From answer to deliverable.
The useful end state is not “here is how you could make the file.” It is a signed URL to the file the agent actually produced.
v0.9.1 · public pre-release · MIT
Give the model
somewhere to work.
Sheafwise adds an execution harness above an OpenAI-compatible model API: files, research, an isolated Linux workspace, subagents, durable state, and real downloadable deliverables.
Change the endpoint. Keep the client. The harness stays on your server.
POST /v1/responses
model your-model
input “Research this and deliver a report.”
S
Sheafwiseexecution harness
running01Inspect filesinputs mounted read-only
02Work in Linuxisolated disposable workspace
03Researchcontrolled public fetch + search
04Publishsigned Artifact URL
analysis-report.pdfArtifact ready · 2.8 MB
download
OpenAI-compatible·Responses API·Files·Docker sandbox·Research·Subagents·Artifacts·Multi-provider·Self-hosted
01 / THE IDEA
A model API is not an agent platform. It is a very good boundary.
A capable model already knows how to reason about a task. What it usually lacks is a place to inspect inputs, run commands, fetch trusted public information, coordinate parallel work, and hand back the thing you actually asked for.
Sheafwise keeps the familiar API surface and adds that missing execution layer behind it. Existing clients stay small; the heavy machinery lives on a host you control.
Disposable Linux workspace
Run code and tools inside a resource-limited Docker environment rather than on the gateway host.
Research without opening the sandbox
Search and controlled public-URL fetching live across an explicit network boundary, with redirect and address validation.
One harness, multiple provider profiles.
Keep credentials and routing server-side while reusing the same files, state, workspace, and Artifact layer.
02 / THE SYSTEM
Thin at the boundary.
Serious behind it.
Sheafwise is infrastructure, not another mandatory chat client. Use it from a browser, an SDK, a scheduled job, or a product of your own.
CLIENTOpenAI-compatible requestResponses or Chat Completions
GATEWAYAuth · routing · limitsprovider credentials stay server-side
HARNESSState · tools · filestool loop and workspace policy
WORKSPACEIsolated Linuxnetwork=none · resource limits
OUTPUTResponse + Artifactstreaming text and signed downloads
01Files in
Upload user inputs through an OpenAI-style file surface and mount them into work safely.
02Stateful Responses
Keep durable provider affinity for stored Responses instead of translating every request into a different protocol.
03Subagents
Split independent work while retaining one API-facing execution harness.
04Artifacts out
Publish real outputs behind signed download URLs rather than injecting fake links into prose.
03 / SECURITY MODEL
Security is a boundary,
not a badge.
The current pre-release targets one trusted operator or a small trusted environment on a dedicated host. Docker daemon access is intentionally treated as root-equivalent trust.
Read the complete SECURITY.md ↗NETWORKSandbox: nonePublic fetching stays outside the container boundary.
PROCESSDrop capabilitiesNo-new-privileges, read-only root, CPU/RAM/PID limits.
FETCHResolve, pin, revalidatePublic address checks are repeated across redirects and peer connection.
BACKUPEncrypted · exact-version BetaValidate a full recovery before trusting it for serious data.
04 / DEPLOY
Pin the release.
Own the host.
v0.9.1 targets a fresh Debian 12 or Ubuntu 22.04/24.04 host. The managed installer keeps the service on loopback by default; publish it through reviewed HTTPS configuration.
VERSION=v0.9.1
curl -fLO "https://github.com/gabriel-meow/sheafwise/releases/download/$VERSION/sheafwise-$VERSION.tar.gz"
curl -fLO "https://github.com/gabriel-meow/sheafwise/releases/download/$VERSION/sheafwise-$VERSION.tar.gz.sha256"
sha256sum -c "sheafwise-$VERSION.tar.gz.sha256"
tar -xzf "sheafwise-$VERSION.tar.gz"
cd "sheafwise-$VERSION"
sudo bash scripts/install.shPre-release means pre-release.
No cross-version migration or rollback promise yet. Treat upgrades as deliberate operations.
Recovery is part of deployment.
Encrypted full-dataset backup and exact-version restore are Beta. Test restoration on a disposable matching host.
Use a dedicated machine.
The host and Docker boundary are trusted. This is not a hostile multi-tenant isolation claim.
OPEN SOURCE · MIT
Change the endpoint.