housekeeping: the inventory a stranger reads first

From a reading of the gate's documents (2026-10-21):
- AGENTS.md: Steps 14 and 15 shown Pending while the Port and both
  sockets have carried live traffic since the gate was built → Done,
  with what carries them; "next build task" now points at the open
  items, the phase tables being complete.
- README.md: the repository tree omitted azazel_processor,
  kushya_generator, mesorah, src/tools and scripts → listed, each in a
  line.
- deploy/ARCHITECTURE.md: the judgment path holds no model, said in
  writing — the examination is Python patterns and Prolog rules, the
  judges consult that Prolog; kushya_generator (a fine-tuned model in
  this repo, not deployed, not wired) is an OFFERER whose output is
  examined, never a component the bedikah, the engine or a judge
  consults. The kohen is not the offerer. azazel_processor listed.
- The map: the repository is public; eleven files named the ingress
  NLB's literal address and five the kohen's kubeconfig path. Docs now
  use the domains (git.bikoret.ch, bikoret.ch) or "<NLB-IP>" with the
  kubectl query that answers it; the kubeconfig is "$KUBECONFIG" /
  "$HOME/.kube/<your-cluster>.yaml". gitea-public-apply.sh takes NLB
  from the environment. None of it was a secret; all of it was a map.
- OTP pin: checked, not changed — the segfault in the build log was a
  source-built OTP 26.2.1 on macOS; the image is hexpm's 26.2.1 with
  ERL_FLAGS +JMsingle.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/ARCHITECTURE.md

@@ -11,10 +11,14 @@ One Kubernetes namespace runs the following:
 | `vav-pipeline` | Elixir/OTP release | Bereishit cycle, ShemaContext, Cloud, Manna, HTTP API (pe'ah, courtyard, chatzer, kodesh) |
 | `shoresh-engine` | Haskell binary, spawned by vav-pipeline as an Erlang Port (staged into the pod by the `shoresh-engine-install` init container — NOT a sidecar container; a Port is a child process of the BEAM and cannot cross a container boundary) | Root activation, te'amim parsing, gematria |
 | `talmudic-engine` | SWI-Prolog (sidecar via Unix socket) | 613 mitzvot, 13 middot, kushya generation, teiku |
-| `korban-processor` | Python 3.12 (sidecar) | Offering protocol, eish zarah validation |
+| `korban-processor` | Python 3.12 (sidecar) | Offering protocol, eish zarah validation, the bedikah's readings (pattern-based: `korban_processor/bedikah.py`) |
+| `kushya_generator/` | Fine-tuned model — **not deployed, not wired** | An OFFERER, if it is ever run: its output arrives at the gate like any model's and is examined. It is never a component the bedikah, the Talmudic Engine or the Sanhedrin consults. |
+| `azazel_processor/` | Python — run by the kohen, not in the pod | Disposal records (the goat for Azazel); `VavPipeline.AzazelIngest` reads its files into L3 |
 
 All four run in the same pod. vav-pipeline is the main container; talmudic-engine and korban-processor are sidecars; shoresh-engine runs inside vav-pipeline as an Erlang Port child process, staged in by an init container.
 
+**No model stands on the judgment path.** The examination of an output — the offering protocol, the seven readings, the halt rules — is Python pattern extraction and Prolog rules, and the Sanhedrin's judges consult that same Prolog. Nothing that examines is a model, and nothing a model produces is consulted as a rule. The kohen is not the offerer. A fine-tuned model in this repository (`kushya_generator/`) is an offerer or a tool whose output is itself examined; wiring it into the bedikah, the engine or a judge would put the offerer on the altar, and is refused by this document before anyone does it for convenience.
+
 ## External dependencies
 
 | Dependency | Purpose | Contract |

deploy/k8s/gitea-ingress.yaml

@@ -10,7 +10,7 @@
 # (ingress-tcp-services.yaml) stay as they are; this adds a third door.
 #
 # Prerequisites:
-# 1. DNS: git.bikoret.ch → 185.19.28.170 (Infomaniak zone)
+# 1. DNS: git.bikoret.ch → <NLB-IP> (Infomaniak zone)
 # 2. ClusterIssuer letsencrypt-prod
 ---
 apiVersion: networking.k8s.io/v1

deploy/k8s/gitea-mcp-ingress.yaml

@@ -8,7 +8,7 @@
 # 1. nginx-ingress controller installed
 # 2. cert-manager installed
 # 3. ClusterIssuer letsencrypt-prod applied
-# 4. DNS: mcp.bikoret.ch → 185.19.28.170 (the one NLB; Infomaniak zone)
+# 4. DNS: mcp.bikoret.ch → <NLB-IP> (the one NLB; Infomaniak zone)
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress

deploy/k8s/gitea-mcp-secret.yaml

@@ -7,11 +7,11 @@
 #
 # Two secrets needed (static-token mode):
 # 1. GITEA_TOKEN: Personal Access Token from Gitea
-#    Create at: http://185.19.28.170:3000/user/settings/applications
+#    Create at: https://git.bikoret.ch/user/settings/applications
 #    Permissions: repo (read/write)
 #
 # 2. OAuth Client ID/Secret: Registered OAuth app in Gitea
-#    Create at: http://185.19.28.170:3000/user/settings/applications
+#    Create at: https://git.bikoret.ch/user/settings/applications
 #    Redirect URIs: https://claude.ai/api/mcp/auth_callback
 #                   http://127.0.0.1/callback   (Claude Code)
 #    Confidential Client: UNCHECKED (PKCE). Only the Client ID is needed;

deploy/k8s/gitea-public-apply.sh

@@ -2,7 +2,7 @@
 # Move Gitea and its MCP server to public HTTPS on bikoret.ch and switch
 # the MCP server to MCP OAuth (2026-10-19). Run by the transmitter:
 #   ! bash ~/.local/bin/gitea-public-apply
-# Idempotent. Needs DNS first: git.bikoret.ch and mcp.bikoret.ch → 185.19.28.170.
+# Idempotent. Needs DNS first: git.bikoret.ch and mcp.bikoret.ch → <NLB-IP>.
 #
 # Rollback (static-token mode on mcp.shorashim.ch, as before 2026-10-19):
 #   kubectl -n temple-council set env deploy/gitea \
@@ -12,7 +12,7 @@
 set -euo pipefail
 REPO="${REPO:-$HOME/bikoret}"
 cd "$REPO"
-NLB=185.19.28.170
+NLB="${NLB:?set NLB to the ingress address: kubectl get svc -n ingress-nginx ingress-nginx-controller}"
 for h in git.bikoret.ch mcp.bikoret.ch; do
   ip=$(dig +short "$h" | tail -1 || true)
   if [ "$ip" != "$NLB" ]; then

deploy/k8s/gitea-public-patch.yaml

@@ -10,7 +10,7 @@
 # name that never resolved) and SSH_DOMAIN (was 185.19.29.94, an NLB IP
 # released on 2026-10-06). Clone URLs shown by Gitea become
 # https://git.bikoret.ch/... and git@git.bikoret.ch:...; the old
-# http://185.19.28.170:3000 remote keeps working for push/pull.
+# http://<NLB-IP>:3000 remote keeps working for push/pull.
 # Side effect: with an https ROOT_URL Gitea marks its session cookie
 # Secure, so the WEB UI must be used at https://git.bikoret.ch, not on
 # the plain-HTTP :3000 door (git over :3000 is unaffected).

deploy/k8s/gitea-public-verify.sh

@@ -13,6 +13,6 @@ chk "mcp /healthz" 200 "$(curl -sS -m 15 -o /dev/null -w '%{http_code}' https://
 prm=$(curl -sS -m 15 https://mcp.bikoret.ch/.well-known/oauth-protected-resource || echo err)
 chk "protected-resource names Gitea" yes "$(printf '%s' "$prm" | grep -q 'git.bikoret.ch' && echo yes || echo no)"
 chk "POST /mcp without token → 401" 401 "$(curl -sS -m 15 -o /dev/null -w '%{http_code}' -X POST https://mcp.bikoret.ch/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d "$INIT" || echo err)"
-chk "git over :3000 still answers" 200 "$(curl -sS -m 15 -o /dev/null -w '%{http_code}' http://185.19.28.170:3000/api/v1/version || echo err)"
+chk "git over :3000 still answers" 200 "$(curl -sS -m 15 -o /dev/null -w '%{http_code}' http://<NLB-IP>:3000/api/v1/version || echo err)"
 echo "protected-resource: $prm"
 exit $fail

deploy/k8s/ingress-tcp-services.yaml

@@ -1,14 +1,14 @@
 # Gitea behind the shared ingress — TCP passthrough
 #
-# One NLB for the cluster (185.19.28.170, the ingress-nginx Service)
+# One NLB for the cluster (<NLB-IP>, the ingress-nginx Service)
 # instead of one per Service. Bikoret is an HTTP Ingress
 # (service.yaml). Gitea has no hostname that resolves
 # (gitea.temple-council.ch is configured in Gitea and exists nowhere),
 # and host-based routing needs a name — so Gitea rides the ingress
 # controller's TCP passthrough on two ports of the same NLB:
 #
-#   185.19.28.170:3000  →  temple-council/gitea:80   (HTTP — git, web UI)
-#   185.19.28.170:22    →  temple-council/gitea:22   (SSH)
+#   <NLB-IP>:3000  →  temple-council/gitea:80   (HTTP — git, web UI)
+#   <NLB-IP>:22    →  temple-council/gitea:22   (SSH)
 #
 # Three live objects carry this; only the first is a whole manifest:
 #

deploy/k8s/secrets.yaml

@@ -42,7 +42,7 @@ stringData:
 # THIS FILE IS A TEMPLATE. Never commit a real value. Create the secret
 # from the live database credential instead:
 #
-#   export KUBECONFIG=~/.kube/exoscale-temple-council.yaml
+#   export KUBECONFIG="$HOME/.kube/<your-cluster>.yaml"
 #   umask 077
 #   TMP=$(mktemp)
 #

deploy/k8s/service.yaml

@@ -42,7 +42,7 @@ spec:
 # below) only redirects. The old shorashim.ch rule was taken down on
 # 2026-10-20 (the domain is retired). TLS from Let's Encrypt through cert-manager's
 # letsencrypt-prod ClusterIssuer, HTTP-01 — so apply this ONLY after
-# `dig +short A bikoret.ch` answers 185.19.28.170: a certificate asked
+# `dig +short A bikoret.ch` answers <NLB-IP>: a certificate asked
 # for before the name resolves only burns the failed-validation limit.
 # The no-host catch-all stays, so http://<ingress-ip>/... keeps working
 # with no DNS; with ssl-redirect on, named hosts go to https.

deploy/k8s/shorashim-ch-takedown.sh

@@ -4,7 +4,7 @@
 #   ! bash ~/.local/bin/shorashim-ch-takedown
 # Idempotent.
 #   1. Ingress `shorashim`: the shorashim.ch host rule is gone (service.yaml).
-#      The no-host catch-all stays, so http://185.19.28.170/ still answers —
+#      The no-host catch-all stays, so http://<NLB-IP>/ still answers —
 #      the name itself dies when its A record is removed at Infomaniak.
 #   2. The orphan TLS secret for mcp.shorashim.ch is deleted.
 #   3. Gitea APP_NAME "Shorashim" → "Bikoret" (gitea-public-patch.yaml; one restart).