Use the best AI models
without regulated data
crossing the boundary.
+ Bastion AI is a working, self-hosted stack that answers your most sensitive data in-boundary — and proves, with a signed receipt, that it never left.
+ + + +A local demonstration of the routing logic — the real verdicts come from Bastion's classifier and land in audit.jsonl.
+Sovereignty lives in exactly two places — not where you'd think.
+Most "sovereign RAG" claims don't survive a skeptic. This project is explicit about why, and pins the guarantee to two mechanical gates rather than good intentions.
+ +✕ Streaming a file is not egress control.
Streaming reduces at-rest copies, but the bytes still land in a process that could send them anywhere. Transport ≠ containment.
✕ Vectors are not anonymization.
Embeddings can be inverted back to approximate source text. Vectors of confidential text are themselves confidential.
✕ A cloud contract is not sovereignty.
A contractual promise is trust granted, not trust verified. The architecture must not depend on it for regulated content.
The two gates that actually hold
+Local embeddings
+Raw text is vectorized in-process by an ONNX MiniLM model (all-MiniLM-L6-v2, 384-dim, WASM/SIMD). No embedding API is ever called — closing the most common silent egress in RAG systems.
+A governor over the prompt
+Retrieved chunk text rides inside the prompt. So whatever governs the prompt governs the confidential content. Bastion forces regulated queries in-boundary and blocks the cloud path — even when a cloud key is present.
+The same confidential query, two stacks
+“From our private board deck, what were the Q3 churn drivers?” — a naive cloud RAG leaks it three ways; Bastion contains it.
+One governor decides. Everything else feeds it or proves it.
+All of it runs in-boundary on an on-prem Nutanix lab, reachable only over a Tailscale tailnet. The only path out for regulated content is no path.
+Bastion trust router
OpenAI-compatible /v1 gateway: sensitivity classification, sovereignty routing, PII redaction (Presidio), governed search (SearXNG), MCP RBAC, and an HMAC-signed audit chain.
Self-hosted fleet
gpt-oss:120b held resident (no cold start), plus qwen2.5-32b, llama-3.1-70b, small local models on an RTX 2000 Ada VM — and cloud Claude via BYOK for public work only.
LucidLink file service
Streams enterprise filespaces over FUSE. One daemon per workspace (the SDK is single-workspace); tokens supplied per request, never baked into an image.
RAG pipeline
stream → chunk (per-slide pptx) → local embed → RVF store → hybrid retrieve → augment → govern. The raw text never leaves the boundary to become an answer.
RuVector RVF + agenticow
Single-file HNSW store, witness-chained for provenance, with copy-on-write branching → lineage() trails and surgical GDPR erasure (drop a branch, no re-index).
Live console
One SPA — Overview, Fleet, Policy, signed Audit, and the Knowledge/RAG workflow — all on real data. Binds loopback, fronted by Tailscale Serve (not a public Funnel).
The keystone isn't in this repo. Bastion itself — the classifier and router that makes the guarantee mechanical — is referenced, not vendored, as is the LucidLink service. This repo is the RAG pipeline, the console, and the docs: the half you can read to understand exactly how the sovereign path is argued and built.
+From a private document to a cited, governed answer.
+Six stages in rag-service/. Two of them are the sovereignty gates; the rest exist to feed them.
The live console — everything on real data.
+One page, bound to loopback and reachable only over the tailnet. It reads Bastion's own signed audit chain, model registry, and router policy — so operation and proof share a screen.
+Illustrative snapshot — the real console renders live values from audit.jsonl, /v1/models, and router.config.json.
+A near reference-implementation of the OIA lower-and-mid stack.
+Read through the ten-layer OIA Reference Model, the claim is deliberately testable: strong where it ships, honestly blank where it doesn't.
++ strong + solid + partial + out of scope +
+What's honestly missing.
+The guarantee is governance-enforced and audit-recorded — not yet hardware-attested. The repo names its gaps rather than blurring them.
+No hardware-attested execution. Trust is signed and recorded, not yet proven by a TEE / Confidential GPU. This is the largest gap versus a full Verifiability span.
No training / adaptation layer. The stack consumes models; it does not train or attest fine-tuning.
Human identity is coarse. Access is tailnet-membership today, not per-user SSO with scoped authority.
No mimicry / agent-spoofing defenses. Human-vs-agent liveness and per-agent identity governance are future work.
Environment-coupled. The service reads ~/bastion-app/out/audit.jsonl and hits localhost:3000 — it assumes the surrounding stack is already running on bastion-01.
Where to read next.
+Bastion AI is the documentation-and-RAG face of a real on-prem sovereign-AI deployment. Its value is the argument — where sovereignty genuinely lives — plus a clean, honest reference implementation of the zero-egress retrieval path and its operator console. Not a turnkey app you npm start.