The corpus decides the architecture
Retrieval inherits the sensitivity of whatever it indexes. An embedding derived from a classified document is a derivative of that document, so on a controlled corpus the index cannot be built through a hosted embedding endpoint — the vectors are generated on the same hardware that serves them. MINERVA was built that way: Llama 3 70B quantised to GGUF, retrieval on pgvector, nothing leaving the premises. The rule applied everywhere else is the same one. If the record cannot leave the country, neither can the prompt containing it, nor the vector derived from it.
