the name: Bikoret — code, contracts, images

Headers X-Bikoret-Key / -Rebuke / -Verdict / -Bedikah; the `bikoret` object and the "— bikoret …" fringe on a gate reply; environment variables BIKORET_*; the image user and paths (/home/bikoret, /tmp/bikoret, /var/lib/bikoret/manna, /etc/bikoret/secrets, /opt/bikoret/spec); the tmp-bikoret pod volume; local databases bikoret_dev/_test. Kubernetes resource names, the shorashim_app role and the domain are unchanged (Tamid §1.1, "the names that still carry the old word"). Doorpost c963c4fe…. Elixir 604/0, L3 10/0, korban 295, Prolog bedikah 44/44. Gitea repo renamed heaviness510/bikoret (old URL redirects). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-10-13 22:13:36 +00:00
1 parent 017a9b89d4
commit c0d0555aed
@@ -1,4 +1,4 @@
-# Shorashim ConfigMap — non-secret configuration
+# Bikoret ConfigMap — non-secret configuration
 # Construction spec §4.4: Tuning constants
 apiVersion: v1
 kind: ConfigMap
@@ -10,20 +10,20 @@ data:
  L1_MOUNT_POINT: "/mnt/torah"

  # Manna provision file location
-  MANNA_PROVISION_FILE: "/var/lib/shorashim/manna/today.json"
+  MANNA_PROVISION_FILE: "/var/lib/bikoret/manna/today.json"

  # Talmudic Engine socket
-  TALMUDIC_SOCKET_PATH: "/tmp/shorashim/talmudic.sock"
+  TALMUDIC_SOCKET_PATH: "/tmp/bikoret/talmudic.sock"

  # Korban Processor socket — the bedikah (Construction §3.9). Opened by
  # the korban-processor container, read by vav-pipeline, both over the
-  # shared tmp-shorashim volume. Pod-internal; never on the network.
-  KORBAN_SOCKET_PATH: "/tmp/shorashim/korban.sock"
+  # shared tmp-bikoret volume. Pod-internal; never on the network.
+  KORBAN_SOCKET_PATH: "/tmp/bikoret/korban.sock"

  # Courtyard / chatzer keys — a FILE (Construction §4.6), projected from
  # the shorashim-api-keys Secret (secrets.yaml). The path is config; the
  # keys never are.
-  API_KEYS_FILE: "/etc/shorashim/secrets/api_keys"
+  API_KEYS_FILE: "/etc/bikoret/secrets/api_keys"

  # The pod network. The ingress controller lives in it; only from here
  # is X-Real-IP believed as the caller's address (the pe'ah's per-IP
@@ -1,4 +1,4 @@
-# Shorashim Deployment — the mishkan
+# Bikoret Deployment — the mishkan
 #
 # Shemot 40:33 — Vay'khal Mosheh et ham'lakhah.
 #
@@ -41,13 +41,13 @@ spec:
      # --- VOLUMES ---
      #
      # ONE shared /tmp volume, not two. There used to be a separate
-      # `talmudic-socket` volume mounted at /tmp/shorashim in
-      # vav-pipeline and talmudic-engine, WHILE `tmp-shorashim` was
+      # `talmudic-socket` volume mounted at /tmp/bikoret in
+      # vav-pipeline and talmudic-engine, WHILE `tmp-bikoret` was
      # mounted at /tmp in vav-pipeline and korban-processor. Nested
-      # mounts meant /tmp/shorashim resolved to a DIFFERENT volume than
-      # /tmp/shorashim reached through /tmp — so:
+      # mounts meant /tmp/bikoret resolved to a DIFFERENT volume than
+      # /tmp/bikoret reached through /tmp — so:
      #   - korban/azazel (Python) wrote AzazelRecord JSON to
-      #     tmp-shorashim:/shorashim/azazel/pending_l3
+      #     tmp-bikoret:/bikoret/azazel/pending_l3
      #   - AzazelIngest (Elixir) watched
      #     talmudic-socket:/azazel/pending_l3
      # Two directories with the same pathname on two different disks.
@@ -67,9 +67,9 @@ spec:
          persistentVolumeClaim:
            claimName: manna-pvc
        # Shared /tmp for every container that speaks over it:
-        # the Talmudic Unix socket (/tmp/shorashim/talmudic.sock) and
-        # the azazel file bridge (/tmp/shorashim/azazel/pending_l3).
-        - name: tmp-shorashim
+        # the Talmudic Unix socket (/tmp/bikoret/talmudic.sock) and
+        # the azazel file bridge (/tmp/bikoret/azazel/pending_l3).
+        - name: tmp-bikoret
          emptyDir: {}
        # Staging area for the Haskell shoresh-engine binary. Written
        # once by the shoresh-engine-install init container, read by
@@ -85,7 +85,7 @@ spec:
            defaultMode: 0440

      # --- POD SECURITY CONTEXT ---
-      # Every image runs as the non-root user `shorashim` (uid/gid
+      # Every image runs as the non-root user `bikoret` (uid/gid
      # 1000). fsGroup makes the kubelet chgrp the emptyDir volumes to
      # 1000 and set the setgid bit, so uid 1000 can actually WRITE
      # them. Without it the write side of each shared path depends on
@@ -94,7 +94,7 @@ spec:
      #   - shoresh-engine-install: cp ... Permission denied (loud —
      #     init fails, pod never starts; this one at least shouts)
      #   - azazel: the Python side cannot create
-      #     /tmp/shorashim/azazel/pending_l3 and the disposal channel
+      #     /tmp/bikoret/azazel/pending_l3 and the disposal channel
      #     has nowhere to put a record
      #   - talmudic-engine: cannot bind the Unix socket
      securityContext:
@@ -142,7 +142,7 @@ spec:
            - -c
            - |
              set -e
-              cp /home/shorashim/shoresh-engine /opt/shoresh/shoresh-engine
+              cp /home/bikoret/shoresh-engine /opt/shoresh/shoresh-engine
              chmod 0755 /opt/shoresh/shoresh-engine
              /opt/shoresh/shoresh-engine gematria שלום >/dev/null
              echo "shoresh-engine staged and exercised at /opt/shoresh/shoresh-engine"
@@ -223,13 +223,13 @@ spec:
                name: shorashim-secrets
          volumeMounts:
            - name: manna
-              mountPath: /var/lib/shorashim/manna
+              mountPath: /var/lib/bikoret/manna
            # One /tmp. The Talmudic socket and the azazel pending_l3
            # directory both live under it.
-            - name: tmp-shorashim
+            - name: tmp-bikoret
              mountPath: /tmp
            - name: api-keys
-              mountPath: /etc/shorashim/secrets
+              mountPath: /etc/bikoret/secrets
              readOnly: true
            - name: shoresh-bin
              mountPath: /opt/shoresh
@@ -279,10 +279,10 @@ spec:
          image: exo.container-registry.com/the-recognition-protocol/talmudic-engine:latest
          volumeMounts:
            # Shares vav-pipeline's /tmp so the Unix socket at
-            # /tmp/shorashim/talmudic.sock is the same file on both
-            # sides. Mounted at /tmp (not /tmp/shorashim) so this is
+            # /tmp/bikoret/talmudic.sock is the same file on both
+            # sides. Mounted at /tmp (not /tmp/bikoret) so this is
            # the same volume korban-processor writes azazel records to.
-            - name: tmp-shorashim
+            - name: tmp-bikoret
              mountPath: /tmp
          resources:
            requests:
@@ -295,10 +295,10 @@ spec:
        # === KORBAN PROCESSOR (sidecar) ===
        # Korban_processor imports azazel_processor (the disposal
        # channel) in the same Python process. The Python side writes
-        # AzazelRecord JSON files to /tmp/shorashim/azazel/pending_l3/;
+        # AzazelRecord JSON files to /tmp/bikoret/azazel/pending_l3/;
        # vav-pipeline's AzazelIngest GenServer watches that directory
        # and ingests into L3. Both containers must mount the shared
-        # tmp-shorashim volume for the file bridge to work.
+        # tmp-bikoret volume for the file bridge to work.
        # Since 2026-10-05 it also listens on KORBAN_SOCKET_PATH (shared
        # /tmp) for the bedikah — vav-pipeline is the only caller.
        - name: korban-processor
@@ -307,7 +307,7 @@ spec:
            - configMapRef:
                name: shorashim-config
          volumeMounts:
-            - name: tmp-shorashim
+            - name: tmp-bikoret
              mountPath: /tmp
          resources:
            requests:
@@ -1,7 +1,7 @@
 # Gitea behind the shared ingress — TCP passthrough
 #
 # One NLB for the cluster (185.19.28.170, the ingress-nginx Service)
-# instead of one per Service. Shorashim is an HTTP Ingress
+# instead of one per Service. Bikoret is an HTTP Ingress
 # (service.yaml). Gitea has no hostname that resolves
 # (gitea.temple-council.ch is configured in Gitea and exists nowhere),
 # and host-based routing needs a name — so Gitea rides the ingress
@@ -1,4 +1,4 @@
-# Shorashim Secrets — template only
+# Bikoret Secrets — template only
 # NEVER commit actual secret values to git.
 # Apply with: kubectl apply -f - after filling in values.
 #
@@ -52,7 +52,7 @@ stringData:
 #   import base64, json, subprocess, sys, urllib.parse
 #   avn = json.load(sys.stdin)["password"]
 #   app = subprocess.run(
-#       ["kubectl", "get", "secret", "shorashim-secrets", "-n", "shorashim",
+#       ["kubectl", "get", "secret", "shorashim-secrets", "-n", "bikoret",
 #        "-o", "jsonpath={.data.DATABASE_URL}"],
 #       capture_output=True, text=True, check=True).stdout
 #   u = urllib.parse.urlsplit(base64.b64decode(app).decode())
@@ -94,7 +94,7 @@ stringData:
 # shorashim-api-keys — who may enter the courtyard
 # ============================================================
 #
-# Mounted as the file /etc/shorashim/secrets/api_keys in vav-pipeline
+# Mounted as the file /etc/bikoret/secrets/api_keys in vav-pipeline
 # (Construction §4.6: a secret is a file). One key per line:
 #
 #   courtyard <key>     offerings and bedikot (/courtyard/*)
@@ -1,4 +1,4 @@
-# Shorashim Services
+# Bikoret Services
 # Operations spec §1.1: Four access tiers
 #   - Pe'ah (public, no auth)
 #   - Machaneh Leviyah (authenticated)
@@ -28,7 +28,7 @@ spec:
 # The gate to the world — through the shared ingress
 # ============================================================
 #
-# Until 2026-10-06 Shorashim had its own LoadBalancer Service
+# Until 2026-10-06 Bikoret had its own LoadBalancer Service
 # (`shorashim-external`, NLB 185.19.29.180, NodePort 30923). It is gone:
 # one NLB per Service was a third of the account's bill, and the pod saw
 # every caller as the node (kube-proxy SNAT) so the pe'ah's per-IP watch