From a reading of the gate's documents (2026-10-21):
- AGENTS.md: Steps 14 and 15 shown Pending while the Port and both
sockets have carried live traffic since the gate was built → Done,
with what carries them; "next build task" now points at the open
items, the phase tables being complete.
- README.md: the repository tree omitted azazel_processor,
kushya_generator, mesorah, src/tools and scripts → listed, each in a
line.
- deploy/ARCHITECTURE.md: the judgment path holds no model, said in
writing — the examination is Python patterns and Prolog rules, the
judges consult that Prolog; kushya_generator (a fine-tuned model in
this repo, not deployed, not wired) is an OFFERER whose output is
examined, never a component the bedikah, the engine or a judge
consults. The kohen is not the offerer. azazel_processor listed.
- The map: the repository is public; eleven files named the ingress
NLB's literal address and five the kohen's kubeconfig path. Docs now
use the domains (git.bikoret.ch, bikoret.ch) or "<NLB-IP>" with the
kubectl query that answers it; the kubeconfig is "$KUBECONFIG" /
"$HOME/.kube/<your-cluster>.yaml". gitea-public-apply.sh takes NLB
from the environment. None of it was a secret; all of it was a map.
- OTP pin: checked, not changed — the segfault in the build log was a
source-built OTP 26.2.1 on macOS; the image is hexpm's 26.2.1 with
ERL_FLAGS +JMsingle.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Headers X-Bikoret-Key / -Rebuke / -Verdict / -Bedikah; the `bikoret`
object and the "— bikoret …" fringe on a gate reply; environment
variables BIKORET_*; the image user and paths (/home/bikoret,
/tmp/bikoret, /var/lib/bikoret/manna, /etc/bikoret/secrets,
/opt/bikoret/spec); the tmp-bikoret pod volume; local databases
bikoret_dev/_test. Kubernetes resource names, the shorashim_app role and
the domain are unchanged (Tamid §1.1, "the names that still carry the
old word"). Doorpost c963c4fe…. Elixir 604/0, L3 10/0, korban 295,
Prolog bedikah 44/44. Gitea repo renamed heaviness510/bikoret (old URL
redirects).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Three NLBs became one (185.19.28.170, ingress-nginx).
Shorashim: `shorashim-external` (NLB 185.19.29.180, NodePort 30923)
is replaced by an Ingress — a host-less catch-all (works by IP, no DNS)
plus a `shorashim.ch` rule ready for the A record; TLS deliberately not
requested until the name resolves. Sanhedrin-length proxy timeouts.
The watch behind the ingress (completes tablet 46): the TCP peer is now
the ingress controller, so Mishmar.peer/1 takes the caller from
X-Real-IP — only when the peer is inside TRUSTED_PROXIES (the pod
network, configmap); from anyone else the header is the caller's own
claim and is ignored. The ingress Service was already
externalTrafficPolicy: Local with its health-check port open, so the
caller's address arrives without the security-group change the direct
route needed. Verified live: the 11th knock is 429, a forged X-Real-IP
is still 429, and in the same minute the old route (pod sees the node)
was a different subject.
Gitea: no name of its resolves, so it rides the controller's TCP
passthrough on the same NLB — :3000 → gitea:80, :22 → gitea:22
(ingress-tcp-services.yaml), on the two NodePorts the security group
already allowed. gitea-mcp now reaches Gitea over the cluster network
instead of out through an NLB and back.
Tamid §1.1 note, KOHEN.md, AGENTS.md. Doorpost e4e3d56d… → a2ec3842….
Elixir 539/0 (L3 on and off).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
