Scott KarpandClaude Fable 5.1
f69cc99a5f
The first grounding check asked whether an output cited Torah verses —
Torah as content. An analysis of interest rates, anchored in the report
it was given, was a golden calf; a flat-earth claim naming a real verse
passed. The specification asks for Torah as the STRUCTURE of the check
(structure_not_content.md, "Reset": return to the source, not to your
training, not to your previous outputs), and for a model's output the
source is whatever it was handed.
Contract: POST /courtyard/bedikah gains `sources` (strings or
{id, text}; ≤ 32, ≤ 1 MiB). Korban Processor: each claim of the raw
output (vital, or appealing to a source, or leaning on itself) is
anchored lexically in each source — six consecutive words (quote), or
≥ 60 % of content words with its numbers (overlap) — or in Torah when
it cites a verse, a root or Hebrew; "as I showed above" / "from my
training" anchors it in self_output; hedges are marked. Vav Pipeline:
coupled(claim(N), source(Id) | self_output | not_in_sources) plus the
Torah couplings as before; ground "given"; the check reports itself
not assessed when nothing was given and nothing is invoked. Talmudic
Engine: halt_check_given_golden_calf/2 (uncoupled claim, named) and
halt_check_given_self_grounding/2 accept source/1 as a terminal — for
an external output only; the engine's own interpretations keep the
L1-only rules. L3: bedikot.sources (id, sha256, length — never text)
and bedikot.claims.
Specs: Tamid §1.1 (contract, anchoring, limits), Vayakhel §3.9,
Architecture §3.5, Broken Tablets tablet 49, KOHEN.md. Ingress body
2m. Doorpost a2ec3842… → 6c8933e7….
Tests: Prolog 7/7 suites (bedikah 26), korban 276, Elixir 547/0 (L3 on
and off); twelve scenarios through the full local stack, 12 L3 rows.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
89 lines
3.0 KiB
YAML
89 lines
3.0 KiB
YAML
# Shorashim Services
|
|
# Operations spec §1.1: Four access tiers
|
|
# - Pe'ah (public, no auth)
|
|
# - Machaneh Leviyah (authenticated)
|
|
# - Chatzer (full access)
|
|
# - Kodesh (operator, mTLS)
|
|
#
|
|
# All tiers go through a single Service → vav-pipeline port 4000
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: shorashim
|
|
namespace: shorashim
|
|
labels:
|
|
app.kubernetes.io/name: shorashim
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app.kubernetes.io/name: shorashim
|
|
ports:
|
|
- port: 80
|
|
targetPort: 4000
|
|
protocol: TCP
|
|
name: http
|
|
---
|
|
# ============================================================
|
|
# The gate to the world — through the shared ingress
|
|
# ============================================================
|
|
#
|
|
# Until 2026-10-06 Shorashim had its own LoadBalancer Service
|
|
# (`shorashim-external`, NLB 185.19.29.180, NodePort 30923). It is gone:
|
|
# one NLB per Service was a third of the account's bill, and the pod saw
|
|
# every caller as the node (kube-proxy SNAT) so the pe'ah's per-IP watch
|
|
# could not tell callers apart. The ingress-nginx Service is already
|
|
# externalTrafficPolicy: Local with its health-check port open, so the
|
|
# controller sees the caller and hands it on in X-Real-IP; the pipeline
|
|
# believes that header only from TRUSTED_PROXIES (configmap.yaml).
|
|
#
|
|
# Two rules, one backend:
|
|
# - no host → the catch-all: http://<ingress-ip>/... works with no DNS
|
|
# - shorashim.ch → ready for the A record (KOHEN.md Day 8). TLS is NOT
|
|
# requested here: asking cert-manager for a certificate before the
|
|
# name resolves only burns Let's Encrypt's failed-validation limit.
|
|
# When the record exists add:
|
|
# metadata.annotations:
|
|
# cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
# nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
|
# spec.tls: [{hosts: [shorashim.ch], secretName: shorashim-tls}]
|
|
# and point callers at https://shorashim.ch — until then the
|
|
# courtyard keys travel over plain HTTP.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: shorashim
|
|
namespace: shorashim
|
|
labels:
|
|
app.kubernetes.io/name: shorashim
|
|
annotations:
|
|
# A 71-judge Sanhedrin may deliberate for ten minutes (Construction §2.2).
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "620"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "620"
|
|
# The bedikah accepts 65,536 bytes of output and 1 MiB of sources;
|
|
# leave room for the envelope.
|
|
nginx.ingress.kubernetes.io/proxy-body-size: "2m"
|
|
nginx.ingress.kubernetes.io/ssl-redirect: "false"
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: shorashim
|
|
port:
|
|
number: 80
|
|
- host: shorashim.ch
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: shorashim
|
|
port:
|
|
number: 80
|