Sigil

What is Sigil

Sigil is the shorthand; CSSL — Caveman Sigil Substrate Language — is the full name. Same language. It is a single-source systems language that compiles to native x86-64 (AVX2 base + AVX-512 opportunistic) and SPIR-V (Vulkan 1.4 + Level-Zero), with backend stubs for D3D12, Metal, WebGPU, and consoles.

Four things distinguish it from the languages it draws from. First, the type system includes a Koka-style row-polymorphic effect system with 28+ built-in effects covering timing, power, thermal, backend gating, and IFC. Second, engine primitives — SDFs, Jets, render graphs, scenes — are compiler-aware built-ins, not library wrappers. Third, the non-negotiable feature set (autodiff, refinement types, effects, staging, IFC, observability) all ship in v1 rather than as "future work." Fourth, a set of bug patterns observed in prior game-engine work (Labyrinth of Apocalypse retrospective) were each mapped to a compile-time structural refusal — CSSL inverts "runtime safety" into "compile-time inexpressibility of the bug."

The language is currently pre-1.0. The compiler (compiler-rs/, 31 crates) is under active development. The specification (25 .csl files, ~200KB) is complete and frozen for v1. What follows is a reference to what the language is, grounded in the spec, with an honest note on what has shipped in the compiler versus what remains.

A Shader, Autodiff'd

An SDF shader in CSSL. Autodiff is a first-class operator (bwd_diff), not a library. The effect row on sdf_pixel says the function runs on GPU, under a 16ms deadline, emitting dispatch latency telemetry — the compiler discharges these statically where it can and asserts at runtime otherwise.

module com.apocky.examples.sdf_shader

use std::math::{vec3, length, normalize, dot, max}
use std::gpu::vec4

// Lipschitz-1 sphere SDF; F1-AD enabled.
@differentiable
@lipschitz(k = 1.0)
fn sphere_sdf(p : vec3, r : f32'pos) -> f32 {
    length(p) - r
}

@differentiable
fn scene_sdf(p : vec3) -> f32 {
    let d1 = sphere_sdf(p, 0.5)
    let d2 = sphere_sdf(p - vec3(1.0, 0.0, 0.0), 0.3)
    min(d1, d2)
}

// Normal via reverse-mode AD. bit-exact vs analytic central-differences.
fn surface_normal(hit_pos : vec3) -> vec3 {
    let g = bwd_diff(scene_sdf)(hit_pos).d_p
    normalize(g)
}

@fragment
fn sdf_pixel(uv : vec3) -> vec4
    / {GPU, Deadline<16ms>, Telemetry<DispatchLatency>}
{
    let cam_origin = vec3(0.0, 0.0, -3.0)
    let dir        = normalize(uv - cam_origin)
    let t          = ray_march(cam_origin, dir, 64)
    let hit        = cam_origin + dir * t
    let n          = surface_normal(hit)
    let lit        = max(dot(n, normalize(vec3(1.0, 1.0, -1.0))), 0.0)
    vec4(lit, lit, lit, 1.0)
}

Source: examples/sdf_shader.cssl in the CSSL repository. This compiles through HIR → MLIR → SPIR-V. The bwd_diff operator is lowered by source-to-source transformation on the structured MIR before SPIR-V emission.

The Non-Negotiable Six (F1–F6)

These are the features CSSL commits to shipping in v1. Each is referenced by ID throughout the specification (specs/00_MANIFESTO.csl).

The Effect System

Effects are row-polymorphic (Koka lineage): ⟨e₁, e₂ | μ⟩ where μ is an inferred tail. A function's effect row declares its observable side-effects and hardware requirements; the compiler unions them with the caller's context and checks that the result is within the caller's declared bound.

28+ effects ship in v1. The categories below are from specs/04_EFFECTS.csl.

Discharge timing

Effects fall into three discharge buckets — how the compiler verifies them.

• Compile-time only: {NoAlloc}, {NoRecurse}, {NoUnbounded}, {DetRNG}, {PureDet}, {Reversible}, {CPU/GPU/XMX/RT}, {SIMD*}, {NUMA/Cache}, {Backend/Target}, {Region}, {Sensitive/Privilege}.
• Compile-time + runtime assert: {Deadline} (cost estimate + wallclock guard), {Power} (static model + sysman sample), {Thermal} (reject-if-overbudget + sysman sample), {Realtime}, {Verify} (SMT discharge), {Audit} (schema + signed-chain write), {Telemetry} (probe insertion + ring push).
• Runtime only: user-defined handlers (State, Exn, Yield, custom).

Capability Model — Pony-6

Six reference capabilities control aliasing. This is Pony's model (not Austral's three), extended with Vale-style generational references for shared-mutable.

Linear values flowing through a handler permit one-shot resume only — a multi-shot resume on a linear value is a compile error. This is the Eio-OCaml5 pattern, production-proven, and is what makes fiber scheduling sound in the presence of exclusive resources.

Primary Hardware Target

CSSL is hardware-grounded: the v1 target is specified concretely, not abstractly. Other vendors work via SPIR-V portability; Intel gets the deep path because Level-Zero is a direct-to-metal compute and instrumentation API.

Backend surface

Cooperative-matrix ops use KHR_cooperative_matrix (portable) preferred over SPV_INTEL_subgroup_matrix_multiply_accumulate. Ray-tracing uses VK_KHR_ray_query for inline-RT. Full extension inventory: specs/10_HW.csl.

Compilation Pipeline

Stage 0 uses Cranelift as a throwaway code generator to bootstrap. Stage 1+ replaces it with a bespoke x86-64 emitter owned by the project. No LLVM dependency anywhere in the pipeline. SPIR-V emission via rspirv from day one. MLIR Transform-dialect is used for pass scheduling (specs/15_MLIR.csl).

Bugs → Compiler Features

The design premise: the patterns that cause bugs in game-engine code are patterns the host language permits. CSSL inverts this — each known bug pattern is mapped to a structural refusal. From the Labyrinth of Apocalypse bug retrospective (specs/00_MANIFESTO.csl):

Dual Surface Syntax

CSSL has two parseable surfaces that share one HIR: a Rust-hybrid form (external-facing, familiar keywords, good for docs and onboarding) and a CSL-native form (primary, compressed, optimized for token density). Both parse to the same intermediate representation; a formatter round-trips losslessly between ASCII and Unicode glyphs.

The effect row after / is the signature's observable side-effects. A pure function omits it. Capability keywords (iso, trn, ref, val, box, tag) are first-class type constructors.

// effect system: declare what a function observes.
fn render_scene<S : Scene>(cam : Camera) -> Image
    / {GPU, Deadline<16ms>, NoAlloc, Power<225W>,
       Thermal<85C>, Telemetry<Counters>}
{
    for (x, y) in grid(cam.size) |> parallel {
        let ray = cam.ray(x, y)
        let hit = ray_march::<S>(ray) ?: return background()
        let n   = bwd_diff(S::eval_sdf)(hit.pos)   // compiler inserts AD
        emit pixel(x, y, shade(hit, n))
    }
}

// handler syntax: define an algebraic effect.
effect Physics<World> {
    fn step(dt : f32'pos) -> World
    fn contact(a : Entity, b : Entity) -> Option<Hit>
}

Targets Matrix

Hardware, OS, and backend support for v1.

NVIDIA and AMD work on any platform via SPIR-V portability. No proprietary-NV path; RDNA3+ uses CooperativeMatrixKHR.

Repository & Specs

Specification is v1-complete. Compiler is in compiler-rs/ across 31 workspace crates. Everything is in one repository.

Sigil (CSSL) vs CSL

The site root also documents CSL. They are distinct and must not be conflated.

Prime Directive