Models are first-class
simulate def … by model lets a model implement a function body under a
sem descriptor, a token/time budget, and ensure/check semantics
contracts. Models are values you can pin, swap, and schedule.
Sema is a programming language for the era of language models. Its syntax is
familiar — Python-shaped indentation, def, struct, enum, traits — but its
semantics are new: a model can implement a function, similarity is an
operator, effects and budgets are part of a type, and contracts are
checked, not hoped for. The deterministic core and the generative edge live in
one language, with one verification story.
# A function whose body is written by a model — but fenced by types, effects,# a token budget, and a semantic contract that is actually checked.simulate def summarize(article: str) -> str !{model.invoke} by gpt: sem "A faithful, single-paragraph summary of the article." budget tokens=400 ensure len(result) < len(article) check semantics("the summary makes no claim absent from the article")
# The deterministic core stays provably invoke-free: `!{}` means no model, no I/O.def dedup_titles(titles: list[str]) -> list[str] !{}: return semantic.dedup(titles, threshold=0.86)Models are first-class
simulate def … by model lets a model implement a function body under a
sem descriptor, a token/time budget, and ensure/check semantics
contracts. Models are values you can pin, swap, and schedule.
Semantics is a built-in
~= is calibrated similarity; semantics("…") is a natural-language
predicate that type-checks as a guard; semantic.rank/filter/cluster/dedup
are language operations, not SDK calls.
Effects you can prove
Every function carries a capability row — !{fs.read, model.invoke}. The
deterministic core is !{}. The compiler tracks it; policies constrain it.
Verification by default
require/ensure/invariant are hard contracts; check/check semantics
are monitored. sema assure fuzzes properties for counterexamples and, at
gold, mutation-tests your suite.
Governance in the language
policy with verified examples:, monitor for distribution drift,
with budget(...), supervise/heal, session protocols, and
non-interfering collector taps — the operational concerns of AI systems,
made native.
No silent no-ops
A construct that parses must have a real effect or fail loudly. sema check
flags anything it does not recognize. What you write is what runs.