Newt-Agent

Free, friendly, local agentic coder. vi to Hermes-Agent's emacs.

A single Rust binary with a sharp, minimal tool set. It runs against your local hardware by default — no cloud bytes leave your machine unless you deliberately install a provider plugin. Opinionated, not extensible.

Why — the bridle, not just the harness

An agent harness helps the model do work; a bridle lets the operator steer — and prove, after the fact, exactly where the horse went. Newt is an experiment in making Object Capability (OCAP) security — long considered theoretically correct but practically unimplementable — pragmatic inside an agent loop, as a reusable concept (agent-bridle) intended to be pluggable into other harnesses, not just this one.

OCAP's algebraic construction means some questions are answered structurally, not by audit-log archaeology:

• Who acted on what, and when?
• Who granted the authority for this to do that?
• Did what they permitted actually happen — and did only what they permitted happen?

For anyone whose work lives on provenance, authority, integrity, and data sovereignty — lawyers, clinicians, data scientists — those answers have to be properties of the system, not promises in a policy document.

If it doesn't find its day in the sun, it was fun anyway.

Quick start

git clone https://github.com/Gilamonster-Foundation/newt-agent
cd newt-agent
just install          # release binaries → ~/bin/newt, ~/bin/newt-mcp-server
newt setup dgx1.home.lab  # probe configured ports and select detected inference
newt code             # TUI coder in the current directory

Bare setup hosts are probed anonymously across the configured discovery ports (including 8000 and 8080 by default). For an authenticated endpoint, use its exact HTTPS URL and store only a secret reference:

newt setup https://inference.example.net:8000 --token-env INFERENCE_TOKEN
newt setup https://inference.example.net:8080 --token-file ~/.config/newt/token

Detected endpoints are stored as ~/.newt/backends/*.toml; the main ~/.newt/config.toml only records the selected default_backend.

Run newt --help for every mode (worker, MCP server, doctor, config, …) — the binary is the authority on its own surface, this file is not. Python bindings live in newt-agent-py/ (pip install newt-agent-py, import path newt_agent).

Design laws

The invariants. Each links to the decision record that argues it.

• Local-first inference. The default binary speaks only to local backends. Cloud providers are opt-in subprocess plugins speaking the JSON-RPC schema in plugins-protocol/ — the opt-in is enforced at the build level, not a runtime flag.
• Fail-closed OCAP. Authority is a caveat lattice, not a denylist; a fixed safety floor no mode or grant can unlock. See docs/decisions/agentic_object_capability_security.md and docs/decisions/ocap_confinement_model.md.
• Small crates, zero warnings, coverage-gated. just check mirrors CI; the pre-push hook runs it. One operator's leverage is this discipline.
• Patch, not prose. Delegated work is verified by the harness (real diffs, real test runs — newt-eval/), never by trusting a model's summary of itself.
• Skills are on-demand context. The prompt carries an index; bodies load when used. See docs/decisions/agent-skills.md and the bundled skills in .newt/bundled-skills/.
• Issues are ground truth. ROADMAP.md sequences delivery, but GitHub issue state is authoritative — the document is only the map.
• Causal ordering, not wall-clock. Timestamps are display claims; the conversation store orders on signed per-writer ticks + content hashes. See docs/decisions/conversation_context_architecture.md.

Field notes

The durable output of this experiment is what building it teaches about how LLMs behave inside a harness:

• Summarization-induced hallucination — context compression that summarizes a session can make the model hallucinate APIs it had already read. A confident summary is worse than a labelled absence: absence routes the model to re-read; a summary suppresses recovery.
• Truncation honesty — silent context truncation yields silently wrong answers; every fix moves the failure, it doesn't always remove it.
• Coder-driving sweet spots — where small local models are and aren't reliable at agentic coding.
• Hermes learnings — take the algorithms, refuse the architecture.

Where things live

What	Where
Forward plan	ROADMAP.md (issue numbers are the live state)
Release history	CHANGELOG.md
Design docs & studies	docs/design/
Decision records	docs/decisions/
Evaluation harness	newt-eval/README.md
Local gate	just check (see justfile)

License

Apache-2.0. See LICENSE.