@@ -173,7 +173,7 @@ Common findings:
 - Gateway process stopped: inspect exit status and logs.
 - Sandbox image missing or pull denied: verify image reference and registry credentials.
 - Sandbox fails before readiness with an identity-resolution error: inspect the image's OCI `USER` and matching `/etc/passwd` and `/etc/group` entries, or explicitly set both process identity fields in policy. Root and missing identities are rejected.
-- Docker driver cannot initialize because it cannot find `openshell-sandbox`: verify `OPENSHELL_DOCKER_SUPERVISOR_BIN`, the sibling binary next to `openshell-gateway`, or the configured supervisor image contains `/openshell-sandbox`.
+- Docker driver cannot initialize because it cannot find `openshell-sandbox` or its trusted helper runtime: verify `OPENSHELL_DOCKER_SUPERVISOR_BIN`, the sibling binary next to `openshell-gateway`, and that the configured supervisor image contains both `/openshell-sandbox` and `/openshell-runtime`. A local supervisor binary without a valid sibling `openshell-runtime` still requires the image as the runtime source.
 - Sandbox never registers: check gateway logs and supervisor callback endpoint.
 - Supervisor image exits before printing `openshell-sandbox --version`: the image should be the scratch supervisor image from `deploy/docker/Dockerfile.supervisor` and must contain a static executable at `/openshell-sandbox`.
 - `mise run e2e:docker:gpu` fails with `docker info --format json did not report any discovered NVIDIA CDI GPU devices`: Docker may report `CDISpecDirs` while still having no generated NVIDIA CDI specs. Verify `.DiscoveredDevices` contains entries such as `nvidia.com/gpu=all`, verify `/etc/cdi` or `/var/run/cdi` contains a generated NVIDIA spec, and check that `nvidia-cdi-refresh.service` and `nvidia-cdi-refresh.path` from NVIDIA Container Toolkit are enabled and healthy. The service is a one-shot unit, so `inactive (dead)` can be normal after a successful run; use `systemctl status` and `journalctl` to distinguish success from a skipped or failed refresh. NVIDIA recommends enabling the path and service units, and restarting `nvidia-cdi-refresh.service` to regenerate missing or stale CDI specs. If specs are generated but Docker still reports no discovered devices, restart Docker or reload the daemon and re-check `docker info`.
@@ -355,6 +355,20 @@ kubectl -n openshell get configmap openshell-config -o jsonpath='{.data.gateway\
 kubectl -n <sandbox-namespace> get sandbox <sandbox-name> -o jsonpath='{.spec.template.spec.serviceAccountName}{"\n"}'
 ```
 
+For the RFC 0012 co-located backend, verify the trusted topology and confirm the
+driver placed the descriptor in the supervisor command rather than
+workload-controlled arguments:
+
+```bash
+helm -n openshell get values openshell | grep topology
+kubectl -n openshell get configmap openshell-config -o jsonpath='{.data.gateway\.toml}' | grep -E '^topology\s*='
+kubectl -n <sandbox-namespace> get pod <sandbox-pod> -o jsonpath='{.spec.containers[?(@.name=="agent")].command}{"\n"}'
+```
+
+Combined topology selects the in-pod backend; sidecar topology remains on its
+separate lifecycle. A combined pod command should include the driver-supplied
+topology descriptor arguments.
+
 If `topology = "sidecar"` is rendered under `[openshell.drivers.kubernetes]`,
 sandbox pods should have an `openshell-network-init` init container running
 `--mode=network-init`, an `agent` container running
 
@@ -65,6 +65,9 @@ mise run helm:skaffold:run
 mise run helm:skaffold:run:sidecar
 ```
 
+Combined topology selects RFC 0012's in-pod backend and supplies its descriptor;
+sidecar topology remains on its separate lifecycle.
+
 **Supervisor sidecar topology with TLS/mTLS enabled** (build once and leave running):
 ```bash
 mise run helm:skaffold:run:sidecar-mtls
 
@@ -139,6 +139,61 @@ jobs:
           fi
           exit 0
 
+  isolation-conformance:
+    name: Isolation conformance (privileged Linux)
+    needs: pr_metadata
+    if: needs.pr_metadata.outputs.should_run == 'true'
+    runs-on: linux-amd64-cpu8
+    timeout-minutes: 20
+    container:
+      image: ghcr.io/nvidia/openshell/ci:latest
+      options: --privileged
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install tools and network helpers
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends iproute2 nftables iptables util-linux
+          mise install --locked
+
+      - name: Materialize the Alpine trusted helper runtime fixture
+        run: |
+          alpine_root="${RUNNER_TEMP}/openshell-alpine-root"
+          runtime="${RUNNER_TEMP}/openshell-runtime"
+          archive="${RUNNER_TEMP}/alpine-minirootfs.tar.gz"
+          curl -fsSL \
+            https://dl-cdn.alpinelinux.org/alpine/v3.22/releases/x86_64/alpine-minirootfs-3.22.5-x86_64.tar.gz \
+            -o "$archive"
+          echo "4b4daa9fe2fc696c4919c4412a4c3d3e770d8fb70292a004a2c72f5096175282  $archive" \
+            | sha256sum -c -
+          mkdir -p "$alpine_root" "$runtime"
+          tar -xzf "$archive" -C "$alpine_root"
+          cp /etc/resolv.conf "$alpine_root/etc/resolv.conf"
+          chroot "$alpine_root" /sbin/apk add --no-cache \
+            iproute2 nftables iptables iptables-legacy
+          for path in /bin /sbin /lib /lib64 /usr/bin /usr/sbin /usr/lib /usr/lib64 /etc/iproute2 /usr/share/nftables; do
+            if [ -e "$alpine_root$path" ]; then
+              (cd "$alpine_root" && cp -aL --parents ".$path" "$runtime")
+            fi
+          done
+          chmod -R go-w "$runtime"
+
+      - name: Exercise the live default-deny ceiling
+        run: |
+          cargo test -p openshell-isolation -p openshell-supervisor-process \
+            -p openshell-supervisor-network -p openshell-sandbox
+          OPENSHELL_TEST_TRUSTED_RUNTIME_ROOT="${RUNNER_TEMP}/openshell-runtime" \
+            cargo test -p openshell-supervisor-process \
+            installed_egress_ceiling_ -- \
+            --ignored --nocapture --test-threads=1
+          cargo test -p openshell-sandbox \
+            pid_one_exit_kills_unregistered_setsid_descendant_within_bound -- \
+            --ignored --nocapture --test-threads=1
+
   rust-macos:
     name: Rust lint (macOS)
     needs: pr_metadata
 
@@ -116,6 +116,8 @@ jobs:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
       options: --privileged
+      volumes:
+        - /var/run/docker.sock:/var/run/docker.sock
     env:
       MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       OPENSHELL_IMAGE_TAG: ${{ inputs['image-tag'] }}
@@ -141,8 +143,12 @@ jobs:
           cache-directories: .cache/sccache
           cache-targets: "true"
 
-      - name: Install zstd
-        run: apt-get update && apt-get install -y --no-install-recommends zstd && rm -rf /var/lib/apt/lists/*
+      - name: Install zstd and verify Docker
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends zstd
+          rm -rf /var/lib/apt/lists/*
+          docker info
 
       - name: Download kernel runtime tarball
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -168,14 +174,14 @@ jobs:
       - name: Verify embedded driver inputs
         run: |
           set -euo pipefail
-          for file in libkrun.so.zst libkrunfw.so.5.zst gvproxy.zst umoci.zst openshell-sandbox.zst; do
+          for file in libkrun.so.zst libkrunfw.so.5.zst gvproxy.zst umoci.zst openshell-sandbox.zst openshell-runtime.tar.zst; do
             test -s "target/vm-runtime-compressed/${file}"
           done
 
       - name: Scope workspace to driver-vm crates
         run: |
           set -euo pipefail
-          sed -i 's|members = \["crates/\*"\]|members = ["crates/openshell-driver-vm", "crates/openshell-core"]|' Cargo.toml
+          sed -i 's|members = \["crates/\*"\]|members = ["crates/openshell-driver-vm", "crates/openshell-core", "crates/openshell-isolation"]|' Cargo.toml
 
       - name: Patch workspace version
         if: ${{ inputs['cargo-version'] != '' }}
 
@@ -75,6 +75,8 @@ jobs:
       credentials:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
+      volumes:
+        - /var/run/docker.sock:/var/run/docker.sock
     env:
       MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       OPENSHELL_IMAGE_TAG: ${{ inputs['image-tag'] }}
@@ -100,8 +102,12 @@ jobs:
           cache-directories: .cache/sccache
           cache-targets: "true"
 
-      - name: Install zstd
-        run: apt-get update && apt-get install -y --no-install-recommends zstd && rm -rf /var/lib/apt/lists/*
+      - name: Install zstd and verify Docker
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends zstd
+          rm -rf /var/lib/apt/lists/*
+          docker info
 
       - name: Build bundled supervisor
         run: |
@@ -116,7 +122,9 @@ jobs:
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: driver-vm-supervisor-arm64
-          path: target/vm-runtime-compressed/openshell-sandbox.zst
+          path: |
+            target/vm-runtime-compressed/openshell-sandbox.zst
+            target/vm-runtime-compressed/openshell-runtime.tar.zst
           retention-days: 1
 
   build-driver-vm-macos:
@@ -180,12 +188,13 @@ jobs:
         run: |
           set -euo pipefail
           test -f target/vm-runtime-compressed-macos/openshell-sandbox.zst
-          ls -lh target/vm-runtime-compressed-macos/openshell-sandbox.zst
+          test -f target/vm-runtime-compressed-macos/openshell-runtime.tar.zst
+          ls -lh target/vm-runtime-compressed-macos/openshell-{sandbox,runtime.tar}.zst
 
       - name: Verify embedded driver inputs
         run: |
           set -euo pipefail
-          for file in libkrun.dylib.zst libkrunfw.5.dylib.zst gvproxy.zst umoci.zst openshell-sandbox.zst; do
+          for file in libkrun.dylib.zst libkrunfw.5.dylib.zst gvproxy.zst umoci.zst openshell-sandbox.zst openshell-runtime.tar.zst; do
             test -s "target/vm-runtime-compressed-macos/${file}"
           done
 
 
@@ -96,11 +96,13 @@ Runtime layout:
   as a release artifact. Linux GNU VM driver binaries must not reference
   `GLIBC_*` symbols newer than `GLIBC_2.28`; release workflows verify this
   before publishing artifacts.
-- **Supervisor**: Alpine base with `nftables`, static musl binary at
-  `/openshell-sandbox`. Static linkage keeps the binary usable when the image
-  is mounted/extracted into sandbox environments (Docker extraction, Podman
-  image volumes, Kubernetes init-container copy-self), while `nftables` supports
-  Kubernetes supervisor sidecar egress enforcement.
+- **Supervisor**: Alpine base with a static musl binary at
+  `/openshell-sandbox` and a materialized, driver-controlled network-helper
+  runtime at `/openshell-runtime`. Kubernetes mounts or copies both into
+  workload containers so boundary setup never executes helpers supplied by a
+  workload image. Podman mounts the same image runtime, Docker extracts it to
+  a digest-keyed read-only bind mount, and the VM supervisor build embeds it
+  beside the guest supervisor.
 
 Gateway image builds bake the corresponding supervisor image tag into the
 gateway binary so Docker sandboxes do not depend on `:latest` by default.
 
@@ -49,6 +49,34 @@ OpenShell uses overlapping controls rather than a single sandbox primitive:
 The supervisor may enrich baseline filesystem allowances for runtime-required
 paths, such as proxy support files or GPU device paths when a GPU is present.
 
+## Isolation Backend
+
+[RFC 0012](../rfc/0012-isolation-backend/README.md) defines the Isolation
+Backend contract for topology-specific boundary construction and process
+operations. The contract uses consuming
+lifecycle states (`attach` → `Bound` → `confirm` → `Ready` → `start_agent` →
+`Running`) so untrusted workload execution cannot begin before standing
+enforcement is confirmed.
+
+The logical supervisor remains the trusted bridge between the gateway and the
+workload. It drives the backend and applies approved network policy through
+supervisor-owned mediation; the backend routes workload egress to that
+mediation. The trusted Kubernetes driver selects the co-located backend for
+combined topology and supplies its topology descriptor to the supervisor.
+Sidecar topology remains on its pre-RFC lifecycle; a conforming backend for
+that placement requires separate design and implementation. Docker, Podman,
+and VM drivers provision the same co-located topology and supply its descriptor
+by default. The co-located backend requires the
+supervisor to own the execution environment's PID namespace so boundary
+teardown can terminate every remaining workload process.
+
+For proxy-mode boundaries, the co-located backend verifies its default-deny
+kernel egress ceiling before exposing any workload execution surface and then
+rechecks it every 250 milliseconds. Each check has a two-second deadline.
+Verification failure or timeout ends the boundary and triggers process cleanup;
+the PID-1 supervisor exits so the kernel terminates the complete workload PID
+namespace. The topology's detection-and-termination bound is five seconds.
+
 ## Network and Inference
 
 All ordinary agent egress is routed through the sandbox proxy. The proxy
 
@@ -30,6 +30,7 @@ const RESERVED_MOUNT_TARGETS: &[&str] = &[
     "/etc/openshell",
     "/etc/openshell-tls",
     "/run/netns",
+    "/proc",
 ];
 
 /// Validate a non-empty driver mount source.
@@ -118,9 +119,11 @@ pub fn validate_container_mount_target(target: &str) -> Result<(), String> {
         return Err("mount target '/sandbox' is reserved for the OpenShell workspace".to_string());
     }
     for reserved in RESERVED_MOUNT_TARGETS {
-        if path_is_or_under(path, Path::new(reserved)) {
+        let reserved = Path::new(reserved);
+        if path_is_or_under(path, reserved) || path_is_or_under(reserved, path) {
             return Err(format!(
-                "mount target '{target}' conflicts with reserved OpenShell path '{reserved}'"
+                "mount target '{target}' conflicts with reserved OpenShell path '{}'",
+                reserved.display()
             ));
         }
     }
@@ -171,6 +174,24 @@ mod tests {
         assert!(err.contains("/etc/openshell"));
     }
 
+    #[test]
+    fn container_target_rejects_parents_that_shadow_reserved_trees() {
+        for target in ["/opt", "/etc", "/run"] {
+            let err = validate_container_mount_target(target).unwrap_err();
+            assert!(
+                err.contains("reserved OpenShell path"),
+                "expected {target} to be rejected: {err}"
+            );
+        }
+    }
+
+    #[test]
+    fn container_target_rejects_proc_shadowing() {
+        for target in ["/proc", "/proc/self", "/"] {
+            assert!(validate_container_mount_target(target).is_err());
+        }
+    }
+
     #[test]
     fn container_target_does_not_prefix_match_unrelated_paths() {
         validate_container_mount_target("/etc/openshell-tools").unwrap();
 
@@ -12,6 +12,7 @@ repository.workspace = true
 
 [dependencies]
 openshell-core = { path = "../openshell-core", default-features = false }
+openshell-isolation = { path = "../openshell-isolation" }
 
 tokio = { workspace = true }
 tonic = { workspace = true }