Skip to content
PointSav Digital Systems

Revision as of · 91b89104

Historical revision — this record as it stood on 8 May 2026, not the current version. View the current record →

service-slm: Linguistic Air-Lock

Every AI inference call on the PointSav platform routes through a single service — service-slm (the Doorman) — which holds all provider API keys, selects the cheapest compute tier that meets the request's deadline, and writes an immutable audit record before returning the result. A request that resolves on the local model never leaves the customer's infrastructure and never appears on a cloud billing statement. The routing logic, tier thresholds, and audit log are all operator-controlled. service-slm is the Ring 3 optional-intelligence boundary: it holds API keys for external AI providers, enforces sanitise-outbound and rehydrate-inbound discipline so that customer-identifying details do not reach external providers in raw form, and writes a signed audit entry to the per-tenant ledger on every call.

Architectural Baseline

The Doorman is the platform's sole AI boundary — no inference call enters or exits the knowledge pipeline without passing through it. The Doorman acts as the air-lock for unstructured text entering the knowledge pipeline. Raw text arriving from Ring 1 services — emails, PDFs, form submissions — passes through service-slm before any structured facts are written to the knowledge graph. The service applies a Small Language Model to extract verifiable facts, formats them as clean Markdown, and closes the AI processing window before data continues downstream to Ring 2. This containment is the implementation of SYS-ADR-07: structured data never routes through AI.

Ring and Role

service-slm occupies Ring 3 — Optional Intelligence in the three-ring compounding-substrate architecture. Ring 3 is structurally optional: Ring 1 boundary ingest and Ring 2 knowledge and processing operate without it. When Ring 3 is active, the Doorman mediates all AI calls on behalf of any ring, applying per-tenant configuration and routing policy.

The three compute tiers the Doorman routes across:

Tier Compute When used
Tier A — Local OLMo 3 7B Q4 on workspace VM (CPU) High-volume, low-latency, budget-sensitive requests
Tier B — On-demand GPU OLMo 3.1 32B Think on multi-cloud GPU burst (GCP Cloud Run / RunPod / Modal) Requests that require larger model capacity
Tier C — External API Anthropic Claude / Google Gemini / OpenAI Narrow precision tasks: citation grounding, initial graph build

Customers do not choose the tier. Request shape and budget caps determine routing automatically.

Structural Organization of Components

The Doorman enforces three invariants at every call boundary:

  1. Key custody. No other service holds provider API keys. The Doorman is the exclusive key holder. A compromise of any Ring 1 or Ring 2 service does not expose provider keys.
  2. Audit logging. Every call — including Tier A local calls — writes a signed record to the per-tenant audit ledger at ~/Foundry/data/audit-ledger/<tenant>/<YYYY-MM>.jsonl. The record captures the request shape, tier selected, token count, and response hash.
  3. Sanitise-outbound / rehydrate-inbound. Before any request leaves the workspace, the Doorman strips customer-identifying details per the per-tenant sanitisation policy. The response is rehydrated with the stripped context before returning to the caller.

The service listens on 127.0.0.1:9080 and speaks an OpenAI-compatible HTTP API, allowing any Ring 2 service to address it without bespoke integration.

Configuration

The Doorman is deployed as a systemd unit (infrastructure/local-doorman/) on the workspace VM. Key configuration fields:

  • Per-tenant budget caps (monthly token limits per tier)
  • Sanitisation policy (field list stripped before outbound calls)
  • Routing thresholds (conditions under which a request escalates from Tier A to Tier B or C)
  • Audit ledger path and rotation schedule

See Also

References

  • §XI — Three-ring architecture and three-tier compute routing
  • infrastructure/local-doorman/ — systemd unit (live since workspace v0.1.13)
  • SYS-ADR-07 — structured data never routes through AI
Important Information

Important Information

Corporate structure. PointSav Digital Systems ("PointSav") is a trade name of Woodfine Capital Projects Inc. ("Woodfine"). PointSav does not itself offer, sell, or solicit any security. Any securities offering associated with Woodfine's real-property direct-hold solutions is made exclusively by Woodfine, and only by means of the applicable Private Placement Memorandum.

No investment advice. This wiki's content is provided for engineering, operational, research, and development purposes. Nothing on this wiki constitutes investment advice or a solicitation to invest in any Woodfine partnership or direct-hold solution.

Intellectual property. The PointSav name, trade name, wordmark, and marks, together with all current and future PointSav- and Totebox-branded products, services, and offerings — and the software, source code, documentation, design system, and all related materials — are proprietary to Woodfine and its affiliates, except for components identified as open source. No rights are granted except as expressly set out in a written license or agreement. See TRADEMARK.md in this repository for the full trademark notice.

Open source components. Portions of the platform are made available under permissive open-source licenses identified in the accompanying repository. Use of those components is governed by their respective license terms.

No warranty; informational use. Content on this wiki is provided for general informational purposes only and does not constitute a representation, warranty, or commitment with respect to product functionality, availability, pricing, or roadmap. Some articles describe planned or intended features, capabilities, and milestones — language such as "planned," "intended," "targeted," "may," and "expected" marks this forward-looking content, which is subject to change and does not constitute a commitment regarding future performance.

Confidentiality. Where an article describes an operational or deployment detail that is not intended for public disclosure, that article is not published on this wiki. Content here is general-purpose engineering documentation, not customer-specific configuration.

Jurisdiction. Woodfine Capital Projects Inc. is organized in British Columbia, Canada. References to the Sovereign Data Foundation on this wiki describe a planned or intended initiative only, not a current equity holder or active governance body.

Changes to this notice. PointSav may update this notice from time to time; the version posted on this page governs.

Not a filing system. This wiki is not a securities filing system, an electronic disclosure repository, or a substitute for SEDAR+ or any other regulatory filing system. Formal securities filings are made through the applicable regulatory filing system, not through this wiki.

Full disclaimer. This notice supplements, and does not replace, the full Disclaimers article. In the event of any conflict, the full Disclaimers article governs.

Read the full disclaimer →