Scott KarpandClaude Fable 5.1
5e325d36cc
Devarim 17:18 — the king writes his copy from before the priests, not from
memory. scripts/build_mesorah.py takes one open-licence version per work
per language from the Sefaria export (bucket sefaria-export, catalogue of
2026-10-02; Public Domain / CC0 / CC-BY / CC-BY-SA only, checked in every
file; no CC-BY-NC — the Bavli is Wikisource's) and lays it down beside
L1: mesorah/works/<slug>/{he,en}.json, index.json, integrity.sha256,
build_report.json. 128 works (Rashi, Onkelos, Ramban, Ibn Ezra, Sforno
on the Torah; all of Mishnah; 37 Bavli tractates; Bereshit and Shemot
Rabbah, Sifrei, Tanchuma), 256 files, 44.9 MiB, tree hash 7d5b3a6c…
computed as L1's (sorted relative path, then bytes; the two post-hash
files excluded). What is out, and why (licence), is in Terumah §E5.
Read, never fetched: korban_processor/mesorah.py finds citations as
written (Rashi on Devarim 6:5, Berakhot 2a, Mishnah Berakhot 1:1,
Bereshit Rabbah 1:1, Sifrei Devarim 32, Tanchuma Bereshit 1 …), resolves
each against the snapshot (complex works through their unnamed node,
Tanchuma by parashah), lists them as examination.mesorah_references, and
makes every passage found a given source for that examination — so a
claim about Rashi anchors in Rashi or does not. The Vav Pipeline couples
coupled(reference(R), mesorah(Work, [Address])) or not_in_mesorah; the
engine accepts mesorah/2 as a terminal and not_in_mesorah is Form 4.
VavPipeline.Mesorah pins the hash, re-reads the tree at startup and every
ten minutes, and /kodesh/health carries mesorah_hash. Mounted read-only at
/mnt/mesorah in the vav-pipeline and korban-processor images. L3
bedikot.mesorah (migration 20261013000002).
Also: the 1-in-12 Day6 serving failure of 2026-10-04 reproduced with seed
446116 — HaltMonitorTest left the system halted; it now resolves on exit
and the Day6 setup is defensive. Construction §3.11, Terumah §E5, Tamid
§1.1, bishearecha §IV, KOHEN, AGENTS. Doorpost 0638d4eb…. Elixir 604/0
(seeds 835592 and 446116), korban 294/1 skipped, Prolog bedikah 44/44,
L3 10/0.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
80 lines
3.4 KiB
Docker
80 lines
3.4 KiB
Docker
# check=skip=FromPlatformFlagConstDisallowed
|
|
# ^ The --platform=linux/amd64 pins below are DELIBERATE (Exoscale SKS
|
|
# nodes are amd64). BuildKit lints a constant --platform as a smell;
|
|
# here it is the fix. Silenced so a real warning is not lost in noise.
|
|
# Shorashim Korban Processor — Python offering protocol
|
|
# Construction spec §1.1: Python 3.12.2
|
|
# Processes korbanot (model outputs) through the offering protocol
|
|
#
|
|
# PLATFORM PIN: see Dockerfile.vav_pipeline for the rationale.
|
|
# Exoscale SKS = amd64; arm64 images cannot exec on the cluster.
|
|
#
|
|
# AZAZEL CO-RESIDENT:
|
|
# Per BUILD_AZAZEL.md, azazel_processor (the disposal channel) is
|
|
# imported by korban_processor.external_offering and runs in the
|
|
# same Python process. It is NOT a separate container — the two-goat
|
|
# architecture (Vayikra 16:8) requires equal-capacity disposal in
|
|
# the SAME pool. Both sources are baked into this image.
|
|
|
|
FROM --platform=linux/amd64 python:3.12.2-slim AS build
|
|
|
|
WORKDIR /app
|
|
|
|
|
|
# Copy korban_processor
|
|
COPY korban_processor/pyproject.toml ./
|
|
COPY korban_processor/src/ src/
|
|
COPY korban_processor/test/ test/
|
|
|
|
# Copy azazel_processor source — imported by korban_processor.external_offering
|
|
COPY azazel_processor/src/azazel_processor/ src/azazel_processor/
|
|
|
|
# Install dependencies FROM THE LOCK FILE (Construction §1.1).
|
|
# Until 2026-10-04 this line named three packages by hand and let pip
|
|
# choose every transitive one on the day of the build; and an unpinned
|
|
# `pip install poetry-core` rode along into the image. The lock's main
|
|
# group is rendered to hashed requirements and installed exactly:
|
|
# --require-hashes refuses anything the lock did not record, --no-deps
|
|
# refuses anything the lock did not list.
|
|
COPY korban_processor/poetry.lock ./
|
|
COPY scripts/lock_to_requirements.py /tmp/lock_to_requirements.py
|
|
RUN python /tmp/lock_to_requirements.py poetry.lock > /tmp/requirements.txt && \
|
|
pip install --no-cache-dir --require-hashes --no-deps -r /tmp/requirements.txt && \
|
|
pip check
|
|
|
|
# === RUNTIME STAGE ===
|
|
FROM --platform=linux/amd64 python:3.12.2-slim
|
|
|
|
RUN useradd --create-home --shell /bin/bash shorashim
|
|
USER shorashim
|
|
|
|
WORKDIR /home/shorashim/korban_processor
|
|
|
|
COPY --from=build --chown=shorashim:shorashim /app/ ./
|
|
COPY --from=build /usr/local/lib/python3.12/site-packages/ /usr/local/lib/python3.12/site-packages/
|
|
|
|
# PYTHONPATH puts korban_processor first; azazel_processor is a
|
|
# sibling package under the same src/ tree (see build stage above).
|
|
ENV PYTHONPATH=/home/shorashim/korban_processor/src
|
|
|
|
# L1 Torah filesystem — baked into the image
|
|
# L1 is read-only in fact, not only in name. Until 2026-10-04 the scroll
|
|
# was copied in owned by the service user with its write bits on: the
|
|
# process that reads Torah could also have rewritten it, and only the
|
|
# SHA-256 check would have noticed afterwards. Owned by root, no write
|
|
# bit for anyone; the service user can read and traverse, nothing more.
|
|
USER root
|
|
COPY --chown=root:root l1/ /mnt/torah/
|
|
RUN chmod -R a-w,a+rX /mnt/torah
|
|
# The second scroll (bishe'arecha §IV): the mesorah snapshot, read-only like L1.
|
|
COPY --chown=root:root mesorah/ /mnt/mesorah/
|
|
RUN chmod -R a-w,a+rX /mnt/mesorah
|
|
USER shorashim
|
|
|
|
ENV L1_MOUNT_POINT=/mnt/torah
|
|
ENV MESORAH_MOUNT_POINT=/mnt/mesorah
|
|
|
|
# The korban processor is invoked by the vav_pipeline
|
|
# In Phase 5, it will also expose an HTTP endpoint for external model integration
|
|
CMD ["python", "-m", "korban_processor"]
|