refactor(supervisor): launch sandbox instances from one config and prepared bindings

Replace SandboxRunConfig and its field-by-field copy into
SandboxInstanceConfig with a single launch configuration. Live per-instance
state (gateway credentials, OCSF context and JSON settings, log sink, and
denial log) is now an explicit SandboxInstanceBindings value that the owner
prepares once, instead of placeholders the runner or host overwrote.

The dedicated binary loads launch inputs from its arguments and environment
and shares one GatewayCredentials with log push; run_sandbox_with_backend
keeps the process-wide OCSF context, health endpoints, and signal handling.
The instance host binds the same SandboxInstanceBindings to its runtime
threads and revokes their credentials when the instance ends.

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Author: drew

crates/openshell-supervisor/README.md

@@ -4,7 +4,7 @@ The supervisor loads and reconciles policy, maintains provider credentials, appl
 
 ## Backend startup
 
-The public `run_sandbox` entry point selects the OpenShell Sandbox Protocol backend and collects its startup inputs into a public `SandboxRunConfig`. Shared startup receives that config and the trusted backend setup separately. The `backend_setup` module owns that backend's launch-data decoder, workload policy discovery, and client construction. Descriptor contents cannot select an implementation.
+The supervisor binary selects a backend setup and collects its launch inputs into a public `SandboxInstanceConfig`. Shared startup receives that config and the trusted backend setup separately. The `backend_setup` module owns that backend's launch-data decoder, workload policy discovery, and client construction. Descriptor contents cannot select an implementation.
 
 Shared startup checks the admitted backend name before passing the opaque payload to its decoder. It then compares the decoded sandbox, session, and runtime generation with the trusted launch inputs before installing credentials or discovering workload policy. A mismatch stops startup.
 
@@ -14,7 +14,7 @@ The supervisor admits policy and prepares credentials before constructing and at
 
 The client receives the supervisor's live provider state, bearer-token slot, and CA-path slot. Provider refresh, token rotation, and later CA publication must remain visible through those shared handles. Startup does not create independent copies of their current values.
 
-`backend_setup`, `SandboxRunConfig`, and `run_sandbox_with_backend` are public so the supervisor binary can select a registered backend. External backends should implement the `IsolationBackend` and `SandboxProtocol` services rather than link this crate.
+`backend_setup`, `SandboxInstanceConfig`, `SandboxInstanceBindings`, and `run_sandbox_with_backend` are public so the supervisor binary can select a registered backend. External backends should implement the `IsolationBackend` and `SandboxProtocol` services rather than link this crate.
 
 The startup result separates the backend transport payload from optional
 authenticated CONNECT listener settings. Shared networking starts the listener
@@ -29,27 +29,32 @@ Gateway connections, and the gateway supervisor sessions carried over them,
 can reconnect within an instance without creating another one; the generation
 remains the fencing identifier.
 
-`run_sandbox_instance` supervises one sandbox instance from a
-`SandboxInstanceConfig` and `SandboxInstanceControls`. Everything that belongs
-to that instance is an input or is created by the instance: gateway
-credentials and their renewal, the Sandbox Protocol credential, policy,
-provider credentials and token grants, middleware credentials, OCSF JSON
-settings, proxy trust files, the denial history served by `policy.local`, the
-backend connection, access plane, readiness, and stop signal. Gateway clients
-receive a `GatewayEndpoint`, which pairs the URL with that instance's
-`GatewayCredentials`; nothing is installed process-wide.
-
-`run_sandbox_with_backend` is the dedicated wrapper. It keeps the existing
-process contract: it sets the process-wide OCSF context, reads launch inputs
-from the environment, binds the readiness socket and port to instance
-readiness, and stops the instance on SIGTERM or SIGINT. The binary shares one
-`GatewayCredentials` between log push and supervision, so renewal by either
-keeps both current.
+`run_sandbox_instance` supervises one sandbox instance from three inputs.
+`SandboxInstanceConfig` is the single launch configuration: identity, command,
+policy inputs, auth bundle, backend descriptor, and file locations.
+`SandboxInstanceBindings` is the live state its owner prepares once: the
+`GatewayCredentials` issued from the auth bundle, the OCSF context and JSON
+settings, the log sink, and the denial history served by `policy.local`.
+`SandboxInstanceControls` carries the owner's stop signal and readiness.
+Everything else, including credential renewal, policy, provider credentials and
+token grants, middleware credentials, the backend connection, and the access
+plane, is created by the instance. Gateway clients receive a `GatewayEndpoint`,
+which pairs the URL with that instance's `GatewayCredentials`; nothing is
+installed process-wide.
+
+The dedicated process wrapper keeps the existing process contract. The binary
+loads the launch configuration from its arguments and environment and prepares
+`SandboxInstanceBindings::dedicated`, sharing one `GatewayCredentials` with log
+push and the OCSF JSON settings with its logging layers, so renewal by either
+gateway client keeps both current. `run_sandbox_with_backend` sets the
+process-wide OCSF context, binds the readiness socket and port to instance
+readiness, and stops the instance on SIGTERM or SIGINT.
 
 `sandbox_instance_host::SandboxInstanceHost` runs several sandbox instances in
 one process. Each instance gets its own Tokio runtime; every thread of that
-runtime, and the thread driving it, is bound to the instance's OCSF context,
-OCSF JSON settings, log sink, and denial log. Spawned tasks, blocking work,
+runtime, and the thread driving it, is bound to the instance's
+`SandboxInstanceBindings`: OCSF context, OCSF JSON settings, log sink, and
+denial log. Spawned tasks, blocking work,
 callbacks, reconnects, and renewal therefore inherit the instance's identity,
 and threads outside an instance carry none and push no logs. The OCSF context
 also supplies the sandbox identity in middleware requests.

crates/openshell-supervisor/src/backend_setup/tests.rs

@@ -680,32 +680,42 @@ async fn shared_startup_uses_selected_backend_through_readiness_and_shutdown() {
         .require_networking
         .store(true, Ordering::SeqCst);
     let startup = |await_main_process_attachment| {
+        let config = crate::SandboxInstanceConfig {
+            command: vec!["test-agent".into(), "test-argument".into()],
+            workdir: Some("/test-workspace".into()),
+            timeout_secs: 15,
+            interactive: false,
+            await_main_process_attachment,
+            sandbox_id: Some(setup.sandbox_id.clone()),
+            sandbox: None,
+            container_image: String::new(),
+            openshell_endpoint: None,
+            policy_rules: Some(rules.to_string_lossy().into_owned()),
+            policy_data: Some(data.to_string_lossy().into_owned()),
+            ssh_socket_path: None,
+            shared_ssh_socket: false,
+            upstream_proxy_args: UpstreamProxyArgs::default(),
+            additional_ca_bundle: None,
+            backend_descriptor: TestSetup::descriptor(),
+            auth_bundle: setup.auth.clone(),
+            admitted_isolation_backend: Some(TEST_BACKEND.into()),
+            main_exit_marker: Some(marker.clone()),
+            trace_context: None,
+            provider_workload_api_socket: None,
+            // The binary loads the proxy trust directory from its environment.
+            proxy_tls: openshell_supervisor_network::run::ProxyTlsFiles::from_environment(),
+        };
+        let bindings = crate::SandboxInstanceBindings::dedicated(
+            &config,
+            openshell_core::grpc_client::GatewayCredentials::from_auth_bundle(&setup.auth).unwrap(),
+            openshell_ocsf::OcsfJsonSettings::default(),
+        );
         Box::pin(crate::run_sandbox_with_backend(
             &setup,
-            crate::SandboxRunConfig {
-                command: vec!["test-agent".into(), "test-argument".into()],
-                workdir: Some("/test-workspace".into()),
-                timeout_secs: 15,
-                interactive: false,
-                await_main_process_attachment,
-                sandbox_id: Some(setup.sandbox_id.clone()),
-                sandbox: None,
-                openshell_endpoint: None,
-                policy_rules: Some(rules.to_string_lossy().into_owned()),
-                policy_data: Some(data.to_string_lossy().into_owned()),
-                ssh_socket_path: None,
-                health_socket_path: Some(readiness.clone()),
-                health_port: Some(health_port),
-                ocsf_enabled: Arc::new(AtomicBool::new(false)),
-                ocsf_schema_version: Arc::new(Mutex::new(String::new())),
-                upstream_proxy_args: UpstreamProxyArgs::default(),
-                additional_ca_bundle: None,
-                backend_descriptor: TestSetup::descriptor(),
-                auth_bundle: setup.auth.clone(),
-                gateway_credentials: None,
-                admitted_isolation_backend: Some(TEST_BACKEND.into()),
-                main_exit_marker: Some(marker.clone()),
-            },
+            config,
+            bindings,
+            Some(readiness.clone()),
+            Some(health_port),
         ))
     };
 

crates/openshell-supervisor/src/legacy_startup_regression_tests.rs

@@ -11,7 +11,7 @@ use openshell_core::proto::{
     UpdateConfigResponse, gateway_message, supervisor_message,
 };
 use openshell_isolation_interface::contract::{BackendError, ResolvedWorkloadIdentity};
-use std::sync::{Mutex, atomic::Ordering};
+use std::sync::atomic::Ordering;
 use tonic::codegen::tokio_stream::{StreamExt as _, wrappers::TcpListenerStream};
 use tonic::codegen::{Body, BoxFuture, BoxStream, Bytes, Service, StdError, http};
 
@@ -277,37 +277,41 @@ async fn config_push_regression_legacy_gateway_never_observes_ready_before_workl
         session_id,
         probe: probe.clone(),
     };
-    let startup = run_sandbox_with_backend(
-        &setup,
-        SandboxRunConfig {
-            command: vec!["true".into()],
-            workdir: None,
-            timeout_secs: 0,
-            interactive: false,
-            await_main_process_attachment: false,
-            sandbox_id: Some("sb-legacy-restart".into()),
-            sandbox: Some("legacy-restart".into()),
-            openshell_endpoint: Some(endpoint),
-            policy_rules: None,
-            policy_data: None,
-            ssh_socket_path: None,
-            health_socket_path: None,
-            health_port: None,
-            ocsf_enabled: Arc::new(AtomicBool::new(false)),
-            ocsf_schema_version: Arc::new(Mutex::new(String::new())),
-            upstream_proxy_args:
-                openshell_supervisor_network::upstream_proxy::UpstreamProxyArgs::default(),
-            additional_ca_bundle: None,
-            backend_descriptor: openshell_isolation_interface::contract::BackendDescriptor {
-                backend_name: "test-held".into(),
-                payload: Vec::new(),
-            },
-            auth_bundle,
-            gateway_credentials: None,
-            admitted_isolation_backend: Some("test-held".into()),
-            main_exit_marker: None,
+    let config = SandboxInstanceConfig {
+        command: vec!["true".into()],
+        workdir: None,
+        timeout_secs: 0,
+        interactive: false,
+        await_main_process_attachment: false,
+        sandbox_id: Some("sb-legacy-restart".into()),
+        sandbox: Some("legacy-restart".into()),
+        container_image: String::new(),
+        openshell_endpoint: Some(endpoint),
+        policy_rules: None,
+        policy_data: None,
+        ssh_socket_path: None,
+        shared_ssh_socket: false,
+        upstream_proxy_args:
+            openshell_supervisor_network::upstream_proxy::UpstreamProxyArgs::default(),
+        additional_ca_bundle: None,
+        backend_descriptor: openshell_isolation_interface::contract::BackendDescriptor {
+            backend_name: "test-held".into(),
+            payload: Vec::new(),
         },
+        auth_bundle,
+        admitted_isolation_backend: Some("test-held".into()),
+        main_exit_marker: None,
+        trace_context: None,
+        provider_workload_api_socket: None,
+        proxy_tls: openshell_supervisor_network::run::ProxyTlsFiles::default(),
+    };
+    let bindings = SandboxInstanceBindings::dedicated(
+        &config,
+        openshell_core::grpc_client::GatewayCredentials::from_auth_bundle(&config.auth_bundle)
+            .unwrap(),
+        openshell_ocsf::OcsfJsonSettings::default(),
     );
+    let startup = run_sandbox_with_backend(&setup, config, bindings, None, None);
     tokio::pin!(startup);
     let result = tokio::select! {
         () = probe.ready_event.notified() => None,