Every number on this page is generated, not typed.
Test counts, bug totals, binary sizes, and vox-fuzz's own coverage numbers, produced by scripts that read the compiler repository and vox-fuzz at build time.
Each section's footer below names the commit its numbers came from. Numbers drift as the compiler and vox-fuzz change; naming the commit is what makes one checkable rather than a bare claim.
Tests you can count
Every test the compiler repository tracks under tests/, counted straight off its file tree.
- Golden-file .vox tests
- 1,252
- Compile-fail cases
- 885
- Total files under tests/
- 2,529
- Unit tests, compiler src/
- 354
Counted by grep for #[test] in the compiler's own src/. A #[test] function that loops over many fixtures counts once (the whole compile-fail suite runs as one), so the real number of cases exercised is higher.
Bugs, in the open
Every bug vox-fuzz or a human has found, tracked publicly in docs/BUGS_FOUND.md, parsed for its totals rather than summarised by hand.
- Bugs found
- 150
- Fixed
- 140
- Open
- 4
- Other
- 6
"Other" is a status that is neither "fixed" nor "open" as written: a documentation fix, a duplicate note, or, if this count is not zero, an entry this parser could not read a status from at all.
Versions covered: 0.3.6 to 0.4.15.
Examples verified
Checked against vox 0.4.16 on 2026-10-16: 27 of 27 examples passed.
"Verified" means compiled: every example, through the real compiler, at the version and on the date above.
Memory safety, and how to try to break it
Vox's central claim is that a compiled program is memory-safe without a garbage collector or a runtime system.
No garbage collector, no heap tracing, no runtime supervision. Every guarantee comes from compile-time structure and small checks written inline into the generated assembly. The README sets out the model in full.
Read the Memory Safety Model in README.md
Break that claim and you have the most serious kind of security report: an out-of-bounds read or write that skips the documented error flag, a use-after-free, or memory corruption reachable from ordinary Vox source. SECURITY.md defines the full scope.
Read what counts as a vulnerability in SECURITY.md
vox-fuzz hunts for defects against LANGUAGE.md claims: it generates Vox programs, compiles and runs them, and checks the compiler's behavior against what the specification says. It tracks how much of the specification has been exercised and verified, not only how many crashes it has found.
Claims coverage
How to read the counts: rows is claims enumerated; exercised counts every row with a leaf in main that emits the construct, and verified is the subset of those whose leaf also asserts the documented result, so verified never exceeds exercised (see PROCEDURE.md §3); invariants is unjustified invariants the section's leaves still contribute to the corpus report (blank until a campaign has been run against the section). Progress is verified / rows going up and invariants going down, nothing else.
A claim is one testable statement taken from LANGUAGE.md; section groups claims by which part of the manual they came from. Total sums every section above; it is not a section of its own.
| Section | Claims | Exercised | Verified |
|---|---|---|---|
| Basics: statements, case, comments, paragraph breaks, sentence consumption, the termination rule, closing more than one level | 61 | 25 | 10 |
| Basics: ranges, loop expansion, but if, treating | 62 | 18 | 0 |
| Types | 12 | 1 | 0 |
| Variables: declaration forms, set/create, canonical forms, assignment, type immutability, naming rules | 66 | 17 | 0 |
| Names and strings | 7 | 0 | 0 |
| Functions: definition, scope, parameter/local types, calls, calling as statement, reading a result | 51 | 14 | 0 |
| Things: defining, declarations and field access, nesting, value copy semantics | 76 | 25 | 6 |
| Things: printing, equality, manifest, the three call forms, one identifier space, top-level only, cross-file, .lib, sentence consumption, diagnostics, predicates | 77 | 23 | 8 |
| Expressions: literals, references, arithmetic, comparisons, property checks, logical operators, plural are, type casting | 100 | 59 | 17 |
| Control flow: if, while, for each, repeat, loop control, termination, increment/decrement | 45 | 22 | 4 |
| Lists and collections: literals, mixed-type, nested, maps, type predicates | 82 | 25 | 12 |
| Dynamic values (value) and nothing | 32 | 15 | 15 |
| Collections: printing, properties, element access, appending, loop expansion with collections, but if, treating | 96 | 48 | 5 |
| Input/Output: print, format strings, conditional print | 58 | 38 | 0 |
| File I/O: buffers, object properties, buffer properties, resizing, byte access, append/copy | 61 | 34 | 18 |
| File I/O: file/list/number properties, opening, reading, seeking, writing, closing, file operations, error handling, resource safety | 103 | 53 | 24 |
| Directories, mounting, device nodes, symlinks, pivot_root, executing programs, process control, system control | 87 | 29 | 23 |
| Time and timers | 60 | 44 | 26 |
| Command-line arguments, flag parsing | 54 | 19 | 4 |
| Environment variables | 12 | 7 | 6 |
| Operators: arithmetic, comparison, logical, bitwise | 42 | 17 | 0 |
| Keywords: articles, starters, flag schema, connectors, and, reserved aliases, two classes of special word, contextual keywords | 88 | 44 | 8 |
| Examples chapter, each example is a composite claim | 5 | 0 | 0 |
| Libraries and imports: see, shared libraries, .lib interface, mangling, --link | 64 | 5 | 0 |
| Compiler usage, claims about the CLI, tested by the harness rather than by leaves | 8 | 2 | 0 |
| Grammar summary, each production is a claim that the forms it lists parse | 23 | 10 | 0 |
| Total | 1,432 | 594 | 186 |
"Exercised" means: "a leaf emits the construct; the program must not crash. This tests memory safety only. The floor."
"Verified" means: "a leaf emits the construct and asserts its documented result, so a wrong answer is a finding"
Seed ledger
| Date | vox | vox-fuzz | Seeds | Budget | Programs | Compiled | Findings | Notes |
|---|---|---|---|---|---|---|---|---|
| 2026-08-19 | 0.4.5 | c99e734 | 1–1000 | 12 | 1,000 | 1,000 | 0 | post-modernization baseline |
| 2026-08-19 | 0.4.5 | c99e734 | 7000–7999 | 16 | 1,000 | 1,000 | 0 | independent range |
| 2026-08-19 | 0.4.5 | f20eb77 | 1–2000 ×4 budgets | 12/40/100/300 | 8,000 | n/a | n/a | guard sweep, generation only, no compile or run |
| 2026-08-23 | 0.4.11 | 4a8de95 | 41000–41219 | 40 | 220 | 220 | 0 | three-tree differential, value band (plain layout) |
| 2026-08-23 | 0.4.11 | 4a8de95 | 77777–77788 | 40 | 12 | 12 | 0 | keep-run: 15 VAL rows assert, all exit 0 |
| 2026-08-24 | 0.4.12 | 937f12a | 90000–90999 | 40 | 1,000 | 994 | 6 | value-band celebration; 6 findings, all fuzzer Defects 14/15 (see FUZZER_DEFECTS.md), zero compiler bugs |
| 2026-08-24 | 0.4.12 | 22e5479 | 100000–101999 (8-way stripe, 8×250) | 40 | 2,000 | 1,977 | 23 | first striped campaign: 19 findings were oversubscription deadline artifacts (8 stripes on 8 cores; scale deadlines or stripe under core count), 4 exposed Defect 16 (pool-name collision, see FUZZER_DEFECTS.md); zero compiler bugs |
| 2026-08-25 | 0.4.13 | ef9dee2 | 200000–200428, 300000–300429, 400000–400544, 500000–500686 (4 stripes) | 40/40/24/12 | 2,000 | 2,000 | 269 | all 269 "compile exceeded 60 s" findings are artifacts of memory pressure on the test machine (vox-fuzz at 20/15/10 GB, Defect 17; every one recompiles in ≤ 2.4 s idle); 0 compiler bugs |
| 2026-08-28 | 0.4.13 | ef9dee2 | 200429–214999 (stripe-1, chunked ×200) | 40 | 14,571 | 14,571 | 0 | resumed the 25th's run under a chunked, memory-capped driver (fresh process per chunk, systemd MemoryMax); 73 chunks, 0 failed |
| 2026-08-28 | 0.4.13 | ef9dee2 | 300430–314999 (stripe-2, chunked ×200) | 40 | 14,570 | 14,570 | 0 | as stripe-1 |
| 2026-08-28 | 0.4.13 | ef9dee2 | 400545–408944 (stripe-3, chunked ×300) | 24 | 8,100 | 8,100 | 0 | chunked, memory-capped driver; the compiler under test was rebuilt to 0.4.14 by the release at 21:19, so seeds from 408945 on belong to the next row |
| 2026-08-28 | 0.4.14 | ef9dee2 | 408945–418544 (stripe-3 continued on the 0.4.14 binary) | 24 | 9,600 | 9,600 | 0 | 32 chunks of 300; stopped by a scheduled shutdown; chunk 418545–418844 interrupted, not counted. Whole stripe-3 including the 0.4.13 part: 60 chunks, 18,000 programs, 0 findings |
| 2026-08-28 | 0.4.13 | ef9dee2 | 500687–509186 (stripe-4, chunked ×500) | 12 | 8,000 | 8,000 | 0 | as stripe-3; seeds from 509187 (chunk started 21:20) ran on 0.4.14 |
| 2026-08-28 | 0.4.14 | ef9dee2 | 509187–519186 (stripe-4 continued on the 0.4.14 binary) | 12 | 10,000 | 10,000 | 0 | 20 chunks of 500; stopped by a scheduled shutdown; chunk 519187–519686 interrupted, not counted. Whole stripe-4: 37 chunks, 18,500 programs, 0 findings |
| 2026-10-05 | 0.4.15 | 39292e4 + files-c batch (staged) | 1005001–1005200 | 12 (default) | 200 | 200 | 0 | files batch C acceptance run, random layout, installed /usr/bin/vox; 82 of 200 programs carry a batch C leaf; no signal deaths |
| 2026-10-05 | 0.4.15 | 39292e4 + process-c batch (staged) | 20261005–20261104, 20261105–20261204 | 40 | 200 | 200 | 0 | process batch C acceptance run, random layout, timeout 20000; no signal deaths; every new leaf reached |
| 2026-10-05 | 0.4.15 | 39292e4 + library-leaf prototype (not merged) | 71001–71200 | n/r | 200 | 200 | 0 | library-leaf prototype on its normal draw; not merged. 11 programs carried a library; no signal deaths. Budget not recorded for this run |
| 2026-10-05 | 0.4.15 | library-leaf prototype, forced-draw copy (not merged) | 90001–90200 | n/r | 200 | 200 | 0 | forced kind-370 draw, scratch-only build, never committed; 157 libraries, 309 LIB-42 assertions. Budget not recorded |
| 2026-10-05 | 0.4.15 | library-leaf prototype, forced-draw copy (not merged) | 50001–50050 | n/r | 50 | 50 | 0 | forced kind-370 draw, unconfined; 41 carried a library, 74 LIB-42 assertions. Budget not recorded |
| 2026-10-05 | 0.4.15 | library-leaf prototype, forced-draw copy (not merged) | 50001–50050 | n/r | 50 | 50 | 0 | the same 50 forced seeds under bwrap, after the prototype's TMPDIR=. fix (FUZZER_DEFECTS.md Defect 23). Budget not recorded |
| 2026-10-05 | 0.4.15 | 58c7877 + merged files-c/process-c (staged) | 51005000–51005299 | 40 | 300 | 300 | 0 | invariant corpus, --layout plain, generated, compiled and run. An earlier attempt (294/300 compiled, 0 findings) is discarded: it shared a working directory with ./test.sh, whose rm -rf ./vf_* deleted its scratch mid-run. Too large for scripts/invariants (about 300 MB of memory per program), so the invariant diff used the budget-12 corpora below |
| 2026-10-05 | 0.4.15 | 58c7877 | 51005000–51005299 | 40 | 300 | 300 | 1 | baseline corpus, --layout plain. 1 finding, seed 51005068: ASSERT EXP-94: expected 255269670110833 got 255269670110834, a fuzzer defect (FUZZER_DEFECTS.md Defect 26), not a compiler bug |
| 2026-10-05 | 0.4.15 | 58c7877 + merged files-c/process-c (staged) | 51005000–51005299 | 12 | 300 | 300 | 0 | invariant corpus, --layout plain; input to the invariant diff (no new invariant) |
| 2026-10-05 | 0.4.15 | 58c7877 | 51005000–51005299 | 12 | 300 | 300 | 0 | baseline invariant corpus, --layout plain |
| 2026-10-05 | 0.4.15 | 58c7877 + merged files-c/process-c (staged) | 61005000–61005999 (5 chunks ×200) | 40 | 1,000 | 1,000 | 2 | random layout, timeout 20000, each chunk under systemd-run --user --scope -p MemoryMax=8G; no signal deaths. Both findings (seeds 61005087, 61005153) are ASSERT LST-49 wrong-values caused by a fuzzer defect (FUZZER_DEFECTS.md Defect 24), not compiler bugs |
| 2026-10-05 | 0.4.15 (main dfdfc7f) | 8d88cf2 + Defects 24 to 26 fix (staged) | 81005000–81005599 (3 chunks ×200) | 40 | 600 | 600 | 7 | the check on the Defect 25 fix: random layout, timeout 20000, each chunk under systemd-run --user --scope -p MemoryMax=8G; every kind Defect 25 had made unreachable was drawn. No signal deaths. 3 wrong-values (seeds 81005329, 81005395: ASSERT FIL-02: expected at least 3 got 0; 81005389: ASSERT FIL-93: expected greater than 0 got 0) are a fuzzer defect (FUZZER_DEFECTS.md Defect 27), not compiler bugs. 4 hangs (seeds 81005027, 81005065, 81005374, 81005518) are deadline artifacts of an overloaded machine: these three chunks took 10 to 21 minutes each, against under 8 for each of the two chunks after the restart, and on 2026-10-12 each program runs in under 0.2 s and passes a rerun under the same harness and 20000 ms timeout |
| 2026-10-05 | 0.4.15 (main dfdfc7f) | 8d88cf2 + Defects 24 to 26 fix (staged) | 81005600–81005999 (2 chunks ×200) | 40 | 400 | 400 | 1 | the same run, resumed after a machine restart cut chunk 81005600 short; that chunk was rerun whole and its partial run is not counted. No signal deaths. 1 hang (seed 81005918) that does not reproduce: on 2026-10-12 the program exits 0 in 0.72 s (0.69 s of it its own Waits) in 100 of 100 runs and passes three reruns under the same harness and timeout. Its cause is not established |
| 2026-10-13 | 0.4.15 (main a0a2ecc) | 3035fdc + Defect 27 fix (staged) | 91013000–91013199 | 40 | 200 | 200 | 0 | the check on the Defect 27 fix: random layout, timeout 20000. No signal deaths and no wrong-values: 14 programs drew FIL-02 and 11 drew FIL-93, 8 of them after opening standard input at 0, which is no longer closed. The three seeds that showed the defect (81005329, 81005389, 81005395, budget 40) were rerun on the same build and pass |
vox names the compiler version under test; vox-fuzz names the commit of the fuzzer that generated the programs. Seeds is the exact range passed to --seed and --count; a seed only names a program together with the generator commit that produced it, so the same range from a different vox-fuzz commit is a different program (SEEDS.md, "a seed is not a program"). Budget is the --budget flag: how many statements the generator puts in each program.
Programs, compiled and findings read n/a for a generation-only sweep: one that writes programs to disk without compiling or running them.
Findings
- Flagged for triage
- 311
- Compiler bugs among them
- 2
What vox-fuzz flagged for human triage. 2 were compiler bugs (written up under docs/findings/); the other 309 came from campaigns and were all fuzzer defects or test-machine artifacts. Compiler bugs the fuzzer found by other routes are credited in the register itself.
Probes
- Families
- 27
- Leaves
- 246
A family is one specification section with at least one hand-verified probe under vox-fuzz's docs/ledger/probes/. A leaf is one construct-emitting function in the generator's own source; a claim needs one before it can move past todo.
Tests
- vox-fuzz's own tests
- 55
- vox, run
- 744
- vox, compile-fail
- 378
"Run" tests compile and execute, checked against a saved .expected file; "compile-fail" tests are meant to fail compilation, checked against a saved .err file. Both counts are top-level files only, so they will not match the fuller count in Tests you can count above. vox-fuzz's own tests exercise the fuzzer itself, not the compiler.
"Each finding is a .vox file plus a repro.sh; you reproduce it without trusting the tool."
Binaries, measured
Compiled fresh at build time with the real compiler, then measured to the byte.
| File | Source | Stripped bytes | As built |
|---|---|---|---|
| hello.vox | the compiler repo's examples/hello.vox, vendored at content/examples/hello.vox | 4,552 | 5,848 |
| cat.vox | the compiler repo's examples/cat.vox, vendored at content/examples/cat.vox | 13,544 | 33,648 |
| supervisor.vox | the compiler repo's examples/supervisor.vox, vendored at content/examples/supervisor.vox | 8,992 | 23,824 |
| initramfs.vox | the compiler repo's examples/initramfs.vox, vendored at content/examples/initramfs.vox | 13,856 | 35,240 |
| clock.vox | this site's own content/clock.vox (the home page's hero example), not a file in the compiler repo | 4,552 | 7,824 |
Stripped with GNU strip --strip-all; as built, with symbols, in the second column.
Command: vox <file> -o <out>
Stability
The latest release gets every fix, and each patch release replaces the one before it:
- 0.4.x (latest patch): gets every fix
- Any earlier release: upgrade first
SECURITY.md, supported versions
Every change is dated in CHANGELOG.md and in the release feed at /feed.xml.
Reproduce all of this
Every number above, run by hand on one machine with the compiler repository and vox-fuzz checked out and a built vox binary.
git clone https://github.com/Vox-lang/vox && cd vox # 1. Tests you can count git ls-tree -r --name-only main -- tests | grep -c '\.vox$' git ls-tree -r --name-only main -- tests/compile_fail | wc -l git ls-tree -r --name-only main -- tests | wc -l git grep -c '#\[test\]' main -- src # 2. Bugs, in the open git show main:docs/BUGS_FOUND.md # 3. Memory safety git show main:README.md git show main:SECURITY.md cd .. && git clone https://github.com/Vox-lang/vox-fuzz && cd vox-fuzz # 4. Fuzzing: the seed ledger and generator leaves (or, once vox-fuzz # publishes it, docs/ledger/quality-stats.json directly) git show main:SEEDS.md git ls-tree --name-only main:src | grep -c '^gen_.*\.vox$' # 5. Every number at once, from this site's own repository, with # VOX_REPO and VOX_FUZZ_REPO pointed at the checkouts above: VOX_REPO=/path/to/vox node scripts/docs/parse-quality.mjs VOX_FUZZ_REPO=/path/to/vox-fuzz node scripts/docs/parse-fuzz.mjs ./scripts/measure-sizes.sh ./scripts/verify-examples.sh