refactor(supervisor): add backend-neutral boundary primitives

AGENTS.md

@@ -39,6 +39,7 @@ These pipelines connect skills into end-to-end workflows. Individual skill files
 | `crates/openshell-conformance-cli/` | Conformance CLI | Distributable `list` and `run` entrypoint for gateway conformance |
 | `crates/openshell-server/` | Gateway server | Control-plane API, sandbox lifecycle, auth boundary |
 | `crates/openshell-sandbox/` | Sandbox runtime | Container supervision, policy-enforced egress routing |
+| `crates/openshell-binary-identity/` | Binary identity | Shared trusted procfs executable identity resolution for isolation backends |
 | `crates/openshell-isolation-interface/` | Isolation backend interface | RFC 0012 `IsolationBackend` trait + types; the supervisor-facing runtime contract for the boundary |
 | `crates/openshell-policy/` | Policy engine | Filesystem, network, process, and inference constraints |
 | `crates/openshell-router/` | Privacy router | Privacy-aware LLM routing |

crates/openshell-binary-identity/Cargo.toml

@@ -0,0 +1,18 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+[package]
+name = "openshell-binary-identity"
+description = "Trusted executable identity resolution for OpenShell isolation backends"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+
+[dependencies]
+openshell-isolation-interface = { path = "../openshell-isolation-interface" }
+sha2 = { workspace = true }
+
+[lints]
+workspace = true

crates/openshell-binary-identity/README.md

@@ -0,0 +1,17 @@
+# Binary identity
+
+`openshell-binary-identity` provides shared executable-identity resolution for
+RFC 0012 isolation backends. Runtime-specific observers remain in their backend:
+Docker obtains an authoritative thread ID from seccomp notification, while the
+co-located Linux path maps an accepted socket to its owning processes.
+
+Given an authoritative Linux PID and an optional trusted process-tree root, the
+crate reads the executable path from procfs, hashes the live `/proc/<pid>/exe`
+object, and collects bounded executable ancestry and diagnostic command-line
+paths. Resolution failures are returned as `ResolveError` so the caller can
+deny the associated connection.
+
+The crate does not intercept connections, authenticate remote observers, or
+evaluate policy. The isolation backend remains responsible for binding the
+resolved identity to the active boundary and exact accepted connection before
+constructing `MediatedConnection`.