Everything before this proved the idea. Phase 4 makes it operable by someone who did not build it: more connectors, real identity and access control, visible data quality, verified backups, and an install that completes with the network cable unplugged.
| connector | mode | last sync | events 24h | lag | status |
|---|---|---|---|---|---|
| jira · OILSIM | webhook + backfill | 12s ago | 1,842 | 0s | ✓ healthy |
| gitlab · oilsim/* | webhook | 1m ago | 603 | 0s | ✓ healthy |
| azure devops · PMO | poll 5m | 3m ago | 221 | 3m | ✓ healthy |
| csv · finance actuals | sftp watch | 6h ago | 1 | 6h | ⚠ file late |
| imap · pmo inbox | poll 15m | 9m ago | 47 | 9m | ✓ healthy |
No new reasoning arrives here. What arrives is everything that decides whether the system survives contact with a real IT department: identity, backups, breadth of connectors, and visible data quality.
Operations console, data-quality panel, report packs, and the audit export screen. React
extendedUnchanged, now with model pinning and an offline model bundle. LM Studio / Ollama / vLLM
runningGains publish approvals tied to roles. React Flow
runningUnchanged. SPARQL · OR-Tools
runningUnchanged, now indexing several sources at once. pgvector · RRF
runningSHACL findings surface in the UI instead of sitting in logs. Oxigraph · SHACL
extendedBackup, restore drills, retention policy, and the AI Act log export. PostgreSQL
extendedGitLab, Azure DevOps, CSV/SFTP, IMAP, plus a generic webhook connector for anything else. Python
newPhase 4 adds no new intelligence. It adds everything that determines whether the system is still running well in three years without us: more source systems, proper log-in and permissions, visible data quality, tested backups, and an installation that completes with no internet connection.
These are the items that never appear in a demo and always appear in a procurement review. Skipping them is how promising pilots quietly die at the point of handover.
One Docker Compose file, one host, no outbound network. Client tools reach in through the connectors, and nothing reaches back out. This diagram is what a security review actually asks for, so it is drawn the way they expect to read it.
One machine, one set of containers, one internal network. Your tools connect inwards. Nothing connects outwards, and that is enforced by how the system is built rather than by a setting someone could change.
The red band at the bottom is the part worth reading twice. There are no model API calls, no telemetry, no licence check and no update fetch, so the host can be firewalled to zero outbound traffic and everything still works. Most AI products cannot survive that test.
This is the phase that decides renewal. It is also where the earlier architectural discipline pays off, because backup, audit export, and multi-source ingestion are nearly free when the event log is already the single source of truth.
GitLab, Azure DevOps, CSV over SFTP, IMAP, and a generic webhook receiver so an unusual in-house tool can be onboarded in a day.
same envelope, no new conceptsKeycloak against the client directory, five roles, and rule publishing gated by approval. The auditor role can read and export but never change anything.
Keycloak · OIDCSHACL findings become a working screen: unassigned tasks, broken dependencies, unresolved identities. PMOs adopt this faster than the AI features.
SHACL · surfaced, not loggedNightly dump of the event log, with the graph and vectors rebuilt from it. A restore is rehearsed quarterly and the result recorded.
one backup covers everythingImages, model weights, and packages ship as one signed bundle. Install completes with no internet, which is what defence, pharma, and finance actually require.
air-gap firstOne command produces the record an EU AI Act reviewer expects: data and model versions, decision logic, inputs, outputs, timestamps, and operators.
Articles 11, 12, 19Two of these tend to surprise clients. The data-quality panel exposes the state of your project records: unassigned work, dependencies pointing at deleted items, the same person recorded under different names. PMO teams frequently adopt this before they adopt any of the AI features, because it is immediately useful.
The audit export is the other. One command produces the record a regulator asks for, covering data versions, model versions, decision logic, inputs, outputs, timestamps and operators.
The correctness of the system never depends on the language model, so a client with modest hardware loses narration speed and nothing else. That property is worth stating plainly in procurement conversations.
| Deployment | CPU / RAM | GPU | Model | What the client gets |
|---|---|---|---|---|
| Pilot, one programme | 8 vCPU · 32 GB | none | 7B quantized, CPU | Everything works. Narration takes a few seconds per answer. |
| Standard | 16 vCPU · 64 GB | 1 × 24 GB | 14B GGUF | Interactive answers, comfortable for daily PMO use. |
| Large programme | 32 vCPU · 128 GB | 2 × 24 GB or 1 × 48 GB | 32B | Better extraction quality, several concurrent users. |
A pilot runs on an ordinary server with no graphics card at all. A comfortable daily-use deployment needs one mid-range GPU. A large programme with several concurrent users benefits from two.
The line worth remembering in a procurement conversation: because correctness never depends on the AI model, weaker hardware costs you speed and phrasing quality, never accuracy. A client on the smallest configuration gets the same numbers as one on the largest.
The final demonstration is deliberately run with your own IT and security people present, and it is designed so we cannot stage it. The network cable comes out, the system installs, three real tools are connected, last night's backup is restored into a clean container, and yesterday's report is regenerated identically.
One step is included specifically because it fails: we log in as an auditor and try to publish a rule, and are refused. Demonstrating that permissions genuinely hold is more persuasive than any feature.