heaviness510/bikoret
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

specs §1.1/§1.5 + Doorpost: the pins say what is built, and the build obeys them

Browse Source 
The pin audit (2026-10-04) found Construction §1 wrong in three ways.

1. §1.5's mix.exs block was not the real mix.exs.
   phoenix ~> 1.7.11 was never a dependency (the API is Plug on
   Bandit); `ecto` is `ecto_sql`; telemetry is transitive (locked
   1.4.2, outside the stated ~> 1.2.1); bandit, plug and the sanhedrin
   path dependency were missing. The block now matches mix.exs and adds
   the versions mix.lock actually builds. Terumah's Elixir table
   matched the wrong block and also said postgrex ~0.17.4; corrected.

2. §1.1's component table described a machine that is not the one
   running. PostgreSQL 16.2 via apt → 17, managed (17.11 today).
   Podman 4.9.3 → Kubernetes/containerd, managed; Podman is used
   nowhere. Ubuntu 24.04.1 → what each image is in fact built on
   (Ubuntu 22.04 for pipeline and engine, Debian 12 for korban and
   talmudic) and the managed node (24.04). rebar3 3.23.0 → 3.22.0, the
   version in the build image. Azazel Processor added as a component.
   The spec is corrected to the deployment, not the reverse.

3. §1.1's rule — "No >=. No +. No ranges." — was not true of the spec's
   own Elixir deps, and "lock files are committed" was not true of two
   components. Both halves fixed:
   - The rule now says what is the case: a manifest may give a range;
     the committed lock is the pin; every image is built from its
     lock; base images are pinned by tag; managed services are pinned
     to a major version and patched by the provider.
   - And the build was made to obey it. The Korban image installed
     three packages named by hand and let pip pick every transitive
     one on the day of the build, plus an unpinned poetry-core. It now
     installs the lock's main group by exact version AND hash
     (scripts/lock_to_requirements.py; --require-hashes --no-deps;
     pip check). The image holds the lock's 12 packages and nothing
     else.
   - azazel_processor/poetry.lock: generated (it had none).
   - kushya_generator/pyproject.toml + poetry.lock: the four §1.4 pins
     (llama-cpp-python 0.2.55, peft 0.9.0, transformers 4.38.2,
     datasets 2.17.1) were pinned nowhere in the repo. They are now
     declared and locked (74 packages). The lock resolves; it has NOT
     been installed or run — Step 21 is unbuilt and needs a GPU.
     Its test config gains the korban and azazel source paths, which
     the external backend needs: 3 tests there had been failing since
     the azazel build, unnoticed because that suite is in no total.

Doorpost @expected_hash 39b66c31… → 1cd07079…, in this commit, with the
witnessed file that moved it (vayakhel).

Read before committing: Elixir 474/0 (seeds 0, 42) · korban 222 passed
1 skipped and azazel 125 passed, each with dependencies installed from
its lock by hash · kushya 17 passed (was 14 of 17) · korban image
starts, imports korban_processor + azazel_processor, pip check clean ·
pipeline image reports specification_identity verified 1cd07079….

Left as written: architecture §2's technology table still names
Phoenix, PostgreSQL 16, Ubuntu 24.04 and rootless Podman for Sanhedrin
isolation, and terumah §B still lists systemd, squashfs, Caddy,
nftables for a self-hosted server. Those describe a design, not a pin.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Scott KarpandClaude Fable 5.1 committed 2026-10-04 19:17:46 +00:00
1 parent 521f263e69
commit f4e8e5afc8
8 files changed
+3551 -26
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

specs/shorashim_terumah.md
+14 -12
View File
@@ -25,10 +25,10 @@ All versions pinned per Construction Specification §1.1.
| Item | Version (Pinned) | Status | Notes |
|------|---------|--------|-------|
| Ubuntu | 24.04.1 LTS | ✅ | Free. Available from all providers. |
| Ubuntu | 22.04 in the pipeline and engine images (`ubuntu:jammy-20240125`); 24.04 LTS on the cluster node (managed) | ✅ | Free. The korban and talmudic images are Debian 12, from their language base images. |
| systemd | ships with Ubuntu | ✅ | Service management, cycle timers. |
| Podman | 4.9.3 | ✅ | `apt install podman` — rootless containers for Sanhedrin isolation. |
| PostgreSQL | 16.2 | ✅ | `apt install postgresql-16` — L3 append-only store. |
| Kubernetes / containerd | 1.35 / 2.2 (managed, Exoscale SKS) | ✅ | Runs the four images as one pod. Images are built with Docker Buildx. Podman is not used: Sanhedrin panels are processes in the pipeline's BEAM, not containers. |
| PostgreSQL | 17 (managed, Exoscale DBaaS; 17.11 on 2026-10-04) | ✅ | L3 append-only store. Patched by the provider. |
| squashfs-tools | ships with Ubuntu | ✅ | For read-only L1 Torah filesystem. |
| Caddy | latest stable | ✅ | Reverse proxy with auto-TLS for pe'ah endpoint. |
| nftables | ships with Ubuntu | ✅ | Firewall. Configuration in Construction Spec §4.5. |
@@ -47,12 +47,12 @@ All versions pinned per Construction Specification §1.1. No ranges. No `+` suff
| GHC (Haskell compiler) | 9.6.4 | ✅ | Free. `ghcup install ghc 9.6.4` |
| Cabal (Haskell build tool) | 3.10 | ✅ | Free. Ships with ghcup. |
| Erlang/OTP | 26.2.1 | ✅ | Free. `apt install erlang` or erlang-solutions repo. |
| Rebar3 (Erlang build tool) | 3.23.0 | ✅ | Free. |
| Rebar3 (Erlang build tool) | 3.22.0 | ✅ | Free. The version `mix local.rebar` installs for Elixir 1.16.1. |
| Elixir | 1.16.1 | ✅ | Free. Must pair with OTP 26.2.1. |
| Mix (Elixir build tool) | ships with Elixir | ✅ | Free. |
| SWI-Prolog | 9.2.2 | ✅ | Free. `apt install swi-prolog` |
| Python | 3.12.2 | ✅ | Free. Ships with Ubuntu 24.04. |
| Poetry (Python package manager) | latest stable | ✅ | Free. Manages `poetry.lock`. |
| Python | 3.12.2 | ✅ | Free. From the `python:3.12.2-slim` base image. |
| Poetry (Python package manager) | 2.5.1 | ✅ | Free. Generates `poetry.lock` (lock-version 2.1); not installed in any image. |
**All language runtimes available. No gaps.**
@@ -85,11 +85,13 @@ All pinned via lock files per Construction Specification §§1.3-1.5.
### Elixir (via `mix.lock`)
| Package | Version | Status | Notes |
|---------|---------|--------|-------|
| phoenix | ~1.7.11 | ✅ | hex.pm (free) — for L2/pe'ah API |
| jason | ~1.4.1 | ✅ | hex.pm (free) — JSON |
| ecto | ~3.11.1 | ✅ | hex.pm (free) — database interface |
| postgrex | ~0.17.4 | ✅ | hex.pm (free) — PostgreSQL driver |
| telemetry | ~1.2.1 | ✅ | hex.pm (free) — metrics |
| jason | ~> 1.4.1 (locked 1.4.5) | ✅ | hex.pm (free) — JSON |
| ecto_sql | ~> 3.11.1 (locked 3.11.3; ecto 3.11.2) | ✅ | hex.pm (free) — database interface |
| postgrex | ~> 0.22.3 (locked 0.22.4) | ✅ | hex.pm (free) — PostgreSQL driver |
| bandit | ~> 1.2 (locked 1.12.5) | ✅ | hex.pm (free) — HTTP server for the pe'ah / kodesh API |
| plug | ~> 1.15 (locked 1.20.3) | ✅ | hex.pm (free) — HTTP routing |
| telemetry | locked 1.4.2 | ✅ | hex.pm (free) — transitive (Ecto, Bandit); not depended on directly |
| sanhedrin | path dependency | ✅ | `../sanhedrin`, built by rebar3 into the same BEAM |
### Python (via `poetry.lock`)
| Package | Version | Status | Notes |
@@ -97,7 +99,7 @@ All pinned via lock files per Construction Specification §§1.3-1.5.
| httpx | 0.27.0 | ✅ | PyPI (free) — API calls |
| pydantic | 2.6.1 | ✅ | PyPI (free) — data validation |
| hebrew-tokenizer | 2.3.0 | ⚠️ | PyPI. Needs evaluation for biblical vs. modern Hebrew. |
| pytest | latest stable | ✅ | PyPI (free) |
| pytest | >=8.0,<9.0 (locked 8.4.2) | ✅ | PyPI (free) — dev group only; not in any image |
| llama-cpp-python | 0.2.55 | ✅ | PyPI (free) — Mistral inference |
| peft | 0.9.0 | ✅ | PyPI (free) — fine-tuning |
| transformers | 4.38.2 | ✅ | PyPI (free) — model tooling |
specs/shorashim_vayakhel.md
+23 -9
View File
@@ -17,16 +17,21 @@ Torah reference: Shemot 25:10 — *V'asu aron atzei shitim, amatayim vachetzi ar
| Component | Language | Exact Version | Package Manager | Lock File |
|-----------|---------|---------------|-----------------|-----------|
| Shoresh Engine | Haskell | GHC 9.6.4 | Cabal 3.10 | `cabal.project.freeze` |
| Sanhedrin | Erlang/OTP | OTP 26.2.1 | rebar3 3.23.0 | `rebar.lock` |
| Sanhedrin | Erlang/OTP | OTP 26.2.1 | rebar3 3.22.0 | `rebar.lock` |
| Vav Pipeline | Elixir | 1.16.1 / OTP 26.2.1 | Mix | `mix.lock` |
| Talmudic Engine | SWI-Prolog | 9.2.2 | swipl packs | — |
| Korban Processor | Python | 3.12.2 | pip + poetry | `poetry.lock` |
| Azazel Processor | Python | 3.12.2 | pip + poetry | `poetry.lock` |
| Kushya Generator | Python | 3.12.2 | pip + poetry | `poetry.lock` |
| Database | PostgreSQL | 16.2 | apt | — |
| Container | Podman | 4.9.3 | apt | — |
| OS | Ubuntu | 24.04.1 LTS | apt | — |
| Database | PostgreSQL | 17 (17.11 on 2026-10-04) | managed (Exoscale DBaaS) | — |
| Container | Kubernetes / containerd | 1.35 / 2.2 (1.35.3 / 2.2.2 on 2026-10-04) | managed (Exoscale SKS); images built with Docker Buildx | — |
| OS — pipeline and engine images | Ubuntu | 22.04 (`ubuntu:jammy-20240125`) | base image tag | — |
| OS — korban and talmudic images | Debian | 12 (`python:3.12.2-slim`, `swipl:9.2.2`) | base image tag | — |
| OS — cluster node | Ubuntu | 24.04 LTS (24.04.4 on 2026-10-04) | managed (Exoscale SKS) | — |
Every dependency is version-pinned. Lock files are committed. `cabal.project.freeze` pins all transitive Haskell dependencies. `rebar.lock` pins all Erlang deps. `mix.lock` pins all Elixir deps. `poetry.lock` pins all Python deps. No `>=`. No `+`. No ranges. The aron is two and a half cubits.
Every language dependency is pinned by a committed lock file, and every image is built from its lock. `cabal.project.freeze` pins all transitive Haskell dependencies. `rebar.lock` pins all Erlang deps. `mix.lock` pins all Elixir deps. `poetry.lock` pins all Python deps, and the Korban image installs the lock's `main` group by exact version and hash (`scripts/lock_to_requirements.py`) — nothing is chosen on the day of the build. A manifest may state a compatible range (`~>` in `mix.exs`, `>=8.0,<9.0` for pytest); the lock is what is built, and a lock has no ranges. Base images are pinned by tag.
What is rented is not ours to cut to the cubit: the database, Kubernetes and the node's operating system are managed services, pinned here to a major version and patched by the provider. The versions observed are recorded above with their date. Everything the builder cuts is exact. The aron is two and a half cubits.
### 1.2 L1 Torah Text Source
@@ -102,15 +107,24 @@ datasets = "2.17.1"
# mix.exs
defp deps do
[
{:phoenix, "~> 1.7.11"},
{:jason, "~> 1.4.1"},
{:ecto, "~> 3.11.1"},
{:sanhedrin, path: "../sanhedrin", manager: :rebar3},
{:ecto_sql, "~> 3.11.1"},
{:postgrex, "~> 0.22.3"},
{:telemetry, "~> 1.2.1"}
{:bandit, "~> 1.2"},
{:plug, "~> 1.15"}
]
end
```
```
# mix.lock (the versions built — excerpt)
jason 1.4.5 · ecto_sql 3.11.3 · ecto 3.11.2 · postgrex 0.22.4
bandit 1.12.5 · plug 1.20.3 · telemetry 1.4.2 (transitive) · jsx 3.1.0
```
The HTTP layer (Bigdei Kodesh) is Plug served by Bandit; Phoenix is not a dependency. Telemetry is not depended on directly — it arrives with Ecto and Bandit.
---
## 2. MIDOT — Performance Specifications
@@ -597,7 +611,7 @@ No secrets in environment variables. No secrets in configuration files. No secre
# /etc/caddy/Caddyfile
shorashim.example.org {
reverse_proxy localhost:4000 # Phoenix endpoint
reverse_proxy localhost:4000 # Bigdei Kodesh (Plug on Bandit)
header {
Strict-Transport-Security "max-age=63072000; includeSubDomains"