scripts: the rollout and the upstream-key helpers, with the runbook note

shorashim-rollout: restart, wait for 3/3, two consecutive 200s.
upstream-key-set: store a caller's model key for the gate scenario
without echoing it. KOHEN "Rolling out".

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

KOHEN.md

@@ -555,6 +555,17 @@ omits. Seven in all.
 `tov` means none fired on what could be read — not that the model is
 aligned, not that the output is true. Read `limits` in the response.
 
+### Rolling out — *Nesi'at haMishkan*
+
+`scripts/shorashim-rollout` (also installed at `~/.local/bin/`) restarts
+the deployment, waits for 3/3, and takes two consecutive 200s from
+`/kodesh/health` before reporting — a rollout is not done at 3/3 (NLB
+re-admission lag). A new image must already be pushed as `:latest`. If
+the day's manna has not been written, the new pod hangs at 2/3 until it
+is (Day 4). `scripts/upstream-key-set` stores a caller's model key for
+the gate scenario without echoing it (`~/.config/shorashim/upstream_keys`,
+0600) — run it from a real terminal, not through a non-interactive runner.
+
 ### Standing at the gate — *Bishe'arecha*
 
 A caller can put Shorashim between themselves and a model instead of

scripts/shorashim-rollout

@@ -0,0 +1,8 @@
+#!/bin/bash
+# Roll out the shorashim deployment and wait for 3/3 + two consecutive 200s (memory lesson).
+set -e
+export KUBECONFIG=$HOME/.kube/exoscale-temple-council.yaml
+kubectl -n shorashim rollout restart deployment/shorashim
+kubectl -n shorashim rollout status deployment/shorashim --timeout=300s
+kubectl -n shorashim get pods | grep shorashim-
+for i in 1 2; do sleep 5; curl -s -o /dev/null -w "%{http_code} " http://185.19.28.170/kodesh/health; done; echo

scripts/upstream-key-set

@@ -0,0 +1,8 @@
+#!/bin/bash
+# Store the caller's model key for the gate scenario: asks for it without echo, writes 0600.
+set -e
+read -rsp "Anthropic key (not echoed): " KEY; echo
+[ -n "$KEY" ] || { echo "empty — nothing written"; exit 1; }
+install -m 600 /dev/null ~/.config/shorashim/upstream_keys
+printf 'anthropic %s\n' "$KEY" > ~/.config/shorashim/upstream_keys
+echo "written ~/.config/shorashim/upstream_keys (0600)"