The decision to run Sepulchre's AI features on an in-process small language model instead of a hosted API — so audit Q&A, compliance narratives and semantic search never ship tenant metadata off the box. The safety linchpin is grammar-constrained decoding: the model emits only a whitelisted query object, never free-form SQL.
Load-bearing invariantThe model never sees plaintext, and audit metadata never leaves the box. A hosted API would contradict the zero-knowledge posture Sepulchre sells, so the substrate must be on-box, small, and steerable.
Sepulchre — embedded AI substrate · captured as code in packages/ai/src/substrate.ts (SUBSTRATE) architecture by Blake Medulan · for more information contact blake@3halves-labs.com