Turn: A Language for Agentic Computation

This paper introduces **Turn**, a compiled, actor-based programming language that enhances agentic software by integrating LLM inference as a typed primitive with schema validation, confidence-based control flow, isolated actor contexts, capability-based identity, and compile-time schema absorption to enforce critical safety and state invariants at the language level.

The Gist

Imagine you are trying to build a team of highly intelligent, autonomous robots to manage a complex investment portfolio. You want them to read news, analyze stocks, talk to each other, and make decisions.

In the current world of software, we build these robots using general-purpose languages (like Python) and glue them together with "frameworks" (libraries). It's like building a robot team out of Lego bricks and duct tape. It works, but it's messy. If a brick falls off, the robot might forget what it was doing, leak its secret keys, or hallucinate a decision that breaks the whole system.

Turn is a new programming language designed specifically for these "agent" robots. Instead of duct tape, it gives you specialized, pre-fabricated parts that are built into the very foundation of the machine.

Here is a breakdown of the paper's five big ideas, using simple analogies:

1. The "Smart Form" (Cognitive Type Safety)

The Problem: Currently, when you ask an AI to give you an answer, it just spits out a blob of text. You have to hope it's formatted correctly. If the AI says, "The stock price is 'maybe'," your program crashes because it expected a number.
The Turn Solution: Think of this as a Smart Form.
In Turn, you don't just ask the AI a question; you hand it a pre-printed form with specific boxes (e.g., "Stock Price," "Confidence Level"). The compiler (the language's rulebook) forces the AI to fill out exactly those boxes. If the AI tries to write "maybe" in the "Price" box, the system rejects it immediately and asks the AI to try again.

• Result: You never have to worry about the AI giving you garbage data. The structure is guaranteed before the code even runs.

2. The "Confidence Meter" (Probabilistic Control Flow)

The Problem: AI is sometimes unsure. In normal code, if an AI is unsure, the program just keeps going, often making a bad decision.
The Turn Solution: Turn gives you a Confidence Meter.
Every time the AI makes a decision, it also gives you a score from 0 to 100% saying, "How sure am I?" Turn lets you write rules like: "If the confidence meter is below 70%, stop and ask a human (or use a backup plan)."

• Result: You can build safety nets directly into the code. If the AI is guessing, the program knows to be careful.

3. The "Private Office" (Actor-Based Process Model)

The Problem: In many current systems, all robots share one giant whiteboard (a shared message list). If Robot A writes a note, Robot B might accidentally read it, or the whiteboard gets so cluttered that Robot A forgets its own instructions.
The Turn Solution: Every agent gets its own Private Office.
Each robot has:

• A Mailbox: Only it can read its own letters.
• A Short-Term Memory: A limited space for the current conversation.
• A Long-Term Memory: A safe place to store facts it learned.
  If a robot gets confused or crashes, it doesn't take down the whole team. It just closes its office door, and the supervisor can restart it without losing the team's progress.
• Result: Robots don't step on each other's toes, and they don't get overwhelmed by too much information.

4. The "Magic Key" (Capability-Based Identity)

The Problem: To let a robot access a bank account or a stock market, you usually have to give it a password (API key). If the robot gets confused, it might accidentally say, "Hey, my password is 12345," and leak it to the world.
The Turn Solution: Turn uses Magic Keys.
Instead of giving the robot a string of text it can read and repeat, the system gives it a sealed, unforgeable token. The robot can use the token to open the door, but it cannot see what's inside the token, nor can it copy it or say it out loud. Even if the robot tries to "hallucinate" a command to leak its secrets, the language physically prevents it.

• Result: Your secrets are safe, even if the AI goes crazy.

5. The "Instant Translator" (Compile-Time Schema Absorption)

The Problem: Connecting an AI to a real-world service (like a weather API or a bank) usually requires writing a lot of boring code to translate between the AI's language and the bank's language.
The Turn Solution: Turn has a Magic Translator.
You simply tell the language, "Go get the rules for the Bank API." The language goes out, reads the bank's rules, and instantly builds the perfect "forms" and "tools" for you before the program even starts.

• Result: You spend zero time writing boring connection code. You just focus on the logic.

The Big Picture: Why does this matter?

The paper argues that building AI agents with current tools is like trying to build a skyscraper with a hammer and a saw. It's possible, but it's dangerous and inefficient.

Turn is like a prefabricated skyscraper kit.

• It forces the AI to follow rules (Type Safety).
• It checks if the AI is sure (Confidence).
• It keeps the workers separate (Actors).
• It locks the vaults (Identity).
• It pre-builds the connections (Schema).

By baking these safety features directly into the language, Turn makes it possible to build reliable, secure, and scalable AI agents that don't just "hope" they work, but are guaranteed to work by the rules of the language itself.

In short: Turn turns "agentic software" from a chaotic experiment into a disciplined engineering discipline.

Technical Summary

Here is a detailed technical summary of the paper "Turn: A Language for Agentic Computation."

1. Problem Statement

The emergence of Large Language Models (LLMs) has enabled a new class of agentic software—programs that observe, reason, and act autonomously. However, building these systems using existing general-purpose languages (e.g., Python, TypeScript, Rust) and frameworks (e.g., LangChain, AutoGPT) reveals a fundamental impedance mismatch.

Current approaches treat critical agentic invariants as application-level conventions rather than language guarantees, leading to five recurring failure modes:

1. Unbounded Context: Context is managed as unstructured message lists, leading to silent overflow or truncation that causes the model to lose critical information.
2. Untyped Inference Output: LLM outputs are treated as raw strings/JSON with no compile-time schema guarantees, causing runtime errors when the output structure deviates from expectations.
3. Fragmented State: Agent state is scattered across variables, databases, and framework internals, lacking a single serializable representation.
4. No Durable Execution: Long-running agents die with their process; there is no language-level mechanism for checkpointing and resuming execution.
5. Credential Leakage: API keys and tokens are often stored as strings accessible to the LLM's tool-calling interface, creating vectors for secret exfiltration.

2. Methodology: The Turn Language

Turn is a compiled, actor-based programming language designed specifically for agentic computation. It is statically typed for schema inference (to ensure structural correctness) but dynamically typed at the value level (to maintain scripting flexibility).

The language is implemented as a Rust-based bytecode Virtual Machine (VM) and introduces five core language-level constructs to address the failure modes above:

A. Cognitive Type Safety (Section 4)

• Mechanism: Introduces the infer Struct { prompt } primitive.
• Function: The compiler generates a JSON Schema from a struct definition at compile time. At runtime, the VM embeds this schema into the LLM request. The VM validates the model's JSON response against the schema before binding the value to a variable.
• Guarantee: If an infer expression completes without error, the bound value is structurally guaranteed to conform to the declared type. Failed validations trigger automatic re-prompts (up to $k$ retries).

B. Probabilistic Control Flow (Section 5)

• Mechanism: Introduces the confidence operator.
• Function: Extracts the model's reported certainty (e.g., log-probabilities) from the inference result.
• Functionality: Enables deterministic branching based on stochastic output (e.g., if confidence(result) < 0.7 { fallback }). This allows programs to compose stochastic and deterministic paths cleanly within the same type discipline.

C. The Agentic Process Model (Section 6)

• Mechanism: Adapts the Erlang actor model to the agentic domain.
• Structure: Each agent is a process with an isolated Context Window, Persistent Memory, and Mailbox.
• Tripartite Context Architecture: To address the "Lost in the Middle" phenomenon, the context is not a flat list but a three-tier structure:
  • P0 (System): High-recall primacy position.
  • P1 (Working): High-recall recency position (bounded).
  • P2 (Episodic): Lower-recall middle zone for older context.
  • Result: System prompts and recent items always occupy attention-privileged positions, regardless of total context size.

D. Capability-Based Identity (Section 7)

• Mechanism: Introduces grant identity::σ("name").
• Function: Returns an opaque, unforgeable Identity handle from the VM host.
• Security: The handle cannot be coerced to a string, serialized, or passed to output tools. The raw credential is injected by the VM host (Rust kernel) only at the point of I/O execution, ensuring the LLM never sees the secret.

E. Compile-Time Schema Absorption (Section 8)

• Mechanism: use schema::<protocol>("url") macro.
• Function: Fetches external API specifications (OpenAPI, GraphQL, etc.) at compile time, parses them, and synthesizes native Turn structs and closures.
• Benefit: Closes the type gap between LLM output and external API consumption, allowing end-to-end type safety.

3. Key Contributions

1. Cognitive Type Safety: Proven structural conformance of LLM outputs via compiler-generated schemas and VM validation.
2. Probabilistic Control Flow: A first-class operator for gating execution on model certainty.
3. Agentic Process Model: An actor-based architecture with isolated context windows, persistent memory, and a tripartite context structure to optimize LLM recall.
4. Capability-Based Identity: A security primitive preventing credential leakage by keeping secrets out of the agent's memory space.
5. Compile-Time Schema Absorption: Automated generation of typed bindings from external API specs.

4. Results and Evaluation

The authors evaluated Turn against five "hard questions" using 105 Rust integration tests on an Apple M4 machine.

• Credential Opacity (E1): Verified that raw API tokens never enter the Turn value heap or are visible to the LLM. The Identity type renders only as a handle (e.g., <identity stripe>).
• Confidence Semantics (E2): Verified that the confidence operator correctly propagates uncertainty (product rule for arithmetic, Zadeh minimum for boolean logic) and enables deterministic fallbacks.
• Structured Context (E3): Confirmed that the P0/P1/P2 architecture maintains primacy and recency positions even as context grows, preventing the "Lost in the Middle" degradation.
• Memory Isolation & Scale (E4): Demonstrated O(1) average access latency for agent memory across scales from 1K to 100K entries, with strict isolation between processes.
• Durable Execution (E5): Verified that suspend checkpoints the entire VM state (stack, heap, context, memory) to JSON with exact fidelity. A 5,000-entry agent checkpoints in <7ms with negligible overhead.
• Complexity Reduction: The "Investment Committee" example (3 agents, concurrent evaluation) was implemented in 89 lines of Turn, compared to an estimated 350+ lines in LangChain, eliminating the need for external Redis, message queues, and manual retry loops.

5. Significance

Turn represents a paradigm shift from framework-based to language-based agentic development.

• Theoretical Impact: It demonstrates that treating LLM inference as a typed primitive and agents as isolated processes with capability-based security provides stronger guarantees than any library built on top of general-purpose languages.
• Practical Impact: By encoding invariants (bounded context, typed output, credential isolation, durability) directly into the language runtime, Turn eliminates entire classes of production failures that currently plague agentic systems.
• Future Outlook: The paper outlines a path toward a production-grade ecosystem with distributed actor scheduling, extended schema adapters (GraphQL, FHIR), and formal verification of the compiler/VM pipeline.

Conclusion: Turn argues that "an agent is a process, not a loop." By making the constraints of agentic computation first-class language constructs, Turn enables the compiler and runtime to mechanically enforce the reliability and security required for autonomous software at scale.