Vouch request: LieBieS

[LieBieS]

What do you want to work on?

I noticed NVIDIA security policy an have a PSIRT report if needed, i would like to assist in hardening the openshell-supervisor-network .

Why this change?

The network supervisor is being resolved using the bare pid from the proc. the issue is we could end up with the wrong attribution. I want to fix the pidfd pinning and test

Checklist

• I wrote this request myself (not AI-generated)
• I have read CONTRIBUTING.md

[bizwillie]

Hey, I noticed the same gap from the audit perspective while reading openshell-supervisor-network. ResolvedIdentity in proxy.rs keeps only binary_pid, and the OCSF actor process only carries pid, so two processes that end up with the same pid look identical in the logs.

Your pidfd pinning would fix how the proxy finds the process. I'm planning to request a simple vouch for the other half: putting pid + start time into the network audit events so the records stay correct when a pid is reused. The start time is already read internally for #2291, so it's a pretty small change.

Happy to coordinate so we don't step on each other! If you land first I'll build on your change.