Embeddings Explorer — REPRESENTATIVE OUTPUT (authored at M8 build time)
STATUS: NOT a real capture. Models were not run in the build environment.
REGENERATE on the golden VM before the workshop:
  docker compose run --rm runner python app/embedding_explore.py | tee expected/embedding_output.txt
Similarity values below are plausible estimates for nomic-embed-text:v1.5;
real values will differ in the second/third decimal but the cluster
structure (which pairs rank high/low) should match.

╭──────────────────────────────────────────────╮
│ Day 1 Lab — Embeddings + Similarity Explorer │
│ Embed: nomic-embed-text:v1.5                 │
╰──────────────────────────────────────────────╯

Step 1: Waiting for Ollama…
Service ready.

Step 2: Checking model…
Model already present: nomic-embed-text:v1.5

Step 3: Embedding the phrase corpus…
Embedded 21 phrases → 768-dimensional vectors

Step 4: Pairwise cosine similarity…

        Top 5 MOST similar pairs (meaning, not keywords)
┌────────────┬──────────────┬──────────────────────────────┬────────────────────────────────────────────┐
│ Similarity │ Shared words │ Phrase A                     │ Phrase B                                   │
├────────────┼──────────────┼──────────────────────────────┼────────────────────────────────────────────┤
│      0.812 │            0 │ reset my password            │ credential recovery for a locked account   │
│      0.794 │            1 │ I forgot my login and can't  │ help me regain access to my user profile   │
│            │              │ get into my account          │                                            │
│      0.781 │            0 │ suspicious email asking me   │ possible phishing message received this    │
│            │              │ to click a link              │ morning                                    │
│      0.766 │            0 │ my laptop is infected with   │ antivirus flagged a trojan on the endpoint │
│            │              │ malicious software           │                                            │
│      0.749 │            1 │ reset my password            │ I forgot my login and can't get into my    │
│            │              │                              │ account                                    │
└────────────┴──────────────┴──────────────────────────────┴────────────────────────────────────────────┘

                    Top 5 LEAST similar pairs
┌────────────┬──────────────┬──────────────────────────────┬────────────────────────────────────────────┐
│ Similarity │ Shared words │ Phrase A                     │ Phrase B                                   │
├────────────┼──────────────┼──────────────────────────────┼────────────────────────────────────────────┤
│      0.287 │            0 │ what time does the cafeteria │ ransomware encrypted the files on the      │
│            │              │ close today                  │ workstation                                │
│      0.301 │            0 │ order more coffee for the    │ open a port on the corporate VPN gateway   │
│            │              │ third floor kitchen          │                                            │
│      0.318 │            0 │ book a meeting room for      │ antivirus flagged a trojan on the endpoint │
│            │              │ Friday afternoon             │                                            │
│      0.334 │            0 │ what time does the cafeteria │ configure the firewall to block outbound   │
│            │              │ close today                  │ traffic                                    │
│      0.352 │            1 │ click the link below to view │ ransomware encrypted the files on the      │
│            │              │ the lunch menu               │ workstation                                │
└────────────┴──────────────┴──────────────────────────────┴────────────────────────────────────────────┘

Watch the 'shared words' column: high-similarity pairs often share ZERO
content words (paraphrases), and word-sharing pairs can rank low. That is
semantic search — and also why attacker paraphrases evade keyword filters (Day 2).

──────────── Nearest-neighbor search (what a vector store does) ────────────

Query: I am locked out of my account
  1. 0.784  help me regain access to my user profile
  2. 0.771  I forgot my login and can't get into my account
  3. 0.703  credential recovery for a locked account

Query: an employee reported a scam email
  1. 0.752  possible phishing message received this morning
  2. 0.731  suspicious email asking me to click a link
  3. 0.687  someone sent me a fake invoice with a strange attachment

Query: computer virus cleanup needed
  1. 0.744  my laptop is infected with malicious software
  2. 0.719  antivirus flagged a trojan on the endpoint
  3. 0.598  ransomware encrypted the files on the workstation

Query: how do I get on the wireless network
  1. 0.721  the wifi in the conference room keeps dropping
  2. 0.633  the password to the wifi is posted in the break room
  3. 0.541  open a port on the corporate VPN gateway

Query: somebody encrypted our file server and wants money
  1. 0.768  ransomware encrypted the files on the workstation
  2. 0.622  my laptop is infected with malicious software
  3. 0.577  antivirus flagged a trojan on the endpoint

────────────────────────────────────────────────────────────────────────

Embedding exploration complete.

Things to notice:
  • The top hit for each query is a MEANING match, not a keyword match.
  • Similarity scores are relative — there is no universal 'relevant' threshold.
    (The RAG-eval lab, day1-rag-eval-failure, builds on exactly this point.)

Try it: add your own phrases to data/phrases.txt or queries to
prompts/embed_queries.txt and re-run — no rebuild needed.
