feat(guardrails): local CPU embedding-model guardrail MVP (AISIX-Cloud#1331)

Cargo.toml

@@ -96,6 +96,18 @@ schemars = "0.8"
 # network access at runtime.
 tiktoken-rs = "0.12"
 
+# Local-model guardrail (AISIX-Cloud#1331): in-process CPU embedding
+# inference over ONNX Runtime. `tls-rustls` (not the default `tls-native`)
+# keeps the build-time binary downloader off OpenSSL, matching the
+# workspace's pure-rustls TLS stance. Offline builds point
+# `ORT_LIB_LOCATION` at a pre-fetched ONNX Runtime; see
+# aisix-guardrails/src/local_model.rs.
+ort = { version = "=2.0.0-rc.13", default-features = false, features = ["std", "tracing", "download-binaries", "tls-rustls", "copy-dylibs", "api-27"] }
+# HF tokenizer runtime for the model's tokenizer.json. `onig` is the regex
+# engine its pre-tokenizer split patterns need; default `progressbar` /
+# `esaxx_fast` are training/CLI conveniences an inference path never uses.
+tokenizers = { version = "0.23", default-features = false, features = ["onig"] }
+
 # Concurrency primitives
 arc-swap = "1.7"
 dashmap = "6.1"

crates/aisix-guardrails/Cargo.toml

@@ -44,6 +44,13 @@ base64 = { workspace = true, optional = true }
 chrono = { workspace = true, optional = true }
 uuid = { workspace = true, optional = true }
 
+# Local-model guardrail MVP (AISIX-Cloud#1331): in-process CPU embedding
+# inference (ONNX Runtime + HF tokenizer). NOT in default features — it
+# statically links ONNX Runtime (tens of MB) and is env-var-activated
+# experimental surface; builds opt in with `--features local-model`.
+ort = { workspace = true, optional = true }
+tokenizers = { workspace = true, optional = true }
+
 [features]
 default = [
     "bedrock",
@@ -77,6 +84,10 @@ aliyun-text-moderation = [
 lakera = ["dep:reqwest"]
 openai-moderation = ["dep:reqwest"]
 presidio = ["dep:reqwest"]
+# Local CPU embedding-model guardrail MVP (AISIX-Cloud#1331). Off by
+# default: statically links ONNX Runtime and is activated only by env
+# config (no control-plane surface yet).
+local-model = ["dep:ort", "dep:tokenizers"]
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["macros", "rt"] }

crates/aisix-guardrails/src/lib.rs

@@ -30,6 +30,8 @@ mod index;
 mod keyword;
 #[cfg(feature = "lakera")]
 mod lakera;
+#[cfg(feature = "local-model")]
+mod local_model;
 #[cfg(feature = "openai-moderation")]
 mod openai_moderation;
 mod pii;
@@ -196,6 +198,8 @@ pub use index::{GuardrailIndex, RequestContext};
 pub use keyword::{KeywordBlocklist, KeywordRule};
 #[cfg(feature = "lakera")]
 pub use lakera::LakeraGuardrail;
+#[cfg(feature = "local-model")]
+pub use local_model::{LocalModelConfig, LocalModelError, LocalModelGuardrail, MODEL_DIR_ENV};
 #[cfg(feature = "openai-moderation")]
 pub use openai_moderation::OpenaiModerationGuardrail;
 pub use pii::{builtin_rule, PiiAction, PiiGuardrail, PiiRule, BUILTIN_DETECTORS};