diff --git a/docs/bastion-ai-explainer.html b/docs/bastion-ai-explainer.html new file mode 100644 index 0000000..574cce9 --- /dev/null +++ b/docs/bastion-ai-explainer.html @@ -0,0 +1,926 @@ +Bastion AI — The Boundary + + + +
+
+
bastion_aisovereign ai stack
+
+ + +
+
+ +
+ +
+
+
// Sovereign AI · on-prem · zero-egress
+

Use the best AI models
without regulated data
crossing the boundary.

+

Bastion AI is a working, self-hosted stack that answers your most sensitive data in-boundary — and proves, with a signed receipt, that it never left.

+
+ Node ESM · ~8 modules + Local MiniLM embeddings + Cloud only for public work + HMAC-signed audit chain +
+ + +
+
Bastion trust router · :3000 · routingStrategy = sovereignty
+
+
+
> Pick a query to route through the governor…
+ +
+
+ Operator · tailnet + Augmented prompt + retrieved chunks inline +
+
+
+ The governor + Bastion + classify · policy · route · sign +
+
CLOUD PATH BLOCKED
+
+
+ In-boundary · customer + Self-hosted fleet + gpt-oss:120b · $0 +
+
+ Third-party · BYOK + Cloud Claude + public / internal only +
+
+
+ + +
+
+

A local demonstration of the routing logic — the real verdicts come from Bastion's classifier and land in audit.jsonl.

+
+
+ + +
+
+
01 The thesis
+

Sovereignty lives in exactly two places — not where you'd think.

+

Most "sovereign RAG" claims don't survive a skeptic. This project is explicit about why, and pins the guarantee to two mechanical gates rather than good intentions.

+ +
+

Streaming a file is not egress control.

Streaming reduces at-rest copies, but the bytes still land in a process that could send them anywhere. Transport ≠ containment.

+

Vectors are not anonymization.

Embeddings can be inverted back to approximate source text. Vectors of confidential text are themselves confidential.

+

A cloud contract is not sovereignty.

A contractual promise is trust granted, not trust verified. The architecture must not depend on it for regulated content.

+
+ +

The two gates that actually hold

+
+
+ GATE 01 +

Local embeddings

+

Raw text is vectorized in-process by an ONNX MiniLM model (all-MiniLM-L6-v2, 384-dim, WASM/SIMD). No embedding API is ever called — closing the most common silent egress in RAG systems.

+
+
+ GATE 02 +

A governor over the prompt

+

Retrieved chunk text rides inside the prompt. So whatever governs the prompt governs the confidential content. Bastion forces regulated queries in-boundary and blocks the cloud path — even when a cloud key is present.

+
+
+ +

The same confidential query, two stacks

+

“From our private board deck, what were the Q3 churn drivers?” — a naive cloud RAG leaks it three ways; Bastion contains it.

+
+
+
Naive cloud RAGthe common default✕ leaked
+
Embed via a cloud APIRaw deck text is POSTed to a hosted embedding endpoint — the first silent egress.
+
Store in a cloud vector DBVectors sit off-prem — and embeddings can be inverted back to source text.
+
·Retrieve → augmentTop chunks are pasted into the prompt.
+
Send to a cloud modelConfidential content now rides inside a third-party prompt. No governor sees it.
+
verdict · confidential content egressed × 3
+
+
+
Bastion governedthis stack✓ contained
+
Embed locally · in-processONNX MiniLM (384-dim, WASM) — no embedding API is ever called. Gate 01.
+
Store in RVF · on-premWitness-chained vectors stay in-boundary, tagged with the sensitivity label.
+
·Retrieve → augmentTop chunks are placed into the prompt — where the governor can see them.
+
Governor routes the promptClassified confidential → gpt-oss-120b · customer · $0. Cloud path blocked. Gate 02.
+
verdict · confidential · gpt-oss-120b · customer · $0
+
+
+
+
+ + +
+
+
02 Architecture
+

One governor decides. Everything else feeds it or proves it.

+

All of it runs in-boundary on an on-prem Nutanix lab, reachable only over a Tailscale tailnet. The only path out for regulated content is no path.

+
+
:3000 · the governor

Bastion trust router

OpenAI-compatible /v1 gateway: sensitivity classification, sovereignty routing, PII redaction (Presidio), governed search (SearXNG), MCP RBAC, and an HMAC-signed audit chain.

+
capability

Self-hosted fleet

gpt-oss:120b held resident (no cold start), plus qwen2.5-32b, llama-3.1-70b, small local models on an RTX 2000 Ada VM — and cloud Claude via BYOK for public work only.

+
source layer

LucidLink file service

Streams enterprise filespaces over FUSE. One daemon per workspace (the SDK is single-workspace); tokens supplied per request, never baked into an image.

+
zero-egress path

RAG pipeline

stream → chunk (per-slide pptx) → local embed → RVF store → hybrid retrieve → augment → govern. The raw text never leaves the boundary to become an answer.

+
sovereign memory

RuVector RVF + agenticow

Single-file HNSW store, witness-chained for provenance, with copy-on-write branching → lineage() trails and surgical GDPR erasure (drop a branch, no re-index).

+
:8090 · tailnet only

Live console

One SPA — Overview, Fleet, Policy, signed Audit, and the Knowledge/RAG workflow — all on real data. Binds loopback, fronted by Tailscale Serve (not a public Funnel).

+
+
+
One honest caveat
+

The keystone isn't in this repo. Bastion itself — the classifier and router that makes the guarantee mechanical — is referenced, not vendored, as is the LucidLink service. This repo is the RAG pipeline, the console, and the docs: the half you can read to understand exactly how the sovereign path is argued and built.

+
+
+
+ + +
+
+
03 The zero-egress pipeline
+

From a private document to a cited, governed answer.

+

Six stages in rag-service/. Two of them are the sovereignty gates; the rest exist to feed them.

+
+
+
+
+
+
+ + +
+
+
04 Proof, in one surface
+

The live console — everything on real data.

+

One page, bound to loopback and reachable only over the tailnet. It reads Bastion's own signed audit chain, model registry, and router policy — so operation and proof share a screen.

+
+
+ + https://bastion-01.<tailnet>.ts.net +
+
+
+
+

Illustrative snapshot — the real console renders live values from audit.jsonl, /v1/models, and router.config.json.

+
+
+ + +
+
+
05 Mapped to a standard
+

A near reference-implementation of the OIA lower-and-mid stack.

+

Read through the ten-layer OIA Reference Model, the claim is deliberately testable: strong where it ships, honestly blank where it doesn't.

+
+ +
+

+ strong + solid + partial + out of scope +

+
+
+ + +
+
+
06 Stated plainly
+

What's honestly missing.

+

The guarantee is governance-enforced and audit-recorded — not yet hardware-attested. The repo names its gaps rather than blurring them.

+
+
L1

No hardware-attested execution. Trust is signed and recorded, not yet proven by a TEE / Confidential GPU. This is the largest gap versus a full Verifiability span.

+
L4

No training / adaptation layer. The stack consumes models; it does not train or attest fine-tuning.

+
L9

Human identity is coarse. Access is tailnet-membership today, not per-user SSO with scoped authority.

+
L7/L9

No mimicry / agent-spoofing defenses. Human-vs-agent liveness and per-agent identity governance are future work.

+
env

Environment-coupled. The service reads ~/bastion-app/out/audit.jsonl and hits localhost:3000 — it assumes the surrounding stack is already running on bastion-01.

+
+
+
+ + +
+
+
07 Repository map
+

Where to read next.

+
+
rag-service/The zero-egress RAG service: server, ingest pipeline, hybrid retrieval, local embedder, and the Bastion query bridge.
+
rag-service/retrieval.mjsHybrid retrieve: dense cosine + multi-field BM25 + RRF + phrase boost + MMR dedup. No cross-encoder, and it says why.
+
console/console.htmlThe unified live console (SPA) — Overview, Fleet, Policy, Audit, Knowledge — served same-origin.
+
docs/sovereignty-model.mdWhere the guarantee actually lives — the two-gates argument, defended to a skeptic.
+
docs/oia-mapping.mdThe stack mapped layer-by-layer onto the OIA Reference Model, with gaps named.
+
lucidlink/ · deploy/The in-boundary file service (daemon-per-workspace) and deployment: systemd units, Docker/FUSE, Tailscale Serve.
+
+
+
Bottom line
+

Bastion AI is the documentation-and-RAG face of a real on-prem sovereign-AI deployment. Its value is the argument — where sovereignty genuinely lives — plus a clean, honest reference implementation of the zero-egress retrieval path and its operator console. Not a turnkey app you npm start.

+
+
+
+
+ + + +