Silu.

A concise, self-hosted, compiled language with Python syntax.

Syntax Python Self-hosted fixed-point verified Compile 0.11s Prove built-in

def greet(name: str) -> str:
    return "Hello, " + name + "!"
 
print(greet("Silu"))
 
$ ./siluc hello.si -o hello   # 0.11s, LTO by default
$ ./hello
Hello, Silu!

Early stage — documentation is published now; binary releases come next; source will follow in stages.

Writes like Python, runs native

15.6×

vs CPython — geometric mean, 15 programs

0.004s

native startup

0.9×

vs hand-written Rust twins (same report)

Program	CPython	Silu native	vs CPython	Rust (reference)
arith	80ms	3.3ms	24.4×	2.9ms
dict	34ms	2.2ms	15.6×	2.8ms
fannkuch	32ms	2.6ms	12.1×	2.5ms
fib	36ms	2.5ms	14.2×	2.8ms
float	52ms	2.7ms	19.3×	2.8ms
jsonparse	47ms	7.4ms	6.3×	3.6ms
jsonparse_json	42ms	7.9ms	5.3×	—
knucleotide	889ms	11.0ms	80.9×	14.8ms
list	35ms	2.4ms	14.8×	2.4ms
mandelbrot	41ms	2.4ms	17.2×	2.7ms
nbody	214ms	5.7ms	37.6×	5.4ms
spectral	288ms	7.4ms	38.7×	4.7ms
string	49ms	3.0ms	16.1×	2.2ms
trees	31ms	3.2ms	9.8×	3.4ms
wordcount	88ms	23.3ms	3.8×	13.7ms

v1.9.0 report (2026-10-25), Apple Silicon, medians of 3 runs including process startup; outputs byte-identical across the interpreter / CPython / native / Rust planes. Against the Rust twins the geometric mean is 0.9× in this report — some programs faster, some slower. Later toolchain work (LTO-by-default linking, string pooling, buffer reuse) further improved jsonparse, spectral and wordcount; see the benchmarks doc.

Prove, or get the counterexample

⚡

Real proofs, not sampling

a / (b*b + 1) is proved safe by algebraic reasoning — the divisor is always ≥ 1, over all possible inputs. Fuzzing can't say that.

🎯

Witnesses for real bugs

m / (n - n) is flagged with a counterexample — the divisor is identically zero. You get the crashing input, not just a warning.

🔗

Contracts compose

require(b != 0) declares a function's domain. The function proves safe standalone; callers are checked separately. Removing a caller never invalidates anything.

Scope today: division by zero, list/string index bounds, dict keys. Loops are verified to a fixed bound; obligations the solver cannot discharge are reported as unproved — never silently assumed safe.

$ cat safe.si
def safe_div(a: int, b: int) -> int:
    require(b != 0)
    return a / b
 
$ silu prove safe.si
safe_div: ok (1 checked abort site(s) proved safe)
verify: ok - no abort reachable
 
$ cat buggy.si
def risky(m: int, n: int) -> int:
    return m / (n - n)
 
$ silu prove buggy.si
risky: POSSIBLE ABORT - division by zero
verify: ABORT REACHABLE

Self-hosted, and it can prove that

The compiler is written in Silu

Lexer, parser, IR generator, LLVM code generator — all Silu, compiled to a native binary by itself. The fixed-point check — the self-hosted converter reproducing its own build output byte-for-byte — runs in the test suite.

One command bootstrap

silu bootstrap builds the zero-Python toolchain from source in ~25 seconds. After that, every compile is ./siluc file.si -o prog — 0.11 seconds, LTO by default.

Ownership, no GC

Static annotations decide representation: int lives on the stack, str is an owned buffer dropped at scope exit, containers are unboxed. Assignment transfers ownership. The trade-offs — including today's deliberately simple dynamic plane — are written up in the memory doc.