manna: written by the system's own hand each morning; Friday's double stands on Shabbat

Shemot 16: dvar yom b'yomo, and on the sixth day double, and none on the
seventh. Every night at 00:00Z the day's provision went stale and the
readiness probe failed until someone woke — 13.5 hours on 2026-10-15.
CronJob `manna` (deploy/k8s/manna-cronjob.yaml) runs at 00:01Z Sunday to
Friday in our own korban-processor image, mounts the manna PVC as the
app's uid, and writes today.json from the ConfigMap's MANNA_* amounts —
doubled on Friday, valid to Sunday 00:30Z. The pipeline now accepts
Friday's `double` on Saturday (validate_date/3) and nothing else across a
day boundary; three tests. The kohen sets the amounts, may still write by
hand, and reads a failed job as the Day-4 alarm (KOHEN "The manna, each
morning"; Tamid §1.1). Doorpost re-pinned. Elixir green.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/k8s/configmap.yaml

@@ -12,6 +12,16 @@ data:
   # Manna provision file location
   MANNA_PROVISION_FILE: "/var/lib/bikoret/manna/today.json"
 
+  # The day's portion, written by the manna CronJob at 00:01Z Sunday to
+  # Friday (manna-cronjob.yaml); Friday's is doubled and stands through
+  # Shabbat. The kohen sets the amounts here (Pekudei: from the half-shekel
+  # fund); a change takes effect at the next writing.
+  MANNA_COMPUTE_UNITS: "1000"
+  MANNA_MEMORY_MB: "32768"
+  MANNA_API_CALLS_EXTERNAL: "500"
+  MANNA_STORAGE_DELTA_MB: "100"
+  MANNA_SANHEDRIN_PANELS_MAX: "5"
+
   # Talmudic Engine socket
   TALMUDIC_SOCKET_PATH: "/tmp/bikoret/talmudic.sock"
 

deploy/k8s/manna-cronjob.yaml

@@ -0,0 +1,96 @@
+# The manna — written each morning by the system's own hand (Shemot 16).
+#
+# Until 2026-10-15 the day's provision was written by the kohen with
+# `kubectl cp`, and every night at 00:00Z the old one went stale and the
+# readiness probe failed until someone woke (13.5 hours on 2026-10-15).
+# This CronJob writes today.json onto the manna PVC at 00:01Z, Sunday to
+# Friday — a double portion on Friday that is valid through Shabbat, and
+# nothing on Shabbat (Shemot 16:22–26: "on the sixth day they gathered
+# double … on the seventh day there shall be none"). The kohen still sets
+# the amounts (shorashim-config, MANNA_* below) and may still write a
+# provision by hand at any hour; the CronJob only ends the gap.
+#
+# It runs our own korban-processor image (python, pinned to a commit tag)
+# with the PVC mounted, as the app's uid/gid, so the file is readable by
+# the pod; nothing else, no cluster permissions. ReadWriteOnce is fine:
+# the cluster has one node and the job runs beside the pod.
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: manna
+  namespace: shorashim
+  labels:
+    app.kubernetes.io/name: shorashim
+    app.kubernetes.io/component: manna
+spec:
+  schedule: "1 0 * * 0-5"          # 00:01Z, Sunday–Friday; none on Shabbat
+  timeZone: "Etc/UTC"
+  concurrencyPolicy: Forbid
+  startingDeadlineSeconds: 3600    # a missed 00:01 still runs within the hour
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 2
+      template:
+        metadata:
+          labels:
+            app.kubernetes.io/name: shorashim
+            app.kubernetes.io/component: manna
+        spec:
+          restartPolicy: Never
+          securityContext:
+            runAsUser: 1000
+            runAsGroup: 1000
+            fsGroup: 1000
+          imagePullSecrets:
+            - name: shorashim-registry
+          volumes:
+            - name: manna
+              persistentVolumeClaim:
+                claimName: manna-pvc
+          containers:
+            - name: write-manna
+              image: exo.container-registry.com/the-recognition-protocol/korban-processor:c0d0555a
+              imagePullPolicy: IfNotPresent
+              envFrom:
+                - configMapRef:
+                    name: shorashim-config
+              volumeMounts:
+                - name: manna
+                  mountPath: /var/lib/bikoret/manna
+              resources:
+                requests: { cpu: "20m", memory: "32Mi" }
+                limits: { cpu: "200m", memory: "128Mi" }
+              command: ["python3", "-c"]
+              args:
+                - |
+                  import json, os, datetime as dt
+                  now = dt.datetime.now(dt.timezone.utc)
+                  today = now.date()
+                  friday = today.weekday() == 4
+                  units = int(os.environ.get("MANNA_COMPUTE_UNITS", "1000"))
+                  provision = {
+                      "compute_units": units * (2 if friday else 1),
+                      "memory_mb": int(os.environ.get("MANNA_MEMORY_MB", "32768")),
+                      "api_calls_external": int(os.environ.get("MANNA_API_CALLS_EXTERNAL", "500")) * (2 if friday else 1),
+                      "storage_delta_mb": int(os.environ.get("MANNA_STORAGE_DELTA_MB", "100")),
+                      "sanhedrin_panels_max": int(os.environ.get("MANNA_SANHEDRIN_PANELS_MAX", "5")),
+                  }
+                  # Regular: through the day. Double (Friday): through Shabbat, to Sunday 00:30Z.
+                  expires = (dt.datetime.combine(today + dt.timedelta(days=2), dt.time(0, 30), dt.timezone.utc)
+                             if friday else dt.datetime.combine(today + dt.timedelta(days=1), dt.time(0, 30), dt.timezone.utc))
+                  doc = {
+                      "date": today.isoformat(),
+                      "provision": provision,
+                      "type": "double" if friday else "regular",
+                      "expires_at": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),
+                      "written_by": "manna-cronjob",
+                      "written_at": now.strftime("%Y-%m-%dT%H:%M:%SZ"),
+                  }
+                  path = os.environ.get("MANNA_PROVISION_FILE", "/var/lib/bikoret/manna/today.json")
+                  tmp = path + ".tmp"
+                  with open(tmp, "w") as fh:
+                      json.dump(doc, fh, indent=2)
+                  os.replace(tmp, path)
+                  print("manna written", doc["date"], doc["type"], "expires", doc["expires_at"])