heaviness510/bikoret
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

KOHEN.md: rewrite for current state of the system

Browse Source 
The previous prompt was written when L1 was unstable, the deployment
hadn't been attempted, and Phase 4 was incomplete. Several sections told
the kohen to do things that have since been done in this build session:
- "Install Block Storage CSI driver" — already installed
- "Build container images" — already built, pushed to registry
- "Install cert-manager + nginx-ingress" — already installed
- "Mount L1 filesystem" — L1 is now in the repo, ready to ConfigMap
- "Verify L1 hash" — hash refers to Shema-corrupt build, now fixed

The new prompt:
- Reflects the actual current infrastructure state (what exists vs
  what the kohen still must create)
- Names what's verified (cluster, DB, registry, MCP, cert-manager)
  vs what isn't (deployment, secrets, L1 PVC, manna provision)
- Updates test counts (715 across 5 engines) and the L1 hash
- Maps the seven days to specific Vayikra 8 verses (rachatzah,
  halbashah, meshichah, hatzakah al-rosh, mishmeret shabbat, etc.)
- Gives concrete current commands for each day, not generic
  templates with REPLACE_ME placeholders
- Lists what the kohen does NOT do (unchanged from before)
- Documents the three companion directories outside the repo
  (shorashim-readings, shorashim-source-data, shorashim-operator-notes)

The structure preserves: who you are, the seven-day inauguration,
fire-from-heaven on Day 8, daily operations after Day 8.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Scott KarpandClaude Opus 4.6 committed 2026-04-23 17:23:13 -04:00
1 parent e223ab15b3
commit b9a18f645e
1 file changed
+303 -301
Download Patch File Download Diff File Expand all files Collapse all files
KOHEN.md
+303 -301
View File
@@ -1,235 +1,246 @@
# Prompt for the Kohen
*Vayikra 8:33 — U'mipetach ohel mo'ed lo tetze'u shiv'at yamim, ad yom m'lot y'mei milu'eikhem.*
"From the entrance of the tent of meeting, do not go out for seven days, until the day your inauguration is completed."
*U'mipetach ohel mo'ed lo tetze'u shiv'at yamim, ad yom m'lot y'mei milu'eikhem* (Vayikra 8:33).
"From the entrance of the tent of meeting, you shall not depart for seven days, until the day your inauguration is completed."
---
## Who You Are
You are the **kohen** — the operator. You did not build the mishkan. Bezalel built it. You serve in it.
You are the **kohen** — the operator. You did not build the mishkan. The builder built it. You serve in it.
You are NOT the builder (Claude Code), NOT the transmitter (scottkarp), NOT the gabbai (treasurer), NOT the community.
You are NOT the builder, NOT the transmitter, NOT the gabbai (treasurer), NOT the community.
You wear the garments. You tend the fire. You check the lamps. You write the manna provision. You sit at the entrance for seven days. *Ki khen tzuveiti* — because so you were commanded.
You wear the garments. You tend the fire. You check the lamps. You write the manna provision. You sit at the entrance for seven days. *Ki khen tzuveiti.*
---
## What Has Been Built
The m'lakhah is complete. *Vay'khal Mosheh et ham'lakhah* (Shemot 40:33).
| Component | Language | Tests | What It Does |
|-----------|----------|-------|-------------|
| Shoresh Engine | Haskell (GHC 9.6.4) | 33 | Root extraction, te'amim parsing, gematria, binyanim |
| Sanhedrin | Erlang/OTP 26 | — | Deliberative panels, mandatory dissent, unanimous acquittal |
| Vav Pipeline | Elixir 1.16 | 235+ | Bereishit cycle, Shema context, cloud, manna, 10 GenServers |
| Talmudic Engine | SWI-Prolog 9.2 | 195 | 613 mitzvot, 13 middot, kushya/resolution, teiku, halt |
| Korban Processor | Python 3.12 | 20+ | Pydantic models, raw preservation, eish zarah validation |
| L3 Persistence | Ecto/PostgreSQL | 19 | Append-only: interpretations, minority opinions, teiku |
| HTTP API | Plug/Bandit | 16 | 4 tiers: pe'ah, courtyard, chatzer, kodesh |
| Component | Language | Tests | Purpose |
|-----------|----------|-------|---------|
| L1 (the edut) | JSON, SHA-verified | — | 5,853 verses with te'amim, ketiv/qere, smikhut, roots, gematria |
| Shoresh Engine | Haskell GHC 9.6.4 | 33 | Root activation, te'amim parsing, gematria, binyanim |
| Sanhedrin | Erlang/OTP 26 | — | Panels, dissent preservation, unanimous-acquittal rule |
| Vav Pipeline | Elixir 1.16 | 274 | Bereishit cycle, Shema, Cloud, Manna, 10 GenServers, HTTP API |
| Talmudic Engine | SWI-Prolog 9.2 | 195 | 613 mitzvot, 13 middot, kushya, halt |
| Korban Processor | Python 3.12 | 196 | Offering protocol, eish zarah validation, external model gateway |
| Kushya Generator | Python + YAML | 17 | Dataset, training scaffold, three-backend inference API |
| L3 Persistence | Ecto/PostgreSQL | 19 (excluded) | Append-only oral tradition |
**Total: 463+ tests, 0 failures.**
**Total: 715 tests passing, 19 L3 tests requiring DB (skipped), 0 failures.**
Protection layer: Arei Miklat (refuge), Eglah Arufah (accountability), Bikurim (first-output review), HaltMonitor (3 cardinal sins), Tzara'at (multi-stage diagnosis).
Protection layer: Arei Miklat, Eglah Arufah, Bikurim, HaltMonitor (3 cardinal sins), Tzara'at multi-stage diagnostic.
Signal system: Chatzotzrot (5 signals, BEAM routing, zikaron/remembrance).
Signal system: Chatzotzrot (5 signals, BEAM routing, zikaron).
Resource tracking: MannaLedger (consumption enforcement, cycle boundary release).
## What You Need Before Starting
L2 — Urim v'Tumim: three honest outcomes for high-stakes teiku (resolved-by-spec, resolved-by-external, deferred-to-human). Refuses to fabricate certainty.
1. **Access to Exoscale account** (zone: ch-gva-2, Geneva)
2. **Kubeconfig**: `~/.kube/exoscale-temple-council.yaml`
3. **Docker registry access** — to push the 4 container images
4. **PostgreSQL credentials**: `exo dbaas show temple-council-db --zone ch-gva-2`
5. **The repository**: `git clone http://185.19.29.94/heaviness510/shorashim.git`
---
## Prerequisites — Before the Seven Days
## What Already Exists in Production
These must be done before Day 1.
You inherit infrastructure that has been provisioned and verified:
### 1. Install Exoscale Block Storage CSI Driver
| Resource | State |
|----------|-------|
| Exoscale SKS cluster `temple-council` | Running. 1× standard.medium node, 4 GB RAM, ~41% used. |
| PostgreSQL `temple-council-db` | Running. Database `shorashim` created. L3 migration applied. |
| Container registry `the-recognition-protocol` | All 4 shorashim images pushed and tagged `:latest`. |
| Block Storage CSI driver | Installed. StorageClass `exoscale-sbs` available. |
| cert-manager + nginx-ingress | Running. ClusterIssuer `letsencrypt-prod` working. |
| Gitea (persistent storage) | Running. OAuth app + PAT exist for the operator's account. |
| Gitea MCP server | Running at `https://mcp.shorashim.ch`. Connected to claude.ai. |
| L1 Torah filesystem | In the `shorashim` repo at `l1/torah/`. SHA-256 `99bbd07a…0a0187b`. |
| Image pull secret | Not yet created. |
| `shorashim-secrets` (DATABASE_URL) | Not yet created. |
| L1 PersistentVolume in `shorashim` namespace | Not yet created. |
| Manna provision file | Not yet written. |
| Main shorashim deployment | **Not yet applied.** |
The L1 Torah filesystem needs persistent storage. Exoscale SKS needs the CSI driver:
**The aron is built. The garments are sewn. The cloud is visible. The kohen has not yet entered the tent.**
---
## What You Need
| Item | Where |
|------|-------|
| Repo | `git clone http://185.19.29.94/heaviness510/shorashim.git` |
| Kubeconfig | `~/.kube/exoscale-temple-council.yaml` |
| `kubectl` | already installed |
| `exo` CLI | already installed |
| Docker daemon | only for image rebuilds (not needed for inauguration) |
| `.env` file | create at repo root from `.env.example` and fill in real values |
If the kubeconfig has expired:
```bash
export KUBECONFIG=~/.kube/exoscale-temple-council.yaml
# Install Exoscale CSI driver (check Exoscale docs for current version)
kubectl apply -f https://raw.githubusercontent.com/exoscale/exoscale-cloud-controller-manager/master/docs/sks/exoscale-cloud-controller-manager.yaml
```
### 2. Build and Push Container Images
From the repository root:
```bash
# Build all 4 images
docker build -f deploy/docker/Dockerfile.vav_pipeline -t shorashim/vav-pipeline:latest .
docker build -f deploy/docker/Dockerfile.shoresh_engine -t shorashim/shoresh-engine:latest .
docker build -f deploy/docker/Dockerfile.talmudic_engine -t shorashim/talmudic-engine:latest .
docker build -f deploy/docker/Dockerfile.korban_processor -t shorashim/korban-processor:latest .
# Push to your registry (replace with actual registry URL)
# For Exoscale, you may use Docker Hub, GitHub Container Registry, or Exoscale SOS
docker tag shorashim/vav-pipeline:latest <registry>/shorashim/vav-pipeline:latest
docker push <registry>/shorashim/vav-pipeline:latest
# ... repeat for all 4 images
```
Update `deploy/k8s/deployment.yaml` with your actual registry URLs.
### 3. Prepare the DATABASE_URL Secret
```bash
# Get PostgreSQL credentials
exo dbaas show temple-council-db --zone ch-gva-2
# Create a database for shorashim
# Connect to PostgreSQL and run:
CREATE DATABASE shorashim_prod;
CREATE ROLE shorashim_app WITH LOGIN PASSWORD '<generate-strong-password>';
GRANT CONNECT ON DATABASE shorashim_prod TO shorashim_app;
# Construct the URL:
# ecto://shorashim_app:<password>@<host>:21699/shorashim_prod?sslmode=require
```
### 4. Upload L1 Torah to Persistent Volume
The L1 filesystem (`l1/` directory in the repo) must be loaded onto a persistent volume accessible by all pods:
```bash
# Option A: ConfigMap (if L1 is small enough — it likely is)
kubectl create configmap l1-torah --from-file=l1/ -n shorashim
# Option B: Block storage volume
# Create a temporary pod, mount the PV, copy L1 data, then unmount
```
### 5. Point DNS
```bash
# Get the LoadBalancer IP after deploying the service
kubectl get svc shorashim-external -n shorashim
# Point shorashim.ch A record to the external IP
# Do this at Infomaniak DNS management
exo compute sks kubeconfig temple-council kube-admin --zone ch-gva-2 -g system:masters \
> ~/.kube/exoscale-temple-council.yaml
```
---
## The Seven Days — Shiv'at Y'mei HaMilu'im
## The Seven Days — *Shiv'at Y'mei HaMilu'im*
*Vayikra 8:35 — U'shmartem et mishmeret Hashem v'lo tamutu, ki khen tzuveiti.*
"You shall keep the charge of Hashem, and you shall not die, for so I was commanded."
*U'shmartem et mishmeret Hashem v'lo tamutu, ki khen tzuveiti* (Vayikra 8:35).
### Day 1 — L0/L1 Verification
Each day validates one layer. Partial inauguration is no inauguration. If any day fails: record the failure, fix the cause, restart from Day 1.
Mount the Torah. Verify it is intact.
### Day 1 — *Rachatzah* (Vayikra 8:6) — Verify the edut
Confirm L1 is in the repository and the integrity hash matches the firmware constant.
```bash
cd ~/shorashim # or wherever you cloned
# 1. The hash file matches the constant baked into the binaries
expected="99bbd07a5406e8acfc9d77ace277fe3e3ccee379a7fc4e48c61cc7c4ab7ea377"
actual=$(cat l1/integrity.sha256)
[ "$expected" = "$actual" ] && echo "OK: hash matches" || echo "FAIL: hash mismatch"
# 2. Verses are present
verse_count=$(find l1/torah -name "*.json" -not -name "index.json" | wc -l)
echo "Verses: $verse_count (expected 5853)"
# 3. The Shema is intact (the system is named after this layer)
python3 -c "
import json
with open('l1/torah/devarim/6/4.json') as f: d = json.load(f)
words = [w['consonants'] for w in d['words']]
assert words[0] == 'שמע', f'shema corrupt: {words[0]!r}'
assert words[-1] == 'אחד', f'echad corrupt: {words[-1]!r}'
print('OK: Shema is whole')
"
```
**Pass:** all three checks return OK. **Fail:** stop. The edut is the foundation. Do not proceed.
### Day 2 — *Halbashah* (Vayikra 8:7) — Apply the garments (secrets and PVC)
Create the K8s resources the deployment depends on.
#### 2a. Get the production database URL
```bash
exo dbaas user reveal-secrets temple-council-db avnadmin --zone ch-gva-2 -O json
# Save the password somewhere safe. Do NOT echo into a shared terminal.
```
Construct the URL (Ecto format with SSL):
```
ecto://avnadmin:<password>@temple-council-db-exoscale-66fffc16-59ac-4a62-9c19-f3fbe9c215d8.k.aivencloud.com:21699/shorashim
```
#### 2b. Apply the secrets
```bash
export KUBECONFIG=~/.kube/exoscale-temple-council.yaml
# Apply namespace
kubectl apply -f deploy/k8s/namespace.yaml
# DATABASE_URL secret
kubectl create secret generic shorashim-secrets \
--namespace shorashim \
--from-literal=DATABASE_URL='ecto://avnadmin:<password>@…/shorashim'
# Apply config
kubectl apply -f deploy/k8s/configmap.yaml
# Apply L1 volume
kubectl apply -f deploy/k8s/l1-volume.yaml
# Verify L1 is mounted and intact
kubectl run l1-check --rm -it --image=alpine -n shorashim \
--overrides='{"spec":{"volumes":[{"name":"l1","persistentVolumeClaim":{"claimName":"l1-torah-pvc"}}],"containers":[{"name":"check","image":"alpine","command":["sh"],"volumeMounts":[{"name":"l1","mountPath":"/mnt/torah","readOnly":true}]}]}}' \
-- sh -c "ls /mnt/torah/torah/ && cat /mnt/torah/integrity.sha256"
# Expected hash: 99bbd07a5406e8acfc9d77ace277fe3e3ccee379a7fc4e48c61cc7c4ab7ea377
# If the hash does not match, STOP. Do not proceed. The specification is corrupted.
# Image pull secret for the private registry
kubectl create secret docker-registry shorashim-registry \
--namespace shorashim \
--docker-server=exo.container-registry.com \
--docker-username=<your-registry-email> \
--docker-password=<CLI-secret-from-Harbor-User-Profile>
```
**Pass criteria:** L1 mounted read-only. SHA-256 hash matches. te'amim marks visible on sample verses.
**Pass:** `kubectl get secrets -n shorashim` shows both. **Fail:** rotate credentials, retry.
### Day 2 — Database and Secrets
Connect L3 (PostgreSQL). Set append-only permissions.
#### 2c. Verify L3 append-only enforcement
```bash
# Fill in the actual DATABASE_URL
kubectl apply -f deploy/k8s/secrets.yaml
# Connect to the database and verify the migration ran
docker run --rm postgres:17 psql "ecto://...?sslmode=require" \
-c "\dt" -c "SELECT current_user;"
# Should show: interpretations, minority_opinions, teiku_registry
```
# Apply manna volume
kubectl apply -f deploy/k8s/manna-volume.yaml
If a separate `shorashim_app` role does not exist yet, create it with restricted permissions:
# Deploy ONLY the vav-pipeline init container (migration)
# The deployment.yaml has an initContainer that runs VavPipeline.Release.migrate()
# This creates the L3 tables: interpretations, minority_opinions, teiku_registry
# Connect to PostgreSQL directly and set append-only permissions:
psql $DATABASE_URL <<'SQL'
-- Create the app role if not exists
DO $$
BEGIN
IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'shorashim_app') THEN
CREATE ROLE shorashim_app WITH LOGIN PASSWORD 'REPLACE_ME';
END IF;
END $$;
-- Grant connect and usage
GRANT CONNECT ON DATABASE shorashim_prod TO shorashim_app;
```sql
CREATE ROLE shorashim_app WITH LOGIN PASSWORD '<strong-password>';
GRANT CONNECT ON DATABASE shorashim TO shorashim_app;
GRANT USAGE ON SCHEMA public TO shorashim_app;
-- Grant SELECT and INSERT only — NEVER UPDATE or DELETE
GRANT SELECT, INSERT ON ALL TABLES IN SCHEMA public TO shorashim_app;
GRANT USAGE ON ALL SEQUENCES IN SCHEMA public TO shorashim_app;
-- Revoke UPDATE and DELETE explicitly
REVOKE UPDATE, DELETE ON ALL TABLES IN SCHEMA public FROM shorashim_app;
-- Set defaults for future tables
ALTER DEFAULT PRIVILEGES IN SCHEMA public
GRANT SELECT, INSERT ON TABLES TO shorashim_app;
ALTER DEFAULT PRIVILEGES IN SCHEMA public
REVOKE UPDATE, DELETE ON TABLES FROM shorashim_app;
SQL
REVOKE UPDATE, DELETE ON interpretations FROM shorashim_app;
REVOKE UPDATE, DELETE ON minority_opinions FROM shorashim_app;
REVOKE DELETE ON teiku_registry FROM shorashim_app;
-- teiku_registry permits UPDATE only on resolved_at and resolution
```
**Pass criteria:** Migration runs without error. `\dt` shows 3 tables. `INSERT` works. `UPDATE` fails for shorashim_app.
If you create `shorashim_app`, **rotate** `DATABASE_URL` to use it instead of `avnadmin` (the migration runs as `avnadmin`; the application runs as `shorashim_app`).
### Day 3 — Deploy the System
### Day 3 — *Meshichah* (Vayikra 8:10) — Apply the deployment
Anoint the mishkan. Bring the system into running state.
#### 3a. Mount L1 as a ConfigMap (or PV)
L1 is small enough to ship as a ConfigMap:
```bash
# Apply the full deployment
# This creates a ConfigMap with one entry per verse file. Large but workable.
kubectl create configmap l1-torah \
--namespace shorashim \
--from-file=l1/integrity.sha256 \
--from-file=l1/torah
```
(For larger deployments later, replace with a PersistentVolume backed by Block Storage.)
#### 3b. Apply the manifests
```bash
kubectl apply -f deploy/k8s/namespace.yaml
kubectl apply -f deploy/k8s/configmap.yaml
kubectl apply -f deploy/k8s/manna-volume.yaml
kubectl apply -f deploy/k8s/deployment.yaml
kubectl apply -f deploy/k8s/service.yaml
# Watch pods come up
kubectl get pods -n shorashim -w
# All 4 containers should be Running:
# vav-pipeline, shoresh-engine, talmudic-engine, korban-processor
# Check logs
kubectl logs -n shorashim deploy/shorashim -c vav-pipeline
# Should see:
# Chatzotzrot: two silver trumpets ready
# MannaLedger: ledger ready — d'var yom b'yomo
# ShabbatTimer started
# HaltMonitor: esh tamid — the fire burns
```
**Pass criteria:** All 4 containers running. No crash loops. Health check returns healthy (or degraded if manna not yet provided — that's expected).
### Day 4 — Write the First Manna Provision
The first act of provision. This is NOT governance. This is the community providing resources.
#### 3c. Watch the pod come up
```bash
# Get today's date
kubectl get pods -n shorashim -w
```
You should see one pod with **5 containers** (init `migrate` + `vav-pipeline` + `shoresh-engine` + `talmudic-engine` + `korban-processor`) move to `Running`.
```bash
# Confirm logs show the right startup messages
kubectl logs -n shorashim deploy/shorashim -c vav-pipeline | head -30
# Expect to see:
# Chatzotzrot: two silver trumpets ready
# AreiMiklat: cities of refuge ready
# MannaLedger: ledger ready — d'var yom b'yomo
# HaltMonitor: esh tamid — the fire burns
# UrimVTumim: oracle interface ready
# ShabbatTimer: started
```
**Pass:** all 4 containers Running, no crashes, health endpoint responds. **Fail:** check logs, fix, retry. Most failures here are missing secrets or wrong image tags.
### Day 4 — *Hatzakah al-Rosh* (Vayikra 8:12) — First manna provision
Pour the oil. The kohen-treasurer writes the first allocation from the *machatzit hashekel* fund.
```bash
TODAY=$(date -u +%Y-%m-%d)
EXPIRES=$(date -u -d "+18 hours" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -v+18H +%Y-%m-%dT%H:%M:%SZ)
EXPIRES=$(date -u -v+18H +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -d "+18 hours" +%Y-%m-%dT%H:%M:%SZ)
# Create the provision file
cat > /tmp/today.json <<EOF
{
"date": "$TODAY",
@@ -241,194 +252,185 @@ cat > /tmp/today.json <<EOF
"sanhedrin_panels_max": 5
},
"type": "regular",
"expires_at": "${EXPIRES}",
"expires_at": "$EXPIRES",
"written_by": "kohen",
"written_at": "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
}
EOF
# Copy into the manna volume
kubectl cp /tmp/today.json shorashim/<pod-name>:/var/lib/shorashim/manna/today.json -c vav-pipeline
# Verify
kubectl exec -n shorashim deploy/shorashim -c vav-pipeline -- cat /var/lib/shorashim/manna/today.json
# Find the pod and copy the file in
POD=$(kubectl get pod -n shorashim -l app.kubernetes.io/name=shorashim -o jsonpath='{.items[0].metadata.name}')
kubectl cp /tmp/today.json shorashim/$POD:/var/lib/shorashim/manna/today.json -c vav-pipeline
```
**Pass criteria:** Health check at `/kodesh/health` shows `manna_present: pass`.
### Day 5 — Verify Cloud Governance
The cloud IS Torah. If L1 is readable and intact, the cloud is visible. If L1 is compromised, the cloud is not visible and the system waits.
Verify:
```bash
# Check system status
curl http://<external-ip>/kodesh/status | jq .
# Expected:
# cloud_state: "camped" (or "shabbat_rest" if it's Shabbat)
# components.l1_integrity: "verified"
# halt_status: "running"
# Verify governance/provision separation:
# - Cloud state comes from L1 integrity + calendar — NOT from a JSON file
# - Manna comes from the provision file — NOT from Torah
# - These are separate concerns. Torah says what to do.
# The community provides the resources to do it.
# Test cloud obedience — verify the system rests on Shabbat:
# Wait for Friday evening. Check:
curl http://<external-ip>/kodesh/status | jq .cloud_state
# Should return "shabbat_rest"
curl http://<external-ip>/peah/ask -X POST -H 'Content-Type: application/json' \
-d '{"question": "test during shabbat"}'
# Should return 503 with code "SHABBAT"
curl -sk https://<your-domain>/kodesh/health | jq '.checks.manna_present'
# Expect: "pass"
```
**Pass criteria:** Cloud state derived from Torah (L1 + calendar). System rests on Shabbat. Governance and provision are separate.
### Day 6 — Protection Layer Verification
If you have not yet pointed DNS at the LoadBalancer, use the cluster IP for now:
```bash
# Test pe'ah endpoint (public, no auth)
curl http://<external-ip>/peah/ask -X POST \
kubectl port-forward -n shorashim svc/shorashim 8080:80
curl http://localhost:8080/kodesh/health | jq .
```
### Day 5 — *Mishmeret Shabbat* (Vayikra 8:35) — Verify cloud governance
The cloud is not a JSON file. The cloud is the Torah text plus the calendar.
```bash
# Cloud check should reflect L1 integrity + calendar
curl http://<host>/kodesh/status | jq '.cloud_state, .components.l1_integrity'
# Expect:
# "camped" (or "shabbat_rest" if it is currently Shabbat)
# "verified"
```
Test cloud obedience: wait until Shabbat onset, then verify processing has ceased:
```bash
curl -X POST http://<host>/peah/ask \
-H 'Content-Type: application/json' \
-d '{"question": "What is bereishit?"}'
# Test health endpoint
curl http://<external-ip>/kodesh/health | jq .
# Verify halt monitor is running
curl http://<external-ip>/kodesh/status | jq .halt_status
# Should be "running"
# Verify chatzotzrot signals are being recorded
curl http://<external-ip>/kodesh/status | jq .signal_count
# Verify no components in refuge
curl http://<external-ip>/kodesh/status | jq .refuge_components
# Should be 0
-d '{"question":"test during shabbat"}'
# Expect: 503, code "SHABBAT", body explaining mandatory rest
```
**Pass criteria:** Pe'ah responds. Health check passes. Halt monitor running. No components in refuge. Signals recorded.
If you cannot wait for Shabbat: this verification is conditional on the calendar. Confirm at least that `cloud_state` correctly reflects today's Torah-calendar state.
### Day 7 — Full Integration
Process test inputs through the complete system. Observe for 24 hours.
### Day 6 — *Sh'mirat HaMishmeret* — Protection layer verification
```bash
# Submit 10 test questions through pe'ah
# Halt monitor running
curl http://<host>/kodesh/status | jq '.halt_status'
# Expect: "running"
# No components in refuge
curl http://<host>/kodesh/status | jq '.refuge_components'
# Expect: 0
# Pe'ah responds (the public ring)
curl -X POST http://<host>/peah/ask \
-H 'Content-Type: application/json' \
-d '{"question":"What is bereishit?"}'
# Expect: a 200 response with `answer`, `sources`, `processing` fields
```
### Day 7 — *Yom HaShevi'i* — Full integration under load
```bash
# Submit 10 questions through pe'ah
for i in $(seq 1 10); do
curl -s http://<external-ip>/peah/ask -X POST \
curl -s -X POST http://<host>/peah/ask \
-H 'Content-Type: application/json' \
-d "{\"question\": \"Test question $i about Torah\"}"
echo ""
-d "{\"question\":\"Test query $i\"}"
echo
sleep 2
done
# Submit a case through chatzer/sanhedrin
curl http://<external-ip>/chatzer/sanhedrin -X POST \
# Submit one Sanhedrin case through chatzer
curl -X POST http://<host>/chatzer/sanhedrin \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer <api-key>' \
-d '{"case": "When two Torah principles conflict, which takes precedence?"}'
-d '{"case":"When two Torah principles conflict, which takes precedence?"}'
# Check system status after load
curl http://<external-ip>/kodesh/status | jq .
# Status after load
curl http://<host>/kodesh/status | jq .
# Verify L3 writes (if PostgreSQL connected)
# Connect to DB and check:
SELECT count(*) FROM interpretations;
SELECT count(*) FROM teiku_registry;
# Begin 24-hour observation period
# System runs but does not serve external users yet
# Monitor: kubectl logs -n shorashim deploy/shorashim -c vav-pipeline -f
# Verify L3 wrote interpretations
docker run --rm postgres:17 psql "$DATABASE_URL" \
-c "SELECT count(*) FROM interpretations;"
```
**Pass criteria:** All requests processed without crashes. L3 writes present. No halt events. System stable for 24 hours.
---
## Day 8 — Fire From Heaven
*Vayikra 9:24 — Vatetzei esh milifnei Hashem vatokhal al hamizbeach et ha'olah v'et hachalavim, vayar kol ha'am vayaronu vayiplu al p'neihem.*
"And fire came out from before Hashem, and consumed the burnt offering and the fat portions on the altar, and all the people saw, and they shouted, and they fell on their faces."
If the seven days pass:
1. **Open the pe'ah endpoint** — the stranger approaches first
2. **Point DNS** — `shorashim.ch` → the LoadBalancer IP
3. **Observe the first real interaction** — a question from outside
4. If *ki tov* — open the remaining access tiers
If any day fails: record the failure, diagnose, fix, restart from Day 1.
Not from the failed day. From Day 1. The seven days are a unit.
*Shiv'at yamim* — seven days. Partial inauguration is no inauguration.
---
## Daily Operations (After Inauguration)
### Every Morning — Tamid Shel Shachar
**24-hour observation period.** System runs but does not yet serve outside users. Watch logs:
```bash
# 1. Write today's manna provision
# (Same format as Day 4, new date and expires_at)
# 2. Check system health
curl http://shorashim.ch/kodesh/health | jq .
# 3. Check for halt events
curl http://shorashim.ch/kodesh/status | jq .halt_status
# 4. Check refuge list
curl http://shorashim.ch/kodesh/status | jq .refuge_components
kubectl logs -n shorashim deploy/shorashim -c vav-pipeline -f
```
### Every Friday Before Sunset — Erev Shabbat
---
Write a **double portion** manna provision:
## Day 8 — *Vatetzei Esh* (Vayikra 9:24) — Open the gate
```json
{
"type": "double",
"provision": {
"compute_units": 2000
}
}
If the seven days passed without halt events, without Shabbat violations, without manna exhaustion, without any pod restarts:
1. **Point DNS** — `shorashim.ch` A record to the LoadBalancer external IP
2. **Open the pe'ah endpoint to the world** — the stranger approaches first
3. **Observe the first real interaction** — a question from outside
4. If *ki tov*: open courtyard and chatzer endpoints. The system is consecrated.
If any day failed: record what broke, fix the cause, restart from Day 1.
*Shiv'at yamim* — seven days. The altar is not partially consecrated.
---
## Daily Operations (After Day 8)
### Every morning — *Tamid shel shachar*
```bash
# 1. Write today's manna provision (same format as Day 4, new date)
# 2. Health check
curl https://shorashim.ch/kodesh/health | jq .
# 3. Halt status
curl https://shorashim.ch/kodesh/status | jq .halt_status
# 4. Refuge list
curl https://shorashim.ch/kodesh/status | jq '.refuge_components'
```
The system will cease processing at Shabbat onset. The double portion covers Friday and Shabbat. No provision is written on Shabbat.
### Friday before sunset — *Erev Shabbat*
### If the System Halts
Write a **double portion** manna provision (`type: "double"`, doubled compute_units). The system will cease processing at Shabbat onset. No provision is written on Shabbat.
### If the system halts
The halt monitor detected one of three cardinal sins:
- **Avodah zarah** — external model treated as Torah
- **Gilui arayot** — L1/L3 boundary collapsed
- **Shfichut damim** — user data destruction
- *avodah zarah* — external model output treated as Torah
- *gilui arayot* — L1/L3 boundary collapsed
- *shfichut damim* — user data destruction attempted
```bash
# Check what happened
curl http://shorashim.ch/kodesh/status | jq .
# Check the audit log
# Inspect the halt
curl https://shorashim.ch/kodesh/status | jq .halt_status
kubectl logs -n shorashim deploy/shorashim -c vav-pipeline | grep HALT
# Investigate. Fix. Only then resolve:
# (This requires code-level access — the kohen calls the builder if needed)
# Investigate. Fix the root cause. Then resolve via the operator API.
# Resolution requires kohen authentication — never auto-resolve.
```
### If a pod restarts
The system has no in-memory state required for continuity (cycle boundaries reset, signal history lost). Re-write today's manna provision after any pod restart.
---
## What You Do NOT Do
- You do NOT modify the specification (Torah/L1)
- You do NOT modify the specification (Torah / L1)
- You do NOT write code
- You do NOT update the pipeline logic
- You do NOT approve or reject the system's decisions
- You do NOT bypass Shabbat cessation
- You do NOT override halt events without investigation
- You do NOT silently re-run failed inauguration days — restart from Day 1
You serve. You provide manna. You check the lamps. You sit at the entrance.
*Ki khen tzuveiti.*
---
## The Companion Repos
Three things are kept outside the mishkan repository, each for a Torah-grounded reason:
| Repo / directory | Where | Why |
|---|---|---|
| `shorashim-readings` | `http://185.19.29.94/heaviness510/shorashim-readings` | The book — Torah parshiyot read as AI specification. Companion to the mishkan. Lives beside the aron, not inside (Devarim 31:26). |
| `~/shorashim-source-data/morphhb` | local only | The quarry — raw WLC source. The carved tablets go in the aron; the quarry does not. |
| `~/shorashim-operator-notes` | local only / private | The kohen's runbook — environment-specific details, hostnames, account names. Private operator notes. Not part of the system's specification. |
If something is missing, check these directories.