feat(isolation): implement the RFC 0012 sandbox architecture

.agents/skills/sbom/SKILL.md

@@ -15,7 +15,7 @@ The OpenShell SBOM tooling produces source-tree CycloneDX JSON SBOMs using Syft,
 
 SBOMs are **release artifacts only** -- they are generated on demand and not committed to the repository. Output lands in `deploy/sbom/output/` (gitignored).
 
-Pushed gateway and supervisor images carry an SPDX SBOM and minimal SLSA provenance as OCI attestations. Branch E2E, Release Dev, and Release Tag image binaries embed cargo-auditable metadata, so their image SBOMs include linked Rust crates.
+Pushed gateway, sandbox, and supervisor images carry an SPDX SBOM and minimal SLSA provenance as OCI attestations. Branch E2E, Release Dev, and Release Tag image binaries embed cargo-auditable metadata, so their image SBOMs include linked Rust crates.
 
 ## Prerequisites
 

.agents/skills/test-release-canary/SKILL.md

@@ -92,7 +92,7 @@ Note `install.sh` is pulled from `raw.githubusercontent.com/NVIDIA/OpenShell/${h
 `Release Dev` publishes two chart versions for every dev build (see `.github/actions/release-helm-oci/action.yml:89-102`):
 
 - `oci://ghcr.io/nvidia/openshell/helm-chart:0.0.0-dev` — floating, overwritten on every main push.
-- `oci://ghcr.io/nvidia/openshell/helm-chart:0.0.0-dev.<sha>` — immutable, `appVersion` set to the same SHA so it pulls `ghcr.io/nvidia/openshell/gateway:<sha>` and `:supervisor:<sha>`.
+- `oci://ghcr.io/nvidia/openshell/helm-chart:0.0.0-dev.<sha>` — immutable, `appVersion` set to the same SHA so it pulls the matching `gateway`, `sandbox`, and `supervisor` images.
 
 To smoke-test the chart for a specific dev build, dispatch `Release Dev` on the branch first, then run the kind canary steps locally pointed at the SHA-pinned chart (see "Local kind reproduction" below). The release-canary workflow itself does not currently expose `chart_version` / `image_tag` inputs.
 

.github/actions/build-rust-binary/action.yml

@@ -29,6 +29,10 @@ inputs:
     description: Additional flags passed to cargo build
     required: false
     default: ""
+  interpreter:
+    description: Expected ELF program interpreter, "none" for static, or "skip"
+    required: false
+    default: skip
 
 runs:
   using: composite
@@ -71,11 +75,24 @@ runs:
       env:
         INPUTS_BINARY: ${{ inputs.binary }}
         INPUTS_TRIPLE: ${{ inputs.triple }}
+        INPUTS_INTERPRETER: ${{ inputs.interpreter }}
       run: |
+        binary="target/${INPUTS_TRIPLE}/release/${INPUTS_BINARY}"
         # Confirm the binary runs and reports the expected name.
-        target/${INPUTS_TRIPLE}/release/${INPUTS_BINARY} --version | grep -q "^${INPUTS_BINARY} "
+        "$binary" --version | grep -q "^${INPUTS_BINARY} "
         # Confirm Syft can decode the embedded cargo-auditable metadata.
-        SYFT_CHECK_FOR_APP_UPDATE=false syft file:target/${INPUTS_TRIPLE}/release/${INPUTS_BINARY} -o cyclonedx-json | grep 'pkg:cargo/' > /dev/null
+        SYFT_CHECK_FOR_APP_UPDATE=false syft "file:${binary}" -o cyclonedx-json | grep 'pkg:cargo/' > /dev/null
+        if [ "$INPUTS_INTERPRETER" != skip ]; then
+          actual_interpreter="$(readelf -l "$binary" | sed -n 's/.*Requesting program interpreter: \(.*\)]/\1/p')"
+          expected_interpreter="$INPUTS_INTERPRETER"
+          if [ "$expected_interpreter" = none ]; then
+            expected_interpreter=""
+          fi
+          if [ "$actual_interpreter" != "$expected_interpreter" ]; then
+            echo "error: expected interpreter '${expected_interpreter:-<none>}', got '${actual_interpreter:-<none>}'" >&2
+            exit 1
+          fi
+        fi
 
     - name: Upload ${{ inputs.binary }}
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7

.github/actions/check-job-results/action.yml

@@ -8,6 +8,10 @@ inputs:
   results:
     description: JSON-encoded GitHub Actions needs context
     required: true
+  allowed-skipped-jobs:
+    description: Comma-separated job IDs that may be skipped but must not fail
+    required: false
+    default: ""
 
 runs:
   using: composite
@@ -16,12 +20,20 @@ runs:
       shell: bash
       env:
         JOB_RESULTS: ${{ inputs.results }}
+        ALLOWED_SKIPPED_JOBS: ${{ inputs.allowed-skipped-jobs }}
       run: |
         set -euo pipefail
         failures="$(
-          jq -r '
+          jq -r --arg allowed_skipped "$ALLOWED_SKIPPED_JOBS" '
+            ($allowed_skipped | split(",") | map(select(length > 0))) as $allowed_skipped_jobs
+            |
             to_entries[]
+            | . as $job
             | select(.value.result != "success")
+            | select(
+                .value.result != "skipped"
+                or ($allowed_skipped_jobs | index($job.key)) == null
+              )
             | "\(.key) concluded \(.value.result)"
           ' <<< "$JOB_RESULTS"
         )"

.github/actions/setup-e2e-kind/action.yml

@@ -14,7 +14,7 @@ inputs:
   images:
     description: Space-separated OpenShell image components to load
     required: false
-    default: gateway supervisor
+    default: gateway sandbox supervisor
   registry:
     description: Container registry and namespace
     required: false
@@ -71,7 +71,7 @@ runs:
         set -euo pipefail
         for component in $IMAGE_COMPONENTS; do
           case "$component" in
-            gateway | supervisor) ;;
+            gateway | sandbox | supervisor) ;;
             *) echo "ERROR: unsupported OpenShell image component: $component" >&2; exit 1 ;;
           esac
           image="${REGISTRY}/${component}:${IMAGE_TAG}"

.github/workflows/branch-checks.yml

@@ -179,8 +179,8 @@ jobs:
           tasks/scripts/verify-telemetry-compiled-out.sh present target/debug/openshell-gateway
           cargo build -p openshell-gateway --bin openshell-gateway --no-default-features --features defaults-without-telemetry
           tasks/scripts/verify-telemetry-compiled-out.sh absent target/debug/openshell-gateway
-          cargo build -p openshell-sandbox --bin openshell-sandbox --no-default-features --features defaults-without-telemetry
-          tasks/scripts/verify-telemetry-compiled-out.sh absent target/debug/openshell-sandbox
+          cargo build -p openshell-supervisor --bin openshell-supervisor --no-default-features --features defaults-without-telemetry
+          tasks/scripts/verify-telemetry-compiled-out.sh absent target/debug/openshell-supervisor
 
       - name: Verify selective gateway compute-driver builds
         run: |
@@ -197,12 +197,12 @@ jobs:
 
       - name: Verify system CA roots build mode compiles and excludes bundled Mozilla roots
         run: |
-          cargo check -p openshell-sandbox --all-targets --no-default-features --features system-ca-roots
-          if cargo tree -p openshell-sandbox -i webpki-roots --no-default-features --features system-ca-roots 2>/dev/null | grep -q webpki-roots; then
+          cargo check -p openshell-supervisor --all-targets --no-default-features --features system-ca-roots
+          if cargo tree -p openshell-supervisor -i webpki-roots --no-default-features --features system-ca-roots 2>/dev/null | grep -q webpki-roots; then
             echo "ERROR: webpki-roots found in system CA roots build" >&2
             exit 1
           fi
-          if cargo tree -p openshell-sandbox -i webpki-root-certs --no-default-features --features system-ca-roots 2>/dev/null | grep -q webpki-root-certs; then
+          if cargo tree -p openshell-supervisor -i webpki-root-certs --no-default-features --features system-ca-roots 2>/dev/null | grep -q webpki-root-certs; then
             echo "ERROR: webpki-root-certs found in system CA roots build" >&2
             exit 1
           fi

.github/workflows/branch-e2e.yml

@@ -28,6 +28,11 @@ jobs:
       run_kubernetes_ha_e2e: ${{ steps.labels.outputs.run_kubernetes_ha_e2e }}
       run_kubernetes_credential_drivers_e2e: ${{ steps.labels.outputs.run_kubernetes_credential_drivers_e2e }}
       run_any_e2e: ${{ steps.labels.outputs.run_any_e2e }}
+      run_docker_e2e: ${{ steps.labels.outputs.run_docker_e2e }}
+      run_podman_e2e: ${{ steps.labels.outputs.run_podman_e2e }}
+      run_vm_e2e: ${{ steps.labels.outputs.run_vm_e2e }}
+      run_kubernetes_e2e: ${{ steps.labels.outputs.run_kubernetes_e2e }}
+      allowed_skipped_core_jobs: ${{ steps.labels.outputs.allowed_skipped_core_jobs }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - id: gate
@@ -68,12 +73,46 @@ jobs:
           else
             run_any_e2e=false
           fi
+
+          run_docker_e2e="$run_core_e2e"
+          run_podman_e2e="$run_core_e2e"
+          run_vm_e2e="$run_core_e2e"
+          run_kubernetes_e2e="$run_core_e2e"
+          allowed_skipped_core_jobs=""
+
+          # The RFC 0012 stack deliberately introduces the split runtime before
+          # migrating each driver. At those intermediate layers, run only the
+          # drivers whose isolation adapter is present. Before and after the
+          # stack this resolves to the complete legacy or migrated driver set.
+          if [ "$run_core_e2e" = "true" ] && [ -f crates/openshell-supervisor/Cargo.toml ]; then
+            if [ ! -f crates/openshell-driver-docker/src/isolation.rs ]; then
+              run_docker_e2e=false
+              allowed_skipped_core_jobs="docker-e2e,docker-external-driver-e2e"
+            fi
+            if [ ! -f crates/openshell-driver-podman/src/isolation.rs ]; then
+              run_podman_e2e=false
+              allowed_skipped_core_jobs="${allowed_skipped_core_jobs:+$allowed_skipped_core_jobs,}podman-e2e,podman-external-driver-e2e"
+            fi
+            if [ ! -f crates/openshell-driver-vm/src/isolation/mod.rs ]; then
+              run_vm_e2e=false
+              allowed_skipped_core_jobs="${allowed_skipped_core_jobs:+$allowed_skipped_core_jobs,}vm-e2e,vm-external-driver-e2e"
+            fi
+            if [ ! -f crates/openshell-driver-kubernetes/src/isolation.rs ]; then
+              run_kubernetes_e2e=false
+              allowed_skipped_core_jobs="${allowed_skipped_core_jobs:+$allowed_skipped_core_jobs,}kubernetes-e2e,kubernetes-external-driver-e2e,kubernetes-workspace-managed-e2e,kubernetes-workspace-operator-e2e"
+            fi
+          fi
           {
             echo "run_core_e2e=$run_core_e2e"
             echo "run_gpu_e2e=$run_gpu_e2e"
             echo "run_kubernetes_ha_e2e=$run_kubernetes_ha_e2e"
             echo "run_kubernetes_credential_drivers_e2e=$run_kubernetes_credential_drivers_e2e"
             echo "run_any_e2e=$run_any_e2e"
+            echo "run_docker_e2e=$run_docker_e2e"
+            echo "run_podman_e2e=$run_podman_e2e"
+            echo "run_vm_e2e=$run_vm_e2e"
+            echo "run_kubernetes_e2e=$run_kubernetes_e2e"
+            echo "allowed_skipped_core_jobs=$allowed_skipped_core_jobs"
           } >> "$GITHUB_OUTPUT"
 
   version:
@@ -237,22 +276,35 @@ jobs:
       target-suffix: unknown-linux-gnu
     secrets: inherit
 
-  build-supervisor-image:
+  build-sandbox-image:
     needs: [pr_metadata, build-sandbox]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_any_e2e == 'true'
     permissions:
       contents: read
       packages: write
     uses: ./.github/workflows/docker-build.yml
     with:
-      component: supervisor
+      component: sandbox
       binary: openshell-sandbox
       target-suffix: unknown-linux-musl
     secrets: inherit
 
+  build-supervisor-image:
+    needs: [pr_metadata, build-sandbox]
+    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_any_e2e == 'true'
+    permissions:
+      contents: read
+      packages: write
+    uses: ./.github/workflows/docker-build.yml
+    with:
+      component: supervisor
+      binary: openshell-supervisor
+      target-suffix: unknown-linux-gnu
+    secrets: inherit
+
   docker-e2e:
-    needs: [pr_metadata, build-cli, build-conformance, build-gateway, build-supervisor-image]
-    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
+    needs: [pr_metadata, build-cli, build-conformance, build-gateway, build-sandbox-image, build-supervisor-image]
+    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_docker_e2e == 'true'
     permissions:
       actions: read
       contents: read
@@ -264,8 +316,8 @@ jobs:
       conformance-artifact-prefix: openshell-conformance
 
   podman-e2e:
-    needs: [pr_metadata, build-cli, build-conformance, build-gateway, build-supervisor-image]
-    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
+    needs: [pr_metadata, build-cli, build-conformance, build-gateway, build-sandbox-image, build-supervisor-image]
+    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_podman_e2e == 'true'
     permissions:
       actions: read
       contents: read
@@ -277,7 +329,7 @@ jobs:
 
   vm-e2e:
     needs: [pr_metadata, build-cli, build-conformance, build-gateway, build-vm-driver]
-    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
+    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_vm_e2e == 'true'
     permissions:
       actions: read
       contents: read
@@ -287,8 +339,8 @@ jobs:
       conformance-artifact-prefix: openshell-conformance
 
   docker-external-driver-e2e:
-    needs: [pr_metadata, build-cli, build-conformance, build-gateway-plain, build-driver-docker, build-supervisor-image]
-    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
+    needs: [pr_metadata, build-cli, build-conformance, build-gateway-plain, build-driver-docker, build-sandbox-image, build-supervisor-image]
+    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_docker_e2e == 'true'
     permissions:
       actions: read
       contents: read
@@ -304,8 +356,8 @@ jobs:
         [{"suite":"external-driver","cmd":"mise run --no-deps --skip-deps e2e:docker:external-driver","apt_packages":"openssh-client","python_proto":false,"mcp":false}]
 
   podman-external-driver-e2e:
-    needs: [pr_metadata, build-cli, build-conformance, build-gateway-plain, build-driver-podman, build-supervisor-image]
-    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
+    needs: [pr_metadata, build-cli, build-conformance, build-gateway-plain, build-driver-podman, build-sandbox-image, build-supervisor-image]
+    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_podman_e2e == 'true'
     permissions:
       actions: read
       contents: read
@@ -321,7 +373,7 @@ jobs:
 
   vm-external-driver-e2e:
     needs: [pr_metadata, build-cli, build-conformance, build-gateway-plain, build-vm-driver]
-    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
+    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_vm_e2e == 'true'
     permissions:
       actions: read
       contents: read
@@ -334,7 +386,7 @@ jobs:
       conformance-artifact-prefix: openshell-conformance
 
   gpu-e2e:
-    needs: [pr_metadata, build-cli, build-conformance, build-gateway, build-supervisor-image]
+    needs: [pr_metadata, build-cli, build-conformance, build-gateway, build-sandbox-image, build-supervisor-image]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_gpu_e2e == 'true'
     permissions:
       actions: read
@@ -346,8 +398,8 @@ jobs:
       conformance-artifact-prefix: openshell-conformance
 
   kubernetes-e2e:
-    needs: [pr_metadata, build-cli, build-conformance, build-gateway-image, build-supervisor-image]
-    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
+    needs: [pr_metadata, build-cli, build-conformance, build-gateway-image, build-sandbox-image, build-supervisor-image]
+    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_kubernetes_e2e == 'true'
     strategy:
       fail-fast: false
       matrix:
@@ -377,8 +429,8 @@ jobs:
       conformance-artifact-prefix: openshell-conformance
 
   kubernetes-workspace-managed-e2e:
-    needs: [pr_metadata, build-cli, build-conformance, build-gateway-image, build-supervisor-image]
-    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
+    needs: [pr_metadata, build-cli, build-conformance, build-gateway-image, build-sandbox-image, build-supervisor-image]
+    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_kubernetes_e2e == 'true'
     permissions:
       actions: read
       contents: read
@@ -391,8 +443,8 @@ jobs:
       conformance-artifact-prefix: openshell-conformance
 
   kubernetes-external-driver-e2e:
-    needs: [pr_metadata, build-cli, build-conformance, build-gateway-plain, build-driver-kubernetes, build-supervisor-image]
-    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
+    needs: [pr_metadata, build-cli, build-conformance, build-gateway-plain, build-driver-kubernetes, build-sandbox-image, build-supervisor-image]
+    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_kubernetes_e2e == 'true'
     permissions:
       actions: read
       contents: read
@@ -408,8 +460,8 @@ jobs:
       conformance-artifact-prefix: openshell-conformance
 
   kubernetes-workspace-operator-e2e:
-    needs: [pr_metadata, build-cli, build-conformance, build-gateway-image, build-supervisor-image]
-    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
+    needs: [pr_metadata, build-cli, build-conformance, build-gateway-image, build-sandbox-image, build-supervisor-image]
+    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_kubernetes_e2e == 'true'
     permissions:
       actions: read
       contents: read
@@ -422,7 +474,7 @@ jobs:
       conformance-artifact-prefix: openshell-conformance
 
   kubernetes-ha-e2e:
-    needs: [pr_metadata, build-cli, build-conformance, build-gateway-image, build-supervisor-image]
+    needs: [pr_metadata, build-cli, build-conformance, build-gateway-image, build-sandbox-image, build-supervisor-image]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_kubernetes_ha_e2e == 'true'
     permissions:
       actions: read
@@ -437,7 +489,7 @@ jobs:
       conformance-artifact-prefix: openshell-conformance
 
   kubernetes-credential-drivers-e2e:
-    needs: [pr_metadata, build-cli, build-conformance, build-gateway-image, build-supervisor-image]
+    needs: [pr_metadata, build-cli, build-conformance, build-gateway-image, build-sandbox-image, build-supervisor-image]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_kubernetes_credential_drivers_e2e == 'true'
     permissions:
       actions: read
@@ -462,6 +514,7 @@ jobs:
       - uses: ./.github/actions/check-job-results
         with:
           results: ${{ toJSON(needs) }}
+          allowed-skipped-jobs: ${{ needs.pr_metadata.outputs.allowed_skipped_core_jobs }}
 
   gpu-e2e-result:
     name: GPU E2E result

.github/workflows/build-binaries.yml

@@ -33,6 +33,11 @@ on:
         required: false
         type: string
         default: ""
+      interpreter:
+        description: Expected ELF program interpreter, "none" for static, or "skip"
+        required: false
+        type: string
+        default: skip
       checkout-ref:
         required: false
         type: string
@@ -67,3 +72,4 @@ jobs:
           image-tag: ${{ inputs['image-tag'] }}
           artifact-name: ${{ inputs['artifact-name'] }}
           extra-cargo-flags: ${{ inputs['extra-cargo-flags'] }}
+          interpreter: ${{ inputs.interpreter }}