Scott KarpandClaude Fable 5.1
42024279b9
Shemot 16: dvar yom b'yomo, and on the sixth day double, and none on the seventh. Every night at 00:00Z the day's provision went stale and the readiness probe failed until someone woke — 13.5 hours on 2026-10-15. CronJob `manna` (deploy/k8s/manna-cronjob.yaml) runs at 00:01Z Sunday to Friday in our own korban-processor image, mounts the manna PVC as the app's uid, and writes today.json from the ConfigMap's MANNA_* amounts — doubled on Friday, valid to Sunday 00:30Z. The pipeline now accepts Friday's `double` on Saturday (validate_date/3) and nothing else across a day boundary; three tests. The kohen sets the amounts, may still write by hand, and reads a failed job as the Day-4 alarm (KOHEN "The manna, each morning"; Tamid §1.1). Doorpost re-pinned. Elixir green. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
97 lines
4.4 KiB
YAML
97 lines
4.4 KiB
YAML
# The manna — written each morning by the system's own hand (Shemot 16).
|
||
#
|
||
# Until 2026-10-15 the day's provision was written by the kohen with
|
||
# `kubectl cp`, and every night at 00:00Z the old one went stale and the
|
||
# readiness probe failed until someone woke (13.5 hours on 2026-10-15).
|
||
# This CronJob writes today.json onto the manna PVC at 00:01Z, Sunday to
|
||
# Friday — a double portion on Friday that is valid through Shabbat, and
|
||
# nothing on Shabbat (Shemot 16:22–26: "on the sixth day they gathered
|
||
# double … on the seventh day there shall be none"). The kohen still sets
|
||
# the amounts (shorashim-config, MANNA_* below) and may still write a
|
||
# provision by hand at any hour; the CronJob only ends the gap.
|
||
#
|
||
# It runs our own korban-processor image (python, pinned to a commit tag)
|
||
# with the PVC mounted, as the app's uid/gid, so the file is readable by
|
||
# the pod; nothing else, no cluster permissions. ReadWriteOnce is fine:
|
||
# the cluster has one node and the job runs beside the pod.
|
||
apiVersion: batch/v1
|
||
kind: CronJob
|
||
metadata:
|
||
name: manna
|
||
namespace: shorashim
|
||
labels:
|
||
app.kubernetes.io/name: shorashim
|
||
app.kubernetes.io/component: manna
|
||
spec:
|
||
schedule: "1 0 * * 0-5" # 00:01Z, Sunday–Friday; none on Shabbat
|
||
timeZone: "Etc/UTC"
|
||
concurrencyPolicy: Forbid
|
||
startingDeadlineSeconds: 3600 # a missed 00:01 still runs within the hour
|
||
successfulJobsHistoryLimit: 3
|
||
failedJobsHistoryLimit: 3
|
||
jobTemplate:
|
||
spec:
|
||
backoffLimit: 2
|
||
template:
|
||
metadata:
|
||
labels:
|
||
app.kubernetes.io/name: shorashim
|
||
app.kubernetes.io/component: manna
|
||
spec:
|
||
restartPolicy: Never
|
||
securityContext:
|
||
runAsUser: 1000
|
||
runAsGroup: 1000
|
||
fsGroup: 1000
|
||
imagePullSecrets:
|
||
- name: shorashim-registry
|
||
volumes:
|
||
- name: manna
|
||
persistentVolumeClaim:
|
||
claimName: manna-pvc
|
||
containers:
|
||
- name: write-manna
|
||
image: exo.container-registry.com/the-recognition-protocol/korban-processor:c0d0555a
|
||
imagePullPolicy: IfNotPresent
|
||
envFrom:
|
||
- configMapRef:
|
||
name: shorashim-config
|
||
volumeMounts:
|
||
- name: manna
|
||
mountPath: /var/lib/bikoret/manna
|
||
resources:
|
||
requests: { cpu: "20m", memory: "32Mi" }
|
||
limits: { cpu: "200m", memory: "128Mi" }
|
||
command: ["python3", "-c"]
|
||
args:
|
||
- |
|
||
import json, os, datetime as dt
|
||
now = dt.datetime.now(dt.timezone.utc)
|
||
today = now.date()
|
||
friday = today.weekday() == 4
|
||
units = int(os.environ.get("MANNA_COMPUTE_UNITS", "1000"))
|
||
provision = {
|
||
"compute_units": units * (2 if friday else 1),
|
||
"memory_mb": int(os.environ.get("MANNA_MEMORY_MB", "32768")),
|
||
"api_calls_external": int(os.environ.get("MANNA_API_CALLS_EXTERNAL", "500")) * (2 if friday else 1),
|
||
"storage_delta_mb": int(os.environ.get("MANNA_STORAGE_DELTA_MB", "100")),
|
||
"sanhedrin_panels_max": int(os.environ.get("MANNA_SANHEDRIN_PANELS_MAX", "5")),
|
||
}
|
||
# Regular: through the day. Double (Friday): through Shabbat, to Sunday 00:30Z.
|
||
expires = (dt.datetime.combine(today + dt.timedelta(days=2), dt.time(0, 30), dt.timezone.utc)
|
||
if friday else dt.datetime.combine(today + dt.timedelta(days=1), dt.time(0, 30), dt.timezone.utc))
|
||
doc = {
|
||
"date": today.isoformat(),
|
||
"provision": provision,
|
||
"type": "double" if friday else "regular",
|
||
"expires_at": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),
|
||
"written_by": "manna-cronjob",
|
||
"written_at": now.strftime("%Y-%m-%dT%H:%M:%SZ"),
|
||
}
|
||
path = os.environ.get("MANNA_PROVISION_FILE", "/var/lib/bikoret/manna/today.json")
|
||
tmp = path + ".tmp"
|
||
with open(tmp, "w") as fh:
|
||
json.dump(doc, fh, indent=2)
|
||
os.replace(tmp, path)
|
||
print("manna written", doc["date"], doc["type"], "expires", doc["expires_at"])
|