feat(deployments): Add per-deployment OpenShell backend config

[JashG]

Summary

This PR enables individual OpenShell deployments to specify a custom sandbox policy YAML (via policyPath) instead of inheriting the executor-level default.

Related Issue

Changes

• Add openshell: OpenShellDeploymentConfig | None to DeploymentBackendConfig alongside existing docker and k8s fields
• Replace del backend_config stub in OpenShellDeploymentBackend.create_deployment with parsing of the openshell section
• Add _build_deployment_policy to OpenShellDeploymentBackend: returns the executor-level policy unchanged when no policyPath is set, otherwise builds a fresh policy from the specified file with the executor's egress rule always re-injected

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with documentation updates
• Documentation only
• Contributor tooling or automation
• CI, build, or test infrastructure

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification: the policyPath override path follows the same policy-building logic already covered by test_openshell_policy.py; the no-override path is unchanged behavior
• Tests not applicable — justification:
• Documentation updated for user-visible behavior
• Documentation not applicable — justification: no user-facing docs cover per-deployment backend config for OpenShell today

Verification

• Pull request title follows the repository's Conventional Commit format
• Every commit includes an appropriate Signed-off-by: trailer
• uv run pre-commit run -a passes, or any blocked checks are identified below
• Targeted tests pass, or tests are marked not applicable above
• No secrets, API keys, or credentials are included

Targeted validation:

uv run --frozen pytest plugins/nemo-deployments/tests/unit/ -q

Summary by CodeRabbit

• New Features
  • Added OpenShell as a supported deployment backend.
  • Added optional per-deployment policy file configuration through policyPath.
  • Deployment-specific policies are applied when provided; otherwise, the default executor policy remains in use.
• Bug Fixes
  • Added validation and policy handling to ensure configured OpenShell policies are applied consistently.
• Tests
  • Added coverage for default and deployment-specific policy behavior.

[github-actions]

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	31772/40384	78.7%	63.4%
Integration Tests	18456/38314	48.2%	20.8%

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 9274a9ed-1aaf-47aa-8ce7-48655daed877

📥 Commits

Reviewing files that changed from the base of the PR and between 184b7af and 0283c00.

📒 Files selected for processing (2)

• plugins/nemo-deployments/openapi/openapi.yaml
• plugins/nemo-deployments/src/nemo_deployments_plugin/entities.py

🚧 Files skipped from review as they are similar to previous changes (2)

• plugins/nemo-deployments/openapi/openapi.yaml
• plugins/nemo-deployments/src/nemo_deployments_plugin/entities.py

---

📝 Walkthrough

Walkthrough

OpenShell deployments now support optional per-deployment sandbox policy files. The API schema, Pydantic models, backend policy selection, sandbox creation, and unit tests were updated.

Changes

OpenShell policy configuration

Layer / File(s)	Summary
Policy configuration contract plugins/nemo-deployments/openapi/openapi.yaml, plugins/nemo-deployments/src/nemo_deployments_plugin/entities.py	The OpenAPI schema and Pydantic models add the optional openshell.policyPath configuration.
Policy selection and sandbox creation plugins/nemo-deployments/src/nemo_deployments_plugin/backends/openshell/backend.py, plugins/nemo-deployments/tests/unit/backends/openshell/test_backend.py	create_deployment validates the OpenShell configuration, applies an optional policy override, preserves platform egress, and uses the effective policy for sandbox creation. Tests cover default and override policies.

Sequence Diagram(s)

sequenceDiagram
  participant DeploymentAPI
  participant create_deployment
  participant _build_deployment_policy
  participant OpenShellSandbox
  DeploymentAPI->>create_deployment: Submit optional policyPath
  create_deployment->>_build_deployment_policy: Build effective policy
  _build_deployment_policy-->>create_deployment: Return executor or deployment policy
  create_deployment->>OpenShellSandbox: Create sandbox with effective policy

Loading

Suggested reviewers: maxdubrinsky

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding per-deployment OpenShell backend configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jgulabrai/sandbox-prereqs

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

plugins/nemo-deployments/tests/unit/backends/openshell/test_backend.py (1)

303-325: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Assert preserved platform egress.

This assertion only proves that the override differs from the executor policy. Add a test with platform_egress configured and assert that the effective policy contains that egress rule. A missing inject_platform_egress call would otherwise pass this test.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@plugins/nemo-deployments/tests/unit/backends/openshell/test_backend.py`
around lines 303 - 325, The test
test_create_uses_per_deployment_policy_when_policy_path_set must verify
preserved platform egress, not only that the policy differs from
executor_policy. Configure platform_egress on the backend or relevant policy
setup, then assert the effective spec.policy contains the expected egress rule
after create_deployment, covering the inject_platform_egress behavior.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@plugins/nemo-deployments/src/nemo_deployments_plugin/backends/openshell/backend.py`:
- Line 273: The policy path currently resolves on the backend host before
CreateSandbox, so it cannot reference files available only inside the sandbox
image. In
plugins/nemo-deployments/src/nemo_deployments_plugin/backends/openshell/backend.py
lines 273-273, change the policy flow to use a backend-accessible source or
deliver and load the policy after sandbox creation. In
plugins/nemo-deployments/openapi/openapi.yaml lines 1219-1225 and
plugins/nemo-deployments/src/nemo_deployments_plugin/entities.py lines 177-185,
document and align the supported policy source with the finalized runtime
contract, then regenerate the OpenAPI schema.

---

Nitpick comments:
In `@plugins/nemo-deployments/tests/unit/backends/openshell/test_backend.py`:
- Around line 303-325: The test
test_create_uses_per_deployment_policy_when_policy_path_set must verify
preserved platform egress, not only that the policy differs from
executor_policy. Configure platform_egress on the backend or relevant policy
setup, then assert the effective spec.policy contains the expected egress rule
after create_deployment, covering the inject_platform_egress behavior.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: eb4b56ff-afb2-409f-8b8e-7ff05aa930d0

📥 Commits

Reviewing files that changed from the base of the PR and between 1c2e9d6 and 184b7af.

📒 Files selected for processing (4)

• plugins/nemo-deployments/openapi/openapi.yaml
• plugins/nemo-deployments/src/nemo_deployments_plugin/backends/openshell/backend.py
• plugins/nemo-deployments/src/nemo_deployments_plugin/entities.py
• plugins/nemo-deployments/tests/unit/backends/openshell/test_backend.py

[maxdubrinsky]

lgtm!