Skip to content

feat(isolation): split supervisor and sandbox runtimes - #3151

Merged
drew merged 19 commits into
codex/1737-rfc12-supervisor-primitivesfrom
codex/1737-rfc12-supervisor-modes
Sep 11, 2026
Merged

feat(isolation): split supervisor and sandbox runtimes#3151
drew merged 19 commits into
codex/1737-rfc12-supervisor-primitivesfrom
codex/1737-rfc12-supervisor-modes

Conversation

@drew

@drew drew commented Sep 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

Split the runtime into openshell-supervisor, outside the agent workload, and openshell-sandbox, inside it. The supervisor consumes the Isolation Backend; the sandbox owns the agent process tree and serves the OpenShell Sandbox Protocol.

The gateway gives the supervisor separate gateway and sandbox JWTs for one launch session. The supervisor refreshes both together, reconnects with a higher credential epoch, and fails closed when authentication expires or the channel is lost.

Related Issue

Part of #1737.

Changes

  • Add dedicated supervisor and sandbox binaries.
  • Move policy, credentials, gateway access, DNS resolution, and upstream TCP dialing into the supervisor.
  • Keep process ownership, binary observation, Landlock, and seccomp interception in the sandbox.
  • Mint and refresh separate audience-scoped gateway and Sandbox Protocol tokens.
  • Authenticate every Sandbox Protocol RPC and stream over one TLS-protected gRPC connection.
  • Rotate launch-scoped credentials and reconnect without exposing them to the agent.
  • Preserve bounded admission, reconnect, readiness, process control, and fail-closed behavior.

Testing

  • mise run pre-commit
  • Focused runtime, refresh, stale-session, and reconnection tests
  • Full E2E validation delegated to remote CI

Checklist

  • Follows Conventional Commits
  • Authored commits are signed off (DCO)

Stack

  1. feat(isolation): define the RFC 0012 boundary contract #2941 — Isolation Backend contract
  2. feat(isolation): implement the RFC 0012 sandbox architecture #2942 — OpenShell Sandbox Protocol and Linux primitives
  3. feat(isolation): split supervisor and sandbox runtimes #3151 — supervisor and sandbox runtimes (this PR)
  4. feat(vm): run the supervisor outside the guest workload #2945 — VM driver
  5. feat(docker): isolate workloads behind a companion supervisor #2965 — Docker driver
  6. feat(kubernetes): isolate workloads behind a dedicated supervisor #3144 — Kubernetes proxy-pod driver
  7. feat(podman): isolate workloads behind a separate supervisor #3230 — Podman driver
  8. perf(isolation): add TCP and DNS benchmark harnesses #3229 — performance harnesses

@drew
drew requested review from a team, derekwaynecarr, mrunalp and sjenning as code owners September 3, 2026 01:46
This was referenced Sep 3, 2026
Closed
Open
Open
Open
Open
@copy-pr-bot

copy-pr-bot Bot commented Sep 3, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@drew
drew force-pushed the codex/1737-rfc12-supervisor-modes branch from c1072f8 to 35727e8 Compare September 3, 2026 14:34
@drew drew added the test:e2e Requires end-to-end coverage label Sep 3, 2026
@github-actions

github-actions Bot commented Sep 3, 2026

Copy link
Copy Markdown

Label test:e2e applied for 35727e8. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

@drew
drew force-pushed the codex/1737-rfc12-supervisor-modes branch from 35727e8 to efa1011 Compare September 5, 2026 16:08
@github-actions

github-actions Bot commented Sep 5, 2026

Copy link
Copy Markdown

🌿 Preview your docs: https://nvidia-preview-pr-3151.docs.buildwithfern.com/openshell

@drew

drew commented Sep 5, 2026

Copy link
Copy Markdown
Collaborator Author

/ok to test

@drew
drew force-pushed the codex/1737-rfc12-supervisor-modes branch from b2848a6 to 33304c3 Compare September 5, 2026 20:24
@drew

drew commented Sep 5, 2026

Copy link
Copy Markdown
Collaborator Author

/ok to test

10 similar comments
@drew

drew commented Sep 5, 2026

Copy link
Copy Markdown
Collaborator Author

/ok to test

@drew

drew commented Sep 5, 2026

Copy link
Copy Markdown
Collaborator Author

/ok to test

@drew

drew commented Sep 5, 2026

Copy link
Copy Markdown
Collaborator Author

/ok to test

@drew

drew commented Sep 5, 2026

Copy link
Copy Markdown
Collaborator Author

/ok to test

@drew

drew commented Sep 5, 2026

Copy link
Copy Markdown
Collaborator Author

/ok to test

@drew

drew commented Sep 5, 2026

Copy link
Copy Markdown
Collaborator Author

/ok to test

@drew

drew commented Sep 6, 2026

Copy link
Copy Markdown
Collaborator Author

/ok to test

@drew

drew commented Sep 6, 2026

Copy link
Copy Markdown
Collaborator Author

/ok to test

@drew

drew commented Sep 6, 2026

Copy link
Copy Markdown
Collaborator Author

/ok to test

@drew

drew commented Sep 6, 2026

Copy link
Copy Markdown
Collaborator Author

/ok to test

@drew drew mentioned this pull request Sep 10, 2026
Merged
3 tasks
@drew
drew force-pushed the codex/1737-rfc12-supervisor-modes branch from c2cc566 to 676a65a Compare September 11, 2026 05:57
@drew
drew force-pushed the codex/1737-rfc12-supervisor-modes branch 2 times, most recently from bd9fd81 to 8f0e48a Compare September 11, 2026 17:52
@drew
drew force-pushed the codex/1737-rfc12-supervisor-modes branch from 8f0e48a to 8ecb902 Compare September 11, 2026 19:48
drew added 19 commits September 11, 2026 13:45
@drew
feat(isolation): split supervisor and sandbox runtimes
9791c8a 
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
@drew
docs(agents): register supervisor runtime
99e192a 
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
@drew
fix(sandbox): harden boundary isolation and lifecycle ownership
cb9c0e6 
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
@drew
fix(sandbox): reject private root redirects and adopt typed errors
e00e263 
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
@drew
fix(sandbox): preserve accept thread ownership on musl
6d357ae 
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
@drew
test(sandbox): isolate credential probes from filtered threads
de86a4c 
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
@drew
fix(sandbox): return retained exec exit status to independent waiters
1727994 
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
@drew
fix(sandbox): bound network mediation and preserve socket authorization
07838b3 
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
@drew
fix(sandbox): bound control admission and retire stale mediation
520aaeb 
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
@drew
ci(e2e): select migrated drivers per stack layer
a4a6666 
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
@drew
refactor(sandbox): implement loopback connector
b555923 
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
@drew
feat(isolation): authenticate the Sandbox Protocol
7cf8f93 
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
@drew
feat(supervisor): rotate launch-scoped authentication
d684ed3 
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
@drew
refactor(sandbox): consume dedicated backend crate
4bdd742 
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
@drew
test(sandbox): align topology session fixture
737628b 
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
@drew
fix(auth): use valid default session token lifetime
0d749dc 
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
@drew
fix(sandbox): align projected bootstrap bundle
c6b64dd 
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
@drew
fix(auth): validate refreshed credentials before rotation
f7b4b85 
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
@drew
fix(sandbox): fail closed across supervisor disconnects
57e7b2d 
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
@drew
drew force-pushed the codex/1737-rfc12-supervisor-modes branch from 4778fc5 to 57e7b2d Compare September 11, 2026 20:48
@drew
drew merged commit 57e7b2d into main Sep 11, 2026
61 of 66 checks passed
@drew
drew deleted the codex/1737-rfc12-supervisor-modes branch September 11, 2026 21:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mrunalp mrunalp Awaiting requested review from mrunalp mrunalp is a code owner
@sjenning sjenning Awaiting requested review from sjenning sjenning is a code owner
@derekwaynecarr derekwaynecarr Awaiting requested review from derekwaynecarr derekwaynecarr is a code owner

Assignees

No one assigned

Labels

test:e2e Requires end-to-end coverage

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@drew