SYSTEM LANGUAGE

A language where intent is verified.

XIOM puts what a function promises directly in its signature -- not in a comment, not in a test, not in someone's head. The compiler reads it, enforces it at runtime, and exposes supported properties to verification tooling. Built for a world where code is increasingly written with AI.

try it in the playground download
divide.xi
1fn div_exact(a: Int, b: Int) -> Int 2 ✓requires: b != 0 && a % b == 0 3 ✓ensures: result * b == a 4{ 5 return a / b; 6}
RUNTIME-CHECKED

The promise lives in the signature.

Contracts are part of the source the compiler reads: runtime-checked by default, stripped only when you say so, and exported to the verifier for the properties it can express.

New here? Getting started · Contracts · GitHub

SAFE

No GC. No null. No surprises.

Deterministic memory: ownership with lexical scope borrowing and no garbage collector. The trade-off is stated plainly -- references are second-class: the language does not let a function return or store a borrow, and the compiler reports violations as E001. Handles and arenas cover what lifetimes would. Data races are prevented at compile time by Send/Sync enforcement.

VERIFIED

Contracts the compiler enforces.

Contracts compile to runtime guards today: violate one and the program aborts with a structured diagnostic. --verify exports SMT-LIB obligations and xiom-verify --check runs the bundled z3 -- a verdict counts as proved only when z3 returns unsat, and UNKNOWN never does.

PRECISE

Canonical syntax, explicit semantics.

No implicit behaviour, no hidden control flow. Allocation is explicit in the language model. derive handles the boilerplate, and the formatter enforces the canonical style.

Illustration: glowing nodes explaining a build error above a terminal
01 / AI

An AI-native toolchain.

When a build fails, --ai asks a model to explain the error with concrete fixes -- run it locally so nothing leaves your machine, or point it at your provider. xiom-mcp takes the next step: agents can compile-check code, read the language guides, query the standard library, and search registry packages as tools. The getting-started guide covers the --ai setup (local Ollama or a cloud key).

docs / compiler
ai.xi
# explain errors -- locally or in the cloud
xiom --ai --ai-local source.xi

# give an agent the whole toolchain
"mcpServers": { "xiom": { "command": "xiom-mcp" } }
Illustration: a glass shield over contract nodes being audited
02 / Proof

Proof for the parts that matter.

Contracts become runtime guards by default, and --verify emits SMT-LIB for external provers when you want stronger guarantees. For the low-level parts -- raw pointers, inline assembly, manual memory -- you mark the code unsafe, and the compiler audits every one of those blocks.

docs / compiler
verify.sh
xiom --verify --verify-output contracts.smt2 source.xi

# audit unsafe blocks, optionally blocking the build
xiom --sandbox source.xi
xiom --sandbox=strict source.xi
Illustration: layered safety glass over a memory chip with canary lines
03 / Safety

Safe where it counts.

No garbage collector and no null in safe code; allocation is explicit in the language model, and library operations document when they allocate. Ownership with lexical scope borrowing keeps memory predictable, as shown further down. The toolchain adds the safety net: integer overflow checks are on by default, and sanitizers, leak detection and stack canaries are one flag away.

docs / compiler
hardened.sh
xiom --sanitize=address source.xi
xiom --sanitize=undefined --stack-protector source.xi

# opt out only when you know you need to
xiom --no-overflow-checks source.xi
Illustration: one cube projecting desktop, browser, phone and chip targets
04 / Targets

One codebase, every target.

XIOM emits LLVM IR and hands it to clang, so the same source compiles to native binaries, WebAssembly, ARM or RISC-V. The playground runs the compiler itself in the browser through WebAssembly -- no install, no account.

open the playground
targets.sh
xiom -o app source.xi
xiom --target wasm -o app.wasm source.xi
xiom --target arm source.xi
xiom --target riscv source.xi
Illustration: a script flowing into a compiled binary
05 / Scripting

Try it like a script, ship it like a binary.

Run a .xi file directly -- shebang lines, inline snippets, piped input and an interactive shell all work. When the experiment is worth keeping, compile the same file to a native binary with no rewrites.

docs / compiler
hello.xi
# top-level code runs as-is -- no fn main required
println("hello, xiom");

# script, snippet, shell, or a compiled binary
xiom run hello.xi
xiom run -e "1 + 2"
xiom repl
xiom build

Also in the box.

Companion tools

The compiler (with xiom doctor), formatter, language server, documentation generator, package manager, foreign-interface generator, debugger, verifier and MCP server ship in every release archive, with a pinned z3 for verification.

docs / compiler

Standard library

44 top-level modules -- containers, strings, math, crypto, networking, SIMD -- with generated API pages. Beta, with the current limitations published.

docs / api

Tooling-friendly

Structured JSON diagnostics, dependency graphs as DOT or Mermaid, incremental and parallel builds with a watch mode.

docs / compiler

Execution modes

Compile natively through LLVM, iterate with the JIT, run scripts with xiom run (the entry point is wrapped automatically), and move eligible computation to compile time.

docs / compiler

AI benchmark

In preparation: an experimental benchmark of AI-generated systems software, measuring correctness, safety, runtime behavior, memory usage, binary footprint, compile success, contract compliance, verification, repair cost and token usage -- under three context conditions (no context, retrieved documentation, MCP tools). Results will be published with the harness.

in preparation
WHY WE'RE
BUILDING THIS

Intent lives in comments and tickets. We put it where the compiler can check it.

Most code today isn't written by one engineer who holds the whole system in their head. It's written by teams, maintained by people who didn't write it, and increasingly generated by AI tools. XIOM puts the specification inside the function signature, where the compiler can reason about it.

Design by Contract is not new: Eiffel had it in 1986, Ada 2012 and SPARK, Dafny and Frama-C push it further. What is new is the context -- contracts as a first-class input to an LLVM compiler, in a language built for AI-generated code.

For the longer discussion -- what XIOM gives up against Rust's lifetime system and what runtime contract checks cost -- see Prior art and trade-offs.

When AI generates a function, or a junior engineer modifies one, the contract layer catches what code review misses -- not because the reviewer is negligent, but because the compiler never gets tired.

Code review can't be the only safety layer when the volume of generated code exceeds what humans can read. So the safety moves into the language itself.

Borrows expire where you can see them.

No lifetime parameters. No annotations. The compiler infers borrow validity from scope nesting alone -- readable by looking at the braces, not by chasing references across the file. References are second-class: a function cannot return a borrow or store one in a struct; handles and arenas cover the cases lifetimes would.

-- lexical scope borrowing, decided Phase 0

fn example() {
  let v = Vec.new();
  read_only(&v);  // borrow ends here
  mutate(&mut v);  // exclusive, scoped
  consume(v);  // v moves, no longer usable
}

Build order, not a wishlist.

PHASE 0

Working pipeline

Lexer, parser, type checker, LLVM IR. Native and WASM targets.

done
PHASE 1

Full language

Ownership, generics, contracts, derive, and the standard library.

done
PHASE 2

Production hardening

Contracts, diagnostics, reliability, and standard library coverage across the toolchain.

done
PHASE 3

Self-hosting and ecosystem

Package registry, editor tooling, and the first self-hosted release.

active

Try it in two minutes.

quickstart
# install (Windows PowerShell)
irm https://xiom-lang.org/install.ps1 | iex

# or Linux
curl -fsSL https://xiom-lang.org/install.sh | sh

# run a script -- fn main is optional
xiom run hello.xi

No account, no configuration. The installer verifies the archive checksum and adds xiom to your PATH.

getting started by example download

Ready to try it?

Compile XIOM in your browser -- no install, no account, no backend. The compiler runs client-side via WASM at playground.xiom-lang.org.

launch playground download compiler

Built in the open.

Source

The compiler, standard library, tooling and this website live under the xiom-lang organization on GitHub.

github.com/xiom-lang

Report or request

Bugs and feature requests go through the issue templates. Security problems use private reporting -- never a public issue.

open an issue · security policy

Start contributing

Read the contribution guide and the code of conduct first; the roadmap shows what is next.

contributing · contribution guide · code of conduct

Get help

Questions and design discussion happen in Discussions; the support guide lists every channel, including registry and conduct contacts.

support guide · support@xiom-lang.org