Phase 1-2 build: Steps 5-6, 8-13

Shoresh Engine (Haskell, Step 5)
- 12 modules: Types, Lexicon, Binyanim, Teamim, Gematria, Graph,
  KetivQere, Smikhut, Havdalah, Kriah, KiTov, Firmware
- 33 EUnit tests, 0 failures
- Firmware module verifies L1 SHA-256 hash at startup

Talmudic Engine (SWI-Prolog, Step 6)
- 15 modules: halt, reasoning, specification, interface
- 57 PlUnit tests, 0 failures
- Three cardinal halt conditions: avodah_zarah, shfichut_damim, gilui_arayot

Vav Pipeline (Elixir, Steps 8-11)
- 14 modules: BereishitCycle, Shema, Cloud, Manna, L1Reader,
  Specification, HaltConditions, ShabbatTimer, CycleLog, Chatzotzrot,
  ShoreshEngineClient, TalmudicEngineClient, Application
- 46 ExUnit tests, 0 failures
- Nishma-first architecture: hears before it speaks

Sanhedrin Framework (Erlang/OTP, Step 12)
- 8 modules: sanhedrin_app, sanhedrin_sup, escalation, panel_sup,
  panel, judge, clerk, halt_monitor
- 46 EUnit tests, 0 failures (includes fix: rejected outcome now reachable)
- Panel sizes: 1/3/23/71 — unanimous capital guilty → acquit (Sanhedrin 17a)
- Minority opinions append-only, never deleted

Korban Processor (Python, Step 13)
- 6 modules: korban, shechitah, semichah, zerikah, haktarah, router

Builder tooling: AGENTS.md, opencode.json, memory/, src/tools/

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

memory/infrastructure.md

@@ -0,0 +1,69 @@
+# Infrastructure — Exoscale Swiss Hosting
+
+All infrastructure is on Exoscale, zone ch-gva-2 (Geneva, Switzerland).
+Swiss data sovereignty under FADP. Outside US legal jurisdiction.
+
+## Account
+
+- Provider: Exoscale
+- Organization: "The Recognition Protocol"
+- Account type: Individual
+- CLI: `exo` (installed via homebrew)
+- Zone: ch-gva-2
+
+## Services
+
+### PostgreSQL (DBaaS)
+
+- Name: `temple-council-db`
+- Plan: hobbyist-2
+- Zone: ch-gva-2
+- IP filter: `0.0.0.0/0` (opened for Gitea connection — tighten in production)
+- Databases: `defaultdb` (system), `gitea` (Gitea data)
+- Password retrieved from: `exo dbaas show temple-council-db --zone ch-gva-2`
+
+### Kubernetes (SKS)
+
+- Cluster name: `temple-council`
+- Zone: ch-gva-2
+- Node pool: 1x standard.small
+- Kubeconfig: `~/.kube/exoscale-temple-council.yaml`
+- Namespace: `temple-council`
+- Security group: `default` (attached manually — was missing initially)
+
+### Object Storage
+
+- Bucket: `temple-council-identities`
+- Zone: ch-gva-2
+
+### Gitea (Self-hosted Git)
+
+- URL: `http://185.19.29.94`
+- Exposed via: LoadBalancer service on K8s
+- Admin user: `heaviness510`
+- Database: `gitea` on `temple-council-db` PostgreSQL
+- Storage: emptyDir (NOT persistent — data lost on pod restart)
+- Repositories:
+  - `heaviness510/shorashim` — Torah as AI specification
+
+### AnythingLLM
+
+- URL: `http://185.19.28.73`
+- Exposed via: LoadBalancer service on K8s
+- Storage: emptyDir (NOT persistent)
+- Workspaces: Not yet configured on Exoscale instance
+
+## Known Issues
+
+- No persistent storage on K8s (need Exoscale Block Storage CSI driver)
+- No HTTPS (need Let's Encrypt + domain)
+- No domain registered (using IP addresses; Infomaniak recommended for Swiss registrar)
+- AWS instances still running (not shut down)
+- AnythingLLM workspaces not configured
+
+## Security Group Rules
+
+Ports opened on default security group:
+- 80 (HTTP)
+- 22 (SSH)
+- 30575, 31345 (K8s NodePorts for services)