feat(isolation): add boundary protocol and Linux primitives

AGENTS.md

@@ -39,6 +39,7 @@ These pipelines connect skills into end-to-end workflows. Individual skill files
 | `crates/openshell-conformance-cli/` | Conformance CLI | Distributable `list` and `run` entrypoint for gateway conformance |
 | `crates/openshell-server/` | Gateway server | Control-plane API, sandbox lifecycle, auth boundary |
 | `crates/openshell-sandbox/` | Sandbox runtime | Container supervision, policy-enforced egress routing |
+| `crates/openshell-binary-identity/` | Binary identity | Shared trusted procfs executable identity resolution for isolation backends |
 | `crates/openshell-isolation-interface/` | Isolation backend interface | RFC 0012 `IsolationBackend` trait + types; the supervisor-facing runtime contract for the boundary |
 | `crates/openshell-policy/` | Policy engine | Filesystem, network, process, and inference constraints |
 | `crates/openshell-router/` | Privacy router | Privacy-aware LLM routing |
@@ -67,7 +68,7 @@ These pipelines connect skills into end-to-end workflows. Individual skill files
 | `crates/openshell-supervisor-middleware/` | Middleware runtime | Generic middleware registry, remote service integration, and chain execution |
 | `crates/openshell-supervisor-middleware-builtins/` | Built-in middleware | First-party in-process middleware implementations |
 | `crates/openshell-supervisor-network/` | Network supervisor | Proxying, L7 enforcement, policy evaluation, and inference routing |
-| `crates/openshell-supervisor-process/` | Process supervisor | Process lifecycle, namespace, and bypass monitoring |
+| `crates/openshell-supervisor-process/` | Supervisor process runtime | Gateway sessions, SSH access, and remote sandbox process control |
 | `crates/openshell-vfio/` | VFIO support | PCI and GPU passthrough preparation and lifecycle |
 | `python/openshell/` | Python SDK | Python bindings and CLI packaging |
 | `sdk/typescript/` | TypeScript SDK | Native Connect client, curated sandbox API, and generated protobuf types |

Cargo.toml

@@ -33,12 +33,13 @@ hyper-util = { version = "0.1", features = ["tokio", "server-auto"] }
 http = "1.2"
 http-body = "1.0"
 http-body-util = "0.1"
+h2 = "0.4"
 
 # TLS
 tokio-rustls = { version = "0.26", default-features = false, features = ["logging", "tls12", "ring"] }
 rustls = { version = "0.23", default-features = false, features = ["std", "logging", "tls12", "ring"] }
 rustls-pemfile = "2"
-rcgen = { version = "0.13", features = ["crypto", "pem"] }
+rcgen = { version = "0.13", features = ["crypto", "pem", "x509-parser"] }
 webpki-roots = "1"
 rustls-native-certs = "0.8"
 

architecture/sandbox.md

@@ -542,3 +542,23 @@ engine with a gateway policy revision.
   `Error/MainProcessFailed`. Infrastructure failures also use `Error`, with a
   distinct condition reason and no fabricated canonical-process result. Runtime
   restart policies must not replace the canonical process.
+
+## Shared Boundary Primitives
+
+`openshell-isolation-interface` owns the common boundary protocol and Linux
+mechanisms. Drivers provide the protected transport and immutable resource
+identity; they do not implement their own process or network protocol. All
+remote traffic uses one mutually authenticated gRPC connection. Independent
+streams carry process control, exec output, and TCP bytes; a persistent
+`Mediate` stream carries DNS queries and supervisor-produced answers. There is
+no alternate raw-TLS application protocol or general UDP framing.
+
+The shared process-signal mediator resolves each positive target PID or TID to
+its thread-group leader, excludes the sandbox leader, retains a pidfd, and sends
+the signal through that descriptor. It never continues the original numeric-PID
+syscall after inspection. This prevents TID aliases or PID reuse from turning an
+agent signal into a signal to the sandbox. Ordinary mediated `kill` reports the
+broker as its sender, not the original calling agent's `SI_USER` identity.
+Queued signals preserve permitted application siginfo payloads; they cannot
+forge kernel-generated or `SI_TKILL` codes. Programs requiring original sender
+identity must account for this mediation boundary.

crates/openshell-binary-identity/Cargo.toml

@@ -0,0 +1,18 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+[package]
+name = "openshell-binary-identity"
+description = "Trusted executable identity resolution for OpenShell isolation backends"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+
+[dependencies]
+openshell-isolation-interface = { path = "../openshell-isolation-interface" }
+sha2 = { workspace = true }
+
+[lints]
+workspace = true

crates/openshell-binary-identity/README.md

@@ -0,0 +1,17 @@
+# Binary identity
+
+`openshell-binary-identity` provides shared executable-identity resolution for
+RFC 0012 isolation backends. Runtime-specific observers remain in their backend:
+Docker obtains an authoritative thread ID from seccomp notification, while the
+co-located Linux path maps an accepted socket to its owning processes.
+
+Given an authoritative Linux PID and an optional trusted process-tree root, the
+crate reads the executable path from procfs, hashes the live `/proc/<pid>/exe`
+object, and collects bounded executable ancestry and diagnostic command-line
+paths. Resolution failures are returned as `ResolveError` so the caller can
+deny the associated connection.
+
+The crate does not intercept connections, authenticate remote observers, or
+evaluate policy. The isolation backend remains responsible for binding the
+resolved identity to the active boundary and exact accepted connection before
+constructing `MediatedConnection`.