Build the LOCAL RAG learning project in this ZIP. Explain the data flow first.
Keep the supplied fictional corpus and public-only CLI. Derive any real tenant
identity from trusted server authentication, never from user/model JSON.
First run the deterministic retrieval and extractive baseline, then optionally
connect a local Ollama generator. Clearly label which mode produced an answer.
Keep sources, IDs and retrieval scores. Filter permissions before retrieval.
Refuse to invent an answer when no source passes the retrieval threshold.
Treat retrieved text as untrusted data. Do not grant tools or execute documents.
Validate that citations refer to retrieved sources, while explaining that this
does not prove the answer is semantically supported. Add tests for unknown
questions, another tenant, missing citations and a changed document.
Report actual commands and results. Do not deploy or publish private files.
