test: add Platform mode unit tests

- Proto conversion: NetworkEnforcementMode::Platform -> NetworkMode::Platform
- Default: zero proto value -> NetworkMode::Proxy (backward compatible)
- Platform mode preserves proxy config for loopback CONNECT proxy
- Policy round-trip: serialize/deserialize preserves network_enforcement
- Policy validation: Platform mode passes restrictive validation

Ref: NVIDIA#899

Author: Ladas

crates/openshell-policy/src/lib.rs

@@ -1821,4 +1821,24 @@ network_policies:
             "port >65535 should fail to parse"
         );
     }
+
+    #[test]
+    fn platform_mode_round_trip() {
+        let mut policy = restrictive_default_policy();
+        policy.network_enforcement = 1; // PLATFORM
+        let yaml = serialize_sandbox_policy(&policy).unwrap();
+        let parsed = parse_sandbox_policy(&yaml).unwrap();
+        assert_eq!(parsed.network_enforcement, 1);
+    }
+
+    #[test]
+    fn platform_mode_passes_validation() {
+        let mut policy = restrictive_default_policy();
+        policy.network_enforcement = 1; // PLATFORM
+        let result = validate_sandbox_policy(&policy);
+        assert!(
+            result.is_ok(),
+            "Platform mode should pass validation: {result:?}"
+        );
+    }
 }

crates/openshell-sandbox/tests/platform_mode.rs

@@ -0,0 +1,48 @@
+// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+//! Tests for NetworkMode::Platform (Issue #899).
+
+use openshell_sandbox::policy::{NetworkMode, SandboxPolicy};
+
+#[test]
+fn platform_mode_from_proto() {
+    use openshell_core::proto::{NetworkEnforcementMode, SandboxPolicy as ProtoSandboxPolicy};
+
+    let mut proto = ProtoSandboxPolicy::default();
+    proto.network_enforcement = NetworkEnforcementMode::Platform as i32;
+
+    let policy: SandboxPolicy = proto.try_into().expect("conversion should succeed");
+    assert!(
+        matches!(policy.network.mode, NetworkMode::Platform),
+        "expected Platform, got {:?}",
+        policy.network.mode
+    );
+}
+
+#[test]
+fn namespace_mode_from_proto_default() {
+    use openshell_core::proto::SandboxPolicy as ProtoSandboxPolicy;
+
+    let proto = ProtoSandboxPolicy::default();
+    let policy: SandboxPolicy = proto.try_into().expect("conversion should succeed");
+    assert!(
+        matches!(policy.network.mode, NetworkMode::Proxy),
+        "default (zero) should map to Proxy, got {:?}",
+        policy.network.mode
+    );
+}
+
+#[test]
+fn platform_mode_allows_proxy_config() {
+    use openshell_core::proto::{NetworkEnforcementMode, SandboxPolicy as ProtoSandboxPolicy};
+
+    let mut proto = ProtoSandboxPolicy::default();
+    proto.network_enforcement = NetworkEnforcementMode::Platform as i32;
+
+    let policy: SandboxPolicy = proto.try_into().expect("conversion should succeed");
+    assert!(
+        policy.network.proxy.is_some(),
+        "Platform mode should still have proxy config for loopback CONNECT proxy"
+    );
+}