ROOT CAUSE (kohen Day-3 escalation):
None of the four Dockerfiles pinned --platform. Build on Apple Silicon
shipped arm64-only images to a registry consumed by amd64 SKS nodes.
Init container failed exec format error before producing logs.
DOCKERFILE FIX (defense in depth):
Pin --platform=linux/amd64 on every FROM line in all four Dockerfiles.
The build artifact now self-corrects regardless of build host.
AZAZEL CO-RESIDENCE (anomaly the kohen flagged):
Azazel L3 migration shipped (20260428…create_azazel_records.exs) but
no separate container existed. Reading the code: azazel_processor is
imported by korban_processor.external_offering at runtime in the same
Python process — not a separate process. Dockerfile.korban_processor
now COPYs azazel_processor/src/ alongside korban_processor.
Documented in the Dockerfile (AZAZEL CO-RESIDENT section) and in
deployment.yaml. Both containers (vav-pipeline + korban-processor)
now mount the shared tmp-shorashim volume so the Python→Elixir file
bridge (azazel_ingest.ex polls /tmp/shorashim/azazel/pending_l3/)
works end-to-end.
CANONICAL BUILD/PUSH (scripts/build_and_push.sh):
- Pins linux/amd64 by default; PLATFORMS env for multi-arch
- Pre-flight checks (repo root, buildx, registry login)
- Builds and pushes all four images with one command
- Closes the gap KOHEN_PROMPT.md gate 0i would otherwise leave open
KOHEN.md DRIFT (kohen recorded these as anomalies through Day 1-3):
- Line 58 hash fragment 99bbd07a…0a0187b → 99bbd07a…4ea377 (correct)
- Inheritance table: "Not yet created" claims rewritten as
"Verify before assuming" — a prior partial setup may have left
state, and the kohen prompt requires verifying not assuming
- L1 PV row: marked NOT REQUIRED (L1 baked into images)
- §Day 3a ConfigMap recipe marked vestigial (kept as comment)
- §Day 3b: removed manna-volume.yaml from kubectl apply list
(deployment uses emptyDir; PVC is for a future move)
- §Day 3c: "5 containers" → "4 containers + 1 init"
- §Day 3 fail-mode list expanded with the four most common causes,
in order, including exec format error → gate 0i
KOHEN_PROMPT.md:
- Gate 0f corrected to four images (talmudic-engine is image #3;
azazel is co-resident in korban-processor not a separate image)
- Gate 0i added: image-architecture vs node-architecture verification
before Day 1, with kubectl one-liner and docker manifest inspect
per image. Drift handler in the gates section: 0i FAIL → escalate
to builder, do not begin Day 1.
NO SPEC FILES TOUCHED:
Doorpost.verify_identity() still :ok — none of these files are in
@spec_files. No atomic spec+hash commit needed.
NEXT STEP FOR THE KOHEN:
Once these images are rebuilt and pushed via scripts/build_and_push.sh
(by anyone with the Harbor CLI secret + a working docker daemon),
restart from Day 1. Existing DB role shorashim_app, ALTER DEFAULT
PRIVILEGES, rotated DATABASE_URL, shorashim-config, and shorashim-
registry secret all remain valid across the restart.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Shemot 25:16 — v'natata el ha-aron et ha-edut asher eten elekha.
The edut placed in the aron must be complete. The Masoretic
tradition preserves every letter, every enlarged letter, every
ketiv/qere pair — because each carries meaning the scribe cannot
reconstruct.
The previous build_l1.py silently dropped:
- enlarged letters encoded as <seg type="x-large"> nested in <w>
→ the Shema was corrupt: שמ instead of שמע, אח instead of אחד
→ the middle letter of Torah was corrupt: גח instead of גחון
→ the Zelophchad nun was missing: משפט instead of משפטן
- ketiv/qere dual readings encoded as <note type="variant">/<rdg type="x-qere">
→ the spec committed to preserving both; the code returned []
- smikhut (construct state) pairs marked in morphology codes
→ the spec committed to extracting them; the code returned []
Fixes:
- collect_word_text() walks all nested <seg> children of <w> and records
large_letters / small_letters metadata with character offsets.
- parse_verse() recognizes <w type="x-ketiv"> followed by <note>, extracts
both the ketiv and the qere readings, stores a ketiv_qere list on the verse.
- _extract_smikhut() scans words for construct-state morph codes
(ending in "c" on N/A primary segments, excluding pronominal suffixes)
and records construct/absolute pairs.
- L1 SHA-256 hash updated everywhere: integrity.sha256, l1_reader.ex,
shoresh-engine's Luchot.Firmware, its test, KOHEN.md.
Torah-wide results after fix:
- 4 enlarged letters preserved (was 0): Shema ayin, Shema dalet,
gachon vav (middle of Torah), Zelophchad nun
- 67 ketiv/qere pairs captured (was 0)
- 9,203 smikhut pairs extracted (was 0)
Elixir updates:
- l1_reader.ex: normalize_verse now surfaces ketiv_qere, smikhut,
and per-word large_letters/small_letters. New type specs. New
extract_large_letters/1 helper. extract_ketiv_qere and
extract_smikhut now return real data instead of [].
- step31_shema_test.exs: replaced placeholder asserts with real
integrity checks. Four new tests verify the Shema word is complete
(שמע not שמ), echad is complete (אחד not אח), the enlarged
letters are marked, the middle letter of Torah is preserved,
and ketiv/qere pairs from Bereishit 8:17 are both captured.
Build script:
- build_l1.py no longer rmtrees the entire l1/ directory (preserves
l1/README.md). Only regenerates torah/ + build_report.json +
integrity.sha256.
- Accepts SHORASHIM_SOURCE_DATA env var or CLI arg for morphhb path.
Test counts:
- Elixir: 260 (was 254), 0 failures
- Haskell: 33, 0 failures
- Prolog: 195, 0 failures
The system that can hear שמע correctly has passed its own shema test.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Shemot 25:16 — v'natata el ha-aron et ha-edut asher eten elekha.
"Place into the aron the testimony (edut) which I shall give you."
L1 is the engraved form — 5,853 verses with te'amim, ketiv/qere,
roots, and gematria. It is not a build artifact to be regenerated
on demand; it IS the specification the system references. Someone
cloning the repo should receive the edut, not a recipe to produce it.
Shemot 34:1 — p'sol lekha shnei luchot avanim ... v'khatavti.
"Carve for yourself two tablets of stone ... and I will write."
The carver provides the stone (raw morphhb source). The Source
writes the content (the engraved Torah text). What belongs in
the aron is the engraved form. The quarry does not enter the
mishkan.
Changes:
- Remove l1/ from .gitignore (it IS the edut, not a build artifact)
- Move data/morphhb/ out to ~/shorashim-source-data/morphhb/
(the quarry lives outside the tabernacle)
- scripts/build_l1.py: fix path computation after earlier relocation
to scripts/, read source path from $SHORASHIM_SOURCE_DATA or CLI
arg, with default ~/shorashim-source-data/morphhb
- Add .claude/ to .gitignore (local Claude Code settings)
- Remove empty src/tools/ leftover
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- scripts/conversation_search.py was a personal dev tool (FTS5
search over Claude conversation history). Moved to ~/dev-tools/.
Has nothing to do with shorashim's spec or implementation.
- .DS_Store was already in .gitignore; deduplicated and removed
the macOS metadata files from the working tree.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- transcripts/ moved to ~/shorashim-transcripts (separate from code repo)
Added to .gitignore so it stays out
- src/l1_aron/build_l1.py → scripts/build_l1.py
- src/tools/conversation_search.py → scripts/conversation_search.py
- Removed empty src/ scaffolding (l0_luchot, sanhedrin, shema_layer,
shoresh_engine, urim_v_tumim — all .gitkeep stubs from an earlier
layout, never used; the real code lives in shoresh-engine/,
sanhedrin/, vav_pipeline/, etc.)
- Removed Untitled/ and erl_crash.dump (untracked junk)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
