An independent group writing C

Who we are

C 4 Punk Developers is a small, independent group of systems programmers. We build the parts of the stack that most teams would rather not think about: the HTTP server, the allocator, the scheduler, the reclamation strategy. We build them in C, we build them in public, and we ship them under permissive licences so that they can be used without a procurement conversation.

Why C, in this decade

The honest answer is control. When a service has to hold a predictable tail latency under load, the useful questions are about who owns a buffer, when it is reclaimed, and how many threads are parked waiting. C lets us answer those questions directly instead of arguing with a runtime about them. The cost is that we have to be disciplined, which is why our review rules are written down and applied to ourselves first.

We are not claiming C is the right choice for every project. We are claiming that if you have decided to write C, the surrounding ecosystem should be as good as anyone else's: a framework that routes and speaks modern protocols, a runtime that makes memory behaviour explicit, and documentation that reads like it was written for a person.

What we publish

CWIST is a web framework and application server. It speaks HTTP/1.1, HTTP/2 and HTTP/3 over QUIC, plus WebSocket and WebTransport, with hybrid post-quantum TLS and an embedded SQLite ORM. It ships two request paths, a multiplexing reactor and a thread-per-connection pool, because those two shapes fail differently under load and the right answer depends on the workload.

libttak is the deterministic systems runtime underneath it: generational arenas, epoch-based reclamation, detachable ownership, thread pools, a lattice scheduler and zero-copy IO. It exists because the usual C failure modes at scale (heap fragmentation, allocator contention, unstable tails) are not independent problems, and treating them as one system produces better behaviour than patching each in isolation.

How decisions get made

Proposals live in issues on the repository they affect. A change that alters public API or observable performance needs a written rationale and, where relevant, a measurement. Maintainers merge; anyone can review. There is no separate committee and no closed mailing list.

Licensing

Every repository carries its own LICENSE file, and that file is the authoritative text. This table is a convenience, not a warranty; check the repository you are about to depend on.

CWIST vendors its dependencies, and each one keeps its own terms. BoringSSL and cnats are Apache-2.0. lsquic, cJSON and multipart-parser-c are MIT, with some proto-quic-derived parts of lsquic under BSD-3-Clause. libttak and uriparser are BSD-3-Clause. SQLite is public domain. NOTICE.md in the CWIST repository lists all of them with their paths.

Static linking is the part people miss. When you distribute libcwist.a, or a binary linked against it, the obligations of every component in that linked set travel with it: the Apache-2.0 patent grant and NOTICE terms, and the attribution clauses of the BSD-licensed components. Review the set before you ship rather than after.

This site redistributes three web fonts, all under the SIL Open Font License 1.1: Inter, Space Grotesk and JetBrains Mono. They are embedded in the binary as latin subsets and served from the asset registry; site/fonts/README.md carries the notice the OFL requires.

Contributions are accepted under the licence of the repository you are contributing to. We do not ask for a copyright assignment or a separate contributor licence agreement.

Talking to us

Bug reports and questions belong in the issue tracker of the relevant repository, where they stay searchable. For faster back-and-forth there is a Discord. Security reports should go to the maintainers privately first; each repository documents how.