axon-lang

<p align="center">
  <strong>AXON</strong> <em>v4.4.0</em><br>
  Axon is the Cognitive Runtime for Enterprise Software.<br><br>
  Build AI systems with deterministic execution, formal guarantees and
  native cognitive primitives.
</p>

<p align="center">
  <a href="https://www.ricardovelit.com/axon-docs"><img src="https://img.shields.io/badge/docs-ricardovelit.com%2Faxon--docs-blue" alt="Documentation"></a>
  <img src="https://img.shields.io/badge/version-v4.4.0-informational" alt="Version">
  <img src="https://img.shields.io/badge/status-production-brightgreen" alt="Status: Production">
  <img src="https://img.shields.io/badge/runtime-100%25%20Rust%20%2B%20C23-orange" alt="100% Rust + C23">
  <img src="https://img.shields.io/badge/streaming-SSE%20%7C%20NDJSON%20%7C%20WebSocket-brightgreen" alt="Streaming">
  <img src="https://img.shields.io/badge/realtime-session--typed-purple" alt="Session types">
  <img src="https://img.shields.io/badge/tests-5700%20axon--lang%20%2B%201725%20frontend-brightgreen" alt="Tests">
  <img src="https://img.shields.io/badge/compliance-%CE%9A%20%3D%2015%20classes%20%C2%B7%20compile--time-blueviolet" alt="Compliance">
  <img src="https://img.shields.io/badge/audit-SOC2%20%7C%20ISO27001%20%7C%20FIPS%20140--3%20%7C%20CC%20EAL4%2B-9cf" alt="Audit frameworks">
  <img src="https://img.shields.io/badge/persistence-postgresql-blue" alt="PostgreSQL">
  <img src="https://img.shields.io/badge/observability-tracing-green" alt="Tracing">
  <img src="https://img.shields.io/badge/license-AGPL--3.0--or--later-lightgrey" alt="License">
</p>

<details>
<summary align="center"><strong>Primitive census</strong> — every language construct advertised here is a <em>build input</em>: the compiler's anti-drift gate (<code>axon-frontend/src/advertised.rs</code>) parses this block at test time and fails the build unless each badge carries a human-attested statement of what its runtime actually does.</summary>

<p align="center">
  <!-- Cognition primitives -->
  <code>persona</code> · <code>intent</code> · <code>flow</code> · <code>reason</code> · <code>anchor</code> · <code>refine</code> · <code>memory</code> · <code>tool</code> · <code>probe</code> · <code>weave</code> · <code>validate</code> · <code>context</code> · <code>step</code> · <code>run</code><br>
  <code>know</code> · <code>believe</code> · <code>speculate</code> · <code>doubt</code> · <code>par</code> · <code>hibernate</code><br>
  <code>dataspace</code> · <code>ingest</code> · <code>focus</code> · <code>associate</code> · <code>aggregate</code> · <code>explore</code><br>
  <code>type</code> · <code>json</code> · <code>ledger</code><br>
  <code>deliberate</code> · <code>consensus</code> · <code>forge</code> · <code>agent</code> · <code>shield</code><br>
  <code>savant</code> · <code>synth</code> · <code>warden</code> · <code>scope</code><br>
  <code>stream</code> · <code>effects</code> · <code>@contract_tool</code> · <code>@csp_tool</code><br>
  <code>effect</code> · <code>handle</code> · <code>perform</code><br>
  <code>pix</code> · <code>navigate</code> · <code>drill</code> · <code>trail</code> · <code>corpus</code><br>
  <code>psyche</code> · <code>ots</code><br>
  <code>mcp</code> · <code>mandate</code> · <code>lambda</code><br>
  <code>budget</code> · <code>window</code> · <code>cors</code> · <code>document</code> · <code>deliver</code> · <code>notify</code><br>
  <code>credential</code> · <code>mint</code> · <code>rotate</code><br>
  <code>compute</code> · <code>grad</code> · <code>quant</code> · <code>observable</code><br>
  <code>extension</code> · <code>witness</code><br>
  <code>daemon</code> · <code>listen</code><br>
  <code>channel</code> · <code>emit</code> · <code>publish</code> · <code>discover</code><br>
  <code>axonendpoint</code> · <code>axpoint</code> · <code>axonstore</code><br>
  <!-- Cognitive I/O & compliance (λ-L-E calculus, Phases 1–9) -->
  <strong>Cognitive I/O:</strong>
  <code>resource</code> · <code>fabric</code> · <code>manifest</code> · <code>observe</code> ·
  <code>reconcile</code> · <code>lease</code> · <code>ensemble</code><br>
  <code>topology</code> · <code>session</code> · <code>send</code> · <code>receive</code> · <code>select</code> · <code>branch</code> ·
  <code>immune</code> · <code>reflex</code> · <code>heal</code> ·
  <code>compliance</code><br>
  <code>component</code> · <code>view</code><br>
  <!-- Enterprise I/O capabilities (v2.37.0–v2.40.0) -->
  <code>cache</code> · <code>voice</code> · <code>shell</code> · <code>path rewrite</code> · <code>PASETO</code><br>
  <!-- NEW — Session-typed WebSocket dialogue (v2.3.0) -->
  <strong>Session types (v2.3.0):</strong>
  <code>socket</code> · <code>upstream</code> · <code>send T</code> · <code>receive T</code> · <code>select {ℓᵢ:…}</code> · <code>branch {ℓᵢ:…}</code> · <code>backpressure: credit(k)</code> · <code>reconnect: cognitive_state</code>
</p>

**Unwired — advertised, and not yet reachable.** Three of the badges
above name a primitive whose engine exists and passes its own tests, and which
**no published program can reach**: nothing calls it. They are listed in the
compiler's `KNOWN_DEBT` ratchet, which may only shrink, so this list cannot grow
quietly:

| primitive | the engine that exists | what is missing |
|---|---|---|
| `cache` | `cache_runtime` — content-addressed keys, single-flight, TTL with jitter, LRU, errors never cached | the call site. `backend:`, `ttl:`, `key_params:` and `invalidate_on:` are inert; **nothing is memoised** |
| `savant` | an HRR codec, a VFE/EFE active-inference engine, and a Betti/PHC topology engine | dispatch. `cognition.depth:` is validated at compile time and read by nothing at runtime |
| `synth` | the deny-by-default OSS reference, which refuses by design | a mount point. Note the honest ceiling: wiring it in OSS yields a *refusal*, not execution — synthesised code runs only in the enterprise sandbox |

This table exists because the alternative is worse. `cache` was attested as
working until v2.89.0 measured it, on a citation that named a compile-time property
as evidence of a runtime — so the state `Unwired` was added to the gate, and it
owes a ledger entry exactly like an unimplemented promise does. A ledger that
stays empty because a row is mislabelled is worth less than one that admits
three.

</details>

---

> **Two repositories, two version lines.** This repo (`axon-lang`,
> AGPL-3.0-or-later, public) ships the **language + runtime + compiler + 7 LLM
> backends + Cognitive I/O + WebSocket session types** — currently **v4.4.0**.
> The commercial control plane (`axon-enterprise`, EULA, private) layers
> multi-tenant identity / RBAC / SSO / metering / audit / vertical compliance
> **on top of** this language via a pinned Cargo dependency — currently
> **v4.x**. The version numbers diverge by design (enterprise iterates on
> the SaaS surface independently of the language). If you don't run a
> commercial Axon deployment, this repo is all you need; the badge above is
> the only version that matters for you.

---

## What is AXON?

AXON is a **compiled language** that targets LLMs instead of CPUs. It has a
formal EBNF grammar, a lexer, parser, AST, intermediate representation, **seven
native Rust LLM backends** (Anthropic, OpenAI, Gemini, Kimi, GLM, Ollama,
OpenRouter), and a 100% Rust + C23 native runtime with semantic type checking, an
algebraic-effects execution engine, real-time SSE / NDJSON / WebSocket
session-typed streaming, retry + circuit-breaker resilience, and execution
tracing. The FIPS-routable cryptographic + tokenisation kernels live in
[`axon-csys`](axon-csys/) as standalone C23 (no opaque C bindings — every
kernel is a `_Generic`-dispatched, `[[nodiscard]]`-annotated, sanitizer-clean
C23 source file with a Rust wrapper).

Beyond cognition, AXON ships **Cognitive I/O** — a λ-calculus-based
infrastructure layer where resources, control loops, observability, security
kernels, and UI components carry their regulatory class as a **compile-time
type**, drawn from a **closed vocabulary Κ of 15 classes**: HIPAA, PCI_DSS,
GDPR, SOX, FINRA, ISO27001, SOC2, FISMA, GxP, CCPA, NIST_800_53, and — since
v4.0.0 — Brazil's LGPD, Mexico's LFPDPPP and NOM151, Colombia's LEY1581. An
unknown label is a **compile error** with a one-edit suggestion
(`axon-T1214`: `[HIPPA]` is refused, `HIPAA` is suggested). FIPS 140-3 and
CC EAL 4+ are *audit frameworks* the evidence
engine targets — deliberately **not** members of Κ: κ classifies what data
*is*; a framework is what the implementation is *audited against*. Programs
that fail coverage are rejected *before* they run. No other programming
language does this.

**v2.3.0 adds the first session-typed real-time dialogue primitive in
any production language**: declare a `session` (the bidirectional protocol),
bind it to a `socket` (the WebSocket transport with credit-refined
backpressure), and the compiler proves the two endpoints are duals
(Caires–Pfenning linear-logic Curry–Howard); the runtime enforces every step,
seals the residual cursor on disconnect for typed reconnection, and projects
to W3C Server-Sent Events when the protocol is single-polarity. See
[`papers/paper_websocket_cognitive_primitive.md`](papers/paper_websocket_cognitive_primitive.md).

It is **not** a Python library, a LangChain wrapper, a YAML DSL, or a Terraform
replacement. It is a *new kind of calculus* — see
[`papers/paper_lambda_lineal_epistemico.md`](papers/paper_lambda_lineal_epistemico.md)
for the formal semantics (Cálculo Lambda Lineal Epistémico).

---

## Cognitive I/O — Build Infrastructure with Compile-Time Compliance

The big differential added in v1.0 — ten new top-level declarations that turn
AXON into the only language where *"does this app leak PHI?"* is a **type
error**, not a post-mortem finding.

| Primitive | What it is | Formal backing |
|---|---|---|
| `resource`  | Infrastructure token (DB, cache, bucket, GPU) with `linear` / `affine` / `persistent` lifetime | Linear Logic (Gi