Scott KarpandClaude Fable 5.1
79eb34840f
/courtyard/* and /chatzer/* admitted any `Authorization: Bearer <x>`. Every test sent `Bearer test-token`; none sent a wrong one. Every admitted request spends the day's manna. VavPipeline.BigdeiKodesh.Gate: keys are a file (Construction §4.6 — never env, never config, never git), one `tier key` per line, tiers courtyard < chatzer (the inner ring opens the outer). Constant-time compare against every line; no file / empty / unreadable → nobody passes, GATE_NO_KEYS in the log, the caller told only "missing or invalid". 403 FORBIDDEN for an outer key at an inner gate. Read on every request so a rotated key is live in ~1 min without a rollout. Deploy: Secret shorashim-api-keys projected at /etc/shorashim/secrets/api_keys (vav-pipeline only, 0440), API_KEYS_FILE in the configmap, template + issue/rotate recipe in secrets.yaml and KOHEN.md "Issuing a key". Spec: tamid §1.1 (gate, 403), vayakhel §4.6. Doorpost 91d09d8d… → 42b38626…. Tests: tablet45_gate_test (parse, tiers, wrong/near/empty/no key, no file) — Elixir 527/0. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
36 lines
1.3 KiB
Elixir
36 lines
1.3 KiB
Elixir
import Config
|
|
|
|
# L1 mount point — relative path for dev, absolute for production
|
|
# Construction spec §4.4: l1_mount_point: "/mnt/torah"
|
|
config :vav_pipeline,
|
|
# Dev: relative to project root (run from shorashim/)
|
|
l1_mount_point: "l1",
|
|
# Manna provision file
|
|
manna_provision_file: "var/manna/today.json",
|
|
# Shabbat check interval (1 minute)
|
|
cycle_boundary_check_interval_ms: 60_000,
|
|
# ShemaContext: no caching — always read fresh
|
|
shema_context_cache_ttl_ms: 0,
|
|
# Step 14 — Component connection config
|
|
# Shoresh Engine (Haskell) — binary path for Erlang Port
|
|
shoresh_engine_binary: "shoresh-engine",
|
|
shoresh_engine_cwd: nil,
|
|
# Talmudic Engine (Prolog) — Unix domain socket path
|
|
talmudic_socket_path: "/tmp/shorashim/talmudic.sock",
|
|
korban_socket_path: "/tmp/shorashim/korban.sock",
|
|
# Courtyard / chatzer keys (BigdeiKodesh.Gate). nil → the gate is shut.
|
|
# Construction §4.6: a file, never an environment variable.
|
|
api_keys_file: nil
|
|
|
|
# L3 — Oral Tradition (PostgreSQL)
|
|
# Architecture §3.7: Append-only. INSERT allowed. Never UPDATE. Never DELETE.
|
|
config :vav_pipeline, ecto_repos: [VavPipeline.Repo]
|
|
|
|
config :vav_pipeline, VavPipeline.Repo,
|
|
database: "shorashim_dev",
|
|
hostname: "localhost",
|
|
pool_size: 10
|
|
|
|
# Import environment specific config
|
|
import_config "#{config_env()}.exs"
|