Kosha: An Adversarial Compiler For Security Education via Documented Failure

Modern systems software education relies increasingly on auxiliary developer tooling—ranging from static analysis linters and automated memory sanitisers to interactive IDE diagnostics and large-scale language models—designed to accelerate debugging and lower entry barriers. However, these instruments share a structural pedagogical flaw: they resolve software defects for the developer rather than requiring the developer to resolve them. By outsourcing the verification step to automated engines, novices develop a passive reliance on external correction, bypassing the rigorous mental execution modeling required for systems mastery.

This paper introduces Kosha (v0.1.0), an adversarial C99 educational compiler engineered to explicitly refuse deferred verification. Kosha strips compiler diagnostic verbosity down to minimal, non-descriptive error codes that map strictly to an external architectural manual. We detail Kosha's single-pass pipeline, formalise its operational type-inference rules, and characterise its host-target security isolation boundaries, presenting a rigorous pedagogical instrument designed to force active, first-principles manual tracing in systems security curricula.