@ingotai/guard

Scan-derived runtime guard for open-weight models. Zero dependencies, Node ≥ 18.

Generic input filters don't know your model. This guard does: it screens text against the exact token strings Ingot's deep battery measured as corruption-prone on your specific checkpoint — e.g. the 7 tokens that base Qwen3.8-27B silently rewrites on every sampled trial (the report).

npm install @ingotai/guard

import { fetchGuard, screen, assertClean } from "@ingotai/guard";

const guard = await fetchGuard("Qwen/Qwen3.8-27B");

// Screen a record before a verbatim-copy task (summarize-with-references,
// CRM extraction, translation memory, …):
const { hits, clean } = screen(guard, record.text);
if (!clean) routeToHumanReview(record, hits); // or use a different model

// Or hard-gate on confirmed corrupting tokens only:
assertClean(guard, record.text); // throws IngotGuardError with .hits

What a hit means

• source: "confirmed" — this token was measured corrupting on every sampled trial (survival 0/16) in the published scan. The model will not copy this string faithfully; route around it.
• source: "candidate" — low embedding-norm token from the probe sweep: elevated risk, not individually behavior-tested. Treat as a soft flag.

Why flag-and-reroute, not rewrite

The guard's policy is flag on purpose. Any automatic transform of the matched string (stripping, escaping, inserting separators) changes the user's data — which is exactly the corruption this guard exists to prevent. Route the record to a human or to a checkpoint that scanned clean instead.

Where configs come from

GET https://ingot.up.railway.app/api/v1/guard/<owner>/<model> — versioned, content-hashed (guard_sha256), derived from the published deep-battery scan of that checkpoint. No guard artifact means "no deep-battery data yet", never "clean". Guard configs address the documented data-integrity findings only; they are not a general input filter and not a safety certification.