Releases

The engineering log

Newest first. This is the full record behind the claims on the home page, including the audits that found our own bugs. Findings are named rather than hidden, and corrected when they turn out to be wrong.

1. On main since rc2

   Nine typechecker holes closed, three machine-checked proofs, and a cloud control plane

   A parallel bug hunt found nine expression positions where the typechecker never called check_expr at all.

2. SMP guests, scoped Cap<Fs>, generational GC, and a fail-closed security sweep

   Four threads of work landed in the same week.

3. The control plane a sovereign cloud needs, written as pure functions

   Four modules landed that turn kern from a language you deploy onto a cloud into one you can build a cloud out of, and they share a design decision…

4. A multi-tenant microVM platform written in Kern, from KVM up

   The isolation story went from a proof of concept to a multi-tenant platform in one wave.

5. The docs are a contract, so they get audited like code, and one audit found an auth bypass

   An adopter put it plainly: the documentation is what actually gets read, so a document promising a capability the code does not deliver is a false…

6. The compiler got about three times faster, and the collections about four

   Compile throughput was profiled end to end and three root causes fell out, each fixed without a rewrite.

7. A toolchain an agent can drive, and MCP with injection safety at compile time

   Kern is now addressable by code-generating models as a first-class consumer.

8. BLE and a complete BLE Mesh stack, in pure Kern, verified on hardware

   Kern reaches the device tier without a C dependency.

9. Post-quantum crypto, workload identity, and the Go 1.25 gap closed

   The standard library grew from 303 modules to 354, and from 2,219 public functions to 2,982, in three deliberate directions.

10. Coverage measured by name, and what it found was failing open

    Test coverage was being measured the flattering way.

11. A resource ceiling on every remote input, and compliance that actually persists

    A sustained hardening wave gave the runtime a ceiling wherever a remote peer chooses the cost.

12. The trust roadmap moved from claims to gates

    The July trust push turned the “real but manually verified” caveats into blocking CI jobs.

13. Three taint tags, race detection and overflow checks in the type system

    Secret is now a first-class compile-time taint tag alongside PersonalData<T> (E0302) and Untrusted<T> (E0303): a secret reaching any sink that does…

14. TLS on every transport, cap-gated mail, real-time SIEM

    The data-confidentiality track is complete: all five network transports now do TLS.

15. The language-security audit, solved at the root

    Five independent audits of the language itself were folded into one ranked register (docs/design/language-security-hardening-2026-08.md), which…

16. The type system is the seccomp profile

    Every Kern binary now seals itself, before user code runs, to a seccomp-BPF filter that permits only the syscalls its capability set grants, and…

17. Object-capability mesh and forensic record-replay

    A Kern service's identity on the network is now the SHA-256 of its own reproducible binary: kern_attest_self_hash() measures the running executable…

18. Rootless containers and managed TLS

    The container engine's full mode (host bridge, veth pairs, NAT, inter-container networking) now runs for a non-root launcher: install-caps.sh grants…

19. Containerisation milestone

    Linux boots on Kern's hypervisor

    The container engine now extends beyond Linux namespaces.

20. Hardening milestone

    Capability-secure core (compile error E0404)

    All authority-bearing entry points: network, filesystem, process, FFI, environment access: now require explicit Cap<T> capabilities.

21. Generics + async

    Landed on a stable ABI

    Selective monomorphization for stdlib hot paths: List<T>, Map<K,V>, Result<T>, Option<T>, Decimal: emitted as linkonce_odr typed wrappers so…

22. Also shipped

    Kern-pkg, cloud KMS, chain-hashed audit

    init / build / run / test / add / remove / verify / install / publish / search / update with manifest [dependencies] / [dev-dependencies] parsing.