Baumwald explores a simple systems question:

How can a language model participate in a software system without ever becoming its source of truth?

The project is implemented as a Windows desktop application that visualizes live operating system telemetry through an interactive process graph, while using local language models to explain system activity and security findings. The application itself is not the experiment—the architecture is.

Rather than relying on the language model for decisions, Baumwald assigns every security verdict, process classification, and system fact to deterministic software. The language models are responsible only for interpreting verified evidence and presenting it in a way that humans can understand.

This separation extends throughout the system. Requests are routed between two local GGUF language models based on reasoning complexity, structured memory augments model knowledge without modifying foundation weights, and deterministic verification prevents generated content from becoming system truth. New knowledge requires explicit human approval before it can become part of the application's persistent memory.

None of these constraints were imposed by the platform or the project scope. They were architectural choices made from the beginning, based on the belief that trustworthy AI emerges from system design—not from the language model alone.

Key Features (Architecture for Trustworthy On-Device AI)

Reliability & Evaluation

(what "grounded" actually means here)

"Grounded" is a claim that needs a falsifiable test, not just an assertion — an in-app evaluation harness runs a fixed battery of queries through the live chat pipeline, the same code path a real query hits.

Deliberately narrow, deliberately dumb: the claim being tested is architectural — does the routing and grounding logic hold — not whether the output reads well.

Human-Gated Ground Truth (teaching the system a new fact)

Teaching Baumwald a fact about a process requires explicit confirmation — and the write path itself rejects generic, low-information input outright, so a hallucinated correction can't silently become ground truth even if a person confirms it without scrutiny.

Demo shown: asked "what is msedge.exe" — answered generically ("a web browser"). Taught it "it is a Web Browser by Microsoft" — a real, specific correction, confirmed before anything is written. Asking again afterward returns the taught fact directly. A vague attempt like "it's a good app" would be rejected before it ever reaches the confirmation prompt at all.

The Guardrail, In Code (real, shipped C# — not illustrative)

A raw 1B model asked "by which company was this built" will confidently invent an answer — confirmed in isolated testing with zero scaffolding: asked about Thunderbird, the bare model fabricated "a word processor... developed by Apple in the 90s," total invention, zero hedging. This is the deterministic guard that prevents that class of question from ever reaching the model: any publisher-shaped question is intercepted before classification, and answered instead from signed CompanyName metadata already read off the binary.

Agentic Governance, Enforced (the model proposes, it never authorizes)

A second, independent chokepoint governs the other direction: not what reaches the model, but what the model is allowed to trigger. ActionGate is the sole path to any destructive action — Block, ForceStop, Sandbox — and every request routed through it, whether typed by a human or classified from a chat command, stops at a manual confirmation the model cannot approve on its own behalf.

Signal, Not Verdict (the Baumwald inference pipeline)

Two local models, two fixed jobs, one routing rule. The 1B model (tested with both Gemma 3 1B and Llama 3.2 1B) handles routine chat and classification by default. Prompts asking for deeper investigation — "analyze," "is this safe," "deep dive," or a general request to explain further — are automatically escalated to a second, user-selectable model (Phi-4-mini-instruct or Foundation-Sec 8B), which handles narration and deep-dive explanation only. Either slot can point at any GGUF model the app's llama.cpp/LLamaSharp inference engine and chat-template detection recognize — swapping the model never changes the routing rule: the deterministic layer still owns every verdict regardless of which model is loaded underneath.

The settings panel also exposes this directly: a named, selectable "Baumwald KV-Cache" inference engine (not just an opaque model call), and an Eval Log toggle sitting right next to model selection — the reliability claims elsewhere on this page aren't only narrative, they're a literal switch in the app itself.

AI Architecture

(control plane deterministic, inference plane advisory)

Branding (Meaning and Logo Design)

"Baumwald" derives from the symbolic for the Node Trees demonstrating the OS processes and interactions.
Literal translation from German "Baum" means Tree, and "Wald" means Forest — a take on the dense processes visualized in the telemetric tool, looking like a forest of processes.