Projects sharing features with Cel Spec

Dhall is a type-safe configuration language designed to create programmable configuration files that are guaranteed to terminate. It is a non-Turing-complete language that uses a strict type system to ensure correctness and prevent infinite loops during evaluation. The project functions as a deterministic configuration engine and marshalling tool, converting programmable expressions into static formats such as JSON, YAML, and Bash. It distinguishes itself through a focus on security and integrity, using semantic hashing to pin remote imports and enforcing origin policies to prevent data exfil

Octelium is a zero-trust network access platform and identity-aware proxy designed to secure private HTTP, SSH, and SQL resources. It functions as a secure gateway that validates human and workload identities using OIDC, SAML, and FIDO2 passkeys before granting access to internal applications and SaaS APIs. The system is distinguished by its secretless access broker, which injects credentials—such as API keys, passwords, and AWS Sigv4 signatures—at the gateway level so users can access databases and cloud resources without managing secrets. It further specializes in AI gateway administration,

Expr is a statically typed expression engine and domain-specific language for parsing and evaluating dynamic logic strings within Go applications. It functions as a bytecode expression evaluator that executes compiled logic with guaranteed termination and memory safety. The engine utilizes a specialized compiler and virtual machine to achieve high-performance execution. It employs static type validation during the compilation phase to ensure operand compatibility and prevent runtime crashes. The project provides a data transformation engine capable of mapping, filtering, and aggregating coll

Ory Keto is an open-source authorization server that implements Google Zanzibar’s relationship-based access control model. It stores every access relationship as a tuple in a SQL database and exposes a declarative TypeScript-like namespace language for defining object types, relations, and permissions. The service provides bidirectional permission resolution, configurable consistency levels for checks, and dual gRPC and REST APIs for broad integration. Keto extends the Zanzibar model with edge enforcement of access policies, structured compliance auditing of permission decisions, and infrastr

Flecs is a high-performance entity component system framework and data-oriented programming library. It serves as a simulation engine core and game engine architecture tool, decoupling state from behavior by separating entities, components, and systems. The framework features a runtime reflection layer for dynamic data inspection and a built-in scripting system for defining entity behavior without recompilation. It also includes a network interface and REST API for remote simulation administration and state querying. The library covers a broad surface of simulation capabilities, including ar

QLExpress is a dynamic scripting engine and expression language for the Java platform. It functions as a runtime expression evaluator and business rule engine, allowing applications to execute scripts and evaluate business logic without requiring system recompilation. The engine distinguishes itself through a secure scripting sandbox that enforces security policies via class whitelisting and execution timeouts. It supports high-precision mathematics to prevent rounding errors and provides language alias support to create domain-specific languages that resemble natural language. Additional cap

The Meson Build System

Locutus is a multi-language utility library and polyfill collection written in TypeScript. It provides a comprehensive set of implementations for standard library functions from various programming languages, enabling developers to use familiar semantics and behaviors across different technical environments. The library functions as a cross-language standard library, porting core logic and utilities from diverse languages into a type-safe TypeScript toolset. It focuses on maintaining consistent behavior through a polyfill-based design that replicates the original functionality of these foreig

The expression-language is a lightweight calculation component and parser tool that compiles and evaluates single-line string expressions against runtime variables. It functions as an expression engine that parses logical expressions into executable code or evaluates them directly against provided variables and functions to power dynamic rule evaluation and configuration. The engine features a complete architecture covering lexical tokenisation, intermediate code generation, and execution caching. It parses expression strings into hierarchical abstract syntax trees to enable programmatic insp

The project provides a standardized abstract syntax tree specification and utility library for parsing, transforming, and serializing markdown documents. It serves as a comprehensive document processing architecture that translates between raw text markup and structured node representations in both directions. The capability surface covers syntax parsing for extended markdown features, custom syntax extensions, metadata blocks, and embedded expressions, alongside document serialization that converts syntax trees back into standard and extended markup formats. It includes node modeling and val

This project is a cross-language quantitative trading framework designed to implement and execute trading strategies consistently across Python, JavaScript, C++, and PineScript. It functions as a polyglot trading strategy translator and a multi-language algorithmic trading engine that maps high-level scripting and block-based logic to executable binaries. The system features a financial domain-specific language parser that translates specialized trading syntax and visual programming blocks into a standardized internal representation. It includes a technical analysis pattern library providing

pycparser is a C99 parser library that converts C source code into an abstract syntax tree consisting of Python objects. It functions as an abstract syntax tree generator, transforming preprocessed C code into a structured hierarchy for programmatic analysis and transformation. The library integrates with a C preprocessor to handle directives before parsing. It also features a stub header parser, which uses minimal mock headers to allow the parsing of C code without requiring a full system C library installation. The project provides tools for static code analysis, C program analysis, and so

ESTree is a formal schema and set of object interfaces used to represent JavaScript source code as a standardized abstract syntax tree. It serves as a common tree format and parser standard to ensure interoperability between different JavaScript parsers and transformation tools. The specification provides a consistent way to model language constructs, including statements, expressions, and module declarations. It includes detailed representations for modern language features such as classes, private identifiers, and short-circuiting logic like nullish coalescing and optional chaining. The pr

Casbin is an authorization library that provides a model-based engine for enforcing access control across diverse application environments. It decouples authorization logic from application code by using a configuration-driven approach, allowing developers to define access rules and evaluation logic independently. The system supports a wide range of access control models, including role-based, attribute-based, and relationship-based patterns, which are evaluated at runtime to determine if a subject is permitted to perform an action on a resource. The project distinguishes itself through a hig

Pundit is a Ruby authorization framework that implements policy-based access control. It maps domain models to dedicated logic classes that determine whether a user is permitted to perform specific actions on data objects. The framework utilizes plain Ruby objects to decouple authorization logic from the model. It includes mechanisms for data query scoping to filter record collections based on user permissions, as well as attribute-level permission control to restrict which specific model fields a user can modify. The system provides tools for authorization coverage verification to ensure se

Jazz is a local-first relational database and synchronization framework designed for offline-capable applications. It functions as a reactive state management system that treats database records as the primary source of truth, automatically updating user interfaces in real time as underlying data changes. The project distinguishes itself through a collaborative data synchronization model that utilizes row-level versioning to track branching edit histories. It implements a security engine based on identity-claim row security, which enforces granular permissions on individual records, and suppo

This project is a Lisp interpreter implementation guide and framework designed to teach the core principles of programming language design. It provides a structured, step-by-step technical framework for building a functional Lisp language from scratch, featuring a specialized interpreter engine and an S-expression parser that converts syntax into abstract syntax trees. The project emphasizes a code-as-data metaprogramming framework, enabling the implementation of macros, quoting, and quasiquoting to transform expressions during evaluation. It is designed with host language agnosticism, allowi

Aviatorscript is a high-performance scripting language and expression evaluation engine designed for integration within Java applications. It enables the dynamic execution of mathematical and logical formulas by compiling script instructions directly into Java bytecode at runtime. The engine distinguishes itself by transforming dynamic logic into machine-readable instructions, allowing for near-native execution speeds. It includes a built-in caching mechanism that stores compiled bytecode to eliminate redundant parsing and compilation overhead during repeated formula execution. This library

HCL is a configuration language implementation designed for parsing, evaluating, and encoding structured settings through the use of blocks and attributes. It functions as a configuration AST parser and a schema-based decoder that maps attributes and blocks to internal data structures using predefined rules. The project includes an expression evaluation engine that resolves dynamic values and cross-references through multi-phase processing of variables and functions. It also provides a configuration file formatter to standardize the layout and indentation of source code for consistent visual

PINCE is a dynamic debugger, instruction tracer, and memory scanner designed for the analysis and manipulation of running processes. It functions as a process memory manipulator and editor, allowing for the identification, modification, and monitoring of values within a target application's active memory. The tool distinguishes itself through memory pointer analysis, tracing addresses and offsets to locate static pointers that lead to dynamic data across different sessions. It also enables the execution of internal functions within a running process by manipulating the instruction pointer and

Cerbos is an open-source authorization service that provides a centralized, language-agnostic engine for managing access control. It functions as a policy-as-code platform, allowing teams to define, test, and distribute authorization rules using declarative YAML or JSON configurations. By decoupling access logic from application code, it enables consistent permission enforcement across diverse service stacks. The project distinguishes itself through its ability to translate high-level authorization policies into native database query filters. This capability allows applications to enforce sec

Atmosphere is a Java-based framework for building and coordinating AI agents. It provides a real-time transport layer for streaming data via WebSockets, SSE, gRPC, and WebTransport, alongside a multi-agent orchestration framework for managing agent fleets through sequential, parallel, and graph-based execution workflows. The project features a durable workflow engine that persists agent state as snapshots, allowing long-running tasks to survive system restarts and incorporate human-in-the-loop approvals. It also implements Model Context Protocol servers to expose tools, resources, and prompt

depcheck is a project dependency auditor and npm dependency analyzer for the JavaScript ecosystem. It functions as an abstract syntax tree parser that scans source code to identify unused packages or missing declarations within a project manifest file. The tool distinguishes itself by parsing multiple language syntaxes and file formats to locate dependency imports. It can identify dependencies declared within tool-specific configuration files for build tools, linters, and test runners, and supports extensibility through custom detectors and parsers. The system provides capabilities for depen

XNU is a hybrid operating system kernel that combines a microkernel architecture with a monolithic layer for system services. It provides a foundation for operating system development, incorporating standardized system-call interfaces, a modular device driver framework, and mandatory access control security. The architecture features a Mach-based microkernel and a BSD-based monolithic layer. It utilizes a message-passing inter-process communication bus for secure data exchange between isolated kernel components and user-space processes, alongside an object-oriented driver framework that decou

Ockam is a zero-trust networking framework designed to secure data transit between distributed applications using an identity-based network overlay. It provides the primitives necessary to establish mutually authenticated and end-to-end encrypted connections, removing the reliance on traditional network-layer security. The project is distinguished by its use of attribute-based access control and verifiable credentials to manage trust at scale. It implements cryptographic identity rotation to maintain identity continuity and integrates with hardware-backed key management systems to secure priv

Authorizer is an open-source identity provider that functions as a centralized authentication and authorization platform. It manages user identities and session lifecycles by implementing standard OpenID Connect protocols, allowing for secure verification across web, mobile, and backend applications. The service is designed as a containerized microservice that provides a unified interface for administrative and authentication operations. The platform distinguishes itself through a multi-tenant architecture that isolates authentication rules and user data across different business domains. It

Digger is a GitOps infrastructure automation system and Terraform orchestrator. It enables the execution of infrastructure plans and applies directly from version control pull requests and CI pipelines. The project provides a framework for policy-based governance and state management. It enforces role-based access controls and custom security policies on infrastructure changes, while centrally storing state files with version history and access controls. The system manages infrastructure workflows through pull request comment triggers and remote execution. It includes capabilities for drift