Promise. Expressions are total, pure, and have no I/O and no loops. Every expression has a static cost bound. Lint in CI; unknown features and namespaces fail the build. Extensions are namespaced and versioned — no silent downgrade.
Total and pure
No I/O, no loops, no hidden state. An expression either returns a value or fails to compile.
Cost you can budget
Every expression carries a static cost bound, so a document cannot become a denial of service.
Unknown means failed
Unknown features and namespaces fail the build. Extensions are namespaced and versioned — no silent downgrade.
form loan version = "1.0" {
field annual_income {
type = number
validate { min = 0, max = 10000000 }
}
field eligible {
type = boolean
value = annual_income >= 12000
}
output {
annual_income: number
eligible: boolean
}
}
A tenant can ship that document. They cannot ship a network call inside an expression.
Boundary. This is not a complete multi-tenant product. The registry, the CI pipeline, and the host sandbox are yours.