Palimpsests runs language models entirely on hardware you control and writes a tamper-evident record of every request — the data residency and the audit trail that regulated and air-gapped deployments depend on, without a byte crossing your boundary.
Every layer is stamped and joined to the one beneath it. The surface changes turn by turn; the record underneath stays recoverable and can’t be quietly rewritten. That is the palimpsest — and the audit trail.
Patient records under GDPR. Positions on a trading desk. Anything inside a classified or air-gapped network. When the data can’t reach a hosted API, neither can your inference.
Palimpsests keeps the whole loop — model, attention state, and log — on the machine where the data already sits. Nothing is uploaded, nothing is phoned home, and the only thing you export is a record you can verify without exposing what it recorded.
So the audit costs hashing, not signing — measured, not asserted — and under pressure the record yields visibly instead of stalling the model: a dropped record is itself a recorded fact.
No network to lean on, no clock to trust. Every timestamp carries its trust level — a device that doesn’t know the time says so, an honest unknown instead of an invented moment.
The chain verifies with no decryption key: bodies are checked against their digests, never opened — an auditor validates what happened without reading what was said.
The recurring idea: hold computed state instead of rebuilding it. Each is a named lever — measured on real hardware, not asserted.
A system prompt or long shared context is processed a single time and held warm, then reused across every request that shares it — instead of being re-read on each call.
state held across requestsMulti-step tool calling without rebuilding the conversation at each step. Measured on Intel Arc (Vulkan) across 1.5B and 7B, it matches a hand-tuned llama-server — in-process, with no server to run.
measured · parity with a tuned serverAttention state is serialized to a validated frame format and restored across sessions and processes. The computed layer survives the process that produced it — and the frame is checked before it’s trusted.
validated frame · restored across runsThe difference is doing all of it locally, with a verifiable record. Every number on this page is measured on real hardware — method and results in the open ↗.
Every request leaves a tamper-evident entry, chained by hash so the log can’t be silently altered — written in a published, frozen wire format, PALA-1 v1.0, not an internal detail. Five independent implementations, three of them outside the project at the time of their runs, reproduce it from the spec and test vectors alone. That’s the record-keeping substrate the EU AI Act’s logging expectations rest on — kept locally, verifiable without revealing what it holds. And since 0.11 the chain reaches outward on your terms: a head can be registered with a transparency service as one signed statement, with the receipt — and what it does and doesn’t prove — on the public record. The software itself carries the same discipline.
Live model of the chain: delete one record and the next hash stops matching. The real verifier answers the same way — chain breaks at seq [1, 2].
Each entry references the one before it; remove or edit a layer and the chain breaks. The wire format is frozen and independently verified — reproduce it yourself ↗ from the spec and test vectors alone.
Published to PyPI with Sigstore provenance, so a build can be traced back to the source and workflow that produced it.
A machine-readable SBOM ships with the release — the dependency inventory a Cyber Resilience Act review asks for, ready rather than reconstructed.
One signed statement per published head — no record content leaves the device. Reproduced byte-for-byte twice from the standards alone; one registration, receipt verified, on the record. What a receipt proves — and what it doesn’t ↗.
A self-attested Open Source Project Security baseline, a published threat model, and Atheris fuzzing in the pipeline. Fully open source under Apache-2.0 — every line is public, and you can read, audit, and run all of it.
Palimpsests holds the OpenSSF Best Practices Gold badge — the highest tier of the programme, and the first held by a project founded by a team from Ukraine. It is not a self-declaration: every criterion is a public registry entry ↗ anyone can open and check against this repository.
Every change — code and docs alike — lands through a pull request reviewed by someone who didn’t write it. No direct commits to main.
Signed with PEP 740 / Sigstore provenance — and reproducible: most recently verified on the v0.10.0 wheel, which rebuilds byte-for-byte to match the artifact published on PyPI.
Static analysis and Atheris fuzzing in CI, a published threat model, and an external security review with every finding closed.
The work behind the code is published as a report with a persistent identifier — DOI 10.5281/zenodo.21978107 ↗ — so the design can be cited permanently. The code itself is pinned by release version on PyPI and GitHub.
Palimpsests supplies the runtime primitive each act leans on — residency, record-keeping, or supply-chain integrity — as a property you can point to, not a promise. Every title links to the source text on EUR-Lex.
The hash-chained request log is the automatic record-keeping a high-risk system has to keep — held locally, and verifiable without exposing what it recorded. The Article 12 mapping ↗ sets out, requirement by requirement, what ships today — 24 of 27 rows as of 0.11 — and what is on the roadmap.
Inference runs where the data already sits, so personal data never leaves the controller — no third-country transfer to justify — and the tamper-evident log speaks to integrity of processing.
Ships the machine-readable SBOM, signed releases, a published threat model and coordinated vulnerability handling the CRA makes mandatory for products with digital elements.
Running the model in-house takes one ICT third-party dependency off the register, and the log gives financial entities defensible evidence for ICT-incident records.
Provenance and the SBOM feed supply-chain security measures; the tamper-evident log backs the incident evidence essential and important entities have to produce.
A clear split is the credential a regulated buyer looks for. Palimpsests carries the runtime obligations; you own the ones that belong to your deployment.
Palimpsests is compliance-grade runtime infrastructure: it carries residency, record-keeping, and supply-chain integrity, so your team can focus on the obligations that are yours to own.
It installs from PyPI and runs offline. Point it at a local GGUF model and the log starts writing itself. The quickstart lives in the README.
# fully open source (Apache-2.0) · runs air-gapped · provenance on every release