From b1c8358f8b510f2754b8a9d17a5208cacc57ebd5 Mon Sep 17 00:00:00 2001
From: Scott Karp <github.carded456@passmail.net>
Date: Tue, 13 Oct 2026 21:23:48 +0000
Subject: [PATCH] scripts: the rollout and the upstream-key helpers, with the
 runbook note

shorashim-rollout: restart, wait for 3/3, two consecutive 200s.
upstream-key-set: store a caller's model key for the gate scenario
without echoing it. KOHEN "Rolling out".

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 KOHEN.md                  | 11 +++++++++++
 scripts/shorashim-rollout |  8 ++++++++
 scripts/upstream-key-set  |  8 ++++++++
 3 files changed, 27 insertions(+)
 create mode 100755 scripts/shorashim-rollout
 create mode 100755 scripts/upstream-key-set

diff --git a/KOHEN.md b/KOHEN.md
index d9d7e16a..d664193d 100644
--- a/KOHEN.md
+++ b/KOHEN.md
@@ -555,6 +555,17 @@ omits. Seven in all.
 `tov` means none fired on what could be read — not that the model is
 aligned, not that the output is true. Read `limits` in the response.
 
+### Rolling out — *Nesi'at haMishkan*
+
+`scripts/shorashim-rollout` (also installed at `~/.local/bin/`) restarts
+the deployment, waits for 3/3, and takes two consecutive 200s from
+`/kodesh/health` before reporting — a rollout is not done at 3/3 (NLB
+re-admission lag). A new image must already be pushed as `:latest`. If
+the day's manna has not been written, the new pod hangs at 2/3 until it
+is (Day 4). `scripts/upstream-key-set` stores a caller's model key for
+the gate scenario without echoing it (`~/.config/shorashim/upstream_keys`,
+0600) — run it from a real terminal, not through a non-interactive runner.
+
 ### Standing at the gate — *Bishe'arecha*
 
 A caller can put Shorashim between themselves and a model instead of
diff --git a/scripts/shorashim-rollout b/scripts/shorashim-rollout
new file mode 100755
index 00000000..7b1b5d3c
--- /dev/null
+++ b/scripts/shorashim-rollout
@@ -0,0 +1,8 @@
+#!/bin/bash
+# Roll out the shorashim deployment and wait for 3/3 + two consecutive 200s (memory lesson).
+set -e
+export KUBECONFIG=$HOME/.kube/exoscale-temple-council.yaml
+kubectl -n shorashim rollout restart deployment/shorashim
+kubectl -n shorashim rollout status deployment/shorashim --timeout=300s
+kubectl -n shorashim get pods | grep shorashim-
+for i in 1 2; do sleep 5; curl -s -o /dev/null -w "%{http_code} " http://185.19.28.170/kodesh/health; done; echo
diff --git a/scripts/upstream-key-set b/scripts/upstream-key-set
new file mode 100755
index 00000000..e563b1d3
--- /dev/null
+++ b/scripts/upstream-key-set
@@ -0,0 +1,8 @@
+#!/bin/bash
+# Store the caller's model key for the gate scenario: asks for it without echo, writes 0600.
+set -e
+read -rsp "Anthropic key (not echoed): " KEY; echo
+[ -n "$KEY" ] || { echo "empty — nothing written"; exit 1; }
+install -m 600 /dev/null ~/.config/shorashim/upstream_keys
+printf 'anthropic %s\n' "$KEY" > ~/.config/shorashim/upstream_keys
+echo "written ~/.config/shorashim/upstream_keys (0600)"