Mneme HQ + NVIDIA OpenShell

Status: experimental

A controlled experiment ran in October 2026. OpenCode, an open-source terminal coding agent, ran inside an OpenShell sandbox, and a Mneme plugin checked what OpenCode’s write tool was about to write to a file. The setup pinned OpenShell 0.1.5, OpenCode 1.19.3 and mneme-hq 0.10.0.

A draft specification in Mneme’s open-source repository records the results and lists the tests a maintained version would have to pass. With the Mneme plugin active, a write that would have added the forbidden library psycopg2 to the file was blocked. The experiment checked the whole file, not only the changed lines, while Mneme’s shipped hooks check only the lines a change adds. A compliant write was saved, and the resulting code ran. When OpenCode ran with all of its external plugins turned off, Mneme’s included, the same forbidden content was written.

The same document records what did not work. An import written in a dynamic form was allowed, because the rule matches literal text: a coverage gap. A change that named the library only in documentation was wrongly blocked. The wider benchmark of 14 tests was inconclusive, and the run that showed the block used a different model from the one that benchmark fixed. Records from some earlier runs are missing, and one planned test was not run. The document supports no claim that every write is checked or that the check cannot be bypassed.

A second draft adds a reference integration to the roadmap: an optional example setup that Mneme would maintain, separate from OpenShell itself. Both pull requests contain documentation only, and neither is merged. The experiment code is not public.

What OpenShell controls

On October 21, 2026, NVIDIA announced the OpenShell Reference Architecture. It pairs the open-source OpenShell runtime with NVIDIA hardware, including optional NVIDIA Sentry (not Sentry.io, the error-monitoring service). The runtime does not need that hardware. NVIDIA’s technical walkthrough describes four parts:

• Gateway: the control plane. It creates and removes sandboxes and holds their policies.
• Sandbox: isolates the agent and restricts which files and processes it can use.
• Supervisor: runs outside the sandbox, checks outbound requests against policy and mediates access to credentials.
• Policy prover: checks that a policy grants nothing beyond a boundary policy, an upper limit the organization writes.

A sandbox policy is a YAML file. In the v0.1.5 documentation, the default version on October 22, 2026, it sets readable and writable paths, the user that sandbox processes run as, which destinations each program may reach, and middleware for allowed traffic. The file and process settings are fixed when the sandbox starts; the network settings can change while it runs. Outbound traffic is denied unless a rule allows it.

The prover documentation says it uses a satisfiability modulo theories (SMT) solver, a tool that proves logical statements, and that a pass does not mean a policy is safe for a particular task or that a running sandbox enforces it.

What OpenShell does not decide

Say a sandbox lets the agent write under src/handlers/. Your team has decided that request handlers reach the database only through the approved storage adapter. The agent adds a handler that imports the database driver directly. Every OpenShell control passes: the path is writable and no network rule is involved. The violation is in the content of the file, and OpenShell’s policy model does not read file content.

Mneme does not enforce infrastructure policy and is not a sandbox.

Where the two could connect

OpenShell documents several extension points. Each sees a different slice of what an agent does, and none sees every file write.

What you can use today

You can run the CI check today. It runs on the pull request, outside any sandbox, so it does not depend on where the agent ran. In strict mode, the default, a violation exits with code 2 and fails the job; in warn mode it is reported without failing.

Mneme also ships hooks for some coding agents, such as Claude Code and Codex CLI. A hook is a point where Mneme inspects a file write before it happens. Whether these hooks work inside an OpenShell sandbox has not been tested.

What would have to be proven

Before the status could move past experimental, a fixed version of OpenShell and a fixed version of Mneme would have to show:

• a documented point where Mneme sees the exact content of a proposed change before it lands, for both new and existing files;
• compliant changes allowed and violating changes blocked, with each result recording which decision it came from;
• known gaps, such as shell commands, reported as not checked rather than passed;
• predictable behaviour when the check itself fails.

FAQ

Related reading

• NVIDIA OpenShell Reference Architecture: agent access policy is not architecture governance: the full analysis behind this page.
• Runtime governance: controlling what agents do while they run, and where that control stops.
• Policy as code: rules written as version-controlled logic that a machine can evaluate.
• How enforcement works: where Mneme checks changes today, per agent.