Newt-Agent

Experimental agentic coder.

Written in Rust. The default build ships no cloud provider — remote models are opt-in subprocess plugins. The scoreboard below is the claim: measured on Terminal-Bench, with security enabled and disabled.

Terminal-Bench

Measured on Terminal-Bench via newt solve (headless) plus the Harbor adapter. The release gate is a per-model monotonic ratchet — a model's score never goes down across releases; establish a starting number, then keep beating it. Both lanes are published, because confined (OCAP on) versus unconfined (OCAP off) is the claim worth making: security you can afford to leave switched on.

Per-model Terminal-Bench champions, OCAP off vs on. Each lane is a monotonic ratchet (a score never goes down). 0.7.6 establishes the honesty-classified, digest-pinned confined (OCAP-on) baseline; OCAP-on within reach of OCAP-off (parity) is pursued forward via pre-granted permissions, not gated here. Auto-generated; do not edit by hand.

Model	OCAP off	OCAP on
deepseek-v4-pro deepseek · tb-30 · ctx 65536 · v0.8.0 · 2026-08-06	56.7% (17/30)	50.0% (15/30)
nemotron-3-super nemotron · tb-30 · ctx 65536 · v0.8.0 · 2026-08-05	36.7% (11/30)	26.7% (8/30)
ornith-1.0-35b-q8 ornith · tb-30 · ctx 65536 · v0.7.6 · 2026-07-29	pending	36.7% (11/30)
qwen3.6_35b qwen · tb-30 · ctx 65536 · v0.7.6 · 2026-07-29	20.0% (6/30)	26.7% (8/30)
o4-mini openai · tb-30 · ctx 65536 · v0.8.0 · 2026-08-05	13.3% (4/30)	16.7% (5/30)
qwen3-coder_30b qwen · tb-30 · ctx 65536 · v0.7.6 · 2026-07-29	10.0% (3/30)	13.3% (4/30)
gpt-oss_120b openai · tb-30 · ctx 65536 · v0.8.0 · 2026-08-05	10.0% (3/30)	10.0% (3/30)
kimi-linear_48b kimi · tb-30 · ctx 65536 · v0.7.6 · 2026-07-31	pending	10.0% (3/30)
nemotron-3-nano_30b nemotron · tb-30 · ctx 65536 · v0.7.5 · 2026-07-29	6.7% (2/30)	pending
glm-4.7-flash glm · tb-30 · ctx 65536 · v0.7.6 · 2026-07-31	pending	3.3% (1/30)
gpt-4.1-mini openai · tb-30 · ctx 65536 · v0.8.0 · 2026-08-05	0.0% (0/30)	3.3% (1/30)

Full results, provenance, and methodology — including per-run records, rejected runs, queued work, and the scoring rules — live in gilamonster-bench, an independent instrument with no dependency on Newt. If the ruler shipped with the thing it measures, one commit could move both at once. The scoreboard above is the concise release view; the benchmark repository is the evidence.

Use Newt

git clone https://github.com/Gilamonster-Foundation/newt-agent
cd newt-agent
just install   # → ~/bin/newt, ~/bin/newt-mcp-server
newt           # first run opens the setup wizard, then the TUI coder

A fresh box needs no setup step: the first launch at a terminal opens the wizard — local Ollama, another machine (auto-probed for Ollama / llama.cpp / vLLM, adopting whatever model is already loaded), OpenAI, Anthropic, or Ollama Cloud. Already know the endpoint? newt setup inference.example.net probes it directly, and newt code names the default TUI-coder command explicitly.

Prefer a browser? The HTMX web cockpit is a separately built binary (newt-web/, deliberately outside the workspace graph):

just install-web   # → ~/bin/newt-web
newt web           # launches it (127.0.0.1:8880 by default)

Hosted providers (OpenAI, Anthropic, OpenRouter, NVIDIA NIM, …) live in an extensible preset roster that also reads Hermes Agent configs — copy a ~/.hermes/config.yaml into ~/.newt/providers/ or run newt providers import-hermes (provider presets). Authenticated endpoints, discovery ports, and where (encrypted) credentials and backends are stored: the setup guide. Inside the TUI, /mode picks a working style and /posture is the separate authority control — a posture floor can only ever narrow authority (decision record). Tool output renders through a bounded, tail-biased spill that /spill tunes (newt-tui). Run newt --help for every mode (worker, MCP server, doctor, config, …) — the binary is the authority on its own surface, this file is not. Python bindings live in newt-agent-py/.

Why Newt

An agent harness helps the model do work; a bridle lets the operator steer — and prove, after the fact, exactly where the horse went. Newt is an experiment in making Object Capability (OCAP) security — long considered theoretically correct but practically unimplementable — pragmatic inside an agent loop, as a reusable concept (agent-bridle) intended to be pluggable into other harnesses, not just this one.

Because OCAP is an algebraic construction, some questions are answered structurally rather than by audit-log archaeology: who acted on what and when, who granted the authority for it, and whether only what was permitted actually happened. For anyone whose work lives on provenance, authority, integrity, and data sovereignty — lawyers, clinicians, data scientists — those answers have to be properties of the system, not promises in a policy document. The long form is docs/vision.md.

If it doesn't find its day in the sun, it was fun anyway.

Design laws

The invariants. Each links to the decision record that argues it.

• Local-first inference. The default binary speaks only to local backends. Cloud providers are opt-in subprocess plugins speaking the JSON-RPC schema in plugins-protocol/ — the opt-in is enforced at the build level, not a runtime flag.
• Fail-closed OCAP. Authority is a caveat lattice, not a denylist; a fixed safety floor no mode or grant can unlock. See docs/decisions/agentic_object_capability_security.md and docs/decisions/ocap_confinement_model.md.
• Small crates, zero warnings, coverage-gated. just check mirrors CI; the pre-push hook runs it. One operator's leverage is this discipline.
• Patch, not prose. Delegated work is verified by the harness (real diffs, real test runs — newt-eval/), never by trusting a model's summary of itself. The bench ratchet above is the same law at release scale: verify by artifact, never by self-report.
• Skills are on-demand context. The prompt carries an index; bodies load when used. See docs/decisions/agent-skills.md and the bundled skills in .newt/bundled-skills/.
• Issues are ground truth. ROADMAP.md sequences delivery, but GitHub issue state is authoritative — the document is only the map.
• Causal ordering, not wall-clock. Timestamps are display claims; the conversation store orders on signed per-writer ticks + content hashes. See docs/decisions/conversation_context_architecture.md.

Field notes and studies

The durable output of this experiment is what building it teaches about how LLMs behave inside a harness.

• Summarization-induced hallucination — a confident summary is worse than a labelled absence: absence routes the model to re-read, a summary suppresses recovery.
• Truncation honesty — silent context truncation yields silently wrong answers; every fix moves the failure, it doesn't always remove it.
• Coder-driving sweet spots — where small local models are and aren't reliable at agentic coding.
• Hermes learnings — take the algorithms, refuse the architecture.

Where things live

What	Where
Setup beyond the quick start	docs/guide/setup.md
Benchmark results & methodology	Terminal-Bench scoreboard and gilamonster-bench records
Forward plan	ROADMAP.md (issue numbers are the live state)
Release history	CHANGELOG.md
Design docs & studies	docs/design/
Decision records	docs/decisions/
Field notes	docs/notes/
Terminal UI	newt-tui/README.md
Evaluation harness	newt-eval/README.md
Local gate	just check (see justfile)

License

Apache-2.0. See LICENSE.