Designing a Stack-Based VM in Rust: 44 Instructions, Dual Backends, and Zero-Cost Security Types

Designing a Stack-Based VM in Rust: 44 Instructions, Dual Backends, and Zero-Cost Security Types

A deep dive into the architecture of Metalogos — how 30,500 lines of Rust implement a language where XSS and SQL injection are compile-time errors, and why two execution backends crosscheck every program.

Introduction

Most programming languages treat security as an external concern — linters, SAST tools, code review. Metalogos takes a different approach: security constraints are enforced by the type system and erased before execution. This post explores the Rust implementation behind that idea, focusing on architectural decisions that are reusable beyond this specific language.

The codebase is ~30,500 lines of Rust, 91 Architecture Decision Records (ADRs), and two execution backends that must agree on every program's output. It is not a toy. It is not a DSL. It is a compiler, a bytecode VM, an HTTP server, a semantic memory engine, and a security audit tool — all in one workspace.