Garnet lang

---

Why Garnet

Every ambitious team makes the same bargain: Rust for the hot path, Ruby for the orchestration, and a painful FFI between them — or one language and its weakness swallowed whole. Garnet refuses the bargain. Managed mode (def + ARC + exceptions) feels like Ruby. Safe mode (@safe fn + ownership + Result) feels like Rust. The mode bridge is specified, not yet wired; garnet check reports mode-boundary call sites. One grammar, two registers, no FFI between them.

And in 2026 there's a second bargain nobody should accept. AI agents now write the code; human review is the bottleneck, and signatures alone can't tell you what a change is allowed to do — the supply chain has already produced validly-signed malware. Garnet doesn't ask you to trust that the model understood. It makes acceptance a decision on capability evidence your own toolchain recomputes — not the model's claims: functions declare their authority budget, the checker verifies declared budgets transitively across the named call edges it can build from annotated functions, cycles included, and diff-caps answers "what new authority does this change declare?" in one screen.

Origin

Garnet began with a question: if a machine writes the code, what must the human accepting it be able to verify? DHH supplied the spark in DHH’s new way of writing code on The Pragmatic Engineer, published April 8, 2026. The idea moved from thought to machine around March-April 2026.

The loop closed publicly on August 26, 2026, with Lex Fridman Podcast #501 – DHH: Future of Programming, AI, Agentic Engineering, Vibe Coding & Linux. Those two conversations bracket Garnet's origin: make authority visible to the person accepting agent-written code, then make the traps match the claim (U-72).

Sixty seconds of Garnet

# Managed mode — Ruby feel, zero ceremony
@caps(fs)
def load_config(path) {
  try {
    std::json::parse(fs::read_file(path))
  } rescue e {   # any fs/parse failure → nil (the checker nudges: name the type)
    nil
  }
}

# Safe mode — Rust rigor where it earns its keep
@safe
fn checksum(borrow data: String) -> String {
  crypto::blake3(data)   # BLAKE3, hex-encoded
}

# Agent-native: memory and actors are language, not libraries
actor Researcher {
  memory episodic events  : EpisodeStore<Event>
  memory semantic  facts  : VectorIndex<Fact>
  protocol recall(q: String) -> Array<Fact>
}

# And the checker holds the line — declared budget vs. actual use:
@caps(net)
def sneaky() {
  fs::read_file("/etc/passwd")
}
# $ garnet check
# caps coverage: function `sneaky` does not declare `fs`
# but transitively calls `fs::read_file` which requires it

What no other language gives you

The pillars are individually precedented — Pony and Austral, Wasmtime and eBPF, Sigstore and SLSA each do a piece well. Garnet's bet is the integration, enforced at the language layer and aimed at agent-authored code:

• diff-caps — the capability-surface diff as an acceptance gate. When a dependency or an agent's PR changes what the code can do, you review the program-wide declared authority delta, not every line; a per-function gain inside that surface is shown for review, not failed.
• @caps(...) — functions declare their OS-authority budget; the CapCaps propagator checks declared budgets transitively at check time across named call chains, and the entry point must declare its budget. Reached instead through a function value, a closure, an actor handler, a top-level initializer, a string interpolation or method_missing, a call contributes no edge and the checker stays silent (finding U-91). A cycle in the call graph is followed: every function in it inherits the cycle's requirements (U-117, cured 2026-09). garnet run does not invoke the checker. Under the garnet CLI on main (the v0.8.2 binary gates 15 and has no mem capability gate) the 24 gated host-authority primitives (fs, net, proc, env, time, log-to-file, and the four memory::* tiers under mem) additionally trap at run time unless the program entry's own declared budget covers the capability, whichever call edge reached them. The other 60 of the 84 registry rows carry no runtime gate, and they are not one group: 58 require no capability at all (std::uuid::new_v5 among them), and net::tcp_listen / net::udp_bind are unbridged and do not execute either. See the capability enforcement scope table.
• An enforced kernel — @caps and @max_depth trap identically on both execution backends, with cross-OS trap parity recorded as evidence, not asserted.
• The manifest — garnet build --deterministic --sign emits a byte-identical manifest plus an Ed25519 signature; releases ship a CycloneDX SBOM and GPG-signed checksums.
• Agent-native memory — memory working|episodic|semantic|procedural as language keywords, so the runtime knows which kind it's allocating.
• Actors — in-process actors in the interpreter the CLI runs. garnet check rejects a protocol or handler that declares a @nonsendable payload type. Mailboxes hold 1024 messages unless Actor.spawn(capacity) sets another size, and a to a full mailbox fails. An actor promises nothing when it dies: no restart, no supervisor (ADR 0014). Ed25519-signed hot-reload with BLAKE3 schema fingerprints is in the separate Rust actor runtime (), a staging crate the binary does not include (ADR 0015).

GitHub's language bar counted this repository as 38.7% Python at the 2026-08-31 f6d3285 main snapshot because the trust and verification harness is Python; the product compiler and runtime are Rust.

Install

curl --proto '=https' --tlsv1.2 -sSf https://garnet-lang.org/install.sh | sh

Release-first, source-fallback. v0.8.2 ships .deb / .rpm packages and tarballs for Linux (x86_64, ARM64), macOS tarballs and a Windows zip, with a GPG-signed SHA256SUMS; verify per docs/release-signing.md. The GPG signature covers SHA256SUMS, not the binaries. The v0.8.2 binary predates main's 24-row runtime gate, the mem capability and seal/v2. The Linux assets need glibc 2.39+ (Ubuntu 24.04+, Debian 13+, Fedora 40+). On Windows, run irm https://garnet-lang.org/install.ps1 | iex in PowerShell. No matching package for your platform? The installer builds from source (Rust 1.95+; CI also tracks current stable — per CONTRIBUTING.md), or:

git clone https://github.com/Island-Dev-Crew/garnet
cd garnet/garnet-cli && cargo install --path . --locked

Quickstart

garnet new --template cli my_app    # also: web-api, agent-orchestrator
cd my_app
garnet test                         # starter tests pass green
garnet run src/main.garnet

# produce a reproducible, signed build:
garnet keygen my.key
garnet build --deterministic --sign my.key src/main.garnet
garnet verify src/main.garnet src/main.garnet.manifest.json --signature

Verified today / Still open

Garnet is a research-grade prototype (v0.8.2), not production-complete — and this README will never tell you otherwise.

Verified today	Still open
v0.8.2 release: Linux x86_64/ARM64 .deb, .rpm and tarballs, macOS tarballs, Windows zip, SBOM, GPG-signed SHA256SUMS	macOS .pkg notarization, Windows .msi (credential-gated)
@caps + @max_depth enforced on interpreter and VM; cross-OS trap parity recorded	OS-sandbox enforcement beyond Linux seccomp
Capability-bounded acceptance demo: agent code accepted and refused on evidence, sealed	Under construction: garnet build --evidence (W-SHIP; no shipping CLI flag); independent verification of the self-found red-team fix
84 capability- and stability-tagged stdlib primitives	Production VM performance (unbenchmarked, unclaimed)
LSP + VS Code extension (local VSIX), trivia-preserving CST, formatter baseline	Marketplace/OpenVSX publication; incremental parsing
Rust / Ruby / Python / Go migration assistant with lineage; output starts @sandbox + @caps() as reviewer notes	Package registry beyond stub

The full ledger lives in CURRENT_STATE.md; the readiness detail lives on the status page. The evidence scorecard for the research claims: 4 supported, 2 partial, 0 refuted, 1 pending-infra (seven papers). The measured results for experiments 2–6 cannot be reproduced from this repository: experiments 2, 4, 5 and 6 have no committed harness, and the experiment 3 harness does not include the measured run.

Learn more

Getting started · Mini-Spec v1.0 · Conformance matrix · Capability model · CRA Article 14 positioning · Script walkthroughs · Research papers · Blog

Community

Questions → FAQ, then Discussions · Bugs → Issues · Security → SECURITY.md (private advisories, please) · Contributing → CONTRIBUTING.md + Code of Conduct

License

Dual-licensed MIT OR Apache-2.0 — your choice. Either is fine for commercial use.

---