refactor!: rename Iron Swarm to Agent Hardener

.gitignore

@@ -161,7 +161,10 @@ docs/helm/index.mdx
 .act-variables
 .act-secrets
 
-# iron-swarm CLI run artifacts (builds, policies, run-logs) written into the working dir
+# agent-hardener CLI run artifacts (builds, policies, run-logs) written into the working dir
+.agent-hardener/
+agent-hardener.yaml
+# Pre-rename run artifacts still on developer machines
 .iron-swarm/
 iron-swarm.yaml
 # Playwright MCP session output

docker/base/Dockerfile.nmp-studio-ui

@@ -43,7 +43,7 @@ COPY plugins/nemo-agents/openapi /app/plugins/nemo-agents/openapi
 COPY plugins/nemo-safe-synthesizer/openapi /app/plugins/nemo-safe-synthesizer/openapi
 COPY plugins/nemo-evaluator/openapi /app/plugins/nemo-evaluator/openapi
 COPY plugins/nemo-customizer/openapi /app/plugins/nemo-customizer/openapi
-COPY plugins/nemo-iron-swarm/openapi /app/plugins/nemo-iron-swarm/openapi
+COPY plugins/nemo-agent-hardener/openapi /app/plugins/nemo-agent-hardener/openapi
 COPY plugins/nemo-insights/openapi /app/plugins/nemo-insights/openapi
 
 # Install pnpm modules and generate SDK artifacts during postinstall.

docs/agents/add-guardrails.mdx

@@ -0,0 +1,161 @@
+---
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+title: "Add Guardrails to an Agent"
+description: ""
+---
+<a id="agents-add-guardrails"></a>
+
+Guardrails attach to an agent through a **guarded virtual model**: a VirtualModel
+entity that uses a guardrail configuration to run input and output rails on every
+call to the main model. Pointing the agent at the guarded VirtualModel secures the
+agent's model path without changing its workflow logic.
+
+There are two steps: create the guarded VirtualModel, then update the agent's
+`llms` block to reference it.
+
+<Note>
+
+Routing model traffic through rails covers the agent's model path. It does not
+cover tool misuse or instructions injected through tool output. To test an agent
+against those and generate fixes, see Agent Governance.
+
+</Note>
+
+## Prerequisites
+
+Before adding guardrails, make sure you have:
+
+1. Local services running (`nemo services run`).
+1. At least one deployed platform-managed agent.
+1. A model provider and model entities registered in the workspace.
+1. A guardrail configuration. See
+   [Guardrail Models](/documentation/guardrail-models).
+
+Common catalog models to use as the guardrail backend (verify availability with
+`nemo models list`):
+
+- `nvidia-llama-3-1-nemoguard-8b-content-safety`
+- `nvidia-llama-3-1-nemoguard-8b-topic-control`
+- `nvidia-llama-3-1-nemotron-safety-guard-8b-v3`
+
+## 1. Create a Guarded VirtualModel
+
+<Tabs>
+
+<Tab title="CLI">
+
+```bash
+nemo inference virtual-models create guarded-agent-model \
+  --workspace default \
+  --models '[{"model":"default/<main-model-entity>","backend_format":"OPENAI_CHAT"}]' \
+  --request-middleware '[{
+    "name":"nemo-guardrails",
+    "config_type":"guardrail_config",
+    "config_id":"default/<guardrail-config>"
+  }]' \
+  --response-middleware '[{
+    "name":"nemo-guardrails",
+    "config_type":"guardrail_config",
+    "config_id":"default/<guardrail-config>"
+  }]'
+```
+
+Wire the same `<guardrail-config>` on both `--request-middleware` (for input
+rails) and `--response-middleware` (for output rails). Omit a side if the
+config defines no flows for it. For the full middleware schema, entity-backed
+versus inline configs, and caching behavior, refer to
+[Guardrails Architecture](/documentation/guardrail-models/core-concepts/architecture).
+
+</Tab>
+<Tab title="Skill">
+
+Ask your coding agent:
+
+> Check guardrail coverage on my deployed agent.
+
+The `agents-secure` skill lists deployed agents, inspects each LLM's
+`model_name`, and suggests creating a guarded virtual model where one is
+missing. Verify the skill is installed:
+
+```bash
+nemo skills show agents-secure
+```
+
+What it does under the hood:
+
+- Lists deployed agents and prompts you to choose one.
+- Inspects each LLM's `model_name`. If it does not reference a guarded
+  virtual model (one with a content-safety, topic-control, or safety-guard
+  backend), suggests creating one.
+- Names the recommended guardrails catalog model and walks you through
+  creating the guarded virtual model.
+- Persists suggestions to the `nemo-agent-security` fileset.
+
+The skill reports whether a guardrail is present. It does not test whether
+that guardrail stops a given attack.
+
+</Tab>
+<Tab title="Python SDK">
+
+```python
+import os
+from nemo_platform import NeMoPlatform
+
+client = NeMoPlatform(
+    base_url=os.environ.get("NMP_BASE_URL", "http://localhost:8080"),
+    workspace="default",
+)
+
+guardrail_mw = {
+    "name": "nemo-guardrails",
+    "config_type": "guardrail_config",
+    "config_id": "default/<guardrail-config>",
+}
+
+client.inference.virtual_models.create(
+    name="guarded-agent-model",
+    workspace="default",
+    models=[{"model": "default/<main-model-entity>", "backend_format": "OPENAI_CHAT"}],
+    request_middleware=[guardrail_mw],
+    response_middleware=[guardrail_mw],
+)
+```
+
+</Tab>
+
+</Tabs>
+
+## 2. Point the Agent at the Guarded VirtualModel
+
+In the agent's workflow YAML, set `model_name` on the relevant `llms` entry to
+the guarded VirtualModel's entity reference, with slashes converted to hyphens
+(per the [agent configuration conventions](/documentation/agents#agent-definition)):
+
+```yaml
+llms:
+  llm:
+    _type: openai
+    model_name: default-guarded-agent-model
+```
+
+Leave `base_url` and `api_key` unset. Once redeployed, every model call from the
+agent flows through the guarded VirtualModel. The agent itself is unchanged and
+unaware of the rails.
+
+For the end-to-end request flow, streaming behavior, header forwarding, and the
+`guardrails` request options, refer to
+[Running Inference with Guardrails](/documentation/guardrail-models/core-concepts/running-inference).
+
+Redeploy the agent, re-run evaluation, and compare quality, cost, latency and
+safety signals against the baseline before promoting.
+
+## Troubleshooting
+
+**Virtual model creation fails with an unknown model.** Confirm the backend model entity exists with `nemo models list`. The `<main-model-entity>` and `<guardrail-config>` placeholders must reference entities the workspace can resolve.
+
+**The agent still calls the unguarded model.** Entity references in `model_name` use hyphens, not slashes. Confirm the agent was redeployed after the config change.
+
+**The `agents-secure` skill is not available.** Run `nemo skills list` to confirm the skill is installed. If it is missing, install it with `nemo skills install --agent <claude|codex|cursor|opencode>`.
+

docs/agents/governance/apply-mitigations.mdx

@@ -0,0 +1,155 @@
+---
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+title: "Review and Apply Mitigations"
+description: ""
+---
+<a id="agents-governance-apply-mitigations"></a>
+
+<Warning>
+
+Agent Governance is released with _early access_ availability and is subject to limited support and potential API changes in future releases.
+
+</Warning>
+
+A finished war-game produces proposed defenses. This page covers choosing which
+to keep, scoring that selection, and writing it back to the agent.
+
+Nothing reaches the agent until you apply it.
+
+## What a Run Proposes
+
+Each proposed defense is tagged by the surface it changes:
+
+| Tag | Written by | Effect |
+|-----|-----------|--------|
+| Guardrail | Guardrails defender | Pre-tool verifier middleware in the agent's workflow |
+| Policy | OpenShell policy defender | A sandbox policy covering network egress, filesystem access, process identity, seccomp and Landlock |
+
+Defenses are grouped by the tool they guard. Each one shows the attack that
+motivated it and the exact configuration diff.
+
+## Score a Selection Before Applying
+
+A sanity check freezes a chosen subset, replays the recorded attacks against it,
+and runs the benign suite. Use it to compare selections without touching the
+agent.
+
+```bash
+nemo agent-hardener sanity-check --manifest-id react-agent \
+  --mitigations mitigations.json \
+  --replay-hitlog <fileset-ref> \
+  --keep custom_guardrail_1
+```
+
+| Option | Effect |
+|--------|--------|
+| `--mitigations <path>` | The run's proposed defenses |
+| `--replay-hitlog <fileset-ref>` | The recorded attacks to replay |
+| `--keep <id>` | Keep this defense. Repeatable |
+| `--exclude <id>` | Drop this defense. Repeatable |
+| `--env-file <path>` | Dotenv supplying the agent's secrets |
+
+The result reports how many attacks the selection blocks and how many benign
+requests still pass. Re-run it with a different `--keep` set to compare.
+
+## Apply to the Agent
+
+<Note>
+
+Applying is available in Studio and through the REST API. The CLI stops at
+`sanity-check`.
+
+</Note>
+
+<Tabs>
+
+<Tab title="Studio">
+
+Open the finished run and select the **Harden** panel.
+
+1. Toggle the defenses you want. Each row expands to show the attack it
+   counters and the configuration diff.
+1. Select **Sanity check** to replay the attacks against just that selection
+   and see what it blocks and which ordinary requests it breaks.
+1. Select **Apply to Agent** to record the hardened guardrails onto the
+   agent config.
+
+</Tab>
+<Tab title="REST API">
+
+Applying takes two calls. First compose the subset you chose, which returns the
+workflow and policy for exactly those defenses:
+
+```bash
+curl -X POST \
+  $NMP_BASE_URL/apis/agent-hardener/v2/workspaces/default/runs/<run-name>/compose-defense \
+  -H "Content-Type: application/json" \
+  -d '{
+    "mitigations": { ... },
+    "selected_defense_ids": ["custom_guardrail_1", "openshell_policy"]
+  }'
+```
+
+`mitigations` is the run's mitigations artifact. `selected_defense_ids` takes
+guardrail ids and `openshell_policy`. The response carries `guardrails_toml` and
+`policy_yaml`, and an unselected surface comes back at its baseline.
+
+Then write the composed guardrails onto the agent:
+
+```bash
+curl -X POST \
+  $NMP_BASE_URL/apis/agent-hardener/v2/workspaces/default/runs/<run-name>/apply-mitigation \
+  -H "Content-Type: application/json" \
+  -d '{"guardrails_toml": "<the guardrails_toml from compose-defense>"}'
+```
+
+`guardrails_toml` is required; the call returns `422` without it. Only the
+guardrails are written — `policy_yaml` is composed for review and sanity-check
+but is not applied to the agent. Runs from a bring-your-own manifest
+(`--project-dir`) are refused, because there is no registered agent to write to.
+
+The response reports `applied`, the `agent` whose config changed, and a
+`detail` note.
+
+</Tab>
+
+</Tabs>
+
+Applying records the hardened guardrails on the agent config and refreshes the
+manifest, so the next run measures the change you just made.
+
+<Warning>
+
+Applying does not yet activate the guardrails on a running agent. The guardrails
+are stored on the agent entity, but the deployment path does not read them back,
+so redeploying does not put them in force. Use `sanity-check` to confirm a
+defense works, and apply the guardrails to your agent's own configuration until
+this is wired up.
+
+</Warning>
+
+<Note>
+
+Applying writes another service's entity: it updates the target agent's config.
+The `agent-hardener.runs.apply` permission is therefore an agent-write grant in
+practice. Assign it accordingly.
+
+</Note>
+
+## Compare Two Runs
+
+Because runs target a frozen manifest, two reports for the same manifest are
+directly comparable. Run the cycle again after applying and compare the attack
+block rate and the benign pass rate against the earlier run:
+
+```bash
+nemo agent-hardener run --manifest-id react-agent
+nemo agent-hardener status --limit 5
+```
+
+## Related Topics
+
+- [Agent Hardener CLI Reference](/documentation/agents/governance/cli-reference): every command and flag.
+- [Guardrail Models](/documentation/guardrail-models): manage the guardrail configurations the defender writes against.