LCORE-3390: Input guardrail point on all query endpoints

docs/devel_doc/openapi.json

@@ -14639,7 +14639,13 @@
                     "url": {
                         "type": "string",
                         "title": "Base URL",
-                        "description": "The model_id to use for the guard"
+                        "description": "Base URL of the OpenAI-compatible inference endpoint."
+                    },
+                    "model_id": {
+                        "type": "string",
+                        "title": "Model name",
+                        "description": "Model name sent to the inference server. Override when the server registers the model under a different name (e.g. an Ollama tag). The prompt template is built for the 4.1 format.",
+                        "default": "ibm-granite/granite-guardian-4.1-8b"
                     },
                     "api_key": {
                         "anyOf": [
@@ -14686,6 +14692,21 @@
                         "description": "SSL certificate verification. Can be:\n  - True: Verify using system CA bundle (default, recommended)\n  - False: Disable verification (insecure, for dev only)\n  - str: Path to custom CA bundle file (for internal PKI)",
                         "default": true
                     },
+                    "parallel": {
+                        "anyOf": [
+                            {
+                                "type": "boolean"
+                            },
+                            {
+                                "type": "integer",
+                                "maximum": 10.0,
+                                "minimum": 1.0
+                            }
+                        ],
+                        "title": "Parallel execution",
+                        "description": "True to run all risk checks in parallel, False to run sequentially, or an integer 1-10 for explicit batch size.",
+                        "default": 3
+                    },
                     "risks": {
                         "items": {
                             "$ref": "#/components/schemas/RiskDefinition"
@@ -14733,6 +14754,14 @@
                 "title": "GraniteGuardianShieldConfiguration",
                 "description": "Configuration for a named Granite Guardian guardrail shield.\n\nAttributes:\n    name: Unique, user-facing name identifying this shield instance.\n    provider_id: Discriminator identifying this as a granite-guardian shield.\n    config: Granite-guardian-specific configuration."
             },
+            "GuardrailPoint": {
+                "type": "string",
+                "enum": [
+                    "input",
+                    "output",
+                    "tool"
+                ]
+            },
             "HTTPAuthSecurityScheme": {
                 "properties": {
                     "bearerFormat": {
@@ -20914,12 +20943,7 @@
                     },
                     "points": {
                         "items": {
-                            "type": "string",
-                            "enum": [
-                                "input",
-                                "output",
-                                "tool"
-                            ]
+                            "$ref": "#/components/schemas/GuardrailPoint"
                         },
                         "type": "array",
                         "minItems": 1,

src/models/config.py

@@ -23,6 +23,7 @@
     PositiveInt,
     PrivateAttr,
     SecretStr,
+    StrictBool,
     field_validator,
     model_validator,
 )
@@ -34,6 +35,8 @@
 from utils.mcp_auth_headers import resolve_authorization_headers
 from utils.types import CompiledPatterns
 
+type GuardrailPoint = Literal["input", "output", "tool"]
+
 logger = get_logger(__name__)
 
 
@@ -2422,8 +2425,7 @@ def validate_providers_and_default(self) -> Self:
 
         if self.default_provider is None:
             raise ValueError(
-                "vector_store.default_provider is required when providers "
-                "is non-empty"
+                "vector_store.default_provider is required when providers is non-empty"
             )
 
         ids = [provider.id for provider in self.providers]
@@ -3197,7 +3199,7 @@ class RiskDefinition(ConfigurationBase):
             "reasoning before scoring."
         ),
     )
-    points: list[Literal["input", "output", "tool"]] = Field(
+    points: list[GuardrailPoint] = Field(
         ...,
         min_length=1,
         title="Guardrail points",
@@ -3217,7 +3219,19 @@ class GraniteGuardianConfig(ConfigurationBase):
     """Configuration for the Granite Guardian moderation guardrail."""
 
     url: str = Field(
-        ..., title="Base URL", description="The model_id to use for the guard"
+        ...,
+        title="Base URL",
+        description="Base URL of the OpenAI-compatible inference endpoint.",
+    )
+
+    model_id: str = Field(
+        "ibm-granite/granite-guardian-4.1-8b",
+        title="Model name",
+        description=(
+            "Model name sent to the inference server. Override when the "
+            "server registers the model under a different name (e.g. an "
+            "Ollama tag). The prompt template is built for the 4.1 format."
+        ),
     )
 
     api_key: Optional[SecretStr] = Field(
@@ -3243,6 +3257,16 @@ class GraniteGuardianConfig(ConfigurationBase):
         ),
     )
 
+    parallel: StrictBool | Annotated[int, Field(ge=1, le=10)] = Field(
+        default=3,
+        title="Parallel execution",
+        description=(
+            "True to run all risk checks in parallel, "
+            "False to run sequentially, "
+            "or an integer 1-10 for explicit batch size."
+        ),
+    )
+
     risks: list[RiskDefinition] = Field(
         ...,
         title="Defined risks",

src/pydantic_ai_lightspeed/capabilities/granite_guardian/__init__.py

@@ -0,0 +1,7 @@
+"""Granite Guardian safety capability for risk-based moderation."""
+
+from pydantic_ai_lightspeed.capabilities.granite_guardian._capability import (
+    GraniteGuardian,
+)
+
+__all__ = ["GraniteGuardian"]