OpenShell agent execution environment

Record description

OpenShell runs agent workloads under Linux filesystem, process and networking restrictions, with a supervisor for selected credentialed actions. The project is presented as a way to enforce boundaries outside the model, not as an instruction classifier.

The OpenShell governance and runtime announcement is a primary source for the design. No independent evaluation establishes universal resistance to compromised processes, arbitrary host configurations or instant revocation under partial failures.

Execution architecture. The project design splits a constrained workload container or Pod from a supervising component that mediates network destinations and credential substitution. Linux restrictions on filesystem and processes complement default-deny egress; they do not rely solely on model instructions. CNCF Sandbox governance marks an early-stage project, not an audited security certification. An implementation test should include direct subprocess connections, supervisor unavailability, policy revocation, and cleanup of a resumed agent's state before calling isolation complete.

Explicitly related research (1)

Declared connections