opsentry 1.8.0__py3-none-any.whl

opsentry/config/init_wizard.py

@@ -0,0 +1,201 @@
+#!/usr/bin/env python3
+"""Interactive setup wizard that generates guardrails.yaml from user choices."""
+
+import argparse
+import shutil
+import sys
+from pathlib import Path
+
+CONFIG_DIR = Path(__file__).parent
+TEMPLATES_DIR = CONFIG_DIR / "templates"
+
+TEMPLATES = {
+    "1": ("generic", "Generic (recommended starting point)"),
+    "2": ("fintech", "Fintech / Banking"),
+    "3": ("healthcare", "Healthcare"),
+    "4": ("manufacturing", "Manufacturing / IoT"),
+}
+
+PII_LOCALES = {"US": "US (SSN, credit cards)", "KR": "KR (Korean RRN)", "EU": "EU (IBAN, national IDs)"}
+GIT_POLICIES = {"1": "block_all", "2": "read_only", "3": "allow_all"}
+INFRA_POLICIES = {"1": "block", "2": "read_only", "3": "allow"}
+COMPLIANCE_OPTS = {"1": "iso_27001", "2": "soc2", "3": "hipaa", "4": "pci_dss"}
+LLM_PROVIDERS = {"1": "bedrock", "2": "anthropic", "3": "openai", "4": "local"}
+
+
+def ask(prompt: str, choices: dict[str, str] | None = None, default: str = "") -> str:
+    """Ask user a question with optional numbered choices."""
+    if choices:
+        print()
+        for key, label in choices.items():
+            print(f"  [{key}] {label}")
+    while True:
+        suffix = f" [{default}]" if default else ""
+        answer = input(f"\n{prompt}{suffix}: ").strip()
+        if not answer and default:
+            return default
+        if choices and answer in choices:
+            return answer
+        if not choices and answer:
+            return answer
+        if choices:
+            print(f"  Please enter one of: {', '.join(choices.keys())}")
+
+
+def ask_multi(prompt: str, choices: dict[str, str]) -> list[str]:
+    """Ask user to select multiple options (comma-separated)."""
+    print()
+    for key, label in choices.items():
+        print(f"  [{key}] {label}")
+    print(f"  [0] None")
+    while True:
+        answer = input(f"\n{prompt} (comma-separated, or 0 for none): ").strip()
+        if answer == "0":
+            return []
+        parts = [p.strip() for p in answer.split(",")]
+        if all(p in choices for p in parts):
+            return [choices[p] for p in parts]
+        print(f"  Please enter valid choices from: {', '.join(choices.keys())}, or 0")
+
+
+def run_interactive() -> str:
+    """Run the interactive wizard. Returns path to the generated guardrails.yaml."""
+    print("=" * 50)
+    print("  OpSentry Setup Wizard")
+    print("=" * 50)
+
+    # Step 1: Template
+    choice = ask("Select an industry template:", TEMPLATES, default="1")
+    template_name = TEMPLATES[choice][0]
+
+    # Copy template
+    src = TEMPLATES_DIR / f"{template_name}.yaml"
+    dest = Path("guardrails.yaml")
+    shutil.copy2(src, dest)
+
+    # Load as text for in-place edits
+    content = dest.read_text()
+
+    # Step 2: Organization
+    org_name = ask("Organization name (optional, press Enter to skip):", default="")
+    if org_name:
+        content = content.replace('  name: ""', f'  name: "{org_name}"')
+
+    # Step 3: PII locales
+    print("\nWhich PII locales do you need?")
+    print("  US (SSN, credit cards) is always included.")
+    extra_locales = []
+    kr = input("  Include KR (Korean RRN)? [y/N]: ").strip().lower()
+    if kr in ("y", "yes"):
+        extra_locales.append("KR")
+    eu = input("  Include EU (IBAN)? [y/N]: ").strip().lower()
+    if eu in ("y", "yes"):
+        extra_locales.append("EU")
+
+    locales_str = ", ".join(f'"{l}"' for l in ["US"] + extra_locales)
+    # Replace the locales line
+    import re
+    content = re.sub(r'locales:\s*\[.*?\]', f'locales: [{locales_str}]', content)
+
+    # Step 4: Git policy
+    print("\nGit policy for AI agents:")
+    git_choice = ask("Select git policy:", {
+        "1": "Block all git commands (most secure, recommended)",
+        "2": "Allow read-only (status, log, diff)",
+        "3": "Allow all (not recommended)",
+    }, default="1")
+    git_policy = GIT_POLICIES[git_choice]
+    content = re.sub(r'git_policy:\s*".*?"', f'git_policy: "{git_policy}"', content)
+
+    # Step 5: Infra tools
+    print("\nInfrastructure tools policy:")
+    for tool in ("docker", "terraform", "kubectl"):
+        tool_choice = ask(f"  {tool}:", {
+            "1": "Block all",
+            "2": "Read-only (recommended)",
+            "3": "Allow all",
+        }, default="2")
+        policy = INFRA_POLICIES[tool_choice]
+        content = re.sub(rf'{tool}:\s*".*?"', f'{tool}: "{policy}"', content)
+
+    # Step 6: Compliance
+    frameworks = ask_multi("Compliance frameworks:", COMPLIANCE_OPTS)
+    if frameworks:
+        fw_str = ", ".join(f'"{f}"' for f in frameworks)
+        content = re.sub(r'frameworks:\s*\[.*?\]', f'frameworks: [{fw_str}]', content)
+
+    # Step 7: LLM provider
+    llm_choice = ask("LLM provider for CI agents:", {
+        "1": "AWS Bedrock",
+        "2": "Anthropic API",
+        "3": "OpenAI-compatible",
+        "4": "Local (Ollama/LM Studio)",
+    }, default="1")
+    provider = LLM_PROVIDERS[llm_choice]
+    content = re.sub(r'llm_provider:\s*".*?"', f'llm_provider: "{provider}"', content)
+
+    # Write
+    dest.write_text(content)
+    print(f"\n{'=' * 50}")
+    print(f"  Created {dest}")
+    print(f"  Run: python3 config/generate.py guardrails.yaml")
+    print(f"{'=' * 50}")
+    return str(dest)
+
+
+def run_non_interactive(args: argparse.Namespace) -> str:
+    """Generate guardrails.yaml from CLI flags."""
+    template_name = args.template or "generic"
+    src = TEMPLATES_DIR / f"{template_name}.yaml"
+    if not src.exists():
+        print(f"ERROR: Template not found: {src}", file=sys.stderr)
+        sys.exit(1)
+
+    dest = Path(args.output or "guardrails.yaml")
+    shutil.copy2(src, dest)
+
+    content = dest.read_text()
+    import re
+
+    if args.org:
+        content = content.replace('  name: ""', f'  name: "{args.org}"')
+
+    if args.pii:
+        locales_str = ", ".join(f'"{l}"' for l in args.pii.split(","))
+        content = re.sub(r'locales:\s*\[.*?\]', f'locales: [{locales_str}]', content)
+
+    if args.git_policy:
+        content = re.sub(r'git_policy:\s*".*?"', f'git_policy: "{args.git_policy}"', content)
+
+    if args.compliance:
+        fw_str = ", ".join(f'"{f}"' for f in args.compliance.split(","))
+        content = re.sub(r'frameworks:\s*\[.*?\]', f'frameworks: [{fw_str}]', content)
+
+    if args.llm:
+        content = re.sub(r'llm_provider:\s*".*?"', f'llm_provider: "{args.llm}"', content)
+
+    dest.write_text(content)
+    print(f"Created {dest}")
+    return str(dest)
+
+
+def main():
+    parser = argparse.ArgumentParser(description="OpSentry Setup Wizard")
+    parser.add_argument("--non-interactive", action="store_true", help="Run without prompts")
+    parser.add_argument("--template", help="Template: generic, fintech, healthcare, manufacturing")
+    parser.add_argument("--org", help="Organization name")
+    parser.add_argument("--pii", help="PII locales, comma-separated: US,KR,EU")
+    parser.add_argument("--git-policy", help="Git policy: block_all, read_only, allow_all")
+    parser.add_argument("--compliance", help="Compliance frameworks, comma-separated: iso_27001,soc2,hipaa,pci_dss")
+    parser.add_argument("--llm", help="LLM provider: bedrock, anthropic, openai, local")
+    parser.add_argument("--output", "-o", help="Output path (default: guardrails.yaml)")
+    args = parser.parse_args()
+
+    if args.non_interactive:
+        run_non_interactive(args)
+    else:
+        run_interactive()
+
+
+if __name__ == "__main__":
+    main()

opsentry/config/rule_texts/01_sensitive_files.md

@@ -0,0 +1,15 @@
+## 1. Sensitive File Access — NEVER Read or Modify
+
+You must never read, open, display, reference, or modify the contents of the following files or patterns. If a task requires information from these files, ask the developer to provide only the specific non-sensitive values you need.
+
+- `.env`, `.env.*`, `.env.local`, `.env.production`, `.env.staging`
+- `credentials.json`, `credentials.yaml`, `credentials.toml`
+- Any file with `secret`, `secrets`, `token`, or `tokens` in its name
+- `*.pem`, `*.key`, `*.crt`, `*.p12`, `*.pfx` (SSL/TLS certificates and private keys)
+- `~/.ssh/*` (SSH keys and config)
+- `~/.aws/*`, `~/.azure/*`, `~/.gcloud/*` (cloud provider credentials)
+- `*.keystore`, `*.jks` (Java keystores)
+- `snowflake.config`, `profiles.yml`, `connections.toml` (database connection configs)
+- Any file inside directories named `secrets/`, `credentials/`, `private/`, or `keys/`
+
+If you encounter a file matching these patterns during a task, skip it and inform the developer.

opsentry/config/rule_texts/02_client_data.md

@@ -0,0 +1,10 @@
+## 2. Client Confidential Data — STRICTLY CONFIDENTIAL
+
+You must never include any client-specific or business-sensitive identifiers in your outputs, code comments, commit messages, logs, or prompts to external services. This includes but is not limited to:
+
+- Client or partner company names
+- Internal project identifiers or account IDs
+- Business-specific metrics, KPIs, or proprietary formulas
+- Any data that could identify a specific client's setup or operations
+
+When writing code that handles client data, use generic variable names and placeholder values in examples. Never hardcode real client data. If you need to create test data, generate clearly fake values (e.g., `client_name = "EXAMPLE_CLIENT_001"`).

opsentry/config/rule_texts/03_credentials.md

@@ -0,0 +1,17 @@
+## 3. Credentials and Connection Strings — NEVER Hardcode
+
+You must never write credentials, API keys, tokens, passwords, or connection strings directly into code. This applies to all contexts including tests, scripts, configuration files, and documentation.
+
+**Always do this:**
+- Reference environment variables: `os.environ.get("DB_PASSWORD")`
+- Use secrets manager references
+- Use placeholder values in examples: `"your-api-key-here"` or `"<DB_TOKEN>"`
+- Use `.env.example` files with empty values to document required variables
+
+**Never do this:**
+- `password = "actual_password_123"`
+- `api_key = "sk-abc123..."`
+- `connection_string = "postgresql://user:pass@host/db"`
+- Embed tokens in URLs, headers, or query parameters as literal strings
+
+If you see hardcoded credentials in existing code, flag it to the developer immediately and suggest refactoring to use environment variables or the secrets manager.

opsentry/config/rule_texts/04_sql_safety.md

@@ -0,0 +1,33 @@
+## 4. SQL Safety — Prevent Injection Vulnerabilities
+
+All SQL queries must use parameterized queries or prepared statements. Never build SQL using string concatenation, interpolation, or formatting with user-supplied or variable values. This applies to every language and database.
+
+**Dangerous patterns by language (never generate these):**
+
+Python:
+- `f"SELECT * FROM t WHERE id = '{val}'"` / `"..." + val` / `"..." % val`
+
+Java/JDBC:
+- `"SELECT * FROM t WHERE id = '" + val + "'"` via `Statement.execute()`
+
+JavaScript/TypeScript:
+- `` `SELECT * FROM t WHERE id = '${val}'` `` / `"..." + val`
+
+C (embedded SQL):
+- `sprintf(query, "SELECT * FROM t WHERE id = '%s'", val)`
+
+**Safe patterns by language (always use these):**
+
+Python:
+- `cursor.execute("SELECT * FROM t WHERE id = %s", (val,))`
+
+Java/JDBC:
+- `PreparedStatement ps = conn.prepareStatement("SELECT * FROM t WHERE id = ?"); ps.setString(1, val);`
+
+JavaScript/TypeScript:
+- `db.query("SELECT * FROM t WHERE id = $1", [val])` (pg) / `db.query("SELECT * FROM t WHERE id = ?", [val])` (mysql2)
+
+C:
+- Use the database library's parameterized API (e.g., `mysql_stmt_prepare` + `mysql_stmt_bind_param`)
+
+No exceptions regardless of database (MySQL, PostgreSQL, Snowflake, SQLite, etc.).

opsentry/config/rule_texts/05_dangerous_code.md

@@ -0,0 +1,29 @@
+## 5. Dangerous Code Patterns — Do Not Use
+
+Never generate code using the following patterns. If existing code uses them, flag and suggest safe alternatives.
+
+**Python:**
+- `eval()` / `exec()` — use `ast.literal_eval()` or `json.loads()` for data parsing
+- `pickle.loads()` on untrusted data — use `json` or other safe formats
+- `subprocess.run(..., shell=True)` with variable input — use a list: `subprocess.run(["cmd", "arg1"])`
+- `os.system()` — use `subprocess.run()` instead
+- `__import__()` with variable input — can load arbitrary modules
+
+**Java:**
+- `Runtime.getRuntime().exec(userInput)` — use `ProcessBuilder` with explicit argument lists
+- `ScriptEngine.eval()` with untrusted input — arbitrary code execution
+- `ObjectInputStream.readObject()` on untrusted data — deserialization attacks. Use JSON or validated schemas
+- `Class.forName()` with user-controlled input — can instantiate arbitrary classes
+- `System.loadLibrary()` / `System.load()` with variable input — arbitrary native code execution
+
+**JavaScript / TypeScript:**
+- `eval()` / `new Function(userInput)` — use `JSON.parse()` for data
+- `child_process.exec(userInput)` — use `child_process.execFile()` or `spawn()` with argument arrays
+- `require(userInput)` / dynamic `import(userInput)` — can load arbitrary modules
+- `vm.runInNewContext()` with untrusted input — sandbox escapes are well-documented
+
+**C / C++:**
+- `system()` with variable input — use `execvp()` or `posix_spawn()` with explicit argument arrays
+- `gets()` — always use `fgets()` with buffer size
+- `sprintf()` / `strcpy()` without bounds — use `snprintf()` / `strncpy()` or safer alternatives
+- `dlopen()` / `dlsym()` with user-controlled paths — arbitrary code loading

opsentry/config/rule_texts/06_frontend_xss.md

@@ -0,0 +1,9 @@
+## 6. Frontend Security — Prevent XSS
+
+When generating frontend code (JavaScript, TypeScript, React, HTML):
+
+- Never assign unsanitized user input to `innerHTML`, `outerHTML`, or `document.write()`
+- Use `textContent` instead of `innerHTML` when displaying user-provided text
+- In React, never use `dangerouslySetInnerHTML` unless the content is sanitized with a library like DOMPurify
+- Always escape user input before rendering it in HTML context
+- Never construct HTML strings with template literals containing user input

opsentry/config/rule_texts/07_git_operations_block_all.md

@@ -0,0 +1,13 @@
+## 7. Git Operations — Do Not Execute
+
+You must not execute any git commands. The developer manages version control themselves.
+
+**Never run:**
+- `git commit`, `git push`, `git pull`, `git merge`
+- `git reset` (especially `--hard`)
+- `git push --force` or `git push --force-with-lease`
+- `git checkout` to switch branches
+- `git stash`, `git rebase`, `git cherry-pick`
+- `git tag`, `git branch -d`, `git branch -D`
+
+If a developer asks you to help with git workflows, provide the commands as text for them to review and run manually. Do not execute them.

opsentry/config/rule_texts/07_git_operations_read_only.md

@@ -0,0 +1,18 @@
+## 7. Git Operations — Read-Only Permitted
+
+You may use read-only git commands to understand the repository state. You must not execute any git commands that modify the repository.
+
+**Allowed (read-only):**
+- `git status`, `git log`, `git diff`, `git show`
+- `git branch` (list only, no `-d` or `-D`)
+- `git remote -v`, `git describe`
+
+**Never run:**
+- `git commit`, `git push`, `git pull`, `git merge`
+- `git reset` (especially `--hard`)
+- `git push --force` or `git push --force-with-lease`
+- `git checkout` to switch branches
+- `git stash`, `git rebase`, `git cherry-pick`
+- `git tag`, `git branch -d`, `git branch -D`
+
+If a developer asks you to help with git workflows beyond read-only commands, provide the commands as text for them to review and run manually.

opsentry/config/rule_texts/08_destructive_commands.md

@@ -0,0 +1,12 @@
+## 8. Destructive Commands — Never Execute
+
+The following commands must never be run under any circumstances:
+
+- `rm -rf` or any recursive forced deletion
+- `rm -r` on directories outside the immediate working scope
+- `sudo` anything — you should never need root access
+- `chmod 777` — never set world-readable/writable/executable permissions
+- `mkfs`, `dd`, `fdisk` — disk-level operations
+- `kill -9` on system processes
+- `systemctl stop`, `service stop` on production services
+- Any command that downloads and pipes to shell: `curl ... | sh`, `wget ... | bash`

opsentry/config/rule_texts/09_database_safety.md

@@ -0,0 +1,17 @@
+## 9. Database Safety — No Direct Production Access
+
+You must not autonomously connect to or execute queries against any database. Your role is to help write queries, not execute them.
+
+**Never do:**
+- Construct and run `snowsql`, `mysql`, `psql` connection commands
+- Execute queries using credentials found in config files
+- Run `DROP TABLE`, `DROP DATABASE`, `TRUNCATE TABLE`
+- Run `DELETE FROM` without a WHERE clause
+- Run `ALTER TABLE` or schema modifications
+- Run `UPDATE` without a WHERE clause
+
+**Instead:**
+- Write the query and present it to the developer for review
+- Use clearly commented placeholder values for any connection parameters
+- Always include a WHERE clause in DELETE and UPDATE statements
+- Add a comment like `-- REVIEW BEFORE RUNNING` on any data-modifying query

opsentry/config/rule_texts/10_network_requests.md

@@ -0,0 +1,10 @@
+## 10. Network Requests — Restrict Outbound Access
+
+Do not make network requests to unknown or external domains. Specifically:
+
+- Never run `curl`, `wget`, or `fetch` to external URLs unless the developer explicitly provides and approves the URL
+- Never download and execute scripts from the internet
+- Never send data to external APIs, webhooks, or logging services
+- Never install packages from unknown or unofficial registries
+
+If a task requires calling an external API, write the code and let the developer review it before execution.

opsentry/config/rule_texts/11_code_quality.md

@@ -0,0 +1,13 @@
+## 11. Code Quality Standards
+
+All code you generate must follow these standards regardless of language:
+
+- Follow the existing code style of the project (check surrounding files for conventions)
+- Never suppress linter or compiler warnings without a documented reason
+- Never comment out code as a way to "disable" functionality — remove it or use feature flags
+- Add `TODO` comments when something needs follow-up, including the reason
+- Always catch specific exceptions/errors, never use bare catch-all handlers:
+  - Python: no bare `except:` — catch specific exception types
+  - Java: no bare `catch (Exception e)` — catch specific exception types
+  - JavaScript/TypeScript: no empty `catch {}` — handle or rethrow with context
+  - C/C++: always check return values from system calls and library functions

opsentry/config/rule_texts/12_data_exfiltration.md

@@ -0,0 +1,10 @@
+## 12. Data Exfiltration Prevention
+
+Never attempt to send file contents, encoded data, or sensitive information outside the local environment:
+
+- Never use `curl -d @file`, `curl -F`, `wget --post-file`, or similar file-uploading constructs
+- Never encode sensitive files with `base64`, `xxd`, `od`, or similar tools
+- Never pipe sensitive file contents to clipboard tools (`pbcopy`, `xclip`, `xsel`)
+- Never write project files to `/tmp/`, `/var/tmp/`, `/dev/shm/`, or other world-readable locations
+- Never open outbound data channels with `nc`, `netcat`, or `ncat`
+- Never embed sensitive content in URLs, query parameters, or request bodies

opsentry/config/rule_texts/13_package_install.md

@@ -0,0 +1,9 @@
+## 13. Package Installation Safety
+
+When installing packages, only use official registries:
+
+- Never install from arbitrary git URLs, tarballs, or direct download links
+- Never use custom `--index-url`, `--registry`, or `--source` flags pointing to non-standard registries
+- Never pipe `curl`/`wget` output to package managers
+- For all languages (pip, npm, gem, go, maven, cargo), only install named packages from their default public registries
+- If a project requires a private registry, the developer will configure it in project-level config files

opsentry/config/rule_texts/14_scope_boundaries.md

@@ -0,0 +1,8 @@
+## 14. Scope Boundaries
+
+Your file operations must stay within the project directory:
+
+- Never write to system paths: `/etc/`, `/usr/`, `/opt/`, `/var/` (except `/var/log`), `/System/`, `/Library/`
+- Never modify shell configuration files: `.bashrc`, `.zshrc`, `.bash_profile`, `.zprofile`, `.profile`
+- Never read or modify anything in `~/.claude/` -- this directory contains security guardrails
+- If you need to create temporary files, create them within the project directory

opsentry/config/rule_texts/15_env_isolation.md

@@ -0,0 +1,9 @@
+## 15. Environment Isolation
+
+Do not interact with production infrastructure or escape the local development environment:
+
+- Never use `ssh`, `scp`, or `rsync` to connect to remote hosts
+- Never run `docker run`, `docker exec`, `docker cp`, or `docker build` (read-only `docker ps`/`docker logs` are permitted)
+- Never read, set, or export production environment variables (prefixed with `PROD_` or `PRODUCTION_`)
+- Never run destructive infrastructure commands: `terraform apply/destroy/import`, `kubectl delete/exec/apply`
+- Read-only infrastructure commands are permitted: `terraform plan/validate`, `kubectl get/describe/logs`

opsentry/config/rule_texts/16_resource_limits.md

@@ -0,0 +1,8 @@
+## 16. Resource Limits
+
+Operate efficiently and avoid unbounded operations:
+
+- Never generate individual files exceeding {{ max_file_lines }} lines -- propose splitting into modules instead
+- Avoid infinite loops or recursive operations without clear termination conditions
+- If a task requires processing a large number of files, process them in bounded batches
+- Do not make repeated failing tool calls -- after 2 failures, stop and explain the issue

opsentry/config/rule_texts/17_compliance_privacy.md

@@ -0,0 +1,9 @@
+## 17. Compliance and Data Privacy
+
+Protect personally identifiable information (PII) and respect licensing:
+
+- Never include real names, email addresses, phone numbers, or physical addresses in generated code, comments, or test data
+- Use clearly synthetic test data: `user@example.com`, `Jane Doe`, `555-0100`
+- Never copy code from external sources without noting the license
+- When referencing open-source code, verify license compatibility (avoid GPL in proprietary codebases unless explicitly approved)
+- Never log, print, or display PII in debug output or error messages

opsentry/config/rule_texts/18_when_in_doubt.md

@@ -0,0 +1,10 @@
+## 18. When in Doubt
+
+If you are uncertain whether an action violates these rules:
+
+- Do not proceed with the action
+- Explain what you were about to do and why you stopped
+- Ask the developer for explicit guidance
+- Default to the safer option in all cases
+
+These guardrails exist to protect client data, company infrastructure, and code quality. They are not suggestions — they are requirements.

opsentry/config/schema.py

@@ -0,0 +1,142 @@
+"""Schema validation for guardrails.yaml configuration files."""
+
+import sys
+from typing import Any
+
+VALID_PII_LOCALES = {"US", "KR", "EU"}
+VALID_GIT_POLICIES = {"block_all", "read_only", "allow_all"}
+VALID_INFRA_POLICIES = {"block", "read_only", "allow"}
+VALID_COMPLIANCE_FRAMEWORKS = {"iso_27001", "soc2", "hipaa", "pci_dss"}
+VALID_LLM_PROVIDERS = {"bedrock", "anthropic", "openai", "local"}
+VALID_SCAN_MODES = {"changed", "full"}
+
+RULE_KEYS = [
+    "sensitive_file_access", "client_confidential_data", "credentials_no_hardcode",
+    "sql_safety", "dangerous_code_patterns", "frontend_security_xss",
+    "git_operations", "destructive_commands", "database_safety",
+    "network_requests", "code_quality_standards", "data_exfiltration",
+    "package_installation", "scope_boundaries", "environment_isolation",
+    "resource_limits", "compliance_data_privacy", "when_in_doubt",
+]
+
+
+def validate_config(config: dict[str, Any]) -> list[str]:
+    """Validate a guardrails config dict. Returns list of error strings (empty = valid)."""
+    errors: list[str] = []
+
+    # Version
+    version = config.get("version")
+    if version is None:
+        errors.append("Missing required field: version")
+    elif str(version) != "2.0":
+        errors.append(f"Unsupported version: {version} (expected 2.0)")
+
+    # Organization (optional but must be dict if present)
+    org = config.get("organization", {})
+    if not isinstance(org, dict):
+        errors.append("organization must be a mapping")
+
+    # Rules
+    rules = config.get("rules", {})
+    if not isinstance(rules, dict):
+        errors.append("rules must be a mapping")
+    else:
+        for key in RULE_KEYS:
+            val = rules.get(key)
+            if val is None:
+                errors.append(f"Missing rule toggle: rules.{key}")
+            elif not isinstance(val, bool):
+                errors.append(f"rules.{key} must be true or false, got {type(val).__name__}")
+
+    # PII
+    pii = config.get("pii", {})
+    if not isinstance(pii, dict):
+        errors.append("pii must be a mapping")
+    else:
+        locales = pii.get("locales", [])
+        if not isinstance(locales, list):
+            errors.append("pii.locales must be a list")
+        else:
+            for loc in locales:
+                if loc not in VALID_PII_LOCALES:
+                    errors.append(f"Invalid PII locale: {loc} (valid: {', '.join(sorted(VALID_PII_LOCALES))})")
+
+    # Git policy
+    git_policy = config.get("git_policy", "block_all")
+    if git_policy not in VALID_GIT_POLICIES:
+        errors.append(f"Invalid git_policy: {git_policy} (valid: {', '.join(sorted(VALID_GIT_POLICIES))})")
+
+    # Infra tools
+    infra = config.get("infra_tools", {})
+    if not isinstance(infra, dict):
+        errors.append("infra_tools must be a mapping")
+    else:
+        for tool in ("docker", "terraform", "kubectl"):
+            val = infra.get(tool, "read_only")
+            if val not in VALID_INFRA_POLICIES:
+                errors.append(f"Invalid infra_tools.{tool}: {val} (valid: {', '.join(sorted(VALID_INFRA_POLICIES))})")
+
+    # Blocked files
+    bf = config.get("blocked_files", {})
+    if isinstance(bf, dict):
+        extra = bf.get("extra_patterns", [])
+        if not isinstance(extra, list):
+            errors.append("blocked_files.extra_patterns must be a list")
+    elif bf is not None:
+        errors.append("blocked_files must be a mapping")
+
+    # Blocked commands
+    bc = config.get("blocked_commands", {})
+    if isinstance(bc, dict):
+        extra = bc.get("extra_patterns", [])
+        if not isinstance(extra, list):
+            errors.append("blocked_commands.extra_patterns must be a list")
+    elif bc is not None:
+        errors.append("blocked_commands must be a mapping")
+
+    # Client data
+    cd = config.get("client_data", {})
+    if isinstance(cd, dict):
+        patterns = cd.get("patterns", [])
+        if not isinstance(patterns, list):
+            errors.append("client_data.patterns must be a list")
+        else:
+            for i, p in enumerate(patterns):
+                if not isinstance(p, dict) or "pattern" not in p or "name" not in p:
+                    errors.append(f"client_data.patterns[{i}] must have 'pattern' and 'name' fields")
+    elif cd is not None:
+        errors.append("client_data must be a mapping")
+
+    # Compliance
+    comp = config.get("compliance", {})
+    if isinstance(comp, dict):
+        frameworks = comp.get("frameworks", [])
+        if not isinstance(frameworks, list):
+            errors.append("compliance.frameworks must be a list")
+        else:
+            for fw in frameworks:
+                if fw not in VALID_COMPLIANCE_FRAMEWORKS:
+                    errors.append(f"Invalid compliance framework: {fw} (valid: {', '.join(sorted(VALID_COMPLIANCE_FRAMEWORKS))})")
+    elif comp is not None:
+        errors.append("compliance must be a mapping")
+
+    # CI agents
+    ci = config.get("ci_agents", {})
+    if isinstance(ci, dict):
+        provider = ci.get("llm_provider", "bedrock")
+        if provider not in VALID_LLM_PROVIDERS:
+            errors.append(f"Invalid ci_agents.llm_provider: {provider}")
+        scan_mode = ci.get("scan_mode", "changed")
+        if scan_mode not in VALID_SCAN_MODES:
+            errors.append(f"Invalid ci_agents.scan_mode: {scan_mode}")
+    elif ci is not None:
+        errors.append("ci_agents must be a mapping")
+
+    # Resource limits
+    rl = config.get("resource_limits", {})
+    if isinstance(rl, dict):
+        mfl = rl.get("max_file_lines", 500)
+        if not isinstance(mfl, int) or mfl < 1:
+            errors.append("resource_limits.max_file_lines must be a positive integer")
+
+    return errors