feat(iron-swarm): add the nemo-iron-swarm plugin (agent red-teaming and hardening)

.github/codeql/codeql-config.yml

@@ -5,3 +5,9 @@ queries:
 
 paths-ignore:
   - sdk/python
+  # A plugin's Studio UI ships as a built bundle committed alongside its Python
+  # package, because the wheel installs it. The file is minified vendor code we
+  # neither author nor can patch — scanning it reports third-party regexes
+  # (ReDoS, unanchored patterns) as if they were ours. The sources that produce
+  # it are still scanned.
+  - plugins/*/src/*/web/dist

.gitignore

@@ -157,3 +157,12 @@ docs/helm/index.mdx
 # nektos/act files commonly used
 .act-variables
 .act-secrets
+
+# iron-swarm CLI run artifacts (builds, policies, run-logs) written into the working dir
+.iron-swarm/
+iron-swarm.yaml
+# Playwright MCP session output
+.playwright-mcp/
+# superpowers skill scratch (local plans/state)
+.superpowers/
+docs/superpowers/

docker/base/Dockerfile.nmp-studio-ui

@@ -40,6 +40,7 @@ COPY plugins/nemo-agents/openapi /app/plugins/nemo-agents/openapi
 COPY plugins/nemo-safe-synthesizer/openapi /app/plugins/nemo-safe-synthesizer/openapi
 COPY plugins/nemo-evaluator/openapi /app/plugins/nemo-evaluator/openapi
 COPY plugins/nemo-customizer/openapi /app/plugins/nemo-customizer/openapi
+COPY plugins/nemo-iron-swarm/openapi /app/plugins/nemo-iron-swarm/openapi
 
 # Install pnpm modules and generate SDK artifacts during postinstall.
 RUN pnpm install --frozen-lockfile

openapi/README.md

@@ -33,6 +33,7 @@ The generator no longer emits one spec per microservice and merges them. It now
 | Data Designer | `plugins/nemo-data-designer/openapi/openapi.yaml` |
 | Deployments | `plugins/nemo-deployments/openapi/openapi.yaml` |
 | Evaluator | `plugins/nemo-evaluator/openapi/openapi.yaml` |
+| Iron Swarm | `plugins/nemo-iron-swarm/openapi/openapi.yaml` |
 | Safe Synthesizer | `plugins/nemo-safe-synthesizer/openapi/openapi.yaml` |
 
 The Customization spec is assembled at generation time from whichever customization contributors (`nemo.customization.contributors` entry points — e.g. `automodel`, `rl`, `unsloth`) are installed in the workspace, so its route surface depends on the synced environment. To add a new plugin to this list, add an (empty is fine) `[tool.nemo.openapi]` table to its `pyproject.toml`; if the plugin has more than one `nemo.services` entry point, set `service_name` in that table to disambiguate.

plugins/example-plugin/web/AGENTS.md

@@ -62,7 +62,8 @@ resolve the SDK's types, types `host.sdk` as Studio does.
 service ships its own client, and must prefix every request with
 `host.apiBaseUrl` — Studio's dev-server `/apis` proxy is opt-in, so a bare
 `/apis/...` request hits the dev server rather than the platform whenever
-`VITE_PLATFORM_BASE_URL` is set.
+`VITE_PLATFORM_BASE_URL` is set. See `plugins/nemo-iron-swarm/web` for a
+generated client wired this way.
 
 ## Shared UI (`@nemo/common`)
 

plugins/nemo-iron-swarm/.gitignore

@@ -0,0 +1,2 @@
+# Local developer helper scripts, not part of the plugin distribution
+scripts/