Shiju
6ea9cd0307
* refactor(supervisor): move backend setup behind the selected backend Keep launch decoding, policy discovery and client construction with the trusted backend while sharing supervisor admission and lifecycle handling. Preserve VM policy identity validation and live credential handles. Exercise alternate launch data through shared startup, readiness and shutdown, including confirmation denial and resource cleanup. Closes #4173 Signed-off-by: Shiju <shiju@nvidia.com> * fix(supervisor): resolve backend setup lint failures Box shared startup futures to keep callers' async state small. Use the private module boundary for backend setup visibility and keep test helpers and defaults explicit without changing their inputs. Signed-off-by: Shiju <shiju@nvidia.com> * refactor(supervisor): simplify selected backend startup Signed-off-by: Shiju <shiju@nvidia.com> * test(supervisor): keep imports before descriptor assertions Signed-off-by: Shiju <shiju@nvidia.com> * test(supervisor): preserve discovery failure startup coverage Exercise backend discovery failure through shared startup before the existing confirmation denial and successful shutdown cases. Assert that startup preserves the error without launching a workload or readiness. Signed-off-by: Shiju <shiju@nvidia.com> --------- Signed-off-by: Shiju <shiju@nvidia.com>
2.1 KiB
OpenShell supervisor
The supervisor loads and reconciles policy, maintains provider credentials, applies network and MCP inspection, and drives the admitted isolation backend through attachment, confirmation, and workload start.
Backend startup
The public run_sandbox entry point selects the OpenShell Sandbox Protocol backend and collects its startup inputs into a private SandboxRunConfig. Shared startup receives that config and the trusted backend setup separately. The backend_setup module owns that backend's launch-data decoder, workload policy discovery, and client construction. Descriptor contents cannot select an implementation.
Shared startup checks the admitted backend name before passing the opaque payload to its decoder. It then compares the decoded sandbox, session, and runtime generation with the trusted launch inputs before installing credentials or discovering workload policy. A mismatch stops startup.
The built-in decoder also carries the VM driver's fixed workload identity into shared policy validation. Startup and later policy updates must reject selectors that conflict with that identity. Other launch descriptors do not enable this VM-specific check.
The supervisor admits policy and prepares credentials before constructing and attaching the selected client. It uses the isolation contract's BoundBoundary and ConfirmedBoundary directly: confirm the attached boundary, prepare network mediation, then start the workload. Backend implementations remain responsible for validating their native enforcement evidence through the isolation contract.
The client receives the supervisor's live provider state, bearer-token slot, and CA-path slot. Provider refresh, token rotation, and later CA publication must remain visible through those shared handles. Startup does not create independent copies of their current values.
The setup interface stays private to the supervisor. It adds no runtime backend registration, endpoint configuration, or public factory API. The public run_sandbox signature and standard backend selection remain unchanged.