@@ -21,6 +21,18 @@ Windows MSVC for the supported deliverables:
 It intentionally does not make Windows a Docker, Kubernetes, Podman, or VM
 runtime host.
 
+The supervisor and supervisor-process libraries participate in native Windows
+checks and tests. Their gateway session, boundary attachment, and TCP readiness
+are portable; only the optional Unix SSH/readiness socket adapters are gated.
+This is compile and control-plane coverage, not Windows isolation qualification.
+Preserve readiness gating on authenticated gateway acceptance and reconnection.
+The supervisor process-access multiplexer consumes boundary-provided streams;
+do not restore local PID, PTY, or process-group operations there. Native process
+mechanics belong to the sandbox or isolation backend. Keep the optional Unix
+SSH access adapter separate from portable session orchestration.
+Shared Sandbox Protocol audit validation defaults to strict Linux evidence;
+concrete platform validators must be selected by the implementing backend.
+
 ## Current Repository Shape
 
 The Windows build lane is implemented by these tracked files:
 
@@ -111,8 +111,6 @@ top-level workspace targets for check/test:
 --exclude openshell-driver-vault
 --exclude openshell-driver-vm
 --exclude openshell-sandbox
---exclude openshell-supervisor
---exclude openshell-supervisor-process
 --exclude openshell-vfio
 ```
 
@@ -124,6 +122,10 @@ egress proxy. The Kubernetes Secrets and Vault libraries still compile as
 gateway dependencies; only their standalone Unix-socket binaries and
 package-level tests are excluded as top-level targets.
 
+The supervisor and supervisor-process packages now participate as top-level
+native check/test targets. Their portable session, attachment, and TCP readiness
+coverage does not enable a Windows isolation runtime.
+
 ## Common Errors
 
 ### Unix imports leak into Windows builds
 
@@ -891,6 +891,47 @@ pub fn parse_env_pairs(items: &[String]) -> Result<HashMap<String, String>> {
     Ok(map)
 }
 
+/// Resolve `--env-from KEY[=ENVVAR]` values from the CLI process environment.
+///
+/// This keeps environment values out of process arguments while preserving the
+/// same sandbox environment validation as `--env KEY=VALUE`.
+pub fn parse_env_from_pairs(items: &[String]) -> Result<HashMap<String, String>> {
+    let mut map = HashMap::new();
+
+    for item in items {
+        let (key, env_name) = match item.split_once('=') {
+            Some((key, env_name)) => (key.trim(), env_name.trim()),
+            None => (item.trim(), item.trim()),
+        };
+        if !is_valid_env_name(key) {
+            return Err(miette::miette!(
+                "--env-from key must match [A-Za-z_][A-Za-z0-9_]*; got '{key}'"
+            ));
+        }
+        if key.starts_with("OPENSHELL_") {
+            return Err(miette::miette!(
+                "--env-from keys starting with OPENSHELL_ are reserved; got '{key}'"
+            ));
+        }
+        if !is_valid_env_name(env_name) {
+            return Err(miette::miette!(
+                "--env-from source must match [A-Za-z_][A-Za-z0-9_]*; got '{env_name}'"
+            ));
+        }
+        if map.contains_key(key) {
+            return Err(miette::miette!("duplicate --env-from sandbox key '{key}'"));
+        }
+        let value = std::env::var(env_name).map_err(|_| {
+            miette::miette!(
+                "--env-from source environment variable '{env_name}' is not set or is not valid Unicode"
+            )
+        })?;
+        map.insert(key.to_string(), value);
+    }
+
+    Ok(map)
+}
+
 /// Resolve `--secret-material-env KEY[=ENVVAR]` values from the CLI process
 /// environment (`ENVVAR` defaults to `KEY`) so secrets never transit argv.
 pub fn parse_secret_material_env_pairs(items: &[String]) -> Result<HashMap<String, String>> {
 
@@ -1452,7 +1452,7 @@ enum SandboxCommands {
         name: Option<String>,
 
         /// Create the sandbox from a named sandbox template.
-        #[arg(long, conflicts_with_all = ["from", "gpu", "cpu", "memory", "driver_config_json", "envs"])]
+        #[arg(long, conflicts_with_all = ["from", "gpu", "cpu", "memory", "driver_config_json", "envs", "env_from"])]
         template: Option<String>,
 
         /// Sandbox source: a rootfs tar archive (`.tar`, `.tar.gz`, or `.tgz`)
@@ -1597,6 +1597,13 @@ enum SandboxCommands {
         #[arg(long = "env", value_name = "KEY=VALUE")]
         envs: Vec<String>,
 
+        /// Set a sandbox environment variable from the CLI process environment.
+        ///
+        /// Format: `KEY[=ENVVAR]`. When `ENVVAR` is omitted, `KEY` is used.
+        /// The value does not appear in the CLI process arguments. Repeatable.
+        #[arg(long = "env-from", value_name = "KEY[=ENVVAR]")]
+        env_from: Vec<String>,
+
         /// Suppress warnings when --env values look like credentials.
         #[arg(long = "no-credential-warnings")]
         no_credential_warnings: bool,
@@ -3372,6 +3379,7 @@ async fn run_async() -> Result<()> {
                     no_auto_providers,
                     labels,
                     envs,
+                    env_from,
                     no_credential_warnings,
                     approval_mode,
                     output,
@@ -3409,7 +3417,12 @@ async fn run_async() -> Result<()> {
                     }
 
                     // Parse --env flags into a HashMap<String, String>.
-                    let env_map = run::parse_env_pairs(&envs)?;
+                    let mut env_map = run::parse_env_pairs(&envs)?;
+                    for (key, value) in run::parse_env_from_pairs(&env_from)? {
+                        if env_map.insert(key.clone(), value).is_some() {
+                            return Err(miette::miette!("duplicate environment key '{key}'"));
+                        }
+                    }
 
                     // Parse --upload specs into [(local_path, sandbox_path, git_ignore)].
                     let upload_specs: Vec<(String, Option<String>, bool)> = upload
 
@@ -4,8 +4,8 @@
 //! CLI command implementations.
 
 pub use crate::commands::common::{
-    PolicyGetView, parse_credential_expiry_cli_value, parse_env_pairs, parse_key_value_pairs,
-    parse_secret_material_env_pairs, warn_credential_env_vars,
+    PolicyGetView, parse_credential_expiry_cli_value, parse_env_from_pairs, parse_env_pairs,
+    parse_key_value_pairs, parse_secret_material_env_pairs, warn_credential_env_vars,
 };
 use crate::commands::common::{
     ProvisioningDisplay, ProvisioningStep, confirm_global_setting_delete,
@@ -6911,12 +6911,12 @@ mod tests {
         ForwardTcpConnectionError, PolicyGetView, ProvisioningStep, build_sandbox_resource_limits,
         format_endpoint, format_log_line, forward_requires_session_token, git_sync_files,
         has_main_process_result, parse_cli_setting_value, parse_credential_expiry_cli_value,
-        parse_driver_config_json, parse_secret_material_env_pairs, policy_revision_list_json,
-        policy_revision_to_json, proto_execution_timeout, provisioning_timeout_message,
-        ready_false_condition_message, relay_local_socket, resolve_from,
-        rootfs_tar_sources_supported_for_gateway, sandbox_should_persist, sandbox_upload_plan,
-        service_endpoint_to_json, service_status_error, service_url_for_gateway,
-        workspace_member_to_json,
+        parse_driver_config_json, parse_env_from_pairs, parse_secret_material_env_pairs,
+        policy_revision_list_json, policy_revision_to_json, proto_execution_timeout,
+        provisioning_timeout_message, ready_false_condition_message, relay_local_socket,
+        resolve_from, rootfs_tar_sources_supported_for_gateway, sandbox_should_persist,
+        sandbox_upload_plan, service_endpoint_to_json, service_status_error,
+        service_url_for_gateway, workspace_member_to_json,
     };
     use openshell_core::proto::TcpForwardFrame;
 
@@ -7181,6 +7181,57 @@ mod tests {
             });
     }
 
+    #[test]
+    fn parse_env_from_pairs_reads_named_and_same_name_environment_variables() {
+        Environment::new()
+            .set("NAV_PARSE_ENV_FROM_NAMED", "named-value")
+            .set("NAV_PARSE_ENV_FROM_SAME", "same-name-value")
+            .run(|| {
+                let parsed = parse_env_from_pairs(&[
+                    "SANDBOX_NAMED=NAV_PARSE_ENV_FROM_NAMED".to_string(),
+                    "NAV_PARSE_ENV_FROM_SAME".to_string(),
+                ])
+                .expect("parse");
+                assert_eq!(
+                    parsed.get("SANDBOX_NAMED"),
+                    Some(&"named-value".to_string())
+                );
+                assert_eq!(
+                    parsed.get("NAV_PARSE_ENV_FROM_SAME"),
+                    Some(&"same-name-value".to_string())
+                );
+            });
+    }
+
+    #[test]
+    fn parse_env_from_pairs_rejects_missing_invalid_reserved_and_duplicate_keys() {
+        Environment::new()
+            .remove("NAV_PARSE_ENV_FROM_MISSING")
+            .set("NAV_PARSE_ENV_FROM_PRESENT", "value")
+            .run(|| {
+                for (input, expected) in [
+                    ("TARGET=NAV_PARSE_ENV_FROM_MISSING", "is not set"),
+                    ("1BAD=NAV_PARSE_ENV_FROM_PRESENT", "key must match"),
+                    ("TARGET=BAD-NAME", "source must match"),
+                    ("OPENSHELL_RESERVED=NAV_PARSE_ENV_FROM_PRESENT", "reserved"),
+                ] {
+                    let error =
+                        parse_env_from_pairs(&[input.to_string()]).expect_err("must reject");
+                    assert!(
+                        error.to_string().contains(expected),
+                        "unexpected error: {error}"
+                    );
+                }
+
+                let error = parse_env_from_pairs(&[
+                    "TARGET=NAV_PARSE_ENV_FROM_PRESENT".to_string(),
+                    "TARGET=NAV_PARSE_ENV_FROM_PRESENT".to_string(),
+                ])
+                .expect_err("duplicate must reject");
+                assert!(error.to_string().contains("duplicate --env-from"));
+            });
+    }
+
     #[test]
     fn parse_secret_material_env_pairs_reads_value_from_named_environment_variable() {
         Environment::new()
 
@@ -3333,6 +3333,16 @@ async fn run_cli_sandbox_create_with_xdg(
     xdg_dir: &TempDir,
     name: &str,
     extra_args: &[&str],
+) -> std::process::Output {
+    run_cli_sandbox_create_with_xdg_and_env(server, xdg_dir, name, extra_args, &[]).await
+}
+
+async fn run_cli_sandbox_create_with_xdg_and_env(
+    server: &TestServer,
+    xdg_dir: &TempDir,
+    name: &str,
+    extra_args: &[&str],
+    environment: &[(&str, &str)],
 ) -> std::process::Output {
     let mut cmd = tokio::process::Command::new(env!("CARGO_BIN_EXE_openshell"));
     for (key, _) in std::env::vars().filter(|(k, _)| k.starts_with("OPENSHELL_")) {
@@ -3351,6 +3361,7 @@ async fn run_cli_sandbox_create_with_xdg(
         "--no-auto-providers",
     ])
     .args(extra_args)
+    .envs(environment.iter().copied())
     .env("XDG_CONFIG_HOME", xdg_dir.path())
     .env("HOME", xdg_dir.path())
     .env("OPENSHELL_PROVISION_TIMEOUT", "5")
@@ -3488,6 +3499,47 @@ async fn sandbox_create_upload_warns_and_reaches_ssh_outside_git_repository() {
         .await;
 }
 
+async fn run_cli_sandbox_create_with_env(
+    server: &TestServer,
+    name: &str,
+    extra_args: &[&str],
+    environment: &[(&str, &str)],
+) -> std::process::Output {
+    let xdg_dir = helpers::tempdir().unwrap();
+    prepare_cli_xdg(server, &xdg_dir);
+    run_cli_sandbox_create_with_xdg_and_env(server, &xdg_dir, name, extra_args, environment).await
+}
+
+#[tokio::test]
+async fn sandbox_create_env_from_reaches_request() {
+    let server = run_server().await;
+    let value = "qualification-value-not-in-argv";
+
+    let output = run_cli_sandbox_create_with_env(
+        &server,
+        "env-from-test",
+        &["--env-from", "SANDBOX_VALUE=HOST_VALUE", "--output=json"],
+        &[("HOST_VALUE", value)],
+    )
+    .await;
+    assert!(
+        output.status.success(),
+        "sandbox create failed: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+
+    let requests = create_requests(&server).await;
+    let environment = &requests[0]
+        .spec
+        .as_ref()
+        .expect("spec should be present")
+        .environment;
+    assert_eq!(
+        environment.get("SANDBOX_VALUE").map(String::as_str),
+        Some(value)
+    );
+}
+
 async fn run_cli_sandbox_template_create(
     server: &TestServer,
     name: &str,
 
@@ -57,6 +57,24 @@ pub fn openshell_state_dir() -> Result<PathBuf> {
     Ok(xdg_state_dir()?.join("openshell"))
 }
 
+/// Platform default for gateway audit files. Sink configuration and writing
+/// remain portable; only the directory convention depends on the host.
+pub fn gateway_audit_log_dir() -> PathBuf {
+    #[cfg(target_os = "windows")]
+    {
+        if let Some(directory) = std::env::var_os("ProgramData") {
+            return PathBuf::from(directory).join("OpenShell").join("logs");
+        }
+        std::env::temp_dir().join("openshell").join("logs")
+    }
+    #[cfg(not(target_os = "windows"))]
+    {
+        openshell_state_dir()
+            .unwrap_or_else(|_| std::env::temp_dir().join("openshell"))
+            .join("logs")
+    }
+}
+
 /// Resolve the XDG data base directory.
 ///
 /// Returns `$XDG_DATA_HOME` if set, otherwise `$HOME/.local/share`.
 
@@ -442,6 +442,18 @@ impl ProviderCredentialState {
             .requires_stable_placeholders
     }
 
+    /// Whether this snapshot contains endpoint-bound material that must be
+    /// resolved by a network proxy rather than exposed to the child process.
+    #[must_use]
+    pub fn requires_proxy_resolution(&self) -> bool {
+        let inner = self
+            .inner
+            .read()
+            .expect("provider credential state poisoned");
+        !inner.static_credential_bindings.is_empty()
+            || !inner.current.dynamic_credentials.is_empty()
+    }
+
     /// Remove a key from the credential snapshot's child env.
     ///
     /// Used when a sandbox-side service (e.g., metadata server) fails to start
 
@@ -857,7 +857,7 @@ pub trait BoundaryLoopbackConnector: Send + Sync {
 /// that owns a connection or one of its executable ancestors. A missing digest
 /// is `None`, never an empty value; binary-scoped policy cannot authorize an
 /// executable whose digest is unavailable.
-#[derive(Debug, Clone, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct ExecutableIdentity {
     /// Absolute executable path in the workload filesystem namespace.
     pub path: PathBuf,
@@ -871,7 +871,7 @@ pub struct ExecutableIdentity {
 ///
 /// How a backend resolves identity is private to that backend; the shape and
 /// fail-closed semantics do not change.
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct BinaryIdentity {
     /// Executable that owns the accepted connection.
     pub executable: ExecutableIdentity,