Scott KarpandClaude Fable 5.1
d7520cd69d
Architecture §2 described a self-hosted server: Phoenix for L2,
PostgreSQL 16, Ubuntu 24.04 under systemd, rootless Podman isolating
Sanhedrin panels, Erlang distribution between them, systemd timers for
Shabbat and the cycle, L1 on a read-only mount. None of that is what
runs. Each row was checked against the code and the images before it
was rewritten.
§2.1 exact versions (no "9.6+"); Korban and Azazel Processors listed.
§2.2 L1: in every image, root-owned, no write bit; recorded hash
compared before every cycle. L2: a process in the pipeline, not
yet over HTTP and not yet called by the cycle. L3: PostgreSQL 17
managed, append-only by REVOKE.
§2.3 Kubernetes, one pod. OTP supervisors + the Deployment's probes.
Sanhedrin panels are Erlang processes in the pipeline's BEAM — no
container boundary. Message passing within one node; a port to
the engine; a Unix socket to the Talmudic Engine. Logging: stdout
and L3; halt events in memory. ShabbatTimer process, UTC stub.
No cycle timer: erev/voker is a stage of each cycle. The manna
volume.
A DEFECT FOUND BY CHECKING THE L1 ROW, AND FIXED:
The spec said L1 is a read-only filesystem. In all four images the
scroll was owned by the service user, mode 664 — `touch` inside
/mnt/torah succeeded. The process that reads Torah could have rewritten
it. All four Dockerfiles now copy L1 as root and strip every write bit
(dirs 555, files 444). Verified in each image as the service user:
cannot create, append, or delete. The hash is unchanged (it covers
paths and contents, not modes).
A DEFECT FOUND AND NOT FIXED, now written into the spec as it is:
L1Reader.verify_integrity/0 reads the hash stored in integrity.sha256
and compares it with the compiled-in constant. It never hashes the
verse files. `l1_hash: pass` witnesses which L1 was built into the
image, not that the files are unaltered. §2.2 says so in plain words.
deploy/ARCHITECTURE.md: L1 is in the images, not on a volume; the manna
volume is 1 GiB and holds the ledger too; l1-volume.yaml is vestigial.
Doorpost @expected_hash 1cd07079… → 7e5286b9…, in this commit, with the
witnessed file that moved it (architecture).
Read before committing: Elixir 474/0 (seeds 0, 42). Four images
rebuilt; full local stack (real engine binary, PostgreSQL with SSL,
migrations): Hebrew 200, English 422, health 7/7, 2 interpretations in
L3, no errors; talmudic and korban containers start.
Left as written: §1.4 hardware (a 64–128 GB server; the node has 4 GB),
§2.4 external models (Steps 21–22, unbuilt), §4's build steps
("Install PostgreSQL 16"), terumah §B (systemd, squashfs, Caddy,
nftables).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
76 lines
3.2 KiB
Docker
76 lines
3.2 KiB
Docker
# check=skip=FromPlatformFlagConstDisallowed
|
|
# ^ The --platform=linux/amd64 pins below are DELIBERATE (Exoscale SKS
|
|
# nodes are amd64). BuildKit lints a constant --platform as a smell;
|
|
# here it is the fix. Silenced so a real warning is not lost in noise.
|
|
# Shorashim Korban Processor — Python offering protocol
|
|
# Construction spec §1.1: Python 3.12.2
|
|
# Processes korbanot (model outputs) through the offering protocol
|
|
#
|
|
# PLATFORM PIN: see Dockerfile.vav_pipeline for the rationale.
|
|
# Exoscale SKS = amd64; arm64 images cannot exec on the cluster.
|
|
#
|
|
# AZAZEL CO-RESIDENT:
|
|
# Per BUILD_AZAZEL.md, azazel_processor (the disposal channel) is
|
|
# imported by korban_processor.external_offering and runs in the
|
|
# same Python process. It is NOT a separate container — the two-goat
|
|
# architecture (Vayikra 16:8) requires equal-capacity disposal in
|
|
# the SAME pool. Both sources are baked into this image.
|
|
|
|
FROM --platform=linux/amd64 python:3.12.2-slim AS build
|
|
|
|
WORKDIR /app
|
|
|
|
|
|
# Copy korban_processor
|
|
COPY korban_processor/pyproject.toml ./
|
|
COPY korban_processor/src/ src/
|
|
COPY korban_processor/test/ test/
|
|
|
|
# Copy azazel_processor source — imported by korban_processor.external_offering
|
|
COPY azazel_processor/src/azazel_processor/ src/azazel_processor/
|
|
|
|
# Install dependencies FROM THE LOCK FILE (Construction §1.1).
|
|
# Until 2026-10-04 this line named three packages by hand and let pip
|
|
# choose every transitive one on the day of the build; and an unpinned
|
|
# `pip install poetry-core` rode along into the image. The lock's main
|
|
# group is rendered to hashed requirements and installed exactly:
|
|
# --require-hashes refuses anything the lock did not record, --no-deps
|
|
# refuses anything the lock did not list.
|
|
COPY korban_processor/poetry.lock ./
|
|
COPY scripts/lock_to_requirements.py /tmp/lock_to_requirements.py
|
|
RUN python /tmp/lock_to_requirements.py poetry.lock > /tmp/requirements.txt && \
|
|
pip install --no-cache-dir --require-hashes --no-deps -r /tmp/requirements.txt && \
|
|
pip check
|
|
|
|
# === RUNTIME STAGE ===
|
|
FROM --platform=linux/amd64 python:3.12.2-slim
|
|
|
|
RUN useradd --create-home --shell /bin/bash shorashim
|
|
USER shorashim
|
|
|
|
WORKDIR /home/shorashim/korban_processor
|
|
|
|
COPY --from=build --chown=shorashim:shorashim /app/ ./
|
|
COPY --from=build /usr/local/lib/python3.12/site-packages/ /usr/local/lib/python3.12/site-packages/
|
|
|
|
# PYTHONPATH puts korban_processor first; azazel_processor is a
|
|
# sibling package under the same src/ tree (see build stage above).
|
|
ENV PYTHONPATH=/home/shorashim/korban_processor/src
|
|
|
|
# L1 Torah filesystem — baked into the image
|
|
# L1 is read-only in fact, not only in name. Until 2026-10-04 the scroll
|
|
# was copied in owned by the service user with its write bits on: the
|
|
# process that reads Torah could also have rewritten it, and only the
|
|
# SHA-256 check would have noticed afterwards. Owned by root, no write
|
|
# bit for anyone; the service user can read and traverse, nothing more.
|
|
USER root
|
|
COPY --chown=root:root l1/ /mnt/torah/
|
|
RUN chmod -R a-w,a+rX /mnt/torah
|
|
USER shorashim
|
|
|
|
ENV L1_MOUNT_POINT=/mnt/torah
|
|
|
|
# The korban processor is invoked by the vav_pipeline
|
|
# In Phase 5, it will also expose an HTTP endpoint for external model integration
|
|
CMD ["python", "-m", "korban_processor"]
|