specs §1.1/§1.5 + Doorpost: the pins say what is built, and the build obeys them

The pin audit (2026-10-04) found Construction §1 wrong in three ways.

1. §1.5's mix.exs block was not the real mix.exs.
   phoenix ~> 1.7.11 was never a dependency (the API is Plug on
   Bandit); `ecto` is `ecto_sql`; telemetry is transitive (locked
   1.4.2, outside the stated ~> 1.2.1); bandit, plug and the sanhedrin
   path dependency were missing. The block now matches mix.exs and adds
   the versions mix.lock actually builds. Terumah's Elixir table
   matched the wrong block and also said postgrex ~0.17.4; corrected.

2. §1.1's component table described a machine that is not the one
   running. PostgreSQL 16.2 via apt → 17, managed (17.11 today).
   Podman 4.9.3 → Kubernetes/containerd, managed; Podman is used
   nowhere. Ubuntu 24.04.1 → what each image is in fact built on
   (Ubuntu 22.04 for pipeline and engine, Debian 12 for korban and
   talmudic) and the managed node (24.04). rebar3 3.23.0 → 3.22.0, the
   version in the build image. Azazel Processor added as a component.
   The spec is corrected to the deployment, not the reverse.

3. §1.1's rule — "No >=. No +. No ranges." — was not true of the spec's
   own Elixir deps, and "lock files are committed" was not true of two
   components. Both halves fixed:
   - The rule now says what is the case: a manifest may give a range;
     the committed lock is the pin; every image is built from its
     lock; base images are pinned by tag; managed services are pinned
     to a major version and patched by the provider.
   - And the build was made to obey it. The Korban image installed
     three packages named by hand and let pip pick every transitive
     one on the day of the build, plus an unpinned poetry-core. It now
     installs the lock's main group by exact version AND hash
     (scripts/lock_to_requirements.py; --require-hashes --no-deps;
     pip check). The image holds the lock's 12 packages and nothing
     else.
   - azazel_processor/poetry.lock: generated (it had none).
   - kushya_generator/pyproject.toml + poetry.lock: the four §1.4 pins
     (llama-cpp-python 0.2.55, peft 0.9.0, transformers 4.38.2,
     datasets 2.17.1) were pinned nowhere in the repo. They are now
     declared and locked (74 packages). The lock resolves; it has NOT
     been installed or run — Step 21 is unbuilt and needs a GPU.
     Its test config gains the korban and azazel source paths, which
     the external backend needs: 3 tests there had been failing since
     the azazel build, unnoticed because that suite is in no total.

Doorpost @expected_hash 39b66c31… → 1cd07079…, in this commit, with the
witnessed file that moved it (vayakhel).

Read before committing: Elixir 474/0 (seeds 0, 42) · korban 222 passed
1 skipped and azazel 125 passed, each with dependencies installed from
its lock by hash · kushya 17 passed (was 14 of 17) · korban image
starts, imports korban_processor + azazel_processor, pip check clean ·
pipeline image reports specification_identity verified 1cd07079….

Left as written: architecture §2's technology table still names
Phoenix, PostgreSQL 16, Ubuntu 24.04 and rootless Podman for Sanhedrin
isolation, and terumah §B still lists systemd, squashfs, Caddy,
nftables for a self-hosted server. Those describe a design, not a pin.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

azazel_processor/poetry.lock

@@ -0,0 +1,232 @@
+# This file is automatically @generated by Poetry 2.5.1 and should not be changed by hand.
+
+[[package]]
+name = "annotated-types"
+version = "0.8.0"
+description = "Reusable constraint types to use with typing.Annotated"
+optional = false
+python-versions = ">=3.10"
+groups = ["main"]
+files = [
+    {file = "annotated_types-0.8.0-py3-none-any.whl", hash = "sha256:f072f4d804ea359e4eaf198b1af7a8b0943881a87f31bb764f8bf219bb9419e0"},
+    {file = "annotated_types-0.8.0.tar.gz", hash = "sha256:13b2beaad985e05e2d6407ee4c4f35590b11f8d693a258a561055cac8f64cab7"},
+]
+
+[[package]]
+name = "colorama"
+version = "0.4.6"
+description = "Cross-platform colored terminal text."
+optional = false
+python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,!=3.6.*,>=2.7"
+groups = ["dev"]
+markers = "sys_platform == \"win32\""
+files = [
+    {file = "colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"},
+    {file = "colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"},
+]
+
+[[package]]
+name = "iniconfig"
+version = "2.3.0"
+description = "brain-dead simple config-ini parsing"
+optional = false
+python-versions = ">=3.10"
+groups = ["dev"]
+files = [
+    {file = "iniconfig-2.3.0-py3-none-any.whl", hash = "sha256:f631c04d2c48c52b84d0d0549c99ff3859c98df65b3101406327ecc7d53fbf12"},
+    {file = "iniconfig-2.3.0.tar.gz", hash = "sha256:c76315c77db068650d49c5b56314774a7804df16fee4402c1f19d6d15d8c4730"},
+]
+
+[[package]]
+name = "packaging"
+version = "26.3"
+description = "Core utilities for Python packages"
+optional = false
+python-versions = ">=3.9"
+groups = ["dev"]
+files = [
+    {file = "packaging-26.3-py3-none-any.whl", hash = "sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c"},
+    {file = "packaging-26.3.tar.gz", hash = "sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79"},
+]
+
+[[package]]
+name = "pluggy"
+version = "1.6.0"
+description = "plugin and hook calling mechanisms for python"
+optional = false
+python-versions = ">=3.9"
+groups = ["dev"]
+files = [
+    {file = "pluggy-1.6.0-py3-none-any.whl", hash = "sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746"},
+    {file = "pluggy-1.6.0.tar.gz", hash = "sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3"},
+]
+
+[package.extras]
+dev = ["pre-commit", "tox"]
+testing = ["coverage", "pytest", "pytest-benchmark"]
+
+[[package]]
+name = "pydantic"
+version = "2.6.1"
+description = "Data validation using Python type hints"
+optional = false
+python-versions = ">=3.8"
+groups = ["main"]
+files = [
+    {file = "pydantic-2.6.1-py3-none-any.whl", hash = "sha256:0b6a909df3192245cb736509a92ff69e4fef76116feffec68e93a567347bae6f"},
+    {file = "pydantic-2.6.1.tar.gz", hash = "sha256:4fd5c182a2488dc63e6d32737ff19937888001e2a6d86e94b3f233104a5d1fa9"},
+]
+
+[package.dependencies]
+annotated-types = ">=0.4.0"
+pydantic-core = "2.16.2"
+typing-extensions = ">=4.6.1"
+
+[package.extras]
+email = ["email-validator (>=2.0.0)"]
+
+[[package]]
+name = "pydantic-core"
+version = "2.16.2"
+description = ""
+optional = false
+python-versions = ">=3.8"
+groups = ["main"]
+files = [
+    {file = "pydantic_core-2.16.2-cp310-cp310-macosx_10_12_x86_64.whl", hash = "sha256:3fab4e75b8c525a4776e7630b9ee48aea50107fea6ca9f593c98da3f4d11bf7c"},
+    {file = "pydantic_core-2.16.2-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:8bde5b48c65b8e807409e6f20baee5d2cd880e0fad00b1a811ebc43e39a00ab2"},
+    {file = "pydantic_core-2.16.2-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:2924b89b16420712e9bb8192396026a8fbd6d8726224f918353ac19c4c043d2a"},
+    {file = "pydantic_core-2.16.2-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:16aa02e7a0f539098e215fc193c8926c897175d64c7926d00a36188917717a05"},
+    {file = "pydantic_core-2.16.2-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:936a787f83db1f2115ee829dd615c4f684ee48ac4de5779ab4300994d8af325b"},
+    {file = "pydantic_core-2.16.2-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:459d6be6134ce3b38e0ef76f8a672924460c455d45f1ad8fdade36796df1ddc8"},
+    {file = "pydantic_core-2.16.2-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:4f9ee4febb249c591d07b2d4dd36ebcad0ccd128962aaa1801508320896575ef"},
+    {file = "pydantic_core-2.16.2-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:40a0bd0bed96dae5712dab2aba7d334a6c67cbcac2ddfca7dbcc4a8176445990"},
+    {file = "pydantic_core-2.16.2-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:870dbfa94de9b8866b37b867a2cb37a60c401d9deb4a9ea392abf11a1f98037b"},
+    {file = "pydantic_core-2.16.2-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:308974fdf98046db28440eb3377abba274808bf66262e042c412eb2adf852731"},
+    {file = "pydantic_core-2.16.2-cp310-none-win32.whl", hash = "sha256:a477932664d9611d7a0816cc3c0eb1f8856f8a42435488280dfbf4395e141485"},
+    {file = "pydantic_core-2.16.2-cp310-none-win_amd64.whl", hash = "sha256:8f9142a6ed83d90c94a3efd7af8873bf7cefed2d3d44387bf848888482e2d25f"},
+    {file = "pydantic_core-2.16.2-cp311-cp311-macosx_10_12_x86_64.whl", hash = "sha256:406fac1d09edc613020ce9cf3f2ccf1a1b2f57ab00552b4c18e3d5276c67eb11"},
+    {file = "pydantic_core-2.16.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:ce232a6170dd6532096cadbf6185271e4e8c70fc9217ebe105923ac105da9978"},
+    {file = "pydantic_core-2.16.2-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a90fec23b4b05a09ad988e7a4f4e081711a90eb2a55b9c984d8b74597599180f"},
+    {file = "pydantic_core-2.16.2-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:8aafeedb6597a163a9c9727d8a8bd363a93277701b7bfd2749fbefee2396469e"},
+    {file = "pydantic_core-2.16.2-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:9957433c3a1b67bdd4c63717eaf174ebb749510d5ea612cd4e83f2d9142f3fc8"},
+    {file = "pydantic_core-2.16.2-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:b0d7a9165167269758145756db43a133608a531b1e5bb6a626b9ee24bc38a8f7"},
+    {file = "pydantic_core-2.16.2-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:dffaf740fe2e147fedcb6b561353a16243e654f7fe8e701b1b9db148242e1272"},
+    {file = "pydantic_core-2.16.2-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:f8ed79883b4328b7f0bd142733d99c8e6b22703e908ec63d930b06be3a0e7113"},
+    {file = "pydantic_core-2.16.2-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:cf903310a34e14651c9de056fcc12ce090560864d5a2bb0174b971685684e1d8"},
+    {file = "pydantic_core-2.16.2-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:46b0d5520dbcafea9a8645a8164658777686c5c524d381d983317d29687cce97"},
+    {file = "pydantic_core-2.16.2-cp311-none-win32.whl", hash = "sha256:70651ff6e663428cea902dac297066d5c6e5423fda345a4ca62430575364d62b"},
+    {file = "pydantic_core-2.16.2-cp311-none-win_amd64.whl", hash = "sha256:98dc6f4f2095fc7ad277782a7c2c88296badcad92316b5a6e530930b1d475ebc"},
+    {file = "pydantic_core-2.16.2-cp311-none-win_arm64.whl", hash = "sha256:ef6113cd31411eaf9b39fc5a8848e71c72656fd418882488598758b2c8c6dfa0"},
+    {file = "pydantic_core-2.16.2-cp312-cp312-macosx_10_12_x86_64.whl", hash = "sha256:88646cae28eb1dd5cd1e09605680c2b043b64d7481cdad7f5003ebef401a3039"},
+    {file = "pydantic_core-2.16.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:7b883af50eaa6bb3299780651e5be921e88050ccf00e3e583b1e92020333304b"},
+    {file = "pydantic_core-2.16.2-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:7bf26c2e2ea59d32807081ad51968133af3025c4ba5753e6a794683d2c91bf6e"},
+    {file = "pydantic_core-2.16.2-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:99af961d72ac731aae2a1b55ccbdae0733d816f8bfb97b41909e143de735f522"},
+    {file = "pydantic_core-2.16.2-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:02906e7306cb8c5901a1feb61f9ab5e5c690dbbeaa04d84c1b9ae2a01ebe9379"},
+    {file = "pydantic_core-2.16.2-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:d5362d099c244a2d2f9659fb3c9db7c735f0004765bbe06b99be69fbd87c3f15"},
+    {file = "pydantic_core-2.16.2-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3ac426704840877a285d03a445e162eb258924f014e2f074e209d9b4ff7bf380"},
+    {file = "pydantic_core-2.16.2-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:b94cbda27267423411c928208e89adddf2ea5dd5f74b9528513f0358bba019cb"},
+    {file = "pydantic_core-2.16.2-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:6db58c22ac6c81aeac33912fb1af0e930bc9774166cdd56eade913d5f2fff35e"},
+    {file = "pydantic_core-2.16.2-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:396fdf88b1b503c9c59c84a08b6833ec0c3b5ad1a83230252a9e17b7dfb4cffc"},
+    {file = "pydantic_core-2.16.2-cp312-none-win32.whl", hash = "sha256:7c31669e0c8cc68400ef0c730c3a1e11317ba76b892deeefaf52dcb41d56ed5d"},
+    {file = "pydantic_core-2.16.2-cp312-none-win_amd64.whl", hash = "sha256:a3b7352b48fbc8b446b75f3069124e87f599d25afb8baa96a550256c031bb890"},
+    {file = "pydantic_core-2.16.2-cp312-none-win_arm64.whl", hash = "sha256:a9e523474998fb33f7c1a4d55f5504c908d57add624599e095c20fa575b8d943"},
+    {file = "pydantic_core-2.16.2-cp38-cp38-macosx_10_12_x86_64.whl", hash = "sha256:ae34418b6b389d601b31153b84dce480351a352e0bb763684a1b993d6be30f17"},
+    {file = "pydantic_core-2.16.2-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:732bd062c9e5d9582a30e8751461c1917dd1ccbdd6cafb032f02c86b20d2e7ec"},
+    {file = "pydantic_core-2.16.2-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e4b52776a2e3230f4854907a1e0946eec04d41b1fc64069ee774876bbe0eab55"},
+    {file = "pydantic_core-2.16.2-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:ef551c053692b1e39e3f7950ce2296536728871110e7d75c4e7753fb30ca87f4"},
+    {file = "pydantic_core-2.16.2-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:ebb892ed8599b23fa8f1799e13a12c87a97a6c9d0f497525ce9858564c4575a4"},
+    {file = "pydantic_core-2.16.2-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:aa6c8c582036275997a733427b88031a32ffa5dfc3124dc25a730658c47a572f"},
+    {file = "pydantic_core-2.16.2-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:e4ba0884a91f1aecce75202473ab138724aa4fb26d7707f2e1fa6c3e68c84fbf"},
+    {file = "pydantic_core-2.16.2-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:7924e54f7ce5d253d6160090ddc6df25ed2feea25bfb3339b424a9dd591688bc"},
+    {file = "pydantic_core-2.16.2-cp38-cp38-musllinux_1_1_aarch64.whl", hash = "sha256:69a7b96b59322a81c2203be537957313b07dd333105b73db0b69212c7d867b4b"},
+    {file = "pydantic_core-2.16.2-cp38-cp38-musllinux_1_1_x86_64.whl", hash = "sha256:7e6231aa5bdacda78e96ad7b07d0c312f34ba35d717115f4b4bff6cb87224f0f"},
+    {file = "pydantic_core-2.16.2-cp38-none-win32.whl", hash = "sha256:41dac3b9fce187a25c6253ec79a3f9e2a7e761eb08690e90415069ea4a68ff7a"},
+    {file = "pydantic_core-2.16.2-cp38-none-win_amd64.whl", hash = "sha256:f685dbc1fdadb1dcd5b5e51e0a378d4685a891b2ddaf8e2bba89bd3a7144e44a"},
+    {file = "pydantic_core-2.16.2-cp39-cp39-macosx_10_12_x86_64.whl", hash = "sha256:55749f745ebf154c0d63d46c8c58594d8894b161928aa41adbb0709c1fe78b77"},
+    {file = "pydantic_core-2.16.2-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:b30b0dd58a4509c3bd7eefddf6338565c4905406aee0c6e4a5293841411a1286"},
+    {file = "pydantic_core-2.16.2-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:18de31781cdc7e7b28678df7c2d7882f9692ad060bc6ee3c94eb15a5d733f8f7"},
+    {file = "pydantic_core-2.16.2-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:5864b0242f74b9dd0b78fd39db1768bc3f00d1ffc14e596fd3e3f2ce43436a33"},
+    {file = "pydantic_core-2.16.2-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:b8f9186ca45aee030dc8234118b9c0784ad91a0bb27fc4e7d9d6608a5e3d386c"},
+    {file = "pydantic_core-2.16.2-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:cc6f6c9be0ab6da37bc77c2dda5f14b1d532d5dbef00311ee6e13357a418e646"},
+    {file = "pydantic_core-2.16.2-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:aa057095f621dad24a1e906747179a69780ef45cc8f69e97463692adbcdae878"},
+    {file = "pydantic_core-2.16.2-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:6ad84731a26bcfb299f9eab56c7932d46f9cad51c52768cace09e92a19e4cf55"},
+    {file = "pydantic_core-2.16.2-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:3b052c753c4babf2d1edc034c97851f867c87d6f3ea63a12e2700f159f5c41c3"},
+    {file = "pydantic_core-2.16.2-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:e0f686549e32ccdb02ae6f25eee40cc33900910085de6aa3790effd391ae10c2"},
+    {file = "pydantic_core-2.16.2-cp39-none-win32.whl", hash = "sha256:7afb844041e707ac9ad9acad2188a90bffce2c770e6dc2318be0c9916aef1469"},
+    {file = "pydantic_core-2.16.2-cp39-none-win_amd64.whl", hash = "sha256:9da90d393a8227d717c19f5397688a38635afec89f2e2d7af0df037f3249c39a"},
+    {file = "pydantic_core-2.16.2-pp310-pypy310_pp73-macosx_10_12_x86_64.whl", hash = "sha256:5f60f920691a620b03082692c378661947d09415743e437a7478c309eb0e4f82"},
+    {file = "pydantic_core-2.16.2-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:47924039e785a04d4a4fa49455e51b4eb3422d6eaacfde9fc9abf8fdef164e8a"},
+    {file = "pydantic_core-2.16.2-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e6294e76b0380bb7a61eb8a39273c40b20beb35e8c87ee101062834ced19c545"},
+    {file = "pydantic_core-2.16.2-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:fe56851c3f1d6f5384b3051c536cc81b3a93a73faf931f404fef95217cf1e10d"},
+    {file = "pydantic_core-2.16.2-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:9d776d30cde7e541b8180103c3f294ef7c1862fd45d81738d156d00551005784"},
+    {file = "pydantic_core-2.16.2-pp310-pypy310_pp73-musllinux_1_1_aarch64.whl", hash = "sha256:72f7919af5de5ecfaf1eba47bf9a5d8aa089a3340277276e5636d16ee97614d7"},
+    {file = "pydantic_core-2.16.2-pp310-pypy310_pp73-musllinux_1_1_x86_64.whl", hash = "sha256:4bfcbde6e06c56b30668a0c872d75a7ef3025dc3c1823a13cf29a0e9b33f67e8"},
+    {file = "pydantic_core-2.16.2-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:ff7c97eb7a29aba230389a2661edf2e9e06ce616c7e35aa764879b6894a44b25"},
+    {file = "pydantic_core-2.16.2-pp39-pypy39_pp73-macosx_10_12_x86_64.whl", hash = "sha256:9b5f13857da99325dcabe1cc4e9e6a3d7b2e2c726248ba5dd4be3e8e4a0b6d0e"},
+    {file = "pydantic_core-2.16.2-pp39-pypy39_pp73-macosx_11_0_arm64.whl", hash = "sha256:a7e41e3ada4cca5f22b478c08e973c930e5e6c7ba3588fb8e35f2398cdcc1545"},
+    {file = "pydantic_core-2.16.2-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:60eb8ceaa40a41540b9acae6ae7c1f0a67d233c40dc4359c256ad2ad85bdf5e5"},
+    {file = "pydantic_core-2.16.2-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:7beec26729d496a12fd23cf8da9944ee338c8b8a17035a560b585c36fe81af20"},
+    {file = "pydantic_core-2.16.2-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:22c5f022799f3cd6741e24f0443ead92ef42be93ffda0d29b2597208c94c3753"},
+    {file = "pydantic_core-2.16.2-pp39-pypy39_pp73-musllinux_1_1_aarch64.whl", hash = "sha256:eca58e319f4fd6df004762419612122b2c7e7d95ffafc37e890252f869f3fb2a"},
+    {file = "pydantic_core-2.16.2-pp39-pypy39_pp73-musllinux_1_1_x86_64.whl", hash = "sha256:ed957db4c33bc99895f3a1672eca7e80e8cda8bd1e29a80536b4ec2153fa9804"},
+    {file = "pydantic_core-2.16.2-pp39-pypy39_pp73-win_amd64.whl", hash = "sha256:459c0d338cc55d099798618f714b21b7ece17eb1a87879f2da20a3ff4c7628e2"},
+    {file = "pydantic_core-2.16.2.tar.gz", hash = "sha256:0ba503850d8b8dcc18391f10de896ae51d37fe5fe43dbfb6a35c5c5cad271a06"},
+]
+
+[package.dependencies]
+typing-extensions = ">=4.6.0,!=4.7.0"
+
+[[package]]
+name = "pygments"
+version = "2.21.0"
+description = "Pygments is a syntax highlighting package written in Python."
+optional = false
+python-versions = ">=3.9"
+groups = ["dev"]
+files = [
+    {file = "pygments-2.21.0-py3-none-any.whl", hash = "sha256:2363c69b61c4a97c838da3b130dcd6468f4848992b21a82f2a63ec34377137d9"},
+    {file = "pygments-2.21.0.tar.gz", hash = "sha256:610ca751c9bc2492b38eb9a38a7fbc93edbbb2d7182edaf34e66ae493dee5c8c"},
+]
+
+[package.extras]
+windows-terminal = ["colorama (>=0.4.6)"]
+
+[[package]]
+name = "pytest"
+version = "8.4.2"
+description = "pytest: simple powerful testing with Python"
+optional = false
+python-versions = ">=3.9"
+groups = ["dev"]
+files = [
+    {file = "pytest-8.4.2-py3-none-any.whl", hash = "sha256:872f880de3fc3a5bdc88a11b39c9710c3497a547cfa9320bc3c5e62fbf272e79"},
+    {file = "pytest-8.4.2.tar.gz", hash = "sha256:86c0d0b93306b961d58d62a4db4879f27fe25513d4b969df351abdddb3c30e01"},
+]
+
+[package.dependencies]
+colorama = {version = ">=0.4", markers = "sys_platform == \"win32\""}
+iniconfig = ">=1"
+packaging = ">=20"
+pluggy = ">=1.5,<2"
+pygments = ">=2.7.2"
+
+[package.extras]
+dev = ["argcomplete", "attrs (>=19.2)", "hypothesis (>=3.56)", "mock", "requests", "setuptools", "xmlschema"]
+
+[[package]]
+name = "typing-extensions"
+version = "4.16.0"
+description = "Backported and Experimental Type Hints for Python 3.9+"
+optional = false
+python-versions = ">=3.9"
+groups = ["main"]
+files = [
+    {file = "typing_extensions-4.16.0-py3-none-any.whl", hash = "sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8"},
+    {file = "typing_extensions-4.16.0.tar.gz", hash = "sha256:dc983d19a509c94dba722ee6abd33940f7c05a89e243c47e907eb4db6f1a43e5"},
+]
+
+[metadata]
+lock-version = "2.1"
+python-versions = "==3.12.2"
+content-hash = "05edb007ce5b000462960d9caaa0110ef611d4ffc74e97b38fcec20a3004b754"

deploy/docker/Dockerfile.korban_processor

@@ -20,8 +20,6 @@ FROM --platform=linux/amd64 python:3.12.2-slim AS build
 
 WORKDIR /app
 
-# Install build deps
-RUN pip install --no-cache-dir poetry-core
 
 # Copy korban_processor
 COPY korban_processor/pyproject.toml ./
@@ -31,8 +29,18 @@ COPY korban_processor/test/ test/
 # Copy azazel_processor source — imported by korban_processor.external_offering
 COPY azazel_processor/src/azazel_processor/ src/azazel_processor/
 
-# Install dependencies
+# Install dependencies FROM THE LOCK FILE (Construction §1.1).
-RUN pip install --no-cache-dir pydantic==2.6.1 httpx==0.27.0 hebrew-tokenizer==2.3.0
+# Until 2026-10-04 this line named three packages by hand and let pip
+# choose every transitive one on the day of the build; and an unpinned
+# `pip install poetry-core` rode along into the image. The lock's main
+# group is rendered to hashed requirements and installed exactly:
+# --require-hashes refuses anything the lock did not record, --no-deps
+# refuses anything the lock did not list.
+COPY korban_processor/poetry.lock ./
+COPY scripts/lock_to_requirements.py /tmp/lock_to_requirements.py
+RUN python /tmp/lock_to_requirements.py poetry.lock > /tmp/requirements.txt && \
+    pip install --no-cache-dir --require-hashes --no-deps -r /tmp/requirements.txt && \
+    pip check
 
 # === RUNTIME STAGE ===
 FROM --platform=linux/amd64 python:3.12.2-slim

kushya_generator/pyproject.toml

@@ -0,0 +1,37 @@
+[project]
+name = "kushya-generator"
+version = "0.1.0"
+description = "Kushya Generator — fine-tuned challenge generation (Architecture §3.6). Scaffolding until Step 21."
+authors = [
+    {name = "Bezalel"}
+]
+requires-python = "==3.12.2"
+# Construction §1.4 — "Kushya generator additional". These are imported
+# lazily by fine_tune/train.py and inference/kushya_api.py; nothing in
+# the deployed images installs them. They are pinned here, and locked in
+# poetry.lock, so that the day Step 21 is built it is built from these.
+dependencies = [
+    "llama-cpp-python==0.2.55",
+    "peft==0.9.0",
+    "transformers==4.38.2",
+    "datasets==2.17.1",
+]
+
+[dependency-groups]
+dev = [
+    "pytest>=8.0,<9.0",
+]
+
+[tool.poetry]
+package-mode = false
+
+[build-system]
+requires = ["poetry-core>=2.0.0,<3.0.0"]
+build-backend = "poetry.core.masonry.api"
+
+[tool.pytest.ini_options]
+testpaths = ["test"]
+# The external backend goes through the offering protocol, and the
+# Korban Processor refuses to load without the disposal channel beside
+# it (azazel §14, property 1). Both sources must be importable.
+pythonpath = ["../korban_processor/src", "../azazel_processor/src"]

scripts/lock_to_requirements.py

@@ -0,0 +1,45 @@
+#!/usr/bin/env python3
+"""
+poetry.lock → a pip requirements file, exact and hashed.
+
+Construction §1.1: the lock file is the pin. A Dockerfile that installs
+`pydantic==2.6.1` by hand pins the three packages it names and lets pip
+choose every transitive one on the day of the build. This prints the
+`main` group of a poetry.lock — every package, its exact version, its
+environment marker if it has one, and the hashes the lock recorded — so
+that `pip install --require-hashes --no-deps -r` installs what was
+locked and nothing else.
+
+Usage: lock_to_requirements.py path/to/poetry.lock > requirements.txt
+"""
+
+import sys
+import tomllib
+
+
+def main(lock_path: str) -> int:
+    with open(lock_path, "rb") as f:
+        lock = tomllib.load(f)
+
+    lines = []
+    for pkg in sorted(lock["package"], key=lambda p: p["name"]):
+        if "main" not in pkg.get("groups", ["main"]):
+            continue
+        hashes = sorted({f["hash"] for f in pkg.get("files", [])})
+        if not hashes:
+            print(f"error: {pkg['name']} has no hashes in {lock_path}", file=sys.stderr)
+            return 1
+        requirement = f"{pkg['name']}=={pkg['version']}"
+        if pkg.get("markers"):
+            requirement += f" ; {pkg['markers']}"
+        lines.append(" \\\n    ".join([requirement] + [f"--hash={h}" for h in hashes]))
+
+    print("\n".join(lines))
+    return 0
+
+
+if __name__ == "__main__":
+    if len(sys.argv) != 2:
+        print(__doc__, file=sys.stderr)
+        sys.exit(2)
+    sys.exit(main(sys.argv[1]))

specs/shorashim_terumah.md

@@ -25,10 +25,10 @@ All versions pinned per Construction Specification §1.1.
 
 | Item | Version (Pinned) | Status | Notes |
 |------|---------|--------|-------|
-| Ubuntu | 24.04.1 LTS | ✅ | Free. Available from all providers. |
+| Ubuntu | 22.04 in the pipeline and engine images (`ubuntu:jammy-20240125`); 24.04 LTS on the cluster node (managed) | ✅ | Free. The korban and talmudic images are Debian 12, from their language base images. |
 | systemd | ships with Ubuntu | ✅ | Service management, cycle timers. |
-| Podman | 4.9.3 | ✅ | `apt install podman` — rootless containers for Sanhedrin isolation. |
+| Kubernetes / containerd | 1.35 / 2.2 (managed, Exoscale SKS) | ✅ | Runs the four images as one pod. Images are built with Docker Buildx. Podman is not used: Sanhedrin panels are processes in the pipeline's BEAM, not containers. |
-| PostgreSQL | 16.2 | ✅ | `apt install postgresql-16` — L3 append-only store. |
+| PostgreSQL | 17 (managed, Exoscale DBaaS; 17.11 on 2026-10-04) | ✅ | L3 append-only store. Patched by the provider. |
 | squashfs-tools | ships with Ubuntu | ✅ | For read-only L1 Torah filesystem. |
 | Caddy | latest stable | ✅ | Reverse proxy with auto-TLS for pe'ah endpoint. |
 | nftables | ships with Ubuntu | ✅ | Firewall. Configuration in Construction Spec §4.5. |
@@ -47,12 +47,12 @@ All versions pinned per Construction Specification §1.1. No ranges. No `+` suff
 | GHC (Haskell compiler) | 9.6.4 | ✅ | Free. `ghcup install ghc 9.6.4` |
 | Cabal (Haskell build tool) | 3.10 | ✅ | Free. Ships with ghcup. |
 | Erlang/OTP | 26.2.1 | ✅ | Free. `apt install erlang` or erlang-solutions repo. |
-| Rebar3 (Erlang build tool) | 3.23.0 | ✅ | Free. |
+| Rebar3 (Erlang build tool) | 3.22.0 | ✅ | Free. The version `mix local.rebar` installs for Elixir 1.16.1. |
 | Elixir | 1.16.1 | ✅ | Free. Must pair with OTP 26.2.1. |
 | Mix (Elixir build tool) | ships with Elixir | ✅ | Free. |
 | SWI-Prolog | 9.2.2 | ✅ | Free. `apt install swi-prolog` |
-| Python | 3.12.2 | ✅ | Free. Ships with Ubuntu 24.04. |
+| Python | 3.12.2 | ✅ | Free. From the `python:3.12.2-slim` base image. |
-| Poetry (Python package manager) | latest stable | ✅ | Free. Manages `poetry.lock`. |
+| Poetry (Python package manager) | 2.5.1 | ✅ | Free. Generates `poetry.lock` (lock-version 2.1); not installed in any image. |
 
 **All language runtimes available. No gaps.**
 
@@ -85,11 +85,13 @@ All pinned via lock files per Construction Specification §§1.3-1.5.
 ### Elixir (via `mix.lock`)
 | Package | Version | Status | Notes |
 |---------|---------|--------|-------|
-| phoenix | ~1.7.11 | ✅ | hex.pm (free) — for L2/pe'ah API |
+| jason | ~> 1.4.1 (locked 1.4.5) | ✅ | hex.pm (free) — JSON |
-| jason | ~1.4.1 | ✅ | hex.pm (free) — JSON |
+| ecto_sql | ~> 3.11.1 (locked 3.11.3; ecto 3.11.2) | ✅ | hex.pm (free) — database interface |
-| ecto | ~3.11.1 | ✅ | hex.pm (free) — database interface |
+| postgrex | ~> 0.22.3 (locked 0.22.4) | ✅ | hex.pm (free) — PostgreSQL driver |
-| postgrex | ~0.17.4 | ✅ | hex.pm (free) — PostgreSQL driver |
+| bandit | ~> 1.2 (locked 1.12.5) | ✅ | hex.pm (free) — HTTP server for the pe'ah / kodesh API |
-| telemetry | ~1.2.1 | ✅ | hex.pm (free) — metrics |
+| plug | ~> 1.15 (locked 1.20.3) | ✅ | hex.pm (free) — HTTP routing |
+| telemetry | locked 1.4.2 | ✅ | hex.pm (free) — transitive (Ecto, Bandit); not depended on directly |
+| sanhedrin | path dependency | ✅ | `../sanhedrin`, built by rebar3 into the same BEAM |
 
 ### Python (via `poetry.lock`)
 | Package | Version | Status | Notes |
@@ -97,7 +99,7 @@ All pinned via lock files per Construction Specification §§1.3-1.5.
 | httpx | 0.27.0 | ✅ | PyPI (free) — API calls |
 | pydantic | 2.6.1 | ✅ | PyPI (free) — data validation |
 | hebrew-tokenizer | 2.3.0 | ⚠️ | PyPI. Needs evaluation for biblical vs. modern Hebrew. |
-| pytest | latest stable | ✅ | PyPI (free) |
+| pytest | >=8.0,<9.0 (locked 8.4.2) | ✅ | PyPI (free) — dev group only; not in any image |
 | llama-cpp-python | 0.2.55 | ✅ | PyPI (free) — Mistral inference |
 | peft | 0.9.0 | ✅ | PyPI (free) — fine-tuning |
 | transformers | 4.38.2 | ✅ | PyPI (free) — model tooling |

specs/shorashim_vayakhel.md

@@ -17,16 +17,21 @@ Torah reference: Shemot 25:10 — *V'asu aron atzei shitim, amatayim vachetzi ar
 | Component | Language | Exact Version | Package Manager | Lock File |
 |-----------|---------|---------------|-----------------|-----------|
 | Shoresh Engine | Haskell | GHC 9.6.4 | Cabal 3.10 | `cabal.project.freeze` |
-| Sanhedrin | Erlang/OTP | OTP 26.2.1 | rebar3 3.23.0 | `rebar.lock` |
+| Sanhedrin | Erlang/OTP | OTP 26.2.1 | rebar3 3.22.0 | `rebar.lock` |
 | Vav Pipeline | Elixir | 1.16.1 / OTP 26.2.1 | Mix | `mix.lock` |
 | Talmudic Engine | SWI-Prolog | 9.2.2 | swipl packs | — |
 | Korban Processor | Python | 3.12.2 | pip + poetry | `poetry.lock` |
+| Azazel Processor | Python | 3.12.2 | pip + poetry | `poetry.lock` |
 | Kushya Generator | Python | 3.12.2 | pip + poetry | `poetry.lock` |
-| Database | PostgreSQL | 16.2 | apt | — |
+| Database | PostgreSQL | 17 (17.11 on 2026-10-04) | managed (Exoscale DBaaS) | — |
-| Container | Podman | 4.9.3 | apt | — |
+| Container | Kubernetes / containerd | 1.35 / 2.2 (1.35.3 / 2.2.2 on 2026-10-04) | managed (Exoscale SKS); images built with Docker Buildx | — |
-| OS | Ubuntu | 24.04.1 LTS | apt | — |
+| OS — pipeline and engine images | Ubuntu | 22.04 (`ubuntu:jammy-20240125`) | base image tag | — |
+| OS — korban and talmudic images | Debian | 12 (`python:3.12.2-slim`, `swipl:9.2.2`) | base image tag | — |
+| OS — cluster node | Ubuntu | 24.04 LTS (24.04.4 on 2026-10-04) | managed (Exoscale SKS) | — |
 
-Every dependency is version-pinned. Lock files are committed. `cabal.project.freeze` pins all transitive Haskell dependencies. `rebar.lock` pins all Erlang deps. `mix.lock` pins all Elixir deps. `poetry.lock` pins all Python deps. No `>=`. No `+`. No ranges. The aron is two and a half cubits.
+Every language dependency is pinned by a committed lock file, and every image is built from its lock. `cabal.project.freeze` pins all transitive Haskell dependencies. `rebar.lock` pins all Erlang deps. `mix.lock` pins all Elixir deps. `poetry.lock` pins all Python deps, and the Korban image installs the lock's `main` group by exact version and hash (`scripts/lock_to_requirements.py`) — nothing is chosen on the day of the build. A manifest may state a compatible range (`~>` in `mix.exs`, `>=8.0,<9.0` for pytest); the lock is what is built, and a lock has no ranges. Base images are pinned by tag.
+
+What is rented is not ours to cut to the cubit: the database, Kubernetes and the node's operating system are managed services, pinned here to a major version and patched by the provider. The versions observed are recorded above with their date. Everything the builder cuts is exact. The aron is two and a half cubits.
 
 ### 1.2 L1 Torah Text Source
 
@@ -102,15 +107,24 @@ datasets = "2.17.1"
 # mix.exs
 defp deps do
   [
-    {:phoenix, "~> 1.7.11"},
     {:jason, "~> 1.4.1"},
-    {:ecto, "~> 3.11.1"},
+    {:sanhedrin, path: "../sanhedrin", manager: :rebar3},
+    {:ecto_sql, "~> 3.11.1"},
     {:postgrex, "~> 0.22.3"},
-    {:telemetry, "~> 1.2.1"}
+    {:bandit, "~> 1.2"},
+    {:plug, "~> 1.15"}
   ]
 end
 ```
 
+```
+# mix.lock (the versions built — excerpt)
+jason 1.4.5 · ecto_sql 3.11.3 · ecto 3.11.2 · postgrex 0.22.4
+bandit 1.12.5 · plug 1.20.3 · telemetry 1.4.2 (transitive) · jsx 3.1.0
+```
+
+The HTTP layer (Bigdei Kodesh) is Plug served by Bandit; Phoenix is not a dependency. Telemetry is not depended on directly — it arrives with Ecto and Bandit.
+
 ---
 
 ## 2. MIDOT — Performance Specifications
@@ -597,7 +611,7 @@ No secrets in environment variables. No secrets in configuration files. No secre
 
 # /etc/caddy/Caddyfile
 shorashim.example.org {
-    reverse_proxy localhost:4000  # Phoenix endpoint
+    reverse_proxy localhost:4000  # Bigdei Kodesh (Plug on Bandit)
 
     header {
         Strict-Transport-Security "max-age=63072000; includeSubDomains"

vav_pipeline/lib/vav_pipeline/doorpost.ex

@@ -175,7 +175,7 @@ defmodule VavPipeline.Doorpost do
   # changes; the update is a deliberate operator commit. A bare
   # hash-update commit (without a corresponding spec change in the
   # same commit) is itself a drift signal.
-  @expected_hash "39b66c3156d58fee5d0790008db4a542f90ed3007786a7c8b646edeb75e2f80e"
+  @expected_hash "1cd070792fc101c5a526680cf8a8116d586151b969a1ba2cf3924e5f02d3cc40"
 
   @doc "Return the list of files that constitute the category-grade specification."
   @spec files() :: [String.t()]