Investigate embedded local ML NER (ONNX / WASM) without external service

[nicknikolakakis]

Summary

Explore embedding a small token-classification model (distilled BERT) directly in the binary via onnxruntime-go or wazero, to get ML-grade NER without the external SPHRAGIS_NER_URL service. Proposal #3 from the product roadmap. Filed as an investigation/spike, not a committed feature.

Motivation

Today NER is either the external HTTP service (internal/redact/ner.go) or the dependency-free gazetteer (internal/redact/ner_builtin.go). A local ML model would improve accuracy while staying self-hosted.

Conflict to resolve first (why this is backlog)

This risks the single static Go binary value prop:

• onnxruntime-go requires CGO + a native onnxruntime shared library -> no longer a pure static single binary; complicates cross-compilation and the GoReleaser matrix (darwin/linux x amd64/arm64).
• A distilled BERT, even quantized, adds tens to hundreds of MB to the binary.
• wazero is pure Go but running transformer inference under WASM is slow and memory-heavy.

What this issue should produce

• A spike comparing onnxruntime-go vs wazero vs keeping external NER, measuring binary size delta, cold-start, latency/throughput, accuracy vs the gazetteer, and the build/release impact.
• A go/no-go recommendation. If go: how to keep a no-ML default build (build tag or separate artifact).

Acceptance criteria

• Written comparison with measured numbers on the four release targets.
• Explicit recommendation, including whether the static-binary claim must change.