// a programming language named after the most famous dwarf planet
Pluto is a compiled, capability-secure, actor-concurrent programming language built in Rust. Like its namesake — small in size, enormous in significance — Pluto delivers production-grade safety from a vocabulary you can hold in your head.
5.9 billion km from the Sun, orbiting in the Kuiper Belt. Discovered 1930, reclassified 2006, immortalised by New Horizons in 2015. Our language carries that same spirit — frontier technology, quietly groundbreaking.
Pluto compiles your source to bytecode, runs it on a Rust-native VM, and gets out of the way. The surface is small enough to learn in an afternoon — capsules for objects, orbit for loops, explore/divert for errors.
Under the hood the VM runs a mark-sweep GC, an M:N actor scheduler, and a RASP security engine that intercepts every I/O call. Phase 6 adds the time module — timestamps, formatting, timers, and ISO 8601 parsing, all from std, no external crates. The language literally cannot execute a network request without a permit declaration.
// Pluto v1.0 — capability-secure language · Phase 6 capsule Telemetry { altitude velocity report() { return self.altitude * self.velocity } } system MissionControl { permit fs.read("/data/telemetry") permit net.transmit("https://api.nasa.gov") permit time.sleep("*") monitor(probe_id) { msg = receive transmit(msg) } launch() { t = Telemetry { altitude: 5906, velocity: 4.74 } transmit(t.report()) // Phase 6: log current UTC time launch_ts = time.now() transmit(time.format(launch_ts, "[%Y-%m-%d %H:%M:%S UTC] launch")) spawn monitor("new-horizons") // Phase 6: measure I/O latency t0 = time.now() explore { data = fs.airlock("/data/telemetry/pluto.log") transmit(data) } divert(err) { transmit(err) } elapsed = time.diff(t0, time.now()) * 1000 transmit(elapsed) // ms elapsed // Phase 6: countdown with sleep n = 3 orbit (n > 0) { transmit(n) time.sleep(1) n = n - 1 } transmit("ignition") } }
The pipeline is Lexer → Parser → Analyzer → Compiler → VM. The compiler emits a compact bytecode chunk with a constant pool. The VM executes with a stack machine — fast, simple, auditable.
The RASP engine normalizes every tainted string through an iterative URL-decode loop before running ~80 regex rules. Inputs needing more than 8 decode passes to stabilize are blocked outright — over-encoding is itself a signal of attack.
// Compilation & execution pipeline source.plt │ ▼ Lexer // logos · zero-copy tokenization Token stream │ ▼ Parser // recursive descent · AST Program AST │ ▼ Analyzer // capability check · static security Verified AST │ ▼ Compiler // bytecode emit · constant pool Chunk { code[], constants[] } │ ▼ Scheduler // M:N actor runtime · PID registry │ ▼ VM // stack machine · GC · RASP engine │ ▼ Output + Security
Every I/O call requires a static permit before a single instruction runs. The analyzer rejects unpermitted access at compile time — not at runtime, not with exceptions.
compile-time80+ rules across SQL injection, XSS, command injection, SSRF, XXE, and WAF-bypass patterns. Tainted strings are normalized before scanning — encoding tricks collapse first.
runtimespawn, send, receive. Each actor owns an isolated VM heap — no shared memory, no data races. M:N scheduler with deadlock detection runs on all available cores.
phase 5Object-oriented via capsules — single inheritance, super dispatch, first-class closures with mutable upvalue capture that persists across calls.
phase 2Heap objects (capsules, lists, closures) managed automatically. The GC threshold doubles after each collection cycle, amortising overhead across bursty allocation patterns.
automaticEvery string from file or network I/O is marked tainted. Taint propagates through operations. At every I/O boundary, tainted strings are normalized and re-scanned.
securitymatch supports numeric literals, strings, Vacuum, capsule type-check, binding variables, and wildcards. Arms short-circuit; clean exhaustive syntax.
phase 3Pluto's error model: explore the risky path, divert when something is jettisoned. Full stack and locals unwinding with a clean error binding.
phase 3pluto compile serialises bytecode + function tables, generates a standalone Rust project, and emits a fully native binary. No interpreter at deploy time.
aotPhase 6 adds time.now(), time.format(), time.diff(), time.sleep(), time.parse(), and time.components(). Timestamps are Unix epoch Floats — no special types, no external crates, all pure std.
phase 6time.format(ts, fmt) supports %Y %m %d %H %M %S %f %A %a %B %b %I %p %P %Z %s %Q %% %n %t %e — ISO, log-style, human-readable, 12-hour, abbreviated, and millisecond-precision output.
Measure elapsed time with time.diff(a, b) — returns b − a in seconds (fractional, negative when b is earlier). time.sleep(secs) blocks an actor for a precise duration. Needs permit time.sleep.
Three independent layers. None can be bypassed by the program being run.
The rule engine covers the OWASP Top 10 and beyond. Path rules fire before every filesystem call. Payload rules run on every string crossing an I/O boundary. Header rules protect every network send.
Every keyword in Pluto is themed to its namesake. The language speaks the language of space exploration.
Each actor is an isolated VM with its own heap, IP register, and mailbox. Messages are primitive values — no shared memory, no data races. The M:N scheduler distributes work across all CPU cores.
Six functions for everything temporal — current time, formatting, elapsed measurement, sleeping, parsing, and calendar decomposition. All UTC. All pure std. Timestamps are just Floats.
Pluto v1.0 — Built by Blake Burns Technologies Inc.