# Sheaf provider profile for NVIDIA OpenShell.
#
#   openshell provider profile lint   -f sheaf.yaml
#   openshell provider profile import -f sheaf.yaml --global
#   openshell provider create sheaf --type sheaf        # paste your Sheaf key when asked
#   openshell sandbox create --name my-agent --provider sheaf
#
# The credential is your Sheaf API key. OpenShell keeps it outside the sandbox and attaches it only to
# requests bound for api.sheaf.one, so the agent never holds it. Copy this file and set `binaries`
# to the paths in your image.

id: sheaf
display_name: Sheaf
description: The signalling layer for OpenShell. Every gated tool call is checked for coherence before it runs, held for a person when it does not add up, and recorded.
category: governance
inference_capable: false
credentials:
  - name: api_key
    description: Sheaf API key (sk_pod_...)
    env_vars: [SHEAF_API_KEY]
    required: true
    auth_style: bearer
    header_name: authorization
discovery:
  credentials: [api_key]
endpoints:
  - host: api.sheaf.one
    port: 443
    protocol: rest
    access: read-write
    enforcement: enforce
binaries: [/usr/bin/node, /usr/local/bin/node, /usr/bin/python3, /usr/bin/curl]