Newt-Agent

Experimental agentic coder.

Written in Rust. The default build ships no cloud provider — remote models are opt-in subprocess plugins. The scoreboard below is the claim, measured on Terminal-Bench, confined and unconfined.

Terminal-Bench

Measured on Terminal-Bench via newt solve (headless) plus the Harbor adapter. The release gate is a per-model monotonic ratchet — a model's score never goes down across releases; establish a starting number, then keep beating it. Both lanes are published, because confined (OCAP on) versus unconfined (OCAP off) is the claim worth making: security you can afford to leave switched on.

Per-model Terminal-Bench champions, OCAP off vs on. Each lane is a monotonic ratchet (a score never goes down). Measured models only; the roster's unrun models are in the full table. Auto-generated; do not edit by hand.

Model	OCAP off	OCAP on
ornith-1.0-35b-q8 ornith · tb-30 · ctx 65536 · v0.7.6 · 2026-07-29	pending	36.7% (11/30)
qwen3.6_35b qwen · tb-30 · ctx 65536 · v0.7.6 · 2026-07-29	20.0% (6/30)	26.7% (8/30)
o4-mini openai · tb-30 · ctx 65536 · v0.7.6 · 2026-07-29	pending	13.3% (4/30)
qwen3-coder_30b qwen · tb-30 · ctx 65536 · v0.7.6 · 2026-07-29	10.0% (3/30)	13.3% (4/30)
kimi-linear_48b kimi · tb-30 · ctx 65536 · v0.7.6 · 2026-07-31	pending	10.0% (3/30)
nemotron-3-nano_30b nemotron · tb-30 · ctx 65536 · v0.7.5 · 2026-07-29	6.7% (2/30)	pending
glm-4.7-flash glm · tb-30 · ctx 65536 · v0.7.6 · 2026-07-31	pending	3.3% (1/30)
gpt-4.1-mini openai · tb-30 · ctx 65536 · v0.7.6 · 2026-07-29	pending	3.3% (1/30)

Full results — every model including those still queued, per-run provenance, and the harness methodology — are published by gilamonster-bench, a separate instrument that has no dependency on newt. If the ruler shipped with the thing it measures, one commit could move both at once. For how these particular numbers were kept honest — including the runs thrown out — see the DGX Spark capability survey.

Quick start

git clone https://github.com/Gilamonster-Foundation/newt-agent
cd newt-agent
just install                       # → ~/bin/newt, ~/bin/newt-mcp-server
newt setup inference.example.net   # probe discovery ports, select a model
newt code                          # TUI coder in the current directory

Authenticated endpoints, discovery ports, and where backends are stored: the setup guide. Inside the TUI, /mode picks a working style and /posture is the separate authority control — a posture floor can only ever narrow authority (decision record). Tool output renders through a bounded, tail-biased spill that /spill tunes (newt-tui). Run newt --help for every mode (worker, MCP server, doctor, config, …) — the binary is the authority on its own surface, this file is not. Python bindings live in newt-agent-py/.

Why a bridle, not just a harness

An agent harness helps the model do work; a bridle lets the operator steer — and prove, after the fact, exactly where the horse went. Newt is an experiment in making Object Capability (OCAP) security — long considered theoretically correct but practically unimplementable — pragmatic inside an agent loop, as a reusable concept (agent-bridle) intended to be pluggable into other harnesses, not just this one.

Because OCAP is an algebraic construction, some questions are answered structurally rather than by audit-log archaeology: who acted on what and when, who granted the authority for it, and whether only what was permitted actually happened. For anyone whose work lives on provenance, authority, integrity, and data sovereignty — lawyers, clinicians, data scientists — those answers have to be properties of the system, not promises in a policy document. The long form is docs/vision.md.

If it doesn't find its day in the sun, it was fun anyway.

Design laws

The invariants. Each links to the decision record that argues it.

• Local-first inference. The default binary speaks only to local backends. Cloud providers are opt-in subprocess plugins speaking the JSON-RPC schema in plugins-protocol/ — the opt-in is enforced at the build level, not a runtime flag.
• Fail-closed OCAP. Authority is a caveat lattice, not a denylist; a fixed safety floor no mode or grant can unlock. See docs/decisions/agentic_object_capability_security.md and docs/decisions/ocap_confinement_model.md.
• Small crates, zero warnings, coverage-gated. just check mirrors CI; the pre-push hook runs it. One operator's leverage is this discipline.
• Patch, not prose. Delegated work is verified by the harness (real diffs, real test runs — newt-eval/), never by trusting a model's summary of itself. The bench ratchet above is the same law at release scale: verify by artifact, never by self-report.
• Skills are on-demand context. The prompt carries an index; bodies load when used. See docs/decisions/agent-skills.md and the bundled skills in .newt/bundled-skills/.
• Issues are ground truth. ROADMAP.md sequences delivery, but GitHub issue state is authoritative — the document is only the map.
• Causal ordering, not wall-clock. Timestamps are display claims; the conversation store orders on signed per-writer ticks + content hashes. See docs/decisions/conversation_context_architecture.md.

Field notes

The durable output of this experiment is what building it teaches about how LLMs behave inside a harness.

• Summarization-induced hallucination — a confident summary is worse than a labelled absence: absence routes the model to re-read, a summary suppresses recovery.
• Truncation honesty — silent context truncation yields silently wrong answers; every fix moves the failure, it doesn't always remove it.
• Coder-driving sweet spots — where small local models are and aren't reliable at agentic coding.
• Hermes learnings — take the algorithms, refuse the architecture.

Where things live

What	Where
Setup beyond the quick start	docs/guide/setup.md
Benchmark results & methodology	gilamonster-bench
Forward plan	ROADMAP.md (issue numbers are the live state)
Release history	CHANGELOG.md
Design docs & studies	docs/design/
Decision records	docs/decisions/
Field notes	docs/notes/
Terminal UI	newt-tui/README.md
Evaluation harness	newt-eval/README.md
Local gate	just check (see justfile)

License

Apache-2.0. See LICENSE.