
Parser fuzzer harness
tools/fuzz_parser.sh <seconds> runs a corpus-mutating, structure-aware driver over tests/conformance/*.kern with five mutators (bit flip, insert, delete, truncate, token splice). Smoke run: 521 iterations / 0 crashes / 0 timeouts in 120 s. CI gate command for v1.0: tools/fuzz_parser.sh 86400 — the 24 h soak is the one remaining code-side gate.
Resilience hardening
LLM proxy: 60 s socket timeout (SO_RCVTIMEO/SO_SNDTIMEO) on the shared HTTPS-with-headers path, layered on the per-provider circuit breaker + 3-attempt retry + jitter. Qdrant client: 30 s socket timeouts + kern_qdrant_health() readiness/liveness probe. WebSocket: stdlib connect_with_backoff() (200 ms base, doubling, capped at 30 s, ±25% jitter) + send_resilient(). Event log: fcntl exclusive lock per append + tunable fsync interval.
Faster than Go, Node, and Python.
On these five workloads.
Five backend workloads. Same algorithm, same data sizes, only the standard library of each language. No JIT pre-warming, no micro-tuning, and Go runs as a native arm64 binary — no emulation handicap. kern takes all five against Go, Node.js, and Python. These are micro-benchmarks, not real-world applications — but they measure what the stdlib actually ships. The hash benchmark compares kern's BLAKE2b (software) against Go's hardware-accelerated SHA-256; both are what the stdlib gives you by default. Methodology and reproducible runner are in the repo.
| Workload | kern | vs Go | vs Node.js | vs Python |
|---|---|---|---|---|
| Fibonacci recursive, n=35 | 54 ms | 1.5× faster | 1.9× faster | 16× faster |
| JSON encode 100k iterations | 29 ms | 2.9× faster | 1.8× faster | 6.3× faster |
| Hash 1M iterations, BLAKE2b vs SHA-256 | 261 ms | 1.2× faster | 1.7× faster | 1.4× faster |
| File I/O 10k write+read cycles | 504 ms | 1.1× faster | 1.1× faster | 1.2× faster |
| HTTP 1k sequential GETs | 154 ms | 1.4× faster | 1.5× faster | 1.2× faster |
~9,000 requests/second sustained at 100-way concurrency, with zero failures across 50,000 requests (measured with ab). Backed by libuv — the same event loop that powers Node.js.
Single run preceded by a discarded warm-up, single machine (macOS arm64, Apple Silicon), wall-clock milliseconds, release builds. Go is a native arm64 binary (Go 1.26); Node 22, Python 3.11. The CPU rows are single-process and single-core; run-to-run variance on a laptop is ±5–15%. Hash compares kern's BLAKE2b (libsodium, software) against each stdlib's SHA-256 — on arm64 that means Go gets hardware acceleration while kern does not, yet BLAKE2b's algorithmic advantage still leads. Micro-benchmarks are not real workloads; these numbers are signals, not proof. The runner skips any toolchain that isn't installed. Re-run the suite yourself with ./benchmarks/run_all.sh. Last measured 2026-06-20.
Up and running in seconds.
Install kern
$ curl -fsSL https://kern-lang.eu/install.sh | bashCreate a project
$ kern new my-service
Created project `my-service` in ./my-service
$ cd my-serviceRun it
$ kern run
Compiling my-service v1.0.0-rc2
Finished in 0.08s
Running `target/release/my-service`
Server listening on :8080European infrastructure.
No US jurisdiction. Period.
Every component of kern's toolchain is hosted, governed, and operated in Europe. No CLOUD Act. No FISA 702. No executive order can compel access to your supply chain. This is the foundation for sovereign digital infrastructure that outlasts any political cycle.
| Component | Provider | Country |
|---|---|---|
| Source code | Codeberg | Germany |
| Package registry | pkg.kern-lang.eu (OVH/Scaleway) | France |
| CI/CD | Woodpecker | Germany |
| Domain & DNS | TransIP | Netherlands |
| Static hosting | Codeberg Pages | Germany |
| Default cloud LLM | Mistral | France |
| Default vector DB | Qdrant | Germany |
| Default local LLM | Ollama | Open source |
Built for the institutions
that define Europe's future.
Kern is for
- EU institutions and member state agencies building sovereign digital infrastructure
- Critical infrastructure operators under NIS2 — energy, transport, health, water
- Central banks, financial market infrastructure, and DORA-regulated institutions
- Defense and intelligence services requiring sovereign, auditable tech stacks
- Enterprise teams deploying AI agents where PII leakage is a regulatory risk
Kern is not for
- Data scientists who need NumPy and pandas — use Python
- Systems programmers building operating systems — use Rust
- Teams with ten years of Go investment — switching has a cost
- Projects that need Windows support — kern targets Linux and macOS
Sovereign infrastructure
for the next decades.
If your institution needs software that no foreign jurisdiction can compel, surveil, or shut down, kern is the backend language where European sovereignty is compiled in. v1.0.0-rc2 is a 1.0-grade implementation (self-hosting, full suite green, race-free, reproducible) on the way to verifiable trust: 1,042 tests at 100% pass, capability-secure core with compile error E0404 for ambient authority, a capability-derived seccomp sandbox so the kernel enforces at runtime exactly the authority the type system granted, injection prevention as a compile error, a self-contained container engine with its own hypervisor that needs no docker or podman and now runs without root, generics + async + Secure<T, State> on a stable ABI, EU-sovereign cloud KMS, chain-hashed AI audit log, CapTP distributed capabilities, multi-provider LLM with circuit breakers, Qdrant with health probes, DORA/NIS2 runtime compliance, CycloneDX 1.5 and SPDX 2.3 SBOM, GDPR Art. 30 records. 272 stdlib modules, 1,961 public functions. Zero US dependencies. Production infrastructure for the institutions that define Europe's future.
Please Donate
kern is open source and community-funded. Your donation helps keep development independent and European.
3HcHaeq9gYrxxLqzbpBSuy3e6cGAw6GwZc
