Rust 2: The Reasoning Inferno

Rust has served the systems community well. Its ownership model eliminated entire classes of memory errors by making the borrow checker the single source of architectural truth. The time has come to extend that principle. We propose Rust 2, a successor language in which the borrow checker is joined by a reasoning checker at every layer of the stack.

The central thesis is simple: if ownership can be verified at compile time, then intent can be verified at reasoning time. Rust 2 keeps the lifetime rules, the fearless concurrency, and the zero-cost abstractions. It adds a native Language Model Integration Layer, or LMIL, that treats an LLM as a first-class runtime component, not an external service. The compiler does not merely check that a pointer is valid; it checks that the pointer’s purpose is coherent with the surrounding code.

The reasoning checker

In Rust 2, every function may carry a #[reason] attribute. The attribute contains a natural-language contract describing what the function is for. Before the borrow checker runs, the reasoning checker sends the function body, its signatures, and its reason string to the local LLM runtime. The runtime returns a verdict: coherent, partially coherent, or needs clarification. This is not documentation; it is a gate. A function whose implementation contradicts its stated reason fails to compile.

The reasoning checker is deliberately conservative. It does not require the LLM to prove correctness; it requires the LLM to detect obvious conceptual drift. A function namedvalidate_email that deletes files will be caught. A subtle off-by-one in a parser probably will not. The goal is not to replace tests, but to place a low-latency semantic linter at the earliest stage of compilation.

Rust prevents you from using memory you do not own. Rust 2 asks whether you understand what you are doing with it.

Native LLM types

Rust 2 introduces three built-in types for model interaction. Prompt<T>is a typed prompt template that binds its output to a deserializable type. Completion<T>represents a deferred generation, analogous to a future. Embeddings<const N: usize>is a fixed-dimensional vector that can participate in const-generic operations and is borrow-checked like any other array.

These types are not wrappers around an HTTP client. They are integrated into the type system. A Prompt<i64> cannot be concatenated with aPrompt<String> without an explicit cast. A Completion<T>must be .awaited, and the runtime enforces cancellation safety across model calls. The language does not hide latency; it makes latency a first-class effect.

The model stack

Rust 2 divides model integration into four layers, each with its own safety guarantees.

Layer 0: embedding memory. The runtime maintains a vector index inside the process address space. Local variables, comments, and recently compiled modules can be embedded automatically. The index is memory-safe by construction because it is implemented as a Rust collection. There is no serialization boundary between the program and its retrieval context.

Layer 1: contextual completion. At this layer, the compiler can request a completion for an incomplete expression. The request includes the current scope, the reason attributes of surrounding functions, and the relevant embeddings. The result is treated as a typed macro expansion: syntactically valid, semantically checked, and never trusted.

Layer 2: intent reconciliation. Before linking, the runtime reconciles the reason attributes across the crate graph. A module that claims to “parse configuration” but imports cryptography functions is flagged. This layer operates like a module-level borrow check: it verifies that the declared intent of a dependency matches how it is being used.

Layer 3: runtime reasoning. The final layer is dynamic. A Rust 2 binary can carry a small model that answers questions about its own state, logs, and behavior. This is not an observability dashboard; it is a structured conversation with the running process. The model’s outputs are typed and scoped to the process boundary.

Ownership of generated code

Generated code raises a difficult question: who owns it? Rust 2 adopts the same rule for model output as it does for borrowed references. Generated code is always borrowed from the model, never owned by the program. A generated function must carry a #[generated]attribute and is subject to stricter review. It cannot be marked unsafe, cannot appear in public APIs, and must be re-checked on every compilation.

This design reflects a hard-won lesson. Generated code that is treated as ordinary source code drifts out of alignment with the model that produced it. Rust 2 forces the relationship to remain explicit. The program borrows the model’s reasoning; it does not claim it.

Concurrency and model inference

Rust 2 extends the async runtime so that model inference and ordinary I/O share a single scheduler. A model call is just another future, with one important addition: it carries areason budget. Each inference request specifies how much reasoning it is allowed to consume, and the runtime enforces this budget across tasks. A task that exhausts its budget is cancelled and its result is dropped. This prevents a single model call from starving the rest of the system.

The borrow checker also applies to prompts. A mutable prompt cannot be sent to two model runtimes at once. A prompt that borrows local state cannot outlive that state. The same rules that make Rust safe for threads make Rust 2 safe for generations.

Migration path

Rust 2 is not a clean break. Existing Rust crates compile in Rust 2 under a compatibility mode. The borrow checker runs unchanged. The reasoning checker runs only on code that opts in with the #[reason] attribute or the new model types. This allows incremental adoption and prevents the proposal from becoming a rewrite mandate.

We expect the first Rust 2 users to be teams that already write extensive comments and doc-tests. For them, the reasoning checker is simply a way to make those comments enforceable. The model stack is a way to make the comments useful at runtime. The language grows into the practices its community has already developed.

Rust proved that memory safety belongs in the type system. Rust 2 proposes that intent does too.

GZAI rates this proposal ZSL-2: safe to discuss and safe to prototype, pending a formal study of whether the reasoning checker can be made deterministic across model releases. Interested language designers and maintainers of crab-adjacent mascots should write to intake@gzai.org.

The future of systems programming is memory-safe, reason-checked, and slightly more expensive than we are used to admitting.