Contracts are full of important details: liability caps, confidentiality periods, governing law, deadlines and exceptions. Finding one clause in a long PDF can be tedious. Sending the document to a cloud AI service is also not always acceptable when it contains sensitive information.
For Hacktoberfest 2026 Week 2, I built Air-Gapped RAG, a local-first contract PDF question-answering prototype that lets a user ask questions about a document and inspect the evidence behind the answer.
The idea is simple: an answer should be verifiable, and when the document does not contain the answer, the system should say so rather than guess.
What I built
Air-Gapped RAG lets a user upload a contract PDF, extract its text, index its contents locally, and ask questions through a browser interface.
The application combines:
- Next.js, React and Tailwind CSS for the frontend.
- FastAPI and PyMuPDF for the backend and digital PDF extraction.
- Tesseract OCR for scanned or image-only PDFs.
- LanceDB for embedded local vector storage.
- nomic-embed-text for text embeddings.
- Gemma 4 12B through Ollama for local answer generation.
The model receives retrieved document evidence rather than being asked to answer from general knowledge alone. The application validates citation references against the retrieved sources and preserves the original physical PDF page numbers.
Watch the demo
Here is Air-Gapped RAG in action. This demo shows the local contract upload workflow, evidence-backed answers with physical-page citations, and how the application handles questions when the document does not contain the answer.
The demonstration uses a synthetic contract, so no real or confidential documents are exposed.
The demonstration uses a synthetic three-page Master Services Agreement.
First, I upload the contract and index its contents. Then I ask:
What is the limitation of liability cap under Section 4?
The document specifies a $250,000 USD cap or the fees paid during the preceding twelve months, whichever is lower. The application returns an answer backed by a citation to physical page 2.
Next, I ask about a statutory penalty under Australian commercial law—something the synthetic contract does not establish.
The expected result is Not found in records, without fabricated citations.
That second example matters just as much as the first. A document assistant should be able to acknowledge when it lacks evidence.
The hardest part was not simply connecting an LLM
A basic RAG demonstration can retrieve a relevant paragraph and generate a plausible response. Making the result useful for contract review requires more care.
1. Preserving physical-page citations
A citation is only useful if a reader can locate the cited material in the original document. The extraction and chunking pipeline therefore preserves one-indexed physical page numbers, and the server validates generated source references.
During development, I also investigated a legal retrieval failure where an important qualification continued onto the following page. I improved the retrieval and context assembly logic so relevant cross-page clauses could be considered without indiscriminately adding more chunks to every query.
2. Handling scanned PDFs and tables
Extracting digital text is not enough for image-only documents. I added a local Tesseract OCR fallback and worked on reconstructing table-like text so values remain associated with their corresponding labels.
The difference matters when a question depends on a particular table row or rating, not just finding the correct page.
3. Refusing unsupported answers
The system is instructed to answer from the retrieved evidence and abstain when that evidence is insufficient. The backend also checks source identifiers instead of blindly trusting citation identifiers generated by the model.
This reduces the risk of presenting unsupported answers as if they were proven by the document. It does not eliminate every possible retrieval or language-model error, so important answers still need human review.
What offline testing taught me
I tested the application on an Apple Silicon Mac with 24 GB of unified memory and documented the verification procedure and results in the repository.
The recorded physical-host tests covered PDF upload, indexing, grounded answers, physical-page citations, safe abstention, a browser workflow with the frontend bound to loopback, and scanned-PDF OCR while external connectivity was disabled. The socket audit reported no unexpected external connections under the recorded test conditions.
The procedure and its limitations are documented here:
This is evidence of offline functionality on the tested configuration—not a universal security certification. Different operating systems, hardware and future dependency versions need their own verification. Dependencies and model weights must also be installed before the machine is disconnected.
Why open innovation matters
A local-first design would be much less useful if every document had to be sent to a hosted model for inference.
Using open-source tools and a locally runnable open-weight model lets the application process documents without depending on a cloud LLM API for its core question-answering workflow. Developers can inspect the code, change components, run the application on their own hardware and investigate its behavior.
That freedom also brings responsibility: model terms still apply, resource requirements matter, and local execution alone does not prove that every process is free from network activity.
Who could use this?
Potential users include contract freelancers, consultants and small businesses that regularly need to locate clauses or verify terms in lengthy agreements.
A small legal practice might also find page-cited answers useful during initial document review. However, this is still a prototype. I have not yet validated customer demand or willingness to pay, and I would not present it as a replacement for legal judgment or professional review.
The next product decision should come from watching real users try the workflow and understanding where accuracy, installation or usability prevents them from trusting it.
What's next?
I want to keep the project focused: make the installation reproducible, preserve evidence-backed answers and safe abstention, and learn from people who would actually use it before expanding the architecture.
Repository: https://github.com/TechGenDM/Air-Gapped-RAG
Built for the Hacktoberfest 2026 Week 2 Side Hustle challenge.
Prize category: Best Use of Gemma
Top comments (0)