01 · Thesis
Ship a model like a link
Every layer we put between a person and a model is a place the model dies. An app-store review. A sign-up wall. A cold-start on someone's data plan. A monthly inference bill. A privacy prompt that means your words leave this device now. Each is friction, and friction is where good AI quietly fails to reach anyone.
There is a delivery mechanism that removes all of them at once, and it has been sitting in every phone for years: the browser. A Progressive Web App is a website that installs itself, works offline, and — as of the current generation of on-device runtimes — can download and run a real fine-tuned model on the device's own GPU. You send a link. They open it. The model is theirs.
The frontier isn't a bigger model. It's the thinnest possible edge between a person and one they can run themselves.
We call that edge the knife. This paper is about how sharp it already is — built, not theorized — and exactly where the blade is still dull.
02 · The distance problem
What sits between a person and a model today
The default way to put AI in someone's hands carries a stack of hidden tolls. None is fatal alone; together they decide who ever actually uses the thing.
The last one is not academic for us. OpenCairn is a hiking app: the AI is needed exactly where the towers end. A model that requires a data centre to answer “how far to the summit” is useless on the ridge where the question gets asked. The constraint forces the honest architecture — and the honest architecture turns out to be the fast-enablement one.
03 · The mechanism
A URL that unfolds into an offline AI app
The delivery path has four moves, and after the first visit it never touches a network again.
No app store sat in the path. No account was created. Nothing was billed, and after the one-time download nothing was sent anywhere. The runtime and the weights are self-hosted — no CDN, no third-party call — so the whole thing satisfies a strict content-security policy and runs on any static host. The blade is: a link, and then nothing.
04 · The stack we sharpened
What actually runs in the tab
This is not a diagram of an intention. Each layer below is built and measured in the OpenCairn PWA. The model is Feedseed — a Gemma 3 270M fine-tune, vocabulary-trimmed to a 48k function-calling core.
The model, in the browser
Feedseed is exported to ONNX and quantised for the web, then run by an on-device inference runtime on WebGPU. The whole model is a one-time download that lives in the browser's cache:
Feedseed · web build
| Build | Size | Role |
|---|---|---|
| q4f16 | 131 MB | Primary one-time download — 4-bit weights, fp16 elsewhere |
| q4 | 197 MB | Fallback if a device's WebGPU rejects fp16 — CPU-verified |
| fp16 | 310 MB | Quality option — no weight quantisation |
| runtime | ~25 MB | WebGPU inference wasm — cached once, shared by any model |
Decode speed on-device is governed by one relation, and it rewards small: decode tok/s ≈ BW_eff ⁄ bytes-read-per-token. A trimmed, quantised 270M model reads few bytes per token, so it is fast on the memory bandwidth a phone actually has. Cutting the model is not a compromise for the browser — it is the browser strategy.
Grammar in the tab — the GBNF the browser never had
A small model left to free-form generation produces plausible garbage: malformed JSON, invented tool names, occasionally a real side-effect fired by accident. Native stacks solve this with grammar-constrained decoding; browsers had no equivalent. So we built one — a character-level automaton over the function-call grammar, projected onto the tokenizer as a decode-time mask. The model can only emit a valid command.
Facts by retrieval, skills by model
The last row is the sharpest part. A 270M model cannot reliably rank a name — asked to choose among candidates it drifts toward chance. So we don't ask it to. A phonetic + fuzzy retriever resolves the spoken name against the region's real trail list, and the grammar admits only that canonical answer. The name a hiker hears back is a real place by construction, not by the model's good luck — “mail box peek” → Mailbox Peak, “twinfalls” → Twin Falls, “mount sigh” → Mount Si. The model chooses the verb; retrieval owns the noun.
The app right-sizes to the device
Not every phone has a WebGPU adapter, and none should get a broken experience. The PWA probes the device and picks its lane: a flagship runs Feedseed on WebGPU; a mid device uses the browser's built-in model; a light device falls to a deterministic parser. Every lane is offline, and every lane gets the same retrieval-grounded names. The ceiling scales up; the floor never drops out.
05 · Why "knife frontier"
Sharpening, not scaling
The industry's frontier is measured in parameters. Ours is measured in what we can remove and still cut. A 262k vocabulary trimmed to a 48k task core. Sixteen-bit weights taken to four. A dialogue model narrowed to a command layer. Each cut lowers bytes-per-token, which — by the bandwidth relation — raises speed, and shrinks the download, which sharpens the enablement edge.
A machete is kept sharp by taking metal away, not adding it. The frontier we work is the same: cut everything that isn't the model and the link.
What is left at the edge is almost nothing, and that is the point. The user notices a map that talks back and a download bar that fills once. They do not notice a data centre, because there isn't one. This is the out-of-the-way nature of AI done right — the intelligence is present and the machinery is absent.
06 · Economics & ecology
Train once, then it costs nothing to ask
A cloud model is a meter running under every query. An on-device model is a fixed cost paid once, in training, then amortised across every question every user ever asks — on hardware they already own and power themselves.
- $0 per query. Inference happens on the user's GPU. There is no marginal cost, no rate limit, no bill that grows with success.
- No data-centre carbon per request. The energy is the phone's own, already spent being a phone. Nothing is served, so nothing is served hot.
- Private by construction. The utterance is answered where it is spoken. Nothing to intercept, cache, or subpoena, because nothing leaves.
- Distribution is free. Enablement is a URL and a QR code. There is no per-install cost and no gatekeeper between you and a user.
For a partner who wants eco-credible AI, this is the whole pitch on one slide: the greenest inference is the one that never books a server.
07 · The blade cuts both ways
Where the edge is still dull
A knife paper that only praised the knife would be a sales sheet. Here is the honest register of what this mechanism does not yet do, stated as plainly as the wins.
-
WebGPU is not everywhere
The full on-device model is a flagship-tier capability. Solid on modern Chrome/Edge and recent Android; emerging on Safari/iOS. The tiering keeps everyone working, but the top experience is gated by hardware we don't control.
-
The grammar guarantees structure, not judgement
A valid command with a real trail name is now certain. Choosing the right command is not — a 270M/4-bit model still mis-picks the verb on hard turns (≈8 of 11 fully correct in our sample). That is a model-quality axis — a higher-precision quant lifts it — independent of the delivery mechanism.
-
A one-time download is still a download
~131 MB is nothing on Wi-Fi and a real ask on a metered connection. It is gated behind an explicit opt-in and preferred to Wi-Fi, never pulled silently. Honesty about the number is part of the design.
-
The grammar-locked headline is native
The often-quoted single-model accuracy figures come from a native runtime with mature tooling. The browser now has the same structural lock and the same grounded names; matching the native semantic accuracy is the remaining work, not a solved claim.
08 · Generalisation
A mechanism, not a hiking feature
Nothing above is about trails. Strip the domain and what remains is a reusable pattern for putting any small, task-specific model into anyone's hands in the time it takes to open a link:
- A trimmed task model — vocabulary and skills cut to the job, quantised for the web.
- A self-hosted WebGPU runtime — one ~25 MB dependency, shared across models, cached once.
- A grammar for the task's output — so a small model is structurally incapable of malformed or invented answers.
- A retrieval rail for the facts — the model supplies the skill; a lookup supplies the ground truth.
- A tiering probe — so the same link serves a flagship and a hand-me-down without either feeling broken.
Swap the trails for parts numbers, medication names, legal clauses, field-equipment codes — any bounded vocabulary where a real answer matters more than an eloquent one. The enablement story is identical: you sent a link, and the person on the other end is now running a model you trained, offline, for free, and it cannot lie to them about the one thing that matters.
The frontier is not somewhere we are going. It is a link you can send today, and it is already sharp enough to cut.