Overview
- NVIDIA published OpenShell (v0.1.x) this week as an open-source runtime that sandboxes agents at the kernel level and centralizes credential custody in a gateway.
- The project includes an SMT-based CLI prover, openshell-prover, that checks whether a candidate policy stays inside a declared boundary and returns counterexamples or 'unsupported' when it cannot model a shape.
- Independent builds and runs of the prover found it deliberately excludes loopback, link-local, and unspecified IPv4/v6 ranges from its destination-IP containment model, which allowed policies granting access to 169.254.169.254 to be reported as within boundary.
- The runtime supervisor’s network code separately hard-blocks those same ranges and the gateway runs a proposal-risk advisor that flags link-local reach, but the prover’s CLI coverage output does not make the exclusion explicit, creating a misleading verification artifact.
- Because OpenShell is early-stage, operators are advised to read the prover’s documented out-of-model shapes, treat the gateway as a sensitive trust anchor, layer logging and attestations for evidence, and disable telemetry if desired.