v0.15.1: Toolchain Confidence

v0.15.1 is a release-integrity and toolchain-confidence update for With.

The main job of this release is to make the self-contained toolchain story real across release artifacts: Windows installer assets are now published, Windows SDK packaging is stricter, SDKs must prove they were built with the pinned Clang toolchain, and SDK packages now carry the With-owned CMake and Ninja needed to reproduce future SDK builds without trusting host tooling.

This release also brings the checked-overflow implementation into the v0.15.1 tag line and tightens several spec/requirements sections so the written contract matches With's actual philosophy: safe by default, low ceremony where the compiler has the facts, and explicit boundaries only where real danger remains.

Highlights

Checked arithmetic is now in the release line

Plain arithmetic overflow is checked by default. Overflow is a bug, not implicit wraparound. Intentional modular or saturating arithmetic remains explicit.

with -e 'let x: i32 = 2147483647; let _ = x + 1'
# panic: integer overflow

with -e 'const X: i32 = 2147483647 + 1; let _ = X'
# error: integer overflow in comptime

with -e 'let x: u8 = 255; assert(x +% 1u8 == 0)'
with -e 'let x: u8 = 250; assert(x +| 20u8 == 255u8)'

Builds may also select an overflow policy explicitly with --overflow=panic, --overflow=wrap, or --overflow=saturate.

Windows release install and SDK assets

The release now publishes the Windows installer scripts and native Windows compiler asset alongside Darwin and Linux:

with-windows-x86_64.exe
install.ps1
install.cmd
with-llvm-sdk-22.1.6-windows-x86_64.tar.zst

README installation docs now include the Windows install flow.

Self-contained SDK packaging is stricter

The release SDK packages now enforce the invariant that SDKs are With-owned toolchain artifacts, not accidental products of whatever compiler happened to be on the host.

SDK packaging now checks that:

• Unix SDKs were built with Clang/clang++.
• Windows SDKs were built with clang-cl and SDK-owned LLVM assembly tools.
• SDK archives include With-owned cmake, ninja, clang, clang++, lld, llvm-nm, and llvm-strip.
• Windows SDK archives include the required LLVM/MSVC-compatible tools such as clang-cl, lld-link, llvm-lib, llvm-ml, and llvm-ml64.

This matters because With's bootstrap and release story depends on reproducible, self-contained toolchain inputs.

SDK bootstrap tooling is now packaged

CMake and Ninja are now first-class SDK build tools. The bootstrap scripts can build them from source, install them into the SDK prefix, and then use those SDK-owned tools for chained LLVM builds.

This removes another source of host-tool drift and makes SDK production less dependent on local machine setup.

Windows SDK build fixes

The Windows SDK build path was hardened in several places:

• Ninja bootstrap uses clang-cl shims.
• clang-cl warning noise is suppressed where it would break bootstrap.
• llvm-lib is used where Windows archive tooling expects it.
• Windows manifest tooling is passed explicitly.
• CMake test tools are avoided in the SDK build.
• Windows SDK builds honor the requested parallel job count.
• LLVM assembly uses SDK-owned llvm-ml / llvm-ml64.

Spec and requirements cleanup

Several requirements were corrected to match the language With is actually becoming:

• unsafe exists, but ordinary safe code should not need it.
• "Trust the programmer" is a rule of thumb for weird-but-safe code, not a license to accept unsafe programs.
• The old if ... then ... form and naked else expr requirements were removed from the spec.
• FFI unsafe boundaries were clarified: c_import calls are direct when the importer can model the contract; unmodeled memory, ownership, or lifetime assumptions remain unsafe or raw.

The problematic-requirements audit now records the BDFL rulings behind these corrections.

Changelog

Language and safety

• Checked integer overflow is implemented for runtime and comptime arithmetic.
• Added explicit overflow policies through compiler/build configuration.
• Added checked-overflow behavior tests for signed, unsigned, comptime, project, and explicit-mode cases.

Windows and release packaging

• Added Windows installer assets: install.ps1 and install.cmd.
• Documented Windows installation in README.md.
• Added Windows release SDK packaging.
• Quieted Windows SDK packaging under PowerShell.
• Recorded Clang-built Windows SDK verification and corrected final SDK status docs.

SDK/toolchain

• Enforced Clang-built LLVM SDKs in package scripts and docs.
• Packaged SDK-owned CMake.
• Packaged SDK-owned Ninja.
• Added Unix and Windows CMake/Ninja bootstrap scripts.
• Fixed chained SDK tool builds.
• Made SDK tool build scripts executable.
• Accepted CMake string compiler cache entries.
• Avoided CMake test tools in SDK builds.
• Honored parallel job count in Windows SDK builds.
• Passed Windows manifest tooling explicitly.
• Used SDK-owned LLVM assembler/archive tools for Windows.

Documentation and spec

• Updated README Windows install instructions.
• Scoped unsafe and memory-management requirements.
• Scoped "trust the programmer" as guidance, not a global compiler rule.
• Removed stale if then requirements from the spec and requirements matrix.
• Clarified FFI unsafe boundaries.
• Recorded BDFL problematic-requirements rulings.

Published assets

install.sh
install.ps1
install.cmd
with-bootstrap-c-v0.15.1.tar.zst
with-darwin-aarch64
with-linux-x86_64
with-windows-x86_64.exe
with-llvm-sdk-22.1.6-darwin-aarch64.tar.zst
with-llvm-sdk-22.1.6-linux-x86_64.tar.zst
with-llvm-sdk-22.1.6-windows-x86_64.tar.zst

Verification notes

Darwin arm64 release gates were run from the v0.15.1 tag:

WITH_VERSION=v0.15.1 with build
WITH_VERSION=v0.15.1 ./out/release/bin/with build :fixpoint
WITH_VERSION=v0.15.1 ./out/release/bin/with build :test
WITH_VERSION=v0.15.1 ./out/release/bin/with build :test-green
WITH_VERSION=v0.15.1 ./out/release/bin/with build :last-green

Published asset digests include:

with-darwin-aarch64
sha256:2b4cce52b9b6d2e90c45e65de9edf9f260c58d427968776890b9bd219b7708f3

with-linux-x86_64
sha256:603c55ec1db85f3080a8e245c33f228bcbe64788c734d8d0e7f631a499fab1af

with-windows-x86_64.exe
sha256:9327fbec781298a8e537ecd964a2f311105129d282e3d87fcb7ebafa62168385

with-llvm-sdk-22.1.6-darwin-aarch64.tar.zst
sha256:aae25a6d115051061afa7249d3ce590296f4695bb23ccb04bdf6e2d8c530a7c2

with-llvm-sdk-22.1.6-linux-x86_64.tar.zst
sha256:f978cae85045617ce9f8e426e64bb05c667cd15d47e0e39adc541e9575b4b387

with-llvm-sdk-22.1.6-windows-x86_64.tar.zst
sha256:0c4f9860cf528b3821781d89e5b42947ef8ee2249327cffa64fb9fb5eac09a4a

Commits since v0.15.0

502b6a1c Check integer overflow by default
6e799dc6 Add Windows release SDK packaging
c02f8b2e Add Windows installer assets
3f20cf64 Document Windows install in README
4ed83fb1 Enforce Clang-built LLVM SDKs
be61fd29 Package SDK CMake as a build tool
9b20ced4 Package SDK Ninja as CMake backend
8d752d79 Use clang-cl shims for Ninja bootstrap
03a8c7ba Suppress clang-cl shim flag warning for Ninja
0a97886e Disable warnings-as-errors for clang-cl Ninja shim
061cb065 Use llvm-lib shim for Ninja bootstrap
134a14be Mark SDK tool build scripts executable
1b4a57b0 Fix chained SDK tool builds
7ce00f7e Pass Windows manifest tool to SDK builds
90ec7293 Avoid CMake test tools in SDK build
7541d5d3 Accept CMake string compiler cache entries
23d2a780 Use SDK llvm-ml for Windows LLVM assembly
8a8cfb75 Use SDK llvm-ml64 for Windows x64 assembly
b43d6d1a Honor parallel job count in Windows SDK builds
03e1c91e Scope unsafe and memory-management requirements
3a4e508d Scope trust-the-programmer requirement
dcc3ae0b Remove if-then requirements from spec
ea0a7944 Clarify FFI unsafe boundaries
305b96d1 Keep Windows SDK packaging quiet under PowerShell
c18e9040 Record Clang-built SDK verification
d9613b76 Correct final SDK status summary
3a0fcb97 Record BDFL problematic requirement rulings
5f47453e Bump version to v0.15.1