feat(server): execute guarded provider streams

nemoguardrails/server/experimental/_content_checker.py

@@ -33,18 +33,40 @@ class UnsupportedContentModification(RuntimeError):
     """Report a checker modification that the proxy cannot safely apply."""
 
 
+@dataclass(frozen=True, slots=True)
+class StreamBufferingPolicy:
+    """Declare how guarded stream deltas are checked before release."""
+
+    chunk_size: int
+    context_size: int
+    release_before_check: bool = False
+
+    def __post_init__(self) -> None:
+        if not isinstance(self.chunk_size, int) or self.chunk_size <= 0:
+            raise ValueError("A stream chunk size must be a positive integer.")
+        if not isinstance(self.context_size, int) or self.context_size < 0:
+            raise ValueError("A stream context size must be a non-negative integer.")
+        if not isinstance(self.release_before_check, bool):
+            raise TypeError("The stream release policy must be a boolean.")
+
+
 @dataclass(frozen=True, slots=True)
 class ContentInspectionPolicy:
     """Record whether a checker examines input and output content."""
 
     inspect_input: bool
     inspect_output: bool
+    stream_buffering: StreamBufferingPolicy | None = None
 
     def __post_init__(self) -> None:
         """Reject non-boolean inspection flags."""
 
         if not isinstance(self.inspect_input, bool) or not isinstance(self.inspect_output, bool):
             raise TypeError("Content inspection flags must be booleans.")
+        if self.stream_buffering is not None and not isinstance(self.stream_buffering, StreamBufferingPolicy):
+            raise TypeError("Stream buffering must be a StreamBufferingPolicy.")
+        if not self.inspect_output and self.stream_buffering is not None:
+            raise ValueError("Stream buffering requires output inspection.")
 
 
 @dataclass(frozen=True, slots=True)
@@ -56,7 +78,14 @@ class InputContentCheck:
 
 @dataclass(frozen=True, slots=True)
 class OutputContentCheck:
-    """Carry generated text and its effective input context to one checker."""
+    """Carry generated text and its effective input context to one checker.
+
+    Buffered and streaming execution currently supply one projected user input
+    subject as context for assistant-output checks. This carrier does not
+    itself enforce the role. Supporting other roles or multiple input subjects
+    requires coordinated changes to bindings, checker semantics, and execution;
+    changing provider metadata alone does not extend that capability.
+    """
 
     input_message: GuardedMessage
     output_content: str