feat(isolation): split supervisor and sandbox runtimes

[drew]

Summary

Split the existing combined runtime into two explicit programs: openshell-supervisor, which stays outside the agent workload, and openshell-sandbox, which runs inside the workload and owns its process tree. The two communicate over the shared authenticated gRPC boundary protocol from #2942.

The sandbox uses seccomp notification to intercept TCP socket setup and DNS operations without proxy environment variables. The external supervisor performs policy evaluation, DNS resolution, upstream TCP dialing, L7 enforcement, credential handling, and gateway session management. General application UDP is intentionally unsupported.

Related Issue

Part of #1737.

Changes

• Add the dedicated openshell-supervisor binary and slim openshell-sandbox boundary runtime.
• Move policy, credentials, gateway sessions, proxying, and upstream networking into the supervisor.
• Keep process ownership, exec/attach/signal/wait, PTY handling, binary observation, Landlock, and seccomp interception in the sandbox.
• Carry lifecycle, process control, TCP streams, and DNS requests over one protected gRPC connection.
• Add reconnect, readiness, completion, provider-environment update, and bounded resource semantics.
• Remove legacy nftables/network-namespace interception and general UDP mediation.

Testing

• mise run pre-commit passes
• Full unit and E2E validation delegated to remote CI

Checklist

• Follows Conventional Commits
• Authored commits are signed off (DCO)

Review remediation

• Retry transient DNS accept failures with bounded backoff instead of terminating mediation.
• Revalidate TCP socket identity at decision time, bound decisions to 30 seconds, and keep quota ownership with the worker.
• Separate bounded pre-auth admission from authenticated sessions, add HTTP/2 liveness detection, and make supervisor replacement non-preemptive.
• Validate Unix peers and workload ancestry, reserve the Kubernetes control port from mediated egress, and remove unused legacy runtime code.

Stack

1. feat(isolation): define the RFC 0012 boundary contract #2941 — contract
2. feat(isolation): add boundary protocol and Linux primitives #2942 — shared interface and primitives
3. feat(isolation): split supervisor and sandbox runtimes #3151 — supervisor and sandbox runtimes (this PR)
4. feat(vm): run the supervisor outside the guest workload #2945 — VM driver
5. feat(docker): isolate workloads behind the host supervisor #2965 — Docker driver
6. feat(kubernetes): add proxy-pod isolation topology #3144 — Kubernetes proxy-pod topology
7. feat(podman): isolate workloads behind the host supervisor #3230 — Podman driver
8. perf(isolation): add TCP and DNS benchmark harnesses #3229 — performance harnesses

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Label test:e2e applied for 35727e8. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-3151.docs.buildwithfern.com/openshell

[drew]

/ok to test

[drew]

/ok to test

[drew]

/ok to test

[drew]

/ok to test

[drew]

/ok to test

[drew]

/ok to test

[drew]

/ok to test

[drew]

/ok to test

[drew]

/ok to test

[drew]

/ok to test

[drew]

/ok to test

[drew]

/ok to test

[drew]

/ok to test

[drew]

/ok to test

[drew]

/ok to test