Bake L1 Torah into container images, simplify K8s deployment

L1 (29MB, 5860 files) is read-only and immutable — it belongs
inside the image, not on a separate volume. The scroll is sealed
in the aron. It ships with the vessel.

- All 4 Dockerfiles: COPY l1/ /mnt/torah/ in runtime stage
- deployment.yaml: Removed L1 PVC volume and all L1 volumeMounts
- deployment.yaml: Added imagePullSecrets for registry auth
- deployment.yaml: Manna uses emptyDir (kohen writes via kubectl cp)
- No CSI driver needed — eliminates Exoscale block storage dependency

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

deploy/docker/Dockerfile.korban_processor

@@ -29,6 +29,10 @@ COPY --from=build --chown=shorashim:shorashim /app/ ./
 COPY --from=build /usr/local/lib/python3.12/site-packages/ /usr/local/lib/python3.12/site-packages/
 
 ENV PYTHONPATH=/home/shorashim/korban_processor/src
+
+# L1 Torah filesystem — baked into the image
+COPY --chown=shorashim:shorashim l1/ /mnt/torah/
+
 ENV L1_MOUNT_POINT=/mnt/torah
 
 # The korban processor is invoked by the vav_pipeline

deploy/docker/Dockerfile.shoresh_engine

@@ -40,7 +40,10 @@ WORKDIR /home/shorashim
 
 COPY --from=build /usr/local/bin/shoresh-engine ./shoresh-engine
 
-# L1 mount point — the engine reads Torah roots from L1
+# L1 Torah filesystem — baked into the image
+COPY --chown=shorashim:shorashim l1/ /mnt/torah/
+
+# L1 mount point
 ENV L1_MOUNT_POINT=/mnt/torah
 
 # The engine is invoked as an Erlang Port by vav_pipeline

deploy/docker/Dockerfile.talmudic_engine

@@ -21,7 +21,10 @@ WORKDIR /home/shorashim/talmudic_engine
 
 COPY --from=build --chown=shorashim:shorashim /app/ ./
 
-# L1 mount point — Prolog reads Torah for mitzvot and root data
+# L1 Torah filesystem — baked into the image
+COPY --chown=shorashim:shorashim l1/ /mnt/torah/
+
+# L1 mount point
 ENV L1_MOUNT_POINT=/mnt/torah
 
 # Socket path for communication with vav_pipeline

deploy/docker/Dockerfile.vav_pipeline

@@ -51,8 +51,11 @@ WORKDIR /home/shorashim
 COPY --from=build --chown=shorashim:shorashim \
   /app/vav_pipeline/_build/prod/rel/vav_pipeline ./app
 
-# L1 mount point — read-only volume in production
+# L1 Torah filesystem — baked into the image (read-only, ~29MB)
-# Mounted at /mnt/torah in K8s, configured via L1_MOUNT_POINT env var
+# The scroll is sealed in the aron. It ships with the vessel.
+COPY --chown=shorashim:shorashim l1/ /mnt/torah/
+
+# L1 mount point
 ENV L1_MOUNT_POINT=/mnt/torah
 
 # Manna provision file location

deploy/k8s/deployment.yaml

@@ -1,16 +1,13 @@
 # Shorashim Deployment — the mishkan
 #
+# Shemot 40:33 — Vay'khal Mosheh et ham'lakhah.
+#
 # Architecture §5.1: All inter-component communication uses
 # JSON over Unix domain sockets or Erlang distribution protocol.
 # No HTTP between internal components.
 #
-# The vav_pipeline (BEAM) runs the Sanhedrin, Chatzotzrot,
+# L1 Torah is baked into each container image (~29MB).
-# AreiMiklat, EglahArufah, Bikurim, MannaLedger, ShabbatTimer.
+# The scroll is sealed in the aron. It ships with the vessel.
-# The shoresh-engine runs as a sidecar (Erlang Port).
-# The talmudic_engine runs as a sidecar (Unix socket).
-# The korban_processor runs as a sidecar (invoked by pipeline).
-#
-# L1 is mounted read-only into all containers.
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -32,18 +29,17 @@ spec:
     spec:
       # --- VOLUMES ---
       volumes:
-        - name: l1-torah
-          persistentVolumeClaim:
-            claimName: l1-torah-pvc
-            readOnly: true
         - name: manna
-          persistentVolumeClaim:
+          emptyDir: {}
-            claimName: manna-pvc
         - name: talmudic-socket
           emptyDir: {}
         - name: tmp-shorashim
           emptyDir: {}
 
+      # --- IMAGE PULL SECRET ---
+      imagePullSecrets:
+        - name: shorashim-registry
+
       # --- INIT CONTAINER: Run L3 migrations ---
       initContainers:
         - name: migrate
@@ -54,10 +50,6 @@ spec:
                 name: shorashim-config
             - secretRef:
                 name: shorashim-secrets
-          volumeMounts:
-            - name: l1-torah
-              mountPath: /mnt/torah
-              readOnly: true
 
       # --- CONTAINERS ---
       containers:
@@ -72,13 +64,7 @@ spec:
                 name: shorashim-config
             - secretRef:
                 name: shorashim-secrets
-          env:
-            - name: SHORESH_ENGINE_BINARY
-              value: "/home/shorashim/shoresh-engine"
           volumeMounts:
-            - name: l1-torah
-              mountPath: /mnt/torah
-              readOnly: true
             - name: manna
               mountPath: /var/lib/shorashim/manna
             - name: talmudic-socket
@@ -108,10 +94,6 @@ spec:
         # === SHORESH ENGINE (sidecar) ===
         - name: shoresh-engine
           image: exo.container-registry.com/the-recognition-protocol/shoresh-engine:latest
-          volumeMounts:
-            - name: l1-torah
-              mountPath: /mnt/torah
-              readOnly: true
           resources:
             requests:
               memory: "128Mi"
@@ -124,9 +106,6 @@ spec:
         - name: talmudic-engine
           image: exo.container-registry.com/the-recognition-protocol/talmudic-engine:latest
           volumeMounts:
-            - name: l1-torah
-              mountPath: /mnt/torah
-              readOnly: true
             - name: talmudic-socket
               mountPath: /tmp/shorashim
           resources:
@@ -140,10 +119,6 @@ spec:
         # === KORBAN PROCESSOR (sidecar) ===
         - name: korban-processor
           image: exo.container-registry.com/the-recognition-protocol/korban-processor:latest
-          volumeMounts:
-            - name: l1-torah
-              mountPath: /mnt/torah
-              readOnly: true
           resources:
             requests:
               memory: "128Mi"