harn-guard — the downloadable on-device prompt-injection classifier for
Harn (security Layer 2).
This crate is the management layer: a catalog of upstream, already-hosted
models ([catalog]), an on-disk store that installs and verifies them
([store]), and selector resolution ([resolve_dir]). It hosts nothing,
bundles no weights, and makes no network calls itself — the CLI downloads
from the catalog's upstream URLs on the user's machine and hands the bytes to
[GuardStore::install] for SHA-256 verification + atomic install.
The heavy inference runtime (ONNX) lives behind the off-by-default neural
feature, so the default binary never links a model runtime. When built
without it, [load_classifier] is a no-op returning None and the runtime
keeps using the always-available built-in heuristic classifier. When built
with it, a host installs [load_classifier] into the runtime's lazy loader
seam (harn_vm::security::set_injection_classifier_loader), which fires the
first time a local-ml policy scores untrusted content.