The kern blog
Release announcements, technical deep-dives, and project updates.
kern v1.0.0-rc2, reproducible across two machines
rc2 is the second release candidate, cut to drive the tag-release pipeline end to end so registry artifacts are built by CI, not by hand, and to carry the fixes accumulated on main since rc1 into one coherently-versioned build. It also moves the trust story: reproducibility is no longer single-machine. The compiler IR is now byte-for-byte identical across two machines and two operating systems (macOS and Linux, manually verified), with the end-to-end binary byte-identical on the Linux box. Three practical features land too: http_static now actually serves files over HTTP and HTTPS with a strict path-traversal guard, persist() is the epoch-GC escape hatch for long-lived global state, and adopter tooling adds .kern-version toolchain pinning and a kern audit-docker Docker-independence attestation. 1,014 tests at 100% pass, 272 stdlib modules, 1,961 public functions.
Read morekern v1.0.0-rc1, and what the label means honestly
The version jumps to 1.0.0-rc1, and both halves of that label are deliberate. The language implementation is 1.0-grade: it self-hosts, the full suite is green (768 conformance + 241 negative, 1,009 tests at 100% pass), the concurrency model is race-free (thread-safe GC, ThreadSanitizer-verified), and the build is locally reproducible byte-for-byte. The release-candidate label is just as deliberate: the headline goal is verifiable trust, and that program is mid-roadmap (Steps 2 to 7 of 12 done), so the trust claims are real but single-machine, not yet independently verified. SQL is now schema-checked at compile time (E0310/E0311/E0312), the GC is race-free, and the Go-parity stdlib spine (std.bytes, std.buf, std.iostream) lands. 110 stdlib modules, 1,270 public functions.
Read morekern v0.9.0-rc3, the engine moves inside the language
Two stability candidates landed after rc1. rc2 turns the OWASP injection family into a syntactic category: SQL, shell, URL, regex and template injection are compile errors via five @literal annotations and a Url<Trusted, Untrusted> type-state, and Secure and PersonalData now ban every sink. rc3 makes the container engine self-contained: it pulls and runs real OCI images with no docker, podman, runc or iptables on the host, using in-tree HTTPS, hand-rolled netlink and native nftables NAT, with cosign signature verification and a build gate that refuses any shellout. 994 tests at 100% pass. 17 of 21 v1.0 gates closed.
Read morekern v0.9.0-rc1 — the stability candidate
Code-side, every v1.0 ROADMAP gate is closed or has its harness shipped. Generics (selective monomorphization), async on cooperative kern routines with libuv-backed IO (spawn / spawn_thread / await), Secure<T, State> with EU-sovereign cloud KMS (Scaleway, Azure, OVH stub), kern-pkg ported to Kern (full surface), native OCI container runtime, OCI Distribution Spec v2 client, and a SHA-256 chain-hashed AI audit log all land here. 16 of 20 v1.0 gates closed; the four remaining are calendar / governance, not code. 901 tests at 100% pass.
Read moreOn main — generics, cooperative async, Secure<T>, native OCI
The preview that traced the path from v0.6 to v0.9.0-rc1: selective monomorphization for stdlib generics, real spawn/await codegen on cooperative kern routines with libuv-backed IO, the Secure<T, State> type-state, native OCI container runtime, and the kern-pkg port to Kern. All shipped in the v0.9.0-rc1 release post above.
Read morekern v0.6.0 — Decimal, durable event log, LLM resilience
The hardening release. Six items moved from the v1.0 list to shipped: a real Decimal type that unblocks finance and government deployment, a per-provider circuit breaker on the LLM proxy and Qdrant client, an event log with flock+fsync and chain re-verification, SSE heartbeat with Last-Event-ID reconnect, and BSI TR-02102-2 cipher classification in net.tls.
Read more