feat(supervisor): host concurrent sessions on session-bound runtimes

SessionHost runs several supervisor sessions in one process. Each
session gets its own Tokio runtime, and every thread that runtime starts,
plus the thread driving it, is bound to the session's OCSF context, OCSF
JSON settings, log sink, and denial log. Tasks, blocking work,
reconnects, and credential renewal spawned by a session therefore keep
its identity, while threads outside any session carry none and push no
logs. Gateway credentials stay explicit per session.

Removing a session stops its workload gracefully, or cancels it at once
while it is still starting, then shuts down only its runtime and revokes
its gateway credentials. The key stays registered until the session
thread has finished, so the same generation cannot gain a second owner
while one is stopping. A panicking session reports a failure, clears its
readiness, and is revoked the same way. Hosted sessions get a private
proxy trust directory and serve policy.local denials from their own log.

A focused test runs two sessions concurrently and checks that nested and
blocking tasks see their own identity, gateway requests carry their own
bearer, log lines reach only their own stream, and removing one leaves
the other supervising.

Closes #4699

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Author: drew

Cargo.lock

@@ -57,6 +57,11 @@ bundled-ca-roots = ["openshell-supervisor-network/bundled-ca-roots"]
 [dev-dependencies]
 openshell-sandbox-backend = { path = "../openshell-sandbox-backend", features = ["test-support"] }
 
+bytes = { workspace = true }
+http = { workspace = true }
+http-body-util = { workspace = true }
+hyper = { workspace = true }
+hyper-util = { workspace = true }
 tokio = { workspace = true, features = ["test-util"] }
 futures = { workspace = true }
 temp-env = "0.3"

crates/openshell-supervisor/Cargo.toml

@@ -40,6 +40,24 @@ readiness, and stops the session on SIGTERM or SIGINT. The binary shares one
 `GatewayCredentials` between log push and supervision, so renewal by either
 keeps both current.
 
+`session_host::SessionHost` runs several sessions in one process. Each session
+gets its own Tokio runtime; every thread of that runtime, and the thread
+driving it, is bound to the session's OCSF context, OCSF JSON settings, log
+sink, and denial log. Spawned tasks, blocking work, callbacks, reconnects, and
+renewal therefore inherit the session's identity, and threads outside a
+session carry none and push no logs. The OCSF context also supplies the
+sandbox identity in middleware requests.
+
+Removing a session stops its workload, shuts down only its runtime, and
+revokes its gateway credentials; the key stays registered until the session's
+thread has finished. A session that panics reports a failure and is revoked
+the same way. A session that is still starting is cancelled at once; the
+sandbox runtime then loses supervision and fails closed, as it does when a
+dedicated supervisor exits. A hosted session without an explicit proxy trust
+directory receives a private one for its lifetime. Hosted processes must
+install `LogPushLayer::thread_bound` and an `OcsfShorthandLayer` writing to
+`SessionDenialWriter`.
+
 ## Console logging
 
 Diagnostics and OCSF shorthand share a bounded, nonblocking stderr writer. With `ocsf_json_enabled=true`, the same writer also receives timestamped `OCSF-JSON` records. Each formatter submits a complete line in one write so concurrent producers cannot interleave records in the queue. The 1,024-line queue drops new lines when full rather than waiting for stderr.

crates/openshell-supervisor/README.md

@@ -23,6 +23,7 @@ mod denial_aggregator;
 mod endpoint_status;
 mod mechanistic_mapper;
 mod provider_readiness;
+pub mod session_host;
 
 use miette::{IntoDiagnostic, Result, WrapErr};
 use std::future::Future;