Preview 0.5.0 release notes /Apache-2.0/Python 3.10–3.13
Geno is a statically typed, functional-first language for programs written with LLMs. Functions carry examples that run as tests, every block closes by name, and files, the network and other processes stay off until you grant them. It runs directly and compiles to Python and JavaScript.
$ pip install geno-lang
Needs Python 3.10–3.13. Geno is pre-1.0, so the language may still change.
Read the datasheet
The replay in five steps:
geno test -v score.geno prints: FAIL score.geno (3/4). x score_label: expected "passing", got "needs work".geno test -v score.geno prints: PASS score.geno (4/4). 4 passed, 0 failed.geno compile writes score.py and, with --target js, score.js.example clauses, required on ordinary functionsrequires and ensures contracts, compiled into every backendend func, end if, end matchgeno serve| Target | Runtime | Status |
|---|---|---|
| python-cli | CPython 3.10–3.13 | Beta |
| node-cli | Node.js | Beta |
| browser | Static HTML + JS | Beta |
| python-hosted | geno serve | Beta |
(1) For what each target needs, see 10.2 Targets.
Models are good at writing code that looks right. Geno is designed so that looking right is not enough. A function states its types, carries examples that run, and closes every block by name. A program cannot grant itself access to files, the network or other processes; the person running it grants each capability by name.
The result reads like a small, strict functional language: immutable by default, with algebraic data types, Result and Option for errors, pipelines and traits. The checker makes sure every case is handled, and geno test makes sure every example still holds.
Geno is in public preview. The parser and type checker are stable; the language surface may change before 1.0.
A Geno function is a component with a published interface. Its signature is the pinout, its examples are the test conditions, and its last line says exactly what it closes.
| Vector | score | Expected | Result |
|---|---|---|---|
| TV1 | 90 | "excellent" | PASS |
| TV2 | 89 | "passing" | PASS |
| TV3 | 60 | "passing" | PASS |
| TV4 | 59 | "needs work" | PASS |
score_label. Each example clause is a test vector, run by geno test. Point at a pin to read its function.1func score_label(score: Int) -> String3
5 requires score >= 0
4 example 90 -> "excellent"
example 89 -> "passing"
example 60 -> "passing"
example 59 -> "needs work"
if score >= 90 then
return "excellent"
else if score >= 60 then
return "passing"
else
return "needs work"
end if
6end funcscore.geno after the repair in Figure 1, with its pins marked.| Pin | Name | Type | Description |
|---|---|---|---|
| 1 | score: Int | I | Parameters always carry types. Local let bindings may be inferred. |
| 2 | caps: none | P | Effects. The body uses no capability, so it runs anywhere. A function that read files would run only where --cap fs is granted. |
| 3 | -> String | O | Return type, required. Errors are values, Result[T, E] and Option[T], never null. |
| 4 | example | T | Executable specification, run by geno test. Required on ordinary functions; main, async functions, app lifecycle hooks and @untested functions are exempt. |
| 5 | requires | C | Precondition, checked on every call in the interpreter, Python and JavaScript. ensures checks result. |
| 6 | end func | T | Named terminator. A mismatched end fails on its own line, so generated structure cannot drift silently. |
I = input, O = output, P = permission, C = contract, T = checked by the toolchain. Pin numbers match Figure 4-1.
Every number in this listing is live. Drag one sideways, or focus it and use the arrow keys. Move a threshold and watch which example catches it; the output is what geno test -v prints for the same program.
Figure 5-1. Example clauses under test. All 4 examples hold
The real Geno 0.5.0 toolchain, running in this tab on CPython compiled to WebAssembly (Pyodide). The first run downloads Python, about 13 MB, and your browser caches it. Your code never leaves the page.
Geno needs Python 3.10 to 3.13. Install the CLI, create a project, and run its examples.
$ pip install geno-lang$ geno init hello --template cli$ cd hello && geno test Main.geno
PASS Main.geno (3/3) (1 untested)
3 passed, 0 failed, 1 untested, in 0.11s
$ geno run Main.geno
>>> Hello, World! <<<| Template | Command | Creates |
|---|---|---|
| GENO-CLI | geno init app --template cli | Command-line program |
| GENO-WEB | geno init app --template web | Browser app with canvas |
| GENO-API | geno init app --template api | Multi-module API |
| GENO-LIB | geno init app --template lib | Reusable library |
From source: git clone https://github.com/davidiach/geno-lang && cd geno-lang && pip install -e ".[dev]"
Generated code runs with what the person running it allows, and within limits they can see.
Most computation is always available. Regular expressions and anything that reaches outside the program need a capability. Plain geno run grants print, clock and random; every other capability is granted by name by the person who runs the program, and a program cannot grant itself anything.
| Capability | Unlocks | Plain geno run(1) |
|---|---|---|
print | Console output | Granted |
clock | Timestamps, timing, sleep_ms | Granted |
random | Random numbers | Granted |
fs | Read, write and list files | Denied |
http | Outbound HTTP and HTTPS | Denied |
env | Environment variables, CLI arguments | Denied |
process | Run other programs | Denied |
regex | Regular expressions | Denied |
stdin | Standard input | Denied |
serve | Listen for HTTP requests | Denied |
(1) geno run app.geno compiles to Python and runs it in an isolated process with print, clock and random. Every other call is refused where it happens, naming the capability it needs (reported as E412 by --json and the embedding API).
Granting a capability
$ geno run --unsafe --cap print,fs app.geno # direct interpreter
$ geno run --json --cap print,env app.geno # embedding API, JSON result
$ python app.py --cap print,fs # compiled Python--cap grants exactly the capabilities it lists, so name print too if the program prints. The default lane refuses --cap, so a grant can never quietly switch off process isolation. --unsafe means no process isolation; capability checks and step limits still apply.
Granted is not unlimited. With fs, paths resolve inside the project’s filesystem roots and absolute paths are rejected; with http, loopback and private-network addresses are refused and responses are read through size limits. Generated JavaScript is trusted code, not a sandbox. See the security policy.
Figure 8-1. Capability gating. Grant capabilities and watch where the program stops.
Every geno run is bounded: a program that exceeds a limit stops with an error instead of exhausting the machine. Standalone compiled Python and JavaScript keep the integer and collection guards, but have no timeout or step limit of their own.
| Parameter | Default | Unit | Set with |
|---|---|---|---|
| Python, toolchain and compiled output | 3.10 – 3.13 | version | — |
| Interpreter steps per run(2) | 1,000,000 | steps | --max-steps |
| Call depth | 500 | frames | --max-recursion-depth |
| Integer size | 33,219 | bits | --max-integer-bits |
| String and collection size | 10,000,000 | elements | --max-collection-size |
| Captured output | 100,000 | characters | --max-output-length |
Sandboxed memory, geno run | 268,435,456 | bytes (256 MiB) | --max-memory-bytes |
Wall-clock timeout, geno run | 30 | seconds | --timeout |
(2) Applies to geno run --unsafe and --json. Every limit except memory is also a field of RunConfig in the embedding API, where the host sets it.
A small, strict functional language: immutable by default, with algebraic data types, Result and Option for errors, pipelines and traits. Each feature below is there because it turns a plausible mistake into a reported one.
A model writes one token at a time. With braces, the end of a loop and the end of a function are the same character, and losing count produces code that parses and means something else. In Geno every block closes by name, so a mistake fails at the exact line.
Because openers and closers always pair, Geno can say at any point in a partial program what is still open. That is what geno constrain reports, and what a constrained decoder can use to keep a model’s block structure intact.
Stack values in Figure 9-1 come from geno.constraints.get_unclosed_blocks on each prefix.
Figure 9-1. A model streaming Geno. Open blocks, innermost first.
Algebraic data types describe every shape a value can take, and the checker holds every match to all of them. Add a variant later and each match that ignores it stops compiling, naming the case it missed.
Click an arm to remove it or put it back. The output is geno check.
A wildcard _ also satisfies the checker. It covers every case, including variants added later, without naming them, so use explicit arms where a new case should force a decision.
Figure 9-2. Click a match arm to toggle it.
func parse_port(arg: String) -> Result[Int, String]
example "8080" -> Ok(8080)
example "http" -> Err("not a number: http")
match parse_int(arg) with
| Some(n) -> return Ok(n)
| None -> return Err("not a number: " + arg)
end match
end funcResult and Option replace null and unchecked exceptions. The ? operator returns an error early.
func squares_of_evens(xs: List[Int]) -> List[Int]
example [1, 2, 3, 4, 5] -> [4, 16]
return xs
|> filter(_, fn(x: Int) -> x % 2 == 0)
|> map(_, fn(x: Int) -> x * x)
end funcData flows left to right; _ marks where the value goes. List comprehensions cover the rest.
type Planet = Planet(name: String, moons: Int)
trait Describable
func describe(self: Self) -> String
end trait
impl Describable for Planet
func describe(self: Planet) -> String
example Planet("Mars", 2) -> "Mars has 2 moons"
return f"{self.name} has {self.moons} moons"
end func
end implShared behaviour without inheritance. Methods carry examples like every other function.
async func page_size(url: String) -> Int
return length(http_fetch(url))
end func
func main() -> Int
let size = await page_size("https://example.com")
let rows = csv_parse_with_headers("name,age\nAda,36")
return size + length(rows)
end funcasync and await, built-in JSON, CSV and TOML, and modules with explicit export.
One front end, three ways to execute. Before any backend sees the program, the checker holds every match to all of its cases and works out which effects each function has. geno test runs the examples; geno compile does not, so keep geno test in CI.
geno testgeno test, --unsafe, REPLgeno compile, geno runOne program, four places to run. A project declares its targets in geno.toml, and geno check --target rejects builtins a target does not provide before anything runs.
Command-line tools and automation. Multi-module projects compile to one Python file that runs without Geno installed.
$ geno compile app.geno -o app.py
$ python app.py --cap print,fsThe same program on Node.js, as a script or ES module with source maps and type declarations. Trusted execution only.
$ geno compile app.geno --target js -o app.js
$ node app.js --cap printApp-mode programs with init, update and render build to static files with canvas, keyboard and mouse.
$ geno build Main.geno -o dist/
$ geno dev # live reloadAn HTTP runtime with isolated execution, authentication, rate limits and Prometheus metrics.
$ geno serve
# POST /run · GET /healthz · GET /metricsCompiled Geno against hand-written Python on the same 53 problems. Geno keeps its safety checks in the compiled output, guarding integer growth and collection sizes, and pays for them here.
Each reference app must check, test and build before a release is tagged. Together they cover all four modes.
fs, print and env.
browsergeno-dashA canvas system monitor: four stat cards, a bar chart and two sparklines, redrawn every second from simulated metrics.
python-hostedgeno-snapA mock JSON API on geno serve. It checks each request by hand and answers 400 or 404 when one is malformed.
node-cligeno-logSummarizes five built-in service events under Node.js. The report is checked byte for byte against expected.out.
python-cligeno-pipeA fixed CSV pipeline, filter, sort, select and take joined with |>, printed as CSV, JSON, a table and Markdown.
browsergeno-formRegistration and contact forms drawn on canvas from typed field records, with length and range rules checked on Enter.
python-cligeno-markMarkdown to a styled HTML page: anchored headings, a table of contents, lists, quotes and code blocks.
browsertetris.genoFalling blocks on a 10×20 well in one file, with arrow keys, a next-piece preview and the app-mode lifecycle.
Models arrive knowing Python and JavaScript. These rules cover the mistakes they make most often in Geno. Paste them into a system prompt, then let geno test report anything they miss.
You are writing code in Geno, a statically typed, functional-first language. - Immutable: let x = 5. Mutable: var count = 0. - Parameters and return values need type annotations. - Booleans are lowercase: true, false. - Concatenate strings with +. Integer division truncates: 7 / 2 = 3. - Close blocks by name: end func, end if, end for, end while, end match. - Write then after if conditions and do after for and while. - Every function except main needs at least one example clause. - Functions with 3 or more parameters take named arguments. - Use Option[T] instead of null and Result[T, E] for errors. - Do not name anything end, in, with, type, or a Python builtin.
dist/Geno is created and led by David Iach, the project lead and code owner. Governance explains how decisions are made and how contributors become maintainers.
Geno is in public preview. This is what you can rely on today, from the maturity matrix.
.d.tsgeno build to dist/ or one HTML file| Revision | Date | Changes |
|---|---|---|
| 0.5.0 | 2026-10-14 | 0.5.0-rc.1 promoted unchanged; still pre-1.0 |
| 0.5.0-rc.1 | 2026-10-14 | main() -> Int becomes the exit status; named constructor arguments; an Async value runs once; module constants; normative 0.5 specification |
| 0.4.4 | 2026-09-20 | geno check validates lowering through the Python backend |
| 0.4.2 | 2026-07-22 | Versioned specification, frozen conformance corpus, weekly 2,000-case differential fuzzing |
| 0.4.0 | 2026-07-13 | Single builtin manifest; recursive exhaustiveness for nested patterns |
| 0.3.0 | 2026-04-06 | CSV and TOML builtins; process capability |
| 0.2.1 | 2026-03-31 | JavaScript backend |
| 0.2.0 | 2026-02-06 | Embedding API; capability-based security |
| 0.1.0 | 2024-12-01 | Initial release: lexer, parser, type checker, interpreter, Python compiler |
Complete history in the changelog.
Geno 0.5.0 makes main() -> Int your process exit status, adds named constructor arguments, and runs an Async value at most once. Here is what changed and how to migrate.
Most language playgrounds send your code to a server. Geno's runs the actual CLI inside your browser tab, with Python compiled to WebAssembly and a 600 KB bundle of the toolchain.
Ordinary Geno functions must carry at least one example clause, and geno test runs them all. Why we made examples mandatory, and what that buys you when a model writes the code.