feat(sandbox): split capability-free supervisor runtime

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Author: drew

.github/workflows/branch-checks.yml

@@ -179,20 +179,20 @@ jobs:
           tasks/scripts/verify-telemetry-compiled-out.sh present target/debug/openshell-gateway
           cargo build -p openshell-gateway --bin openshell-gateway --no-default-features --features defaults-without-telemetry
           tasks/scripts/verify-telemetry-compiled-out.sh absent target/debug/openshell-gateway
-          cargo build -p openshell-sandbox --bin openshell-sandbox --no-default-features --features defaults-without-telemetry
-          tasks/scripts/verify-telemetry-compiled-out.sh absent target/debug/openshell-sandbox
+          cargo build -p openshell-supervisor --bin openshell-supervisor --no-default-features --features defaults-without-telemetry
+          tasks/scripts/verify-telemetry-compiled-out.sh absent target/debug/openshell-supervisor
 
       - name: Verify the defaults-without-telemetry feature alias tracks the default feature set
         run: tasks/scripts/verify-defaults-without-telemetry.sh
 
       - name: Verify system CA roots build mode compiles and excludes bundled Mozilla roots
         run: |
-          cargo check -p openshell-sandbox --all-targets --no-default-features --features system-ca-roots
-          if cargo tree -p openshell-sandbox -i webpki-roots --no-default-features --features system-ca-roots 2>/dev/null | grep -q webpki-roots; then
+          cargo check -p openshell-supervisor --all-targets --no-default-features --features system-ca-roots
+          if cargo tree -p openshell-supervisor -i webpki-roots --no-default-features --features system-ca-roots 2>/dev/null | grep -q webpki-roots; then
             echo "ERROR: webpki-roots found in system CA roots build" >&2
             exit 1
           fi
-          if cargo tree -p openshell-sandbox -i webpki-root-certs --no-default-features --features system-ca-roots 2>/dev/null | grep -q webpki-root-certs; then
+          if cargo tree -p openshell-supervisor -i webpki-root-certs --no-default-features --features system-ca-roots 2>/dev/null | grep -q webpki-root-certs; then
             echo "ERROR: webpki-root-certs found in system CA roots build" >&2
             exit 1
           fi

AGENTS.md

@@ -68,7 +68,7 @@ These pipelines connect skills into end-to-end workflows. Individual skill files
 | `crates/openshell-supervisor-middleware/` | Middleware runtime | Generic middleware registry, remote service integration, and chain execution |
 | `crates/openshell-supervisor-middleware-builtins/` | Built-in middleware | First-party in-process middleware implementations |
 | `crates/openshell-supervisor-network/` | Network supervisor | Proxying, L7 enforcement, policy evaluation, and inference routing |
-| `crates/openshell-supervisor-process/` | Process supervisor | Process lifecycle, namespace, and bypass monitoring |
+| `crates/openshell-supervisor-process/` | Supervisor process runtime | Gateway sessions, SSH access, and remote sandbox process control |
 | `crates/openshell-vfio/` | VFIO support | PCI and GPU passthrough preparation and lifecycle |
 | `python/openshell/` | Python SDK | Python bindings and CLI packaging |
 | `sdk/typescript/` | TypeScript SDK | Native Connect client, curated sandbox API, and generated protobuf types |

Cargo.lock

@@ -38,7 +38,7 @@ http-body-util = "0.1"
 tokio-rustls = { version = "0.26", default-features = false, features = ["logging", "tls12", "ring"] }
 rustls = { version = "0.23", default-features = false, features = ["std", "logging", "tls12", "ring"] }
 rustls-pemfile = "2"
-rcgen = { version = "0.13", features = ["crypto", "pem"] }
+rcgen = { version = "0.13", features = ["crypto", "pem", "x509-parser"] }
 webpki-roots = "1"
 rustls-native-certs = "0.8"
 

Cargo.toml

@@ -47,8 +47,7 @@ Cargo cannot subtract a single default feature, so each of the three binary
 crates also defines a `defaults-without-telemetry` alias listing every default
 except `telemetry`. Telemetry-free builds use
 `--no-default-features --features defaults-without-telemetry` and stay correct
-as the default set grows, instead of dropping unrelated defaults the way a bare
-`--no-default-features` does on `openshell-sandbox`. The alias is a keep-list,
+as the default set grows. The alias is a keep-list,
 not a switch: enabling it on top of the defaults would otherwise yield a
 telemetry-on binary that reads as telemetry-free, so each crate root carries a
 `compile_error!` for the `telemetry` + `defaults-without-telemetry` combination.
@@ -63,7 +62,7 @@ roots through `webpki-roots` plus locally-installed CAs from the system bundle.
 Building without `bundled-ca-roots` switches to the platform trust store via
 `rustls-native-certs` and excludes bundled Mozilla root crates such as
 `webpki-roots` and `webpki-root-certs` from the dependency graph. The
-`system-ca-roots` feature alias on `openshell-sandbox` includes all other
+`system-ca-roots` feature alias on `openshell-supervisor` includes all other
 defaults (currently `telemetry`) except `bundled-ca-roots`, so Linux
 distribution builds (e.g. RPM) can use
 `--no-default-features --features system-ca-roots` without manually re-adding
@@ -196,13 +195,12 @@ Runtime layout:
   cache action runs. An explicitly configured VM runtime bundle is required to
   contain every non-empty embedding input; the driver build fails before
   packaging when an input is absent or empty.
-- **Supervisor**: Alpine base with `nftables`, static binary at
-  `/openshell-sandbox` (musl by default; see `SUPERVISOR_LIBC` above). Static
-  linkage keeps the binary usable when the image is mounted/extracted into
-  sandbox environments (Docker extraction, Podman image volumes, Kubernetes
-  init-container copy-self), whose libc and glibc version are not known at build
-  time, while `nftables` supports Kubernetes supervisor sidecar egress
-  enforcement. The VM driver bundles its own supervisor build
+- **Sandbox and supervisor**: Alpine base with separate static
+  `/openshell-sandbox` and `/openshell-supervisor` binaries (musl by default;
+  see `SUPERVISOR_LIBC` above). Static linkage keeps the sandbox executable
+  usable when a driver stages it into an arbitrary workload image. The image
+  entrypoint is the external supervisor; drivers copy only the sandbox binary
+  into the workload trust domain. The VM driver bundles both builds
   (`tasks/scripts/vm/build-supervisor-bundle.sh`) and does not read
   `SUPERVISOR_LIBC`.