hilde hilde

a programming language

Deutsch

Why Hilde

The name says what Hilde is after: High-Integrity, Linear, Deterministic, Explicit. Hilde is not a criticism of Rust or C. It is a different approach, with different weights: a small language, one strict rule for resources, and messages that say exactly what is wrong.

What Hilde does for people, it also does for AI

Austral, the language Hilde is built on (specification, a mirror of the one on Austral's website), was designed to be read: few constructs, no operator precedence to remember, and errors that name their cause. That helps a person who reads code they did not write. It helps an AI assistant in the same way. Hilde's stated aim is to make coding with AI assistants safer: the typical mistakes of an assistant are ones a strict compiler can catch, and each comes with a stable code such as H4008 and an entry with a failing and a correct example. The assistant sees its mistake and can fix it.

The following sections show what Hilde added beyond Austral; where a part already comes from Austral, it says so.

Contracts in the language, not in a library

C++26 has taken contracts in (P2900: pre, post and contract_assert). There the implementation decides whether a contract is ignored, observed or enforced; in Hilde contracts are part of the language and always checked. A function says what must hold when it is called (requires) and what holds when it returns (ensures), and records carry invariants. The contract of a public function stands once, in its interface, where every caller reads it, a person or an AI assistant; a public function without one says in its docstring why it has none. Contracts are checked at run time and cannot be switched off, hilde test makes random tests from them, and simple cases are proved when the programme is compiled. More in the basics and the decisions.

In the shop window: Raft

What the language promises shows best in one hard piece of code. Standard.Raft is the Raft consensus algorithm as a pure state machine: no network, no disk and no clock, which belong to the caller. The invariants of the Raft specification stand in the code as contracts and are checked after every event in the tests: at most one leader per term, logs that agree on an entry agree before it, every leader holds the committed entries, no two machines differ in what both applied. Because the machine owns nothing outside, the tests with partitions run the same every time. On top, Standard.RaftTcp carries the messages over TCP and Standard.SqliteReplica replicates SQLite through it. More on the Raft page.

Avoiding typical C mistakes without giving up C

Hilde compiles to C17; the C is built with cc, clang or zig cc, and the project's build checks count zero warnings under all three. Safe Hilde code catches the typical C mistakes like this; only the unsafe Bindings.* modules are excepted.

At compile time:

At run time, the programme stops with a message:

Linear types and the overflow check come from Austral; new in Hilde are the duty to look at every Option and Either, the contracts, and zero warnings under three compilers.

No garbage collector

Hilde has no garbage collector. A linear value is consumed exactly once, and the compiler checks that every resource is released at a fixed point (linear types). So there are no pauses to collect, and memory is freed where the code says so. For the many small values of one unit of work, such as one FastCGI request, a programme can use Standard.Arena selectively: it releases everything at once, and no reference into it outlives its borrow. On OpenBSD a request with 2000 small values became 3.3 times faster with it. For few values and for security-critical code, OpenBSD's hardened malloc remains the better choice. Austral already had no garbage collector; Standard.Arena is Hilde's.

Concurrency modelled on Go

Concurrency should be as easy as in Go, but safe. So tasks run on fibers instead of callbacks. Every task belongs to a scope and ends with it. The two ends of a channel are linear values. A task cannot take a reference that outlives its borrow (H3002). More in tasks and channels.

Regular expressions and templates

Standard.Regex runs in linear time with the syntax of RE2; back references and lookaround are refused with a pointer to Standard.Pcre, which binds PCRE2 for the cases that need it. Whoever comes from Perl and likes PCRE finds the familiar syntax in Standard.Pcre: back references, lookahead and lookbehind, groups with their positions and replacing with \1; with Standard.PcreJit the JIT of PCRE2 compiles the patterns to machine code. Templates use the syntax of Jinja2, but they are checked and translated into Hilde code when the programme is compiled: nothing of the template is parsed at run time, and a template that does not fit its record does not compile.

Why HTML

Where Hilde produces web pages, it uses HTML on purpose: HTML is well known from the data AI assistants are trained on, while Hilde is not yet. Templates use the well-known syntax of Jinja2 for this (see above).

"unsafe" only in the bindings

A module may bind C, paste C or touch raw memory only with pragma Unsafe_Module, and the compiler checks it. In the standard library such modules are the thin bindings under Bindings.*, and a programme cannot import them (H2045); it imports the safe Standard.* module built on top. The compiler's own built-in core (Hilde.Pervasive, Hilde.Memory, Hilde.Array) is unsafe as well. pragma Unsafe_Module comes from Austral; new are the split into bindings and that a programme cannot import them. More on the security page.

Only the runtime a programme needs

Hilde's runtime in C is split into parts: the core, tasks, the sandbox, files, sockets and more. A programme gets only the parts whose functions it actually calls; hello world carries only the core. That shrank hello world from 134,088 to 67,808 bytes, and a programme with signatures and JSON by 17 per cent. Less C in the binary also means less code that no contract covers.

C to keep working on

With hilde compile --target-type=c Hilde writes a programme as one C17 file: the parts of the runtime it needs, the translated code, and at the end a comment naming the libraries to link. The names stay readable, such as Hilde__Pervasive__abort__d9, with #line to the Hilde source if asked for, and the contracts stand in the C as ordinary checks. Anyone who knows C can build the file with cc, clang or zig cc and keep working on it there; hilde export --with-c adds it to a release if asked for. What is changed in the C after that is no longer checked by Hilde: neither the linear types nor the contracts at compile time. Austral already writes C; new are the readable names, #line, the contracts in the C and --with-c.

Command lines after clap

Standard.Arguments follows the builder API of clap 4, the Command Line Argument Parser of Rust (Command, Arg, ArgAction); clap's derive form has no counterpart. Hilde follows clap rather than Go's Cobra because in clap the command line is a plain value with one result in one place. That fits linear types and is harder for AI assistants to get wrong, too. Standard.Arguments goes further: every option returns a typed key. A typo in an option name does not compile (H6039), and a key of the wrong kind is a type error (H3060). Arguments after clap maps clap to Hilde call by call and carries three programmes written in both, compared with clap 4.6.7. The package commands of hilde are carried out by a companion tool written in Hilde, and its command line is built on Standard.Arguments; so is the command line of RAMBO. The compiler itself is (so far) written in OCaml.

No replacement for Rust or Zig

Rust is a brilliant language, and Hilde does not want to replace it. Hilde tries to bring many of its advantages, small, simple and easy to follow, into code that a C compiler turns into small binaries anywhere. Zig is an excellent language too, and Hilde does not want to replace it either. Hilde owes both a lot: zig cc builds Hilde programmes for other targets and for WebAssembly and serves as a further compiler in the full gate. A Hilde package can use Rust crates through bridge modules, and ML-DSA comes from the C code of libcrux, which is generated from Rust. There are many great languages and tools. Hilde is not better by definition; it is built the way we think is right for Hilde.

Origin and licence

Hilde is a fork of Austral at commit 0962d2a8 (29 July 2025). Austral's compiler is under the Apache License 2.0 with LLVM Exception, and so is Hilde; Austral's specification is under the GNU Free Documentation License 1.3. Details on the licence page.

Hilde owes a lot to many. We value every language and tool Hilde has learned from, and we are grateful: Austral as the foundation, and Ada, Eiffel, Go, Rust, C++, C with Zig, Perl, Python and OpenBSD. Hilde follows the idea of bringing what we liked best about them together in one language. And because Hilde itself is freely licensed, anyone can use it.