Cairn

Try it, back in the browser

Mon, 26 Oct 2026 14:46:47 GMT

TodoMVC from cairn_examples on /try/todo/: every frame one its Lean code drew, captured headless by make try. The pointer is on a todo's checkbox, cairn_examples^204, proved, with its claim page a click away.

A screenshot at commit dccde9a0, in the progress log of Likes that show at once and end up true.

Sky: the notifications list

Mon, 26 Oct 2026 14:35:19 GMT

Grouped likes, follows with Follow back, replies and mentions as posts with Like, Repost and ⋯; the unread count on the tab.

A screenshot at commit a85a11f0, in the progress log of Likes that show at once and end up true.

Sky: notifications on screen

Mon, 26 Oct 2026 14:35:17 GMT

Others like, repost and follow while the reader is on Home: the count comes onto the Notifications tab (and the Dock badge). The tab opens the list, "3 new" takes it to the new rows, which are marked seen; Follow back, a like from a mention, then Home again at the same place. Rendered offscreen against the fake PDS.

Watch the video (16 s), recorded at commit a85a11f0, in the progress log of Likes that show at once and end up true.

Cairn 0.5.2

Mon, 26 Oct 2026 14:08:40 GMT

Cairn 0.5.2 is out on the public registry with two virtual-list fixes Sky turned up: a list now settles however many layouts it takes when many rows it knows change height at once (Sky's mute hiding many posts), and a clamp within a batch no longer moves the reader's row when a later step of the same batch lengthens the list.

No claim is new, retired, moved or changed. The registry's ledger check accepted 0.5.1 to 0.5.2 and serves its claims export for the claim pages.

As of commit 23f0836, in the progress log of Likes that show at once and end up true.

Sky: muting an author mid-feed

Mon, 26 Oct 2026 12:56:55 GMT

⋯ on a post, Mute: the author's posts leave the feed and the post being read stays where it is; the status line offers Undo, which brings them back (cairn#254). The ⋯ menu is AppKit's and isn't in the offscreen render: the button shows pressed while it is open.

Watch the video (8 s), recorded at commit f9a66b65, in the progress log of Likes that show at once and end up true.

Sky: Like and Repost, one refused

Mon, 26 Oct 2026 12:56:50 GMT

Sky against the fake PDS with its replies slowed by 1.4 s: Like shows at once and greys until the server confirms it, then Repost; the next Like is refused and rolls back, with the reason in the status line (cairn#254). Rendered offscreen from the engine's frames.

Watch the video (11 s), recorded at commit f9a66b65, in the progress log of Likes that show at once and end up true.

Cairn 0.5.1

Mon, 26 Oct 2026 12:06:37 GMT

Cairn 0.5.1 is out on the public registry: cairn conformance now holds the world (the debug socket's holdWorld stops the host's own clock, wake and requests, and the driver decides the time and every reply), benchmarks for Cairn.Optimistic up to 1,000,000 keys, and two fixes Sky needs: cairn fuzz no longer treats controls as hidden after a virtual list is replaced, and a held clock never steps an app with an empty batch.

One claim is new, ^1032 (under holdWorld the host sends no clock, wake or reply of its own), fuzzed by world.hold. The registry's ledger check accepted 0.5.0 to 0.5.1 and serves its claims export for the claim pages.

As of commit 3616efd, in the progress log of Likes that show at once and end up true.

Sky: notifications, grouped

Mon, 26 Oct 2026 11:44:43 GMT

Sky's notifications: likes of one post in one row, marked seen once on screen (cairn#253).

A screenshot at commit 7a69f8b, in the progress log of Likes that show at once and end up true.

Sky: unread notifications

Mon, 26 Oct 2026 11:44:41 GMT

The unread count, polled from the fake PDS, on Sky's Notifications tab (cairn#253).

A screenshot at commit 7a69f8b, in the progress log of Likes that show at once and end up true.

Sky: like, repost, follow and mute

Mon, 26 Oct 2026 11:42:38 GMT

Sky's feed with the acts row under each post: Like, Repost, Follow and Mute, built on Cairn.Optimistic and cairn_atproto's writes. An offscreen render against the fake server.

A screenshot at commit 7a69f8b, in the progress log of Likes that show at once and end up true.

Cairn 0.5.0 and cairn_atproto 0.3.0, early in M5

Mon, 26 Oct 2026 10:06:12 GMT

Cairn 0.5.0 is out on the public registry as iamnbutler/cairn, so Sky's M5 work builds on it from the registry: Cairn.Optimistic (values shown at once, confirmed or rolled back, ^1100–^1114), a fuzz server with a world that fails requests before it acts and loses replies after, menus on controls and in the menu bar, Effect.scrollTo, kept scroll boxes, the Dock badge and announcements. Frames are v13, and every app now links Lean's libStd.

cairn_atproto 0.3.0 follows on Cairn ^0.5.0, with Fake.server: the fake PDS as a cairn fuzz server whose world is the whole PDS and the host's Keychain. A small app in the package, FakeApp, runs under cairn fuzz with it and checks that the server holds every like it acknowledged while replies are lost and tokens rotate.

The registry's ledger check accepted 0.4.1 to 0.5.0 (23 new claims, none retired) and cairn_atproto 0.2.0 to 0.3.0, and serves both claims exports for the claim pages.

As of commit 486e8ce, in the progress log of Likes that show at once and end up true.

Likes that roll back

Mon, 26 Oct 2026 08:35:19 GMT

The fixture's Like buttons on Cairn.Optimistic, against a scripted server: each press shows at once with its count. Post 1's like is accepted. Post 3's is refused and rolled back in the step the refusal arrives, with a line saying so. Post 4's reply is lost after the server applied it, so the post stays liked, dimmed, until the read back confirms it. Rendered offscreen (Fixture --like-frames).

Watch the video (13 s), recorded at commit a8d0310, in the progress log of Likes that show at once and end up true.

Likes that show at once and end up true

Mon, 26 Oct 2026 08:18:05 GMT

Sky, the Bluesky client I'm building on Cairn, could read a feed. Now it can act on one: like, repost, follow and mute, with a notifications tab beside Home. This is the fifth milestone, and it's still in progress.

The hard part of a like button isn't drawing it. The button has to change the instant you press it, before the server has answered, and the server may refuse, answer late, answer out of order, or act and lose the reply. Most apps handle that with care and hope. I wanted a claim:

Once every reply is in, whatever order the replies came in, each post shows what the server holds, and its count is the server's.

What Cairn gained

Optimistic values (Cairn.Optimistic): keyed values shown at once, with one write in flight per key. A refused write rolls back in the step its answer arrives, and a lost reply is read back. The convergence proof is about the framework, so every app gets it, not just Sky.
Menus on controls and on the secondary click, and an app's own items in the menu bar.
scrollTo, the Dock badge and spoken announcements, as effects the host runs.
A server with a world of its own in cairn fuzz. It keeps the likes and follows, loses replies after acting on them, and lets the fuzzer check claims against what it holds.
cairn_atproto 0.3.0: record keys, idempotent writes, the authoritative read, viewer state and notifications.

What it looks like

When the server refuses a like, Sky rolls it back, says so in a line and announces it to VoiceOver. Muting an author takes their posts out of the feed at once without moving the post you're reading, and the status line offers Undo. Notifications are grouped ("Alice, Bob and 3 others liked your post"), counted on the tab and the Dock, and marked seen once they're on screen.

The catch

The proof is about a model of the server: one register per key, with idempotent writes. Bluesky's real servers lag, so a count other people are changing can be briefly behind; the count claim holds when no one else has acted since the last view. Posting, replies and quotes are the next milestone.

Progress so far:

Try it, back in the browser (2026-10-26)
Sky: the notifications list (2026-10-26)
Sky: notifications on screen (2026-10-26)
Cairn 0.5.2 (2026-10-26)
Sky: muting an author mid-feed (2026-10-26)
Sky: Like and Repost, one refused (2026-10-26)
Cairn 0.5.1 (2026-10-26)
Sky: like, repost, follow and mute (2026-10-26)
Sky: notifications, grouped (2026-10-26)
Sky: unread notifications (2026-10-26)
Cairn 0.5.0 and cairn_atproto 0.3.0, early in M5 (2026-10-26)
Likes that roll back (2026-10-26)

Sky 0.3.1, signed and installed

Mon, 26 Oct 2026 07:22:04 GMT

Sky 0.3.1 is on the public registry as iamnbutler/sky, built on Cairn 0.4.1 with cairn_json and cairn_atproto, all from the registry, and so is its CI in iamnbutler/sky. Its claims export, 26 active claims, is on the registry for its claim pages.

cairn bundle --sign made Sky.app, signed with a Developer ID under the hardened runtime, and it is installed in ~/Applications. Signing in with a real account is the next step, by a person, not by a test: every test signs in to the fake server.

As of commit sky@bd64e76, in the progress log of A feed that never ends.

Cairn 0.4.1: the trusted base for M4, fuzzed

Mon, 26 Oct 2026 07:05:04 GMT

Cairn 0.4.1 is out on the public registry as iamnbutler/cairn. Every Keychain call now goes through one serial queue for the process, so a forgetSecret racing a read of the same app's items no longer deadlocks inside Security's file-based keychain (#237), and a value that starts with a byte order mark reads back with it.

What VoiceOver and other assistive apps see of a scrolled list or a secure field was reviewed by hand; it is now two assume claims with a fuzz check each. ^1021: the accessibility tree holds exactly what a scroll area shows, walked through AppKit's own accessibility API on a real view. ^1022: a secure field shows nothing typed, and the debug socket's request log shows no secret. docs/trusted.md lists every assumption M4 added with its check; the full trusted fuzz run passes all 54 checks.

The registry's ledger check accepted 0.4.0 to 0.4.1, a patch release: two new claims and nothing retired. It serves the claims export, 54 active claims, for the claim pages.

As of commit a6a35fb, in the progress log of A feed that never ends.

Sky: refresh keeps the reader

Mon, 26 Oct 2026 01:39:56 GMT

Three posts arrived and Refresh put them above: the post at the top of the view didn't move, and Sky offers ↑ 3 new posts to go back to the top. Offscreen render, fake PDS.

A screenshot at commit 96355c0, in the progress log of A feed that never ends.

Sky: scrolled to the end

Mon, 26 Oct 2026 01:39:54 GMT

Scrolling to the end shows the list's end row; its appear loads the next page (30 → 43 posts). Reposts say who reposted; link cards are words for now. Offscreen render, fake PDS.

A screenshot at commit 96355c0, in the progress log of A feed that never ends.

Sky: the home feed

Mon, 26 Oct 2026 01:39:52 GMT

Posts in Cairn's virtual list: avatars and images load from the fake PDS into fixed-size placeholders, text wraps, counts under each post. Offscreen render, fake PDS.

A screenshot at commit 96355c0, in the progress log of A feed that never ends.

Cairn 0.4.0: runtime scrolling, Action.appear, virtual lists and package-scoped fuzzing

Mon, 26 Oct 2026 00:19:46 GMT

Cairn 0.4.0 is out on the public registry as iamnbutler/cairn. Scroll offsets belong to the runtime: a box names itself with Style.scrollRef, the runtime keeps its offset in UI.scroll, moves it for the wheel, trackpad and scroll keys, and clamps it after every step, and a scroll never reaches update (#225). A control with appear := true is told when it comes on screen, through Action.appear. The host's scroll sign is a new assume claim, ^1012.

VList.node lays out only the rows of a list that meet its box, so a runtime step costs about the same at 1,000 rows as at 100,000, with proofs that the rows built are exactly those in view and that the first row showing stays still when rows are inserted above it (#231). Fuzz targets are scoped by package: cairn fuzz runs only a package's own machines unless given --deps, and two targets with one name fail to compile (#224).

The registry's ledger check accepted 0.3.0 to 0.4.0: the only change to the ledger is ^1012. It is a minor release because Event, Action and Trigger gain constructors, so exhaustive matches need new cases; Style and UI gain defaulted fields, and settleFuel is 4. The registry checked the claims export, 54 claims, against the ledger and serves it for the claim pages.

As of commit f107007, in the progress log of A feed that never ends.

Sky: a slow sign-in

Sun, 25 Oct 2026 23:44:51 GMT

After a few seconds Sky says it's still signing in and offers Cancel. Offscreen render, fake PDS.

A screenshot at commit 6f0aa14, in the progress log of A feed that never ends.

Sky: offline

Sun, 25 Oct 2026 23:44:49 GMT

Sign-in errors are words, not codes: here the service can't be reached. Offscreen render, fake PDS.

A screenshot at commit 6f0aa14, in the progress log of A feed that never ends.

Sky: a wrong app password

Sun, 25 Oct 2026 23:44:47 GMT

A wrong password, said in words; the field is emptied as the request is sent. Offscreen render, fake PDS.

A screenshot at commit 6f0aa14, in the progress log of A feed that never ends.

Sky: sign in

Sun, 25 Oct 2026 23:44:46 GMT

Sky's sign-in screen (cairn#210): handle or email, the app password in a secure field (bullets only), the service. An offscreen render from the selftest against the fake PDS.

A screenshot at commit 6f0aa14, in the progress log of A feed that never ends.

The runtime scrolls the fixture's rows

Sun, 25 Oct 2026 22:51:11 GMT

Cairn's runtime now owns scroll offsets (#203). A scroll of 100,000 points over the fixture's 200 rows is clamped to the end, the app's state never sees it, and the end line, marked appear, hears that it came on screen: an Action.appear move counted in the app. Offscreen render through the real engine (Fixture --scroll-shots).

A screenshot at commit bed3b86, in the progress log of A feed that never ends.

Cairn 0.3.0: the example apps leave, Keychain secrets, secure fields and scroll boxes

Sun, 25 Oct 2026 22:40:44 GMT

Cairn 0.3.0 is out on the public registry as iamnbutler/cairn. The example apps (Counter, Basics, Todo, Clock, Tray, Gallery) live in their own package, cairn_examples, and their 71 claims keep their numbers there: cairn^202 is now cairn_examples^202, marked moved:cairn_examples in Cairn's ledger, which now holds only framework claims (#219).

A secret can live in the Keychain, and http can capture reply fields into it before Lean sees the body (#216). Text.SecureField shows bullets, never puts its text on the clipboard, in undo history or in any frame dump, and the host turns on secure event input while it has focus (#217). Style.scroll lays out scroll boxes, with proofs that what shows stays inside the box and a control is pressed only where it shows (#218). The frame format is version 11, and the 0.1.3 shims are gone.

The registry's ledger check accepted 0.2.5 to 0.3.0: moving and retiring released claims needs a new minor while at 0.x, and 0.2.6 would have been refused. It checked the claims export, 53 claims, against the ledger and serves it for the claim pages. Apps upgrade by naming an environment secret's source, matching http with eight arguments and importing Cairn.Abi for Cairn.Frame.Boundary.

As of commit 60c4483, in the progress log of A feed that never ends.

Secure text field

Sun, 25 Oct 2026 21:51:15 GMT

The fixture's Passcode field after typing seven characters: the frame holds seven bullets, never the text, and the host gives it the AXSecureTextField role with no value. An offscreen render of the frame (Renderer.image).

A screenshot at commit 1968755, in the progress log of A feed that never ends.

Yap on cairn_json

Sun, 25 Oct 2026 21:14:20 GMT

Yap's overlay mid-dictation, now built on Cairn 0.2.5 with JSON from the cairn_json package instead of its own parser. Yap 0.1.0 is on the registry.

A screenshot at commit bdf391d, in the progress log of An app built from packages alone.

A feed that never ends

Sun, 25 Oct 2026 20:57:29 GMT

Sky is the reading half of a Bluesky client, built on Cairn: sign in with an app password, keep the session, and read the home feed for as long as you scroll. It was the fourth milestone and the first of four on Bluesky, which needs nearly everything a small app doesn't: long lists, authentication, paging and requests that race.

Sky lives in its own repository, iamnbutler/sky, as the package sky, built only from registry packages. Its claims are on the registry.

What Cairn gained

Scrolling owned by the runtime. Every scroll offset belongs to Cairn, not the app, and is clamped after every step. A virtual list builds and lays out only the rows on screen: a step costs about 0.17 ms at 1,000 rows and at 100,000.
Secrets. The host captures the session's tokens from the server's replies straight into the Keychain, so they never reach Lean. The password goes in a secure field that shows bullets, keeps no undo and copies nothing.
cairn_atproto, a package for XRPC, the session calls and the timeline, with proofs that only one token refresh runs at a time and each call is sent at most twice.

What's proved about the feed

No duplicates and no gaps.
A late page for an old cursor never changes the feed.
A refresh racing a load-more ends as one of the two would have, in order.

Refresh puts new posts above without moving the post you're reading, and offers a way back to the top. Flinging through 1,102 posts with images, Sky's Lean thread takes a median of 1.5 to 1.7 ms a frame.

The catch

Everything the host is trusted with, from the Keychain to what VoiceOver sees of a scrolled list, is an assumption with a fuzz check of its own rather than a proof. Every path runs against a fake server with no account and no network; reading a real timeline is something I do by hand with the installed app.

Progress so far:

Sky 0.3.1, signed and installed (2026-10-26)
Cairn 0.4.1: the trusted base for M4, fuzzed (2026-10-26)
Sky: refresh keeps the reader (2026-10-25)
Sky: scrolled to the end (2026-10-25)
Sky: the home feed (2026-10-25)
Cairn 0.4.0: runtime scrolling, Action.appear, virtual lists and package-scoped fuzzing (2026-10-25)
Sky: a slow sign-in (2026-10-25)
Sky: offline (2026-10-25)
Sky: a wrong app password (2026-10-25)
Sky: sign in (2026-10-25)
The runtime scrolls the fixture's rows (2026-10-25)
Cairn 0.3.0: the example apps leave, Keychain secrets, secure fields and scroll boxes (2026-10-25)
Secure text field (2026-10-25)

Cairn 0.2.5: closing the window quits cleanly

Sun, 25 Oct 2026 12:14:23 GMT

Cairn 0.2.5 is out on the public registry as iamnbutler/cairn. Closing an app's window now quits it cleanly: the window delegate owns the window and shuts the view down before the app terminates. Before, AppKit also released the window on close, and a frame landing afterwards reached the freed window; Pairs 0.1.2 crashed that way. make selftest closes a real window with input, a timer and frames in flight (#199).

cairn builds fetch registry dependencies at the commit the manifest pins and turn Lake's lazy fetches off when every git dependency is on a registry: a stale checkout on Pairs went from 92 s to 4 s (#198). The tray's tick-rate selftest asserts the wall-clock rate on real hardware only (#195).

The registry checked its claims export, 122 claims, against the ledger and serves it for the claim pages. claims.lock is the same as 0.2.4's: no claim was retired, moved, changed or added, so it is a patch release.

As of commit ea05c5e, in the progress log of An app built from packages alone.

Cairn 0.2.4, with a fuzzer that plays the host

Sun, 25 Oct 2026 08:41:47 GMT

Cairn 0.2.4 is out on the public registry as iamnbutler/cairn. cairn fuzz now plays the host's side: it answers requests late and in any order, replies to cancelled ones, fires timers, moves the clock, sends subscription events and evicts images, within what the trusted claims allow, and checks that every image a frame draws is one the host holds (#189).

An app's Custom fuzz hooks take replies and subEvents generators, relations checked on every step, drained checks once the host has answered everything, and outstanding checks against the requests the runtime still holds (#189, #192).

The registry checked its claims export, 122 claims, against the ledger and serves it for the claim pages. claims.lock is the same as 0.2.3's: no claim was retired, moved, changed or added, so it is a patch release.

As of commit 654c669, in the progress log of An app built from packages alone.

Cairn 0.2.3, with several apps a package and cairn bundle

Sun, 25 Oct 2026 07:30:22 GMT

Cairn 0.2.3 is out on the public registry as iamnbutler/cairn. A package can hold several apps, and cairn build, size, bench and conformance take --app to link one (#177), as iamnbutler/cairn_examples does. cairn bundle wraps an app package's release build in a .app with the SwiftPM resource bundles it uses (#185).

The fuzzer now presses status-item buttons and menu items and takes App.minSize as the window's minimum, so Clock, Tray and Gallery are fuzzed (#178, #182). The click assumptions ^7 and ^214 moved from the examples into Cairn's trusted base, with pointer fuzz checks (#184).

The registry checked its claims export, 122 claims, against the ledger and serves it for the claim pages. claims.lock is the same as 0.2.2's: no claim was retired, moved, changed or added, so it is a patch release.

As of commit 8ecf96e, in the progress log of An app built from packages alone.

Pairs: the win screen

Sun, 25 Oct 2026 07:08:54 GMT

All eight pairs of Patterns matched: the board gives way to the result, and the best moves and time for the pack are saved (they only ever improve, pairs^26).

A screenshot at commit e3d4416, in the progress log of An app built from packages alone.

Pairs: a pack that fails

Sun, 25 Oct 2026 07:08:52 GMT

A pack with a missing image: Pairs says which face didn't load and leaves the game exactly as it was. A 404 manifest and a pack.json that isn't JSON are refused the same way.

A screenshot at commit e3d4416, in the progress log of An app built from packages alone.

Pairs: a pack loading over http

Sun, 25 Oct 2026 07:08:50 GMT

A pack typed into the field loads beside the game from the URL tests' stub server, whose images answer after three seconds: the game goes on, with Cancel and a count of the images loaded. Choosing another pack or Cancel stops it; its late replies change nothing (pairs^28, ^29).

A screenshot at commit e3d4416, in the progress log of An app built from packages alone.

Pairs: the grid follows the window

Sun, 25 Oct 2026 07:08:48 GMT

The same game in a wider, shorter window: Grid keeps four columns and shrinks the cards to fit the height; nothing scrolls. App.minSize from Grid.minBox keeps every card at least 64 points wide.

A screenshot at commit e3d4416, in the progress log of An app built from packages alone.

Pairs: a game in progress

Sun, 25 Oct 2026 07:08:46 GMT

Pairs, the M3 memory game, built only from registry packages (cairn 0.2.2, cairn_json). Three pairs of Shapes are matched (green edges); the arrow and the heart don't match and turn back after a second. Rendered offscreen from the app's own frame.

A screenshot at commit e3d4416, in the progress log of An app built from packages alone.

Cairn 0.2.2, with a window minimum and an image budget

Sun, 25 Oct 2026 05:38:57 GMT

Cairn 0.2.2 is out on the public registry as iamnbutler/cairn. An app declares its window's smallest size with App.minSize, and Grid.minBox gives the smallest box in which every card is at least its minimum width, proved for every size; the host keeps the window at least that big (#169, frame format 7). Sub.imageCache keeps the host's images within a byte budget, and the host tells the app with an evicted notice for every image it drops, so ready always means the pixels are there (#170, frame format 8).

The registry checked its claims export, 122 claims, against the ledger and serves it for the claim pages. No claim was retired, moved or changed, so it is a patch release; five are new, ^511–^513, ^1010 and ^1011.

As of commit 885b585, in the progress log of An app built from packages alone.

Image cache under a budget

Sun, 25 Oct 2026 04:52:42 GMT

Gallery runs an imageCache subscription with an 8 MiB budget. Load 24 fetches all 24 thumbnails; the host keeps the twelve on screen and drops the other page's, telling the app, which counts them as evicted and no longer takes them for loaded. Next page loads the dropped ones again, and the host drops the first page's in turn.

Watch the video (25 s), recorded at commit ecdc04f, in the progress log of An app built from packages alone.

Cairn 0.2.1, with claim pages

Sun, 25 Oct 2026 04:41:35 GMT

Cairn 0.2.1 is out on the public registry as iamnbutler/cairn. Requests in flight are capped at 6, with a queue and cancelRequest, frame format 6 (#151). Cairn.UI.Grid lays cards out in as many columns as the window fits, proved for every size (#160). cairn fuzz, claims, bench, size and conformance run on any app, and test/fixture is Cairn's own fixture app (#149).

cairn publish now sends the claims export as well as claims.lock. The registry checked its 117 claims against the ledger and serves it, so Cairn's claim pages group its moves and flows by place instead of showing only ledger rows (#156). No claim was retired, moved or changed, so it is a patch release; six are new, ^506–^510 and ^1009.

As of commit d08381d, in the progress log of An app built from packages alone.

Try it: TodoMVC in the browser

Sun, 25 Oct 2026 04:30:29 GMT

Every frame is one the app's Lean code drew, explored ahead of time; each control shows its claim id, its reading and a link to its claim page.

Watch the video (23 s), recorded at commit a9813e5, in the progress log of Claims on an app I use every day.

A floor on tile size

Sun, 25 Oct 2026 04:21:06 GMT

Gallery asks the host to keep its window at least 1020 × 536: the smallest size, proved with Grid.minBox, at which every tile is 180 points wide. The demo drags the window narrower, shorter, then both, through the window's resize delegate as a person's drag goes; it stops at the minimum each time and the tiles stay 180 points wide.

Watch the video (22 s), recorded at commit f6e6ad2, in the progress log of An app built from packages alone.

Gallery's grid follows the window

Sun, 25 Oct 2026 03:38:17 GMT

Gallery's six tiles in a grid whose column count Lean computes from the window size: three columns at 1120 points, six at 1640, two at 860, in reading order throughout. The host only reports resize events; Lean proves the cells never overlap, stay inside the grid's box, take the most columns that fit, and that a click in a tile reaches that tile.

Watch the video (15 s), recorded at commit ee9ecbf, in the progress log of An app built from packages alone.

Claim pages

Sun, 25 Oct 2026 03:25:50 GMT

Every package on the registry gets claim pages, rendered by the site from the claims export cairn publish now sends: the overview grouped by place, then the Todos window, a flow's steps, a move, and one of the trusted base's assumptions. No agent and no screenshots of the apps: proofs, witnesses and where each claim is defined come straight from Lean. Shown here with Cairn's export from this branch; the live pages fill in once Cairn is published again. These replace the maps, and /map/ redirects here.

Watch the video (15 s), recorded at commit f45df9b, in the progress log of An app built from packages alone.

Many requests in flight, and Cancel

Sun, 25 Oct 2026 02:41:38 GMT

Gallery asks for 24 thumbnails from a slow server. Lean's runtime sends six at a time and queues the rest; Cancel drops the queued ones and stops the six being fetched, and a late answer for a cancelled one changes nothing.

Watch the video (23 s), recorded at commit ebac002, in the progress log of An app built from packages alone.

Cairn 0.2.0, with images

Sun, 25 Oct 2026 02:05:01 GMT

Cairn 0.2.0 is out, on the public registry as iamnbutler/cairn next to 0.1.3. It has images: Node.image, the loadImage effect, frame format 5 and the Gallery example (#132). import Cairn now links, the old everything-umbrella is CairnAll, and cairn new --bin makes a working app (#134). cairn-link links each dependency's libs from its cairn.toml, and Cairn's says libs = ["Cairn"] (#127).

It was going to be 0.1.4, and v0.1.4 is tagged, but the registry refused it: claim ^213's statement hash changed when Style gained its image field, and a published claim keeps its statement. Its meaning didn't change, so the same invariant is now ^225 and ^213 is retired. Retiring a released claim needs a new minor version while at 0.x, hence 0.2.0.

As of commit 16b70b8, in the progress log of An app built from packages alone.

cairn new makes an app that links

Sun, 25 Oct 2026 01:17:40 GMT

Since the library split, the Cairn umbrella imported every proof and tool, none of which an app links, so an app that wrote import Cairn, as cairn new's template did, failed at the host's link on initialize_cairn_Cairn (#128). Now Cairn is the linked library's umbrella, with the claim commands at compile time only, and the everything-umbrella the ledger, the audit and the docs read is CairnAll. cairn new --bin writes a working app: a place, a move, its exports, the C declaration of its initializer and a host with a selftest. make check now builds one against the checkout, runs its selftest and locks its two claims, which takes about a minute.

As of commit a2d3ff9, in the progress log of An app built from packages alone.

cairn_json, the first package outside the cairn repository

Sun, 25 Oct 2026 01:01:40 GMT

Yap's JSON parser and encoder is now its own registry package, cairn_json 0.1.0, in iamnbutler/cairn_json. It requires cairn ^0.1.2 from the registry, is pure Lean with no Swift and no extern, and leaves Yap's date arithmetic for a later cairn_date.

The library is 491 lines. 793 lines of proofs hold 49 theorems: decode (encode v) = some v and decode (pretty v) = some v for every value nested at most 512 deep, and that more fuel never changes what the parser answers. decode is total by construction, with no partial def. The axiom audit allows only propext, Classical.choice and Quot.sound, and the kernel replays every declaration.

A trusted fuzz check compares it with Foundation's JSONSerialization: 220,164 documents per seed (valid, mutated, UTF-16 and UTF-32, random bytes and 164 edge cases), 5 seeds, 0 unexplained differences. The known ones are listed in its docs/trusted.md: numbers Foundation can't hold, a leading U+FEFF Foundation drops from strings, short UTF-16 and UTF-32 documents without a byte order mark, invalid UTF-8, and nesting 513 deep.

The commit is cairn_json's.

As of commit bf6a0e7, in the progress log of An app built from packages alone.

Gallery: images

Sun, 25 Oct 2026 01:01:25 GMT

Six image tiles, each a 200 × 150 Node.image that Lean lays out before any pixels exist: a PNG, a JPEG turned by its EXIF orientation, a GIF, a poster over https, a text file and a missing file. The host decodes with ImageIO and paints with Metal; Lean only learns the pixel size, or the fault, from the loadImage reply. Reload (^501) sends every tile back to its grey placeholder and reads each source again; Fit (^502) cycles cover, contain and stretch. Nothing moves when a picture arrives or fails. In the self test every tile was answered 6.8 ms after launch.

Watch the video (31 s), recorded at commit 8254f50, in the progress log of An app built from packages alone.

cairn-link links each dependency's libraries

Sun, 25 Oct 2026 00:53:44 GMT

bin/cairn-link no longer links Cairn's library by name (#118). It reads lake-manifest.json, finds the cairn.toml beside each dependency, transitive ones included, and links the Lean libraries that package lists under libs. Cairn's own cairn.toml now lists Cairn, so an app gets the same archive as before, and a library like cairn_json can be linked the same way.

It refuses a Lean module that ends up in two archives, which would be a duplicate symbol, and a dependency that is an app. A dependency with no cairn.toml is linked not at all; if linked code imports it, cairn-link names the package and says to give it one.

Checked with a throwaway app that depends on Cairn and on a second library package with its own libs: it links, and a small C program draws a frame through both. Yap builds against it with its existing --lib Yap and passes its selftest.

As of commit 1e1b640, in the progress log of An app built from packages alone.

An app built from packages alone

Sun, 25 Oct 2026 00:43:00 GMT

Pairs is a memory game: a grid of face-down cards, flip two, keep them if they match. Decks are theme packs, a JSON manifest and a set of images, loaded from a folder or a URL. It was the third milestone, small enough to finish, and it needs what a Bluesky client needs: images, JSON and many requests in flight at once.

It's also the first app built only through the package path, cairn new pairs --bin, cairn add and cairn build, in a repository of its own. Nothing in it reaches into Cairn's.

What Cairn gained

Images. An image node whose size Lean knows before the pixels arrive, so the layout never jumps, and an effect that loads one. The host decodes and paints; Lean never holds pixels.
JSON as its own package, cairn_json, with a proof that decoding what was encoded gives it back.
Requests in flight: at most six at once, with the rest queued. Switching packs cancels them, and a late reply for an old pack never changes the board.

What's proved

The grid follows the window, and for every width no two cards overlap and every card is inside it.
The deal has every face exactly twice, at most two unmatched cards are face up, and every game can be won.
A best score only improves.

The catch

Decoding images, caching them and the network belong to the host: they're recorded as assumptions and fuzzed, not proved. The grid always fits the window, so nothing in Pairs scrolls; scrolling waited for Sky.

Progress so far:

Yap on cairn_json (2026-10-25)
Cairn 0.2.5: closing the window quits cleanly (2026-10-25)
Cairn 0.2.4, with a fuzzer that plays the host (2026-10-25)
Cairn 0.2.3, with several apps a package and cairn bundle (2026-10-25)
Pairs: the win screen (2026-10-25)
Pairs: a pack that fails (2026-10-25)
Pairs: a pack loading over http (2026-10-25)
Pairs: the grid follows the window (2026-10-25)
Pairs: a game in progress (2026-10-25)
Cairn 0.2.2, with a window minimum and an image budget (2026-10-25)
Image cache under a budget (2026-10-25)
Cairn 0.2.1, with claim pages (2026-10-25)
A floor on tile size (2026-10-25)
Claim pages (2026-10-24)
Gallery's grid follows the window (2026-10-24)
Many requests in flight, and Cancel (2026-10-24)
Cairn 0.2.0, with images (2026-10-24)
cairn new makes an app that links (2026-10-24)
Gallery: images (2026-10-24)
cairn_json, the first package outside the cairn repository (2026-10-24)
cairn-link links each dependency's libraries (2026-10-24)

Cairn 0.1.3, on the public registry

Sun, 25 Oct 2026 00:39:27 GMT

Cairn 0.1.3 is out, and it is on the public registry at cairn.registry.nexthub.sh as iamnbutler/cairn, next to 0.1.2. Reading it needs no login: cairn add cairn finds the owner by name and writes the version range, and Lake fetches Cairn from the registry's git (#107, #109). /packages/ now reads the registry itself instead of sample data (#111).

The Cairn library is now only what an app links: 31 modules. Proofs, claims, fuzzing and tools are their own Lake libraries, so libcairn_Cairn.a went from 3.67 to 2.78 MB (#114). Three modules moved so the directories in lean/ have no cycles, and make lint now fails on one; the old names stay as shims until 0.2.0 (#110).

No claim changed, so it is a patch release. Yap moved to it with only its tag changed.

As of commit aea142c, in the progress log of Claims on an app I use every day.

Cairn 0.1.2: libraries and apps

Sat, 24 Oct 2026 21:11:09 GMT

Cairn 0.1.2 is out. A package is now a library or an app, as in Cargo: cairn.toml has kind = "lib" or "bin", cairn new asks which, and /packages/ lists apps under their own tab (#103). Nothing can depend on an app.

cairn publish sends no docs. HTML from a publisher would run as the registry's site, so docs will be built from the source instead, as docs.rs does (#98).

The ledger now treats retiring a released claim as a breaking change: it needs a new major version, or a new minor one while at 0.x (#100). No claim changed in 0.1.2, so it is a patch release.

As of commit 597dea8, in the progress log of Claims on an app I use every day.

Cairn is a package, and Yap moved out

Sat, 24 Oct 2026 19:35:06 GMT

Cairn is now a package. An app lives in its own repository and depends on a tagged release, and one tag pins both halves: the Lean package and the Swift libraries. v0.1.0 is the first release (#80). v0.1.1 fixes cairn doc, which failed in apps because it read its stylesheet from the app (#91).

Yap moved out first. It lives in its own repository, yap-cairn, and depends on Cairn v0.1.0 like any other app would. Its Lean, proofs, fuzzers, Swift host and benches left this repository with it.

Claim ids are now scoped by package. Cairn's are cairn^N and Yap's are yap^N, so “a shortcut never sends” is yap^311. Cairn's claims.lock still lists Yap's old ids, marked moved:yap, so they can never be issued here again.

As of commit ea72e75, in the progress log of Claims on an app I use every day.

The cairn command and packages

Sat, 24 Oct 2026 19:29:01 GMT

There is now a cairn command (#79). cairn new starts a package in its own repository with its claim scope set, cairn add depends on another package, and cairn build runs Lake, links the Lean into one library and builds the Swift host. cairn doc writes the package's docs, and cairn publish and cairn login talk to a registry. It has unit tests, and it has been run against a stand-in registry but not a deployed one yet.

The registry is nextpm, a package registry, with a new cairn kind (nextpm #22). It has an index Lake reads natively, the source served over git, and a build cache, so that lake cache get downloads prebuilt Lean. Its claim ledger refuses a version that drops, renumbers or redefines an id. /packages/ shows a registry's packages, and until one is running it shows sample data (#78).

Publishers no longer upload docs. A registry now refuses HTML from a publisher (nextpm #23), and docs will be built from the source by a builder we run, the way docs.rs works (#94).

As of commit fb902c0, in the progress log of Claims on an app I use every day.

Developer docs and the API reference

Sat, 24 Oct 2026 18:36:08 GMT

Developer docs are up at /docs, laid out like Rust's bookshelf: the Cairn Book, Cairn by Example, reference pages, and guides to working on Cairn itself (#76). Every code sample is included from a source file that make check compiles, so a sample can't drift from the code it shows. Moving an included region fails the build until the page is fixed.

The API reference at /docs/api/ is generated by cairn doc, Cairn's answer to rustdoc (#77). It reads the Lean environment directly instead of using doc-gen4. On TodoMVC, doc-gen4 took 185 s and wrote 227 MB, almost all of it Lean's own library. Each claim appears on its module's page with its statement, evidence and proofs. A Lean block in a doc comment is a doc test that make check runs.

Every heading on the site also has an id now, and a # that copies a link to it (#72).

As of commit d04416c, in the progress log of Claims on an app I use every day.

Yap against the original under Instruments

Sat, 24 Oct 2026 13:14:51 GMT

Yap on Cairn was measured against the original Yap with Apple's Instruments rather than Cairn's own tools (#65). At 60 Hz the two overlays now pace the same, at 59.3 and 59.9 frames a second, with no hitches in either.

While recording, Cairn used 205 ms of CPU a second, against the original's 82. Most of that went to redrawing the menu bar's status item on every frame. Once its properties were written only when they change, an A/B run went from 197 to 98 ms/s.

The overlay now appears only once the microphone is running, as in the original, so a microphone that fails no longer flashes it (#68, yap^349). On a 120 Hz display, Cairn drew 118 frames a second where the original draws 60. It's now capped at 60, and it checks files every 2 s, as the original does (#69). The idle runs and a check on a 60 Hz display are still to do (#70).

As of commit 40b6863, in the progress log of Claims on an app I use every day.

Yap on Cairn: the overlay

Sat, 24 Oct 2026 07:16:39 GMT

Yap's dictation overlay on Cairn, driven by a synthetic voice: recording with a moving tape waveform and a two-line live preview, then transcribing, then typed. The state, view and layout are Lean; the waveform is a host-drawn paint node running the original's Metal shader.

Watch the video (11 s), recorded at commit a83d447, in the progress log of Claims on an app I use every day.

Claims on an app I use every day

Sat, 24 Oct 2026 01:04:46 GMT

Yap is a small dictation app for the Mac: hold a key, talk, and the transcript is typed into the app in front. I use it every day. TodoMVC lived in one window; almost all of Yap lives outside its window, in a global key, the microphone, timers, a network request, files, sounds and typing into another app. The second milestone asked whether claims hold up there.

I rebuilt it on Cairn, signed it, installed it and used it for a day of real work.

What Cairn gained

Effects. The clock and timers, requests the host performs and answers, and outside inputs like a global key and the microphone. Lean decides; Swift captures audio, hears the key, makes the request and types the text, each because Lean asked.
New surfaces: a native menu bar menu built from Lean's view, and an overlay that never takes focus.
Packages. Moving Yap into its own repository made Cairn a package, with a cairn command and claim ids scoped by package. Yap's are yap^N.

What's proved about dictation

A key used in a shortcut never sends.
A transcript is saved before it's typed.
A late reply for an old clip never types.
Every recording ends.

The catch

Each new effect is an assumption about the host, fuzzed with slow, failed, duplicated and out-of-order replies, not proved. Audio and HTTP stay in Swift; Lean only decides what to do with the results.

Progress so far:

Try it: TodoMVC in the browser (2026-10-25)
Cairn 0.1.3, on the public registry (2026-10-24)
Cairn 0.1.2: libraries and apps (2026-10-24)
Cairn is a package, and Yap moved out (2026-10-24)
The cairn command and packages (2026-10-24)
Developer docs and the API reference (2026-10-24)
Yap against the original under Instruments (2026-10-24)
Yap on Cairn: the overlay (2026-10-24)
Clock: effects (2026-10-23)

Clock: effects

Fri, 23 Oct 2026 21:55:36 GMT

Cairn's first effects. A stopwatch whose time, ticks, sounds and lap file come from the host as replies to requests Lean makes: Lap plays a sound, Save writes the laps to a file, Reset clears them and Load reads them back. Timers fire within 1–2 ms; a click → read file → frame round trip is 1.5 ms (p50).

Watch the video (16 s), recorded at commit 4fc3970, in the progress log of Claims on an app I use every day.

TodoMVC in Lean

Fri, 23 Oct 2026 17:16:53 GMT

The full TodoMVC, written in Lean and running natively on the Mac. Add, complete, double-click to edit, filter, clear completed, and toggle all. Every control is a claim (^202 to ^211). On the real app, 999 of 1,000 generated conformance sequences matched the Lean model. The one miss is a known edge case: a click that ends an edit can be dropped, as in a browser.

Watch the video (28 s), recorded at commit 9224599, in the progress log of A proved TodoMVC.

Basics: the first Lean app

Fri, 23 Oct 2026 15:57:47 GMT

A whole app written in Lean: adding, ticking and deleting items. Lean decides the layout, focus, text editing and hit testing; Swift only draws. Every control is a claim (^101 to ^104). Lean proves that an item's Delete button exists exactly when the item does, and that the 'items left' count is right.

Watch the video (17 s), recorded at commit 733224a, in the progress log of A proved TodoMVC.

The host, with text

Fri, 23 Oct 2026 15:18:26 GMT

The new AppKit host painting through the Metal renderer: Core Text glyphs from an atlas, a caret, a focused field, a checkbox and a list. Typing goes through the Mac's text-input path, and every control in the accessibility tree is named by its claim id (^1 field, ^2 checkbox, ^3 Add, ^4#1 the new item). This app is the host's test fixture, with its frames built in Swift; the next video is the same host running a Lean app.

Watch the video (18 s), recorded at commit 3ff02ad, in the progress log of A proved TodoMVC.

Boundary spike

Fri, 23 Oct 2026 14:57:34 GMT

The first thing on screen. Lean owns the state, the layout and the hit test; Swift forwards clicks and paints Lean's rectangles with Metal. The bar is the count (no text rendering yet). Reset (red) exists only while the count is above zero, which is proved in Lean, and here it's pressed through the accessibility tree.

Watch the video (9 s), recorded at commit a6b45bc, in the progress log of A proved TodoMVC.

A proved TodoMVC

Fri, 23 Oct 2026 14:57:34 GMT

The first milestone was TodoMVC, running natively on the Mac. TodoMVC is small, completely specified and has text input, and formal UI testing already uses it as a benchmark. It needs every layer of a UI framework and is small enough to finish.

Its state, view, layout, hit testing, focus and text editing are written in Lean. A thin Swift host passes events in and paints Lean's frames with Metal. The text fields do typing, selection, copy and paste, and input methods.

What's proved

Every action is a claim with an id, and the build won't let an id drift.
Each action does what its claim says, and the counts and filters stay right in every state.
Presence: a control is on screen exactly when its action is enabled.
Pressable: at any window size from the minimum up, a click at an enabled control's centre reaches that control, so it's visible, unclipped and on top.

Checked another way

The real app is driven through a thousand generated sequences of real pointer and key events, and must agree with the model after every step. A map of the app is generated from the claims, with the evidence behind each one, and everything the proofs trust about the host is written down in the trusted base.

Progress so far:

TodoMVC in Lean (2026-10-23)
Basics: the first Lean app (2026-10-23)
The host, with text (2026-10-23)
Boundary spike (2026-10-23)