The two layers
OpenShell fences the line. Sheaf works the signals.
NVIDIA OpenShell is an open-source runtime that puts each AI agent in its own sandbox and enforces, at the kernel, which files, network endpoints, tools and credentials the agent may reach. Its policies are compiled to formal logic and checked by a prover. What it does not see is what a tool call says: by NVIDIA's own description it works below the level where tool names and arguments live.
Sheaf sits inside the one connection OpenShell allows, as a proxy between the agent and its tools. It reads every tool call, forwards the harmless ones, and for any action that matters it measures whether the reasoning behind it holds together across the facts, the rules and the other agents. A contradiction holds the action for a person. Nothing about the agent changes, and OpenShell makes Sheaf the only door, so the agent cannot go around it. The two layers side by side.
The design
The stop is simple and instant. The checking happens beside it.
This is the design choice that makes Sheaf work in daily use. The part that stops an action must be fast and simple, so it is. The part that checks whether the agents agree needs time to think, so it runs beside the agents and never slows them down. There are five parts. Each does one job.
01 Before the run
The fact list: the facts and the actions that need approval
The fact list names the facts your agents are allowed to work with, and the actions that need a person's approval before they happen. You write it once, before the agents run. Everything Sheaf measures is measured against it.
The hard part of supervising agents is knowing when two agents are talking about the same fact. The fact list settles that. It names the facts up front, and the ways the agents may compare them, such as one value being higher than another. The Witnesses then only look for claims about those named facts. Anything outside the fact list is left out on purpose. That is what makes the result exact.
ledger field)
ledger:facts:
- income # numeric
- ltv # numeric
- rate # numeric
- risk_tier # ordinal: A > B > C > D
relations: [ordering, equality, implication]
consent_required: # the Gate blocks these pending a human
- submit_application_to_lender
- send_binding_quote
- pull_hard_credit_check
02 During the run · the stop
The Gate and the Warden: the signal
Every action an agent takes passes through the Gate before it happens. The Gate is simple on purpose. It checks the action against the approval list you wrote before the run. If the action is on the list, it does not happen. No AI model is involved, so nothing can be slow, tricked, or talked out of it. It is a plain lookup.
When the Gate stops an action, the Warden pauses the work and puts the decision in front of a person. The person can approve it, refuse it, or step in. The work then continues or ends. No important action happens without that step, and an agent cannot argue its way past it.
03 During the run · the measurement
The Witness and the Reporter: the signalling behind it
Each agent has a Witness beside it. The Witness reads what its agent is thinking and doing, and writes down the agent's claims about how the facts relate, for example risk_tier(applicant) > threshold or rate_quoted = rate_offered. It records claims about the listed facts only.
The Reporter collects what every Witness has written down and keeps checking that it all fits together. If two agents have drifted apart, say one is acting on a fact another has already contradicted, the Reporter shows the exact contradiction while the agents are still working and calls the Warden. When the work ends, it issues the signed record shown below.
What you get
A signed record of whether the reasoning held together
The record is built on two measurements. A model cannot make them up about itself. Both come from the mathematics Sheaf Labs works in: sheaf cohomology for whether the claims fit into one picture, and the sheaf Laplacian for the score. The same mathematics is also used in engineering to combine readings from many sensors and to check that designs contain no contradictions.
Every agent's claims fit together as one picture (the mathematics calls this H⁰).
Any two agents agree, yet no single picture holds all of them (the mathematics calls this H¹).
Sheaf signs and stores one record for every run. It is a document your risk team can sign, a regulator can read, and your board can rely on before you let agents act on their own. See the mathematics at Sheaf Labs →
What runs on the line
Portfolio IQ is the first train on it.
The signalling is general: any set of AI agents that take actions on OpenShell can run under it. The first product built on it is Portfolio IQ: agents that assess, price and watch a loan book. It reads the book you give it, your criteria, and your rate card if you want pricing. The agents propose each decision, Sheaf checks it, holds it when the reasoning does not hold together, and records it. A person on your team releases or turns down anything that is held. Your systems act on what comes out, the way they do today.
What Sheaf checks
Three checks on every decision
Sheaf checks three things. It checks the agents' claims against the sources of truth you choose. It checks that the values themselves are possible, and flags any that are clearly false. And it checks that all the claims fit together, and puts the result in one signed record. This catches the failure that causes incidents: agents that each look fine on their own but no longer agree with each other underneath.