feat(isolation): expose trusted launch and registry data contracts

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

crates/openshell-sandbox-backend/src/delegated.rs

@@ -0,0 +1,30 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+//! Trusted launch metadata for an endpoint-registered Sandbox Protocol backend.
+
+use std::collections::BTreeMap;
+use std::net::IpAddr;
+
+use openshell_core::SandboxSessionId;
+use openshell_isolation_interface::contract::{OuterFenceGuarantees, ResolvedWorkloadIdentity};
+use serde::{Deserialize, Serialize};
+
+use crate::boundary_protocol::SandboxTlsClientConfig;
+
+/// Delivered by the trusted driver separately from its opaque backend payload.
+/// Endpoint selection belongs to operator configuration, not launch data.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct DelegatedLaunch {
+    pub backend_name: String,
+    pub sandbox_id: String,
+    pub generation: String,
+    pub session_id: SandboxSessionId,
+    pub workload_identity: ResolvedWorkloadIdentity,
+    pub tls: SandboxTlsClientConfig,
+    #[serde(default)]
+    pub host_gateway_ip: Option<IpAddr>,
+    pub resource_claims: BTreeMap<String, String>,
+    pub outer_fence: OuterFenceGuarantees,
+}

crates/openshell-sandbox-backend/src/lib.rs

@@ -9,6 +9,7 @@
 //! types in this crate.
 
 pub mod boundary_protocol;
+pub mod delegated;
 pub mod mediation;
 mod runtime;
 pub mod sandbox_auth;

crates/openshell-supervisor/src/backend_setup.rs

@@ -3,6 +3,9 @@
 
 //! Backend-owned launch decoding and client construction for supervisor startup.
 
+mod registration;
+pub use registration::{BackendRegistration, BackendRegistrations};
+
 use std::path::PathBuf;
 use std::sync::{Arc, Mutex};
 
@@ -27,8 +30,9 @@ pub struct LaunchIdentity {
     pub vm_policy_identity: Option<super::VmPolicyIdentity>,
 }
 
-/// Runtime state remains owned by the supervisor. Backends retain these same
-/// handles so CA publication, provider reload, and bearer rotation stay visible
+/// Runtime state remains owned by the supervisor.
+///
+/// Backends retain these same handles so CA publication, provider reload, and bearer rotation stay visible
 /// after attachment; copying their current contents would lose later updates.
 pub struct BackendServices {
     pub ca_file_paths: Arc<Mutex<Option<(PathBuf, PathBuf)>>>,

crates/openshell-supervisor/src/backend_setup/registration.rs

@@ -0,0 +1,13 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+//! Operator-owned endpoint registration; launch payloads never select a route.
+
+pub use openshell_core::isolation_registration::BackendRegistration;
+use serde::Deserialize;
+
+#[derive(Default, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct BackendRegistrations {
+    pub backends: Vec<BackendRegistration>,
+}

crates/openshell-supervisor/src/lib.rs

@@ -16,7 +16,7 @@ compile_error!(
 );
 
 mod activity_aggregator;
-mod backend_setup;
+pub mod backend_setup;
 mod denial_aggregator;
 mod endpoint_status;
 mod mechanistic_mapper;
@@ -667,33 +667,34 @@ pub async fn run_sandbox(
     .await
 }
 
-struct SandboxRunConfig {
-    command: Vec<String>,
-    workdir: Option<String>,
-    timeout_secs: u64,
-    interactive: bool,
-    await_main_process_attachment: bool,
-    sandbox_id: Option<String>,
-    sandbox: Option<String>,
-    openshell_endpoint: Option<String>,
-    policy_rules: Option<String>,
-    policy_data: Option<String>,
-    ssh_socket_path: Option<String>,
-    health_socket_path: Option<std::path::PathBuf>,
-    health_port: Option<u16>,
-    ocsf_enabled: Arc<AtomicBool>,
-    ocsf_schema_version: Arc<std::sync::Mutex<String>>,
-    upstream_proxy_args: openshell_supervisor_network::upstream_proxy::UpstreamProxyArgs,
-    backend_descriptor: openshell_isolation_interface::contract::BackendDescriptor,
-    auth_bundle: openshell_core::jwt::SupervisorAuthBundle,
-    admitted_isolation_backend: Option<String>,
-    main_exit_marker: Option<std::path::PathBuf>,
+/// Trusted inputs for one supervisor launch.
+pub struct SandboxRunConfig {
+    pub command: Vec<String>,
+    pub workdir: Option<String>,
+    pub timeout_secs: u64,
+    pub interactive: bool,
+    pub await_main_process_attachment: bool,
+    pub sandbox_id: Option<String>,
+    pub sandbox: Option<String>,
+    pub openshell_endpoint: Option<String>,
+    pub policy_rules: Option<String>,
+    pub policy_data: Option<String>,
+    pub ssh_socket_path: Option<String>,
+    pub health_socket_path: Option<std::path::PathBuf>,
+    pub health_port: Option<u16>,
+    pub ocsf_enabled: Arc<AtomicBool>,
+    pub ocsf_schema_version: Arc<std::sync::Mutex<String>>,
+    pub upstream_proxy_args: openshell_supervisor_network::upstream_proxy::UpstreamProxyArgs,
+    pub backend_descriptor: openshell_isolation_interface::contract::BackendDescriptor,
+    pub auth_bundle: openshell_core::jwt::SupervisorAuthBundle,
+    pub admitted_isolation_backend: Option<String>,
+    pub main_exit_marker: Option<std::path::PathBuf>,
 }
 
 /// Trusted composition chooses the setup before shared admission, policy, and
 /// lifecycle handling. Payload contents never select a backend implementation.
 #[allow(clippy::similar_names)]
-async fn run_sandbox_with_backend(
+pub async fn run_sandbox_with_backend(
     backend_setup: &dyn backend_setup::BackendSetup,
     config: SandboxRunConfig,
 ) -> Result<i32> {
@@ -2141,7 +2142,7 @@ enum LocalPolicyIdentity {
 /// init maps the `sandbox` account to this pair; the host must not resolve
 /// guest selectors through its own account database.
 #[derive(Clone, Copy)]
-struct VmPolicyIdentity {
+pub struct VmPolicyIdentity {
     uid: u32,
     gid: u32,
 }