RAGatm Open

Open source

Three public repositories under the Apache-2.0 licence, locked dependencies, documented contracts. Here is what is published, how to contribute and what remains to be done.

Why open the code

A document AI is only trustworthy if you can verify what it does with your documents. Publishing the code, the API contracts and the qualification procedures lets anyone audit, host and adapt it.

RAGatm Open is developed in France, with a European approach to technological control: locally executed models, infrastructure the operator controls, no mandatory dependency on a remote AI provider.

The Open edition derives from an older private product. It was de-confidentialised, stripped of non-redistributable components and re-qualified before publication. This site describes the Open edition only.

Three modules

Each repository has a precise role; two are required, the third is optional.

No release or Git tag as of 2026-11-11: the main branch of the three repositories is the candidate publication. No official Docker image is published for the three repositories; images are built locally from source (base images pinned by digest).

Licences

The original code of the three repositories is published under the Apache License 2.0, with a NOTICE file. No model weights are distributed: the Compact profile models (granite-embedding, qwen2.5, bge-reranker-v2-m3) are downloaded by the operator and are themselves Apache-2.0 licensed.

Third-party components keep their licences, listed in each repository’s THIRD_PARTY_NOTICES.md. Some optional copyleft components are never included by default.

  • psycopg (LGPL-3.0), certifi (MPL-2.0), libvips (LGPL-3.0): included, compatible licences.
  • LibreDWG (GPL-3.0) for DWG files and PyMuPDF (AGPL-3.0): optional, excluded from the default images; enabling them is a compliance review for the operator.
  • The Outlook .msg parser (GPL) was removed from the Open edition.

Contribute

  • Read CONTRIBUTING.md and CODE_OF_CONDUCT.md in the relevant repository.
  • Report a vulnerability privately as described in SECURITY.md (contact@ragatm.com); GitHub private vulnerability reporting is enabled.
  • Each repository runs a GitHub Actions CI: deterministic install, tests, lock-file consistency, dependency audit, secret scan.
  • Dependencies are hash-locked (requirements.lock, package-lock.json); any update is an explicit change with tests and a CHANGELOG entry.

Governance

The project is maintained by its author under the "RAGatm Open" identity, with a single contact (contact@ragatm.com). Architecture decisions are recorded in ADRs published in the main repository (document storage, mandatory second factor, etc.).

The main branch of each repository is protected (no history rewriting). There is no release or tag yet: the main branch is the candidate publication.

Acknowledged limits

  • No official Docker image is published; images are built locally.
  • The gateway API contract (gateway-api/1.0) is a candidate, not ratified.
  • GPU profiles are not qualified; load beyond one concurrent generation and multi-machine deployment are not verified.
  • Vision, speech recognition and OCR are not enabled in the published Open edition.
  • Code formatting (lint) is not blocking in the CI.

Public roadmap

The items below follow from the documented limits. They are not a schedule commitment.

  1. Ratification of the gateway-api/1.0 contract.
  2. Qualification of an 8 GB GPU profile on a dedicated host with the official Ollama image (NVIDIA driver ≥ 550).
  3. First tagged release and possible image publication after a distribution decision.
  4. Clarification of the Compact configuration for XML, DXF and EML formats (consistent documentation and flags).
  5. Multi-node qualification of the Pool on real hardware.

Source: CHANGELOG files ("Unreleased" section) and the repositories’ limits documents.