chore: end-to-end guardrails logging of traces (llm_call--> guardrails execution) in Sentry and other chores

.env.example

@@ -16,6 +16,7 @@ POSTGRES_USER=postgres
 POSTGRES_PASSWORD=postgres
 
 SENTRY_DSN=
+OTEL_ENABLED=false
 
 # Configure these with your own Docker registry images
 

.github/workflows/continuous-integration.yml

@@ -42,7 +42,6 @@ jobs:
             AUTH_TOKEN_HASH="$(echo -n "ci-test-token" | sha256sum | awk '{print $1}')"
           fi
           sed -i "s|AUTH_TOKEN=\"<ADD-HASH-TOKEN>\"|AUTH_TOKEN=\"${AUTH_TOKEN_HASH}\"|" .env.test
-          sed -i "s|GUARDRAILS_HUB_API_KEY=\"<ADD-KEY>\"|GUARDRAILS_HUB_API_KEY=\"${{ secrets.GUARDRAILS_HUB_API_KEY }}\"|" .env.test
           cp .env.test .env
 
       - name: Install uv
@@ -55,15 +54,6 @@ jobs:
         run: uv sync
         working-directory: backend
 
-      - name: Install Guardrails hub validators
-        env:
-          GUARDRAILS_HUB_API_KEY: ${{ secrets.GUARDRAILS_HUB_API_KEY }}
-        run: |
-          source .venv/bin/activate
-          chmod +x scripts/install_guardrails_from_hub.sh
-          scripts/install_guardrails_from_hub.sh
-        working-directory: backend
-
       - name: Activate virtual environment and run Alembic migrations
         run: |
           source .venv/bin/activate

.gitignore

@@ -18,4 +18,4 @@ backend/app/evaluation/outputs/**/*.json
 backend/notebooks/*.csv
 **/__marimo__/
 
-backend/logs/*
+backend/logs/*

backend/.guardrails/hub_registry.json

@@ -6,39 +6,39 @@
       "exports": [
         "BanList"
       ],
-      "installed_at": "2026-08-18T06:55:12.094065+00:00",
+      "installed_at": "2026-08-26T05:41:11.480494+00:00",
       "package_name": "guardrails-grhub-ban-list"
     },
     "guardrails/llm_critic": {
       "import_path": "guardrails_grhub_llm_critic",
       "exports": [
         "LLMCritic"
       ],
-      "installed_at": "2026-08-18T06:57:19.392503+00:00",
+      "installed_at": "2026-08-26T05:41:14.741349+00:00",
       "package_name": "guardrails-grhub-llm-critic"
     },
     "guardrails/llamaguard_7b": {
       "import_path": "guardrails_grhub_llamaguard_7b",
       "exports": [
         "LlamaGuard7B"
       ],
-      "installed_at": "2026-08-18T06:56:38.901794+00:00",
+      "installed_at": "2026-08-26T05:41:18.742264+00:00",
       "package_name": "guardrails-grhub-llamaguard-7b"
     },
     "guardrails/profanity_free": {
       "import_path": "guardrails_grhub_profanity_free",
       "exports": [
         "ProfanityFree"
       ],
-      "installed_at": "2026-08-18T06:58:01.196192+00:00",
+      "installed_at": "2026-08-26T05:41:26.279899+00:00",
       "package_name": "guardrails-grhub-profanity-free"
     },
     "guardrails/nsfw_text": {
       "import_path": "guardrails_grhub_nsfw_text",
       "exports": [
         "NSFWText"
       ],
-      "installed_at": "2026-08-18T07:03:49.839668+00:00",
+      "installed_at": "2026-08-26T05:41:36.879459+00:00",
       "package_name": "guardrails-grhub-nsfw-text"
     }
   }

backend/Dockerfile

@@ -58,22 +58,15 @@ ENV HF_HOME=/app/hf_cache
 RUN --mount=type=secret,id=HF_TOKEN \
     HF_TOKEN="$(cat /run/secrets/HF_TOKEN 2>/dev/null || true)" \
     /app/.venv/bin/python -c "from transformers import AutoTokenizer, AutoModelForSequenceClassification; \
-AutoTokenizer.from_pretrained('textdetox/xlmr-large-toxicity-classifier', cache_dir='/app/hf_cache'); \
-AutoModelForSequenceClassification.from_pretrained('textdetox/xlmr-large-toxicity-classifier', cache_dir='/app/hf_cache')"
+AutoTokenizer.from_pretrained('michellejieli/NSFW_text_classifier', cache_dir='/app/hf_cache'); \
+AutoModelForSequenceClassification.from_pretrained('michellejieli/NSFW_text_classifier', cache_dir='/app/hf_cache')"
 
 RUN --mount=type=secret,id=HF_TOKEN \
     HF_TOKEN="$(cat /run/secrets/HF_TOKEN 2>/dev/null || true)" \
     /app/.venv/bin/python -c "from transformers import AutoTokenizer, AutoModelForTokenClassification; \
 AutoTokenizer.from_pretrained('dslim/bert-base-NER-uncased', cache_dir='/app/hf_cache'); \
 AutoModelForTokenClassification.from_pretrained('dslim/bert-base-NER-uncased', cache_dir='/app/hf_cache')"
 
-# Pre-install Guardrails hub validators so container startup is not blocked by downloads
-RUN --mount=type=secret,id=GUARDRAILS_HUB_API_KEY \
-    GUARDRAILS_HUB_API_KEY="$(cat /run/secrets/GUARDRAILS_HUB_API_KEY 2>/dev/null || true)" \
-    ENABLE_METRICS="false" \
-    ENABLE_REMOTE_INFERENCING="true" \
-    /app/scripts/install_guardrails_from_hub.sh
-
 # -------------------------------
 # Entrypoint (runtime setup)
 # -------------------------------

backend/app/alembic/versions/011_rename_validator_log_request_id.py

@@ -0,0 +1,35 @@
+"""Rename validator_log.request_id to request_log_id
+
+The column is a foreign key to request_log.id (the surrogate PK), not to
+request_log.request_id (the caller-supplied business id) - the old name
+made it easy to join on the wrong column.
+
+Revision ID: 011
+Revises: 010
+Create Date: 2026-09-04 00:00:00.000000
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision: str = "011"
+down_revision = "010"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.alter_column("validator_log", "request_id", new_column_name="request_log_id")
+    op.execute(
+        "ALTER INDEX idx_validator_log_request_id RENAME TO idx_validator_log_request_log_id"
+    )
+
+
+def downgrade() -> None:
+    op.execute(
+        "ALTER INDEX idx_validator_log_request_log_id RENAME TO idx_validator_log_request_id"
+    )
+    op.alter_column("validator_log", "request_log_id", new_column_name="request_id")

backend/app/api/deps.py

@@ -50,7 +50,7 @@ def check_source_ip(request: Request) -> None:
         if client_ip not in allowed:
             raise HTTPException(
                 status_code=status.HTTP_403_FORBIDDEN,
-                detail="Forbidden",
+                detail=f"Source IP '{client_ip}' is not permitted to access this service.",
             )