guardrails: decide and wire the segment-moderation posture for embeddings/rerank/audio/images/passthrough (semantic + siblings)

[membphis]

Context

#1031 ships kind: "semantic" (AISIX-Cloud#1363) wired through the segment-moderation pass: chat, /v1/messages, /v1/responses, legacy completions (all via redact::moderate_body), and /mcp (a new async segment pass over the same byte-splice surface as the sync write-back).

The remaining endpoint families have no segment walker (crates/aisix-proxy/src/redact.rs module doc: "Families without a wire walker (embeddings, rerank, images, audio, passthrough, MCP) keep the plain check_* path") — MCP got its walker in #1031; the rest did not. On those surfaces a semantic guardrail row resolves into the chain but its segment hooks are never driven, so it silently does nothing — the class of gap the handler-family rule requires an explicit tracking issue for.

The product question (decide before wiring)

Semantic redaction is span-level rewriting of natural-language text. Whether that is even meaningful per family needs a decision first:

• embeddings / rerank input — rewriting the input changes the vectors/scores the caller gets back. Masking may be desired (the sensitive value must not reach the provider) but it is a semantic change to the result, unlike chat where the mask reads as prose. Note kind=pii has the same posture today (sync redactors do run there? verify) — the semantic decision should match whatever pii does, not fork the family.
• audio (transcription output), images (prompt input) — plausible surfaces; same "mask-alters-the-product" question.
• passthrough routes — the envelope is detected, not owned; a rewrite channel would need the same byte-splice discipline as /mcp per envelope kind.

Suggested shape

1. Decide the per-family posture (mask / scan-only / out of scope) alongside the pii/Bedrock segment posture so the kinds do not drift from each other.
2. For families that should mask: give each a SegmentCollector/SegmentApplier walk (or byte-splice pass) and run the standard check_*_non_segment + moderate_*_segments pair, as chat and /mcp do.
3. e2e per wired family (the family-lockstep rule: a suite that only drives chat stays green while the siblings misbehave).

Out of scope

Ensemble member-level wiring (experimental-surface backlog, one deliberate design pass); /mcp (done in #1031); the aisix#1027 scan/rewrite text unification.

[jarvis9443]

Keeping this open, but two premises in the description no longer hold on main, so anyone picking it up should re-scope first.

semantic no longer means what the body assumes. It now names the embedding-similarity screening kind — detection-only, no rewrite — and it does not implement moderates_segments. On embeddings/rerank/audio/images/files/a2a it runs the ordinary check_input path rather than doing nothing, so the specific gap the title points at is not there. The actual segment moderators today are five: bedrock, presidio, lakera, custom, aliyun_ai_guardrail.

No unscanned content is released on those surfaces. The plain path calls each member's own check_input, and a mask-type member with no write-back channel degrades to a blocking verdict rather than passing content through. Embeddings additionally has a real mask path for kind: pii.

So what is actually left here is one product question, not a coverage gap: whether to build a mask write-back channel for embeddings/rerank/audio/images so a mask-action rule can mask on those surfaces instead of blocking. Today the answer is fail-closed by refusal, which is the safe behaviour but not the one an operator configuring masking expects.

The passthrough half that was attached to this issue has been settled separately: a payload the detected typed protocol cannot parse is released rather than folded into the scan text, decided as posture and closed with #1104.