From a reading of the gate's documents (2026-10-21):
- AGENTS.md: Steps 14 and 15 shown Pending while the Port and both
sockets have carried live traffic since the gate was built → Done,
with what carries them; "next build task" now points at the open
items, the phase tables being complete.
- README.md: the repository tree omitted azazel_processor,
kushya_generator, mesorah, src/tools and scripts → listed, each in a
line.
- deploy/ARCHITECTURE.md: the judgment path holds no model, said in
writing — the examination is Python patterns and Prolog rules, the
judges consult that Prolog; kushya_generator (a fine-tuned model in
this repo, not deployed, not wired) is an OFFERER whose output is
examined, never a component the bedikah, the engine or a judge
consults. The kohen is not the offerer. azazel_processor listed.
- The map: the repository is public; eleven files named the ingress
NLB's literal address and five the kohen's kubeconfig path. Docs now
use the domains (git.bikoret.ch, bikoret.ch) or "<NLB-IP>" with the
kubectl query that answers it; the kubeconfig is "$KUBECONFIG" /
"$HOME/.kube/<your-cluster>.yaml". gitea-public-apply.sh takes NLB
from the environment. None of it was a secret; all of it was a map.
- OTP pin: checked, not changed — the segfault in the build log was a
source-built OTP 26.2.1 on macOS; the image is hexpm's 26.2.1 with
ERL_FLAGS +JMsingle.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The claude.ai connector ran the OAuth flow against a server in
static-token mode, which has no OAuth endpoints: the login ended on a
404. The proper form is gitea-mcp's -oauth mode, where each user
authorizes with their own Gitea account; it needs both origins public
over HTTPS and Gitea's ROOT_URL to be that origin.
- gitea-ingress.yaml: git.bikoret.ch → temple-council/gitea, TLS
- gitea-public-patch.yaml: ROOT_URL/DOMAIN/SSH_DOMAIN = git.bikoret.ch
(were a name that never resolved and a released NLB IP)
- gitea-mcp-deployment.yaml: -oauth -oauth-public-url
https://mcp.bikoret.ch -H https://git.bikoret.ch, no static token,
probes on /healthz
- gitea-mcp-ingress.yaml: host mcp.bikoret.ch (mcp.shorashim.ch retired)
- gitea-public-apply.sh / gitea-public-verify.sh: the operator's
DNS-gated apply and read-only verification (also in ~/.local/bin)
- KOHEN.md, deploy/ARCHITECTURE.md: the new doors and the Gitea OAuth2
app ("Claude", PKCE, claude.ai + Claude Code redirect URIs)
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
