Jo's two-world architecture to solve the fine-grained sandboxing problem at compile-time

Jo is a secure programming language that intends to addressing the fine-grained sandboxing problem at compile-time. To make secure programming practical it ends up with a two-world architecture : - confined world : not trusted, no FFI transitively, disciplined, standard library is not trusted - trusted world : trusted, FFI, type cast, language runtime is trusted The two-world architecture makes it possible to establish a security wall inside the language : that makes it easy to confine an untrusted program