A contract-and-dispatch language for agent-to-agent trust
Codifide is not a general-purpose language. It codifies what software usually leaves implicit — intent, effects, contracts, confidence, and refusal — and preserves those properties with byte-level fidelity across every agent that reads, writes, or composes the code.
def classify
intent "label an image, refuse rather than guess"
sig (img: Image) -> Label
effects {model.vision}
cand
label <- vision.classify(img)
believe label
ge(conf(label), 0.85) => label
ge(conf(label), 0.60) => escalate(img, label)
else => bottomWhy this exists
Every mainstream language — from Fortran to Rust — was built around human cognitive constraints. Agents don't share those constraints. But they have different weaknesses.
The problem
An agent will happily declare effects {} on a function that writes to disk,
because the claim is plausible and nobody made it check. An agent will hand another agent
a library by name and version and expect the recipient to know which library was meant.
An agent will discard intent after compilation because the compiler did.
The answer
Codifide answers each of those with a property the language enforces rather than trusts. Effects are checked transitively at module load. Symbols are referenced by content hash — two agents naming the same hash see the same bytes. Intent is part of a definition's canonical form; you cannot rename or re-intend a symbol without minting a new identity.
Six enforced properties
These are the properties that matter for agent-to-agent trust — declared in the type, enforced by the runtime, preserved across composition.
Every function carries why it exists as structure — not a comment the compiler discards. A symbol's intent is part of its content-addressed identity.
Declared in the type and enforced transitively across the call graph. A pure function cannot call an impure one and launder the effect.
Pre- and postconditions the runtime evaluates — not docstrings. Contracts run with an empty effect budget. They describe state; they do not modify it.
believe label ge(conf(label), 0.85) — probability as a first-class dispatch mechanism. Every value can carry a confidence score.
bottom is a value, not an exception. A function that does not know enough to answer says so explicitly. The runtime respects that.
Two agents naming the same content hash see the same bytes, the same contracts, the same intent. No drift. No version gaps. No trust gaps.
What Codifide is — and isn't
Codifide is
- A contract-and-dispatch language
- Optimized for declaring intent and contracts
- Optimized for dispatching among candidates
- Optimized for enforcing effects
- Optimized for content-addressing compositions
- The properties that matter for agent-to-agent trust
Codifide is not
- A systems language
- A general-purpose computation language
- A replacement for Python, Rust, or TypeScript
- Designed for raw iteration or mutable state
- Designed for deep recursion or data structure manipulation
- Trying to be everything to everyone
What working Codifide code looks like
Contracts run pure
def greet
intent "welcome a known user by name, neutrally"
sig (name: String) -> String
effects {io.stdout, clock.read}
pre ne(name, "")
post contains(result, name)
cand
now <- clock.now
io.say("Hello, " ++ name ++ ", it's " ++ now.hm)Content-addressed imports
module consumer
import hello = sha256:f8fb...
from sha256:5899... import goodbye
def main
intent "use two library symbols"
sig () -> String
effects {}
cand
hello("Ada")Get started
pip install codifide
python3 -m codifide run examples/greet.cod
python3 -m codifide run examples/sort.cod
python3 -m codifide run examples/classify.cod
python3 -m codifide test