The constraint comes first
For an institution under a residency mandate the constraint is not a preference to be negotiated. Classified or personal data cannot transit a third-party API, so no amount of contractual assurance from a model vendor changes the answer. That removes the hosted option entirely, and with it the habit of treating the model as a service somebody else operates. What remains is a deployment problem: the model comes to the data, on hardware the customer owns, inside a perimeter with no route out.
MINERVA was scoped that way from the first brief — sovereign large-language-model document intelligence over a classified corpus, with sizing, quantisation, serving, retrieval, evaluation and the update procedure delivered as one scope rather than six. The single scope matters more than it sounds. Split the work and the sizing decision is taken by someone who never sees the retrieval load, the quantisation level is chosen by someone who never runs the evaluation, and the update procedure gets written after the perimeter is already closed.
Brief to production took seventy-five days — ten and a half weeks. Processing that had run three days came back in eight minutes, at 94% extraction accuracy, with nothing leaving the premises. Those are the outcomes. The rest of this note is the engineering that produced them, in the order the decisions actually had to be taken, because on a fixed perimeter the sequence is not negotiable either.
Sizing against sustained inference, not benchmark bursts
The first deliverable is a hardware specification, and it is the one most often got wrong. Published benchmark figures describe a burst: a single prompt, a warm cache, a short context, nothing else on the card. An estate does not work that way. Concurrent readers, long documents, retrieval context appended to every prompt, and an index rebuild running while people are still asking questions. We size against the sustained figure, and we prove throughput before procurement is signed.
Proving it first is a commercial decision as much as a technical one. A node bought against burst numbers looks adequate in acceptance testing and then falls over in the third week of real use, at which point the fix is a procurement cycle rather than a configuration change. Inside a classified estate a second procurement cycle can cost more calendar time than the whole original build. Seventy-five days does not survive a hardware re-order.
So the sizing exercise runs on the real workload profile: expected concurrency, the document lengths that actually appear in the corpus, the retrieval context each prompt will carry, and headroom for the index. What comes out is a sustained throughput target the node has to hold, not a peak it can touch once. Everything downstream — the quantisation level, the context budget, how many requests are served in parallel — is then chosen to fit that target rather than to flatter it.
Quantisation is a sizing decision, not a compression trick
Llama 3 70B, quantised to GGUF and sized to the hardware on site. The word doing the work in that sentence is sized. Quantisation is usually described as making a model smaller; in a sovereign deployment it is how the model is made to fit a node whose specification is already fixed — or, better, how the node and the quantisation level are chosen together. Weights, context window and concurrency all compete for the same memory, and open weights give you Gemma, Mistral and Qwen as alternatives to trade against.
GGUF earns its place for reasons beyond file size. It is a single self-describing artefact, which matters when the delivery mechanism is physical media and the receiving machine has no package repository to reach. It runs on CPU as well as GPU, which leaves a degraded but working fallback if a card fails inside a perimeter where a replacement is a scheduled event rather than an overnight delivery.
The quantisation level itself is settled by evaluation on the customer’s own corpus, not by a general leaderboard. A level that costs a little on open-domain questions may cost nothing on the document types the estate actually holds — or it may cost a great deal, and the only way to know is to measure against the corpus in front of you. That measurement is part of the scope, which is why evaluation sits inside the delivery rather than as a separate exercise afterwards.
Retrieval over the estate’s own corpus
The model does not hold the answers; the corpus does. Documents are indexed locally with pgvector, in the same PostgreSQL instance that carries the rest of the application state. That is a deliberately unremarkable choice. A separate vector service is another process to install offline, another thing to back up, another component an assessor asks about, and another dependency whose upgrade path runs through the internet. One database is one backup and one restore procedure.
Every generated answer cites the source file. This is the difference between a system an officer will use and one they will politely ignore. Provenance makes the output a route to the document rather than a substitute for it: the reader verifies the claim in the original, in a file whose classification they already know. Trust is placed in the citation, not in the generation — which is the only arrangement that survives contact with people who are accountable for being wrong.
It also changes what a failure looks like. An unsupported answer with no citation is visibly unsupported. Retrieval that returns the wrong passage is a retrieval defect — diagnosable, reproducible and fixable — rather than an unexplained model behaviour. Making the corpus the authority keeps the failure modes in the part of the system engineers can reason about, and keeps the model in the part where it is genuinely good.
Updating a model with no inbound path
Models improve, indexes grow, and both have to change after handover. The tempting solution is a narrow outbound rule, a single host, a scheduled pull — and it is exactly the thing that turns an air-gapped installation into a connected one with extra paperwork. No inbound network path is ever opened for convenience. Once opened it stays open, and the next engineer inherits it as a fact of the environment rather than as a decision somebody took and could revisit.
Updates are signed and delivered offline over controlled media. The bundle carries the model artefact, the index changes and a manifest; signatures are verified on the receiving side before anything is written into place; the previous version stays on disk so a rollback is a restart rather than a reinstall. It is documented as an operating procedure — who may perform it, what is checked, what is recorded — because the people running it in year three will not be the people who built it.
This is slower than a pull, and that is the point. Every change to a classified system arrives as a deliberate, attributable act with a record attached. An assessor reading the log afterwards sees who applied what, when, and against which signature — which is precisely the question they came to ask.
Tested with the interface physically down
A firewall rule is a claim. Pulling the cable is a test. Zero-egress behaviour is verified with the network interface physically down, not merely blocked, because the failure worth finding is the one nobody wrote down: a library that checks for a new version at start-up, a font fetched from a public CDN, a telemetry default that ships enabled, an SDK that resolves a hostname before it will serve and blocks until it times out.
Run with the interface down and each of those stops being a theory. Either the system starts and serves, or it does not — and whatever it was reaching for appears as a stack trace rather than as an outbound packet somebody might notice a year later. The test is cheap, repeatable and hard to argue with, which is what you want from evidence that will be handed to an assessor rather than described to them.
It is also the honest form of the claim. Saying no data leaves the premises means little if the only proof is a firewall configuration maintained by somebody else. Saying it was tested with the interface down is a statement a technical reader can repeat and, if we are wrong, disprove. That is the standard the rest of the deployment is held to as well.
Programmes referenced by codename are classified engagements. Capability, engineering and measured outcome are described in full; the client, the installation and the unit are not named anywhere — disclosure policy.