M3.14: wire ComputeDriverKind::Substrate dispatch into gateway compute runtime

The M3 scaffold (commit 0390bcd) added the `Substrate` enum variant and
the driver crate, but parked the gateway-side instantiation behind a
placeholder error: "openshell-driver-substrate is a scaffold; runtime
wiring lands in M3." M3.1 through M3.13 then built out the driver crate
(client, RPCs, kube-rs materialization, JWT, TLS, live tests, ActorTemplate
synthesis). This change replaces the placeholder with the real wiring so
`compute_drivers = ["substrate"]` in `gateway.toml` actually instantiates
`SubstrateComputeDriver` and routes every `ComputeDriver` RPC through it.

Three pieces:
- `openshell-server/Cargo.toml`: depend on `openshell-driver-substrate`
  (one line; mirrors the docker/kubernetes/podman pattern).
- `openshell-server/src/compute/mod.rs`: add `ComputeRuntime::new_substrate`.
  The substrate driver implements `ComputeDriver` directly with the same
  `WatchStream` type `SharedComputeDriver` expects, so no
  `ComputeDriverService`-style adapter is needed (kubernetes wraps because
  its internal API surface differs from the gRPC trait).
- `openshell-server/src/lib.rs`: replace the placeholder `Substrate => Err(...)`
  arm with a real `ComputeRuntime::new_substrate(...)` call, and add
  `substrate_config_from_file()` mirroring `kubernetes_config_from_file()`
  to parse `[openshell.drivers.substrate]` via the driver's `Deserialize`
  impl.

Test plan:
- `cargo check --release -p openshell-server --bin openshell-gateway`
  completes in 2m 03s without warnings.
- End-to-end validation lands in the helpdesk demo
  (`dims/openshell-driver-substrate/examples/helpdesk/`), which switches
  from `kubectl apply` + atenet curl to driving every sandbox lifecycle
  call through `gateway.create_sandbox` / `stop_sandbox` /
  `delete_sandbox` / `list_sandboxes`. That work is filed separately.

Signed-off-by: Davanum Srinivas <dsrinivas@nvidia.com>

Author: dims

Cargo.lock

@@ -20,6 +20,7 @@ openshell-core = { path = "../openshell-core" }
 openshell-driver-docker = { path = "../openshell-driver-docker" }
 openshell-driver-kubernetes = { path = "../openshell-driver-kubernetes" }
 openshell-driver-podman = { path = "../openshell-driver-podman" }
+openshell-driver-substrate = { path = "../openshell-driver-substrate" }
 openshell-ocsf = { path = "../openshell-ocsf" }
 openshell-policy = { path = "../openshell-policy" }
 openshell-providers = { path = "../openshell-providers" }

crates/openshell-server/Cargo.toml

@@ -34,6 +34,8 @@ use openshell_driver_kubernetes::{
 use openshell_driver_podman::{
     ComputeDriverService as PodmanDriverService, PodmanComputeConfig, PodmanComputeDriver,
 };
+pub use openshell_driver_substrate::SubstrateComputeConfig;
+use openshell_driver_substrate::SubstrateComputeDriver;
 use prost::Message;
 use std::fmt;
 use std::net::SocketAddr;
@@ -347,6 +349,34 @@ impl ComputeRuntime {
         .await
     }
 
+    pub async fn new_substrate(
+        config: SubstrateComputeConfig,
+        store: Arc<Store>,
+        sandbox_index: SandboxIndex,
+        sandbox_watch_bus: SandboxWatchBus,
+        tracing_log_bus: TracingLogBus,
+        supervisor_sessions: Arc<SupervisorSessionRegistry>,
+    ) -> Result<Self, ComputeError> {
+        // SubstrateComputeDriver directly impls ComputeDriver with the
+        // same WatchStream type SharedComputeDriver expects, so no
+        // ComputeDriverService-style adapter is needed.
+        let driver: SharedComputeDriver = Arc::new(SubstrateComputeDriver::new(config));
+        Self::from_driver(
+            driver,
+            None,
+            None,
+            None,
+            store,
+            sandbox_index,
+            sandbox_watch_bus,
+            tracing_log_bus,
+            supervisor_sessions,
+            false,
+            Vec::new(),
+        )
+        .await
+    }
+
     pub(crate) async fn new_remote_vm(
         channel: Channel,
         driver_process: Option<Arc<ManagedDriverProcess>>,

crates/openshell-server/src/compute/mod.rs

@@ -63,6 +63,7 @@ pub use grpc::OpenShellService;
 pub use http::{health_router, http_router, metrics_router, service_http_router};
 pub use multiplex::{MultiplexService, MultiplexedService};
 use openshell_driver_kubernetes::KubernetesComputeConfig;
+use openshell_driver_substrate::SubstrateComputeConfig;
 use persistence::Store;
 use sandbox_index::SandboxIndex;
 use sandbox_watch::SandboxWatchBus;
@@ -757,11 +758,19 @@ async fn build_compute_runtime(
             .await
             .map_err(|e| Error::execution(format!("failed to create compute runtime: {e}")))
         }
-        ComputeDriverKind::Substrate => Err(Error::execution(
-            "openshell-driver-substrate is a scaffold; runtime wiring lands in M3. \
-             See crates/openshell-driver-substrate/README.md and rfc/0005-sandbox-degraded-mode/."
-                .to_string(),
-        )),
+        ComputeDriverKind::Substrate => {
+            let substrate = substrate_config_from_file(file)?;
+            ComputeRuntime::new_substrate(
+                substrate,
+                store,
+                sandbox_index,
+                sandbox_watch_bus,
+                tracing_log_bus,
+                supervisor_sessions,
+            )
+            .await
+            .map_err(|e| Error::execution(format!("failed to create compute runtime: {e}")))
+        }
     }
 }
 
@@ -785,6 +794,26 @@ fn kubernetes_config_from_file(
         .map_err(|e| Error::config(format!("invalid [openshell.drivers.kubernetes] table: {e}")))
 }
 
+/// Build a [`SubstrateComputeConfig`] from the file's
+/// `[openshell.drivers.substrate]` table merged with inheritable
+/// `[openshell.gateway]` defaults. Falls back to the driver's `Default`
+/// when no file is present.
+fn substrate_config_from_file(
+    file: Option<&config_file::ConfigFile>,
+) -> Result<SubstrateComputeConfig> {
+    let Some(file) = file else {
+        return Ok(SubstrateComputeConfig::default());
+    };
+    let merged = config_file::driver_table(
+        ComputeDriverKind::Substrate,
+        &file.openshell.gateway,
+        file.openshell.drivers.get("substrate"),
+    );
+    merged
+        .try_into()
+        .map_err(|e| Error::config(format!("invalid [openshell.drivers.substrate] table: {e}")))
+}
+
 fn kubernetes_config_for_k8s_sa_bootstrap(
     file: Option<&config_file::ConfigFile>,
 ) -> Result<KubernetesComputeConfig> {
@@ -857,7 +886,8 @@ fn configured_compute_driver(config: &Config) -> Result<ComputeDriverKind> {
             driver @ (ComputeDriverKind::Kubernetes
             | ComputeDriverKind::Vm
             | ComputeDriverKind::Docker
-            | ComputeDriverKind::Podman),
+            | ComputeDriverKind::Podman
+            | ComputeDriverKind::Substrate),
         ] => Ok(*driver),
         drivers => Err(Error::config(format!(
             "multiple compute drivers are not supported yet; configured drivers: {}",