Lodestar — Offline AI Survival Copilot

GPS denial is no longer rare: Poland logged 2,732 jamming incidents in one month in early 2025, and an EU Commission President's plane lost GPS near Bulgaria and landed on paper maps. When navigation fails, everything built on top tends to fail at once including medical guidance, since most first-aid apps assume connectivity that may not exist when it matters most. Lodestar is an offline, on-device AI survival copilot built for that moment. It runs on Snapdragon hardware via ExecuTorch, requesting no INTERNET permission at all, across three capabilities: TREAT — describe an injury by voice or text and get a severity-ranked, source-cited first-aid response. Severity comes from a deterministic safety-tree engine, not the language model, so the system can't be talked into downgrading a critical call by ambiguous phrasing. The model explains and cites a TCCC/MARCH corpus but cannot override the verdict underneath. We tested negation handling ("hasn't stopped" vs. "has stopped now"), the failure mode that matters in the field — and caught and fixed a real bug here during testing. ORIENT — true north without a satellite. By day, a solar compass derives heading from the sun's position, verified against documented sunrise, sunset, and solar-noon directions. By night, on-device star plate-solving matches a photographed sky against a catalog. A status strip shows the active position source — GPS_TRUSTED, DEAD_RECKONING, SOLAR_FIX, or STAR_FIX — and flips in real time if GPS is spoofed, freezing to the last trusted fix. COMMUNICATE — medic-casualty translation plus a one-tap SOS card from the TREAT conversation. Every model-backed capability sits behind one interface, so the app was built and tested against a stub before the real models landed swapping to production is a one-line change. We're upfront about what's tested today (safety tree, solar math, spoof detection all pass automated tests) versus what's in progress (corpus coverage, runtime integration)