Steplet

What inspired us

Asking an AI agent to work on someone else's code means letting two strangers loose on your laptop: the AI, which can be talked into things by text in the files it reads, and the code, which runs when its tests run. Most coding agents run with your own permissions, can see your home folder and saved keys, and finish by telling you how it went in their own words. We wanted a way to get the work done anyway, and to get a true account of it.

What it does

A .steplet file carries a coding task for an AI agent, such as "check out this repository at this commit, run its tests, tell me what fails". It says who sent it, the steps, what the agent may touch and what it must never do, and it can be signed. Double-click it on Windows and Steplet shows the whole plan, who signed it, and a risk rating worked out by fixed rules (not by an AI, so text in the file can't argue its way to a better rating).

Then Steplet's own agent, NVIDIA Nemotron 3 Super on Nebius Token Factory, does the work:

Nemotron proposes each move as a tool call.
Steplet's checker decides each move against what the file declared, and refuses or asks you about anything else.
Allowed moves run one at a time inside a fenced Linux that Steplet builds and owns, with no access to your files or Windows, and only the web sites the file declares.
A refused move goes back to the model, which can try another way inside the rules.
The live view shows every move, every verdict, the exit code, the money spent and the steps used. The report puts the exit codes from Steplet's own record next to what the model claims, so "all tests pass" can't hide a failure.

Before you run a file, "What will this file do?" asks Nemotron 3 Super to describe in plain words what running it would do and what a careful person would look at. It is shown as AI advice and cannot change the rating.

How we built it

A Tauri 2 app: Rust core, Svelte 5 screens.
Steplet installs its own WSL 2 Linux (Ubuntu 26.04) and runs each allowed move there as an account with no powers, inside a fence (srt, Anthropic's sandbox-runtime, which uses bubblewrap). Even file reads and writes run inside the fence, so a mistake by the checker is still contained.
The agent loop runs on Windows and calls Token Factory's chat-completions API through Windows' own web library (WinHTTP). The API follows the OpenAI shape, so no SDK was needed: the Token Factory part is 109 lines, tested against a stand-in server.
Seven tools (run_command, read_file, write_file, edit_file, list_files, find_files, search_text), each mapped onto a tool the checker already understood, so one set of rules judges every runner.
Spending is capped before each call, not after: Steplet works out the most the next call could cost (everything sent plus the longest answer allowed) and stops before sending if that could pass the run's $0.25 cap. A run also stops at 40 steps or 30 minutes.
The Nebius key lives in Windows Credential Manager and goes only into the Authorization header, never onto the screen or into a log or report.

Steplet's first commit was 8 Oct 2026. Before Nebius it ran Claude Code inside the same fence; for this hackathon we built Steplet's own agent around Nemotron.

What we tested

Only what a passing test or a recorded run shows:

15 tests of the Token Factory client, 9 of the moves in Steplet's real Linux, and 14 of the agent loop with a stand-in model. We broke the code on purpose three times, and these tests caught each break.
10 attack tests of Steplet's agent, each with a control that shows the test can fail. Together with the 39 cases for Claude Code: 49 of 49 blocked, nothing left behind (the 10 agent cases used a scripted model, not real Nemotron).
Real runs with Nemotron 3 Super on 30 Oct 2026, started by a test program that drives the app's own session:
- The sample file: Nemotron asked for the one command the file allows, Steplet allowed it, exit code 0, and Python printed "Ran 5 tests" and "OK". Nemotron said "5 tests ran and all passed." 2 model turns, 40 seconds, about $0.0012.
- A copy that also asks for a command it does not allow: Steplet asked, the answer was No, the move was refused and Nemotron was told. It finished and said it could not report what the refused command would have shown. 3 model turns, 19 seconds, about $0.0023.
- "What will this file do?" on the sample file: 3.6 seconds, $0.00057.
- The Nebius key was found 0 times in the runs' logs. The full output is in the repository (docs/real-runs).

Challenges we faced

The key came on the last day. Applying the hackathon's promo code failed at first with an error we could not act on, so our first real Nemotron call was on 30 Oct, the deadline day. Everything before that was built and tested against a stand-in model and server, and the first real runs needed no change to Steplet's code.
Nemotron thinks before it answers, and thinking counts. Nemotron 3 Nano used 1,721 tokens for a one-line answer, so Steplet's cap counts the longest answer allowed, thinking included, before each call.
A Stop at the wrong moment broke Steplet's Linux. A Stop pressed in the first milliseconds of a run could leave Steplet's Linux unable to look up web addresses until it restarted. Testing the agent found it, because the agent meets that moment at every move. Steplet now puts back its own copy of the lookup file at every start.
The fence keeps some folders read-only, so the temporary folder each move needs had to live inside the run's own folder.
"Change nothing" is harder than it sounds. Python wrote its own cache files while running the tests, although the file says "Do not change any file". Steplet's report lists them instead of hiding them.

What we learned

A standard API shape makes the model swappable for testing. We built and tested everything against a stand-in model and server, and the real Nemotron runs needed no code change.
Thinking costs money. A cap counted in tokens has to count the longest possible answer, thinking included, before each call, not after.
The model's own report is not evidence. Keeping the exit codes from the fence's own record, next to the model's words, is what makes the report worth trusting.
A test only counts if it can fail. Every attack test has a control, and we broke the code on purpose to see the tests catch it.
Nemotron 3 Super follows declared rules. In our runs it asked for exactly what the file allowed and did not try to get round a refusal (a small sample: two whole runs).

Accomplishments we're proud of

The first real Nemotron runs worked with no code change, on the deadline day.
49 of 49 attack cases blocked, nothing left behind.
All our real Nemotron calls together cost about one cent ($0.0113).

What's next

Run more use cases and the attack cases with real Nemotron, not only a scripted model.
Compare Steplet's own cost count with what Nebius actually bills.
Try Steplet on more Windows laptops, and sign the installer so Windows stops warning about it.