# kern 1.0.0 > The release line is stable, releases are signed, and the clock became a capability. Source: https://kern-lang.eu/releases/1.0.0 The release line is stable, releases are signed, and the clock became a capability October 3, 2026 ## Release notes ## v1.0.0, and what the label means The first stable release, tagged 2026-10-03\. The language **implementation is 1.0-grade**: it self-hosts, the full suite is green (**1,423 conformance + 403 negative, 1,826 tests at 100% pass**; both gates CI-blocking), the concurrency model is race-free (thread-safe GC, ThreadSanitizer-verified, ASan/UBSan-gated) and the build is reproducible byte-for-byte. ### The surface is frozen `docs/stability.md` enumerates what 1.0 promises: the grammar, type system, taint rules and capability model, every `pub fn` in the stdlib index, the CLI and its `--json` schemas, the `kern.toml` keys. A removal takes a full deprecation cycle: `@deprecated` in a minor release, warning **W0004** at every call site for the rest of the major line, removal only in 2.0, and `kern fix` performs the drop-in migrations mechanically. The systems surface a hypervisor builds on (`std.cap_vm`, `std.cap_unsafe`, `std.arena`, `std.dma`, `std.irq`) is locked in `docs/systems-surface.lock`, and a changed line without a recorded reason is a red gate. ### A release is a signed tag that builds from source Tags are signed with a key whose public half is pinned in the repository; the release job refuses to publish from a tag that does not verify; artefacts (the C runtime bundle and the Windows launcher) are signed offline with a second pinned key. No compiler binary is published by any route, because for a compiler a downloaded binary is exactly the Trusting-Trust threat the toolchain exists to remove; the Homebrew tap is the repository itself, so there is no second copy of the formula to fall behind. The project's headline goal is **verifiable trust**, and that programme is at ten of eleven steps. Deterministic compiler IR (Step 3), the reproducible end-to-end binary (Step 4), the independent bootstrap path (Step 5) and the diverse double-compilation gate (Step 6) are **per-commit CI gates**. `kern audit-caps` makes the audit surface the capability grants, not the code (Step 8). The verifiable supply chain (Step 10) is closed on all four sub-claims. Capability enforcement, the lexer bisimulation and flow-analysis soundness are **machine-checked** in Rocq with zero admits (Step 11), re-checked per commit. What 1.0 does _not_ claim, named rather than left to be found: the proofs are about _models_. The lexer model is now measured against the shipped lexer on every file in the tree, and the taint model is extracted and judged beside `kern check` on generated programs (300 of 300 agree); for the capability model the evidence that the compiler implements it is still the probe grid and the negative suite, not a mechanised link. Step 12, the independent external audit, was removed from the plan on 2026-09-19 and is taken up when ready. Performance is not at Go's on every benchmark cell; the per-cell matrix and ceilings are in `docs/design/performance-to-go-parity.md`. The live `TRUST.md`, `ROADMAP.md` and `docs/threat-model.md` track exactly what is and is not verified. The flagship privacy claim, `PersonalData` to AI is a compile error, extends to every sink: display, file, database and HTTP, not just the LLM call. ## v1.0.0: the release line is stable, releases are signed, and the clock became a capability Around the 1.0.0 tag the type system tightened in four places, two of them found by the project's own formal models. Two of the four are in the tag (the clock capability and per-type generics); the other two, E0331 and the trait-bound fix, landed on `main` on 2026-10-04, the day after, together with the PersonalData runtime fixes, and ship in 1.0.1. ### Implicit flow is E0331 The shipped checker accepted `if secret: out = "a"` followed by `print(out)`, for two reasons each sufficient on its own: `pd == q` typed as a plain `bool` (the operator dropped the tag), and there was no program counter. The machine-checked taint model, extracted to OCaml and run beside `kern check` on 300 generated programs, disagreed on 83 of them, every one an implicit flow. Now an operator's result carries every tag of its operands, `if`/`elif`/`else`, `while`, `match` arms and a `for` over a tagged iterable run under a program counter, and under a tagged pc a write to an untagged variable, a call to an effectful function, a `spawn`, an untagged `return` or a `break` out of an untagged loop is refused. Measured across all 2,352 files in the tree: seven new diagnostics, all real; 300 of 300 and 2,000 of 2,000 generated programs now agree. ### The clock is authority `time_now_ms`, `time_now_seconds` and `time_sleep_ms` take `Cap