Compliance & incident report drafting

The agent reads the policy and the incident record and drafts the compliance report — clause citations, violations, remediation table, open questions — for a human to review. The sensitive material never leaves your infrastructure.

Why run it locally: Compliance drafting is exactly the workload regulated industries cannot send to a cloud API: the input IS the sensitive record. It is also naturally async and human-reviewed, which makes CPU-speed decode a non-issue and small-model caveats manageable — the reviewer is the checkpoint by design.

Model & hardware fit: 4B works for structured drafts; 9B–27B for longer reports. Async work — CPU is fine.

1. The server — any install works; one line on Linux:

curl -fsSL https://inference-server.searchblox.com/install | sudo bash

2. The agent — pi, a minimal open-source coding agent (four tools: read, write, edit, bash), needs Node 22+:

npm install -g --ignore-scripts @earendil-works/pi-coding-agent

3. Connect them — create ~/.pi/agent/extensions/searchai.ts:

import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";

export default function (pi: ExtensionAPI) {
  pi.registerProvider("searchai", {
    baseUrl: "http://127.0.0.1:8081/v1",
    apiKey: "$SEARCHAI_API_KEY",
    api: "openai-completions",
    models: [{ id: "q35-4b", name: "SearchAI q35-4b", reasoning: false,
      input: ["text"], cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
      contextWindow: 32768, maxTokens: 4096 }]
  });
}

export SEARCHAI_API_KEY='your-api-key'   # printed by the installer

Full setup detail (and four more worked tasks) in the pi agents article. The server works with pi stock — no compatibility flags.

With the policy excerpt and an incident note in the working directory:

pi --provider searchai --model q35-4b -p \
  "Read retention-policy.md and incident.md. Draft report.md: a compliance \
   incident report for HUMAN REVIEW with exactly these sections: ## Summary, \
   ## Policy clauses implicated (cite the clause numbers), ## Violations and \
   gaps, ## Remediation actions (each with an owner role and target timeframe), \
   ## Open questions for the reviewer. Be specific to the facts; do not invent \
   facts. Verify with grep that all five section headers exist."

Measured run (64 seconds, CPU 4B). The draft mapped every policy clause to the specific incident facts — including the subtle one (a backup restore re-introducing deleted records, violating clause 7.2), produced a remediation table with owner roles and timeframes, and asked genuinely useful reviewer questions:

## Policy clauses implicated
- DRP-7.1: Customer PII must be deleted within 30 days... (violated by re-introduction)
- DRP-7.2: ...must be excluded from restore into production after a deletion
  request (violated by restoration of July 28 backup on September 2).
- DRP-7.3: Every deletion request... logged within 5 business days (violated; no entry).
...
## Open questions for the reviewer
- What specific corruption required the July 28 backup restoration, and could
  it have been resolved without re-introducing PII?

Frame the output as a draft, always — the prompt above bakes that in. In our run the model marked a pending third-party confirmation as "partially violated" when the deadline had not yet passed: precisely the kind of judgment call the human reviewer exists to make.

Measured: 64 s: policy + incident → structured report draft.

Next: all the use cases · give the agent memory across sessions · 3–4× the speed with one GPU flag