@@ -108,11 +108,7 @@ host selectors choose the chain independently of the network rule that admitted
 the request. Policy-local map keys identify configs, while built-in names or
 operator-owned registration names identify implementations.
 
-Built-ins run in-process; operator services use the same bounded gRPC contract.
-`openshell-policy` validates policy-owned structure, and the active middleware
-registry validates implementation-owned config. The generic registry and chain
-runner live in `openshell-supervisor-middleware`; first-party implementations
-live in `openshell-supervisor-middleware-builtins`.
+Built-ins run in-process against a borrowed view of the chain's current request state. Operator services retain the bounded protobuf/gRPC contract, and the remote adapter materializes an owned evaluation only when the request crosses that transport boundary. `openshell-policy` validates policy-owned structure, and the active middleware registry validates implementation-owned config. The generic registry and chain runner live in `openshell-supervisor-middleware`; first-party implementations live in `openshell-supervisor-middleware-builtins`.
 
 The supervisor installs policy and middleware registry changes as one runtime
 generation and preserves the last-known-good generation if preparation fails.
 
@@ -11,6 +11,7 @@ license.workspace = true
 repository.workspace = true
 
 [dependencies]
+async-trait = "0.1"
 glob = { workspace = true }
 prost = { workspace = true }
 prost-types = { workspace = true }
 
@@ -1,10 +1,197 @@
 // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-//! Platform-wide supervisor middleware limits.
+//! Supervisor middleware in-process contracts and platform-wide limits.
 
 use std::time::Duration;
 
+use miette::Result;
+
+use crate::proto::{
+    HttpHeader, HttpRequestResult, HttpRequestTarget, MiddlewareManifest, RequestContext,
+    SupervisorMiddlewarePhase,
+};
+
+/// Borrowed request state exposed to one in-process middleware invocation.
+///
+/// The view reflects every transformation applied by earlier stages. It is valid
+/// only for the current invocation and cannot be retained by the middleware.
+#[derive(Clone, Copy)]
+pub struct HttpRequestView<'a> {
+    phase: SupervisorMiddlewarePhase,
+    context: &'a RequestContext,
+    config: &'a prost_types::Struct,
+    target: &'a HttpRequestTarget,
+    headers: &'a [HttpHeader],
+    body: &'a [u8],
+    middleware_name: &'a str,
+}
+
+impl<'a> HttpRequestView<'a> {
+    /// Create a view over the chain's current request state for one stage.
+    #[must_use]
+    pub fn new(
+        phase: SupervisorMiddlewarePhase,
+        context: &'a RequestContext,
+        config: &'a prost_types::Struct,
+        target: &'a HttpRequestTarget,
+        headers: &'a [HttpHeader],
+        body: &'a [u8],
+        middleware_name: &'a str,
+    ) -> Self {
+        Self {
+            phase,
+            context,
+            config,
+            target,
+            headers,
+            body,
+            middleware_name,
+        }
+    }
+
+    /// Return the typed middleware phase selected for this invocation.
+    #[must_use]
+    pub fn phase(self) -> SupervisorMiddlewarePhase {
+        self.phase
+    }
+
+    /// Return the request and sandbox identity shared by every chain stage.
+    #[must_use]
+    pub fn context(self) -> &'a RequestContext {
+        self.context
+    }
+
+    /// Return the validated configuration for this policy-selected stage.
+    #[must_use]
+    pub fn config(self) -> &'a prost_types::Struct {
+        self.config
+    }
+
+    /// Return the admitted destination and HTTP request target.
+    #[must_use]
+    pub fn target(self) -> &'a HttpRequestTarget {
+        self.target
+    }
+
+    /// Return visible request headers in wire order, including repeated names.
+    #[must_use]
+    pub fn headers(self) -> &'a [HttpHeader] {
+        self.headers
+    }
+
+    /// Return the current body, including replacements made by earlier stages.
+    #[must_use]
+    pub fn body(self) -> &'a [u8] {
+        self.body
+    }
+
+    /// Return the in-process middleware manifest or attachment name selected by
+    /// policy, including custom implementation names.
+    #[must_use]
+    pub fn middleware_name(self) -> &'a str {
+        self.middleware_name
+    }
+}
+
+/// Asynchronous contract for supervisor middleware that runs in the process.
+///
+/// Remote services use the protobuf `SupervisorMiddleware` contract instead.
+/// The borrowed view remains valid for the evaluation future, so implementations
+/// can yield without constructing an owned protobuf request envelope.
+///
+/// Downstream implementations must apply `#[async_trait::async_trait]` to each
+/// `impl InProcessMiddleware` block. The macro's default expansion creates
+/// `Send` futures, matching this trait's generated method signatures; do not
+/// use the `?Send` form.
+///
+/// An implementing crate must declare `async-trait` as a direct dependency
+/// because `openshell-core`'s dependency does not make the procedural macro
+/// available in downstream source. The example also names `miette` and
+/// `prost-types`, so standalone crates must declare those dependencies when
+/// using those paths.
+///
+/// # Examples
+///
+/// ```
+/// use std::sync::Arc;
+///
+/// use miette::Result;
+/// use openshell_core::middleware::{HttpRequestView, InProcessMiddleware};
+/// use openshell_core::proto::{
+///     Decision, HttpRequestResult, MiddlewareBinding, MiddlewareManifest,
+///     SupervisorMiddlewareOperation, SupervisorMiddlewarePhase,
+/// };
+/// use prost_types::Struct;
+///
+/// struct Service;
+///
+/// #[async_trait::async_trait]
+/// impl InProcessMiddleware for Service {
+///     async fn describe(&self) -> MiddlewareManifest {
+///         MiddlewareManifest {
+///             name: "example/audit".into(),
+///             service_version: "1".into(),
+///             bindings: vec![MiddlewareBinding {
+///                 operation: SupervisorMiddlewareOperation::HttpRequest as i32,
+///                 phase: SupervisorMiddlewarePhase::PreCredentials as i32,
+///                 max_body_bytes: 1024,
+///                 timeout: String::new(),
+///             }],
+///         }
+///     }
+///
+///     async fn validate_config(
+///         &self,
+///         _middleware_name: &str,
+///         _config: &Struct,
+///     ) -> Result<()> {
+///         Ok(())
+///     }
+///
+///     async fn evaluate_http_request(
+///         &self,
+///         _request: HttpRequestView<'_>,
+///     ) -> Result<HttpRequestResult> {
+///         Ok(HttpRequestResult {
+///             decision: Decision::Allow as i32,
+///             ..Default::default()
+///         })
+///     }
+/// }
+///
+/// let service: Arc<dyn InProcessMiddleware> = Arc::new(Service);
+/// assert_eq!(Arc::strong_count(&service), 1);
+/// ```
+#[async_trait::async_trait]
+pub trait InProcessMiddleware: Send + Sync {
+    /// Return the immutable manifest describing this implementation.
+    async fn describe(&self) -> MiddlewareManifest;
+
+    /// Validate implementation-owned configuration for one policy attachment.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when the implementation name is unknown or the
+    /// configuration is malformed or unsupported.
+    async fn validate_config(
+        &self,
+        middleware_name: &str,
+        config: &prost_types::Struct,
+    ) -> Result<()>;
+
+    /// Evaluate one request using borrowed chain state.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when the selected implementation cannot evaluate the
+    /// request or its validated configuration.
+    async fn evaluate_http_request(
+        &self,
+        request: HttpRequestView<'_>,
+    ) -> Result<HttpRequestResult>;
+}
+
 /// Default timeout for one supervisor middleware RPC.
 pub const DEFAULT_MIDDLEWARE_TIMEOUT: Duration = Duration::from_millis(500);
 /// Smallest operator-configured supervisor middleware RPC timeout.
 
@@ -13,12 +13,12 @@ rust-version.workspace = true
 [dependencies]
 openshell-core = { path = "../openshell-core", default-features = false }
 
+async-trait = "0.1"
 miette = { workspace = true }
 prost-types = { workspace = true }
 regex = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
-tonic = { workspace = true, features = ["server"] }
 
 [dev-dependencies]
 tokio = { workspace = true }