Module local_only 

Egress restriction for local-only inference (ADR-010 §1a, clauses b and c).

The requested mode is “local-only inference with no external connection”. Ordering a loopback provider first does not deliver that, and neither does a test over the config file: seed_providers_from_registry skips any provider whose settings row already exists, so the YAML is not authoritative after first run, and a provider can be enabled through PUT /api/providers/{id} without appearing in any file. An adversarial review of ADR-010 found openai enabled at api.openai.com in exactly that state.

So the guarantee is enforced where every inference path converges instead: build_driver is the single constructor for a driver — primary, failover, server, and turn bindings all reach it — and it already returns a Result, so refusing costs no signature change.

This is the egress axis. governance::runtime_control checks the opposite direction (is our own listener bound to loopback, BoundIngressNotLoopback) and does not constrain where inference is sent.

Off by default. A runtime that silently refused remote providers would break every existing deployment; the mode is opt-in and, once on, fails closed.

Structs

Offender

One enabled provider whose base URL would leave this machine.

Enums

EgressDenial

Why a base URL was refused. Carried so the caller can name the offender.

Constants

ENV_LOCAL_ONLY

Environment variable that turns the restriction on.

Functions

audit_providers

Audit the resolved provider registry for non-loopback egress.

check_base_url

Refuse a base URL that would send inference off this machine.

enabled

Whether local-only egress enforcement is active.

host_is_local

Whether a host string denotes this machine.