Newt-Agent

Free, friendly, local agentic coder.
vi to Hermes-Agent's emacs.

A single Rust binary with a sharp, minimal tool set. It runs against your
local hardware by default — no cloud bytes leave your machine unless you
deliberately install a provider plugin. Opinionated, not extensible.

Why — the bridle, not just the harness

An agent harness helps the model do work; a bridle lets the operator
steer — and prove, after the fact, exactly where the horse went. Newt is an
experiment in making Object Capability (OCAP) security — long considered
theoretically correct but practically unimplementable — pragmatic inside an
agent loop, as a reusable concept
(agent-bridle)
intended to be pluggable into other harnesses, not just this one.

OCAP's algebraic construction means some questions are answered
structurally, not by audit-log archaeology:

• Who acted on what, and when?
• Who granted the authority for this to do that?
• Did what they permitted actually happen — and did only what they
  permitted happen?

For anyone whose work lives on provenance, authority, integrity, and data
sovereignty — lawyers, clinicians, data scientists — those answers have to be
properties of the system, not promises in a policy document.

If it doesn't find its day in the sun, it was fun anyway.

Quick start

git clone https://github.com/Gilamonster-Foundation/newt-agent
cd newt-agent
just install          # release binaries → ~/bin/newt, ~/bin/newt-mcp-server
newt setup dgx1.home.lab  # probe configured ports and select detected inference
newt code             # TUI coder in the current directory

Bare setup hosts are probed anonymously across the configured discovery ports
(including 8000 and 8080 by default). For an authenticated endpoint, use its
exact HTTPS URL and store only a secret reference:

newt setup https://inference.example.net:8000 --token-env INFERENCE_TOKEN
newt setup https://inference.example.net:8080 --token-file ~/.config/newt/token

Detected endpoints are stored as ~/.newt/backends/*.toml; the main
~/.newt/config.toml only records the selected default_backend.

Tool output scrollback

Completed tool results use a bounded, tail-biased spill ([tui] spill_lines = 3 by default). On Unix, the default interactive build also
streams an active shell tool into that bounded frame when both stdin and stdout
are terminals and TERM is not dumb. Up/Down scroll retained lines; Space or
Enter toggles ⧉ expand and ▣ collapse. Expansion never exceeds safe terminal
capacity, and each tool still commits one canonical completed block to normal
terminal scrollback.

Use /spill <N> for a session-only row count, /spill reset to restore
configuration, or /spill 0 for unbounded completed output with live display
disabled. The default newt binary enables live-spill; a
--no-default-features build strips it. See the
TUI README and
decision record.

Operating modes and permission postures

Inside the TUI, /mode lists and selects a working style: chat, dev,
admin, plan, diagnose, auto, or full-auto. Bare /mode includes a
description of each. plan is workspace-read-only with access to Newt's plan
ledger, and diagnose is bounded read-only research. In auto, the model can
select a bounded style for a later action-shaped turn, but protected intake
still wins and only the human can select full-auto. Every mode still honors
all permission and safety boundaries. dev and full-auto both carry TDD,
worktree-safe Git, targeted-test, and full-preflight guidance; full-auto
changes persistence and interruption policy, not authority.

/posture is the separate authority control. It lists or applies a configured
skill/framing binding and its optional permission floor; /posture off clears
it. A configured floor can only narrow authority, while a posture without one
leaves authority unchanged. Existing posture bindings remain under
[modes.<name>] in TOML for compatibility. See the
mode/posture decision.

Run newt --help for every mode (worker, MCP server, doctor, config, …) —
the binary is the authority on its own surface, this file is not. Python
bindings live in newt-agent-py/ (pip install newt-agent-py, import path newt_agent).

Terminal-Bench scoreboard

newt is measured on Terminal-Bench
via newt solve (headless) + the Harbor adapter. The release gate is a
per-model monotonic ratchet — a model's score never goes down across
releases; we establish a starting number and keep beating it. The table below is
published from scripts/eval/bench-results.jsonl every release
(scripts/eval/bench_scoreboard.py render).

For the full DGX Spark capability survey — the model ladder, the hosted-model and
newt-vs-Codex comparisons, and the integrity log for how the numbers were kept
honest — see
docs/findings/dgx-spark-terminal-bench-survey.md.

Per-model Terminal-Bench champions, OCAP off vs on. Each lane is a monotonic ratchet (a score never goes down). 0.7.6 establishes the honesty-classified, digest-pinned confined (OCAP-on) baseline; OCAP-on within reach of OCAP-off (parity) is pursued forward via pre-granted permissions, not gated here. Auto-generated; do not edit by hand.

Design laws

The invariants. Each links to the decision record that argues it.

• Local-first inference. The default binary speaks only to local
  backends. Cloud providers are opt-in subprocess plugins speaking the
  JSON-RPC schema in plugins-protocol/ — the opt-in
  is enforced at the build level, not a runtime flag.
• Fail-closed OCAP. Authority is a caveat lattice, not a denylist; a
  fixed safety floor no mode or grant can unlock. See
  docs/decisions/agentic_object_capability_security.md
  and docs/decisions/ocap_confinement_model.md.
• Small crates, zero warnings, coverage-gated. just check mirrors CI;
  the pre-push hook runs it. One operator's leverage is this discipline.
• Patch, not prose. Delegated work is verified by the harness (real
  diffs, real test runs — newt-eval/), never by trusting a
  model's summary of itself.
• Skills are on-demand context. The prompt carries an index; bodies load
  when used. See docs/decisions/agent-skills.md
  and the bundled skills in .newt/bundled-skills/.
• Issues are ground truth. ROADMAP.md sequences
  delivery, but GitHub issue state is authoritative — the document is only
  the map.
• Causal ordering, not wall-clock. Timestamps are display claims; the
  conversation store orders on signed per-writer ticks + content hashes. See
  docs/decisions/conversation_context_architecture.md.

Field notes

The durable output of this experiment is what building it teaches about how
LLMs behave inside a harness:

• Summarization-induced hallucination
  — context compression that summarizes a session can make the model
  hallucinate APIs it had already read. A confident summary is worse than a
  labelled absence: absence routes the model to re-read; a summary suppresses
  recovery.
• Truncation honesty
  — silent context truncation yields silently wrong answers; every fix
  moves the failure, it doesn't always remove it.
• Coder-driving sweet spots
  — where small local models are and aren't reliable at agentic coding.
• Hermes learnings
  — take the algorithms, refuse the architecture.

Where things live

License

Apache-2.0. See LICENSE.