LCORE-3228: Wire Shields into build_agent

[jrobertboos]

Description

Wires the previously-added shields configuration into build_agent so configured guardrail shields (question validity and PII redaction) are attached as pydantic-ai capabilities on every agent run.

_shield_capability() translates each ShieldConfiguration entry into its concrete capability instance — QuestionValidity when the config is a QuestionValidityConfig, PiiRedactionCapability when it's a RedactionConfig — raising ValueError for any unrecognized config type. _agent_capabilities() and build_agent() now accept an optional shields list and prepend the resulting shield capabilities ahead of the skills capability. configuration.shields is threaded into all three call sites that build an agent: the non-streaming query flow (utils/agents/query.py), the streaming query flow (utils/agents/streaming.py), and the A2A executor (app/endpoints/a2a.py).

Also changed QuestionValidity's capability base from AbstractCapability[None] to AbstractCapability[Any] to match the Any-typed pattern already used by PiiRedactionCapability and SkillsCapability — this avoids a pyright contravariance conflict when mixing both shield types into the same capability list, without needing to loosen _agent_capabilities's own type annotations.

Type of change

• Refactor
• New feature
• Bug fix
• CVE fix
• Optimization
• Documentation Update
• Configuration Update
• Bump-up service version
• Bump-up dependent library
• Bump-up library or tool used for development (does not change the final image)
• CI configuration change
• Konflux configuration change
• Unit tests improvement
• Integration tests improvement
• End to end tests improvement
• Benchmarks improvement

Tools used to create PR

• Assisted-by: Cursor
• Generated by: N/A

Related Tickets & Documents

• Related Issue # LCORE-3228
• Closes #

Checklist before requesting a review

• I have performed a self-review of my code.
• PR has passed all pre-merge test jobs.
• If it is a core feature, I have added thorough tests.

Testing

• Extended tests/unit/utils/test_pydantic_ai.py with coverage for _shield_capability (both shield types plus an unsupported-config-type error case), _agent_capabilities (shields alone, and shields combined with skills), and build_agent (agent includes/excludes shield capabilities based on configuration).
• Ran black, ruff, pylint, pyright, and pydocstyle against all touched files — all clean.
• Ran the full tests/unit/utils/test_pydantic_ai.py suite (20 tests) — all passing.
• Note: tests/unit/utils/agents/test_query.py, test_streaming.py, and tests/unit/app/endpoints/test_a2a.py currently fail to collect due to a pre-existing, unrelated environment issue (ImportError: cannot import name 'Shield' from 'ogx_client.types'), confirmed present before these changes too.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: bd1401ec-8e6b-4bbc-bd20-fa6b83bd317f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

✨ Simplify code

• Create PR with simplified code

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[asimurka]

LGTM, just some nits ;)

[jrobertboos]

So I am debating either leaving this PR as is with passing a List[ShieldsConfig] and then we can modify that list based on the QueryRequest.shield_ids or build_agent will have a config: AppConfig field and a shields parameter. Wdyt?