Roadmap

Kora is being built in small, runnable steps. This page separates the features implemented in the current codebase from the work that remains.

Working now

The current codebase includes:

• Python-like syntax, a conservative static checker, modules, imports, and source diagnostics. The checker covers local declared assignments and returns, calls, constructors, fields, loop control, and direct classified flow into analyze; dynamic integrations remain runtime-checked.
• kora run, kora test, and the debugger run the checker before starting effects. An invalid kora.toml or corrupt durable journal stops execution instead of selecting defaults or starting a run again.
• kora run, check, test, audit, trace, and durable run commands.
• Typed analyze calls with OpenAI and Ollama providers, including images and per-call model selection.
• Record and replay cassettes for deterministic tests without model costs.
• Agents, parallel work, lexical budgets, human pauses, and resumable runs.
• Durable pipelines: fs.write, fs.append, and sql.execute are journaled effects, so a killed run resumes without writing any row twice, and reads are digest-checked so a resume against changed input stops rather than mixing two inputs into one run. The journal is append-only, one line per effect, and a run is locked to one process while it is open.
• Concise workflow composition: stream for a prose answer, else (why, kind) for flat outcome handling with a recorded status, and case A(x) | B(x) for shared branches.
• Crash-safe streaming inside a durable run. A stream killed after part of its answer was written is never sent to the provider again and never writes those pieces twice: the resume returns Failed for the program to match on. One killed before it wrote anything is sent again like ordinary unfinished work.
• One effect lifecycle across model calls, tools, and writes. An effect that cannot be repeated safely leaves a mark before it is sent, so a resume can tell “never started” from “outcome unknown” — and an interrupted tool-using call stops the run naming what is in doubt instead of silently running every tool a second time.
• Classified data, scoped declassify, sink policies, and audit output.
• Safe terminal output: print and write redact classified leaves using a project-configurable marker.
• Native json, yaml, xml, csv, fs, http, sql, time, re, env, notes, and pdf modules, with fs.image and fs.glob for working over a folder of files. pdf reads a document’s text and keeps its page boundaries, and says whether there is a text layer at all, so a scan is never mistaken for an empty document.
• Package helpers: a package may declare one separate program it carries heavy work out to, for what cannot be written in Kora. Kora links no native code itself, so a crash or a hang in a helper is a value the program matches rather than a dead run. A fetched helper is pinned by sha256, fetched only for the platform and only for a package the program imports, and recorded in kora.sums.
• Confined helpers: [package.helper] needs is empty by default, and the operating system enforces it — a seccomp filter on Linux, a sandbox profile on macOS. A confined helper cannot open a socket, write a file, or read the memory of the kora process that started it, and needs = ["net"] is refused unless the importing program holds net itself. Windows has no mechanism available to an unprivileged process, and the runtime says so rather than implying a sandbox that is not there.
• Stopping work that stopped being worth doing. break inside a parallel for ends the fan-out — no further item is started, and the branches already running are let go of at their next statement — and break <value> carries what the branch that stopped it found, so a search ends as soon as it has an answer. A budget(max_seconds = N) deadline now reaches work already sent: model calls, HTTP requests, MCP tool calls, and helper calls all take the smaller of their own timeout and what the scope has left.
• Python sidecar and MCP tool integrations through project configuration, with a deadline on every MCP request. A tool server that does not answer comes back as Failed(reason) instead of ending the run, and tool calls are never retried, because a timeout is exactly when whether the effect ran is unknown.
• VS Code syntax highlighting, file icons, language-server features, and run and test commands.
• Lexical with context(...) policies that bound model input independently of spend budgets, retaining newest whole tool exchanges and failing rather than silently truncating base prompt or data.

Coming next

Prove the product wedge

The product thesis is now deliberately narrow: policy-safe, replayable AI workflows over sensitive claims, invoices, compliance records, and internal documents. The next release gate is evidence, not more syntax:

• work with three design partners on one repeated document workflow;
• publish one end-to-end case study with correctness, cost, and replay data;
• benchmark that workflow against an established Python or TypeScript stack;
• publish a conformance suite for checking, label flow, and journal recovery;
• commission an independent security review before any production claim.

If teams do not keep using the workflow after a 90-day trial, Kora should shrink into a DSL or library instead of expanding as a general-purpose language.

Finish cancellation

parallel for ... first has shipped: a candidate answer stops later work from starting while lower input indexes already in flight are allowed to finish. The earliest successful input wins, and that result is journaled so a resumed run keeps the live run’s decision rather than racing again.

What remains is the half that is genuinely hard — interrupting a branch already running. Today no further work is started, but a request already sent runs to its own transport timeout. That is the same “did it happen” problem that makes a tool call unretryable, and it will be solved once, deliberately, rather than approximated.

Stabilize streaming and workflows

Streaming prose works for a single str call, including inside a durable run, and is metered and retried on the same terms as a blocking one. The remaining work is streaming alongside tools and parallel for, exact in-flight token enforcement, and a general event-stream API.

Sharpen what confinement claims

A helper’s sandbox is a denylist: the network and filesystem writes are withheld, and the claim stops there. An allowlist is stronger and is what a WASM component will eventually give, which is why WASM remains the end state rather than a second sandbox to maintain. Windows confinement is the other open piece.

Fill the deliberate standard-library gaps

yaml has shipped: config is where a program is one step from doing something consequential, so it refuses a duplicate key, reads the YAML 1.2 core schema (no Norway problem), and meters alias expansion against a node budget so a “billion laughs” file is a value rather than an out-of-memory kill.

xml has shipped alongside it, on the same terms: a DOCTYPE is refused outright, so the XXE and billion-laughs attack class has nowhere to start; namespaces are kept as data rather than glued to the tag; character data is whole; and children is a list at every length, so a program’s shape does not change with the size of its input.

A dedicated network module remains unbuilt. The existing http module stays the network boundary until a narrower, safer API is ready.

PDF rendering is not a stdlib gap any more, and deliberately not a stdlib feature: it lives in the pdf_render package, which carries PDFium in a helper process. A program that never renders a PDF downloads nothing and pays nothing for it.

Complete the package ecosystem when there is demand

A hosted checksum log begins when third parties routinely fetch Kora packages. WASM components begin when a package cannot be expressed in Kora, MCP, or the Python sidecar. Native shared libraries remain deliberately unsupported.

Durable write throughput

Done. Every journaled write still costs two synced appends, but the syncs of workers running beside each other are now coalesced into one: 400 rows from a parallel for went from 4.79s to 0.82s, 5.8x, doing 131 syncs where it used to do 800. Nothing was weakened to get it — every record still reaches the disk before the program acts on it.

A sequential loop is unchanged, and deliberately so: one thread has nobody to batch with. What remains under durable execution is retention and compaction of old runs.

Improve distribution and editor workflows

The next product work includes crates.io and Open VSX distribution, CLI polish, and richer project-aware editor and debugging workflows.

A note on status

Kora is still pre-alpha. A feature listed as working is implemented in the current repository and release checks. A feature listed as coming next is a real direction, but its APIs may still change.