Design constraints
- No network calls — no CVE/malware-database lookups, no telemetry. Every rule is evaluable fully offline, deterministically, from the package’s own files.
- No ML, no entropy scoring — regex, size thresholds, set/count arithmetic, and local edit-distance only.
- Must not fire on a well-formed, benign package — every rule is checked against a realistic valid-fixture package in the service’s own test suite before it ships, to keep WARN-level false positives low enough to stay useful signal.
Resilience
The guardrails service being temporarily unreachable never takes the rest of the registry down. Its catalog is fetched on demand per-request, not cached at startup, so search, sharing, and auth stay fully available. Only the specific routes that need it — draft validate/publish, the tenant guardrail-policy endpoints,/api/v1/guardrails — return 503 GUARDRAILS_SERVICE_UNAVAILABLE if it’s down.