@@ -421,6 +421,16 @@ above) instead of relying only on `OPENSHELL_GATEWAY_ENDPOINT`; some tests call
 ### Kubernetes E2E Notes
 
 Use `mise run e2e:kubernetes` for the standard Helm-backed Kubernetes suite.
+For the opt-in application listener, build/import matching branch images and run
+`mise run e2e:kubernetes:app-listener`; see `e2e/kubernetes/app-listener/README.md`
+for image, topology, delivery-mode and takeover inputs. The task owns an isolated
+Helm release/namespace, temporary TLS material, in-cluster clients, teardown and
+evidence under `results/app-listener/`. It checks policy denial, dedicated Service
+selection, shared-owner takeover, gateway-outage expiry and disabled-listener
+gateway compatibility, without discovery or a proxy. CI runs four cases under
+`test:e2e` and includes them in `Core E2E result`. Its reusable kind setup installs
+pinned Calico only for this lane; other jobs retain kindnet. Local k3s already
+enforces policy. The lower-level `verify.py` can target a predeployed release.
 The kube e2e wrapper creates only one port-forward, to `svc/openshell`; it no
 longer forwards the unauthenticated health listener or runs a `/readyz` e2e
 target. `/readyz` remains covered by server unit/integration tests.
 
@@ -29,6 +29,10 @@ inputs:
     description: mise release to install
     required: false
     default: v2026.9.9
+  enforce-network-policy:
+    description: Replace kindnet with pinned Calico for NetworkPolicy assertions
+    required: false
+    default: "false"
 
 runs:
   using: composite
@@ -45,11 +49,44 @@ runs:
         REGISTRY_PASSWORD: ${{ inputs.registry-password }}
       run: echo "$REGISTRY_PASSWORD" | docker login "${REGISTRY%%/*}" -u "$REGISTRY_USERNAME" --password-stdin
 
+    - name: Configure policy-enforcing kind network
+      id: kind-config
+      if: inputs.enforce-network-policy == 'true'
+      shell: bash
+      run: |
+        set -euo pipefail
+        config="$RUNNER_TEMP/kind-network-policy.yaml"
+        cat > "$config" <<'YAML'
+        kind: Cluster
+        apiVersion: kind.x-k8s.io/v1alpha4
+        networking:
+          disableDefaultCNI: true
+          podSubnet: 10.244.0.0/16
+        YAML
+        echo "path=$config" >> "$GITHUB_OUTPUT"
+
     - name: Create kind cluster
       uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
       with:
         cluster_name: ${{ inputs.cluster-name }}
-        wait: 120s
+        # Nodes cannot become Ready until the following CNI installation.
+        wait: ${{ inputs.enforce-network-policy == 'true' && '0s' || '120s' }}
+        config: ${{ steps.kind-config.outputs.path }}
+
+    - name: Install policy-enforcing CNI
+      if: inputs.enforce-network-policy == 'true'
+      shell: bash
+      env:
+        CLUSTER_NAME: ${{ inputs.cluster-name }}
+      run: |
+        set -euo pipefail
+        curl -fsSL https://raw.githubusercontent.com/projectcalico/calico/v3.30.3/manifests/calico.yaml \
+          -o "$RUNNER_TEMP/calico.yaml"
+        sed 's@192.168.0.0/16@10.244.0.0/16@g' "$RUNNER_TEMP/calico.yaml" > "$RUNNER_TEMP/calico-kind.yaml"
+        kubectl --context "kind-$CLUSTER_NAME" apply -f "$RUNNER_TEMP/calico-kind.yaml"
+        kubectl --context "kind-$CLUSTER_NAME" -n kube-system rollout status daemonset/calico-node --timeout=300s
+        kubectl --context "kind-$CLUSTER_NAME" -n kube-system rollout status deployment/calico-kube-controllers --timeout=300s
+        kubectl --context "kind-$CLUSTER_NAME" wait nodes --all --for=condition=Ready --timeout=120s
 
     - name: Export kind kubeconfig to mise path
       shell: bash
 
@@ -447,6 +447,43 @@ jobs:
       agent-sandbox-version: ${{ matrix.agent_sandbox_version }}
       test-name: ${{ matrix.test_name }}
 
+  kubernetes-app-listener-e2e:
+    needs: [pr_metadata, build-binaries, build-images]
+    if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - topology: dedicated
+            delivery: push
+            takeover: graceful
+            name: dedicated push
+          - topology: dedicated
+            delivery: poll
+            takeover: graceful
+            name: dedicated poll
+          - topology: shared
+            delivery: push
+            takeover: graceful
+            name: shared graceful takeover
+          - topology: shared
+            delivery: push
+            takeover: abrupt
+            name: shared abrupt takeover
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+    uses: ./.github/workflows/e2e-kubernetes-test.yml
+    with:
+      image-tag: ${{ github.sha }}
+      job-name: Kubernetes app listener (${{ matrix.name }})
+      e2e-task: e2e:kubernetes:app-listener
+      enforce-network-policy: true
+      listener-topology: ${{ matrix.topology }}
+      listener-delivery: ${{ matrix.delivery }}
+      listener-takeover: ${{ matrix.takeover }}
+
   kubernetes-workspace-managed-e2e:
     needs: [pr_metadata, build-binaries, build-images]
     if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true'
@@ -535,6 +572,7 @@ jobs:
       - podman-external-driver-e2e
       - vm-external-driver-e2e
       - kubernetes-e2e
+      - kubernetes-app-listener-e2e
       - kubernetes-external-driver-e2e
       - kubernetes-workspace-managed-e2e
       - kubernetes-workspace-operator-e2e
 
@@ -77,6 +77,23 @@ on:
         required: false
         type: string
         default: "gateway sandbox supervisor"
+      enforce-network-policy:
+        description: "Install a policy-enforcing CNI for listener isolation checks"
+        required: false
+        type: boolean
+        default: false
+      listener-topology:
+        required: false
+        type: string
+        default: "dedicated"
+      listener-delivery:
+        required: false
+        type: string
+        default: "push"
+      listener-takeover:
+        required: false
+        type: string
+        default: "graceful"
 
 permissions:
   actions: read
@@ -129,6 +146,14 @@ jobs:
           registry-username: ${{ github.actor }}
           registry-password: ${{ secrets.GITHUB_TOKEN }}
           mise-version: ${{ inputs.mise-version }}
+          enforce-network-policy: ${{ inputs.enforce-network-policy }}
+
+      - name: Preload listener workload and client fixture
+        if: inputs.e2e-task == 'e2e:kubernetes:app-listener'
+        run: |
+          docker pull --platform linux/amd64 python:3.12-slim
+          docker image save --platform linux/amd64 --output "$RUNNER_TEMP/listener-python.tar" python:3.12-slim
+          kind load image-archive "$RUNNER_TEMP/listener-python.tar" --name "$KIND_CLUSTER_NAME"
 
       - name: Run Kubernetes E2E
         env:
@@ -142,4 +167,15 @@ jobs:
           IMAGE_TAG: ${{ inputs.image-tag }}
           OPENSHELL_REGISTRY: ghcr.io/nvidia/openshell
           E2E_TASK: ${{ inputs.e2e-task }}
+          OPENSHELL_E2E_APP_TOPOLOGY: ${{ inputs.listener-topology }}
+          OPENSHELL_E2E_APP_DELIVERY: ${{ inputs.listener-delivery }}
+          OPENSHELL_E2E_APP_TAKEOVER: ${{ inputs.listener-takeover }}
         run: mise run --no-deps --skip-deps "$E2E_TASK"
+
+      - name: Upload listener test evidence
+        if: always() && inputs.e2e-task == 'e2e:kubernetes:app-listener'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: listener-${{ inputs.listener-topology }}-${{ inputs.listener-delivery }}-${{ inputs.listener-takeover }}
+          path: results/app-listener/
+          if-no-files-found: warn
@@ -5,6 +5,101 @@ images. This fixture exercises the listener without discovery or the reference
 proxy. The opt-in Helm values are
 `deploy/helm/openshell/ci/values-app-listener.yaml`.
 
+## Repeatable local checks
+
+The local and CI entry point creates an isolated Helm release, temporary TLS
+Secret and client resources, runs the checks, and removes the release/namespace:
+
+```shell
+KUBECONFIG="$PWD/kubeconfig" \
+IMAGE_TAG=dev OPENSHELL_REGISTRY=openshell \
+OPENSHELL_E2E_APP_TOPOLOGY=shared \
+OPENSHELL_E2E_APP_TAKEOVER=abrupt \
+  mise run e2e:kubernetes:app-listener
+```
+
+Build and import matching `openshell/gateway:dev`, `openshell/supervisor:dev`,
+and `openshell/sandbox:dev` images first, or set the registry/tag to images
+already loaded into the cluster. Build the CLI or set `OPENSHELL_BIN` to it.
+Set `OPENSHELL_E2E_KUBE_CONTEXT` to select a context explicitly. The cluster must
+enforce NetworkPolicy; the local k3s default does. The task installs the pinned
+Agent Sandbox controller only when its CRD is absent.
+Set `OPENSHELL_E2E_KUBECONFIG` when testing a separate cluster whose kubeconfig
+differs from the repository's mise environment.
+
+`OPENSHELL_E2E_APP_TOPOLOGY` accepts `dedicated` (default) or `shared`;
+`OPENSHELL_E2E_APP_DELIVERY` accepts `push` (default) or `poll`;
+`OPENSHELL_E2E_APP_TAKEOVER` accepts `graceful` (default) or `abrupt` for shared
+supervisors. Dedicated runs include gateway-outage expiry. Every run also
+disables the listener and verifies absent app sockets/TLS mounts/Services and
+continued gateway application ingress. Logs, events, and resource summaries
+are written under `results/app-listener/`, without TLS private keys or Secrets.
+
+GitHub Actions runs four matrix cases under the existing `test:e2e` label:
+dedicated push/poll and shared graceful/abrupt takeover. These jobs use the
+reusable Kubernetes workflow, with kindnet replaced by pinned Calico for policy
+enforcement, and participate in `Core E2E result`. CI uploads the evidence even
+on failure. They still require the normal current-head `/ok to test <SHA>`
+approval mirror.
+
+### Checking an already deployed release
+
+Build the gateway, supervisor, sandbox, and CLI from the branch under test and
+deploy them through the local Helm development workflow. Use an isolated release
+namespace with gateway TLS, unauthenticated development API access, and the app
+listener enabled. Provide the application TLS Secret before installing the
+release. The workload and client fixture use `python:3.12-slim`.
+
+Run from the repository root, supplying the public application certificate/CA:
+
+```shell
+KUBECONFIG="$PWD/kubeconfig" uv run --no-project python \
+  e2e/kubernetes/app-listener/verify.py \
+  --namespace listener-review-shared \
+  --gateway-endpoint https://localhost:29203 \
+  --forward-gateway service/listener-review \
+  --app-ca /path/to/app-ca.crt \
+  --network-policy \
+  --takeover graceful
+```
+
+Use the actual namespace and gateway Service name of the test release. The
+runner maintains its API port-forward across gateway restarts; application
+traffic originates in client Pods and uses cluster networking. Application TLS
+verifies the supplied CA and hostname. The development API connection uses
+`--gateway-insecure` with an isolated temporary CLI configuration.
+
+The runner creates and cleans up its sandboxes, client Pods, public-CA ConfigMap,
+and ingress policies. It checks named/unnamed HTTP routes, public Host/Origin and
+cookies, credential stripping and explicit bearer passthrough, unknown routes,
+Host/SNI mismatch, quiet WebSockets beyond 30 seconds, selective withdrawal, and
+re-exposure without restarting the application. When dedicated app Services are
+configured, it also verifies their DNS and EndpointSlices.
+
+`--network-policy` requires an enforcing cluster network implementation, such as
+the local k3s default. A default kind cluster needs a policy-enforcing CNI before
+this assertion can establish isolation.
+
+For a two-member shared pool, `--takeover graceful` deletes the owning Pod and
+checks that its sandbox keeps its Pod UID, runtime generation, process, and
+in-memory state, while another owner's WebSocket survives. `--takeover abrupt`
+first SIGKILLs the supervisor container through the local k3d/kind node's Docker
+container, preventing a graceful leave; it requires access to that Docker engine.
+These options deliberately interrupt test resources in the supplied namespace.
+
+For dedicated topology, omit `--takeover`. Add
+`--expire-gateway statefulset/listener-review` (using the actual workload name)
+to scale the isolated gateway to zero, verify route/stream expiry, restore its
+original replica count, and check application survival. Repeat with gateway
+`config_delivery_mode` set to `push` and `poll`.
+
+The lower-level runner leaves the Helm release and TLS Secret in place. Use
+`--disabled --gateway-service <service>` instead of takeover/expiry flags to
+check an already disabled release. Configuration rejection and the additional
+deployment cleanup scenarios remain in the manual checklist below.
+
+## Manual deployment and additional scenarios
+
 Before deployment, provide an operator-owned `openshell-app-tls` Secret in the
 supervisor namespace with `tls.crt` and `tls.key` for
 `*.services.example.com`. Keep private keys outside the checkout. Allow a labeled
@@ -63,7 +158,7 @@ that it accepts its own non-controller Sandbox owner reference and has Service
 Services must be left untouched, and cleanup uses UID/resource-version
 preconditions.
 
-For HA pool validation after integration with #4864, use at least two supervisor
+For HA pool validation, use at least two supervisor
 members with distinct sandbox owners. Move one owner through graceful downscale
 and abrupt loss. Existing streams may disconnect; after selecting the new owner,
 new HTTP/WebSocket connections must work without restarting the workload.
 
@@ -0,0 +1,70 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+"""Loopback HTTP/WebSocket fixture; identity and counter survive supervisor moves."""
+
+import base64
+import hashlib
+import json
+import os
+import struct
+import uuid
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+BOOT = str(uuid.uuid4())
+
+
+class Handler(BaseHTTPRequestHandler):
+    protocol_version = "HTTP/1.1"
+    counter = 0
+
+    def do_GET(self):
+        Handler.counter += 1
+        if self.headers.get("Upgrade", "").lower() != "websocket":
+            body = json.dumps(
+                {
+                    "headers": dict(self.headers),
+                    "boot": BOOT,
+                    "pid": os.getpid(),
+                    "counter": Handler.counter,
+                }
+            ).encode()
+            self.send_response(200)
+            self.send_header("Content-Length", str(len(body)))
+            self.end_headers()
+            self.wfile.write(body)
+            return
+        # SHA-1 is mandated by the WebSocket handshake, not used for authentication.
+        accept = base64.b64encode(
+            hashlib.sha1(
+                (
+                    self.headers["Sec-WebSocket-Key"]
+                    + "258EAFA5-E914-47DA-95CA-C5AB0DC85B11"
+                ).encode(),
+                usedforsecurity=False,
+            ).digest()
+        ).decode()
+        self.send_response(101)
+        self.send_header("Upgrade", "websocket")
+        self.send_header("Connection", "Upgrade")
+        self.send_header("Sec-WebSocket-Accept", accept)
+        self.end_headers()
+        while True:
+            head = self.rfile.read(2)
+            if len(head) != 2 or head[0] & 15 == 8:
+                return
+            length = head[1] & 127
+            if length == 126:
+                length = struct.unpack("!H", self.rfile.read(2))[0]
+            if length > 125 or not head[1] & 128:
+                return  # Fixture deliberately accepts only small masked frames.
+            mask = self.rfile.read(4)
+            data = self.rfile.read(length)
+            if len(mask) != 4 or len(data) != length:
+                return
+            data = bytes(value ^ mask[i % 4] for i, value in enumerate(data))
+            self.wfile.write(bytes([0x81, len(data)]) + data)
+            self.wfile.flush()
+
+
+ThreadingHTTPServer(("127.0.0.1", 8080), Handler).serve_forever()