Skip to content

guides

Intended Documentation

OpenShell and NemoClaw Integration

Compile Open Intent intents and Domain LIM results into OpenShell sandbox policy YAML with @intended-inc/openshell-adapter — presets, risk-tightened method scoping, and physical-AI geofences.

intermediate4 min readimplemented

OpenShell and NemoClaw Integration#

@intended-inc/openshell-adapter is a reference integration that compiles Open Intent intents and Domain LIM signals into OpenShell sandbox policy YAML for the NVIDIA OpenShell / NemoClaw runtime stack. It generates the policy; you review it and apply it with the upstream OpenShell tooling. Intended does not run your OpenShell instance or apply policy on your behalf.

Note

NVIDIA OpenShell and NemoClaw are third-party projects (Apache 2.0), currently described upstream as alpha / early preview. Intended is an independent integration layer, not affiliated with or endorsed by NVIDIA. Treat compiled policy as security-relevant configuration and review it before applying anywhere that can reach production or sensitive data.

What it compiles#

The compiler takes runtime context plus structured intents and LIM evaluations and emits a versioned OpenShell policy: a filesystem policy (read-only / read-write paths, Landlock posture), a process identity, network policies built from presets, and optional geofences for physical runtimes.

  • Presets are resolved from the runtime, the providers, any explicitly requestedPresets, and presets inferred from the intents' target systems (e.g. github, jira, slack, npm_registry, pypi, docker_hub, claude_code, nvidia).
  • Risk posture is strict when any intent is high/critical, touches production, requires privileged access, or contains sensitive data — or when a LIM evaluation triggered fail-closed or raised a conflict signal. Otherwise baseline.
  • In strict posture, allowed HTTP methods on each endpoint are narrowed to only those implied by the intents' verbs (read verbs → GET, write verbs → POST, etc.), instead of the preset's default method set.

Install#

bash
pnpm add @intended-inc/openshell-adapter

The intended CLI is in private beta for design partners — request access or build it from the monorepo workspace.

Input shape#

The compile input matches IntendedOpenShellCompileInputSchema. Intents are Open Intent (UniversalIntent) objects — with action, resource, and riskContext — not the GitHub-workflow IntentRequest used by POST /intent.

json
{
  "profileName": "intended-openshell",
  "runtime": "openclaw",
  "providers": ["nvidia"],
  "requestedPresets": ["github"],
  "intents": [
    {
      "action": { "name": "github.repo.write", "verb": "push" },
      "resource": { "system": "github", "type": "repository" },
      "riskContext": {
        "level": "high",
        "touchesProduction": true,
        "requiresPrivilegedAccess": false,
        "containsSensitiveData": false
      }
    }
  ],
  "limEvaluations": [],
  "geofences": []
}
FieldTypeNotes
profileNamestringDefaults to intended-openshell.
runtimegeneric | openclaw | claude-code | codex-cliSeeds runtime presets.
providersarray of nvidia | anthropicSeeds provider presets.
requestedPresetspreset idsExplicit presets to include.
intentsUniversalIntent[]Drive preset inference + method narrowing.
limEvaluationsDomainLIMEvaluationResult[]Can upgrade risk posture to strict.
geofencesgeofence objectsPhysical-AI bounding regions (see below).

Compile with the CLI#

The CLI uses flat, hyphenated commands. The OpenShell compile command is openshell-compile (aliased nemoclaw-compile):

bash
intended openshell-compile \
  --input intended-openshell.json \
  --output intended-openshell.yaml \
  --runtime openclaw \
  --provider nvidia \
  --preset github,jira

Inspect the inferred presets, risk posture, and per-endpoint method scope in the generated YAML before applying it.

Apply the emitted policy#

Apply with the upstream OpenShell interface (review first):

bash
openshell policy set intended-openshell.yaml

Geofences (physical AI)#

For physical runtimes you can attach geofences — axis-aligned bounding regions in map-frame (x, y, z) or geographic (lat, lon, alt) coordinates. NemoClaw / OpenShell consumers evaluate them on every navigation / pose-setting action on the robot, before the LLM gateway round-trip, so the boundary holds even if the gateway is compromised.

json
{
  "name": "keep-out-cell-3",
  "mode": "deny_inside",
  "coordinate_system": "map_frame_xyz",
  "xyz_box": { "x_min": 2.0, "x_max": 5.0, "y_min": 0.0, "y_max": 3.0 },
  "applies_to_actions": ["navigate_to_pose", "set_velocity"],
  "description": "Human work area — robot must not enter."
}
  • mode: "allow_inside" — the action is permitted only when the resulting pose is inside the region; outside denies.
  • mode: "deny_inside" — the action is denied when the pose is inside the region; outside allows. Use for exclusion zones.

Each geofence must specify exactly one of xyz_box or latlon_box.

  1. Compile policy in a review environment.
  2. Inspect inferred presets, endpoint method scope, and geofences.
  3. Validate the YAML against your runtime configuration.
  4. Apply in staging first.
  5. Promote to production only after operator review.

Upstream runtime hardening, credentials, and allowed endpoints remain your responsibility — the adapter generating a policy is not proof that the upstream defaults are safe.

OpenShell and NemoClaw Integration | Intended