LCORE-3390: Input guardrail point on all query endpoints

docs/devel_doc/openapi.json

@@ -14639,7 +14639,13 @@
                     "url": {
                         "type": "string",
                         "title": "Base URL",
-                        "description": "The model_id to use for the guard"
+                        "description": "Base URL of the OpenAI-compatible inference endpoint."
+                    },
+                    "model_id": {
+                        "type": "string",
+                        "title": "Model name",
+                        "description": "Model name sent to the inference server. Override when the server registers the model under a different name (e.g. an Ollama tag). The prompt template is built for the 4.1 format.",
+                        "default": "ibm-granite/granite-guardian-4.1-8b"
                     },
                     "api_key": {
                         "anyOf": [
@@ -14686,6 +14692,21 @@
                         "description": "SSL certificate verification. Can be:\n  - True: Verify using system CA bundle (default, recommended)\n  - False: Disable verification (insecure, for dev only)\n  - str: Path to custom CA bundle file (for internal PKI)",
                         "default": true
                     },
+                    "parallel": {
+                        "anyOf": [
+                            {
+                                "type": "boolean"
+                            },
+                            {
+                                "type": "integer",
+                                "maximum": 10.0,
+                                "minimum": 1.0
+                            }
+                        ],
+                        "title": "Parallel execution",
+                        "description": "True to run all risk checks in parallel, False to run sequentially, or an integer 1-10 for explicit batch size.",
+                        "default": 3
+                    },
                     "risks": {
                         "items": {
                             "$ref": "#/components/schemas/RiskDefinition"

src/models/config.py

@@ -23,6 +23,7 @@
     PositiveInt,
     PrivateAttr,
     SecretStr,
+    StrictBool,
     field_validator,
     model_validator,
 )
@@ -2422,8 +2423,7 @@ def validate_providers_and_default(self) -> Self:
 
         if self.default_provider is None:
             raise ValueError(
-                "vector_store.default_provider is required when providers "
-                "is non-empty"
+                "vector_store.default_provider is required when providers is non-empty"
             )
 
         ids = [provider.id for provider in self.providers]
@@ -3217,7 +3217,19 @@ class GraniteGuardianConfig(ConfigurationBase):
     """Configuration for the Granite Guardian moderation guardrail."""
 
     url: str = Field(
-        ..., title="Base URL", description="The model_id to use for the guard"
+        ...,
+        title="Base URL",
+        description="Base URL of the OpenAI-compatible inference endpoint.",
+    )
+
+    model_id: str = Field(
+        "ibm-granite/granite-guardian-4.1-8b",
+        title="Model name",
+        description=(
+            "Model name sent to the inference server. Override when the "
+            "server registers the model under a different name (e.g. an "
+            "Ollama tag). The prompt template is built for the 4.1 format."
+        ),
     )
 
     api_key: Optional[SecretStr] = Field(
@@ -3243,12 +3255,42 @@ class GraniteGuardianConfig(ConfigurationBase):
         ),
     )
 
+    parallel: StrictBool | Annotated[int, Field(ge=1, le=10)] = Field(
+        default=3,
+        title="Parallel execution",
+        description=(
+            "True to run all risk checks in parallel, "
+            "False to run sequentially, "
+            "or an integer 1-10 for explicit batch size."
+        ),
+    )
+
     risks: list[RiskDefinition] = Field(
         ...,
         title="Defined risks",
         description="Risks to be considered while applying this guradrail",
     )
 
+    @model_validator(mode="after")
+    def validate_api_key_requires_https(self) -> Self:
+        """Require HTTPS when an API key is configured.
+
+        Prevents the API key from being sent to the inference endpoint over
+        an unencrypted connection.
+
+        Raises:
+            ValueError: If ``api_key`` is set but ``url``'s scheme isn't https.
+
+        Returns:
+            The validated configuration instance.
+        """
+        # pylint: disable=no-member
+        if self.api_key is not None and not self.url.startswith("https://"):
+            raise ValueError(
+                "Granite Guardian endpoints with an API key must use HTTPS"
+            )
+        return self
+
 
 class GraniteGuardianShieldConfiguration(ConfigurationBase):
     """Configuration for a named Granite Guardian guardrail shield.

src/pydantic_ai_lightspeed/capabilities/granite_guardian/__init__.py

@@ -0,0 +1,7 @@
+"""Granite Guardian safety capability for risk-based moderation."""
+
+from pydantic_ai_lightspeed.capabilities.granite_guardian._capability import (
+    GraniteGuardian,
+)
+
+__all__ = ["GraniteGuardian"]