Initial public ModelForge release

docs/architecture/RAGCORE_INTEGRATION.md

@@ -0,0 +1,21 @@
+# ExampleRAG integration
+
+```text
+ExampleRAG operator workflow
+  -> scoped ExampleRAG service credential
+  -> POST /api/v1/capabilities/rag.embedding@1/invoke
+  -> Gateway authentication and rate limits
+  -> GPU scheduler and lease
+  -> outbound GPU Node node agent
+  -> typed offline runtime worker
+  -> vector plus embedding_space_id
+  -> isolated ExampleRAG shadow collection
+```
+
+ExampleRAG configuration names only the ModelForge origin, credential-file boundary and
+`rag.embedding@1`. The adapter rejects redirects, public/cloud hosts, invalid credentials,
+non-finite vectors, wrong dimensions, non-normalized output and embedding-space mismatch. Safe
+transient statuses are retried with bounded backoff. There is no cloud or direct-worker fallback.
+
+The credential is read for every batch, allowing create → secret-file replacement → validate →
+revoke rotation without logging or persisting the secret in either repository.