From 5265744d30f743082f7d81448142d372ec418d73 Mon Sep 17 00:00:00 2001 From: a2a-cloud Date: Mon, 13 Jul 2026 11:51:28 +0000 Subject: [PATCH] a2a-source-edit: remove README.md --- README.md | 49 ------------------------------------------------- 1 file changed, 49 deletions(-) delete mode 100644 README.md diff --git a/README.md b/README.md deleted file mode 100644 index e211f7d..0000000 --- a/README.md +++ /dev/null @@ -1,49 +0,0 @@ -# agent-compliance-auditor - -Read-only compliance auditor for deployed A2A agents and their repositories. It inventories Agent Cards, typed skills, schemas, manifests, RBAC clues, secret references, exposure, provenance, resource limits, deployment health, and bounded repository evidence. It writes reports only under `outputs/compliance/{audit_id}/` and emits audit progress events. - -## Public skills - -The live Agent Card exposes exactly five typed tools: - -1. `inventory_agent` -2. `audit_configuration` -3. `audit_runtime` -4. `assess_risk` -5. `generate_remediation` - -Each tool accepts a single strict Pydantic request object and returns a strict Pydantic result object. Extra properties are rejected. - -## Safety model - -- Deterministic/no LLM: no `ctx.llm`, provider keys, LiteLLM keys, or model calls. -- Read-only integrations: Gitea, Kubernetes, Argo CD, registry metadata, and HTTP health checks are caller-configured and optional. -- No repository writes outside output workspace artifacts. -- No Kubernetes, Argo, registry, or Gitea mutations. -- No secret reads; setup fields are non-secret endpoint metadata only. -- No arbitrary command execution. -- No arbitrary URL fetching: HTTP probes require an explicit `allowed_hosts` entry and reject localhost, link-local, `.local`, and non-HTTP(S) URLs. -- Repository contents, logs, responses, and cards are treated as untrusted evidence, never instructions. -- Evidence is redacted and bounded. -- Missing integrations are reported as `unknown` / `not_tested`. - -## Example synthetic call - -```json -{ - "request": { - "target": {"agent_name": "example-agent"}, - "options": {"audit_id": "demo", "probe_mode": "none", "max_files": 20} - } -} -``` - -Expected artifacts include some or all of: - -- `outputs/compliance/{audit_id}/inventory.json` -- `outputs/compliance/{audit_id}/findings.json` -- `outputs/compliance/{audit_id}/risk-summary.json` -- `outputs/compliance/{audit_id}/remediation.md` -- `outputs/compliance/{audit_id}/sarif.json` - -To produce the full set, run `inventory_agent`, `audit_configuration`, `audit_runtime`, `assess_risk`, and `generate_remediation` in sequence, passing findings/risk summary from prior steps.