# Fortis

> Fortis is a statically checked, compiled, general-purpose programming language designed so that software written mostly by AI agents can be read, reviewed and trusted by people. A reader of a file or a diff can answer, without tooling, who owns each value, which calls can change it, which calls can fail and who handles the failure, what effects a function has, and when an observation is recorded: every one of those decisions is written in the source (Language Reference 1). The checked program runs on a development VM and compiles to safe Rust.

Status: v0.0.1 release candidate. Developed by Pickering Technologies Ltd. MIT licence.
Markdown of every page is published beside its HTML; the full agent-mode documentation is concatenated in /llms-full.txt.

## Agent documentation
- [Fortis for agents](/docs/docs/agent/README.md): Fortis is a statically checked, compiled, library-first language built so that code written mostly by agents can be reviewed and trusted by people: every ownership operation, mutation permission, fail
- [Known limitations of v0.0.1](/docs/docs/agent/known-limitations.md): Open, non-blocking defects in v0.0.1's scope, plus loud refusals (X-343): a checked program, a non-zero exit, another backend correct.
- [Records](/docs/docs/agent/records.md): Every finding, runtime failure report, test result and observation the toolchain produces is a record first: a JSON object of a known kind, from which the text a person sees is rendered (Programme 7.4
- [Diagnostic codes](/docs/docs/agent/codes.md): Every diagnostic code the Language Reference names, grouped by class.
- [Overview: design invariants and notation (LR 1, LR 2)](/docs/docs/agent/01-overview.md): LR 1 and LR 2 state no numbered rules; they fix the invariants every later rule serves.
- [Lexical structure (LR 3)](/docs/docs/agent/03-lexical.md): The lexical rules of LR 3 by rule ID: names, keywords, literals, strings and comments, with codes and corrections.
- [Modules and packages (LR 4)](/docs/docs/agent/04-modules.md): LR 4.3 and 4.6 state some rules without naming a code: an import of an undeclared package or of a module the exporting package does not list, an import that collides with a local declaration, and a mi
- [Statements and expressions (LR 5)](/docs/docs/agent/05-statements.md): The statement and expression rules of LR 5 by rule ID, with codes and corrections.
- [Types (LR 6)](/docs/docs/agent/06-types.md): Void Never Bool; Int8 Int16 Int32 Int64 UInt8 UInt16 UInt32 UInt64 (Int = Int64, UInt = UInt64, Byte = UInt8); Float32 Float; Decimal BigInt; String StringView Bytes BytesView; Duration Instant Timest
- [Proofs for arithmetic and indexing (LR 6.3, 6.4, 6.7)](/docs/docs/agent/06-proofs.md): Language 1.0's interval domain is exactly the rules below; nothing else is inferred (LANG-06-02, LR 6.3).
- [Ownership (LR 7)](/docs/docs/agent/07-ownership.md): Places: a binding, a field path from a binding or self, an Array element at a literal index.
- [Functions and closures (LR 8)](/docs/docs/agent/08-functions.md): Modifiers appear in exactly the order of LR 8.1; any other order is a canonicalisation error that the formatter fixes (LR 8.1).
- [Classes, interfaces, mixins and enums (LR 9)](/docs/docs/agent/09-classes.md): The class, interface, mixin and enum rules of LR 9 by rule ID, with codes and corrections.
- [Outcomes and failures (LR 10)](/docs/docs/agent/10-outcomes.md): The outcome and failure rules of LR 10 by rule ID: declared errors, obligations and recovery, with codes and corrections.
- [Effects and contracts (LR 11)](/docs/docs/agent/11-effects.md): The effect and contract rules of LR 11 by rule ID: claims, capabilities and noalloc, with codes and corrections.
- [Cleanup, async and concurrency (LR 12)](/docs/docs/agent/12-async.md): The cleanup, async and concurrency rules of LR 12 by rule ID, with codes and corrections.
- [Observation schemas and statements (LR 13)](/docs/docs/agent/13-observation.md): Effects: observation does not change a function's effect summary; records go to the diagnostic plane, which feeds nothing back (LR 11.7).
- [Test declarations (LR 14)](/docs/docs/agent/14-tests.md): Records (JSON lines with --format json or on a pipe): test-result (test, case, status, evidence), property-failure (seed, original, minimal, shrinks, replay), and a final test-summary (passed, failed)
- [Core runtime inventory (LR 15)](/docs/docs/agent/15-runtime.md): LR 15 has no rule table of its own; its components are bound by rules elsewhere: LANG-04-06 (LR 4.6), LANG-11-07 (LR 11.6), LANG-12-04 (LR 12.5), LANG-13-01 (LR 13).
- [Reserved declaration heads for kits (LR 16)](/docs/docs/agent/16-kits.md): LR 16 has no rule table; the rule that binds it is LANG-03-04 (LR 3.4): every reserved word, head words included, is rejected in declaration and binding positions and admitted as a member or method na
- [Embedded languages (LR 16)](/docs/docs/agent/embedded-languages.md)
- [Keyword inventory (LR A)](/docs/docs/agent/appendix-a-keywords.md): Tool behaviour: the checker stops parsing a module at its first E-SYN-002, so fix each one and re-check; the rule itself is LR 3.4.
- [Closed decisions (LR B)](/docs/docs/agent/appendix-b-decisions.md): Decisions Language 1.0 does not reopen.
- [Lowering reference and the Rust-expressible subset (LR C)](/docs/docs/agent/appendix-c-lowering.md): Generated application crates carry #![forbid(unsafe_code)]; a rustc rejection of frontend-accepted code is a compiler defect only inside the Rust-checked fragment (LR 7.10, LR C.1).
- [Rule index (LR D)](/docs/docs/agent/appendix-d-rules.md): Every LANG- rule, its section, a condensed statement and the agent page that carries its codes and correction patterns.
- [Glossary (agent mode)](/docs/docs/agent/glossary.md): One meaning per term; where a word has two meanings both rows are listed.
- [The core library](/docs/docs/agent/library.md): The signatures of the core library package, generated from the declarations of library/fortis.
- [fortis-code](/docs/skills/fortis-code/SKILL.md): Fortis source is read through the language's tools, never through text tools.

## Language Reference
- [Fortis — Specification Overview](/docs/docs/Fortis_Specification.md): Document: FSPEC-0.2 • Date: 22 October 2026 • Supersedes: FSPEC-0.1 (Fortis_Full_Specification.md, now this file) • Status: normative baseline for Fortis Language 1.0 and the kits; not an implemented 
- [Fortis Language Reference](/docs/docs/Fortis_Language_Reference.md): Document: FSPEC-0.2-LR • Date: 22 October 2026 • Status: normative reference for Fortis Language 1.0 (the core).
- [Fortis Platform Specification](/docs/docs/Fortis_Platform_Specification.md): Document: FSPEC-0.2 / Platform • Date: 22 October 2026 • Status: normative baseline for the kits.

## Human guide
- [Fortis](/docs/README.md): Fortis is a statically checked, compiled, general-purpose programming language designed so that software written mostly by AI agents can be read, reviewed and trusted by people.
- [The Fortis guide](/docs/docs/guide/README.md): This guide teaches Fortis Language 1.0, the core language, from the beginning.
- [A tour of Fortis](/docs/docs/guide/tour.md): This chapter says what Fortis is for, gets the tools running, and then walks through one whole program, a small to-do list, pointing to the chapter that explains each piece.
- [Lexical structure](/docs/docs/guide/03-lexical.md): This chapter is about the text of a program before it means anything: files, lines, names, keywords, literals, strings and comments.
- [Modules and packages](/docs/docs/guide/04-modules.md): A Fortis program is a set of packages; a package is a set of modules; a module is one file (LR 1).
- [Statements and expressions](/docs/docs/guide/05-statements.md): A Fortis function body is a sequence of statements in blocks.
- [Types](/docs/docs/guide/06-types.md): Fortis is nominally typed: two types are the same only when they are the same declaration, whatever their representation (LR 6.1).
- [Proving arithmetic and indexing](/docs/docs/guide/06-proofs.md): An integer operator in Fortis never overflows, never divides by zero and never shifts out of range, and an index never falls outside its list.
- [Ownership](/docs/docs/guide/07-ownership.md): Every value in Fortis has exactly one owner, and every other use of it is either a loan or a transfer that the line says out loud.
- [Functions and closures](/docs/docs/guide/08-functions.md): Functions are where most Fortis code lives, and their heads carry more information than in most languages: what the function may do (its modifiers), what it does with each argument (the parameter mode
- [Classes, interfaces, mixins and enums](/docs/docs/guide/09-classes.md): Fortis has no inheritance.
- [Outcomes and failures](/docs/docs/guide/10-outcomes.md): Fortis has no exceptions.
- [Effects and contracts](/docs/docs/guide/11-effects.md): A reader of a Fortis function wants to know what it may do besides compute its result: allocate, touch the outside world, change something it was not handed, read the clock, wait, fail, or quietly swa
- [Cleanup, async and concurrency](/docs/docs/guide/12-async.md): This chapter is about time: what runs when a block ends, in what order values are destroyed, and how a program does several things at once.
- [Observation](/docs/docs/guide/13-observation.md): Logs and metrics are usually an afterthought: a line printed here, a counter bumped there, and nobody can say which facts every request is guaranteed to record.
- [Tests](/docs/docs/guide/14-tests.md): Tests in Fortis are declarations, part of the core grammar, written in the same module as the code they test.
- [The core runtime](/docs/docs/guide/15-runtime.md): Fortis is not only a compiler.
- [Kits and declaration heads](/docs/docs/guide/16-kits.md): The core language has no HTTP server, no database layer, no web components and no dependency injection.
- [Embedded languages](/docs/docs/guide/embedded-languages.md): Many programs hold text in another language: a SQL query, an HTML template, a regular expression, a JSON document.
- [Appendix A: Keywords](/docs/docs/guide/appendix-a-keywords.md): Fortis reserves its keywords: a keyword can never be the name of a variable, a parameter, a field, a type or any other declaration (LR 3.4).
- [Appendix B: Closed decisions](/docs/docs/guide/appendix-b-decisions.md): Some questions come up whenever someone meets Fortis: why no semicolons, why give and not yield, why there is no ? operator.
- [Appendix C: Lowering to Rust](/docs/docs/guide/appendix-c-lowering.md): Fortis has two execution paths that share one semantics: the development VM runs the checked intermediate representation directly, and the production backend turns it into safe Rust, a crate marked #!
- [Appendix D: Rule index](/docs/docs/guide/appendix-d-rules.md): Every normative rule of the core has an ID of the form LANG-<section>-<nn>, and each LR section ends with a table of its rules and the evidence that tests them (LR 0).
- [Worked examples](/docs/docs/guide/worked-examples.md): The chapters each show one construct at a time.
- [Notes for readers coming from Rust](/docs/docs/guide/from-rust.md): Fortis will feel familiar to a Rust programmer: values have one owner, moves are real, shared mutation is not allowed, failures are values, and the native backend emits safe Rust (LR 1).
- [Notes for readers coming from TypeScript](/docs/docs/guide/from-typescript.md): TypeScript adds static types to a dynamic language and leaves the runtime alone.
- [Notes for readers coming from Python](/docs/docs/guide/from-python.md): Python checks a program while it runs; Fortis checks it before anything runs.
- [Glossary](/docs/docs/guide/glossary.md): The words this guide uses with a precise meaning, each with the section that defines it.
- [Known limitations of v0.0.1](/docs/docs/guide/known-limitations.md): v0.0.1 is a subset of the language (the ladder in the delivery plan).

## Release
- [v0.0.1 release notes](/docs/docs/releases/v0.0.1.md): The v0.0.1 release notes: what the release ships, how it was checked and reviewed, and what happens next.
- [Known limitations (human guide)](/docs/docs/guide/known-limitations.md): v0.0.1 is a subset of the language (the ladder in the delivery plan).
- [Known limitations (agent mode)](/docs/docs/agent/known-limitations.md): Open, non-blocking defects in v0.0.1's scope, plus loud refusals (X-343): a checked program, a non-zero exit, another backend correct.

The release ladder (each release keeps everything earlier releases shipped, and adds):
- v0.0.1: Write, check, run, build, format and test real programs
- v0.0.2: Read code that says only what matters
- v0.1: Model a domain
- v0.2: Trust effects and test properly
- v0.3: Write concurrent code
- v0.4: Use a complete standard library
- v0.5: Run in production
- v0.6: Work at scale
- v1.0: Rely on it

## Examples
- [Examples (JSON)](/examples.json): the four example programs with their review notes, line mappings and expected output.
- [Failures you can see](/examples/mean.md): the complete program `mean.ft` with its review notes.
- [Cleanup without a collector](/examples/cleanup.md): the complete program `resource.ft` with its review notes.
- [Patterns that take ownership](/examples/patterns.md): the complete program `parcel.ft` with its review notes.
- [Recover, report or pass on](/examples/outcomes.md): the complete program `half.ft` with its review notes.

## Optional
- [fortis-code](/docs/skills/fortis-code/SKILL.md): the official agent skill, installable with `bin/fortis skill install`.
- [index.md](/index.md): the landing page as Markdown.
- [llms-full.txt](/llms-full.txt): the full agent-mode documentation in one file.