feat(agents): AgentSandboxSpec entity with CRUD, resolution, snapshot, and runtime wiring - #1525
Draft
maxdubrinsky wants to merge 5 commits into
Conversation
maxdubrinsky
force-pushed
the
mdubrinsky/aircore-1068-agentsandboxspec-entity-crud-routes-resolution-and-runtime
branch
from
August 25, 2026 20:21
6c8dd57 to
a806544
Compare
Contributor
|
Add SandboxSpecInline (provider + provider_config) as the isolation-posture slot on AgentEnvironment that RFC-129 left out of scope. AgentSandboxSpec is a first-class entity with CRUD routes at /sandbox-specs, mirroring the EnvironmentSpec and ComputeSpec pattern from #1379. The sandbox_spec field on AgentEnvironmentInline is ref | inline | None, matching the composition model. No runtime wiring or compiler integration yet; this is the entity layer only. Signed-off-by: Max Dubrinsky <mdubrinsky@nvidia.com>
… runtime
Resolve sandbox_spec refs in environment_resolution (ResolvedEnvironment +
_resolve_sandbox_spec), snapshot it onto AgentDeployment as a new sandbox
field, and plumb it through the controller → RunnerBackend →
DeploymentConfig.backend_config.
The _SANDBOX_PROVIDER_BACKEND_CONFIG_MODELS registry maps provider names
(e.g. "openshell") to backend config models; provider_config is validated
against the model and compiled into DeploymentBackendConfig.{provider}.
Unknown providers are silently skipped.
Subprocess mode ignores sandbox (no isolation). Container mode is the
only consumer today.
AIRCORE-1068
Signed-off-by: Max Dubrinsky <mdubrinsky@nvidia.com>
Add --environment/-e flag to `nemo agents deploy` accepting ref strings
("workspace/name") or inline JSON. Add environment parameter to
_DeploymentResource.create in the Python SDK.
AIRCORE-1068
Signed-off-by: Max Dubrinsky <mdubrinsky@nvidia.com>
…ield AIRCORE-1068 Signed-off-by: Max Dubrinsky <mdubrinsky@nvidia.com>
… update AIRCORE-1068 Signed-off-by: Max Dubrinsky <mdubrinsky@nvidia.com>
maxdubrinsky
force-pushed
the
mdubrinsky/aircore-1068-agentsandboxspec-entity-crud-routes-resolution-and-runtime
branch
from
August 26, 2026 21:46
a806544 to
51dff82
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
AgentSandboxSpecas a first-class entity with CRUD routes at/sandbox-specs, wires it end-to-end through environment resolution, deployment snapshotting, and runtime compilation into the deployments-pluginDeploymentConfig.backend_config. The sandbox spec defines an agent's isolation posture (provider + provider_config) and is referenced byAgentEnvironment.sandbox_specas a ref/inline/None union, mirroring the EnvironmentSpec/ComputeSpec pattern from #1379.Related Issue
Closes AIRCORE-1068
Changes
SandboxSpecInlinemodel (provider + provider_config) andAgentSandboxSpecentity with CRUD routes at/sandbox-specssandbox_specfield onAgentEnvironment/AgentEnvironmentInline(ref | inline | None)ResolvedEnvironmentcarriessandbox_spec;_resolve_sandbox_spec()dereferences refsAgentDeploymentgetssandbox: SandboxSpecInline | Nonesnapshot fieldcreate_deploymentroute snapshots resolved sandbox_spec onto the deploymentRunnerBackend.create_deployment()addssandboxparameter; subprocess ignores it, containers compile it_build_sandbox_backend_config()maps provider names (e.g. "openshell") toDeploymentBackendConfigmodels via_SANDBOX_PROVIDER_BACKEND_CONFIG_MODELSregistrynemo agents deploy --environmentCLI flag and SDKenvironmentparametersandboxfield onAgentDeploymentType of Change
Quality Gates
--helptext is self-documenting.Verification
Signed-off-by:trailerTargeted validation: