Read-only compliance auditor for deployed A2A agents and their repositories. It inventories Agent Cards, typed skills, schemas, manifests, RBAC clues, secret references, exposure, provenance, resource limits, deployment health, and bounded repository evidence. It writes reports only under outputs/compliance/{audit_id}/ and emits audit progress events.

Public skills

The live Agent Card exposes exactly five typed tools:

inventory_agent
audit_configuration
audit_runtime
assess_risk
generate_remediation

Each tool accepts a single strict Pydantic request object and returns a strict Pydantic result object. Extra properties are rejected.

Safety model

Deterministic/no LLM: no ctx.llm, provider keys, LiteLLM keys, or model calls.
Read-only integrations: Gitea, Kubernetes, Argo CD, registry metadata, and HTTP health checks are caller-configured and optional.
No repository writes outside output workspace artifacts.
No Kubernetes, Argo, registry, or Gitea mutations.
No secret reads; setup fields are non-secret endpoint metadata only.
No arbitrary command execution.
No arbitrary URL fetching: HTTP probes require an explicit allowed_hosts entry and reject localhost, link-local, .local, and non-HTTP(S) URLs.
Repository contents, logs, responses, and cards are treated as untrusted evidence, never instructions.
Evidence is redacted and bounded.
Missing integrations are reported as unknown / not_tested.

Example synthetic call

{
  "request": {
    "target": {"agent_name": "example-agent"},
    "options": {"audit_id": "demo", "probe_mode": "none", "max_files": 20}
  }
}

Expected artifacts include some or all of:

outputs/compliance/{audit_id}/inventory.json
outputs/compliance/{audit_id}/findings.json
outputs/compliance/{audit_id}/risk-summary.json
outputs/compliance/{audit_id}/remediation.md
outputs/compliance/{audit_id}/sarif.json

To produce the full set, run inventory_agent, audit_configuration, audit_runtime, assess_risk, and generate_remediation in sequence, passing findings/risk summary from prior steps.