# ExampleRAG integration

```text
ExampleRAG operator workflow
  -> scoped ExampleRAG service credential
  -> POST /api/v1/capabilities/rag.embedding@1/invoke
  -> Gateway authentication and rate limits
  -> GPU scheduler and lease
  -> outbound GPU Node node agent
  -> typed offline runtime worker
  -> vector plus embedding_space_id
  -> isolated ExampleRAG shadow collection
```

ExampleRAG configuration names only the ModelForge origin, credential-file boundary and
`rag.embedding@1`. The adapter rejects redirects, public/cloud hosts, invalid credentials,
non-finite vectors, wrong dimensions, non-normalized output and embedding-space mismatch. Safe
transient statuses are retried with bounded backoff. There is no cloud or direct-worker fallback.

The credential is read for every batch, allowing create → secret-file replacement → validate →
revoke rotation without logging or persisting the secret in either repository.