Runtime capability matrix

Language-core progress estimate — 2026-10-27: about 35%. This is a manual estimate against the accepted general-purpose language design, not a percentage of source files or tests. The self-hosted compiler and core control-flow, type, shape, variant, option/result, and match features exist. General ownership and memory-safety guarantees, general generics/traits, a complete collection and text/byte model, source-level asynchronous tasks, and broader target/release evidence remain open. Internal scheduler capabilities are tracked separately and do not count as source-language async/await support.

This is a code-backed snapshot of the native YAZA runtime and compiler source. “Implemented” means the feature exists in source; it does not mean the feature has production-release guarantees. Recent compiler changes passed YAZA source checking and native compilation. Offline checks accepted a matching format-2 snapshot, rejected an unsupported format, rejected a stale migration fingerprint, accepted the matching fingerprint during project compilation, and rejected it after a migration file changed. The full YAZA suite most recently passed 45/45 on 2026-10-28, including the process-local TTL cache, PostgreSQL API-record and structured-query adapters, SQLSTATE classification, database value contracts, secure rooted filesystem capabilities, bounded HTML escaping, the HTTP/HTTPS URL parser, Argon2id password hashing, typed lists, and process environment isolation. The TTL-cache runtime harness passed normally and under ASan/UBSan, including expiry, capacity eviction, and concurrent access. The macOS bootstrap passed its 10,000-case fallback parser mutation run, API layer conformance checks, and local PostgreSQL/API-record protocol fixtures in normal and ASan/UBSan builds. This bootstrap also passed the API fixture's normal and ASan/UBSan HTTP smokes with typed List[Shape] request-body arrays, followed by the OpenAPI/Postman generation smoke. The filesystem C harness passed normally and under ASan/UBSan, including symlink-swap race checks. A separate test-runner fixture verified timeout reporting, child process-group termination, and continuation to a later passing test. Crypto and SCRAM tests passed under ASan/UBSan in earlier runs. Earlier checks cover nested product shape declarations, tagged variants with unit and typed payload cases, checked construction, exhaustive variant matching, shape/variant payloads in Option[T] and Result[T, E], same-type and explicit From error propagation through ?, module imports, function parameter/return use, checked Int32, Float64 scientific notation, nested elif, TextList and numeric-range loops, OS-backed secure randomness, bounded TCP/TLS transport and PostgreSQL SSLRequest negotiation, typed HTTP path/query/body accessors, and nested shape-based JSON request bodies. Negative checks reject duplicate conversions, missing conversions, non-exhaustive and duplicate variant matches, unknown cases, constructor arity errors, and payload type mismatches. Existing checks cover shape field/type/arity errors, cyclic by-value layouts, incompatible field updates, updates through immutable values, malformed Float64 exponents, out-of-range Int32 conversions, Int32 overflow, invalid secure-random inputs, and invalid loop control. Allocator, JSON, secure-random, and filesystem boundary harnesses pass normally and under ASan/UBSan; the 10,000-case parser mutation run and full CRUD/slow-client/timeout smoke pass under ASan/UBSan. Typed HTTP path/query/body, nested-shape, and nested typed-array smoke passes normally and under ASan/UBSan. The latest 100,000-request run retained its in-memory CRUD record; sampled RSS grew 0 KiB at 1 KiB ps resolution (10,800 KiB baseline and peak). The macOS package remains provisional because the managed host adds AppleDouble provenance records to its payload. Security design requirements are tracked in Appendix H, layered application requirements are tracked in Appendix G, and accepted design RFCs are indexed in docs/rfcs. RFC acceptance does not change implementation status.

Latest API array slice (2026-10-27): API request shapes decode bounded List[Number], List[Int32], List[Float64], List[Boolean], and List[Text], plus nullable Option[List[T]]. Shape response serializers preserve those values; OpenAPI and Postman include typed item schemas, bounds, examples, and absolute URLs. The fixture passed normal and ASan/UBSan HTTP smoke, generation smoke, and the macOS bootstrap's 42/42 YAZA tests.

Latest pure-language collection slice (2026-10-27): list_try_get now returns Option[T] for typed lists, including TextList, primitives, shapes, variants, and nested supported values; negative and out-of-range positions return none. for item in values now iterates List[T] as well as TextList, captures the initial length once, and does not visit items appended mid-loop. The typed-list loop test and example pass, and bootstrap stages two and three emitted identical compiler C. Slicing and generic functions remain open.

Latest URL and safe-link slice (2026-10-28): std/url.yz provides a typed, bounded parser for an ASCII HTTP/HTTPS subset. std/html.yz reuses it for absolute HTTPS hrefs while checking relative links with a separate policy. URL and HTML tests pass normally and under ASan/UBSan. This is not a general URI parser, does not resolve or authorize destinations, and does not prevent server-side request forgery.

Later update (2026-10-25): The macOS bootstrap passed 29/29 language tests. The PostgreSQL URI suite covers percent-decoded credentials/options, IPv4 and bracketed IPv6 hosts, database path rules, invalid ports/escapes/options, and environment configuration. std/pg/uri.yz serves both the database CLI and generated Product repository. The repository uses std/pg/api_records.yz for configured Product CRUD; native libpq remains for API startup/schema checks and readiness. A local PostgreSQL 17.6 migration and end-to-end API CRUD/restart-persistence smoke passed; remote TLS, broader versions, and CI automation remain unverified.

Later update (2026-10-26): The macOS bootstrap completed three self-host compiler stages with identical generated C and passed all 29 language tests. tests/api-layer-conformance-smoke.sh now also verifies that an explicit source path checked from outside its project root still loads that project's architecture policy and rejects a forbidden controllers -> repositories import.

Previous update (2026-10-26): HTTP request reads now run as one bounded scheduler task per connection and suspend on the readiness bridge. At that milestone the macOS bootstrap passed 29/29 tests and the HTTP smoke, including a partial pipelined request that waits while an unrelated health request succeeds, then resumes after the remaining request bytes arrive; only macOS kqueue was exercised.

Later update (2026-10-26): HTTP responses are copied into capped per-connection buffers and flushed on writable readiness, at most 64 KiB per connection per event-loop turn. Each response is limited to 16 MiB, total queued response memory to 64 MiB, and send time to five seconds. The full macOS bootstrap passed three self-hosted stages with identical generated C, 34/34 YAZA tests, and normal plus ASan/UBSan HTTP smokes. The socketpair harness checks slow-client isolation, write resumption, per-turn fairness, memory-budget release, and shutdown drain. Route handlers and PostgreSQL calls remain synchronous; Linux epoll remains unverified.

Later update (2026-10-26): API request shapes can declare validate email email on Text or optional Text fields. Runtime validation accepts a conservative ASCII dot-atom/DNS-label form, returns the safe invalid_email field error, and OpenAPI marks the field as format: email. Normal bootstrap HTTP smoke, a dedicated ASan/UBSan HTTP smoke, the generated OpenAPI checks, and the compiler's incompatible-field rejection passed. This is syntax validation only; it does not verify that an address exists or supports quoted and internationalized addresses.

Current PostgreSQL API update (2026-10-26): Generated API builds compile without defining YAZA_WITH_POSTGRES or linking libpq; otool -L and undefined-symbol inspection show no libpq dependency. The API's declared startup/readyz hooks call YAZA functions that perform PostgreSQL setup and readiness through std/pg. Migration plus the full database-configured API HTTP smoke passed against disposable PostgreSQL 18.6 after the lifecycle-hook change, covering startup seeding, /readyz pause/resume, CRUD, restart persistence, live SQLSTATE-to-HTTP mappings, and safe 503 unavailable handling when PostgreSQL is stopped during a create. The smoke keeps the published loopback host port fixed across the PostgreSQL container restart and verifies /readyz recovers in the same API process. The test script installs all fault fixtures only in its disposable, loopback-only container. This is one local major version and plaintext loopback transport; remote TLS, more versions, and automated live-DB CI remain open. An interrupted create is returned as 503 and is not retried automatically.

Current structured-query update (2026-10-26): tests/db_postgres_live_smoke.yz now exercises db_postgres_select against a disposable PostgreSQL 18 container. It inserts two fixture rows using bound parameters, runs a validated filter/order/page descriptor, checks the returned column and values, then confirms an SQL-injection-shaped filter string returns no rows. tests/api-postgres-container-smoke.sh runs this before the HTTP/API lifecycle smoke, and the complete script passed. This verifies the current single-filter SELECT path against PostgreSQL; joins, schema-aware types, typed shape mapping, and broader database versions remain open.

Current compiler memory update (2026-10-26): API module expansion and zero-argument return-type indexing are reused across route parsing, API code generation, OpenAPI generation, and layer conformance checks. The API project now passes compiler checking and build through the self-hosted CLI within its bounded compiler arena; the full macOS bootstrap and database-backed API smoke passed after the change. This avoids repeated full-source expansion in the API path, but is not a general incremental compiler or a bound on every possible project.

Later update (2026-10-25): The API now supports an opt-in per-client IPv4 token-bucket limiter. Full macOS bootstrap and HTTP smoke pass, including normal and ASan/UBSan bucket tests, configuration validation, calculated Retry-After, operational-route bypass, capacity saturation, and recovery. The limiter is process-local and global across application routes; it is not distributed or route-policy middleware.

Later update (2026-10-25): Logical std/... imports resolve from the project, YAZA_STDLIB_DIR, or the installed macOS standard-library roots. Runtime lookup honors the same source root before older global runtime copies and supports YAZA_RUNTIME_DIR. An external-working-directory PostgreSQL URI test and the API HTTP smoke passed with the project standard library selected explicitly.

Verification update (2026-10-26): The latest macOS bootstrap passed three self-host compiler stages with identical generated C, all 33/33 language tests, HTTP/API smokes, and normal plus ASan/UBSan checks for SecretText. The compiler rejected the negative fixture that tries to print a secret implicitly.

Control-flow update (2026-10-27): YAZA supports block-form and one-line if/elif/else, mutable var plus set, and sequential early returns. Numeric guarded match supports return match, typed let/var initializers, and set existing_var = match for Number, Int32, and Float64; exhaustive variant/Option/Result matches support those same result contexts with -> arms. set updates an existing mutable var. A typed match initializer becomes visible only after its exhaustive arms close, so arm payload bindings cannot read an uninitialized destination. Match values are not yet general nested expressions or direct arguments. The three-stage macOS bootstrap passed with byte-identical final C and all 39/39 language tests; API, negative compiler, and normal plus ASan/UBSan HTTP fixtures passed. examples/match-forms.yz and tests/elif.test.yz demonstrate and exercise the supported styles.

API validation update (2026-10-27): Nested request shapes accept validate <field> integer for Float64 values; the decoder inspects the exact JSON decimal spelling and accepts only whole values within [-9007199254740991, 9007199254740991], avoiding fractional values that round to integers in Float64. OpenAPI emits the same nullable/required integer schema and bounds. The API HTTP smoke verifies whole values, exponent notation, fractions, values near precision boundaries, and both range boundaries in normal and ASan/UBSan builds. The compiler also rejects applying this rule to Text fields.

OpenAPI numeric contract update (2026-10-27): Generated schemas now match runtime numeric representations throughout typed path/query parameters, scalar request bodies, nested request shapes, and shape responses. Number is emitted as a signed 64-bit integer with bounds [-9223372036854775808, 9223372036854775807]; Int32 is emitted as a signed 32-bit integer; Float64 remains number. Explicit Float64 integer validation uses its narrower IEEE-754 safe-integer bounds. Numeric runtime bounds and user validation limits are composed with allOf, avoiding duplicate JSON Schema keywords. Generation smoke checks these types and boundaries, and the full three-stage macOS bootstrap passed.

API deadline update (2026-10-27): YAZA_HTTP_REQUEST_TIMEOUT_MS now sets the bounded request deadline (1,000–300,000 ms; default 5,000 ms), and YAZA_HTTP_KEEP_ALIVE_TIMEOUT_MS sets the bounded idle keep-alive deadline (1,000–60,000 ms; default 5,000 ms). The full API smoke passed normally and under ASan/UBSan with invalid-bound rejection, effective startup reporting, header rounding, and a live one-second incomplete-request timeout. YAZA_HTTP_RESPONSE_WRITE_TIMEOUT_MS sets response-write deadlines from 1,000 to 300,000 ms (default 5,000 ms); YAZA_HTTP_MAX_CONNECTIONS sets the active-connection capacity from 1 to 127 (default 64), bounded by the event buffer; YAZA_HTTP_SHUTDOWN_GRACE_MS sets response-drain grace from 1,000 to 120,000 ms (default 5,000 ms).

CORS preflight update (2026-10-27): preflight header names are validated as HTTP tokens and are allowed only when common or declared by the matched route controller. The response reflects the validated requested list and includes Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers; an undeclared custom header is rejected. The full API smoke passes normally and under ASan/UBSan. The origin policy remains a single exact configured origin for the server.

HTTP OPTIONS update (2026-10-28): Ordinary OPTIONS requests now return a bodyless 204 with path-specific Allow; OPTIONS * returns the server-wide method set; unknown paths remain 404. Allow includes implicit HEAD for GET and OPTIONS itself. The most restrictive route-auth policy applies to path discovery, including JWT-only routes. CORS preflight remains a separate method/header-validated path. The complete API HTTP smoke passes normally, and route-auth smoke passes normally and under ASan/UBSan; Linux behavior remains unverified.

HTTP capacity and descriptor-pressure update (2026-10-28): With every configured connection slot occupied, the event loop closes excess accepted clients without parsing or responding and increments yaza_http_connections_rejected_total at /metrics. The loopback test fills a one-connection table, verifies the extra client is closed, confirms the existing connection can still serve metrics, then frees the slot and verifies health requests are accepted again. A second loopback integration lowers macOS RLIMIT_NOFILE, forces accept() to return EMFILE, verifies yaza_http_accept_backoffs_total, releases descriptors, and confirms listener recovery after the one-second backoff. The same test confirms a queued peer that closes before sending bytes does not create a false HTTP 400 metric. The API concurrency harness passes normally, under ASan/UBSan, and under ThreadSanitizer on macOS. System-wide ENFILE and Linux epoll behavior remain unverified.

HTTP EOF framing update (2026-10-28): Raw loopback TCP tests confirm that a complete GET followed by shutdown(SHUT_WR) receives its normal 200 response; EOF in an incomplete header or declared request body receives 400. The checks assert two 400 response metrics, two matching access-log records, and return of active connections to the baseline after clients close. The concurrency harness passes normal, ASan/UBSan, and ThreadSanitizer runs on macOS. Linux behavior remains unverified.

API security progress — 2026-10-25

The runtime now refuses a non-loopback IPv4 listener without a configured YAZA_API_TOKEN; the policy runs before opening the listening socket. The normal and ASan/UBSan API smoke checks verify the refusal, missing and incorrect credentials, duplicate Authorization rejection, and the ordinary authenticated loopback API path. This is a safer bind default, not a substitute for TLS, role-based authorization, token lifecycle management, or a completed API security profile.

API graceful shutdown update — 2026-10-26

SIGINT/SIGTERM now stops further accepts and performs a zero-time readiness collection after an interrupted event wait. Requests already readable on accepted sockets are completed with Connection: close; incomplete and idle sockets are then closed. tests/fixtures/api-complete/tests/http_shutdown.c verifies a fragmented request completed at shutdown, the closing response, EOF, and clean server exit in normal and ASan/UBSan HTTP smokes. This does not drain background jobs or introduce a configurable grace period.

Provider-neutral database values update — 2026-10-26

std/db/core.yz defines tagged SQL values for NULL, Boolean, Int32, Int64, Float64, Text, and Bytes, with checked accessors and explicit driver capability flags. std/db/postgres.yz maps them to PostgreSQL Bind parameters, including OID-typed NULL and bytea, and decodes known integer, Boolean, finite Float64, text, and bytea result columns into the shared contract. Adapter errors use fixed DbError categories/messages. tests/database_core.test.yz passes normally and as an ASan/UBSan native executable. Schema-to-shape mapping and a working second provider are still absent.

Work completed in the current runtime-hardening milestone

• Validated HTTP Host syntax and enforced an exact YAZA_ALLOWED_HOSTS list. Loopback defaults to 127.0.0.1, localhost, and the configured loopback address; non-loopback binds require an explicit list of up to 32 host names without wildcards or ports. Host matching is case-insensitive and ignores the request port. The API HTTP smoke rejects wildcard configuration and an unlisted hostname and accepts an explicitly allowed mixed-case hostname on macOS. Browser DNS-rebinding and Linux behavior remain unverified. Non-empty request bodies require application/json; path and query values use bounded percent-decoding.
• Added PostgreSQL statement, lock, and idle-transaction timeouts on the API connection.
• On shutdown, stop accepting, collect queued socket readiness without blocking, complete requests already readable on accepted sockets, and close remaining connections before cleanup; the fragmented-request shutdown smoke covers this path.
• Added sanitizer builds, a libFuzzer-compatible parser harness with a deterministic sanitizer fallback, and test-runner isolation after compile errors.
• Added a bounded child-process timeout that terminates the child process group and reaps the child.
• Added source file and line locations to errors in the main native compilation path.
• Added bounded program/request arenas, explicit promotion of persisted in-memory CRUD records, allocator accounting checks, and a 100,000-request RSS smoke test.

The remaining rows are real compiler/runtime work; documentation or a template does not count as implementing them.

← Kembali ke semua dokumentasiVersi dan status rilis →