Mneme HQ + NVIDIA OpenShell

Status: planned

Two draft pull requests in Mneme’s open-source repository describe an optional reference setup. In it, OpenCode, an open-source terminal coding agent, runs inside an OpenShell sandbox, and Mneme checks what OpenCode’s write tool is about to write to a file. The first adds the setup to the roadmap. The second lists the tests a future implementation would have to pass. Both contain documentation only and neither is merged.

What OpenShell controls

On October 21, 2026, NVIDIA announced the OpenShell Reference Architecture. It pairs the open-source OpenShell runtime with NVIDIA hardware, including optional NVIDIA Sentry (not Sentry.io, the error-monitoring service). The runtime does not need that hardware. NVIDIA’s technical walkthrough describes four parts:

• Gateway: the control plane. It creates and removes sandboxes and holds their policies.
• Sandbox: isolates the agent and restricts which files and processes it can use.
• Supervisor: runs outside the sandbox, checks outbound requests against policy and mediates access to credentials.
• Policy prover: checks that a policy grants nothing beyond a boundary policy, an upper limit the organization writes.

A sandbox policy is a YAML file. In the v0.1.5 documentation, the default version on October 22, 2026, it sets readable and writable paths, the user that sandbox processes run as, which destinations each program may reach, and middleware for allowed traffic. The file and process settings are fixed when the sandbox starts; the network settings can change while it runs. Outbound traffic is denied unless a rule allows it.

The prover documentation says it uses a satisfiability modulo theories (SMT) solver, a tool that proves logical statements, and that a pass does not mean a policy is safe for a particular task or that a running sandbox enforces it.

What OpenShell does not decide

Say a sandbox lets the agent write under src/handlers/. Your team has decided that request handlers reach the database only through the approved storage adapter. The agent adds a handler that imports the database driver directly. Every OpenShell control passes: the path is writable and no network rule is involved. The violation is in the content of the file, and OpenShell’s policy model does not read file content.

Mneme does not enforce infrastructure policy and is not a sandbox.

Where the two could connect

OpenShell documents several extension points. Each sees a different slice of what an agent does, and none sees every file write.

What you can use today

You can run the CI check today. It runs on the pull request, outside any sandbox, so it does not depend on where the agent ran. In strict mode, the default, a violation exits with code 2 and fails the job; in warn mode it is reported without failing.

Mneme also ships hooks for some coding agents, such as Claude Code and Codex CLI. A hook is a point where Mneme inspects a file write before it happens. Whether these hooks work inside an OpenShell sandbox has not been tested.

What would have to be proven

Before the status could move past planned, a fixed version of OpenShell and a fixed version of Mneme would have to show:

• a documented point where Mneme sees the exact content of a proposed change before it lands, for both new and existing files;
• compliant changes allowed and violating changes blocked, with each result recording which decision it came from;
• known gaps, such as shell commands, reported as not checked rather than passed;
• predictable behaviour when the check itself fails.

FAQ

Related reading

• NVIDIA OpenShell Reference Architecture: agent access policy is not architecture governance: the full analysis behind this page.
• Runtime governance: controlling what agents do while they run, and where that control stops.
• Policy as code: rules written as version-controlled logic that a machine can evaluate.
• How enforcement works: where Mneme checks changes today, per agent.