How do we know what the on-prem model is allowed to quote?

Note · KBMill · problem · the signature problem

The demo worked. Then someone asked the only question that matters in a real shop: if the model cites a step, a limit, or a warning — how do we know that stretch was fit to quote? If the answer is “the retriever found it,” you do not have a knowledge base. You have a search over a pile nobody will sign.

That is the signature problem: a responsible person cannot put their name under the citation. Everything upstream — ghost data, hallucination fuel, wrong neighbor, the melt — ends here.

How we see the problem

Wrong answers come from ghost data, hallucination fuel, and the wrong neighbor. Trust fails one step later: there is no list of what was empty, garbled, or taken off the answer path. Hide the holes and the model still fills them. Leave every junk stretch searchable and the model quotes the junk with confidence. Either way, nobody can sign.

That is not a chatbot feature request. It is a manufacture requirement. The leave-behind has to show what the model may treat as fact — and what it must not.

What you already tried

Prompt rules / bigger models / better RAG

“Only quote the context” fails when the context is hollow or noisy. A bigger model rationalizes junk more elegantly. Better retrieval still searches whatever you stuffed in.

Extract to markdown

Words out. No mute list. No board a second engineer opens next week. The signature problem remains.

How we mill it

Mute list (listed, not hidden)

We mill a knowledge brick: a portable ZIP you keep. Readable stock is structured. Known junk is muted off the answer path and listed (LIBRARY_CARD and muted chunk flags — the residual board) — counts and reasons a person can read. That stance is residual-honest: not a slogan, a paper trail for a wrong answer.

SECURITY_REPORT.md

Best checkable proof for this note: open SECURITY_REPORT.md inside any remilled public ZIP (for example Ranger Handbook SH 21-76). Read what the plant declares it did not check — not a clearance, not full DLP/PII/CUI/ITAR, not “should you have uploaded this.” Show the holes, name the limits, last word to your trusted people.

Hostile scans make the same honesty loud (Galileo); cleaner manuals still show finish + mutes (Ranger). Retrieval evals are useful for search demos; they are not the primary Trust artifact — scans and tables use other proofs.

You point your existing local model at the ZIP. You pay only if we produce. We do not certify your RAG for flight, for counsel, or for the floor. Gallery: Public brick shelf. Drop the pile in the bin when you want that package.

What this costs, when it is your pile

Class follows manufacture difficulty — clean short docs Small; scan-heavy or multi-file piles Medium or Hard — not how important the meeting felt. Why $10. Drop the pile on the mill. You keep the ZIP. We purge after the download window (72 hours). No honest brick, no charge.