Phase 5 deployment: Dockerfiles, K8s manifests, halt monitor (Steps 33, 36)

Shemot 40:33 — Vay'khal Moshe et ham'lakhah.
The builder completes the work. The vessel is ready for transport.

Step 33 — Deployment configuration:
- Dockerfiles for all 4 components:
  - vav_pipeline: Elixir 1.16.1/OTP 26.2.1 release with Sanhedrin
  - shoresh_engine: GHC 9.6.4 binary
  - talmudic_engine: SWI-Prolog 9.2.2
  - korban_processor: Python 3.12.2 with pydantic
- Kubernetes manifests for Exoscale SKS (ch-gva-2):
  - Namespace, ConfigMap, Secrets template
  - L1 Torah PV/PVC (read-only mount)
  - Manna provision PVC (kohen writes, system reads)
  - Deployment: vav-pipeline + 3 sidecars, shared volumes
  - Service: ClusterIP + LoadBalancer with Exoscale NLB
  - Init container runs Ecto migrations (VavPipeline.Release)

Step 36 — Halt monitor (esh tamid):
- GenServer watches for three cardinal sins
- halt!/3 immediately halts system, sounds Chatzotzrot war signal
- Permanent audit log — halt events never deleted
- resolve/1 requires explicit operator action to resume
- alive?/0 for morning tamid verification
- 13 tests: alive check, 3 halt types, resolution, audit log,
  chatzotzrot war signal integration
- Added to supervision tree

All 219 Elixir + 19 L3 + 195 Prolog + 33 Haskell = 447+ tests, 0 failures

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

deploy/k8s/configmap.yaml

@@ -0,0 +1,27 @@
+# Shorashim ConfigMap — non-secret configuration
+# Construction spec §4.4: Tuning constants
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: shorashim-config
+  namespace: shorashim
+data:
+  # L1 mount point — read-only Torah filesystem
+  L1_MOUNT_POINT: "/mnt/torah"
+
+  # Manna provision file location
+  MANNA_PROVISION_FILE: "/var/lib/shorashim/manna/today.json"
+
+  # Talmudic Engine socket
+  TALMUDIC_SOCKET_PATH: "/tmp/shorashim/talmudic.sock"
+
+  # Shabbat location — Zurich (Construction spec §4.4)
+  SHABBAT_LATITUDE: "47.3769"
+  SHABBAT_LONGITUDE: "8.5417"
+  SHABBAT_TIMEZONE_OFFSET: "1"
+
+  # Cycle boundary check interval (ms)
+  CYCLE_BOUNDARY_CHECK_INTERVAL_MS: "60000"
+
+  # Pipeline latency budget (ms) — Construction spec §2.5
+  PIPELINE_LATENCY_BUDGET_MS: "5000"

deploy/k8s/deployment.yaml

@@ -0,0 +1,153 @@
+# Shorashim Deployment — the mishkan
+#
+# Architecture §5.1: All inter-component communication uses
+# JSON over Unix domain sockets or Erlang distribution protocol.
+# No HTTP between internal components.
+#
+# The vav_pipeline (BEAM) runs the Sanhedrin, Chatzotzrot,
+# AreiMiklat, EglahArufah, Bikurim, MannaLedger, ShabbatTimer.
+# The shoresh-engine runs as a sidecar (Erlang Port).
+# The talmudic_engine runs as a sidecar (Unix socket).
+# The korban_processor runs as a sidecar (invoked by pipeline).
+#
+# L1 is mounted read-only into all containers.
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: shorashim
+  namespace: shorashim
+  labels:
+    app.kubernetes.io/name: shorashim
+    app.kubernetes.io/version: "0.1.0"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: shorashim
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: shorashim
+    spec:
+      # --- VOLUMES ---
+      volumes:
+        - name: l1-torah
+          persistentVolumeClaim:
+            claimName: l1-torah-pvc
+            readOnly: true
+        - name: manna
+          persistentVolumeClaim:
+            claimName: manna-pvc
+        - name: talmudic-socket
+          emptyDir: {}
+        - name: tmp-shorashim
+          emptyDir: {}
+
+      # --- INIT CONTAINER: Run L3 migrations ---
+      initContainers:
+        - name: migrate
+          image: shorashim/vav-pipeline:latest
+          command: ["./app/bin/vav_pipeline", "eval", "VavPipeline.Release.migrate()"]
+          envFrom:
+            - configMapRef:
+                name: shorashim-config
+            - secretRef:
+                name: shorashim-secrets
+          volumeMounts:
+            - name: l1-torah
+              mountPath: /mnt/torah
+              readOnly: true
+
+      # --- CONTAINERS ---
+      containers:
+        # === VAV PIPELINE (main) ===
+        - name: vav-pipeline
+          image: shorashim/vav-pipeline:latest
+          ports:
+            - containerPort: 4000
+              name: http
+          envFrom:
+            - configMapRef:
+                name: shorashim-config
+            - secretRef:
+                name: shorashim-secrets
+          env:
+            - name: SHORESH_ENGINE_BINARY
+              value: "/home/shorashim/shoresh-engine"
+          volumeMounts:
+            - name: l1-torah
+              mountPath: /mnt/torah
+              readOnly: true
+            - name: manna
+              mountPath: /var/lib/shorashim/manna
+            - name: talmudic-socket
+              mountPath: /tmp/shorashim
+            - name: tmp-shorashim
+              mountPath: /tmp
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "250m"
+            limits:
+              memory: "1Gi"
+              cpu: "1000m"
+          livenessProbe:
+            httpGet:
+              path: /kodesh/health
+              port: 4000
+            initialDelaySeconds: 30
+            periodSeconds: 60
+          readinessProbe:
+            httpGet:
+              path: /kodesh/health
+              port: 4000
+            initialDelaySeconds: 10
+            periodSeconds: 10
+
+        # === SHORESH ENGINE (sidecar) ===
+        - name: shoresh-engine
+          image: shorashim/shoresh-engine:latest
+          volumeMounts:
+            - name: l1-torah
+              mountPath: /mnt/torah
+              readOnly: true
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "100m"
+            limits:
+              memory: "512Mi"
+              cpu: "500m"
+
+        # === TALMUDIC ENGINE (sidecar) ===
+        - name: talmudic-engine
+          image: shorashim/talmudic-engine:latest
+          volumeMounts:
+            - name: l1-torah
+              mountPath: /mnt/torah
+              readOnly: true
+            - name: talmudic-socket
+              mountPath: /tmp/shorashim
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "100m"
+            limits:
+              memory: "512Mi"
+              cpu: "500m"
+
+        # === KORBAN PROCESSOR (sidecar) ===
+        - name: korban-processor
+          image: shorashim/korban-processor:latest
+          volumeMounts:
+            - name: l1-torah
+              mountPath: /mnt/torah
+              readOnly: true
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "100m"
+            limits:
+              memory: "512Mi"
+              cpu: "500m"

deploy/k8s/l1-volume.yaml

@@ -0,0 +1,43 @@
+# L1 Torah Filesystem — Read-Only Volume
+# Construction spec §1.2: SHA-256 verified, mounted read-only
+#
+# In production, L1 is a read-only filesystem (squashfs or similar)
+# containing the Torah text. It is mounted into all pods that need it.
+#
+# For Exoscale SKS, this uses a PersistentVolume backed by
+# Exoscale Block Storage. The L1 data is loaded once and never modified.
+#
+# Step 34: Mount L1 filesystem read-only
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: l1-torah-pv
+  labels:
+    app.kubernetes.io/name: l1-torah
+spec:
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadOnlyMany
+  persistentVolumeReclaimPolicy: Retain
+  # For initial setup, use hostPath. In production, replace with
+  # Exoscale Block Storage CSI or pre-loaded ConfigMap/Secret.
+  hostPath:
+    path: /mnt/torah
+    type: DirectoryOrCreate
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: l1-torah-pvc
+  namespace: shorashim
+spec:
+  accessModes:
+    - ReadOnlyMany
+  resources:
+    requests:
+      storage: 1Gi
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: l1-torah

deploy/k8s/manna-volume.yaml

@@ -0,0 +1,16 @@
+# Manna Provision Volume
+# The kohen/treasurer writes today.json to this volume.
+# The vav_pipeline reads it. Provision is external to the system.
+# Shemot 16:4 — d'var yom b'yomo.
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: manna-pvc
+  namespace: shorashim
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 100Mi

deploy/k8s/namespace.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: shorashim
+  labels:
+    app.kubernetes.io/name: shorashim
+    app.kubernetes.io/part-of: shorashim

deploy/k8s/secrets.yaml

@@ -0,0 +1,17 @@
+# Shorashim Secrets — template only
+# NEVER commit actual secret values to git.
+# Apply with: kubectl apply -f - after filling in values.
+#
+# The DATABASE_URL connects to Exoscale PostgreSQL (temple-council-db)
+# in ch-gva-2 zone. Retrieve credentials from:
+#   exo dbaas show temple-council-db --zone ch-gva-2
+apiVersion: v1
+kind: Secret
+metadata:
+  name: shorashim-secrets
+  namespace: shorashim
+type: Opaque
+stringData:
+  # PostgreSQL connection for L3 Oral Tradition
+  # Format: ecto://user:password@host:port/database?sslmode=require
+  DATABASE_URL: "REPLACE_WITH_ACTUAL_DATABASE_URL"

deploy/k8s/service.yaml

@@ -0,0 +1,48 @@
+# Shorashim Services
+# Operations spec §1.1: Four access tiers
+#   - Pe'ah (public, no auth)
+#   - Machaneh Leviyah (authenticated)
+#   - Chatzer (full access)
+#   - Kodesh (operator, mTLS)
+#
+# All tiers go through a single Service → vav-pipeline port 4000
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: shorashim
+  namespace: shorashim
+  labels:
+    app.kubernetes.io/name: shorashim
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: shorashim
+  ports:
+    - port: 80
+      targetPort: 4000
+      protocol: TCP
+      name: http
+---
+# External access via LoadBalancer
+# For Exoscale SKS, this provisions an Exoscale NLB
+apiVersion: v1
+kind: Service
+metadata:
+  name: shorashim-external
+  namespace: shorashim
+  labels:
+    app.kubernetes.io/name: shorashim
+  annotations:
+    # Exoscale NLB annotations
+    service.beta.kubernetes.io/exoscale-loadbalancer-zone: "ch-gva-2"
+    service.beta.kubernetes.io/exoscale-loadbalancer-name: "shorashim"
+spec:
+  type: LoadBalancer
+  selector:
+    app.kubernetes.io/name: shorashim
+  ports:
+    - port: 80
+      targetPort: 4000
+      protocol: TCP
+      name: http