feat: define process identity across supervisor topologies #2291

Problem Statement

Process-aware network policy currently overloads entrypoint_pid as both a namespace/rootfs reference and an ancestry boundary. That assumption does not hold for every supported or planned topology:

• SSH exec commands are spawned by openshell-sandbox and are siblings of the configured entrypoint.
• Entrypoints can exit, daemonize, or reparent descendants.
• The VM backend can place runtime init above the supervisor.
• Split process/network supervisors may not share a PID namespace at all.

This caused #1998: the VM ancestry walk passed the configured entrypoint, reached /init.krun, and denied otherwise allowed egress when integrity verification could not stat that runtime-owned executable. Fixing only that topology would leave the identity contract undefined for split supervisors and future runtimes.

Proposed Design

Introduce an explicit process-identity model with separate responsibilities:

1. namespace_reference identifies the process whose /proc/<pid>/root, network namespace, and procfs views are used. The configured entrypoint may fill this role while it is alive, but it is not automatically a trust root.
2. process_trust_anchor identifies the verified process-side OpenShell supervisor for a shared PID namespace. An ancestry walk must reach this anchor and fail closed if it does not.
3. A process reference includes PID-reuse protection, using a pidfd where available or PID plus process start time, and verifies the running executable through /proc/<pid>/exe rather than trusting argv or a pathname alone.
4. The process-side supervisor becomes a child subreaper before spawning workloads so daemonized descendants remain attributable to its tree. The design must explicitly address CLONE_PARENT and equivalent escape paths.
5. Combined and shared-PID topologies use local procfs ancestry. Split topologies do not pretend that a cross-namespace PID is meaningful: the process-side supervisor produces authenticated process identity/decision context for the network-side supervisor over the internal control channel.
6. Each inspected PID namespace has one authoritative process-side trust anchor. Multiple supervisor components are represented by topology roles and authenticated delegation, not by a global allowlist of trusted PIDs.
7. Policy evaluation records whether identity came from local procfs ancestry or authenticated delegated attribution, and retains fail-closed behavior when the configured strategy is unavailable.

The topology/orchestration context should carry these identities explicitly, for example as a ProcessIdentityContext enum for shared-PID and delegated modes. ProxyContext and SshSessionContext from #2003 are natural consumers, while the topology work in #1810 is the natural producer.

Tests should cover combined Docker/Kubernetes, VM, SSH exec sibling processes, daemonized/reparented processes, PID reuse, supervisor replacement, and split process/network supervisors.

Alternatives Considered

• Stop at entrypoint_pid: incomplete because SSH exec commands are siblings of the entrypoint, and entrypoints can exit or daemonize.
• Trust or skip PID 1 globally: couples security semantics to a runtime implementation detail and can weaken unrelated drivers.
• Accept multiple trusted supervisor PIDs: increases the trust surface, does not solve PID reuse, and is meaningless across PID namespaces.
• Make the supervisor PID 1 in every driver: useful for the VM combined topology, but does not address split supervisors or cross-namespace attribution.
• Verify only the supervisor pathname: pathnames and argv are insufficient identity; verification must bind to the running process and executable inode/content.

Agent Investigation

• Reproduced bug: vm driver denies allowed network egress due to /init.krun ancestor integrity failure #1998 in the VM topology: /init.krun is PID 1, openshell-sandbox is its child, and an SSH command is a supervisor child rather than an entrypoint descendant.
• Confirmed both PTY and non-PTY SSH exec paths independently spawn shells in openshell-supervisor-process; see bug(sandbox): SSH exec hardcodes /bin/bash and breaks BYOC images without Bash #2290.
• Found cleanup(supervisor-*): Cleanup supervisor crates & prepare for split-pod topology #1810 tracks combined, network-only, and process-only supervisor modes but does not define an ancestry trust contract.
• Found Proposal: Split Supervisor and Agent into Separate Pods with gVisor Isolation #981 explicitly loses per-binary procfs enforcement when the network and process supervisors do not share a PID namespace.
• Found fix(sandbox): eliminate startup stale-policy forward proxy race #1942 demonstrates that entrypoint_pid is also used for namespace/rootfs policy readiness, reinforcing the need for separate identities.
• Found feat: support custom sandbox entrypoint command #848 allows arbitrary entrypoints while later commands continue through sandbox exec.
• Exact open-issue searches found no existing proposal for a verified supervisor anchor, subreaper-based attribution, or multiple supervisor identities.

Related: #1998, #1810, #981, #1942, #2003, #848, #2290.

Checklist

• I have reviewed existing issues and the architecture docs
• This is a design proposal, not a please build this request