ashuuuu21

Les graphiques faisaient aujourd’hui ce truc coincé au point mort, la même poignée de configurations se faisaient reproposer avec de nouvelles légendes. J’ai fermé les onglets et je me suis retrouvé dans la documentation de Newton — la section sur les garde-fous de l’agent, en particulier, parce que je voulais comprendre ce que signifie « autonome » ici, au-delà du mot sur la page.
Alors j’ai retracé ce qui se passe réellement quand un agent dépense de l’argent via Newton. Le vault est alimenté. Le curator fixe les limites. L’agent opère à l’intérieur de celles-ci. La transaction est vérifiée par rapport à la politique, puis elle est acceptée ou non. Je me demandais sans cesse : à quel moment, dans cette chaîne, quelque chose qui ressemble vraiment à une décision se produit ?

En fouillant dans le texte du site de Newton pour quelque chose de complètement sans rapport, je suis tombé sur une seule phrase que j’avais lue deux fois sans vraiment la décoder : « The Newton AVS evaluates each transaction before it settles, with no UX changes. »
Ma première réaction a été : d’accord, c’est une affirmation très forte à faire aussi clairement sur une page d’accueil. La plupart des infrastructures qui ajoutent une couche de vérification ajoutent aussi une friction quelque part — une signature supplémentaire, un écran de confirmation, un délai perceptible. Prétendre n’avoir aucun impact sur l’UX tout en insérant une couche d’autorisation entière entre l’intention et le règlement relève soit d’une prouesse d’ingénierie vraiment impressionnante, soit d’une allégation qui fait davantage de travail marketing que de travail technique. J’ai donc vérifié concrètement ce qui se passe mécaniquement entre le moment où l’utilisateur appuie sur « confirmer » et celui où la transaction est réglée, pour voir ce qu’il en était réellement.

Was meant to be reviewing something completely unrelated last night and drifted back into Newton’s whitepaper instead — the identity section specifically, which has pulled me back in three separate times this week now.
Newton’s identity verification runs through a TEE — a trusted execution environment — with the pitch being that sensitive credential data gets checked against policy without ever being exposed, not even to the system processing it.
Read past that the first time, standard-sounding language. Came back to it because something didn’t sit right, and I couldn’t place what right away.
Here’s what I landed on. A TEE isn’t a protocol Newton designed — it’s a hardware feature, a secure enclave built into a physical chip by a specific manufacturer, running firmware nobody outside that company can fully audit. When identity verification happens “inside a TEE,” what’s actually true is that this one step of the pipeline runs on hardware built and controlled by a company that isn’t Newton, isn’t the operator network, and isn’t decentralized in any sense the rest of the whitepaper uses that word.
Sat with that longer than expected, argued myself in a circle, ended up somewhere in between.
The case for not worrying about it: TEEs are completely normal, widely deployed infrastructure — cloud computing, mobile devices, plenty of non-crypto privacy systems run on them. Newton isn’t doing anything unusual by using one specifically for identity checks, where you genuinely need to evaluate sensitive data against sensitive rules without exposing either side. And it’s scoped: this is the identity-verification step, not the whole policy-evaluation pipeline, which still runs through the operator network’s own decryption and evaluation process. The hardware dependency lives in one corner, not the whole system.
The case for still being bothered by it: Newton’s entire security pitch rests on one argument — decentralization removes any single point of trust, no one entity controls outcomes, operators are bonded and slashable so misbehavior is both detectable and punishable. That argument only holds if the actual trust boundary is the operator network. But for the identity step specifically, the real trust boundary is the chip manufacturer, and manufacturer-level trust doesn’t get slashed. There’s no economic stake at risk if the enclave itself turns out flawed. Silicon doesn’t post collateral.
And this isn’t a hypothetical risk category — secure enclaves have a real, documented history of side-channel exploits, discovered and patched after the fact rather than prevented ahead of time. No claim here that Newton’s own setup has this exact flaw — that’s not something I can verify. Just flagging that this class of failure is documented and has happened before, and it’s a completely different failure mode than “an operator lied and got caught,” which is what the rest of the security model is actually built to catch.
So here’s where I keep landing: the headline pitch is no single point of trust, and there’s at least one step — identity verification — where the real trust anchor is a hardware vendor’s manufacturing process, sitting entirely outside the economic security model the rest of the document spends so much space building. Not nothing. Also not necessarily fatal, since it’s scoped to one step rather than everything.
Still working through whether “no single point of trust, except this one hardware dependency in the identity layer” is a reasonable caveat every privacy-preserving system carries right now, or a bigger crack in the neutrality claim than the framing suggests. Leaning toward the former. Want to understand which specific TEE implementation is actually running before I settle on that.
@NewtonProtocol $NEWT #Newt $LAB

Was rereading the ZK section of Newton's whitepaper way later than I should've been up, and one sentence stopped me cold enough that I read it something like four times in a row.
The claim: any policy written in Rego is automatically ZK-provable. No hand-written circuits, no constraint system to learn, no trusted setup ceremony.
First take: if that holds up, it's a legitimately clever piece of design. Most ZK tooling forces you to translate your logic into circuit constraints by hand — a specialized skill nobody on a compliance team should have to pick up. Skipping that step for real would be a genuine unlock, not just marketing copy.
So I went looking for what's actually underneath "automatically." Newton compiles the full Rego evaluation engine — an entire interpreter — down to RISC-V, and runs it inside a general-purpose zkVM, the same category of tooling as SP1 or RISC Zero. What comes out the other side is a proof that this specific policy, fed this specific input, produced exactly this result. That piece checks out — proving arbitrary RISC-V execution inside a general-purpose zkVM is real, shipped technology, not a research paper promise.
The part I couldn't let go of, though: asking a zkVM to prove an entire interpreter's execution is a categorically heavier lift than proving one narrowly scoped circuit built for a single check. A purpose-built circuit represents only the specific computation at hand. A full interpreter has to carry the weight of the whole language, every time it runs.
Nowhere in that section does the whitepaper attach an actual number to proving time — no benchmark, no rough range, nothing. Elsewhere in the same document, other sections are willing to cite concrete performance figures for their approach. The section making the "automatically provable" claim isn't held to that same standard.
That's the actual issue. Being provable in principle and being provable fast enough to matter are two separate questions, and only one of them gets an answer here. Milliseconds keeps this useful for real-time authorization. Minutes makes it close to irrelevant for that exact use case, while remaining completely true on paper.
Tried to talk myself out of the concern for a second — maybe proofs only get generated when someone actually disputes an attestation, not on every transaction, and the signed attestation alone covers the fast path the rest of the time. If that's really how it works, the missing number stops mattering nearly as much.
Problem is, that resolution isn't actually stated anywhere near the claim itself. I'm piecing it together from how disputes get described in a completely different part of the document — the provability sentence doesn't come with that context attached.
Genuinely unsure whether I'm overreading a silence or whether this is a real distance between what's technically accurate and what's usable in production. One actual proving-time number from a real Rego-interpreter-in-zkVM setup would settle the whole question, in either direction.
@NewtonProtocol $NEWT #Newt $LAB