Guard Agent Registry

Registry-op shape validator for b.agent.orchestrator.register / lookup / unregister. Refuses agent names that wouldn't be safe to surface in audit logs, registry queries, or routing keys:

non-ASCII (NFC-normalized + ASCII-only — operator-greppable)
path-traversal shapes (.. / / / \ / NUL / C0 / DEL)
oversized (default 64 bytes per name)
reserved FRAMEWORK.* / ROOT / * prefix from operator code
duplicate-on-register (caller must unregister first)

b.guardAgentRegistry.validate(op, opts?) #

stable0.9.21

{
  profile:   "strict" | "balanced" | "permissive",
  posture:   "hipaa" | "pci-dss" | "gdpr" | "soc2",
}

Validate a { kind, name, agent, opts } registry op shape. Returns the op on success; throws GuardAgentRegistryError on refusal.

b.guardAgentRegistry.validate({
  kind: "register",
  name: "tenant-acme-mail",
  agentKind: "mail",
});

b.guardAgentRegistry.compliancePosture(name) #

stable0.9.21hipaapci-dsssoc2

Return the effective profile NAME for a compliance posture, or null for a name this parser does not map. Unlike the content-guard variant this returns the resolved profile string (every line-protocol parser composes gateContract.ALL_STRICT_POSTURES, so "hipaa" / "pci-dss" / "gdpr" / "soc2" all resolve to "strict") and never throws — the parser shape carries no overlay-clone, no buildProfile, and no loadRulePack. Wired by gateContract.defineParser.

b.guardAgentRegistry.compliancePosture("hipaa");                   // → "strict"
b.guardAgentRegistry.compliancePosture("not-a-regime");            // → null

Last updated 2026-08-08T16:39:49.652Z by seeder.