specs §1.1/§1.5 + Doorpost: the pins say what is built, and the build obeys them

The pin audit (2026-10-04) found Construction §1 wrong in three ways.

1. §1.5's mix.exs block was not the real mix.exs.
   phoenix ~> 1.7.11 was never a dependency (the API is Plug on
   Bandit); `ecto` is `ecto_sql`; telemetry is transitive (locked
   1.4.2, outside the stated ~> 1.2.1); bandit, plug and the sanhedrin
   path dependency were missing. The block now matches mix.exs and adds
   the versions mix.lock actually builds. Terumah's Elixir table
   matched the wrong block and also said postgrex ~0.17.4; corrected.

2. §1.1's component table described a machine that is not the one
   running. PostgreSQL 16.2 via apt → 17, managed (17.11 today).
   Podman 4.9.3 → Kubernetes/containerd, managed; Podman is used
   nowhere. Ubuntu 24.04.1 → what each image is in fact built on
   (Ubuntu 22.04 for pipeline and engine, Debian 12 for korban and
   talmudic) and the managed node (24.04). rebar3 3.23.0 → 3.22.0, the
   version in the build image. Azazel Processor added as a component.
   The spec is corrected to the deployment, not the reverse.

3. §1.1's rule — "No >=. No +. No ranges." — was not true of the spec's
   own Elixir deps, and "lock files are committed" was not true of two
   components. Both halves fixed:
   - The rule now says what is the case: a manifest may give a range;
     the committed lock is the pin; every image is built from its
     lock; base images are pinned by tag; managed services are pinned
     to a major version and patched by the provider.
   - And the build was made to obey it. The Korban image installed
     three packages named by hand and let pip pick every transitive
     one on the day of the build, plus an unpinned poetry-core. It now
     installs the lock's main group by exact version AND hash
     (scripts/lock_to_requirements.py; --require-hashes --no-deps;
     pip check). The image holds the lock's 12 packages and nothing
     else.
   - azazel_processor/poetry.lock: generated (it had none).
   - kushya_generator/pyproject.toml + poetry.lock: the four §1.4 pins
     (llama-cpp-python 0.2.55, peft 0.9.0, transformers 4.38.2,
     datasets 2.17.1) were pinned nowhere in the repo. They are now
     declared and locked (74 packages). The lock resolves; it has NOT
     been installed or run — Step 21 is unbuilt and needs a GPU.
     Its test config gains the korban and azazel source paths, which
     the external backend needs: 3 tests there had been failing since
     the azazel build, unnoticed because that suite is in no total.

Doorpost @expected_hash 39b66c31… → 1cd07079…, in this commit, with the
witnessed file that moved it (vayakhel).

Read before committing: Elixir 474/0 (seeds 0, 42) · korban 222 passed
1 skipped and azazel 125 passed, each with dependencies installed from
its lock by hash · kushya 17 passed (was 14 of 17) · korban image
starts, imports korban_processor + azazel_processor, pip check clean ·
pipeline image reports specification_identity verified 1cd07079….

Left as written: architecture §2's technology table still names
Phoenix, PostgreSQL 16, Ubuntu 24.04 and rootless Podman for Sanhedrin
isolation, and terumah §B still lists systemd, squashfs, Caddy,
nftables for a self-hosted server. Those describe a design, not a pin.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

specs/shorashim_vayakhel.md

@@ -17,16 +17,21 @@ Torah reference: Shemot 25:10 — *V'asu aron atzei shitim, amatayim vachetzi ar
 | Component | Language | Exact Version | Package Manager | Lock File |
 |-----------|---------|---------------|-----------------|-----------|
 | Shoresh Engine | Haskell | GHC 9.6.4 | Cabal 3.10 | `cabal.project.freeze` |
-| Sanhedrin | Erlang/OTP | OTP 26.2.1 | rebar3 3.23.0 | `rebar.lock` |
+| Sanhedrin | Erlang/OTP | OTP 26.2.1 | rebar3 3.22.0 | `rebar.lock` |
 | Vav Pipeline | Elixir | 1.16.1 / OTP 26.2.1 | Mix | `mix.lock` |
 | Talmudic Engine | SWI-Prolog | 9.2.2 | swipl packs | — |
 | Korban Processor | Python | 3.12.2 | pip + poetry | `poetry.lock` |
+| Azazel Processor | Python | 3.12.2 | pip + poetry | `poetry.lock` |
 | Kushya Generator | Python | 3.12.2 | pip + poetry | `poetry.lock` |
-| Database | PostgreSQL | 16.2 | apt | — |
-| Container | Podman | 4.9.3 | apt | — |
-| OS | Ubuntu | 24.04.1 LTS | apt | — |
+| Database | PostgreSQL | 17 (17.11 on 2026-10-04) | managed (Exoscale DBaaS) | — |
+| Container | Kubernetes / containerd | 1.35 / 2.2 (1.35.3 / 2.2.2 on 2026-10-04) | managed (Exoscale SKS); images built with Docker Buildx | — |
+| OS — pipeline and engine images | Ubuntu | 22.04 (`ubuntu:jammy-20240125`) | base image tag | — |
+| OS — korban and talmudic images | Debian | 12 (`python:3.12.2-slim`, `swipl:9.2.2`) | base image tag | — |
+| OS — cluster node | Ubuntu | 24.04 LTS (24.04.4 on 2026-10-04) | managed (Exoscale SKS) | — |
 
-Every dependency is version-pinned. Lock files are committed. `cabal.project.freeze` pins all transitive Haskell dependencies. `rebar.lock` pins all Erlang deps. `mix.lock` pins all Elixir deps. `poetry.lock` pins all Python deps. No `>=`. No `+`. No ranges. The aron is two and a half cubits.
+Every language dependency is pinned by a committed lock file, and every image is built from its lock. `cabal.project.freeze` pins all transitive Haskell dependencies. `rebar.lock` pins all Erlang deps. `mix.lock` pins all Elixir deps. `poetry.lock` pins all Python deps, and the Korban image installs the lock's `main` group by exact version and hash (`scripts/lock_to_requirements.py`) — nothing is chosen on the day of the build. A manifest may state a compatible range (`~>` in `mix.exs`, `>=8.0,<9.0` for pytest); the lock is what is built, and a lock has no ranges. Base images are pinned by tag.
+
+What is rented is not ours to cut to the cubit: the database, Kubernetes and the node's operating system are managed services, pinned here to a major version and patched by the provider. The versions observed are recorded above with their date. Everything the builder cuts is exact. The aron is two and a half cubits.
 
 ### 1.2 L1 Torah Text Source
 
@@ -102,15 +107,24 @@ datasets = "2.17.1"
 # mix.exs
 defp deps do
   [
-    {:phoenix, "~> 1.7.11"},
     {:jason, "~> 1.4.1"},
-    {:ecto, "~> 3.11.1"},
+    {:sanhedrin, path: "../sanhedrin", manager: :rebar3},
+    {:ecto_sql, "~> 3.11.1"},
     {:postgrex, "~> 0.22.3"},
-    {:telemetry, "~> 1.2.1"}
+    {:bandit, "~> 1.2"},
+    {:plug, "~> 1.15"}
   ]
 end
 ```
 
+```
+# mix.lock (the versions built — excerpt)
+jason 1.4.5 · ecto_sql 3.11.3 · ecto 3.11.2 · postgrex 0.22.4
+bandit 1.12.5 · plug 1.20.3 · telemetry 1.4.2 (transitive) · jsx 3.1.0
+```
+
+The HTTP layer (Bigdei Kodesh) is Plug served by Bandit; Phoenix is not a dependency. Telemetry is not depended on directly — it arrives with Ecto and Bandit.
+
 ---
 
 ## 2. MIDOT — Performance Specifications
@@ -597,7 +611,7 @@ No secrets in environment variables. No secrets in configuration files. No secre
 
 # /etc/caddy/Caddyfile
 shorashim.example.org {
-    reverse_proxy localhost:4000  # Phoenix endpoint
+    reverse_proxy localhost:4000  # Bigdei Kodesh (Plug on Bandit)
 
     header {
         Strict-Transport-Security "max-age=63072000; includeSubDomains"