fix(runtime): integrate current policy and SSH launch contracts

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Author: drew

crates/openshell-cli/src/run.rs

@@ -6899,12 +6899,11 @@ mod tests {
         format_endpoint, format_log_line, forward_requires_session_token, git_sync_files,
         has_main_process_result, parse_cli_setting_value, parse_credential_expiry_cli_value,
         parse_driver_config_json, parse_env_from_pairs, parse_secret_material_env_pairs,
-        policy_revision_list_json,
-        policy_revision_to_json, proto_execution_timeout, provisioning_timeout_message,
-        ready_false_condition_message, relay_local_socket, resolve_from,
-        rootfs_tar_sources_supported_for_gateway, sandbox_should_persist, sandbox_upload_plan,
-        service_endpoint_to_json, service_expose_status_error, service_url_for_gateway,
-        workspace_member_to_json,
+        policy_revision_list_json, policy_revision_to_json, proto_execution_timeout,
+        provisioning_timeout_message, ready_false_condition_message, relay_local_socket,
+        resolve_from, rootfs_tar_sources_supported_for_gateway, sandbox_should_persist,
+        sandbox_upload_plan, service_endpoint_to_json, service_expose_status_error,
+        service_url_for_gateway, workspace_member_to_json,
     };
     use openshell_core::proto::TcpForwardFrame;
 

crates/openshell-server/src/compute/mod.rs

@@ -1327,7 +1327,7 @@ impl ComputeRuntime {
         // cancelled. Keep the creation guard until its public identity and
         // protected launch bundle have been committed.
         let prepared = async {
-            if let Some(encoded) = launch_authentication {
+            if let Some(encoded) = runtime_inputs.launch_authentication {
                 let authentication = serde_json::from_slice(&encoded)
                     .map_err(|_| Status::internal("invalid sandbox launch authentication"))?;
                 let encoded = self
@@ -1362,7 +1362,7 @@ impl ComputeRuntime {
         }
         if let Some(spec) = driver_sandbox.spec.as_mut() {
             spec.await_main_process_attachment = await_main_process_attachment;
-            spec.launch_authentication = runtime_inputs.launch_authentication.unwrap_or_default();
+            spec.launch_authentication = launch_authentication.unwrap_or_default();
         }
         let result = Box::pin(self.await_provisioning_operation(
             &sandbox,
@@ -8666,7 +8666,7 @@ mod tests {
             version: 2,
             ..Default::default()
         });
-        let launch_authentication = b"protected-launch-material".to_vec();
+        let launch_authentication = test_launch_authentication(&sandbox);
         runtime_inputs.launch_authentication = Some(launch_authentication.clone());
 
         runtime

crates/openshell-server/src/grpc/policy.rs

@@ -3555,7 +3555,7 @@ pub(super) async fn resolve_sandbox_create_runtime_inputs(
         provider_names,
     )
     .await?;
-    let effective_policy = current_effective_policy_from_records(
+    let (effective_policy, _) = current_effective_policy_from_records(
         state,
         &provider_profile_catalog,
         sandbox,

crates/openshell-server/src/storage_proto.rs

@@ -143,9 +143,9 @@ mod tests {
     // Legacy payloads decode empty owners; the gateway rebuilds their authority
     // from effective policy rather than trusting persisted owner stamps.
     const PUBLIC_RPC_SCHEMA_SHA256: &str =
-        "18206c52e68fdb0af60f8bb8dfaf47d9bc8021222cb49cacffab6352d3ad5549";
+        "3fead4a66e57e6828072109564fa25b5b65ef541b35098d9ed7f0785387fe0aa";
     const DURABLE_SCHEMA_SHA256: &str =
-        "76487ab369fc3a4b03a179bb5e7ea6be8d20e380ad5563075dff8ee50e539406";
+        "96269474903e077df4d4861db0dd1004b8a7205604ffadcdaff98d0124f18147";
     const PUBLIC_DURABLE_OVERLAP_SHA256: &str =
         "761dea31a521b0650840fe2a823ad6e36a265ed323ba4506889781d630df0ee3";
     // A persisted Sandbox without endpoint status retains its lifecycle fields;
@@ -612,7 +612,7 @@ mod tests {
                 overlap_hash.as_str(),
             ),
             (
-                (306, 27),
+                (307, 27),
                 (93, 21),
                 (81, 21),
                 PUBLIC_RPC_SCHEMA_SHA256,

crates/openshell-supervisor/src/lib.rs

@@ -803,7 +803,9 @@ async fn run_sandbox_with_backend(
     #[cfg(not(unix))]
     let ssh_host_key = {
         if ssh_socket_path.is_some() {
-            return Err(miette::miette!("SSH access sockets are unsupported on this host"));
+            return Err(miette::miette!(
+                "SSH access sockets are unsupported on this host"
+            ));
         }
         None
     };