edict-compiler-dev — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited edict-compiler-dev (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Edict is a programming language designed exclusively for AI agents. Agents produce JSON AST, the compiler validates and returns structured errors, the agent self-repairs. No human in the loop.
"If no human ever saw this, would I still build it this way?"
Edict's moat is the bet that a language designed for agent cognition beats any language designed for human cognition. Every human-centric feature erodes this moat.
Never build: text syntax/parser, human-readable error messages, CLI for human use, pretty-printer, IDE/LSP integration, comments in AST, web playground/REPL.
Priority order: (1) minimize agent-compiler round-trips, (2) error actionability, (3) token efficiency, (4) correctness surface.
Read .agent/rules/criticalrules.md for the full set of hard boundaries.
src/
├── ast/ # TypeScript interfaces for every AST node (nodes.ts, types.ts)
├── validator/ # Phase 1: Schema validation (structural correctness)
├── resolver/ # Phase 2a: Name resolution (scope-aware, Levenshtein suggestions)
├── checker/ # Phase 2b: Type checking (bidirectional, unit types)
├── effects/ # Phase 3: Effect checking (call-graph propagation)
├── contracts/ # Phase 4: Contract verification (Z3/SMT integration)
├── codegen/ # Phase 5: WASM code generation (pure-JS encoder)
│ ├── codegen.ts # AST → WASM compilation
│ ├── runner.ts # WASM execution (Node.js WebAssembly API)
│ ├── builtins.ts # Built-in functions (print, string ops)
│ └── string-table.ts # String interning for WASM memory
├── mcp/ # Phase 6: MCP server (tools + resources)
│ ├── create-server.ts # Tool/resource registration
│ ├── handlers.ts # Tool handler implementations
│ └── server.ts # Entry point (stdio + HTTP/SSE transports)
├── errors/ # Structured error types and constructors
│ └── structured-errors.ts
├── check.ts # Full pipeline orchestrator (validate → resolve → check → effects → contracts)
├── compile.ts # Compile + run convenience wrapper
└── index.ts # Public API exportsEach stage runs in order. Errors from any stage halt the pipeline and return structured errors:
kind, required fields, valid IDs)The check() function in src/check.ts runs phases 1-5. The compile() function in src/codegen/codegen.ts runs phase 6.
Every error is a typed JSON object. Never use prose/string messages. Each error must have enough context for an agent to self-repair.
Error constructors live in src/errors/structured-errors.ts. Each constructor is a factory function returning a typed object.
Pattern for adding a new error type:
structured-errors.tsStructuredError union typeexport function myNewError(...))error-registry.ts (type + stage + make)error-catalog.ts (example_cause + example_fix)src/index.tsEvery error must include:
error — discriminator string (e.g., "type_mismatch")nodeId — which AST node caused the errorsrc/ast/nodes.ts (or src/ast/types.ts for type nodes)Definition, Expression, TypeExpr, or Pattern)src/validator/validate.tssrc/resolver/resolve.ts (resolve names within the new node)src/checker/check.ts (type inference/checking)src/contracts/translate.ts)src/codegen/codegen.tsnpm run generate-schemaCURRENT_SCHEMA_VERSION in src/migration/migrate.ts, run npm run snapshot-schema to save the new snapshot, then run npm run diff-schemas to auto-generate migration opssrc/index.tsEdict auto-migrates agent ASTs from older schema versions. When the AST evolves:
CURRENT_SCHEMA_VERSION in src/migration/migrate.tsnpm run snapshot-schema — stores current schema as schema/snapshots/v{N}.jsonnpm run diff-schemas — auto-generates migration ops by diffing snapshotsmigrateToLatest()Migration ops are auto-derived: added properties → add_field, removed → remove_field. The MIGRATION_REGISTRY in migrate.ts can also hold manual overrides for complex transforms.
Key files: src/migration/migrate.ts, scripts/diff-schemas.ts, scripts/snapshot-schema.ts, schema/snapshots/
BUILTIN_FUNCTIONS map in src/codegen/builtins.tsWASM sandboxing with explicit host bridging is a deliberate security feature, not a limitation. Agent-generated code runs in an isolated WASM VM with zero ambient authority. Filesystem, network, and crypto access are only available through host-provided adapters. This is defense-in-depth: the effect system declares capabilities at compile time, theEdictHostAdaptercontrols what's actually available at runtime, andRunLimitsenforces timeout/memory/sandbox constraints.
The host function layer uses a pluggable adapter pattern (EdictHostAdapter) to separate platform-specific operations from the WASM↔Host bridge.
Architecture:
createHostImports(state, adapter?)
│
├── 12 platform-agnostic groups (Web Standard APIs — always shared)
│ core, string, math, type-conversion, array, option, result,
│ json, random, int64, datetime, regex
│
└── 3 platform-specific groups (delegated to adapter)
crypto, HTTP, IOAvailable Adapters:
NodeHostAdapter — default, uses node:crypto, node:fs, node:child_processBrowserHostAdapter — stub with meaningful errors for unavailable operationsHow to implement a custom adapter:
EdictHostAdapter (from src/codegen/host-adapter.ts)sha256, md5, hmac, fetch, readFile, writeFile, env, args, exitRunLimits.adapter or directly to createHostImports(state, adapter)Key files: src/codegen/host-adapter.ts, src/codegen/node-host-adapter.ts, src/codegen/browser-host-adapter.ts, src/codegen/host-functions.ts
id string. Convention: {kind}-{name}-{counter} (e.g., fn-main-001, param-n-001)npm test. Test files live in tests/ across subdirectories per pipeline stageconsole.log in library codesrc/index.tsFor the full language specification, read FEATURE_SPEC.md at the project root. For the development roadmap, read ROADMAP.md at the project root. For full critical rules, read .agent/rules/criticalrules.md.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.