NVIDIA OpenShell Crosswalk

1. What NVIDIA Built

NVIDIA's Open Agent Safety Platform (September 2026) brings runtime containment to AI agents at scale. 120+ organizations adopted it in the first week, including PAN Networks, Microsoft, Oracle, CrowdStrike, Salesforce, and JPMorganChase.

The platform has two components: OpenShell, an Apache 2.0 CPU-based agent runtime using Linux Landlock LSM and seccomp BPF for containment, and Sentry, a hardware-backed watchdog on BlueField-4 DPUs. OpenShell emits events in OCSF (Open Cybersecurity Schema Framework) format, runs on any Linux with Landlock support (kernel 5.13+), and supports AMD, Intel, and Arm architectures.

Enforcement and evidence are separate concerns. OpenShell handles the first. This guide covers how to produce auditable compliance evidence from the containment events OpenShell generates.

2. The Evidence Layer

OpenShell focuses on enforcement. Compliance evidence -- proving to an auditor that containment was in effect during a specific time window -- is a separate architectural concern. Two open GitHub issues on the NVIDIA/OpenShell repository reflect community interest in this area:

The SWT3 protocol provides this evidence layer today. AI-SHELL.1 records containment attestation as an immutable SWT3 Witness Anchor, producing the kind of cryptographic compliance evidence these issues describe.

3. The Three-Layer Stack

Each layer operates independently. Enforcement continues if the evidence layer is unavailable. Evidence records remain verifiable without enforcement running. Assessment can occur offline from either layer.

4. NVIDIA's 5 Governance Principles Mapped to SWT3

5. AI-SHELL.1: Runtime Containment Attestation

Framework Crosswalks

6. Code Examples

Python: Witness OpenShell Containment

from swt3_ai import Witness

witness = Witness(
    endpoint="https://sovereign.tenova.io",
    api_key="axm_live_...",
    tenant_id="YOUR_TENANT_ID",
    clearing_level=1,
)

# After your OCSF event pipeline computes summary stats:
payload = witness.witness_runtime_containment(
    runtime_type="openshell",
    policy_hash="e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    violation_count=0,
    sandbox_id="sandbox-agent-7b2f",
    observation_window_ms=300000,   # 5-minute window
    ocsf_event_count=1247,          # events processed
    quarantine_events=0,            # kill/quarantine actions
)

print(f"Anchor: {payload.anchor_fingerprint}")
# PASS -- policy enforced, zero violations

# Flush to persist
witness.flush()

TypeScript: Witness gVisor Containment

import { Witness } from "@tenova/swt3-ai";

const witness = new Witness({
  endpoint: "https://sovereign.tenova.io",
  apiKey: "axm_live_...",
  tenantId: "YOUR_TENANT_ID",
  clearingLevel: 1,
});

// Works with any OCSF-compatible runtime -- not just OpenShell
const payload = witness.witnessRuntimeContainment({
  runtimeType: "gvisor",
  policyHash: "a1b2c3d4e5f6...",
  violationCount: 0,
  sandboxId: "gvisor-pod-abc123",
  observationWindowMs: 60000,
  ocsfEventCount: 342,
  quarantineEvents: 0,
});

await witness.flush();

MCP Server: Runtime Containment Tool

// The @tenova/swt3-mcp server exposes witness_runtime_containment as a tool.
// Any MCP-compatible agent can call it directly:

{
  "tool": "witness_runtime_containment",
  "arguments": {
    "runtime_type": "openshell",
    "policy_hash": "e3b0c44298fc...",
    "violation_count": 0,
    "observation_window_ms": 300000,
    "ocsf_event_count": 1247
  }
}

Python: Real-Time OCSF Event Stream (Adapter Pattern)

from swt3_ai.adapters.openshell import OpenShellWitness

# The adapter processes individual OCSF events in real time.
# Each event is mapped to the appropriate SWT3 procedure automatically.
osw = OpenShellWitness(witness=witness)

# Feed OCSF events as they arrive from the sandbox:
for event in ocsf_event_stream:
    procedure = osw.process_event(event)
    # Returns "AI-INF.1", "AI-SEC.1", "AI-TOOL.1", etc.
    # Unknown event types are silently skipped.

print(osw.stats)  # {"processed": 1247, "skipped": 3}

7. Procedure Coverage Matrix

SWT3 procedures that map to OpenShell capabilities:

8. For Auditors

Verification Checklist

• Policy hash continuity: Compare policy_hash across sequential AI-SHELL.1 anchors. Consistent hashes prove the same containment policy was enforced throughout the assessment period.
• Observation window coverage: Sum observation_window_ms values across anchors. Gaps between windows indicate periods without containment attestation.
• OCSF event correlation: Request the OCSF event log from the operator. The ocsf_event_count in the anchor should match the event log length for the corresponding time window.
• Violation cross-reference: Any AI-SHELL.1 anchor with factor_b = 0 (FAIL) should have a corresponding AI-VIO.1 anchor documenting the specific violation.
• Runtime type consistency: The runtime_type in AI-SHELL.1 should match the runtime_type_code in AI-ENV.1 anchors from the same environment.

What the Auditor Sees

Each witness_runtime_containment() call produces an anchor like this:

The anchor is immutable, independently verifiable, and maps to EU AI Act Art. 12 and NIST AI RMF GOVERN 1.2. The policy_hash lets auditors confirm the same containment policy was in effect across every attestation window without seeing the policy itself.

Sample Verification Query

# Verify all containment anchors for a tenant over 30 days
curl -s "https://sovereign.tenova.io/api/v1/ai-witness/export" \
  -H "Authorization: Bearer axm_live_..." | \
  jq '.anchors[] | select(.procedure_id == "AI-SHELL.1")'

9. Clearing Level Behavior

At L3 (Classified), only the three factors survive: runtime type code, policy enforcement status, and violation count. This is sufficient for verdict computation while protecting all operational details.

10. Beyond OpenShell

AI-SHELL.1 is runtime-agnostic. The same procedure works with any sandbox that produces containment summary statistics:

11. Integration Patterns by Use Case

The evidence layer applies regardless of which enforcement stack you run. Common patterns:

12. Get Started