ora-core-rag

Canonical retrieval, multi-RAG control, and local RAG Governor layer for ORA Core OS.

Status: 0.4.0

ora-core-rag is a local-first, deterministic retrieval engine for the public ORA canon. It indexes ORA technical files, retrieves source-backed context, emits audit traces, keeps client data outside the core memory boundary, and can run a local RAG Governor profile.

Repository Role

Read this after ora-core-os when you need source-backed retrieval and audit traces around the ORA canon.

Public order	Repository role
3	Canonical retrieval layer, route gates, audit trace, and RAG Governor.

White Papers

• ORA Core RAG Governance White Paper
  Strategic and technical overview of the local-first RAG Governor, route gates, audit traces, client separation, and verification boundaries.

• ORA Core RAG Architecture White Paper
  Shorter and more technical architecture note focused on retrieval flow, route gates, fanout regulation, evidence handoff and architectural invariants.

• Global ORA White Papers Index

V0.4 Capabilities

• automatic discovery and ingestion from public GitHub repositories
• optional JSONL audit log for indexing, queries and orchestrator packets
• minimal ORCHESTRATEUR_LLM connector returning a routed retrieval packet
• GLK client route gate for tenant isolation
• multi-RAG / agent registry planning
• deterministic Neroflux fanout regulation
• anti-contamination checks for cross-tenant resources
• local RAG Governor config, status, bootstrap and governed run commands
• ARCH+ ArchiPersona activation packet generation for M10 v3

Quick Start

cd C:\ora-core-rag
python -m unittest discover -s tests
python -m pip install -e .

Create a local index:

python -m ora_core_rag init --db data/index/ora_core_rag.sqlite
python -m ora_core_rag ingest --manifest examples/ora_sources.json --db data/index/ora_core_rag.sqlite --audit-log data/audit/local.jsonl
python -m ora_core_rag query "PRIMORDIA truth layer" --db data/index/ora_core_rag.sqlite --audit-log data/audit/local.jsonl

Discover and ingest public GitHub sources:

python -m ora_core_rag discover-github TwinsProductionAI/ora-core-specs --ref main --limit 10
python -m ora_core_rag ingest-github TwinsProductionAI/ora-core-specs --ref main --limit 20 --db data/index/ora_core_rag.sqlite --audit-log data/audit/local.jsonl

Return an orchestrator-shaped retrieval packet:

python -m ora_core_rag orchestrate-query "ORCHESTRATEUR_LLM verification" --risk-level MID --db data/index/ora_core_rag.sqlite

Regulate fanout with Neroflux:

python -m ora_core_rag neroflux-regulate --client-sensitivity 0.9 --permission-risk 0.7 --agent-count 4

Build a route-gated client activation plan:

python -m ora_core_rag plan-client --route-manifest examples/client_route_manifest.json --registry examples/rag_registry.json --client-sensitivity 0.4

Local RAG Governor

Check the local Governor:

python -m ora_core_rag governor-status --config examples/rag_governor.local.json

Bootstrap the local Governor index and audit log:

python -m ora_core_rag governor-bootstrap --config examples/rag_governor.local.json

Build an ARCH+ ArchiPersona activation packet:

python -m ora_core_rag arch-persona-activate --payload examples/arch_persona_activation.json

See docs/ARCH_PLUS_IMPLANT.md for the RAG-safe M10 ARCH+ v3 implant.

Run governed retrieval plus client activation:

python -m ora_core_rag governor-run --config examples/rag_governor.local.json --query "PRIMORDIA ORCHESTRATEUR_LLM"

Architecture

User request
  |
  v
RAG_GOVERNOR
  |-- loads local config
  |-- checks Python + SQLite FTS5
  |-- initializes index and audit
  |-- validates GLK route + registry
  |
  v
ORCHESTRATEUR_LLM
  |
  v
Neroflux fanout regulator
  |-- caps RAG fanout
  |-- reduces top_k under pressure
  |-- requires H-NERONS when conflict or sensitivity rises
  |
  v
ORA_CORE_RAG
  |-- canonical ORA retrieval only
  |-- source hashes
  |-- FTS5 text index
  |-- JSONL audit trace
  |-- GitHub public source discovery
  |
  v
Client Route Gate + RAG Registry
  |-- GLK tenant route required for client RAGs
  |-- registry entries cannot answer final directly
  |-- cross-tenant access denied
  |-- no client writes to ORA core

Core Rule

ORA_CORE_RAG indexes ORA canon only.
Client RAGs require a GLK tenant route and stay outside the core index.
Neroflux can reduce fanout, but truth still goes through HGOV/H-NERONS/Primordia.
The RAG Governor wires the local runtime; it does not bypass governance.

Public Repository Map

Order	Repository	Role
1	ora-core-os	Architecture and canonical module order.
2	ora-core-runtime	Runnable runtime and tests.
3	ora-core-rag	Retrieval layer and RAG Governor.
4	ora-core-specs	Technical specifications.
6	ora-core-neroflux	Cognitive flow-control module used by fanout regulation.

Note

V0.4 does not require containers: Python + SQLite FTS5 are enough for the local Governor.

Non-Goals

• it is not a vector database
• it is not a client document store
• it is not a final answer generator
• it is not a truth engine by itself
• it does not write client data into ORA core memory