Matthew Grossman
2fd802eff2
* feat(skills): add release-captain skill for the weekly release cadence Add an internal skill with Monday pre-flight, Tuesday stable cut, and recovery steps for the RFC 0014 release train. All tag, workflow, merge, and Slack actions require explicit maintainer approval. Closes #4433 Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): document starting a release train after tag-push triggers Pre-release tag pushes now start Release Tag, so the skill no longer dispatches after pushing. Add seed-commit selection from Release Dev results, a commit-type summary for the patch/minor decision, and a recovery row for a tag push that starts no run. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): create lightweight release tags regardless of signing config With tag.gpgSign enabled, git tag creates an annotated tag and blocks in an editor. Disable signing for the release tag commands so they create the same lightweight tags as Auto-Tag. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): capture release captain lessons from starting 0.1.5 Note that Auto-Tag skips report success and show how to tell from the log, the UTC time of the schedule across DST, where pre-releases appear instead of the Releases page, why tags need a forced fetch, reading workflow triggers from origin/main, the rolling dev tag, and the common compatibility-review false positive for unpublished internal crates. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): add recovery for pre-releases failing on new RustSec advisories Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): recommend fixing forward to a green pre-release A failed pre-release doesn't end the train. Document merging the fix and tagging the next pre-release by hand once its Release Dev run passes, letting the failed run finish for its remaining signal. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): describe the triage channel and thread replies for pre-release failures Name #openshell-triage, where TriageBot posts each failed Release Tag attempt, and ask the captain to reply in the failure's thread so others know a fix is underway. List common transient failure types and rerun once when a failure looks unrelated to the commit. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): drop Codex Security from release captain run matching Codex Security no longer runs in release qualification (#4469), so the stable release can't rely on a pre-release's Codex result and runs can't be matched by its job name. Match dispatched runs by the qualification artifact name instead. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): describe where and how to post the release coordination thread Name the CNCF Slack channel, note that the release ships from main with no release branch or cherry-picks, and add an example post. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): make seeding the next train the outgoing captain's handoff Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): update release captain for the Release workflow and add usage guide Stable releases are now dispatched with release.yml, which selects the qualified pre-release and creates the tag, and pre-releases run in release-prerelease.yml. Replace the stable tag push steps and stale recovery rows, add a preview of the selected candidate, add a section on when to use each part of the skill, and trim redundant explanations. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): explain what the release cutoff guarantees The release ships the final pre-release's commit only if it passes, so the coordination post must not promise that every PR merged by the cutoff ships. Describe the Auto-Tag and hand-tagged cutoffs, and tag the final pre-release by hand on Tuesday for a later cutoff. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): add release notes review and v0.1.5 release day lessons Review the release notes preview from the Pre-release run before approval, and describe how Release regenerates them. Correct the thread when the shipped pre-release was cut before the posted cutoff, require maintainer agreement for accepted-risk breaks in a patch release, and add recovery rows for startup failures and release notes failures. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): make starting the next train the captain's final duty Move starting the next train after closing the loop, so it is the last Tuesday step. The captain's week ends when the next -pre.1 Pre-release run passes or its failure is handed off. Also move open milestone items when closing the loop. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): trim the release captain skill to its durable steps Remove repeated guidance, week-specific examples, fragile commands, and debugging detail an agent can derive from the workflows. Keep the approval guardrails, the weekly steps, and a short recovery table. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(ci): document Release Auto-Tag and pre-release notes previews Add Release Auto-Tag to the workflow table, including that each train's -pre.1 is pushed by hand, and note that every Pre-release run writes a release notes preview. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): add a template for the release announcement reply Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): watch pre-releases in the week before your turn Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): remove internal channel references from release captain Check pre-release runs directly instead of relying on an internal notification channel, and drop internal Slack channel IDs. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): fix pre-release failures in a new number via Auto-Tag A rerun repeats the same commit, so a failure that needs a fix ships in the next -pre.N. Cut it by dispatching Release Auto-Tag from the tip of main, and tag a specific commit by hand only when needed. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> --------- Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
Important
New in OpenShell 0.1.x: a stable release cadence, new isolation primitives, an expanded extension surface, and new APIs. Read the 0.1.0 upgrade guide.
OpenShell is the safe, private runtime for fleets of autonomous AI agents. Agents are most useful when they can read files, install packages, call APIs, and use credentials. OpenShell gives them that capability without giving them unrestricted access to your data, secrets, or network. You declare what each agent can touch in a policy, and OpenShell enforces it.
How It Works
OpenShell governs what agents can do in two ways: it instruments the kernel to enforce policy on every file access, system call, and network connection at runtime, and it uses formal verification to check what a policy change would allow before it is applied.
- Kernel-level enforcement. Each agent runs in an isolated sandbox. Kernel controls confine which files it can access and which system calls it can make, and every network connection passes through a policy check before it leaves the sandbox. Agents never see real credentials; OpenShell adds them only to requests bound for approved endpoints.
- Formally verified policy changes. Before a policy change is approved, OpenShell uses formal verification to flag risky new access it would grant, such as reaching a new host with credentials or calling a new API method, so those changes wait for human review.
See Architecture for how the gateway, supervisor, and sandbox fit together.
Quickstart
You need Linux, macOS on Apple Silicon, or Windows with WSL 2 (experimental), plus Docker, Podman, or host virtualization. See the Support Matrix for details.
curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh
openshell sandbox create --name demo
The installer sets up the CLI and a local gateway. The default sandbox image is minimal Ubuntu with no agent installed. To run a real agent, follow Run Your First Agent: it runs OpenCode against a free OpenRouter model and shows how to approve new access as the agent needs it.
Explore Further
- Sandboxes: images, runtimes, GPUs, and lifecycle.
- Policies: filesystem, network, and process rules, with the advisor and prover for reviewing changes.
- Providers: credentials that work only at approved endpoints, including inference.
- Gateways: the control plane for sandboxes, policy, and access.
- Kubernetes: deploy the gateway with Helm. Your CNI must enforce
NetworkPolicy. - Extensibility: middleware, interceptors, and compute drivers.
- Tutorials: step-by-step policy and agent walkthroughs.
- Prerelease and development builds: try an upcoming release or the latest commit on
main.
Agent Skills
Install the public OpenShell skills for your coding agent:
npx skills add NVIDIA/OpenShell
The skills teach your agent to drive the OpenShell CLI, write sandbox policies, and debug gateways and inference routing. They live in skills/ and work without an OpenShell source checkout.
SDKs
SDKs connect applications to an OpenShell gateway. They do not install the CLI. Use the same OpenShell release for the SDK and the gateway when possible.
| Language | Install | Docs |
|---|---|---|
| Python | uv add openshell |
README |
| TypeScript | npm install @nvidia/openshell-sdk (GitHub Packages) |
README |
| Go | go get github.com/NVIDIA/OpenShell/sdk/go@latest |
README |
| Rust | cargo add openshell-sdk --git https://github.com/NVIDIA/OpenShell --tag <release-tag> |
Installation and usage |
Community
- Questions and discussion: GitHub Discussions
- Bug reports and feature requests: GitHub Issues, using the issue templates
- Security vulnerabilities: follow SECURITY.md. Do not open a GitHub issue.
- Roadmap: OpenShell Roadmap and the RFC board
- Try it in the cloud: Brev Launchable
OpenShell is built agent-first: it is developed with the same agent-driven workflows it enables. See CONTRIBUTING.md for development setup and the contribution workflow, and AGENTS.md for repository coding conventions.
Telemetry
OpenShell collects anonymous telemetry, limited to operational categories and counts, to help improve the project. It does not collect sandbox names, hostnames, file paths, prompts, credentials, provider or model names, or user content. To disable it, set OPENSHELL_TELEMETRY_ENABLED=false on the gateway, or server.telemetryEnabled=false for Helm installs. You can also compile telemetry out entirely. See Telemetry for details and the community telemetry reports for published usage trends.
Notice and Disclaimer
This software automatically retrieves, accesses or interacts with external materials. Those retrieved materials are not distributed with this software and are governed solely by separate terms, conditions and licenses. You are solely responsible for finding, reviewing and complying with all applicable terms, conditions, and licenses, and for verifying the security, integrity and suitability of any retrieved materials for your specific use case. This software is provided "AS IS", without warranty of any kind. The author makes no representations or warranties regarding any retrieved materials, and assumes no liability for any losses, damages, liabilities or legal consequences from your use or inability to use this software or any retrieved materials. Use this software and the retrieved materials at your own risk.
License
This project is licensed under the Apache License 2.0.