@@ -13,14 +13,17 @@ repository.workspace = true
 [dependencies]
 prost = { workspace = true }
 prost-types = { workspace = true }
-tonic = { workspace = true }
+tonic = { workspace = true, features = ["channel", "tls-native-roots"] }
 tonic-prost = { workspace = true }
+tokio = { workspace = true }
 thiserror = { workspace = true }
 miette = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
+tracing = { workspace = true }
 url = { workspace = true }
 ipnet = "2"
+base64 = { workspace = true }
 chrono = { version = "0.4", default-features = false, features = ["clock", "std"], optional = true }
 reqwest = { workspace = true, features = ["blocking", "rustls-tls-webpki-roots"], optional = true }
 
@@ -34,6 +37,10 @@ telemetry = ["dep:reqwest", "dep:chrono"]
 ## Off by default so production builds have an empty registry.
 ## Enabled by e2e tests and during development.
 dev-settings = []
+## Expose proposals::test_helpers (`ProposalsFlagGuard`) to downstream test
+## code in other crates. Enabled by openshell-sandbox and
+## openshell-supervisor-network dev builds.
+test-helpers = []
 
 [build-dependencies]
 tonic-prost-build = { workspace = true }
 
@@ -0,0 +1,50 @@
+// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+//! Cross-component anonymous network activity event type.
+//!
+//! `ActivityEvent` is emitted by the supervisor's networking proxy and by
+//! the supervisor's bypass monitor on every observed connection attempt
+//! (allowed or denied). It is consumed by the orchestrator-side
+//! `ActivityAggregator` which counts events, sanitizes deny groups, and
+//! periodically flushes anonymous summaries to the gateway.
+//!
+//! It lives in `openshell-core` because both supervisor leaves
+//! (`openshell-supervisor-network` and `openshell-supervisor-process`)
+//! produce it and need a shared type without depending on each other.
+
+use tokio::sync::mpsc;
+
+/// Channel capacity for the per-sandbox activity event queue.
+pub const ACTIVITY_EVENT_QUEUE_CAPACITY: usize = 1024;
+
+/// A single anonymous network activity event.
+#[derive(Debug, Clone)]
+pub struct ActivityEvent {
+    /// Whether the action was denied.
+    pub denied: bool,
+    /// The deny group label (e.g. `connect_policy`, `l7_policy`, `bypass`).
+    /// Static so producers cannot leak per-request data into the channel.
+    pub deny_group: &'static str,
+}
+
+/// Shorthand for the producer side of the activity channel.
+pub type ActivitySender = mpsc::Sender<ActivityEvent>;
+
+/// Non-blocking emit. Drops the event if the queue is full.
+/// Returns whether the event was enqueued.
+pub fn try_record_activity(tx: &ActivitySender, denied: bool, deny_group: &'static str) -> bool {
+    tx.try_send(ActivityEvent { denied, deny_group }).is_ok()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn activity_send_drops_when_queue_is_full() {
+        let (tx, _rx) = mpsc::channel(1);
+        assert!(try_record_activity(&tx, false, "unknown"));
+        assert!(!try_record_activity(&tx, true, "connect_policy"));
+    }
+}
@@ -0,0 +1,34 @@
+// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+//! Cross-component denial event type.
+//!
+//! `DenialEvent` is emitted by the supervisor's networking proxy (on L4/L7
+//! deny) and by the supervisor's bypass monitor (on direct-connect attempts
+//! that bypass the proxy). It is consumed by the networking-side denial
+//! aggregator that deduplicates and flushes summaries to the gateway.
+//!
+//! It lives in `openshell-core` because both supervisor leaves
+//! (`openshell-supervisor-network` and `openshell-supervisor-process`)
+//! produce it and need a shared type without depending on each other.
+
+/// A single denial event emitted by the proxy or the bypass monitor.
+#[derive(Debug, Clone)]
+pub struct DenialEvent {
+    /// Destination host that was denied.
+    pub host: String,
+    /// Destination port that was denied.
+    pub port: u16,
+    /// Binary path that initiated the connection (if resolved).
+    pub binary: String,
+    /// Ancestor binary paths from process tree walk.
+    pub ancestors: Vec<String>,
+    /// Reason for denial (e.g. "no matching policy", "internal address").
+    pub deny_reason: String,
+    /// Denial stage: "connect", "forward", "ssrf", "l7", "bypass".
+    pub denial_stage: String,
+    /// L7 request method (if this is an L7 denial).
+    pub l7_method: Option<String>,
+    /// L7 target path.
+    pub l7_path: Option<String>,
+}
@@ -22,16 +22,16 @@ use std::collections::HashMap;
 use std::sync::{Arc, OnceLock, RwLock};
 use std::time::{Duration, SystemTime, UNIX_EPOCH};
 
-use miette::{IntoDiagnostic, Result, WrapErr};
-use openshell_core::proto::{
+use crate::proto::{
     DenialSummary, GetDraftPolicyRequest, GetInferenceBundleRequest, GetInferenceBundleResponse,
     GetSandboxConfigRequest, GetSandboxProviderEnvironmentRequest, IssueSandboxTokenRequest,
     NetworkActivitySummary, PolicyChunk, PolicySource, PolicyStatus, RefreshSandboxTokenRequest,
     ReportPolicyStatusRequest, SandboxPolicy as ProtoSandboxPolicy, SubmitPolicyAnalysisRequest,
     SubmitPolicyAnalysisResponse, UpdateConfigRequest, inference_client::InferenceClient,
     open_shell_client::OpenShellClient,
 };
-use openshell_core::sandbox_env;
+use crate::sandbox_env;
+use miette::{IntoDiagnostic, Result, WrapErr};
 use tonic::Status;
 use tonic::metadata::AsciiMetadataValue;
 use tonic::service::interceptor::InterceptedService;
@@ -707,7 +707,7 @@ pub struct SettingsPollResult {
     pub config_revision: u64,
     pub policy_source: PolicySource,
     /// Effective settings keyed by name.
-    pub settings: HashMap<String, openshell_core::proto::EffectiveSetting>,
+    pub settings: HashMap<String, crate::proto::EffectiveSetting>,
     /// When `policy_source` is `Global`, the version of the global policy revision.
     pub global_policy_version: u32,
     pub provider_env_revision: u64,
@@ -717,7 +717,7 @@ pub struct ProviderEnvironmentResult {
     pub environment: HashMap<String, String>,
     pub provider_env_revision: u64,
     pub credential_expires_at_ms: HashMap<String, i64>,
-    pub dynamic_credentials: HashMap<String, openshell_core::proto::ProviderProfileCredential>,
+    pub dynamic_credentials: HashMap<String, crate::proto::ProviderProfileCredential>,
 }
 
 impl CachedOpenShellClient {
 
@@ -9,22 +9,29 @@
 //! - Common error types
 //! - Build version metadata
 
+pub mod activity;
 pub mod auth;
 pub mod config;
+pub mod denial;
 pub mod driver_mounts;
 pub mod driver_utils;
 pub mod error;
 pub mod forward;
 pub mod gpu;
+pub mod grpc_client;
 pub mod image;
 pub mod inference;
 pub mod metadata;
 pub mod net;
 pub mod paths;
+pub mod policy;
 pub mod progress;
+pub mod proposals;
 pub mod proto;
 pub mod proto_struct;
+pub mod provider_credentials;
 pub mod sandbox_env;
+pub mod secrets;
 pub mod settings;
 pub mod telemetry;
 pub mod time;