feat(sandbox): add control and boundary supervisor modes

.github/actions/build-docker-image/action.yml

@@ -11,6 +11,10 @@ inputs:
   binary:
     description: Binary staged in the Docker build context
     required: true
+  additional-binary:
+    description: Optional second binary staged in the Docker build context
+    required: false
+    default: ""
   triple:
     description: Binary artifact target triple
     required: true
@@ -53,6 +57,21 @@ runs:
         INPUTS_BINARY: ${{ inputs.binary }}
         INPUTS_ARCH: ${{ inputs.arch }}
 
+    - name: Download ${{ inputs.additional-binary }}
+      if: inputs.additional-binary != ''
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: ${{ inputs.additional-binary }}-${{ inputs.triple }}
+        path: additional-artifact
+
+    - name: Stage ${{ inputs.additional-binary }}
+      if: inputs.additional-binary != ''
+      shell: bash
+      run: install -Dm0755 additional-artifact/${INPUTS_ADDITIONAL_BINARY} deploy/docker/.build/prebuilt-binaries/${INPUTS_ARCH}/${INPUTS_ADDITIONAL_BINARY}
+      env:
+        INPUTS_ADDITIONAL_BINARY: ${{ inputs.additional-binary }}
+        INPUTS_ARCH: ${{ inputs.arch }}
+
     - name: Build ${{ inputs.component }} image
       shell: bash
       env:

.github/workflows/branch-checks.yml

@@ -179,20 +179,20 @@ jobs:
           tasks/scripts/verify-telemetry-compiled-out.sh present target/debug/openshell-gateway
           cargo build -p openshell-gateway --bin openshell-gateway --no-default-features --features defaults-without-telemetry
           tasks/scripts/verify-telemetry-compiled-out.sh absent target/debug/openshell-gateway
-          cargo build -p openshell-sandbox --bin openshell-sandbox --no-default-features --features defaults-without-telemetry
-          tasks/scripts/verify-telemetry-compiled-out.sh absent target/debug/openshell-sandbox
+          cargo build -p openshell-supervisor --bin openshell-supervisor --no-default-features --features defaults-without-telemetry
+          tasks/scripts/verify-telemetry-compiled-out.sh absent target/debug/openshell-supervisor
 
       - name: Verify the defaults-without-telemetry feature alias tracks the default feature set
         run: tasks/scripts/verify-defaults-without-telemetry.sh
 
       - name: Verify system CA roots build mode compiles and excludes bundled Mozilla roots
         run: |
-          cargo check -p openshell-sandbox --all-targets --no-default-features --features system-ca-roots
-          if cargo tree -p openshell-sandbox -i webpki-roots --no-default-features --features system-ca-roots 2>/dev/null | grep -q webpki-roots; then
+          cargo check -p openshell-supervisor --all-targets --no-default-features --features system-ca-roots
+          if cargo tree -p openshell-supervisor -i webpki-roots --no-default-features --features system-ca-roots 2>/dev/null | grep -q webpki-roots; then
             echo "ERROR: webpki-roots found in system CA roots build" >&2
             exit 1
           fi
-          if cargo tree -p openshell-sandbox -i webpki-root-certs --no-default-features --features system-ca-roots 2>/dev/null | grep -q webpki-root-certs; then
+          if cargo tree -p openshell-supervisor -i webpki-root-certs --no-default-features --features system-ca-roots 2>/dev/null | grep -q webpki-root-certs; then
             echo "ERROR: webpki-root-certs found in system CA roots build" >&2
             exit 1
           fi

.github/workflows/branch-e2e.yml

@@ -262,6 +262,7 @@ jobs:
     with:
       component: supervisor
       binary: openshell-sandbox
+      additional-binary: openshell-supervisor
       target-suffix: unknown-linux-musl
     secrets: inherit
 

.github/workflows/build-sandbox-binaries.yml

@@ -32,13 +32,27 @@ jobs:
           - triple: x86_64-unknown-linux-musl
             runner: linux-amd64-cpu8
             dev_shell: .#devShells.x86_64-linux.musl
+            package: openshell-sandbox
+            binary: openshell-sandbox
+          - triple: x86_64-unknown-linux-musl
+            runner: linux-amd64-cpu8
+            dev_shell: .#devShells.x86_64-linux.musl
+            package: openshell-supervisor
+            binary: openshell-supervisor
+          - triple: aarch64-unknown-linux-musl
+            runner: linux-arm64-cpu8
+            dev_shell: .#devShells.aarch64-linux.musl
+            package: openshell-sandbox
+            binary: openshell-sandbox
           - triple: aarch64-unknown-linux-musl
             runner: linux-arm64-cpu8
             dev_shell: .#devShells.aarch64-linux.musl
+            package: openshell-supervisor
+            binary: openshell-supervisor
     uses: ./.github/workflows/build-binaries.yml
     with:
-      package: openshell-sandbox
-      binary: openshell-sandbox
+      package: ${{ matrix.package }}
+      binary: ${{ matrix.binary }}
       triple: ${{ matrix.triple }}
       runner: ${{ matrix.runner }}
       dev-shell: ${{ matrix.dev_shell }}

.github/workflows/docker-build.yml

@@ -12,6 +12,10 @@ on:
       binary:
         required: true
         type: string
+      additional-binary:
+        required: false
+        type: string
+        default: ""
       target-suffix:
         required: true
         type: string
@@ -54,6 +58,7 @@ jobs:
         with:
           component: ${{ inputs.component }}
           binary: ${{ inputs.binary }}
+          additional-binary: ${{ inputs['additional-binary'] }}
           triple: ${{ matrix.rust_arch }}-${{ inputs['target-suffix'] }}
           arch: ${{ matrix.arch }}
           platform: ${{ matrix.platform }}

.github/workflows/release-dev.yml

@@ -145,6 +145,7 @@ jobs:
     with:
       component: supervisor
       binary: openshell-sandbox
+      additional-binary: openshell-supervisor
       target-suffix: unknown-linux-musl
     secrets: inherit
 

.github/workflows/release-tag.yml

@@ -184,6 +184,7 @@ jobs:
     with:
       component: supervisor
       binary: openshell-sandbox
+      additional-binary: openshell-supervisor
       target-suffix: unknown-linux-musl
       image-tag: ${{ needs.compute-versions.outputs.source_sha }}
       checkout-ref: ${{ inputs.tag || github.ref }}

AGENTS.md

@@ -68,7 +68,7 @@ These pipelines connect skills into end-to-end workflows. Individual skill files
 | `crates/openshell-supervisor-middleware/` | Middleware runtime | Generic middleware registry, remote service integration, and chain execution |
 | `crates/openshell-supervisor-middleware-builtins/` | Built-in middleware | First-party in-process middleware implementations |
 | `crates/openshell-supervisor-network/` | Network supervisor | Proxying, L7 enforcement, policy evaluation, and inference routing |
-| `crates/openshell-supervisor-process/` | Process supervisor | Process lifecycle, namespace, and bypass monitoring |
+| `crates/openshell-supervisor-process/` | Supervisor process runtime | Gateway sessions, SSH access, and remote sandbox process control |
 | `crates/openshell-vfio/` | VFIO support | PCI and GPU passthrough preparation and lifecycle |
 | `python/openshell/` | Python SDK | Python bindings and CLI packaging |
 | `sdk/typescript/` | TypeScript SDK | Native Connect client, curated sandbox API, and generated protobuf types |

Cargo.toml

@@ -38,7 +38,7 @@ http-body-util = "0.1"
 tokio-rustls = { version = "0.26", default-features = false, features = ["logging", "tls12", "ring"] }
 rustls = { version = "0.23", default-features = false, features = ["std", "logging", "tls12", "ring"] }
 rustls-pemfile = "2"
-rcgen = { version = "0.13", features = ["crypto", "pem"] }
+rcgen = { version = "0.13", features = ["crypto", "pem", "x509-parser"] }
 webpki-roots = "1"
 rustls-native-certs = "0.8"
 

architecture/build.md

@@ -47,8 +47,7 @@ Cargo cannot subtract a single default feature, so each of the three binary
 crates also defines a `defaults-without-telemetry` alias listing every default
 except `telemetry`. Telemetry-free builds use
 `--no-default-features --features defaults-without-telemetry` and stay correct
-as the default set grows, instead of dropping unrelated defaults the way a bare
-`--no-default-features` does on `openshell-sandbox`. The alias is a keep-list,
+as the default set grows. The alias is a keep-list,
 not a switch: enabling it on top of the defaults would otherwise yield a
 telemetry-on binary that reads as telemetry-free, so each crate root carries a
 `compile_error!` for the `telemetry` + `defaults-without-telemetry` combination.
@@ -63,7 +62,7 @@ roots through `webpki-roots` plus locally-installed CAs from the system bundle.
 Building without `bundled-ca-roots` switches to the platform trust store via
 `rustls-native-certs` and excludes bundled Mozilla root crates such as
 `webpki-roots` and `webpki-root-certs` from the dependency graph. The
-`system-ca-roots` feature alias on `openshell-sandbox` includes all other
+`system-ca-roots` feature alias on `openshell-supervisor` includes all other
 defaults (currently `telemetry`) except `bundled-ca-roots`, so Linux
 distribution builds (e.g. RPM) can use
 `--no-default-features --features system-ca-roots` without manually re-adding
@@ -196,13 +195,12 @@ Runtime layout:
   cache action runs. An explicitly configured VM runtime bundle is required to
   contain every non-empty embedding input; the driver build fails before
   packaging when an input is absent or empty.
-- **Supervisor**: Alpine base with `nftables`, static binary at
-  `/openshell-sandbox` (musl by default; see `SUPERVISOR_LIBC` above). Static
-  linkage keeps the binary usable when the image is mounted/extracted into
-  sandbox environments (Docker extraction, Podman image volumes, Kubernetes
-  init-container copy-self), whose libc and glibc version are not known at build
-  time, while `nftables` supports Kubernetes supervisor sidecar egress
-  enforcement. The VM driver bundles its own supervisor build
+- **Sandbox and supervisor**: Alpine base with separate static
+  `/openshell-sandbox` and `/openshell-supervisor` binaries (musl by default;
+  see `SUPERVISOR_LIBC` above). Static linkage keeps the sandbox executable
+  usable when a driver stages it into an arbitrary workload image. The image
+  entrypoint is the external supervisor; drivers copy only the sandbox binary
+  into the workload trust domain. The VM driver bundles both builds
   (`tasks/scripts/vm/build-supervisor-bundle.sh`) and does not read
   `SUPERVISOR_LIBC`.