# Sheaf for NVIDIA OpenShell: a sandbox policy in which the agent's only door to its tools is Sheaf.
#
#   openshell sandbox create --name my-agent --policy sheaf-policy.yaml
#
# The agent's real tool servers are NOT listed here. The one endpoint it may call for tools is the
# Sheaf gate, a hosted transparent MCP proxy that reads every tool call, forwards harmless ones, and
# holds any gated action whose reasoning does not hold together until a person releases it.
# OpenShell enforces that this is the only door; Sheaf decides what goes through it.
#
# Get your gate URL and key at https://sheaf.one/get-sheaf.html (a free key takes a minute).
#
# Proven on OpenShell, 28 Sept 2026. Note: OpenShell's default sandbox image has no curl, wget, python or node,
# so to try the fence use an image that has one, e.g.
#   openshell sandbox create --name sheaf-test --from curlimages/curl:latest --policy sheaf-policy.yaml --no-auto-providers --detach -- sleep infinity
#   openshell sandbox exec -n sheaf-test -- curl -s https://api.sheaf.one/api/v1/plans

version: 1

filesystem_policy:
  include_workdir: true
  read_only: [/bin, /usr, /lib, /proc, /dev/urandom, /app, /etc, /var/log]
  read_write: [/sandbox, /tmp, /dev/null]
landlock:
  compatibility: best_effort

network_policies:
  sheaf_gate:
    name: sheaf-gate
    endpoints:
      - host: api.sheaf.one          # the Sheaf gate: https://api.sheaf.one/api/v1/gate/<your-gate-id>/mcp
        port: 443
        protocol: rest
        access: read-write
        enforcement: enforce
    binaries:
      - { path: /usr/bin/node }      # the process that speaks MCP for your agent; add /usr/bin/python3 or your agent binary
      - { path: /usr/bin/curl }