Compare commits

...
Author SHA1 Message Date
Scott KarpandClaude Fable 5.1 53778f372e Gitea MCP connector: MCP OAuth mode on bikoret.ch
The claude.ai connector ran the OAuth flow against a server in
static-token mode, which has no OAuth endpoints: the login ended on a
404. The proper form is gitea-mcp's -oauth mode, where each user
authorizes with their own Gitea account; it needs both origins public
over HTTPS and Gitea's ROOT_URL to be that origin.

- gitea-ingress.yaml: git.bikoret.ch → temple-council/gitea, TLS
- gitea-public-patch.yaml: ROOT_URL/DOMAIN/SSH_DOMAIN = git.bikoret.ch
  (were a name that never resolved and a released NLB IP)
- gitea-mcp-deployment.yaml: -oauth -oauth-public-url
  https://mcp.bikoret.ch -H https://git.bikoret.ch, no static token,
  probes on /healthz
- gitea-mcp-ingress.yaml: host mcp.bikoret.ch (mcp.shorashim.ch retired)
- gitea-public-apply.sh / gitea-public-verify.sh: the operator's
  DNS-gated apply and read-only verification (also in ~/.local/bin)
- KOHEN.md, deploy/ARCHITECTURE.md: the new doors and the Gitea OAuth2
  app ("Claude", PKCE, claude.ai + Claude Code redirect URIs)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-10-19 21:55:05 +00:00
Scott KarpandClaude Fable 5.1 861cd4e64e engine: the verse facts are the whole scroll, derived from L1
torah_text.pl held 32 hand-written verses from Phase 1 — "the reasoning
layer's view of the specification". With the cycle and the Sanhedrin
now consulting the engine on every question (2026-10-19), that view
showed: any root it knew lit the same handful, and bereishit 1:1 and
devarim 6:4 were read in the same eleven verses.

- scripts/build_engine_verses.py writes
  talmudic_engine/src/specification/l1_verses.pl from l1/torah: every
  verse, each word's shoresh as the engine names it (Hebrew → letter
  names, finals folded), the consonantal text as gloss, and the SHA-256
  of the L1 files read in the header. `--check` exits 1 when the facts
  lag the scroll; build_and_push.sh runs it beside the Doorpost check.
- torah_text.pl includes the generated file; the hand facts are gone.
  L1's roots are authoritative where the hand facts differed (Israel
  שרה, the Name הוה).
- interpret.pl: over 5,853 verses a common root lights hundreds, so the
  reading ranks verses by how many of the case's roots each carries and
  keeps the top 12 in canonical order; the coupling trace names only the
  verses the reading cites.

Local, over the full scroll: bereishit 1:1 → itself, Devarim 4:32,
Bereishit 2:4 …; devarim 6:4 → itself, Shemot 3:18, Devarim 4:1 …;
shabbat roots → Bereishit 2:3, Shemot 20:8, 20:11, 31:13. interpret
15 ms, challenge 10 ms (now finds a kushya for the Shema), resolve
24 ms. Prolog 7 suites green (middot 2.9 s — pairwise scans over the
scroll). 5,853 verses loaded, 49,542 root occurrences.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-10-19 21:37:29 +00:00
Scott KarpandClaude Fable 5.1 4e0eb2f983 cycle: the engine is consulted on every resolved question
The Talmudic route ran only on a teiku from ki_tov, and ki_tov returns
teiku only for a root with no Hebrew — which the Shoresh Engine never
leaves. So the engine had never read a real question. Now every cycle
that resolves tov consults it with the roots it activated
(consult_engine/2, on the socket directly — never the client's stub;
an unreachable engine is reported "not consulted" and the cycle's
answer stands). A tamid probe does not consult.

The reading is said plainly (engine_reading_text/1): "Talmudic Engine
(resolved): 11 verse(s): Bereishit 1:1, …; 4 mitzvah/mitzvot:
know_hashem (1, positive), …" — the engine's own term form is no longer
pasted into a reader's answer. The verses join the sources as
references ("Bereishit 1:3", engine form beside), the L3 interpretation
carries them in torah_references with the reading in its reasoning and
processing_component "bereishit_cycle+talmudic_engine".

Proven against the engine running locally on its socket, bereishit 1:1
through VavPipeline.process/1: consulted :ok, 11 verses in the answer
and the sources, L3 torah_references 12; engine stopped → "not
consulted (Cannot connect)", answer stands, L3 component
bereishit_cycle; tamid probe → not consulted. Elixir 632/0.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-10-19 19:02:51 +00:00
Scott KarpandClaude Fable 5.1 ab6ca1ebcf cycle: the Talmudic routing sends roots the engine can read
route_if_unresolved sent the roots' Hebrew (ברא) to the Talmudic
Engine, whose verse facts name roots by letter (bet_resh_aleph, read
from "bet-resh-aleph"). Since Step 14 every interpretation the cycle
took from the engine was "resolved" over an empty trace — 0 verses,
0 mitzvot — and so was every case it escalated to the Sanhedrin. Now
the names go up (BereishitCycle.engine_root_name/1, from tablet 55's
third commit), on both the interpretation and the escalation.

Proven against the engine running locally on its socket, with the
roots the cycle itself activates for bereishit 1:1:
  HEBREW (as before): status=resolved verses=0  mitzvot=0
  NAMES  (now):       status=resolved verses=11 mitzvot=4
Elixir 632/0. The unresolved route cannot be driven in the test env
(it needs the Shoresh Engine to leave a root ungrounded); the live
proof is a pe'ah question with an ungroundable Hebrew word.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-10-19 18:45:06 +00:00
Scott KarpandClaude Fable 5.1 e01181959d tablet 55, fourth: the engine answers the whole dialectic over the wire
Live after vav :4bffa01e the judges consulted with roots the engine
could read — interpret found 4 mitzvot and 11 verses for bereishit 1:1
— and the other two seats still said teiku. The engine had no
"challenge" action at all (process_json_line failed and the socket
fell silent), and a resolve that SUCCEEDED came back
UNEXPECTED_RESPONSE because response(ok, resolved_accepted, ...) had
no JSON clause. Both pre-existing; both invisible until a judge asked.

- api.pl: request(challenge, ...) — interpret, then a kushya against
  it → resolved_challenged with the kushya; none → no_challenge with
  the reading.
- json_bridge.pl: interpreted | resolved_accepted | no_challenge share
  the "resolved" JSON; resolved_challenged now carries the
  interpretation's verses and mitzvot (a judge rejecting on the kushya
  cites its ground); resolved_synthesized and no_interpretation gain
  clauses.
- reasoning_test.pl: dialectic_over_the_wire — all three actions
  answer; no roots → resolved on an empty trace (the judge abstains).

Prolog: 7 suites green (bedikah 45, halt 49, middot 47, mitzvot 42,
phase3 28, reasoning 18, tzaraat 34). Local probe: interpret /
challenge / resolve each → resolved, 11 verses, 4 mitzvot.

Live proof waits for tomorrow's manna: today's five panels were all
spent on verification (503 MANNA_DEPLETED, as specified).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-10-19 18:25:17 +00:00
Scott KarpandClaude Fable 5.1 4bffa01e0e tablet 55, third: roots the engine can read; abstentions count; an empty trace is no ground
Live after the second commit (vav :046010f0): a monetary case naming
bereishit 1:1 convened three judges and came back "accepted" — the
interpret seat said "resolved (5 roots, 0 verses)" with
reading(mitzvot_count(0),verse_count(0),grounded_in([],[])), the other
two seats said teiku, and one accept beat two abstentions (the reply
showed majority 1, minority 2). Three defects the tests could not see:

- The engine names roots by letter (bet_resh_aleph; json_bridge reads
  "bet-resh-aleph") and the pipeline sent it the Hebrew, which its
  verse facts never match. BereishitCycle.engine_root_name/1 builds
  the engine's name from the Shoresh Engine's letter names or, for the
  L1 fallback, from the Hebrew with finals folded; the router sends
  that. (The cycle's own Talmudic routing still sends the Hebrew —
  recorded, not changed here: it alters /peah/ask and needs its own
  verification.)
- judge.erl: "resolved" with no verse and no mitzvah is a reading
  coupled to nothing (avodah_zarah.pl Form 2); the judge abstains and
  says "resolved on an empty trace; nothing to stand on".
- panel.erl: the majority is the verdict with the most votes,
  abstentions included; an abstaining plurality or an accept/reject
  tie is teiku.

EUnit 57/0 (plurality, tie, empty trace). Elixir 632/0 (engine_root_name
from names, from Hebrew, nil on nothing; the no-engine case is an
abstaining majority of one, teiku).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-10-19 18:18:50 +00:00
24 changed files with 6561 additions and 146 deletions

No files matched your search

+2 -2
View File
@@ -53,8 +53,8 @@ You inherit infrastructure that has been provisioned and verified:
| Container registry `the-recognition-protocol` | All 4 bikoret images pushed and tagged `:latest`. |
| Block Storage CSI driver | Installed. StorageClass `exoscale-sbs` available. |
| cert-manager + nginx-ingress | Running. ClusterIssuer `letsencrypt-prod` working. |
| Gitea (persistent storage) | Running. OAuth app + PAT exist for the operator's account. |
| Gitea MCP server | Running at `https://mcp.shorashim.ch`. Connected to claude.ai. |
| Gitea (persistent storage) | Running. Public HTTPS at `https://git.bikoret.ch` (ROOT_URL) since 2026-10-19; git also over `http://185.19.28.170:3000` and SSH :22. The web UI needs the https door (Secure cookie). |
| Gitea MCP server | `https://mcp.bikoret.ch/mcp`, MCP OAuth mode: each user authorizes with their own Gitea account (Gitea OAuth2 app "Claude", PKCE, client ID in the claude.ai connector's Advanced settings). Apply: `bash ~/.local/bin/gitea-public-apply`; check: `gitea-public-verify`. The old `mcp.shorashim.ch` and the shared static token are retired. |
| L1 Torah filesystem | In the `bikoret` repo at `l1/torah/`. SHA-256 `9e1abe4e…3c3086` (full hash in `l1/integrity.sha256`; verified at Day 1). |
| Image pull secret `shorashim-registry` | **Verify before assuming.** A prior partial setup may have created it. `kubectl get secrets -n shorashim` is the source of truth. |
| `shorashim-secrets` (DATABASE_URL) | **Verify before assuming.** Same as above. If present, also verify the role it points at (the architecture requires `shorashim_app`, not `avnadmin`). |
+6 -3
View File
@@ -36,9 +36,12 @@ Kept in `deploy/k8s/`:
- `manna-volume.yaml` — PVC for provision file
- `deployment.yaml` — the pod with 3 containers + 2 init containers (`shoresh-engine-install`, `migrate`). Four images are still built and pushed; shoresh-engine ships a binary, not a running container.
- `service.yaml` — ClusterIP and external LoadBalancer
- `gitea-mcp-deployment.yaml` — separate MCP server for Gitea connector (optional)
- `gitea-mcp-ingress.yaml` — TLS ingress for the MCP server
- `gitea-mcp-secret.yaml` — template for Gitea PAT
- `gitea-mcp-deployment.yaml` — Gitea MCP server for the claude.ai / Claude Code connector, MCP OAuth mode (users act as themselves in Gitea)
- `gitea-mcp-ingress.yaml` — TLS ingress `mcp.bikoret.ch` for the MCP server
- `gitea-mcp-secret.yaml` — template for a Gitea PAT (static-token mode only; kept for rollback)
- `gitea-ingress.yaml` — TLS ingress `git.bikoret.ch` for Gitea itself (namespace temple-council), required by OAuth mode
- `gitea-public-patch.yaml` — patch that sets Gitea's ROOT_URL/DOMAIN/SSH_DOMAIN to `git.bikoret.ch`
- `gitea-public-apply.sh` / `gitea-public-verify.sh` — the operator's apply and read-only check for the four above
- `cert-manager-issuer.yaml` — Let's Encrypt ClusterIssuer
## Containers
+46
View File
@@ -0,0 +1,46 @@
# Ingress for Gitea itself — public HTTPS at git.bikoret.ch
#
# Added 2026-10-19 so the Gitea MCP server can run in MCP OAuth mode:
# claude.ai and Claude Code send the user to Gitea's own OAuth2
# authorize page, which must be reachable over HTTPS at Gitea's ROOT_URL
# (gitea-public-patch.yaml sets ROOT_URL = https://git.bikoret.ch/).
#
# Gitea lives in namespace temple-council (Service gitea, 80 → 3000).
# The plain-HTTP TCP passthrough on :3000 and SSH on :22
# (ingress-tcp-services.yaml) stay as they are; this adds a third door.
#
# Prerequisites:
# 1. DNS: git.bikoret.ch → 185.19.28.170 (Infomaniak zone)
# 2. ClusterIssuer letsencrypt-prod
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: gitea
namespace: temple-council
labels:
app.kubernetes.io/name: gitea
annotations:
cert-manager.io/cluster-issuer: letsencrypt-prod
nginx.ingress.kubernetes.io/ssl-redirect: "true"
# git push of large packs; Gitea enforces its own limits
nginx.ingress.kubernetes.io/proxy-body-size: "0"
nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
spec:
ingressClassName: nginx
tls:
- hosts:
- git.bikoret.ch
secretName: gitea-bikoret-tls
rules:
- host: git.bikoret.ch
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: gitea
port:
number: 80
+30 -18
View File
@@ -1,13 +1,28 @@
# Gitea MCP Server — public connector for claude.ai
# Gitea MCP Server — public connector for claude.ai and Claude Code
#
# Deploys the official Gitea MCP server (gitea.com/gitea/gitea-mcp)
# in HTTP mode, exposing /mcp endpoint for Streamable HTTP transport.
# in HTTP mode with MCP OAuth (-oauth): every client authorizes against
# Gitea with its OWN account (PKCE, no client secret), and the server
# forwards that bearer token to Gitea per request. No shared static
# token is used any more (gitea-mcp-secrets is kept only for a rollback
# to the pre-2026-10-19 static-token mode).
#
# The MCP server connects to the Gitea backend over the cluster network
# (gitea.temple-council.svc.cluster.local) using a Personal Access Token
# stored in gitea-mcp-secrets. Until 2026-10-06 it went out to Gitea's
# own NLB (185.19.29.94) and back in; that NLB is gone — Gitea is behind
# the shared ingress now (ingress-tcp-services.yaml).
# The server serves /.well-known/oauth-protected-resource naming Gitea
# as the authorization server, so BOTH origins must be public HTTPS:
# -oauth-public-url https://mcp.bikoret.ch (gitea-mcp-ingress.yaml)
# -H https://git.bikoret.ch (gitea-ingress.yaml;
# Gitea ROOT_URL must be the same, gitea-public-patch.yaml)
# /mcp accepts only the Host from -oauth-public-url, and reverse proxies
# must pass Mcp-Protocol-Version, Mcp-Method and Mcp-Name through
# (ingress-nginx does).
#
# One-time in Gitea (Settings → Applications → Manage OAuth2 Applications):
# name Claude
# redirect URIs https://claude.ai/api/mcp/auth_callback
# http://127.0.0.1/callback (Claude Code; any port)
# confidential UNCHECKED (PKCE)
# The client ID goes into the claude.ai connector's Advanced settings,
# with the connector URL https://mcp.bikoret.ch/mcp.
---
apiVersion: apps/v1
kind: Deployment
@@ -33,18 +48,13 @@ spec:
args:
- "-t"
- "http"
- "-oauth"
- "-oauth-public-url"
- "https://mcp.bikoret.ch"
- "--host"
- "http://gitea.temple-council.svc.cluster.local"
- "https://git.bikoret.ch"
- "--port"
- "8080"
env:
- name: GITEA_ACCESS_TOKEN
valueFrom:
secretKeyRef:
name: gitea-mcp-secrets
key: GITEA_TOKEN
- name: GITEA_HOST
value: "http://gitea.temple-council.svc.cluster.local"
ports:
- containerPort: 8080
name: http
@@ -56,12 +66,14 @@ spec:
memory: "256Mi"
cpu: "250m"
livenessProbe:
tcpSocket:
httpGet:
path: /healthz
port: 8080
initialDelaySeconds: 10
periodSeconds: 30
readinessProbe:
tcpSocket:
httpGet:
path: /healthz
port: 8080
initialDelaySeconds: 5
periodSeconds: 10
+7 -5
View File
@@ -1,12 +1,14 @@
# Ingress for Gitea MCP Server — public HTTPS endpoint
# Routes mcp.shorashim.ch to the gitea-mcp service
# Routes mcp.bikoret.ch to the gitea-mcp service (moved from
# mcp.bikoret.ch on 2026-10-19 with the switch to MCP OAuth; the
# server only answers /mcp for the host in -oauth-public-url).
# TLS via cert-manager (Let's Encrypt)
#
# Prerequisites:
# 1. nginx-ingress controller installed
# 2. cert-manager installed
# 3. ClusterIssuer letsencrypt-prod applied
# 4. DNS: mcp.shorashim.ch → Ingress external IP
# 4. DNS: mcp.bikoret.ch → 185.19.28.170 (the one NLB; Infomaniak zone)
---
apiVersion: networking.k8s.io/v1
kind: Ingress
@@ -22,10 +24,10 @@ spec:
ingressClassName: nginx
tls:
- hosts:
- mcp.shorashim.ch
secretName: gitea-mcp-tls
- mcp.bikoret.ch
secretName: gitea-mcp-bikoret-tls
rules:
- host: mcp.shorashim.ch
- host: mcp.bikoret.ch
http:
paths:
- path: /
+9 -3
View File
@@ -1,15 +1,21 @@
# Gitea MCP Server — secrets template
# NEVER commit actual values. Fill in and apply manually.
#
# Two secrets needed:
# Since 2026-10-19 the MCP server runs in OAuth mode and uses NO static
# token: users authorize with their own Gitea account. This secret is
# kept only for a rollback to static-token mode (see the deployment).
#
# Two secrets needed (static-token mode):
# 1. GITEA_TOKEN: Personal Access Token from Gitea
# Create at: http://185.19.28.170:3000/user/settings/applications
# Permissions: repo (read/write)
#
# 2. OAuth Client ID/Secret: Registered OAuth app in Gitea
# Create at: http://185.19.28.170:3000/user/settings/applications
# Redirect URI: https://claude.ai/api/mcp/auth_callback
# (These go into claude.ai connector settings, not this secret)
# Redirect URIs: https://claude.ai/api/mcp/auth_callback
# http://127.0.0.1/callback (Claude Code)
# Confidential Client: UNCHECKED (PKCE). Only the Client ID is needed;
# it goes into the claude.ai connector's Advanced settings, not here.
---
apiVersion: v1
kind: Secret
+40
View File
@@ -0,0 +1,40 @@
#!/usr/bin/env bash
# Move Gitea and its MCP server to public HTTPS on bikoret.ch and switch
# the MCP server to MCP OAuth (2026-10-19). Run by the transmitter:
# ! bash ~/.local/bin/gitea-public-apply
# Idempotent. Needs DNS first: git.bikoret.ch and mcp.bikoret.ch → 185.19.28.170.
#
# Rollback (static-token mode on mcp.shorashim.ch, as before 2026-10-19):
# kubectl -n temple-council set env deploy/gitea \
# GITEA__server__ROOT_URL=http://gitea.temple-council.ch/ \
# GITEA__server__DOMAIN=gitea.temple-council.ch GITEA__server__SSH_DOMAIN-
# then restore deploy/k8s/gitea-mcp-*.yaml from commit 861cd4e6 and apply them.
set -euo pipefail
REPO="${REPO:-$HOME/bikoret}"
cd "$REPO"
NLB=185.19.28.170
for h in git.bikoret.ch mcp.bikoret.ch; do
ip=$(dig +short "$h" | tail -1 || true)
if [ "$ip" != "$NLB" ]; then
echo "DNS: $h → '${ip:-nothing}' (need $NLB). Add the A record at Infomaniak first." >&2
exit 2
fi
done
echo "== 1/4 ingresses (certificates issue once DNS resolves)"
kubectl apply -f deploy/k8s/gitea-ingress.yaml
kubectl apply -f deploy/k8s/gitea-mcp-ingress.yaml
echo "== 2/4 Gitea ROOT_URL → https://git.bikoret.ch/ (one restart)"
kubectl -n temple-council patch deploy gitea --patch-file deploy/k8s/gitea-public-patch.yaml
kubectl -n temple-council rollout status deploy/gitea --timeout=180s
echo "== 3/4 gitea-mcp in OAuth mode at https://mcp.bikoret.ch"
kubectl apply -f deploy/k8s/gitea-mcp-deployment.yaml
kubectl -n shorashim rollout status deploy/gitea-mcp --timeout=120s
echo "== 4/4 certificates"
for i in $(seq 1 24); do
ready=$(kubectl get certificate -A -o jsonpath='{range .items[?(@.metadata.name=="gitea-bikoret-tls")]}{.status.conditions[?(@.type=="Ready")].status}{end}{range .items[?(@.metadata.name=="gitea-mcp-bikoret-tls")]}{.status.conditions[?(@.type=="Ready")].status}{end}' 2>/dev/null || true)
[ "$ready" = "TrueTrue" ] && break
sleep 5
done
kubectl get certificate -A | grep -E "NAME|bikoret"
echo "== verify"
bash "$REPO/deploy/k8s/gitea-public-verify.sh"
+28
View File
@@ -0,0 +1,28 @@
# Strategic-merge patch for the Gitea Deployment (namespace temple-council,
# which is NOT otherwise managed from this repo): make Gitea's own URL the
# public HTTPS host, so its OAuth2 authorize/token endpoints and the
# issuer in /.well-known/openid-configuration are reachable by claude.ai.
#
# kubectl -n temple-council patch deploy gitea --patch-file deploy/k8s/gitea-public-patch.yaml
#
# The Gitea image rewrites app.ini from GITEA__section__KEY at start, so
# this replaces ROOT_URL/DOMAIN (were http://gitea.temple-council.ch, a
# name that never resolved) and SSH_DOMAIN (was 185.19.29.94, an NLB IP
# released on 2026-10-06). Clone URLs shown by Gitea become
# https://git.bikoret.ch/... and git@git.bikoret.ch:...; the old
# http://185.19.28.170:3000 remote keeps working for push/pull.
# Side effect: with an https ROOT_URL Gitea marks its session cookie
# Secure, so the WEB UI must be used at https://git.bikoret.ch, not on
# the plain-HTTP :3000 door (git over :3000 is unaffected).
spec:
template:
spec:
containers:
- name: gitea
env:
- name: GITEA__server__ROOT_URL
value: "https://git.bikoret.ch/"
- name: GITEA__server__DOMAIN
value: "git.bikoret.ch"
- name: GITEA__server__SSH_DOMAIN
value: "git.bikoret.ch"
+18
View File
@@ -0,0 +1,18 @@
#!/usr/bin/env bash
# Read-only checks for the public Gitea + OAuth MCP setup. Exit 0 = all pass.
# bash ~/.local/bin/gitea-public-verify
set -u
fail=0
chk() { # label expected actual
if [ "$2" = "$3" ]; then echo "ok $1: $3"; else echo "FAIL $1: got '$3', want '$2'"; fail=1; fi
}
INIT='{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"probe","version":"0"}}}'
chk "https://git.bikoret.ch/ status" 200 "$(curl -sS -m 15 -o /dev/null -w '%{http_code}' https://git.bikoret.ch/ || echo err)"
chk "Gitea OIDC issuer" "https://git.bikoret.ch" "$(curl -sS -m 15 https://git.bikoret.ch/.well-known/openid-configuration | python3 -c 'import sys,json;print(json.load(sys.stdin)["issuer"].rstrip("/"))' 2>/dev/null || echo err)"
chk "mcp /healthz" 200 "$(curl -sS -m 15 -o /dev/null -w '%{http_code}' https://mcp.bikoret.ch/healthz || echo err)"
prm=$(curl -sS -m 15 https://mcp.bikoret.ch/.well-known/oauth-protected-resource || echo err)
chk "protected-resource names Gitea" yes "$(printf '%s' "$prm" | grep -q 'git.bikoret.ch' && echo yes || echo no)"
chk "POST /mcp without token → 401" 401 "$(curl -sS -m 15 -o /dev/null -w '%{http_code}' -X POST https://mcp.bikoret.ch/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d "$INIT" || echo err)"
chk "git over :3000 still answers" 200 "$(curl -sS -m 15 -o /dev/null -w '%{http_code}' http://185.19.28.170:3000/api/v1/version || echo err)"
echo "protected-resource: $prm"
exit $fail
+9
View File
@@ -157,7 +157,16 @@ vote_from_consultation(Step, {ok, Map}, RootCount) ->
Status = maps:get(status, Map, <<"teiku">>),
Text = maps:get(text, Map, <<>>),
Verses = maps:get(verses, Map, []),
Grounding = maps:get(grounding, Map, []),
case Status of
<<"resolved">> when Verses =:= [], Grounding =:= [] ->
%% The engine says "resolved" over an empty trace — no verse,
%% no mitzvah. That is a reading that stands on nothing, and
%% a vote to accept it would be the calf (avodah_zarah.pl
%% Form 2: the uncoupled output). Abstain, and say why.
{<<"Teiku — the reading is coupled to no verse and no mitzvah">>,
reasoning(Step, <<"resolved on an empty trace; nothing to stand on">>, RootCount, Verses),
[], abstain};
<<"resolved">> ->
{Text,
reasoning(Step, <<"resolved">>, RootCount, Verses),
+10 -4
View File
@@ -207,15 +207,21 @@ compute_majority_minority([]) ->
torah_refs => [],
vote_count => 0}};
compute_majority_minority(Votes) ->
%% Count accepts vs rejects
Accepts = [V || V <- Votes, V#vote.verdict == accept],
Rejects = [V || V <- Votes, V#vote.verdict == reject],
Abstains = [V || V <- Votes, V#vote.verdict == abstain],
NA = length(Accepts), NR = length(Rejects), NB = length(Abstains),
%% The majority is the verdict with the most votes — abstentions
%% count (tablet 55: live, one accept "won" against two
%% abstentions, and the reply showed majority 1, minority 2). An
%% abstaining plurality, or an accept/reject tie, is teiku
%% (determine_outcome reads the majority's verdict).
{MajVotes, MinVotes} =
case length(Accepts) >= length(Rejects) of
true -> {Accepts, Rejects ++ Abstains};
false -> {Rejects, Accepts ++ Abstains}
if
NA > NR, NA >= NB -> {Accepts, Rejects ++ Abstains};
NR > NA, NR >= NB -> {Rejects, Accepts ++ Abstains};
true -> {Abstains, Accepts ++ Rejects}
end,
MajSample = case MajVotes of
+31
View File
@@ -506,6 +506,37 @@ majority_verdict_reject_test() ->
{Maj, _Min} = panel:compute_majority_minority(Votes),
?assertEqual(reject, maps:get(verdict, Maj)).
%% Tablet 55: abstentions count. One accept against two abstentions is
%% not an accepting majority — it is teiku.
majority_abstaining_plurality_is_teiku_test() ->
Votes = [make_vote(accept), make_vote(abstain), make_vote(abstain)],
{Maj, Min} = panel:compute_majority_minority(Votes),
?assertEqual(abstain, maps:get(verdict, Maj)),
?assertEqual(2, maps:get(vote_count, Maj)),
?assertEqual(1, maps:get(vote_count, Min)),
?assertEqual(teiku, panel:determine_outcome(Maj, Min, passed)).
majority_accept_reject_tie_is_teiku_test() ->
Votes = [make_vote(accept), make_vote(reject)],
{Maj, _Min} = panel:compute_majority_minority(Votes),
?assertEqual(abstain, maps:get(verdict, Maj)),
?assertEqual(0, maps:get(vote_count, Maj)).
%% Tablet 55: "resolved" over an empty trace — no verse, no mitzvah —
%% is nothing to stand on; the judge abstains rather than accept.
judge_resolved_on_empty_trace_abstains_test() ->
{Pos, Reason, Refs, Verdict} =
judge:vote_from_consultation(interpret,
{ok, #{status => <<"resolved">>, text => <<"reading(0,0)">>, verses => [], grounding => []}}, 5),
?assertEqual(abstain, Verdict),
?assertEqual([], Refs),
?assertMatch({_, _}, binary:match(Pos, <<"Teiku">>)),
?assertMatch({_, _}, binary:match(Reason, <<"empty trace">>)),
%% a mitzvah without a verse is still ground
{_, _, _, V2} = judge:vote_from_consultation(interpret,
{ok, #{status => <<"resolved">>, text => <<"r">>, verses => [], grounding => [<<"mitzvah(5)">>]}}, 1),
?assertEqual(accept, V2).
%% ============================================================
%% determine_outcome tests — accepted, rejected, teiku reachable
%% ============================================================
+5
View File
@@ -63,6 +63,11 @@ if [[ "${DOORPOST_SKIP:-0}" != "1" ]]; then
python3 -I scripts/doorpost_check.py || exit 1
fi
# The engine's verse facts are derived from L1 (scripts/build_engine_verses.py);
# an image whose facts lag the scroll reasons over a scroll that is not
# the one the pipeline reads. Regenerate and commit, never skip.
python3 -I scripts/build_engine_verses.py --check || exit 1
if ! docker buildx version >/dev/null 2>&1; then
echo "ERROR: docker buildx not available — install Docker Desktop or buildx plugin" >&2
exit 1
+111
View File
@@ -0,0 +1,111 @@
#!/usr/bin/env python3
"""build_engine_verses.py — the Talmudic Engine's verse facts, derived from L1.
Architecture §3.4: verse(Book, Chapter, Verse, HebrewRoots, Gloss) is "the
reasoning layer's view of the specification — not a replacement for L1".
Until 2026-10-19 that view was 32 hand-written verses, so any root the
engine knew lit the same handful and every reading cited the same list.
This script writes talmudic_engine/src/specification/l1_verses.pl from
l1/torah — every verse, its roots as the engine names them
(Hebrew shoresh → letter names, finals folded: ברא → bet_resh_aleph), the
consonantal text as the gloss — and records the SHA-256 of the L1 files it
read in the header, so the facts can be checked against the scroll.
scripts/build_engine_verses.py # write the facts
scripts/build_engine_verses.py --check # exit 1 if the facts do not match L1 as it stands
Devarim 4:2 — nothing added, nothing taken: the engine reads the scroll's
roots, not the builder's memory of them.
"""
import argparse, hashlib, json, os, sys
ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
L1 = os.path.join(ROOT, "l1", "torah")
OUT = os.path.join(ROOT, "talmudic_engine", "src", "specification", "l1_verses.pl")
BOOKS = ["bereishit", "shemot", "vayikra", "bamidbar", "devarim"]
NAMES = {
"א": "aleph", "ב": "bet", "ג": "gimel", "ד": "dalet", "ה": "he", "ו": "vav", "ז": "zayin",
"ח": "chet", "ט": "tet", "י": "yod", "כ": "kaf", "ך": "kaf", "ל": "lamed", "מ": "mem", "ם": "mem",
"נ": "nun", "ן": "nun", "ס": "samekh", "ע": "ayin", "פ": "pe", "ף": "pe", "צ": "tsadi", "ץ": "tsadi",
"ק": "qof", "ר": "resh", "ש": "shin", "ת": "tav",
}
def root_atom(shoresh):
if not shoresh:
return None
names = [NAMES.get(c) for c in shoresh]
if not names or any(n is None for n in names):
return None
return "_".join(names)
def quote(s):
return "'" + s.replace("\\", "\\\\").replace("'", "\\'") + "'"
def verse_files():
out = []
for book in BOOKS:
bdir = os.path.join(L1, book)
for ch in sorted((d for d in os.listdir(bdir) if d.isdigit()), key=int):
cdir = os.path.join(bdir, ch)
for f in sorted((f for f in os.listdir(cdir) if f.endswith(".json") and f[:-5].isdigit()), key=lambda x: int(x[:-5])):
out.append((book, int(ch), int(f.split(".")[0]), os.path.join(cdir, f)))
return out
def build():
h = hashlib.sha256()
facts = []
nverses = nroots = 0
for book, ch, vs, path in verse_files():
data = open(path, "rb").read()
h.update(f"{book}/{ch}/{vs}\n".encode())
h.update(data)
d = json.loads(data)
roots = []
for w in d.get("words", []):
a = root_atom(w.get("shoresh"))
if a and a not in roots:
roots.append(a)
gloss = " ".join(w.get("consonants", "") for w in d.get("words", []) if w.get("consonants"))
facts.append(f"verse({book}, {ch}, {vs}, [{', '.join(roots)}], {quote(gloss)}).")
nverses += 1
nroots += len(roots)
header = f"""%% l1_verses.pl — GENERATED by scripts/build_engine_verses.py from l1/torah.
%% Do not edit: regenerate. verse(Book, Chapter, Verse, Roots, Gloss) for
%% every verse of L1; Roots are the engine's letter-name atoms derived from
%% each word's shoresh (finals folded), once per verse in word order; Gloss
%% is the consonantal text. Included by torah_text.pl.
%%
%% l1_sha256: {h.hexdigest()}
%% verses: {nverses} root_occurrences: {nroots}
"""
return header + "\n".join(facts) + "\n", h.hexdigest(), nverses
def main():
ap = argparse.ArgumentParser()
ap.add_argument("--check", action="store_true")
a = ap.parse_args()
text, digest, n = build()
if a.check:
try:
current = open(OUT, encoding="utf-8").read()
except FileNotFoundError:
print(f"engine verses: {OUT} missing — run scripts/build_engine_verses.py", file=sys.stderr)
sys.exit(1)
if current != text:
print(f"engine verses: {OUT} does not match L1 (l1_sha256 now {digest[:12]}…) — regenerate", file=sys.stderr)
sys.exit(1)
print(f"engine verses: match L1 ({n} verses, l1_sha256 {digest[:12]}…)")
return
with open(OUT, "w", encoding="utf-8") as f:
f.write(text)
print(f"wrote {OUT}: {n} verses, l1_sha256 {digest[:12]}…")
if __name__ == "__main__":
main()
+18
View File
@@ -45,6 +45,24 @@ process_request(request(resolve, CaseRef, Domain, Roots, Question), Response) :-
; Response = response(error, no_resolution, CaseRef)
).
%% The challenge step of the dialectic, on its own (tablet 55: the
%% Sanhedrin's second seat asks it; until now no handler answered and
%% the socket fell silent). Interpret, then look for a kushya against
%% the interpretation: one stands → resolved_challenged, the kushya
%% named; none → no_challenge, the interpretation as read.
process_request(request(challenge, CaseRef, Domain, Roots, Question), Response) :-
Case = case(CaseRef, Domain, Roots, Question),
( interpret(Case, Interpretation)
-> ( challenge(Interpretation, Kushya)
-> Response = response(ok, resolved_challenged,
result(interpretation(Interpretation),
challenge(Kushya)))
; format_interpretation(Interpretation, response(ok, interpreted, Result)),
Response = response(ok, no_challenge, Result)
)
; Response = response(error, no_interpretation, CaseRef)
).
process_request(request(halt_check, Action), Response) :-
format_halt_check(Action, Response).
+41 -6
View File
@@ -153,11 +153,15 @@ read_coupling_term(Str, Term) :-
%% JSON format (Construction §3.3):
%% { "status": "resolved", "interpretation": { ... } }
%% Interpreted response
response_to_json(response(ok, interpreted, result(ref(Ref), mitzvot(Mitzvot),
verses(Verses), reading(Reading),
confidence(Conf))),
%% Interpreted response — and the same shape under the names the
%% resolve and challenge steps give it when the reading stands
%% (tablet 55: resolved_accepted had no clause, so a resolve that
%% succeeded came back UNEXPECTED_RESPONSE; no_challenge is new).
response_to_json(response(ok, Kind, result(ref(Ref), mitzvot(Mitzvot),
verses(Verses), reading(Reading),
confidence(Conf))),
Dict) :-
memberchk(Kind, [interpreted, resolved_accepted, no_challenge]),
maplist(term_to_string, Mitzvot, MitzvotStrs),
maplist(term_to_string, Verses, VerseStrs),
term_to_string(Reading, ReadingStr),
@@ -171,21 +175,52 @@ response_to_json(response(ok, interpreted, result(ref(Ref), mitzvot(Mitzvot),
confidence: ConfStr},
challenge: null}.
%% Challenged response
%% Challenged response — the interpretation's verses and mitzvot are
%% carried, so a judge rejecting on the kushya still cites its ground.
response_to_json(response(ok, resolved_challenged,
result(interpretation(Interp), challenge(Kushya))),
Dict) :-
Interp = interpretation(_Ref, Mitzvot, Verses, _Reading, _Conf, _Trace),
maplist(term_to_string, Mitzvot, MitzvotStrs),
maplist(term_to_string, Verses, VerseStrs),
term_to_string(Interp, InterpStr),
term_to_string(Kushya, KushyaStr),
Dict = json{status: "challenged",
interpretation: json{text: InterpStr,
prolog_form: InterpStr,
grounding: [],
grounding: MitzvotStrs,
verses: VerseStrs,
confidence: "medium"},
challenge: json{kushya: KushyaStr,
contradicting: "",
strength: "moderate"}}.
%% Synthesized resolution: both readings stand on common ground.
response_to_json(response(ok, resolved_synthesized,
result(common(Common), verses(Verses), both_sides(Both))),
Dict) :-
maplist(term_to_string, Common, CommonStrs),
maplist(term_to_string, Verses, VerseStrs),
term_to_string(Both, BothStr),
Dict = json{status: "resolved",
interpretation: json{text: BothStr,
prolog_form: BothStr,
grounding: CommonStrs,
verses: VerseStrs,
confidence: "medium"},
challenge: null}.
%% No interpretation possible (from resolve)
response_to_json(response(ok, no_interpretation, result(ref(Ref))), Dict) :-
atom_string(Ref, RefStr),
Dict = json{status: "teiku",
interpretation: json{text: "No interpretation found",
prolog_form: RefStr,
grounding: [],
verses: [],
confidence: "low"},
challenge: null}.
%% Teiku response
response_to_json(response(ok, teiku, result(record(Record))), Dict) :-
term_to_string(Record, RecordStr),
+36 -7
View File
@@ -111,16 +111,45 @@ find_relevant_mitzvot_traced(case(_Ref, Domain, Roots, _Question), Mitzvot, Coup
find_relevant_verses(case(Ref, Domain, Roots, Question), Verses) :-
find_relevant_verses_traced(case(Ref, Domain, Roots, Question), Verses, _).
%% Traced version: returns verses AND the coupling trace for each
%% Traced version: returns verses AND the coupling trace for each.
%%
%% Over the whole scroll (2026-10-19, l1_verses.pl) a common root lights
%% hundreds of verses; a reading that cites them all cites nothing. The
%% verses are ranked by how many of the case's roots they carry — a
%% verse sharing three roots stands closer to the case than one sharing
%% one — and the reading keeps the top ?MAX_VERSES, ties broken by
%% canonical order. The coupling trace is kept only for the verses the
%% reading cites: a trace names what the reading stands on.
max_verses(12).
find_relevant_verses_traced(case(_Ref, _Domain, Roots, _Question), Verses, Couplings) :-
findall(verse_ref(Book, Ch, Vs, Gloss)-coupled(root(Root), verse(Book, Ch, Vs)),
( member(Root, Roots),
verse(Book, Ch, Vs, VerseRoots, Gloss),
sort(Roots, UniqueRoots),
findall(Shared-verse_ref(Book, Ch, Vs, Gloss),
( verse(Book, Ch, Vs, VerseRoots, Gloss),
intersection(UniqueRoots, VerseRoots, SharedRoots),
SharedRoots \== [],
length(SharedRoots, N),
Shared is -N
),
Scored),
%% keysort is stable: equal scores keep the scroll's order
keysort(Scored, Ranked),
pairs_values(Ranked, RankedVerses),
max_verses(Max),
take(Max, RankedVerses, Verses),
findall(coupled(root(Root), verse(Book, Ch, Vs)),
( member(verse_ref(Book, Ch, Vs, _), Verses),
verse(Book, Ch, Vs, VerseRoots, _),
member(Root, UniqueRoots),
member(Root, VerseRoots)
),
AllPairs),
pairs_keys_values(AllPairs, AllVerses, Couplings),
sort(AllVerses, Verses).
Couplings).
take(N, List, Prefix) :-
length(List, L),
( L =< N -> Prefix = List
; length(Prefix, N), append(Prefix, _, List)
).
%% ============================================================
%% CONSTRUCT INTERPRETATION
File diff suppressed because it is too large. Load diff
+10 -84
View File
@@ -16,93 +16,19 @@
]).
%% ============================================================
%% BEREISHIT — Creation narratives
%% THE SCROLL — every verse of L1, generated (2026-10-19)
%% ============================================================
%%
%% The 32 hand-written verses that stood here from Phase 1 are gone:
%% with them, any root the engine knew lit the same handful and every
%% reading cited the same list. l1_verses.pl is written by
%% scripts/build_engine_verses.py from l1/torah — 5,853 verses, each
%% word's shoresh as the engine names it, the consonantal text as the
%% gloss — and carries the SHA-256 of the L1 it read. Check it against
%% the scroll with `scripts/build_engine_verses.py --check`.
verse(bereishit, 1, 1, [bet_resh_aleph, bet_resh_aleph, aleph_lamed_he],
'In the beginning God created the heavens and the earth').
verse(bereishit, 1, 3, [aleph_mem_resh, aleph_lamed_he, he_yod_he, aleph_vav_resh],
'And God said let there be light and there was light').
verse(bereishit, 1, 4, [resh_aleph_he, aleph_lamed_he, aleph_vav_resh, tet_vav_bet, bet_dalet_lamed],
'And God saw that the light was good and God separated').
verse(bereishit, 1, 27, [bet_resh_aleph, aleph_lamed_he, aleph_dalet_mem, tzade_lamed_mem, bet_resh_aleph],
'And God created man in His image in the image of God He created him').
verse(bereishit, 2, 2, [kaf_lamed_he, aleph_lamed_he, yod_vav_mem, shin_bet_tav, mem_lamed_aleph_kaf_he],
'And on the seventh day God completed His work and He rested').
verse(bereishit, 2, 3, [bet_resh_kaf, aleph_lamed_he, yod_vav_mem, shin_bet_tav, qof_dalet_shin],
'And God blessed the seventh day and sanctified it').
verse(bereishit, 9, 6, [shin_pe_kaf, dalet_mem, aleph_dalet_mem, tzade_lamed_mem, aleph_lamed_he],
'Whoever sheds the blood of man by man shall his blood be shed for in the image of God He made man').
:- include('l1_verses.pl').
%% ============================================================
%% SHEMOT — The ten dibrot and the covenant
%% ============================================================
verse(shemot, 3, 14, [aleph_he_yod_he, aleph_mem_resh, aleph_he_yod_he],
'I am that I am').
verse(shemot, 20, 2, [aleph_nun_kaf_yod, he_shin_mem, aleph_lamed_he],
'I am the LORD your God who brought you out of the land of Egypt').
verse(shemot, 20, 3, [he_yod_he, aleph_lamed_he, aleph_chet_resh],
'You shall have no other gods before Me').
verse(shemot, 20, 8, [zayin_kaf_resh, yod_vav_mem, shin_bet_tav, qof_dalet_shin],
'Remember the Sabbath day to sanctify it').
verse(shemot, 20, 13, [resh_tzade_chet],
'You shall not murder').
verse(shemot, 20, 14, [nun_aleph_pe],
'You shall not commit adultery').
verse(shemot, 20, 15, [gimel_nun_bet],
'You shall not steal').
verse(shemot, 20, 16, [ayin_nun_he, shin_qof_resh, ayin_dalet],
'You shall not bear false witness against your neighbor').
verse(shemot, 20, 17, [chet_mem_dalet],
'You shall not covet').
%% ============================================================
%% VAYIKRA — Holiness and offerings
%% ============================================================
verse(vayikra, 1, 3, [qof_resh_bet, ayin_lamed_he, tav_mem_yod_mem],
'If his offering is a burnt offering let him offer a male without blemish').
verse(vayikra, 4, 27, [chet_tet_aleph, nun_pe_shin, shin_gimel_gimel_he],
'If anyone of the common people sins unintentionally').
verse(vayikra, 19, 2, [qof_dalet_shin, he_yod_he, qof_dalet_shin],
'Be holy for I the LORD your God am holy').
verse(vayikra, 19, 15, [ayin_shin_he, mem_shin_pe_tet, tzade_dalet_qof],
'In righteousness shall you judge your neighbor').
verse(vayikra, 19, 18, [aleph_he_bet, resh_ayin, kaf_mem_vav],
'You shall love your neighbor as yourself').
%% ============================================================
%% BAMIDBAR — The camp and the cloud
%% ============================================================
verse(bamidbar, 9, 23, [pe_he, he_shin_mem, chet_nun_he, pe_he, he_shin_mem, nun_samekh_ayin],
'At the mouth of the LORD they camped and at the mouth of the LORD they journeyed').
verse(bamidbar, 10, 2, [ayin_shin_he, shin_nun_yod, chet_tzade_tzade_resh_he, kaf_samekh_pe],
'Make two silver trumpets for the calling of the assembly').
verse(bamidbar, 35, 11, [mem_qof_lamed_tet, ayin_yod_resh, nun_pe_shin, resh_tzade_chet, shin_gimel_gimel_he],
'You shall designate cities of refuge for one who kills a person unintentionally').
%% ============================================================
%% DEVARIM — Moses' final instruction
%% ============================================================
verse(devarim, 6, 4, [shin_mem_ayin, yod_shin_resh_aleph_lamed, he_shin_mem, aleph_lamed_he, he_shin_mem, aleph_chet_dalet],
'Hear O Israel the LORD our God the LORD is one').
verse(devarim, 6, 5, [aleph_he_bet, he_shin_mem, aleph_lamed_he, kaf_lamed, lamed_bet_bet],
'And you shall love the LORD your God with all your heart').
verse(devarim, 16, 18, [shin_pe_tet, shin_tet_resh, nun_tav_nun, shin_ayin_resh],
'Judges and officers shall you appoint in all your gates').
verse(devarim, 16, 20, [tzade_dalet_qof, tzade_dalet_qof, resh_dalet_pe],
'Justice justice shall you pursue').
verse(devarim, 21, 1, [nun_pe_lamed, chet_lamed_lamed, shin_dalet_he, yod_dalet_ayin],
'If a slain person is found in the field and it is not known who struck him').
verse(devarim, 25, 12, [nun_tzade_lamed, resh_dalet_pe],
'You shall save the pursued from the pursuer').
verse(devarim, 26, 2, [lamed_qof_chet, resh_aleph_shin_yod_tav, pe_resh_yod, aleph_dalet_mem_he],
'You shall take of the first of all the fruit of the ground').
verse(devarim, 26, 5, [aleph_resh_mem_yod, aleph_bet_dalet, aleph_bet_yod],
'A wandering Aramean was my father').
%% ============================================================
%% QUERIES
+49
View File
@@ -112,3 +112,52 @@ test(teiku_count_works) :-
integer(Count).
:- end_tests(teiku_module).
%% ============================================================
%% Tablet 55 — the dialectic over the wire: interpret, challenge,
%% resolve each answer JSON a judge can vote on. Before this the
%% engine had no "challenge" action and a resolve that succeeded came
%% back UNEXPECTED_RESPONSE (resolved_accepted had no JSON clause).
%% ============================================================
:- use_module('../src/interface/api').
:- use_module('../src/interface/json_bridge').
:- use_module('../src/interface/socket_server').
:- begin_tests(dialectic_over_the_wire).
roots_line(Action, Line) :-
format(atom(Line),
'{"action":"~w","case":{"ref":"t55-~w","question":"q","context_roots":["bet-resh-aleph","aleph-lamed-he"]}}',
[Action, Action]).
test(interpret_answers_resolved_with_verses, [nondet]) :-
roots_line(interpret, L),
socket_server:process_json_line(L, R),
get_dict(status, R, "resolved"),
get_dict(interpretation, R, I),
get_dict(verses, I, Vs), Vs \== [].
test(challenge_answers_and_carries_the_ground, [nondet]) :-
roots_line(challenge, L),
socket_server:process_json_line(L, R),
get_dict(status, R, S),
memberchk(S, ["resolved", "challenged"]),
get_dict(interpretation, R, I),
get_dict(verses, I, Vs), Vs \== [].
test(resolve_answers_resolved_not_unexpected, [nondet]) :-
roots_line(resolve, L),
socket_server:process_json_line(L, R),
\+ get_dict(error, R, _),
get_dict(status, R, S),
memberchk(S, ["resolved", "challenged", "teiku"]).
test(no_roots_resolves_on_an_empty_trace, [nondet]) :-
socket_server:process_json_line('{"action":"interpret","case":{"ref":"t55-empty","question":"q","context_roots":[]}}', R),
get_dict(status, R, "resolved"),
get_dict(interpretation, R, I),
get_dict(verses, I, []),
get_dict(grounding, I, []).
:- end_tests(dialectic_over_the_wire).
+158 -11
View File
@@ -63,8 +63,8 @@ defmodule VavPipeline.BereishitCycle do
"""
alias VavPipeline.{Specification, CycleLog, Manna, HaltConditions,
ShoreshEngineClient, TalmudicEngineClient, SanhedrinClient,
Chatzotzrot}
ShoreshEngineClient, TalmudicEngineClient, TalmudicEngineSocket,
SanhedrinClient, Chatzotzrot}
require Logger
@@ -308,7 +308,11 @@ defmodule VavPipeline.BereishitCycle do
final =
case result do
{:ok, data} ->
check_halt_on_output(data)
# Every question is read against the engine, not only a teiku
# that never comes (2026-10-19: ki_tov returns teiku only on a
# root with no Hebrew, and the Shoresh Engine never leaves one;
# the Talmudic route had never been walked by a real question).
data |> consult_engine(context) |> check_halt_on_output()
{:unresolved, data} ->
case route_if_unresolved(data, context) do
@@ -325,6 +329,90 @@ defmodule VavPipeline.BereishitCycle do
final
end
# ============================================================
# The engine, consulted on every resolved cycle
# ============================================================
# Architecture §3.3: the Talmudic Engine grounds a reading in verses
# and mitzvot over the case's roots. The cycle's own ki_tov says the
# roots stand in L1; the engine says what stands on them. Called
# directly on the socket — never the client's stub (tablet 41): an
# engine that cannot be reached is reported as not consulted, and the
# cycle's answer stands without it. A tamid probe does not consult
# (the fire is checked, the engine is not loaded by the check).
defp consult_engine(%{probe: true} = data, _context), do: data
defp consult_engine(data, _context) do
roots = Map.get(data, :roots_activated, [])
names = roots |> Enum.map(&engine_root_name/1) |> Enum.reject(&is_nil/1)
case_ref = Map.get(data, :case_ref, generate_case_ref())
cond do
names == [] ->
Map.put(data, :talmudic_consulted, {:skipped, :no_roots})
Process.whereis(TalmudicEngineSocket) == nil ->
Map.put(data, :talmudic_consulted, {:error, :engine_socket_not_started})
true ->
case TalmudicEngineSocket.interpret(case_ref, %{context_roots: names, question: Map.get(data, :raw, "")}) do
{:ok, %{"status" => _} = reply} ->
Map.merge(data, %{talmudic_interpretation: reply, talmudic_consulted: :ok})
{:ok, other} ->
Logger.warning("BereishitCycle: engine answered an unexpected shape for #{case_ref}: #{inspect(other)}")
Map.put(data, :talmudic_consulted, {:error, :unexpected_reply})
{:error, reason} ->
Logger.warning("BereishitCycle: engine not consulted for #{case_ref}: #{inspect(reason)}")
Map.put(data, :talmudic_consulted, {:error, reason})
end
end
end
@doc """
The engine's reading, said plainly: how many verses and mitzvot it
coupled to the roots, and which. `nil` when there is no reading.
"""
@spec engine_reading_text(map()) :: String.t() | nil
def engine_reading_text(data) do
case Map.get(data, :talmudic_interpretation) do
%{"interpretation" => interp} = reply when is_map(interp) ->
verses = interp |> Map.get("verses", []) |> List.wrap() |> Enum.map(&verse_ref_display/1) |> Enum.reject(&is_nil/1) |> Enum.uniq()
mitzvot = interp |> Map.get("grounding", []) |> List.wrap() |> Enum.map(&mitzvah_display/1) |> Enum.reject(&is_nil/1) |> Enum.uniq()
status = Map.get(reply, "status", "")
cond do
verses == [] and mitzvot == [] ->
"Talmudic Engine (#{status}): no verse or mitzvah is coupled to these roots."
true ->
v = if verses == [], do: "no verse", else: "#{length(verses)} verse(s): #{Enum.join(verses, ", ")}"
m = if mitzvot == [], do: "no mitzvah", else: "#{length(mitzvot)} mitzvah/mitzvot: #{Enum.join(mitzvot, ", ")}"
"Talmudic Engine (#{status}): #{v}; #{m}."
end
_ ->
nil
end
end
# "verse_ref(bereishit,1,1,'...')" / "verse(shemot,3,14)" → "Bereishit 1:1"
defp verse_ref_display(s) do
case Regex.run(~r/verse(?:_ref)?\((bereishit|shemot|vayikra|bamidbar|devarim)\s*,\s*(\d+)\s*,\s*(\d+)/, to_string(s)) do
[_, book, ch, vs] -> "#{String.capitalize(book)} #{ch}:#{vs}"
_ -> nil
end
end
# "mitzvah(1,positive,know_hashem,always)" → "know_hashem (1, positive)"
defp mitzvah_display(s) do
case Regex.run(~r/mitzvah\((\d+)\s*,\s*(\w+)\s*,\s*(\w+)/, to_string(s)) do
[_, id, kind, name] -> "#{name} (#{id}, #{kind})"
_ -> nil
end
end
# ============================================================
# Compose — the answer and its sources, from the context
# ============================================================
@@ -385,15 +473,19 @@ defmodule VavPipeline.BereishitCycle do
deliberation =
case Map.get(data, :resolution) do
:talmudic ->
text = get_in(data, [:talmudic_interpretation, "interpretation", "text"]) || ""
" Talmudic Engine: #{text}"
" " <> (engine_reading_text(data) || "Talmudic Engine resolved the case.")
:sanhedrin ->
pos = get_in(data, [:sanhedrin_decision, :majority, :position]) || ""
" Sanhedrin majority: #{pos}"
_ ->
""
# Consulted after ki_tov (every resolved question), or not.
case {engine_reading_text(data), Map.get(data, :talmudic_consulted)} do
{text, _} when is_binary(text) -> " " <> text
{nil, {:error, reason}} -> " Talmudic Engine: not consulted (#{inspect(reason)})."
_ -> ""
end
end
"Roots activated in #{verse.ref}: #{Enum.join(root_lines, "; ")}." <>
@@ -426,10 +518,19 @@ defmodule VavPipeline.BereishitCycle do
text: verse.text_hebrew
}
# The engine's verses as references a reader can follow ("Bereishit
# 1:3"), the engine's own form kept beside them; the scope verse is
# not repeated.
talmudic_verses =
case get_in(data, [:talmudic_interpretation, "interpretation", "verses"]) do
vs when is_list(vs) -> Enum.map(vs, fn v -> %{ref: to_string(v)} end)
_ -> []
vs when is_list(vs) ->
vs
|> Enum.map(fn v -> %{ref: verse_ref_display(v) || to_string(v), engine_form: to_string(v)} end)
|> Enum.uniq_by(& &1.ref)
|> Enum.reject(&(&1.ref == verse.ref))
_ ->
[]
end
[primary | talmudic_verses]
@@ -604,13 +705,22 @@ defmodule VavPipeline.BereishitCycle do
{:interpretation, attrs, nil}
_ ->
# The engine's reading, when it was consulted, rides in the record:
# its verses beside the scope, its text in the reasoning, and the
# component names both readers.
interp = get_in(data, [:talmudic_interpretation, "interpretation"]) || %{}
engine_verses = interp |> Map.get("verses", []) |> to_string_list()
reading = engine_reading_text(data)
attrs =
Map.merge(base, %{
reasoning: single_judge_reasoning(data, context),
reasoning:
if(reading, do: single_judge_reasoning(data, context) <> " " <> reading, else: single_judge_reasoning(data, context)),
torah_references: Enum.uniq([scope_ref | engine_verses]),
panel_size: 1,
vote_count_for: 1,
vote_count_against: 0,
processing_component: "bereishit_cycle"
processing_component: if(reading, do: "bereishit_cycle+talmudic_engine", else: "bereishit_cycle")
})
{:interpretation, attrs, nil}
@@ -740,7 +850,10 @@ defmodule VavPipeline.BereishitCycle do
@doc false
defp route_if_unresolved(data, context) do
roots = Map.get(data, :roots_activated, [])
context_roots = Enum.map(roots, & &1.shoresh)
# Tablet 55: the engine names roots by letter (bet_resh_aleph); the
# Hebrew was sent since Step 14 and never matched a verse fact, so
# every Talmudic interpretation was "resolved" over an empty trace.
context_roots = roots |> Enum.map(&engine_root_name/1) |> Enum.reject(&is_nil/1)
case_ref = Map.get(data, :case_ref, generate_case_ref())
@@ -970,6 +1083,40 @@ defmodule VavPipeline.BereishitCycle do
defp letters_to_hebrew(_), do: nil
# The inverse: Hebrew consonant → letter name, finals folded to their base.
@hebrew_to_name Map.new(@consonant_names, fn {name, heb} -> {heb, name} end)
|> Map.merge(%{"ך" => "kaf", "ם" => "mem", "ן" => "nun", "ף" => "pe", "ץ" => "tsadi"})
@doc """
The root as the Talmudic Engine names it — letter names joined by `-`
(`json_bridge` `parse_root_name` → `bet_resh_aleph`, the form of its
verse facts). From the letter names the Shoresh Engine gives when it
has them, else from the Hebrew (the L1 fallback carries only that).
Tablet 55: the engine was being sent the Hebrew, which its facts never
match — 5 roots in, 0 verses out, and "resolved" over the emptiness.
`nil` when the root carries nothing nameable.
"""
@spec engine_root_name(map()) :: String.t() | nil
def engine_root_name(root) when is_map(root) do
letters = Map.get(root, :shoresh_letters) || []
names =
if is_list(letters) and letters != [] do
Enum.map(letters, &String.downcase(to_string(&1)))
else
root
|> Map.get(:shoresh)
|> case do
s when is_binary(s) -> s |> String.graphemes() |> Enum.map(&Map.get(@hebrew_to_name, &1))
_ -> [nil]
end
end
if names != [] and Enum.all?(names, &is_binary/1), do: Enum.join(names, "-"), else: nil
end
def engine_root_name(_), do: nil
# ============================================================
# Private helpers
# ============================================================
@@ -1250,7 +1250,11 @@ defmodule VavPipeline.BigdeiKodesh.Router do
{:ok,
%{
roots: Enum.map(roots_full, & &1.shoresh),
# The engine's verse facts name roots by letter — bet_resh_aleph —
# and json_bridge reads "bet-resh-aleph". The cycle's root carries
# the letter names beside the Hebrew; the Hebrew never matches
# (live, 2026-10-19: 5 roots sent, 0 verses found, "resolved").
roots: roots_full |> Enum.map(&VavPipeline.BereishitCycle.engine_root_name/1) |> Enum.reject(&is_nil/1),
roots_full: roots_full,
torah_ref: {String.to_atom(scope.book), scope.chapter, scope.verse},
read_from: Map.get(state, :roots_read_from)
+4 -2
View File
@@ -403,8 +403,10 @@ defmodule VavPipeline.BigdeiKodeshTest do
body = Jason.decode!(conn.resp_body)
assert body["deliberation"]["outcome"] == "teiku"
assert body["deliberation"]["panel_size"] == 1
assert body["deliberation"]["majority"]["votes"] == 0
assert body["deliberation"]["minority"]["reasoning"] =~ "no consultation"
# the one judge abstained: an abstaining majority of one, no dissent
assert body["deliberation"]["majority"]["votes"] == 1
assert body["deliberation"]["majority"]["reasoning"] =~ "no consultation"
assert body["deliberation"]["minority"]["votes"] == 0
end
# Tablet 55: with a consultation behind the judges, the dialectic
@@ -0,0 +1,27 @@
defmodule VavPipeline.Tablet55EngineRootNameTest do
@moduledoc """
Tablet 55: the Talmudic Engine names roots by letter (bet_resh_aleph,
read from "bet-resh-aleph"). The pipeline was sending it the Hebrew,
which its verse facts never match — roots in, no verses out, and a
"resolved" reading over the emptiness.
"""
use ExUnit.Case, async: true
alias VavPipeline.BereishitCycle
test "from the Shoresh Engine's letter names" do
assert BereishitCycle.engine_root_name(%{shoresh: "ברא", shoresh_letters: ["bet", "resh", "aleph"]}) ==
"bet-resh-aleph"
end
test "from the Hebrew alone (the L1 fallback), finals folded" do
assert BereishitCycle.engine_root_name(%{shoresh: "דבר", shoresh_letters: []}) == "dalet-bet-resh"
assert BereishitCycle.engine_root_name(%{shoresh: "מלך"}) == "mem-lamed-kaf"
end
test "nothing nameable → nil, never a Hebrew string the engine cannot read" do
assert BereishitCycle.engine_root_name(%{shoresh: nil}) == nil
assert BereishitCycle.engine_root_name(%{shoresh: "x1"}) == nil
assert BereishitCycle.engine_root_name(%{}) == nil
end
end