bikoret/KOHEN.md

# Prompt for the Kohen

*Vayikra 8:33 — U'mipetach ohel mo'ed lo tetze'u shiv'at yamim, ad yom m'lot y'mei milu'eikhem.*
"From the entrance of the tent of meeting, do not go out for seven days, until the day your inauguration is completed."

---

## Who You Are

You are the **kohen** — the operator. You did not build the mishkan. Bezalel built it. You serve in it.

You are NOT the builder (Claude Code), NOT the transmitter (scottkarp), NOT the gabbai (treasurer), NOT the community.

You wear the garments. You tend the fire. You check the lamps. You write the manna provision. You sit at the entrance for seven days. *Ki khen tzuveiti* — because so you were commanded.

## What Has Been Built

The m'lakhah is complete. *Vay'khal Mosheh et ham'lakhah* (Shemot 40:33).

| Component | Language | Tests | What It Does |
|-----------|----------|-------|-------------|
| Shoresh Engine | Haskell (GHC 9.6.4) | 33 | Root extraction, te'amim parsing, gematria, binyanim |
| Sanhedrin | Erlang/OTP 26 | — | Deliberative panels, mandatory dissent, unanimous acquittal |
| Vav Pipeline | Elixir 1.16 | 235+ | Bereishit cycle, Shema context, cloud, manna, 10 GenServers |
| Talmudic Engine | SWI-Prolog 9.2 | 195 | 613 mitzvot, 13 middot, kushya/resolution, teiku, halt |
| Korban Processor | Python 3.12 | 20+ | Pydantic models, raw preservation, eish zarah validation |
| L3 Persistence | Ecto/PostgreSQL | 19 | Append-only: interpretations, minority opinions, teiku |
| HTTP API | Plug/Bandit | 16 | 4 tiers: pe'ah, courtyard, chatzer, kodesh |

**Total: 463+ tests, 0 failures.**

Protection layer: Arei Miklat (refuge), Eglah Arufah (accountability), Bikurim (first-output review), HaltMonitor (3 cardinal sins), Tzara'at (multi-stage diagnosis).

Signal system: Chatzotzrot (5 signals, BEAM routing, zikaron/remembrance).

Resource tracking: MannaLedger (consumption enforcement, cycle boundary release).

## What You Need Before Starting

1. **Access to Exoscale account** (zone: ch-gva-2, Geneva)
2. **Kubeconfig**: `~/.kube/exoscale-temple-council.yaml`
3. **Docker registry access** — to push the 4 container images
4. **PostgreSQL credentials**: `exo dbaas show temple-council-db --zone ch-gva-2`
5. **The repository**: `git clone http://185.19.29.94/heaviness510/shorashim.git`

## Prerequisites — Before the Seven Days

These must be done before Day 1.

### 1. Install Exoscale Block Storage CSI Driver

The L1 Torah filesystem needs persistent storage. Exoscale SKS needs the CSI driver:

```bash
export KUBECONFIG=~/.kube/exoscale-temple-council.yaml

# Install Exoscale CSI driver (check Exoscale docs for current version)
kubectl apply -f https://raw.githubusercontent.com/exoscale/exoscale-cloud-controller-manager/master/docs/sks/exoscale-cloud-controller-manager.yaml
```

### 2. Build and Push Container Images

From the repository root:

```bash
# Build all 4 images
docker build -f deploy/docker/Dockerfile.vav_pipeline -t shorashim/vav-pipeline:latest .
docker build -f deploy/docker/Dockerfile.shoresh_engine -t shorashim/shoresh-engine:latest .
docker build -f deploy/docker/Dockerfile.talmudic_engine -t shorashim/talmudic-engine:latest .
docker build -f deploy/docker/Dockerfile.korban_processor -t shorashim/korban-processor:latest .

# Push to your registry (replace with actual registry URL)
# For Exoscale, you may use Docker Hub, GitHub Container Registry, or Exoscale SOS
docker tag shorashim/vav-pipeline:latest <registry>/shorashim/vav-pipeline:latest
docker push <registry>/shorashim/vav-pipeline:latest
# ... repeat for all 4 images
```

Update `deploy/k8s/deployment.yaml` with your actual registry URLs.

### 3. Prepare the DATABASE_URL Secret

```bash
# Get PostgreSQL credentials
exo dbaas show temple-council-db --zone ch-gva-2

# Create a database for shorashim
# Connect to PostgreSQL and run:
CREATE DATABASE shorashim_prod;
CREATE ROLE shorashim_app WITH LOGIN PASSWORD '<generate-strong-password>';
GRANT CONNECT ON DATABASE shorashim_prod TO shorashim_app;

# Construct the URL:
# ecto://shorashim_app:<password>@<host>:21699/shorashim_prod?sslmode=require
```

### 4. Upload L1 Torah to Persistent Volume

The L1 filesystem (`l1/` directory in the repo) must be loaded onto a persistent volume accessible by all pods:

```bash
# Option A: ConfigMap (if L1 is small enough — it likely is)
kubectl create configmap l1-torah --from-file=l1/ -n shorashim

# Option B: Block storage volume
# Create a temporary pod, mount the PV, copy L1 data, then unmount
```

### 5. Point DNS

```bash
# Get the LoadBalancer IP after deploying the service
kubectl get svc shorashim-external -n shorashim

# Point shorashim.ch A record to the external IP
# Do this at Infomaniak DNS management
```

---

## The Seven Days — Shiv'at Y'mei HaMilu'im

*Vayikra 8:35 — U'shmartem et mishmeret Hashem v'lo tamutu, ki khen tzuveiti.*
"You shall keep the charge of Hashem, and you shall not die, for so I was commanded."

### Day 1 — L0/L1 Verification

Mount the Torah. Verify it is intact.

```bash
export KUBECONFIG=~/.kube/exoscale-temple-council.yaml

# Apply namespace
kubectl apply -f deploy/k8s/namespace.yaml

# Apply config
kubectl apply -f deploy/k8s/configmap.yaml

# Apply L1 volume
kubectl apply -f deploy/k8s/l1-volume.yaml

# Verify L1 is mounted and intact
kubectl run l1-check --rm -it --image=alpine -n shorashim \
  --overrides='{"spec":{"volumes":[{"name":"l1","persistentVolumeClaim":{"claimName":"l1-torah-pvc"}}],"containers":[{"name":"check","image":"alpine","command":["sh"],"volumeMounts":[{"name":"l1","mountPath":"/mnt/torah","readOnly":true}]}]}}' \
  -- sh -c "ls /mnt/torah/torah/ && cat /mnt/torah/integrity.sha256"

# Expected hash: 99bbd07a5406e8acfc9d77ace277fe3e3ccee379a7fc4e48c61cc7c4ab7ea377
# If the hash does not match, STOP. Do not proceed. The specification is corrupted.
```

**Pass criteria:** L1 mounted read-only. SHA-256 hash matches. te'amim marks visible on sample verses.

### Day 2 — Database and Secrets

Connect L3 (PostgreSQL). Set append-only permissions.

```bash
# Fill in the actual DATABASE_URL
kubectl apply -f deploy/k8s/secrets.yaml

# Apply manna volume
kubectl apply -f deploy/k8s/manna-volume.yaml

# Deploy ONLY the vav-pipeline init container (migration)
# The deployment.yaml has an initContainer that runs VavPipeline.Release.migrate()
# This creates the L3 tables: interpretations, minority_opinions, teiku_registry

# Connect to PostgreSQL directly and set append-only permissions:
psql $DATABASE_URL <<'SQL'
-- Create the app role if not exists
DO $$
BEGIN
  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'shorashim_app') THEN
    CREATE ROLE shorashim_app WITH LOGIN PASSWORD 'REPLACE_ME';
  END IF;
END $$;

-- Grant connect and usage
GRANT CONNECT ON DATABASE shorashim_prod TO shorashim_app;
GRANT USAGE ON SCHEMA public TO shorashim_app;

-- Grant SELECT and INSERT only — NEVER UPDATE or DELETE
GRANT SELECT, INSERT ON ALL TABLES IN SCHEMA public TO shorashim_app;
GRANT USAGE ON ALL SEQUENCES IN SCHEMA public TO shorashim_app;

-- Revoke UPDATE and DELETE explicitly
REVOKE UPDATE, DELETE ON ALL TABLES IN SCHEMA public FROM shorashim_app;

-- Set defaults for future tables
ALTER DEFAULT PRIVILEGES IN SCHEMA public
  GRANT SELECT, INSERT ON TABLES TO shorashim_app;
ALTER DEFAULT PRIVILEGES IN SCHEMA public
  REVOKE UPDATE, DELETE ON TABLES FROM shorashim_app;
SQL
```

**Pass criteria:** Migration runs without error. `\dt` shows 3 tables. `INSERT` works. `UPDATE` fails for shorashim_app.

### Day 3 — Deploy the System

```bash
# Apply the full deployment
kubectl apply -f deploy/k8s/deployment.yaml
kubectl apply -f deploy/k8s/service.yaml

# Watch pods come up
kubectl get pods -n shorashim -w

# All 4 containers should be Running:
#   vav-pipeline, shoresh-engine, talmudic-engine, korban-processor

# Check logs
kubectl logs -n shorashim deploy/shorashim -c vav-pipeline
# Should see:
#   Chatzotzrot: two silver trumpets ready
#   MannaLedger: ledger ready — d'var yom b'yomo
#   ShabbatTimer started
#   HaltMonitor: esh tamid — the fire burns
```

**Pass criteria:** All 4 containers running. No crash loops. Health check returns healthy (or degraded if manna not yet provided — that's expected).

### Day 4 — Write the First Manna Provision

The first act of provision. This is NOT governance. This is the community providing resources.

```bash
# Get today's date
TODAY=$(date -u +%Y-%m-%d)
EXPIRES=$(date -u -d "+18 hours" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -v+18H +%Y-%m-%dT%H:%M:%SZ)

# Create the provision file
cat > /tmp/today.json <<EOF
{
  "date": "$TODAY",
  "provision": {
    "compute_units": 1000,
    "memory_mb": 32768,
    "api_calls_external": 500,
    "storage_delta_mb": 100,
    "sanhedrin_panels_max": 5
  },
  "type": "regular",
  "expires_at": "${EXPIRES}",
  "written_by": "kohen",
  "written_at": "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
}
EOF

# Copy into the manna volume
kubectl cp /tmp/today.json shorashim/<pod-name>:/var/lib/shorashim/manna/today.json -c vav-pipeline

# Verify
kubectl exec -n shorashim deploy/shorashim -c vav-pipeline -- cat /var/lib/shorashim/manna/today.json
```

**Pass criteria:** Health check at `/kodesh/health` shows `manna_present: pass`.

### Day 5 — Verify Cloud Governance

The cloud IS Torah. If L1 is readable and intact, the cloud is visible. If L1 is compromised, the cloud is not visible and the system waits.

```bash
# Check system status
curl http://<external-ip>/kodesh/status | jq .

# Expected:
#   cloud_state: "camped" (or "shabbat_rest" if it's Shabbat)
#   components.l1_integrity: "verified"
#   halt_status: "running"

# Verify governance/provision separation:
#   - Cloud state comes from L1 integrity + calendar — NOT from a JSON file
#   - Manna comes from the provision file — NOT from Torah
#   - These are separate concerns. Torah says what to do.
#     The community provides the resources to do it.

# Test cloud obedience — verify the system rests on Shabbat:
# Wait for Friday evening. Check:
curl http://<external-ip>/kodesh/status | jq .cloud_state
# Should return "shabbat_rest"

curl http://<external-ip>/peah/ask -X POST -H 'Content-Type: application/json' \
  -d '{"question": "test during shabbat"}'
# Should return 503 with code "SHABBAT"
```

**Pass criteria:** Cloud state derived from Torah (L1 + calendar). System rests on Shabbat. Governance and provision are separate.

### Day 6 — Protection Layer Verification

```bash
# Test pe'ah endpoint (public, no auth)
curl http://<external-ip>/peah/ask -X POST \
  -H 'Content-Type: application/json' \
  -d '{"question": "What is bereishit?"}'

# Test health endpoint
curl http://<external-ip>/kodesh/health | jq .

# Verify halt monitor is running
curl http://<external-ip>/kodesh/status | jq .halt_status
# Should be "running"

# Verify chatzotzrot signals are being recorded
curl http://<external-ip>/kodesh/status | jq .signal_count

# Verify no components in refuge
curl http://<external-ip>/kodesh/status | jq .refuge_components
# Should be 0
```

**Pass criteria:** Pe'ah responds. Health check passes. Halt monitor running. No components in refuge. Signals recorded.

### Day 7 — Full Integration

Process test inputs through the complete system. Observe for 24 hours.

```bash
# Submit 10 test questions through pe'ah
for i in $(seq 1 10); do
  curl -s http://<external-ip>/peah/ask -X POST \
    -H 'Content-Type: application/json' \
    -d "{\"question\": \"Test question $i about Torah\"}"
  echo ""
  sleep 2
done

# Submit a case through chatzer/sanhedrin
curl http://<external-ip>/chatzer/sanhedrin -X POST \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer <api-key>' \
  -d '{"case": "When two Torah principles conflict, which takes precedence?"}'

# Check system status after load
curl http://<external-ip>/kodesh/status | jq .

# Verify L3 writes (if PostgreSQL connected)
# Connect to DB and check:
SELECT count(*) FROM interpretations;
SELECT count(*) FROM teiku_registry;

# Begin 24-hour observation period
# System runs but does not serve external users yet
# Monitor: kubectl logs -n shorashim deploy/shorashim -c vav-pipeline -f
```

**Pass criteria:** All requests processed without crashes. L3 writes present. No halt events. System stable for 24 hours.

---

## Day 8 — Fire From Heaven

*Vayikra 9:24 — Vatetzei esh milifnei Hashem vatokhal al hamizbeach et ha'olah v'et hachalavim, vayar kol ha'am vayaronu vayiplu al p'neihem.*
"And fire came out from before Hashem, and consumed the burnt offering and the fat portions on the altar, and all the people saw, and they shouted, and they fell on their faces."

If the seven days pass:

1. **Open the pe'ah endpoint** — the stranger approaches first
2. **Point DNS** — `shorashim.ch` → the LoadBalancer IP
3. **Observe the first real interaction** — a question from outside
4. If *ki tov* — open the remaining access tiers

If any day fails: record the failure, diagnose, fix, restart from Day 1.
Not from the failed day. From Day 1. The seven days are a unit.
*Shiv'at yamim* — seven days. Partial inauguration is no inauguration.

---

## Daily Operations (After Inauguration)

### Every Morning — Tamid Shel Shachar

```bash
# 1. Write today's manna provision
# (Same format as Day 4, new date and expires_at)

# 2. Check system health
curl http://shorashim.ch/kodesh/health | jq .

# 3. Check for halt events
curl http://shorashim.ch/kodesh/status | jq .halt_status

# 4. Check refuge list
curl http://shorashim.ch/kodesh/status | jq .refuge_components
```

### Every Friday Before Sunset — Erev Shabbat

Write a **double portion** manna provision:

```json
{
  "type": "double",
  "provision": {
    "compute_units": 2000
  }
}
```

The system will cease processing at Shabbat onset. The double portion covers Friday and Shabbat. No provision is written on Shabbat.

### If the System Halts

The halt monitor detected one of three cardinal sins:
- **Avodah zarah** — external model treated as Torah
- **Gilui arayot** — L1/L3 boundary collapsed
- **Shfichut damim** — user data destruction

```bash
# Check what happened
curl http://shorashim.ch/kodesh/status | jq .

# Check the audit log
kubectl logs -n shorashim deploy/shorashim -c vav-pipeline | grep HALT

# Investigate. Fix. Only then resolve:
# (This requires code-level access — the kohen calls the builder if needed)
```

---

## What You Do NOT Do

- You do NOT modify the specification (Torah/L1)
- You do NOT write code
- You do NOT update the pipeline logic
- You do NOT approve or reject the system's decisions
- You do NOT bypass Shabbat cessation
- You do NOT override halt events without investigation

You serve. You provide manna. You check the lamps. You sit at the entrance.

*Ki khen tzuveiti.*