A toolchain an agent can drive, and MCP with injection safety at compile time

Kern is now addressable by code-generating models as a first-class consumer. kern check --json and kern build --json emit exactly one JSON object on stdout with the same diagnostic schema (severity, E-code, message, file, line, column, hint), covering the whole build path: import resolution, typecheck, IR streaming, the cross-link refusal and the clang link. kern fix closes the loop by applying the mechanical repairs an agent should not have to reason about, starting with the typechecker's own “Did you mean?” renames; it is safe by construction, re-verifying that the bad token is still exactly at the recorded position before writing and applying edits bottom-up so a same-line fix never shifts a pending column.

A generated llms.txt bundle gives a model the whole language surface in one file, counts pulled from source. On the protocol side, three new modules implement Model Context Protocol server and client over JSON-RPC 2.0, and they close the injection hole that MCP normally leaves open: tool arguments arrive as Untrusted<str> and tool results return as Untrusted<str>, so a handler that feeds model-provided input into SQL, shell, HTTP or a file without validating it does not compile (E0303).

The same rule now applies to the model itself: ai_complete, ai_api_call and ai_chat return Untrusted<str>, because LLM output is adversarial input by definition, and every wrapper above them propagates the taint. That is the compile-time axis; the runtime axis is a WAF prompt-injection detector covering 27 patterns in five families (instruction override, role hijack, system-prompt extraction, delimiter injection, jailbreak). The language surface grew to match: select over channels with recv, timeout and default arms, which was the largest concurrency gap against Go, plus else if, real atomic sub/and/or/compare-swap, string interpolation over any expression rather than bare identifiers, and main(args) receiving argv.

And kern new api <name> now scaffolds a service that actually works: health and root routes on :8080, compiling to a roughly 115 KB binary that answers curl out of the box, on macOS and Linux.