The download. The source.
The horizon.
Garnet puts authority in the source and evidence beside the change. Choose the build that matches the behavior you want to inspect.
Snapshot: 5 October 2026 · published v0.8.2 · current source aba11b329e32.
| Surface | Published v0.8.2 | Current source |
|---|---|---|
| Host capability gates | 15 host primitives; no mem kind | 24 entry-gated host primitives, including mem |
| Seal format | seal/v1 | seal/v2 binds source and declared capabilities; CLI content verification |
| Installer authentication | SHA-256 integrity comparison; GPG authentication is separate | Same as v0.8.2 today; signature-checking installers and older-distro Linux packages are proposed in draft #607 (unreleased) |
| Browser workbench | The site serves a committed WASM package with its own build provenance. Check, diff and supported run are live. The CLI recording names its source separately. | |
What the demonstration establishes.
The guided filesystem example runs the browser checker, compares the declared capability change, and gives the visitor a local review choice. The seven-command CLI record then demonstrates reproducible seal bytes, a matching source, and refusal after the source changes.
Capability checking and review
The checker propagates named call edges. Closure, function-value, actor-handler, string-interpolation, top-level-initializer and method_missing edges are outside that propagation; unannotated function bodies are not checked. Match-guard calls, and same-named methods on impl types whose paths share a last segment, are not yet traced. diff-caps compares declared surfaces. Treat it as a review aid. A passing check is not a complete acceptance proof. The runtime entry budget separately traps the host primitives covered by the selected build.
Source binding and signatures
The recorded seal is unsigned. CLI seal/v2 verification recomputes source and declared-capability binding; it does not verify a signature. Deterministic signed build manifests use a separate signing path. Neither a digest, self-declared model identity nor a signature establishes factual truth, program correctness or human approval.
Two registers and the mode bridge
The grammar accepts managed def and @safe fn syntax. The full ARC/ownership and exception/Result crossing bridge is specified and deferred. Shared syntax does not imply that the planned bridge is wired. The spec describes the intended language; current implementation scope belongs beside it.
Memory and actors
Four memory declaration kinds and reference stores exist. Kind-aware allocator adapters, cycle-aware root lifecycle statistics and a narrow episodic text persistence/cache path are implemented. Custom production backends, full ARC finalizers and persistence across all memory kinds remain on the roadmap. The actor demonstration illustrates the separate Rust runtime’s queue and behavior replacement; that runtime is not linked into the CLI, and signed hot reload is not wired.
Converters, packages and performance
The deterministic Rust, Ruby, Python and Go converters cover stylized subsets and preserve unresolved work as migration TODOs. They are migration aids, not lossless language bridges or complete supersets. The registry remains a local filesystem stub; there is no public package registry yet. The interpreter and VM work have no production performance number here. A published number needs a fixed workload, pinned implementations and its executable harness.
One small, useful path.
Write a def. See an undeclared action rejected. Declare its authority. Review the change. See the source binding recomputed. This is the first encounter the site makes tangible while the language’s larger reconciliation continues.
Research-grade language and toolchain. The interface and its demonstrations keep that scope explicit.