fix(runtime): integrate current policy and SSH launch contracts

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

crates/openshell-server/src/compute/mod.rs

@@ -1330,7 +1330,7 @@ impl ComputeRuntime {
         // cancelled. Keep the creation guard until its public identity and
         // protected launch bundle have been committed.
         let prepared = async {
-            if let Some(encoded) = launch_authentication {
+            if let Some(encoded) = runtime_inputs.launch_authentication {
                 let authentication = serde_json::from_slice(&encoded)
                     .map_err(|_| Status::internal("invalid sandbox launch authentication"))?;
                 let encoded = self
@@ -1365,7 +1365,7 @@ impl ComputeRuntime {
         }
         if let Some(spec) = driver_sandbox.spec.as_mut() {
             spec.await_main_process_attachment = await_main_process_attachment;
-            spec.launch_authentication = runtime_inputs.launch_authentication.unwrap_or_default();
+            spec.launch_authentication = launch_authentication.unwrap_or_default();
         }
         let result = Box::pin(self.await_provisioning_operation(
             &sandbox,
@@ -8724,7 +8724,7 @@ mod tests {
             version: 2,
             ..Default::default()
         });
-        let launch_authentication = b"protected-launch-material".to_vec();
+        let launch_authentication = test_launch_authentication(&sandbox);
         runtime_inputs.launch_authentication = Some(launch_authentication.clone());
 
         runtime

crates/openshell-server/src/grpc/policy.rs

@@ -3593,7 +3593,7 @@ pub(super) async fn resolve_sandbox_create_runtime_inputs(
         provider_names,
     )
     .await?;
-    let effective_policy = current_effective_policy_from_records(
+    let (effective_policy, _) = current_effective_policy_from_records(
         state,
         &provider_profile_catalog,
         sandbox,

crates/openshell-supervisor/src/lib.rs

@@ -805,7 +805,9 @@ async fn run_sandbox_with_backend(
     #[cfg(not(unix))]
     let ssh_host_key = {
         if ssh_socket_path.is_some() {
-            return Err(miette::miette!("SSH access sockets are unsupported on this host"));
+            return Err(miette::miette!(
+                "SSH access sockets are unsupported on this host"
+            ));
         }
         None
     };