Cheap-LLM ImportGuard adapter not shipped (MN-REQ-12.11 leftover) #63

Gap

MN-REQ-12.11 is an optional cheap-LLM soft review (allow / trim / reject) on Path B before ImportAbsorb.

#49 closed when the hook landed (set_import_guard, --no-guard, ImportGuardDecision). That hid the rest of 12.11: MemNet still does not ship an LLM adapter. If the host never registers a function, every import is GuardPassthrough.

Hard gates already run (distinct session, ACL, id_policy, LAW exclude, slice budget). This issue is not those.

Target

Ship one optional cheap-LLM ImportGuard in memnet-llm:

• Off by default (no key → skip, same as today).
• On when env is set (MEMNET_IMPORT_GUARD_API_KEY + model / base URL). OpenAI-compatible HTTP; do not vendor a model.
• Returns ImportGuardDecision only. Guard chat is not SSOT.
• Must not replace engine hard gates. Path A never enters the guard.
• Tests: fake HTTP / fixture; no live LLM required.

Cites

• MN-REQ-12.11 CheapLlmImportGuardSoft
• MN-VER-12-S12
• memnet.import_absorb.set_import_guard (hook only)
• Closed precursor: Optional ImportGuard host hook missing (MN-REQ-12.11) #49

Out of scope

N-server (#47). Live AgensGraph. Making the guard mandatory.