doorpost: category-grade specification identity verification (vehaya §3.3, §6 item 3)

The companion to L1Reader.verify_integrity/0. L1Reader defends the TORAH SCROLL'S identity (the source text); Doorpost defends the *am*'s COVENANT-CONTENT identity (the category-grade specifications the system was built to hold). WHY THIS IS LOAD-BEARING (Torah-anchored): Devarim 4:2 — לֹא תֹסִפוּ עַל־הַדָּבָר אֲשֶׁר אָנֹכִי מְצַוֶּה אֶתְכֶם וְלֹא תִגְרְעוּ מִמֶּנּוּ. The injunction is plural (etkhem) — corporate. Lo tosif is a property the CATEGORY must hold, not just a discipline each individual practices. Without an enforcement mechanism, lo tosif is a moral exhortation, not a structural commitment — different instances could silently drift, running different halt rules or different disclosure text, and no one would notice. Devarim 11:16-17 — the failure mechanism operates whether or not anyone notices. Corporate breach (specifications drift) produces corporate consequence. The detection mechanism — verifying threshold-text identity against category-source — is what catches drift before the consequence accumulates. Devarim 13:1 — the keeping is plural; the actual not-adding/not- subtracting happens at every individual threshold (singular `lo tosef`, `lo tigra`). Each threshold COULD add or subtract; only the corporate detection mechanism catches it. Vehaya §3.3 / §6 item 3 — "the same specifications must be inscribed at every threshold. Drift is breach. Implement a verification mechanism for category-text identity." The Torah anchor is exact: as L1's text-integrity check defends the Torah scroll's identity, the doorpost-text identity check defends the am's covenant-content identity. Both are lo tosif enforcement; both are load-bearing for what the category IS. CREATED: vav_pipeline/lib/vav_pipeline/doorpost.ex ~210 lines @spec_files 20 category-grade files, alphabetically sorted: - 3 halt rule sources (avodah_zarah, gilui_arayot, shfichut_damim) - 8 middot files (R. Yishmael's 13 inference rules) - 5 specs/ docs (PRD, architecture, vayakhel, tamid, eish_zarah_reading, lo_taaseh_lekha, structure_not_content) - 2 BUILD docs (BUILD_KORBAN, BUILD_AZAZEL) Operations files (pekudei, terumah) EXCLUDED — execution-grade, not category-grade orientation. @expected_hash baseline: bea5dc0c0145ac0d46ffd08b328fbdbf 19112f1aa4d93a3dc37bfd942e4e7490 files/0 the spec set expected_hash/0 the baked hash repo_root/0 configurable via env compute_identity/0 SHA-256 over canonical concatenation of per-file hashes (sort by path, tab-separate, hash; missing file → {:error, ...} not a partial hash) manifest/0 per-file hashes for diagnosis verify_identity/0 :ok | {:error, message} — same shape as L1Reader.verify_integrity/0 THE OPERATOR DISCIPLINE: every change to @expected_hash must be traceable in git to a corresponding spec change in the SAME COMMIT. A bare hash-update commit with no spec-file change is itself a drift signal — the operator updated the witness without updating what is witnessed, which is exactly the failure mode this module defends against. CHANGED: vav_pipeline/lib/vav_pipeline/bigdei_kodesh/router.ex + GET /kodesh/specification_identity operator-tier endpoint returning computed_hash, expected_hash, file_count, manifest, torah_basis. 200 when verified; 503 with status="drift_ detected" otherwise. /kodesh/* tier (not /peah) because exposing per-file SHA-256s publicly would let outside parties enumerate which specific files were changed in any deployment — a fingerprint. Public observability commitments live elsewhere (/peah/azazel_log, disclosure block). + build_health_check/0 adds doorpost_hash to the checks map alongside l1_hash. Spec drift now surfaces in the standard /kodesh/health response. CREATED: vav_pipeline/test/doorpost_test.exs 16 tests: files/0: - returns the full spec list with expected entries - explicitly excludes operations files (pekudei, terumah) - sorted (canonical order) - no duplicates manifest/0: - one entry per spec file - paths match @spec_files order - each hash is 64-char hex SHA-256 (or :missing) compute_identity/0: - 64-char hex hash - deterministic across calls verify_identity/0: - :ok against the live spec set drift detection (synthetic temp dir mirror): - fresh mirror produces same hash as live - modifying ANY one file changes the hash - removing any one file → {:error, missing spec file: <path>} - modifying different files produces different hashes (no accidental hash collision across drift sites) /kodesh/specification_identity HTTP: - 200 with status="verified" when matched - manifest in response carries per-file hashes - torah_basis cites Devarim 4:2 as the load-bearing anchor WHAT THIS DOES NOT CLAIM: - That the specifications are correct (only identifiable and unchanged from the witnessed state). - That all instances will run the same code (only that all instances running this code witness the same specifications). - That hash equality across deployments proves no drift outside THIS spec set (only the listed files are covered). FOLLOW-UP WORK (not in this commit): - Have HaltMonitor call Doorpost.verify_identity/0 at startup (mirrors how L1 integrity is checked at startup) and fire chatzotzrot on drift - Add Doorpost identity to ShemaContext so EVERY reception witnesses the spec-identity (mirrors Devarim 13:1's "the not-adding happens at every threshold") - Fold vehaya.md itself into specs/ (it currently lives in chat downloads — like azazel_engineering_reading.md). Then add it to @spec_files, recompute the hash, update @expected_hash. Tests: vav_pipeline 379 passed, 0 failures, 35 excluded (was 363; +16 Doorpost tests). All other test counts unchanged. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-28 19:31:58 -04:00
1 parent 1e59d9a752
commit 3f4749695d
@@ -155,6 +155,68 @@ defmodule VavPipeline.BigdeiKodesh.Router do
    send_json(conn, 200, status)
  end

+  # === KODESH — Doorpost-text identity (vehaya.md §3.3, §6 item 3) ===
+  # Vehaya / Devarim 11:20 (u'kh'tavtam al m'zuzot beitekha) — the
+  # threshold inscription is constant. Two Shorashim deployments
+  # running the same SHA-256 here are running the same category-grade
+  # specifications. Different SHA-256 = drift = breach. Visible.
+  #
+  # Operators compare the hash across deployments to verify the
+  # *am*'s covenant content is identical at every threshold (the
+  # Devarim 4:2 lo-tosif enforcement mechanism).
+  #
+  # The endpoint is /kodesh/* tier — operator-only — because
+  # exposing the spec-file SHA-256s publicly would let outside
+  # parties enumerate which specific files were changed in any
+  # deployment, which is operationally a fingerprint. The PUBLIC
+  # observability commitment is property 9 of the Azazel build
+  # (/peah/azazel_log) and the disclosure block on every Torah-
+  # content response. The doorpost identity is operator-internal.
+
+  get "/kodesh/specification_identity" do
+    computed = VavPipeline.Doorpost.compute_identity()
+    expected = VavPipeline.Doorpost.expected_hash()
+
+    {status_code, status_atom} =
+      case VavPipeline.Doorpost.verify_identity() do
+        :ok -> {200, "verified"}
+        {:error, _} -> {503, "drift_detected"}
+      end
+
+    body =
+      case computed do
+        {:error, reason} ->
+          %{
+            status: status_atom,
+            error: reason,
+            expected_hash: expected,
+            file_count: length(VavPipeline.Doorpost.files()),
+            manifest: VavPipeline.Doorpost.manifest(),
+            torah_basis: [
+              "Devarim 4:2 (lo tosif)",
+              "Devarim 11:16-17 (failure mechanism)",
+              "Devarim 11:20 (the doorpost — threshold inscription)"
+            ]
+          }
+
+        hash when is_binary(hash) ->
+          %{
+            status: status_atom,
+            computed_hash: hash,
+            expected_hash: expected,
+            file_count: length(VavPipeline.Doorpost.files()),
+            manifest: VavPipeline.Doorpost.manifest(),
+            torah_basis: [
+              "Devarim 4:2 (lo tosif)",
+              "Devarim 11:16-17 (failure mechanism)",
+              "Devarim 11:20 (the doorpost — threshold inscription)"
+            ]
+          }
+      end
+
+    send_json(conn, status_code, body)
+  end
+
  # === CATCH-ALL ===

  match _ do
@@ -360,6 +422,16 @@ defmodule VavPipeline.BigdeiKodesh.Router do
      _ -> "fail"
    end

+    # Companion to L1 integrity: doorpost-text identity (vehaya
+    # §3.3). L1 defends the Torah scroll's identity; Doorpost
+    # defends the *am*'s covenant-content identity. Both are
+    # load-bearing — one is the source, the other is what the
+    # category committed to hold.
+    doorpost_check = case VavPipeline.Doorpost.verify_identity() do
+      :ok -> "pass"
+      _ -> "fail"
+    end
+
    halt_check = if VavPipeline.HaltMonitor.alive?(), do: "pass", else: "fail"

    cloud_check = case VavPipeline.Cloud.check() do
@@ -376,6 +448,7 @@ defmodule VavPipeline.BigdeiKodesh.Router do

    checks = %{
      l1_hash: l1_check,
+      doorpost_hash: doorpost_check,
      cloud_readable: cloud_check,
      manna_present: manna_check,
      halt_monitor_alive: halt_check,