Roadmap
Each phase has an exit criterion. A phase isn’t done until its criterion is met and measured.
| Phase | Scope | Exit criterion |
|---|---|---|
| 1. Design | Spec docs 00 to 05, JSON schemas, token benchmark | SSP-T uses fewer tokens than Python on the benchmark median across 3 tokenizers |
| 2. Core compiler | Rust: SSP-T parser and printer, graph store (SQLite), hashing, type and effect checker, interpreter, ops protocol, diagnostics with fix ops | 10-program suite runs. A model given only the spec writes correct programs for 70% or more of 30 held-out tasks |
| 3. Agent loop | Query API, context packs, MCP server, typed holes, property tests from contracts, effect handlers, coroutines | An agent completes multi-step feature tasks using ops only, with fewer total tokens than the same agent using Python |
| 4. Native and systems | Cranelift backend, sys profile (ownership, res, Ptr, unsafe), allocator handlers, atomics and threads, comptime, const generics, variadics, specialization, SMT contracts (Z3) | Runtime benchmarks within 1.5x of C++ -O2. Ownership checker passes the soundness suite |
| 5. Release and bare | LLVM backend, LTO and PGO, SIMD and intrinsics, inline asm, bare profile, MMIO and interrupts, C binding generator, embedded targets | Within 1.1x of C++ -O3. Boots a bare-metal hello world on QEMU riscv64 and aarch64 |
| 6. Ship | Deployer (AWS), effects-as-IAM, migrations, hot swap, replay, kernel fn (Metal, SPIR-V, PTX), full std library | A CRUD service goes from intent to production with zero handwritten infra. Std library matches C++ coverage |
| 7. Scale | CRDT multi-agent sync, global build cache, distributed store, proven rewrites, cost-driven optimization | 100 concurrent agents on one codebase with no lost work |
Progress
| Phase | State |
|---|---|
| 1 | Done. SSP-T median 0.71x Python tokens |
| 2 | Done. 12 suite programs. Spec-only evaluation: Opus 30/30 zero-shot (bar: 70%), Haiku 25/30. See adr/0002-phase2-compiler-core.md and bench/eval/ |
| 3 | Done. store, transactions, query API with context packs, MCP server, contract fuzzing, typed holes, sspur edit (definitions replaced by name, atomic, --test in the same call), compact CLI output, a 1.5k-token agent spec, effect handlers with one-shot resume, generators (ADR 0010). Exit criterion met: on 8 multi-step feature tasks (Sonnet 5.5, CLI only), both languages passed 95/95 hidden tests and SSPUR used 0.59x Python’s total tokens (median 0.60x per task, cheaper on 7 of 8; 27 calls vs 46). The first run, with JSON queries and transaction files, was 1.96x. A checker slowdown on nested constructor literals (20s) was fixed (10ms). Rerun after Phases 4 to 7 (run 4): still 95/95 on both sides, but the compressed 1.8k spec had dropped rules the tasks need (core List methods, the catch test form, the one-edit and file-fallback CLI guidance) and SSPUR rose to 1.24x. With those restored (1,782 tokens) and the 4 affected cells rerun, SSPUR used 0.70x (median 0.61x, 26 calls vs 38). An optional 9th task with regex and JSON passed 17/17 on both sides at 0.75x after one more spec fix. Run 5 (more models, neutral tasks, a large codebase): Opus 5.5 used 0.76x on the 8 tasks (95/95 on both sides) and Sonnet 0.74x on 8 tasks from neutral sources (0.66x after a spec fix, 141/141 on both sides), but Haiku 4.5 used 2.31x (1.21x after the fix; SSPUR 95/95, Python 84/95) and Sonnet used 1.34x on one 1,117-definition codebase. The criterion holds for Sonnet and Opus, not yet for Haiku or the large codebase. See adr/0003-phase3-agent-loop.md and bench/agent/ |
| 4 | Speed criterion met and exceeded: native code beats C++ -O2 on every benchmark (now 0.14x typical, 0.57x strings, 0.59x app, 0.89x compute), with in-place reuse, fusion, and proven check elimination (ADR 0005 to 0008). SMT contracts: sspur verify proves pre/post/where with Z3, and native code drops proven checks (ADR 0009). Automatic multi-core parallelism for pure pipelines (ADR 0011). sys profile: owned res types with destructors, second-class borrows, Ptr and the unsafe effect; the ownership checker passes the soundness suite (68 rejected, 18 accepted programs identical in both tiers; ADR 0012). See bench/native/. Since 0.8.2 native code also frees list buffers and strings at their last use when they have one owner (ADR 0033), which puts peak memory near or below C++ on every benchmark but gpu. Traits (ADR 0027): trait and impl with default methods and effect-bounded methods, bounds on type parameters checked at the definition, operator traits and derive Eq, Ord, Show, Hash, Json, all resolved statically by specializing bounded functions per type, identical in both tiers and across packages. |
| 5 | Speed criterion met: native code beats C++ -O3 on every benchmark (0.15x to 0.88x; bench/native/README.md). Boot criterion met: profile bare (no runtime; E_PROFILE_BARE for heap, log and error features), typed volatile MMIO (mmio[U32](addr)), interrupt timer handlers, and `sspur build –target riscv64-qemu |
| 6 | Mostly done. Deployer and effects-as-IAM: store, svc/ep, db.* effects compiled natively, and sspur deploy plan produces CloudFormation, per-handler least-privilege IAM derived from effect rows, and a native Lambda bootstrap. sspur deploy local runs the CRUD example end to end under enforced policies (ADR 0016). Migrations, hot swap and replay (ADR 0019): store schema versions from type hashes, sspur deploy migrate classifies changes as compatible, migration (a typechecked migrate_S function, optional unmigrate_S for side by side) or breaking; handlers migrate lazily on read and a conditional backfill runs locally or as a generated Lambda; deploy local hot swaps with weighted canary and rollback, with no failed requests under concurrent load; --record and sspur deploy replay re-run traffic against a new version and report differences. Real deploys get retained versions, a live alias and CodeDeploy canary with alarm rollback, rollback.sh and backfill.sh. Std library (ADR 0018), two rounds: Set, Heap, StrBuf, HashMap/HashSet (persistent HAMT, 5.5x faster lookups than Map), Regex (Pike VM, no backtracking), BigInt and fixed-point Dec, Bits, Time/Duration (UTC calendar, ISO 8601), Python-style .format(spec), the rest of <cmath>, saturating and rotate ops, seeded distributions and shuffle, lazy range pipelines and loops, fs binary I/O and directories, a proc effect (run_cmd, exit), JSON for every data type; a third round adds FlatMap, MdSpan, lazy View values fused into native loops, binomial/Poisson/geometric/gamma/beta/weighted draws and a splittable Rng, Complex, IANA time zones from the system zoneinfo, streaming File handles and Unicode case folding, all identical in both tiers with every suite function native; a fourth round adds Ratio, valarray idioms as fused pipelines, file copy, symlinks and permission bits, and Locale values with bundled collation and formatting for six locales; all 23 C++ library areas are covered. GPU kernels (ADR 0020): kernel fn with @grid, slice borrows, a device subset checked for races, the dev effect and DevBuf device buffers; the interpreter runs threads in order with exact F32, native code runs Metal (exact F32, rerunning on the CPU when a thread could trap or meet a subnormal) with identical results and traps, and sspur gpu emits OpenCL C, SPIR-V and PTX. ADR 0023 adds queued launches synchronized on buffer reads, shared[T](n) arrays with barrier() (uniformity and per-phase race checks), order-independent atomics, @grid2 2D grids and inlined pure helper fns. bench/native/gpu is 2.6x faster than C++ -O2 overall (0.38x; tiled matmul 8.4x). First real deploy verified on a test account: CRUD over HTTP API, Lambda and DynamoDB, least-privilege roles checked live, then torn down (ADR 0016), and a real canary, backfill and rollback on a test account (ADR 0019). Pending: SLO-driven rollout gates |
| 7 | Exit criterion met (ADR 0021): 100 concurrent agents (threads, 8 randomized edits each: add, change and rename functions, attach tests, edit shared functions, with one agent renaming a function all others call) on one codebase through the real transaction path: about 800 transactions, about 700 acknowledged, about 120 conflicts reported to their agents, 0 lost edits, the final codebase typechecks and all its tests pass. Definitions are CRDT registers (stable id, name and body registers), so renames commute with body edits; transactions are optimistic against a base, merged under a file lock with typecheck-on-merge and conflict reports that carry the other side’s source and a rebase; the commit sequence is crash safe across processes. Replicas sync by hash over directories or TCP (`sspur sync serve |
Language completeness
C++-level completeness is the target. The phase for each feature is in 05-systems-layer.md section 15. Features land when their phase is reached, but the design of every feature is fixed in Phase 1 so later phases never force a redesign.