Sley 2.0 Makes Agents Mutate Verified Program Graphs Instead of Source Text

Greyforge Labs released Sley 2.0 on September 24, 2026, as an Apache-2.0 programming system built for AI agents that change verified program state instead of emitting source text. The public site and release notes now point at Sley 2.0.2 with a prebuilt static Linux x86_64 binary, SHA256SUMS, and source at github.com/sley-lang/sley. The project’s one-line premise is blunt: machines do not write source; they change verified program state. A Sley program is a typed, immutable graph of functions, types, blocks, operations, contracts, and tests stored as content-addressed objects. Agents read that graph through bounded queries and change it by proposing typed mutations that a deterministic kernel validates before anything commits.

The agent loop is specified as a closed protocol rather than a prompt recipe. Work starts from a verified cryptographic state root. The agent issues a bounded, typed query with hard limits that fail loudly instead of truncating. It proposes a typed mutation against that base root, with preconditions that reject stale edits. A fourteen-phase validator then judges types, control flow, effects, contracts, tests, and policy. Only after validation does an atomic commit produce a receipt and a new verified root—or a stable refusal code. The project contrasts this with today’s coding agents that paste whole files, edit line ranges, rerun toolchains that differ per machine, and parse free-text errors. Sley removes the text layer as the agent’s primary interface while keeping humans in charge of objectives, policy, capabilities, and acceptance.

Engineering claims are unusually ledger-heavy for a 2.0 launch. Greyforge describes a clean-room break from Sley 1.2 (frozen as Sley Legacy): 1.x may run as an outside oracle, but its syntax and parser were not copied into the new kernel. A second, independent Python implementation is required to agree with the Rust kernel byte for byte on hashes, receipts, and error vectors. Crash recovery—“old state or complete new state, never partial”—went through thirteen frozen contract revisions and a 100-row crash matrix before release. Release candidates are built twice from clean, compared member by member, then rebuilt on a second host that must produce the identical digest, with CycloneDX and SPDX SBOMs recorded. The 2.0 decision tracked 52 GA acceptance criteria; at release, 32 were evidenced, 17 awaited independent review, and 3 remained gated. Public docs also cite roughly 1,256 commits across 29 days from first commit to 2.0.0, about 2,000 Rust tests, and 18 typed entity kinds in the SSMC1 graph form.

What ships today is infrastructure, not a slogan that agents already self-host the toolchain. Sley 2.0 includes the SSMC1 program form and SCB1 canonical encoding, the SMP1 machine protocol (binary frames or JSON lines via sley serve), content-addressed branches with semantic merge and explicit conflict objects, bounded context capsules, a deterministic VM with fuel/output/cancellation limits, and policy roots with scoped capability tokens and bounded adapters—no arbitrary shell. Honest unfinished edges are listed: a small family of VM opcodes is refused deterministically rather than half-supported; creating new functions and their tests currently takes two commits; and the succession benchmark that compares agents on Sley versus raw source and Sley 1.x on a frozen 15-task corpus is still running. Greyforge calls 2.0 a release, not a general-availability claim.

Trying it is intentionally mechanical. On Linux x86_64, download the 2.0.2 tarball and checksums, verify with sha256sum, extract, run ./bin/sley version, then python3 demo/run_demo.py until it reports "result": "PASS". Building from source uses a pinned Rust toolchain (1.93 called out in the chronicle). Every CLI command speaks JSON so agents can drive the kernel without scraping human prose.

For Writeble’s opensource desk, Sley 2.0 is the late-September bet that agent coding infrastructure should look more like a verified state machine than a better text editor—Apache-2.0, reproducible, and explicit about what is not yet proven.