A programming language for code that models write and people review.

Every function signature lists the effects it may perform, and the runtime refuses any effect you have not granted. The same program can run against a fixed snapshot, a recorded trace or an exact probability model. Definitions are identified by their canonical structure, so reformatting and renaming change nothing that matters.

curl -fsSL https://raw.githubusercontent.com/jbwinters/jacquard-lang/jacquard-core-0.3.0/scripts/install.sh | sh

Installs Core 0.3.0 (7 October 2026) to ~/.local on Linux x86-64 or macOS, with checksums verified. No OCaml needed.

Take the tour Set up an agent Source on GitHub

01 · the signature is the manifest

Read one line to learn what a function can touch.

The checker infers an effect row for every function and rejects a signature that leaves one out. Nobody wrote the type below; the checker reports that greet talks to the console.

greet(name) = {
  println(text.concat("hello ", name))
  text.length(name)
}

greet("reviewer")

$ jac check greet.jac --print-sigs
greet : (Text) ->{Console} Int
_ : Int

The inferred row of a runnable program is the authority it asks for. Without a grant the runtime stops before anything happens, and the diagnostic says what to do next.

$ jac run greet.jac
error[E0814]: The program requires an effect that was not granted
  Cause: This program requires console [world/low] — talk to the process terminal, which is not granted (performed via `greet`).
  Next step: grant it with --allow console, or handle the effect in the program
[exit status 3]

$ jac run greet.jac --allow console
hello reviewer
8

This is language-level enforcement in a research runtime. It constrains Jacquard programs; it does not replace an operating-system sandbox.

02 · one policy, three worlds

Swap the handler, not the code.

A release policy is written once against a Telemetry effect. A handler answers the program's requests to the outside world, and because a handler may resume the rest of the program once, never or many times, the same policy can be run, weighed and checked exhaustively.

multi effect Telemetry where {
  inventory-health : () -> Health
  payments-health : () -> Health
  error-spike? : () -> Bool
}

-- A pure, reviewable release policy.
decide : (Health, Health, Bool) ->{} Decision
decide(inventory, payments, spike) =
  match (inventory, payments, spike) {
    | (_, Down, _) -> Hold("payments-down")
    | (_, Degraded, _) -> Canary(5)
    | (Down, Healthy, _) -> Hold("inventory-down")
    | (Degraded, Healthy, _) -> Canary(10)
    | (Healthy, Healthy, True) -> Canary(5)
    | (Healthy, Healthy, False) -> Ship
  }

release-assessment : () ->{Telemetry} Assessment
release-assessment() = {
  let inventory = inventory-health()
  let payments = payments-health()
  let spike = error-spike?()
  Assessment(inventory, payments, spike, decide(inventory, payments, spike))
}

A fixed snapshot

A handler that answers each reading from today's values.

assessment(healthy, degraded, false, canary(5))

An exact probability model

Each reading becomes a weighted choice. Given an observed checkout failure, enumeration lists every decision with its exact probability.

0.305077  canary(5)
0.295394  hold("inventory-down")
0.184621  canary(10)
0.155903  hold("payments-down")
0.059005  ship

Every world, checked

Warp runs the safety property over all 18 combinations of the readings instead of a sample.

PASS release-risk-suite/release risk/the concrete snapshot chooses a five-percent canary (1 check)
PASS release-risk-suite/release risk/the conditioned posterior is normalized with five decisions (2 checks)
PASS release-risk-suite/release risk/a down service is never approved to ship (verified exhaustively (18 cases))
3 passed, 0 failed, 0 skipped, 0 refused

Output of demos/case-studies/release-risk/run.sh from the 0.3.0 install, re-checked by scripts/verify_examples.sh. Walk through it →

03 · identity by structure

Reformatting does not change what a definition is.

Jacquard hashes the canonical resolved structure of each definition (SHA-256), not its bytes. Comments, layout and local names are erased, so the version below hashes exactly like the original, and a test cache keyed on the hash does not rerun.

-- Same function: a comment, a new parameter name, a new layout.
greet(who) = { println(text.concat("hello ", who))
               text.length(who) }

greet("reviewer")

$ jac hash greet-reformatted.jac
0 4f780db9b7f2fe96720a37110be0d91b1c9240f408048cf25dad215ea578db60
0:greet 451680d275e156dd8bf5d94fb7bc8df97518e96e9bcf5a8304f4ae7274853062
1 249ce0ea88ebca42fdb36c46fe31363f72044cea1abf13fea56ce5dbf65f00de

Change what the function does, and its identity changes.

greet(name) = {
  println(text.concat("hi ", name))
  text.length(name)
}

greet("reviewer")

$ jac hash greet-edited.jac
0 5a7e33ef060a625b7ef369ab73f69d4fd0d7d022c7e02048dad60aae24d60d62
0:greet 45cfe66faa1e2dafb7fcaf47d1d67618dd93bbbadb189a348de842a6fbe22277
1 42499038ee9548e0a21f8d28037e7d75e8199f2a566739898e7896773193c065

Equal hashes mean equal canonical structure. They say nothing about whether two different programs behave alike.

04 · for agents

Built to be learned from one file.

SKILL.md covers installing Jacquard and writing, checking, running, testing and compiling programs, and loads as a skill in coding agents. Every diagnostic carries a stable code, a cause and a next step, also available as JSON with --diagnostic-format json-v1.

Set up Claude Code, Codex or another agent →

05 · in your application

Keep the decision in Jacquard and the I/O in your service.

Jacquard Host calls checked Jacquard functions from Python, TypeScript or Go. The function's effect row says which services the application must provide; you bind each effect to an ordinary object, and a missing one is refused before anything runs.

See a policy call a Python service →

06 · the boundary

What 0.3.0 is, and is not.

A research prototype with a checker, an interpreter, a native compiler via C, a standard library and the Warp test framework.
No real network adapter ships; examples run against stubs, scripted responses, recorded traces and probability models.
Exact inference is finite and discrete. Exhaustive checks are exhaustive only within their declared bounds.
Native binaries cover a documented subset: no dynamic eval, interpreted tasks or typed channels.
No package manager, no formal soundness proof, no continuous distributions.
The surface syntax is an evolving v0; future releases may not parse every program unchanged.

Read the full limits · bounded claims · release notes