Shawn Hartsock

Where answers come from

Some pages can ask a language model questions. Set this up once; your choice is remembered in this browser for the whole site.

Model source
Use another source instead

Smallest-to-largest weight downloads. Qwen3.5 0.8B is our starting choice for page Q&A. GPU estimates are not total RAM: leave room for the browser, context and temporary buffers. Hardware changes speed and capacity; answers still need checking.

Session-only loading avoids saving model weights, uses extra RAM and downloads again after unloading. Turn it off to save downloads. Delete-data-on-exit or private browsing may impose a much smaller storage limit than the displayed estimate.

You sign in on OpenRouter; it gives this page a key for your account.

A free account does not make every model free. Choose a model with a listed :free variant; merely adding that suffix does not create one. Check free-model availability and pricing.

Chat

AI assistant, not Shawn Hartsock. It does not speak for him.

Inspect the page excerpt

Up to 4,800 characters, not the whole site. Recent conversation turns are retained within the model’s context limit.


    

    

      
Ask about this page, or just say hello.

      

    

    
    
Ready when you are.

    

      
      
      

        
        
        
        
      

    

    
Not saved or uploaded automatically. Closing keeps this conversation in this tab; changing pages starts a new one. Model replies can be wrong.

  



  

  

    

      

  

  
How Newt grants and enforces authority
Every tool call runs under a capability: what it may read, write, run, and reach. The operator sets the ceiling, the gate checks each call, and the kernel enforces it where the OS allows. Step through one write that is allowed and one network call that is not.
~5 min read
By Shawn Hartsock (commissioned) AI-drafted


Unreviewed draft. The author has not yet signed off on this text.


  

    



  

    

    
  

  

  

  

  

    
    
    
    
  

  
Example paths and hosts are illustrative. Types come from newt-core/src/caveats.rs and newt-core/src/agentic/permissions.rs. Keys: left/right arrows step, space plays or pauses.











Going further



The brush shell: how a shell command becomes individually checked spawns, and why.



What each stage maps to




  
    

      Stage
      What it does
      Where
      Status
    

  
  
    

      Ceiling
      Operator picks workspace access once; frozen for the session.
      newt-core/src/launch_authority.rs
      Implemented
    

    

      Check
      Each call is tested on fs_read, fs_write, exec and net.
      newt-core/src/caveats.rs
      Implemented
    

    

      Deny and ask
      Typed denial (DenialKind), then the gate asks the operator.
      newt-core/src/agentic/permissions.rs
      Implemented
    

    

      Widen once
      widen_caveats adds one target to one axis for one re-run.
      newt-core/src/agentic/permissions.rs
      Implemented
    

    

      Durable grants
      Signed approve.toml; four verdict files; unsigned approvals are dropped.
      newt-core/src/ocap_store.rs
      Implemented
    

    

      Kernel fence
      Confined child via agent-bridle; refuses if it cannot enforce.
      newt-core/src/confined_exec.rs
      Implemented, open deviations
    

    

      Delegation
      meet only narrows; Lean proofs cover the lattice, not the whole runtime.
      formal/CaveatLattice/
      Implemented
    

    

      Grant tree view
      A per-host, per-path grant tree is a pure view, not wired in.
      newt-core/src/grant_tree.rs
      Design only
    

  




What this does not show



    
  
  • On macOS, deny-all network is supported for audited launches by an unprivileged caller with pipe or null stdio. Hostname-scoped and deputy-relayed network grants are not enforceable there and are refused, so a per-host network fence is not shown.
    • 
  
  • Windows AppContainer does not enforce a restricted exec allowlist; it fails closed and refuses the shell tool.
    • 
  
  • --yolo (--disable-ocap) runs on the host shell with no confinement.
    • 
  
  • Signatures do not stop an older valid file being restored, and do not help if an attacker holds the operator key.
    • 
  
  • Open deviations are tracked in docs/security/ocap-deviations.md.
    • 




Source: newt-agent site/ocap.html at 67b24697. newt-agent is Apache-2.0: Gilamonster Foundation / newt-agent.


  


  


  
Revisions

  
    
    
  •  · claude-sonnet-5-5 · Moved from newt-agent site/ocap.html at 67b24697; prose converted to Markdown, animation text moved to copy.
    • 
  


↑ All parts in “Newt-Agent”