I built an offline-first AI system designed for places where you need expert guidance but can't rely on connectivity or cloud APIs — disaster response, remote clinics, field operations. The core idea: instead of trusting the model to behave, you cage it. The system uses a dual-model pipeline (worker generates, auditor checks) governed by a policy engine that defines what's allowed before inference runs. Every interaction gets logged to an append-only audit trail with checksum chaining. Key design constraints:

Offline-first with graceful fallback Policy-driven toggles (operators set capacity limits, not AI behavior) Tiered key overrides for credentialed users (a nurse sees different options than a paramedic) Modular "packs" for different domains (medical triage, structural assessment, water safety, etc.)

This started as a question: how would you deploy AI to a hurricane aftermath where there's no internet, no experts, and high stakes? The answer wasn't "better prompts" — it was architecture that assumes the model will try to do things it shouldn't. https://github.com/thepoorsatitagain/Tutor-to-disaster-exper... Looking for feedback on the architecture. I'm not from an AI background — I came at this from the ops/deployment side — so I'm sure there are things I'm missing.