The Verifier Is the Product

Why Janus is not another language — and what the agent era actually rewards.

Anders Hejlsberg — creator of Turbo Pascal, C#, and TypeScript — once said the world needs another programming language like it needs another hole in the head. He is right. The world does not need another language.

What the world needs is a constitutional layer for systems that will increasingly be written by agents — systems that must be verifiable by construction, not trusted by habit. That is not “me too with different keywords.” It is a different claim. And no incumbent holds it.

The admission that gives the game away

In a 2026 interview about TypeScript’s native rewrite, Hejlsberg made an admission most of the industry has never fully absorbed: TypeScript’s types “have no impact whatsoever on the runtime behavior of the code.” They are erased at compile time. They exist purely for tooling’s sake — for statement completion, refactoring, navigation, and catching the programmer’s mistakes before anyone runs anything.

In other words: the most successful language of the last decade did not win because of what it emitted. It won because of what it verified. The compiler was never the product. The tooling was the product. The type checker was the product. The vouching was the product.

Complete the syllogism

If verification is where the value lived in the human era, then in the agent era the conclusion is unavoidable:

When agents write the code, the verifier is the product.

Agents generate. Something must vouch. And the thing that vouches had better be deterministic, fast, and structural — a compiler, not a prompt, not a code review you skim at midnight, not vibes.

TypeScript gives AI type-checking: the proof that a value has the right shape. Janus gives AI capability-checking: the proof that a program has the right authority. Shape is table stakes. Authority is the frontier.

An agent-written Janus program can be proven at compile time — structurally, with no runtime hooks, no sandbox scaffolding, no policy engine bolted on after the fact — unable to touch the network, the filesystem, or a process without a capability token you explicitly granted it. No ambient authority. Every effect granted. Every boundary proven.

The responsibility stack

Hejlsberg also said the quiet part about agent-written code: when the app steals a bank account, “they’re going to sue you, not the AI.”

Responsibility cannot be delegated to a model. It stays with the human and the organization that shipped the system. But responsibility has two halves:

The technical half — capability gating. The compiler proves what the code is allowed to do, so the human’s vouching has teeth.
The process half — sovereign review. In the Libertaria stack, that is sober: the review gate nothing merges without. Agents propose; the gate disposes.

Type-checking tells you the agent’s code is well-formed. Capability-checking tells you it is well-behaved by construction. Only one of those is a defensible answer in front of a regulator, a board, or a judge.

Not a language. A constitution.

Every incumbent was designed for a world where humans wrote the code and the compiler’s job was to emit machine instructions. Verification was a side effect; authority was ambient; review was folklore.

Janus inverts the order of operations. The constitution comes first: profiles are oaths, capabilities are grants, effects are visible in the syntax, and the compiler enforces the law before a single instruction is emitted. The agent may hold the pen. It never holds the keys.

TypeScript made AI’s code type-correct. Janus makes AI’s code provably confined.

The compiler is the constitution. The capability is the law. Provable, not promised.