OPEN SOURCE — MIT

VAREK
————

AI PIPELINE PROGRAMMING LANGUAGE

One language for every stage of the AI pipeline. Faster than Python. Safer than C. More expressive than anything in between.

Verified before the first action. Enforced at the kernel.

READ THE v1.9.2 RELEASE NOTES → SEE THE SYNTAX
10–40×
FASTER THAN PYTHON
ZERO
MEMORY UNSAFETY
ONE
UNIFIED SYNTAX
MIT
OPEN SOURCE
// SYNTAX

Replace four tools
with one language.

Today's ML pipelines stitch together Python, YAML, JSON, and shell scripts. VAREK replaces all of it.

● VAREK
-- Schema, pipeline, and logic in one file
schema ImageInput { 
  path:   str, 
  label:  str?, 
  width:  int, 
  height: int 
} 

pipeline classify_images { 
  source: ImageInput[] 
  steps:  [preprocess -> embed -> infer] 
  output: ClassResult[] 
} 

fn preprocess(img: ImageInput) -> Tensor { 
  load_image(img.path) 
    |> resize(224, 224) 
    |> normalize(mean=[0.485, 0.456]) 
} 

async fn infer(t: Tensor) -> ClassResult { 
  let model = load_model("resnet50.synmodel") 
  model.forward(t) 
}
● TODAY'S EQUIVALENT
# schema.json + config.yaml + pipeline.py + run.sh

# --- schema.json ---
{ 
  "type": "object", 
  "properties": { 
    "path": {"type": "string"}, 
    "label": {"type": "string"} 
  }
} 

# --- pipeline.py ---
from torchvision import transforms 
from PIL import Image 
import torch, yaml, json, subprocess 

def preprocess(img_path): 
  t = transforms.Compose([ 
    transforms.Resize((224, 224)), 
    transforms.ToTensor(), 
    transforms.Normalize([0.485, 0.456]) 
  ]) 
  return t(Image.open(img_path)) 

async def infer(tensor): 
  model = torch.load("resnet50.pt") 
  model.eval() 
  with torch.no_grad(): 
    return model(tensor.unsqueeze(0))
// FEATURES

Built for the AI era.
Not retrofitted for it.

Native Speed
Compiles to native machine code via LLVM. Interpreted mode for prototyping, compiled mode for production. 10–40× faster than equivalent Python.
LLVM BACKEND
🛡
Memory Safety
Static typing with full inference. Null safety enforced at compile time. No buffer overflows. No silent failures. Errors are values, not exceptions.
COMPILE-TIME SAFETY
🧠
AI-Native Primitives
Built-in tensor and matrix types. Native async/await for model inference. Pipeline operators for composing model chains without boilerplate.
TENSOR<T, DIMS>
🔗
Unified Syntax
The same file defines schemas, logic, pipelines, and config. No format translation. No context switching between YAML, JSON, Python, and shell.
ONE FORMAT
🔄
Python Interop
Import any Python, C, or Rust library natively. Migrate incrementally. You don't have to abandon your existing ecosystem to adopt VAREK.
FFI SUPPORT
🌐
LLM-Legible Grammar
Deterministic, unambiguous grammar designed for human and AI collaboration. The first language built knowing that LLMs will read and write it.
AI-FIRST DESIGN
// ROADMAP

From spec to verified.

v0.1 - v1.0
Core Language
Compiler backend, LLVM compilation, Hindley-Milner type inference, standard library (261 functions), package manager. Stable at v1.0.
COMPLETE ✓
v1.1 - v1.3
Warden Layer & Policy Control
Kernel-enforced containment, fail-closed semantics, seccomp-unotify integration binding the policy evaluator to the Linux syscall boundary, and a unified policy format.
COMPLETE ✓
v1.4 - v1.5
Production Warden & Fast-Path Decisions
Production-grade supervisor in C with full kernel-level enforcement (cross-process memory extraction, in-kernel verdict injection, latency measurement), plus a hybrid fast-path matcher for the common case with a decision-procedure slow path for richer policy classes.
COMPLETE ✓
v1.6
Pre-Execution Plan Verification
The agent's entire planned action-graph is verified before execution begins — an unsafe plan is refused before its first action runs. Composes with the per-action runtime as a second deterministic layer.
COMPLETE ✓
v1.7
Cross-Action Data-Flow Verification
Verification reasons across sequences of actions, not just individual ones. Policies can constrain how information moves through an agent's work — where data originates and where it is permitted to go — rather than judging each action in isolation.
COMPLETE ✓
v1.8.2
Bounded-Refusal Breaker
A non-bypassable loop bound in the trusted boundary, keyed by (session, action-signature), so a stuck or adversarial planner cannot resubmit a refused action-graph forever. Each verdict stays a pure function of plan and policy; the breaker only interprets the sequence of verdicts.
COMPLETE ✓
v1.9.0
Progress-Safety / HOOTL
A load-time liveness proof that certifies human-out-of-the-loop operation per policy: for every non-authorizing verdict, a deterministic automated terminal outcome is reachable in finitely many steps. "Never requires a human" becomes certified rather than hoped. Current release.
COMPLETE ✓
v1.9.1
Enforcement hardening
io_uring bypass closed; connect/execve deny-only (TOCTOU); file-open mediation proven race-free — 510→0 sentinel leaks on the TOCTOU harness. Threat model and trusted-computing-base published.
COMPLETE ✓
v1.9.2
Mediation completeness
Allow-by-default inverted to a default-deny allowlist; native-ABI lockdown closes the x32 bypass; hard-deny set (ptrace, bpf, userfaultfd, mount/FUSE, modules) plus scalar-flag CLONE_NEWUSER denial; supervisor→target lifetime coupling. Wired into the Warden and proven end-to-end — a conformance target passes 4/4 under live enforcement.
current
v1.10
The UNKNOWN-Shrinking Program
Migrate cases out of the UNKNOWN verdict into a provable verdict — raising the clear rate on safe actions — under a hard invariant that no extension may ever move an unsafe action into SATISFIED. Verdict-distribution harness, bitvector fragment, and bounded string fragment.
PLANNED
v1.11
Bounded Sequence Fragment
Element-level reasoning for the cross-action data-flow subsystem — collections modeled as a fixed N slots plus a length, composed on the v1.10 fragments so its soundness inherits theirs.
CANDIDATE