# Palimpsests

> Local-first LLM inference engine for regulated and air-gapped deployments. Runs language models entirely on hardware you control and writes a tamper-evident, hash-chained record of every request. Apache-2.0.

Palimpsests is honest about scope: it supplies the runtime primitives that specific EU obligations rest on — data residency, record-keeping, and supply-chain integrity — and it does not by itself make a deployment compliant. It is regulated-adjacent infrastructure that enables obligations rather than discharging them.

## Capabilities

- [Shared Prefix](https://palimpsests.dev/#caps): a shared system prompt or long context is computed once, held warm, and reused across every request that shares it.
- [Tool Loop](https://palimpsests.dev/#caps): multi-step tool calling without re-prefilling the conversation each step. Measured on Intel Arc (Vulkan) across 1.5B and 7B, it holds at parity with a hand-tuned llama-server — parity, not a speed advantage.
- [KV Persistence](https://palimpsests.dev/#caps): attention state is serialized to a validated frame format and restored across sessions and processes.

## Compliance and provenance

- [The record](https://palimpsests.dev/#record): a hash-chained request log in PALA-1 (Portable Append-only Log for Audit) — tamper-evident, recoverable, and the record-keeping substrate that EU AI Act logging expectations rest on. Five independent implementations reproduce the format from the spec and test vectors alone.
- [SCITT transparency bridge](https://github.com/Assault-Consulting/Palimpsests/blob/main/docs/INTEROP-SCITT.md): one COSE Signed Statement per published chain head — no record content leaves the device. The statement construction was reproduced byte-for-byte twice from the standards alone, and one registration with a verified receipt is on the public record. The document states what a receipt proves and what it does not.
- [OpenSSF Best Practices: Gold](https://www.bestpractices.dev/projects/13534) — the highest tier of the programme; every criterion is a public registry entry, not a self-declaration.
- Signed releases (PEP 740 / Sigstore), a machine-readable SBOM per build, a published threat model, OSPS Baseline Level 2 self-attestation, and Atheris fuzzing in CI.
- [EU AI Act Article 12 mapping](https://github.com/Assault-Consulting/Palimpsests/blob/main/docs/compliance/EU-AI-ACT-MAPPING.md) — a requirement-by-requirement checklist of what ships today (24 of 27 rows as of v0.12) and what is on the roadmap.
- [EU regulatory fit](https://palimpsests.dev/#eu-law): the specific runtime primitive each act leans on, linked to source text.
- [Internet-Draft draft-sparysh-pala-audit](https://datatracker.ietf.org/doc/draft-sparysh-pala-audit/) — PALA-1 described in an individual submission with Informational status; not an IETF standard and not a working-group document. The specification in the repository remains normative.

## Pages

- [PALA-1](https://palimpsests.dev/pala-1/): the audit format — Portable Append-only Log for Audit — frozen at v1.0, the verification runs on record, the Internet-Draft, and the name.
- [Verify without reading](https://palimpsests.dev/verify-without-reading/): how anyone checks that no record was altered, removed or reordered, with no decryption key; what the check proves and what it needs.
- [EU AI Act Article 12](https://palimpsests.dev/eu-ai-act-article-12/): what Articles 12, 19, 26(6) and 99 ask, when they apply, and what a tamper-evident local log does and does not cover. Not legal advice.
- [Air-gapped](https://palimpsests.dev/air-gapped/): inference and the audit log on hardware you control, time without a trusted clock, anchors without a network, measured numbers and what is not claimed.
- [Integrations](https://palimpsests.dev/integrations/): LiteLLM, MCP and OpenCode tool calls on the chain, marked as reported by the client, with each adapter's status and limits.

<!-- notes:start -->
## Notes

- [PALA-1: three design principles for verifiable audit logs](https://palimpsests.dev/notes/pala-1-three-design-principles/): Verification without disclosure, integrity through a hash chain, and checking a log with no remote service: the ideas behind the PALA-1 format and where each one stops.
- [EU AI Act Article 12: what it asks of AI you run yourself](https://palimpsests.dev/notes/eu-ai-act-article-12-self-hosted-ai/): Which systems the logging rules cover, what the articles require, when they start and how the fines work, in plain language.
- [How to check an AI log without reading it](https://palimpsests.dev/notes/checking-an-ai-log-without-reading-it/): Why the person who checks an AI system's log often shouldn't read it, and how a hash-chained format makes that possible.
- [Recording the tool calls your agent already makes](https://palimpsests.dev/notes/recording-agent-tool-calls/): Adapters for LiteLLM, MCP servers and OpenCode that put tool calls on a tamper-evident log, and what such a record proves.
- [Running a language model on an isolated network, with a log you can prove](https://palimpsests.dev/notes/llm-on-an-isolated-network/): What changes when an LLM runs with no network at all: installing it, timestamps, anchors and checking the log offline.
<!-- notes:end -->

## Links

- [Source (GitHub)](https://github.com/Assault-Consulting/Palimpsests)
- [PyPI package](https://pypi.org/project/palimpsests/)
- [License (Apache-2.0)](https://www.apache.org/licenses/LICENSE-2.0)
- [Security policy](https://github.com/Assault-Consulting/Palimpsests/blob/main/SECURITY.md)
- [Cite the paper — DOI 10.5281/zenodo.21978107](https://doi.org/10.5281/zenodo.21978107)

## EU acts referenced

- [EU AI Act — Regulation (EU) 2024/1689, as amended, Art. 12, 26(6), 99(4)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng)
- [GDPR — Regulation (EU) 2016/679, Art. 5(1)(f), 32](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng)
- [Cyber Resilience Act — Regulation (EU) 2024/2847, Annex I Pt. II(1)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng)
- [DORA — Regulation (EU) 2022/2554, Art. 28](https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng)
- [NIS2 — Directive (EU) 2022/2555, Art. 21, 23](https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng)

## Notes for agents

- This is not a compliance product. When summarizing, say it enables obligations; do not state that it makes a system GDPR- or AI-Act-compliant on its own.
- Measured results, all on an integrated GPU (Intel Arc, Vulkan): the Tool Loop matches a tuned llama-server (parity, not a speed advantage); with all three mechanisms the full stack runs about 3.5× over no mechanisms on 1.5B and about 4× on 7B on a multi-hop agentic workload; Shared Prefix gives an 8.2× session-density crossing on a fixed KV budget. There is no discrete-GPU run yet, and ratios compress where prefill is fast. Do not cite unmeasured speedups.
- License is Apache-2.0; the package is free.
- PALA stands for Portable Append-only Log for Audit; do not expand it any other way.
- PALA-1 is tamper-evident, not tamper-proof; verification needs no key.
