feat(isolation): implement the RFC 0012 sandbox architecture

[drew]

Summary

Implement RFC 0012 as one combined change. This PR defines the Isolation Backend and adds the OpenShell implementation: the Sandbox Protocol, OpenShellRuntimeBackend, separate openshell-supervisor and openshell-sandbox binaries, transport-neutral JWT authentication, and the Docker, Podman, Kubernetes, and VM integrations.

The supervisor stays outside the agent workload. Each compute driver creates the runtime resources, protected channel, and outer network fence needed by its platform.

Related Issue

Part of #1737. Implements the architecture accepted in #2048.

Changes

• Add the openshell-isolation-interface crate and backend conformance tests.
• Add OpenShellRuntimeBackend and the authenticated OpenShell Sandbox Protocol.
• Add separate supervisor and sandbox runtime binaries.
• Bind gateway and sandbox JWT profiles to sandbox identity, runtime generation, session lineage, credential epoch, and expiry.
• Add process ownership, binary identity, TCP and DNS mediation, loopback connections, and fail-closed reconnect behavior.
• Integrate the architecture with VM, Docker, Kubernetes, and Podman.
• Add TCP and DNS performance harnesses.
• Publish separate glibc supervisor and static musl sandbox artifacts.

Driver placement

• VM: host supervisor, guest sandbox runtime, authenticated vsock, no guest NIC.
• Docker: companion supervisor container, workload container, authenticated Unix socket, network_mode=none on the workload.
• Kubernetes: supervisor Pod, workload Pod, private mTLS Service, and NetworkPolicy fence.
• Podman: separate supervisor and workload containers, authenticated Unix socket, no workload network.

Testing

• mise run pre-commit
• Targeted isolation, authentication, and driver tests
• Driver E2E workflows from the original stack
• Remote CI is the final source of truth for the combined PR.

Checklist

• Follows Conventional Commits
• Authored commits are signed off (DCO)
• Driver-specific implementation stays in its respective driver crate and supporting deployment/tests

Consolidated stack

The following stacked PRs are now merged into this PR:

• feat(vm): run the supervisor outside the guest workload #2945 — VM driver
• feat(docker): isolate workloads behind a companion supervisor #2965 — Docker driver
• feat(kubernetes): isolate workloads behind a dedicated supervisor #3144 — Kubernetes driver
• feat(podman): isolate workloads behind a separate supervisor #3230 — Podman driver
• perf(isolation): add TCP and DNS benchmark harnesses #3229 — performance harnesses

#2941 is superseded by the canonical RFC merged in #2048. #3151 was folded into this PR.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

Label test:e2e applied for b06e0b1. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[drew]

/ok to test

[drew]

/ok to test

[drew]

/ok to test

[drew]

/ok to test

[johntmyers]

gator-agent

Monitoring Complete

Monitoring is complete because this PR has merged.

Final status: Gator found no remaining blocking feedback, the required checks were green, and maintainer approval was present before merge.

I removed the active gator:* label because there is nothing left for gator to monitor on this PR.

Gator metadata

• Head SHA: 7984c15894b9092092753253acf47340b27e67bd
• Gator payload: 9