We built Metamynd OpenShell Integration to answer one question: can an AI agent running inside NVIDIA OpenShell be held to business rules, not just network rules?
OpenShell already gives you containment, egress control and credential isolation. What it can't know is whether a given action is something the agent was actually allowed to do. That's the part Metamynd adds as OpenShell supervisor middleware: live mandates, spend and merchant limits, human escalation above a threshold, behavioural anomaly checks, a per-agent identity, and an anchored evidence trail.
What the demo shows, end to end, on one host:
1. A purchase from an OpenShell sandbox is authorized at Metamynd as the agent bound to that sandbox.
2. OpenShell substitutes the real credential, so the agent never holds it.
3. Metamynd's purchasing gateway re-verifies the request and settles it.
4. It executes exactly once, and every decision joins up across OpenShell's logs, our adapter journal, Metamynd evidence and the ledger.
We also ran a 22-case adversarial matrix against it, including a second client and a check that no agent key is reachable from inside the sandbox.
This is a proof of concept built on OpenShell's public extension points.
Try it: clone the repo, run bash tools/host-preflight.sh, npm ci and npm run check, then follow docs/runbook.md. You'll need an OpenShell v0.1.2 gateway and a Metamynd tenant.