A new programming language called U claims to solve memory safety, data races, and security vulnerabilities through a single type modifier system. The language compiles to portable C and targets both human developers and AI code generation. A companion transpiler converts existing PHP and JavaScript codebases into native binaries.

U eliminates garbage collection, null exceptions, and async coloring by making them compile-time errors. Variables live on the stack by default. The compiler handles memory, concurrency, and vectorization without runtime overhead. LLMs generate correct U code on first attempts because the safe path and the fast path are the same path.

One modifier system replaces twenty-six solutions

Traditional languages solve different safety problems with different tools. Garbage collectors handle memory. Borrow checkers prevent data races. Type systems catch null dereferences. Each solution has a cost and they rarely compose cleanly. U uses modifiers on types to address all of them through one mechanism.

Variables are stack-allocated by default and freed when the function returns. Adding +R tells the compiler the value outlives the function scope. Circular references become compile-time errors. Parameters cannot be changed. Fields outside your own instance cannot be changed. Making something mutable requires explicit opt-in with +M. Shared state goes through atomic patches and data races become compile errors.

Prefixing a call with a runs it as a lightweight fiber. There is no async or await split. Functions that work synchronously work asynchronously too. The caller decides, not the definition. Adding +V enables automatic vectorization. The emitted C uses vector types that become SSE or AVX on x86 and NEON on ARM. Adding +R(GPU) puts data in device memory and turns a map operation into a GPU compute shader.

Capabilities prove what code cannot do

Every function in U declares its exact effects. A function with +E(DbRead) can read the database but cannot write to it. It cannot make HTTP calls. It cannot touch the filesystem. A function with no +E annotation is pure with zero side effects. Capabilities propagate up the call graph so nothing hides.

The compiler detects dangerous combinations at compile time. If a function has DbRead and calls another function with Email, the transitive surface is DbRead plus Email. That is a data exfiltration vector and the compiler flags it. This differs from runtime sandboxes which stop bad behavior after it starts. Capabilities are compile-time proofs that bad behavior cannot be compiled into existence.

The compiler generates a Merkle DAG of the call graph with capability annotations at each node. Changing one function's capabilities rehashes only that branch. M-of-N cryptographic signatures from auditors gate deployment. More restrictive changes auto-approve. An LLM auditor reads function signatures and the capability graph without reading function bodies.

Transpiler converts PHP and JavaScript to native binaries

The transpiler maps 1,246 PHP functions. 132 map to native U operations for the fast path. The remaining 1,114 bridge to the real PHP C implementation for compatibility. strlen becomes a pointer subtraction. gzdeflate calls actual zlib. The code does not change but the runtime underneath does.

A benchmarked 8-file PHP application including classes request handling a user model and route handlers transpiled through the pipeline serves 70,026 requests per second on a health endpoint and 5,689 requests per second on an API endpoint. PHP 8.3 does 800 requests per second on the same workload. Node.js does 2,444. The compiled binary is 22 kilobytes with zero dependencies.

The JavaScript transpiler handles Express routes middleware and models. CORS headers request logging and JSON serialization all compile. The result serves 65,374 requests per second compared to Node's 2,444. No node_modules directory. No V8 memory overhead. No event loop blocking.

Arena allocator replaces per-request forking

Every request gets an arena which is a single block of memory that all allocations come from. When the request ends one pointer reset frees everything. No reference counting. No garbage collector. No individual free calls. The arena allocates at 406 million operations per second which is 200 times faster than malloc.

This gives PHP's per-request isolation without the fork overhead. Preload classes config and routes once at startup. Take a snapshot. Each request gets a copy-on-write view. Reads are free. Writes go to the request arena. Simulated fork via threads works on Linux macOS and Windows.

The compiled binary starts in microseconds and uses 2 megabytes of RAM. It fits in an L2 cache. Deploy it to a container a Lambda function an edge node or an IoT device. A 22 kilobyte binary runs in a Docker scratch container with nothing else in it. No runtime to install no interpreter to patch no CVEs to track.

LLMs generate correct U because defaults are safe

In testing LLMs introduced null dereferences 23 percent of the time and capability violations 31 percent of the time. The U compiler caught every one. The compiler acts as an uncorrelated red team that does not hallucinate does not miss paths and does not tire.

A single function signature tells you everything. f+E(DbRead, HTTP) +A get_user(...) -> User +N ! NotFound declares async reads the database handles HTTP might return null and might throw NotFound. No inference needed. No compiler run. No tracing call stacks. The compiler infers capabilities from the code with --suggest-caps and warns about dangerous combinations.

The project includes 122 PHP edge cases covering string math array type control flow OOP and operators. It includes 100 JavaScript edge cases covering array methods string methods classes modern JS and TypeScript. There are 46 transpiler mapping tests 4 compatibility bridge tests and 636 compiler tests. Every run produces zero failures.

Security falls out of the code itself

Every function signature declares its full contract including effects capabilities errors and return types. The compiler enforces all of it. But the real power is what this enables beyond the compiler. An LLM reads function signatures and reasons about attack vectors without reading bodies. The notation is the analysis.

U emits ordinary C11 that you can read debug and compile with gcc clang or MSVC. No virtual machine. No runtime library to ship. No dependency on a specific OS version. The same source compiles to WebAssembly through Emscripten so one codebase runs natively and in the browser. The language targets the point where safety and performance stop being tradeoffs and become the same thing.