# \[ANN\] Kotoba: a Clojure-shaped language that compiles to WebAssembly, with capability-based safety (feedback wanted)
**URL:** https://clojureverse.org/t/ann-kotoba-a-clojure-shaped-language-that-compiles-to-webassembly-with-capability-based-safety-feedback-wanted/14949
**Category:** Showcase
**Tags:** announcement, language-design, wasm, security
**Created:** [July 8, 2026, 8:05pm UTC](https://clojureverse.org/t/ann-kotoba-a-clojure-shaped-language-that-compiles-to-webassembly-with-capability-based-safety-feedback-wanted/14949 "2026-07-08T20:05:44Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@com-junkawasaki](https://clojureverse.org/u/com-junkawasaki)
#### Post date: [July 8, 2026, 8:05pm UTC](https://clojureverse.org/t/ann-kotoba-a-clojure-shaped-language-that-compiles-to-webassembly-with-capability-based-safety-feedback-wanted/14949/1 "2026-07-08T20:05:44Z")
## **What Kotoba is**
Kotoba is a small **Clojure-shaped language profile** for compiling capability-checked programs to WebAssembly. It’s aimed at code that should be inspectable, portable, and constrained: AI-generated cells, sandboxed automation, repository policy, and other untrusted programs where the host decides which capabilities are available.
Three things up front, since ‘Clojure-shaped’ invites the obvious pushback:
1. **It’s a Clojure-family _profile/subset_, not a full Clojure or ClojureScript implementation.** Canonical source extension is `.kotoba`; `.clj`, `.cljc`, and `.cljs` are accepted as compatibility formats. It is not “any JVM Clojure or ClojureScript program runs.”
2. **Compilation target is WebAssembly, compile-first.** The public surface is `kotoba -e` / `kotoba wasm ...` – not an interpreter with a Wasm backend bolted on.
3. **Capability-confined safety is the point, not an add-on.** Capabilities are explicit, scoped, typed values (never ambient strings a module can summon by name); a host-side guard intersects what a module was actually handed against policy before any call runs.
## **30-second tour**
```auto
kotoba -e '(+ 1 2)'
kotoba wasm build examples/hello.kotoba -o hello.wasm
kotoba wasm safe-policy examples/policy-demo.kotoba
kotoba wasm safe-build examples/policy-demo.kotoba --policy policy.edn -o policy-demo.wasm
```
## **A few design notes**
The compiler, CLI, and conformance tooling that process this Clojure-shaped language are themselves written in Clojure/ClojureScript – an earlier Rust implementation was fully retired in favor of this CLJC authority.
Safety is _benchmarked against_ Rust, not copied from it: capability confinement (deny-by-default, typed capabilities, signed audit receipts) is designed to exceed Rust-style memory safety alone, not just match it. Rather than a full ownership/borrow/lifetime system, we shipped a narrow affine check scoped only to capability values – a handle can be consumed at most once per execution path – with a documented limitation instead of a broader, harder-to-verify mechanism.
## **The rest of the stack**
Alongside the language, [`kotoba-lang/kotobase`](https://github.com/kotoba-lang/kotobase) plays the role Datomic plays for Clojure – same datom/EAVT/Datalog model, but reimagined for the distributed web: content-addressed blake3/CIDv1 blocks instead of a single transactor over SQL/DynamoDB, a Prolly Tree instead of a B-tree, an immutable commit DAG instead of a single log, and a CACAO-authenticated edge runtime instead of a JVM peer with a direct storage connection.
## **Where to look**
- Language contract: [https://github.com/kotoba-lang/kotoba-lang](https://github.com/kotoba-lang/kotoba-lang)
- Compiler/runtime (CLJC, Rust-free): [https://github.com/kotoba-lang/kotoba](https://github.com/kotoba-lang/kotoba)
- Distributed-web Datomic: [https://github.com/kotoba-lang/kotobase](https://github.com/kotoba-lang/kotobase)
## **Question for this community**
We shipped a narrow affine-typing check scoped only to capability values instead of a general ownership/borrow system, on the reasoning that it’s what the actual threat model needs and it’s small enough to verify exhaustively. It has a documented gap (tracked per binding name, not per value) that doesn’t weaken runtime enforcement but is a real limitation. Where do you draw the line between “ship the narrow useful slice, gaps documented” and “go build the complete thing first”?"
---
### Author:  [@jackrusher](https://clojureverse.org/u/jackrusher)
#### Post date: [July 10, 2026, 12:15pm UTC](https://clojureverse.org/t/ann-kotoba-a-clojure-shaped-language-that-compiles-to-webassembly-with-capability-based-safety-feedback-wanted/14949/2 "2026-07-10T12:15:42Z")
This text reads like it was written by Claude.
---
### Author:  [@com-junkawasaki](https://clojureverse.org/u/com-junkawasaki)
#### Post date: [July 12, 2026, 8:44am UTC](https://clojureverse.org/t/ann-kotoba-a-clojure-shaped-language-that-compiles-to-webassembly-with-capability-based-safety-feedback-wanted/14949/3 "2026-07-12T08:44:05Z")
Hi Jackrusher-san. You’re right — I’m not a confident English writer, so I do lean on Claude to help me draft posts like this one. The design, the code, and the ideas behind Kotoba are mine, but I use it as a writing assistant to make sure the English reads clearly. Sorry if that came across as impersonal — happy to answer any questions directly here in my own (rougher) words if that’s more useful!
---
### Author:  [@jackrusher](https://clojureverse.org/u/jackrusher)
#### Post date: [July 23, 2026, 7:37am UTC](https://clojureverse.org/t/ann-kotoba-a-clojure-shaped-language-that-compiles-to-webassembly-with-capability-based-safety-feedback-wanted/14949/4 "2026-07-23T07:37:31Z")
Kawasaki-san,
I am often also in the position of communicating in languages that are not my own, so I know how awkward that can feel. That said, I would always rather receive communications in your own voice than in Claude’s. 🙂