Guard Posture Chain

Validates cross-boundary posture-chain envelopes. The envelope carries the set of compliance regimes the call is operating under (postureSet: ["hipaa", "pci-dss"]), the hop trail (chainTrail: ["api-gateway", "mail-agent", "audit"]), per-hop timestamps, and hop count. Refuses:

- oversized trail (default hop cap = 16; defends infinite recursion across agent delegation) - non-ASCII hop names (operator-greppable in audit logs) - duplicate hop in trail (recursion guard) - missing or non-monotonic enteredAt timestamps - posture set contains non-string entries OR duplicates

b.guardPostureChain.validate(envelope, opts?) #

{
  profile:   "strict" | "balanced" | "permissive",
  posture:   "hipaa" | "pci-dss" | "gdpr" | "soc2",
}

Validate a posture-chain envelope. Returns the envelope on success; throws on refusal.

b.guardPostureChain.validate({
  postureSet: ["hipaa"],
  chainTrail: ["api-gateway", "mail-agent"],
  enteredAt:  [1700000000000, 1700000000100],
  hopCount:   2,
});

b.guardPostureChain.compliancePosture(name) #

Return the effective profile NAME for a compliance posture, or null for a name this parser does not map. Unlike the content-guard variant this returns the resolved profile string (every line-protocol parser composes gateContract.ALL_STRICT_POSTURES, so "hipaa" / "pci-dss" / "gdpr" / "soc2" all resolve to "strict") and never throws — the parser shape carries no overlay-clone, no buildProfile, and no loadRulePack. Wired by gateContract.defineParser.

b.guardPostureChain.compliancePosture("hipaa");                   // → "strict"
b.guardPostureChain.compliancePosture("not-a-regime");            // → null

Last updated 2026-08-08T16:39:49.652Z by seeder.