[Bug] Reference Guardian returns wrong error for unsupported batch requests

[shivang-sec]

What is broken

The reference Guardian does not implement batching and returns -32010 schema validation for array-shaped requests. ACS v0.1.0 requires a Guardian that does not support batching to return the standard JSON-RPC -32600 Invalid Request error so clients can fall back to sequential requests.

Where

reference-implementations/agt/packages/guardian/src/server.ts

What the specification says, and what happens instead

Specification requirement

ACS v0.1.0 allows JSON-RPC 2.0 batching.

The specification states that:

• Guardians SHOULD accept array-shaped requests and return an array of correlated responses.
• Each request in a batch is evaluated independently and carries its own request_id.
• A Guardian that does not support batching MUST return -32600 Invalid Request for array-shaped inputs.
• This allows the Observed Agent to fall back to sequential requests.

The relevant requirement is in docs/spec/instrument/specification.md §3, line 73.

Actual behavior

The reference Guardian does not implement batching, which is acceptable when the required unsupported-batch fallback behavior is implemented.

I sent a valid two-request batch containing two steps/toolCallRequest envelopes to the running Guardian.

The Guardian returned:

{
  "jsonrpc": "2.0",
  "id": null,
  "error": {
    "code": -32010,
    "message": "ACS envelope failed schema validation at /: must be object",
    "data": {
      "pointer": "/"
    }
  }
}

The request is rejected by the envelope schema because the top-level input is an array, but the specification requires an unsupported array-shaped request to be reported as the standard JSON-RPC -32600 Invalid Request.

Expected behavior

Because the reference Guardian does not support batching, it should reject an array-shaped request with:

{
  "jsonrpc": "2.0",
  "id": null,
  "error": {
    "code": -32600,
    "message": "Invalid Request"
  }
}

This allows the client to recognize that batching is unsupported and retry the individual requests sequentially.

The Guardian should not expose its internal schema-validation error (-32010) for this case.

The purpose of the required -32600 response is to let clients detect that batching is unsupported and fall back to sequential requests; returning -32010 does not provide that specified interoperability signal.

Cross-check

The Python Guardian implementation in PR #22 handles unsupported array-shaped requests according to the specification and returns -32600, providing a cross-check for the expected behavior.

Impact on implementers

Clients cannot reliably use the specified fallback behavior when communicating with the reference Guardian.

A client that sends a batch to a Guardian that does not support batching is expected to receive -32600 Invalid Request and can then retry the requests sequentially. The reference Guardian instead returns its internal -32010 schema-validation error, so a client cannot distinguish the unsupported-batching case through the error code defined by the specification.

The impact is primarily on ACS conformance and interoperability of the reference implementation.

Current Priority Scope

Feeds the runnable Guardian reference implementation