Palimpsests runs language models entirely on hardware you control and writes a tamper-evident record of every request — the data residency and the audit trail that regulated and air-gapped deployments depend on, without a byte crossing your boundary.
Every layer is stamped and joined to the one beneath it. The surface changes turn by turn; the record underneath stays recoverable and can’t be quietly rewritten. That is the palimpsest — and the audit trail.
Patient records under GDPR. Positions on a trading desk. Anything inside a classified or air-gapped network. When the data can’t reach a hosted API, neither can your inference.
Palimpsests keeps the whole loop — model, attention state, and log — on the machine where the data already sits. Nothing is uploaded, nothing is phoned home, and the only thing you export is a record you can verify without exposing what it recorded.
The recurring idea: hold computed state instead of rebuilding it. Each is a named lever — measured on real hardware, not asserted.
A system prompt or long shared context is processed a single time and held warm, then reused across every request that shares it — instead of being re-read on each call.
state held across requestsMulti-step tool calling without rebuilding the conversation at each step. Measured on Intel Arc (Vulkan) across 1.5B and 7B, it matches a hand-tuned llama-server — in-process, with no server to run.
measured · parity with a tuned serverAttention state is serialized to a validated frame format and restored across sessions and processes. The computed layer survives the process that produced it — and the frame is checked before it’s trusted.
validated frame · restored across runsThe difference is doing all of it locally, with a verifiable record. Every number on this page is measured on real hardware — method and results in the open ↗.
Every request leaves a tamper-evident entry, chained by hash so the log can’t be silently altered — written in a published, frozen wire format, PALA-1 v1.0, not an internal detail. Five independent implementations, three of them outside the project, reproduce it from the spec and test vectors alone. That’s the record-keeping substrate the EU AI Act’s logging expectations rest on — kept locally, verifiable without revealing what it holds. And the software itself carries the same discipline.
Each entry references the one before it; remove or edit a layer and the chain breaks. The wire format is frozen and independently verified — reproduce it yourself ↗ from the spec and test vectors alone.
Published to PyPI with Sigstore provenance, so a build can be traced back to the source and workflow that produced it.
An SPDX SBOM ships with the release — the dependency inventory a Cyber Resilience Act review asks for, ready rather than reconstructed.
A self-attested Open Source Project Security baseline, a published threat model, and Atheris fuzzing in the pipeline. Fully open source under Apache-2.0 — every line is public, and you can read, audit, and run all of it.
Palimpsests holds the OpenSSF Best Practices Gold badge — the highest tier of the programme, and the first held by a project founded by a team from Ukraine. It is not a self-declaration: every criterion is a public registry entry ↗ anyone can open and check against this repository.
Every change — code and docs alike — lands through a pull request reviewed by someone who didn’t write it. No direct commits to main.
Signed with PEP 740 / Sigstore provenance — and reproducible: the v0.10.0 wheel rebuilds byte-for-byte to match the artifact published on PyPI.
Static analysis and Atheris fuzzing in CI, a published threat model, and an external security review with every finding closed.
Every release is archived with a persistent identifier — DOI 10.5281/zenodo.21978107 ↗ — so the exact code behind a claim can be cited and retrieved.
Palimpsests supplies the runtime primitive each act leans on — residency, record-keeping, or supply-chain integrity — as a property you can point to, not a promise. Every title links to the source text on EUR-Lex.
The hash-chained request log is the automatic record-keeping a high-risk system has to keep — held locally, and verifiable without exposing what it recorded. The Article 12 mapping ↗ sets out, requirement by requirement, what ships today and what is on the roadmap.
Inference runs where the data already sits, so personal data never leaves the controller — no third-country transfer to justify — and the tamper-evident log speaks to integrity of processing.
Ships the machine-readable SBOM, signed releases, a published threat model and coordinated vulnerability handling the CRA makes mandatory for products with digital elements.
Running the model in-house takes one ICT third-party dependency off the register, and the log gives financial entities defensible evidence for ICT-incident records.
Provenance and the SBOM feed supply-chain security measures; the tamper-evident log backs the incident evidence essential and important entities have to produce.
A clear split is the credential a regulated buyer looks for. Palimpsests carries the runtime obligations; you own the ones that belong to your deployment.
Palimpsests is compliance-grade runtime infrastructure: it carries residency, record-keeping, and supply-chain integrity, so your team can focus on the obligations that are yours to own.
It installs from PyPI and runs offline. Point it at a local GGUF model and the log starts writing itself. The quickstart lives in the README.
# fully open source (Apache-2.0) · runs air-gapped · provenance on every release