From 3fb55069947ef8835c0f38f7e0a76eaa71c283f3 Mon Sep 17 00:00:00 2001
From: Drew Newberry <anewberry@nvidia.com>
Date: Thu, 8 Oct 2026 23:19:18 -0700
Subject: [PATCH] fix(runtime): integrate current policy and SSH launch
 contracts

Signed-off-by: Drew Newberry <anewberry@nvidia.com>
---
 crates/openshell-server/src/compute/mod.rs | 6 +++---
 crates/openshell-server/src/grpc/policy.rs | 2 +-
 crates/openshell-supervisor/src/lib.rs     | 4 +++-
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/crates/openshell-server/src/compute/mod.rs b/crates/openshell-server/src/compute/mod.rs
index 0ef97596e..0a558351c 100644
--- a/crates/openshell-server/src/compute/mod.rs
+++ b/crates/openshell-server/src/compute/mod.rs
@@ -1330,7 +1330,7 @@ impl ComputeRuntime {
         // cancelled. Keep the creation guard until its public identity and
         // protected launch bundle have been committed.
         let prepared = async {
-            if let Some(encoded) = launch_authentication {
+            if let Some(encoded) = runtime_inputs.launch_authentication {
                 let authentication = serde_json::from_slice(&encoded)
                     .map_err(|_| Status::internal("invalid sandbox launch authentication"))?;
                 let encoded = self
@@ -1365,7 +1365,7 @@ impl ComputeRuntime {
         }
         if let Some(spec) = driver_sandbox.spec.as_mut() {
             spec.await_main_process_attachment = await_main_process_attachment;
-            spec.launch_authentication = runtime_inputs.launch_authentication.unwrap_or_default();
+            spec.launch_authentication = launch_authentication.unwrap_or_default();
         }
         let result = Box::pin(self.await_provisioning_operation(
             &sandbox,
@@ -8724,7 +8724,7 @@ mod tests {
             version: 2,
             ..Default::default()
         });
-        let launch_authentication = b"protected-launch-material".to_vec();
+        let launch_authentication = test_launch_authentication(&sandbox);
         runtime_inputs.launch_authentication = Some(launch_authentication.clone());
 
         runtime
diff --git a/crates/openshell-server/src/grpc/policy.rs b/crates/openshell-server/src/grpc/policy.rs
index 039c9550f..6755a6cd6 100644
--- a/crates/openshell-server/src/grpc/policy.rs
+++ b/crates/openshell-server/src/grpc/policy.rs
@@ -3593,7 +3593,7 @@ pub(super) async fn resolve_sandbox_create_runtime_inputs(
         provider_names,
     )
     .await?;
-    let effective_policy = current_effective_policy_from_records(
+    let (effective_policy, _) = current_effective_policy_from_records(
         state,
         &provider_profile_catalog,
         sandbox,
diff --git a/crates/openshell-supervisor/src/lib.rs b/crates/openshell-supervisor/src/lib.rs
index bdfb7b97a..3caebfc9f 100644
--- a/crates/openshell-supervisor/src/lib.rs
+++ b/crates/openshell-supervisor/src/lib.rs
@@ -805,7 +805,9 @@ async fn run_sandbox_with_backend(
     #[cfg(not(unix))]
     let ssh_host_key = {
         if ssh_socket_path.is_some() {
-            return Err(miette::miette!("SSH access sockets are unsupported on this host"));
+            return Err(miette::miette!(
+                "SSH access sockets are unsupported on this host"
+            ));
         }
         None
     };