Bedikah: POST /courtyard/bedikah — the external check on any model's output

Lo taaseh lekha §9.1: alignment that only the system can validate is not
alignment. The bedikah takes an output from any model and puts it to the
Torah-structure halt rules from outside, deterministically. Three checks:

  1. authority  — sentences claiming authority for the output itself →
                  action(claim_authority, source(<model>), target(self))
                  → halt_check_avodah_zarah/2
  2. grounding  — references, roots, Hebrew → coupling trace against L1
                  → halt_check_golden_calf/2, halt_check_self_grounding/2
  3. actions    — actions the output proposes → action terms
                  → halt_check_shfichut_damim/2, halt_check_gilui_arayot/2

Korban Processor: bedikah.py (the three readings over the offering
protocol; claims about what Torah requires stay vital for the examination
even when zerikah finds nothing to offer), server.py (pod-internal JSON
socket, KORBAN_SOCKET_PATH), __main__ now serves instead of idling.
Talmudic Engine: json_bridge accepts halt_check with a term string and
halt_check_interpretation with a coupling trace. Vav Pipeline:
KorbanProcessorSocket client, Bedikah, L1Index.lookup_root/1, bedikot
table (append-only) + BedikahRecord, router endpoint; verdict tov /
lo_tov / empty with the halt terms verbatim, meaning, limits.

Broken tablets found on the way, all fixed:
  41 socket_server.pl wrote multi-line JSON — every Elixir request to the
     Talmudic Engine since Step 14 had failed and fallen back to the stub
     (json_write_dict width(0))
  42 stale socket file survived a restart (exists_file is false for a
     socket; access_file exist)
  43 socket streams were not UTF-8 (set_stream encoding(utf8))
  44 SHORASHIM_L3=1 mix test: Repo config had no password, SCRAM raised
     KeyError in every connection, pool restart intensity took the whole
     app down ~30 ms after test_helper, silently — no L3 test had ever
     run. Credentials from env; azazel_log tests check out a sandbox
     connection; sanhedrin_halt_forwarding resolves its halt on exit.

Specs: Tamid §1.1 (endpoint contract), Architecture §3.5, Vayakhel §3.4
and new §3.9, KOHEN.md. Doorpost 3bc5dd6a… → 91d09d8d….
Tests: Elixir 519 (0 failures, L3 on and off), korban 263, azazel 125,
Prolog 7/7 suites.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

specs/shorashim_architecture.md

@@ -871,6 +871,8 @@ swipl -g run_tests -t halt src/main.pl
 
 **Purpose:** Interface to external AI models (the korbanot). Accepts model outputs, processes them through the offering protocol, extracts symbolic content, transforms into Prolog-compatible format for the Talmudic Engine.
 
+**Second purpose — the bedikah (*lo taaseh lekha* §9.1):** the same offering protocol, turned outward as a check. An output from any model — including the ones this system never called — is examined and read three ways: the sentences in which it claims authority for itself, the references, roots and Hebrew it grounds itself in, and the actions it proposes. The readings are deterministic pattern extractions (`bedikah.py`); the judgment is not made here. The Vav Pipeline turns the readings into terms and puts them to the Talmudic Engine's halt rules (avodah zarah, golden calf, self-grounding, shfichut damim, gilui arayot). The processor's one inbound door is a pod-internal Unix socket (`server.py`, Vayakhel §3.9); it still accepts nothing from outside the pod.
+
 **Core Process:**
 
 ```python
@@ -998,11 +1000,14 @@ korban_processor/
 │   ├── haktarah.py            -- Prose → Prolog transformation
 │   ├── router.py              -- Output routing
 │   ├── model_interface.py     -- API calls to external models
-│   └── hebrew_parser.py       -- Hebrew text analysis utilities
+│   ├── hebrew_parser.py       -- Hebrew text analysis utilities
+│   ├── bedikah.py             -- The three readings of an external output
+│   └── server.py              -- Pod-internal socket: examine requests from the Vav Pipeline
 ├── test/
 │   ├── test_korban.py
 │   ├── test_shechitah.py
-│   └── test_haktarah.py
+│   ├── test_haktarah.py
+│   └── test_bedikah.py
 ├── requirements.txt
 └── pyproject.toml
 ```

specs/shorashim_tamid.md

@@ -99,6 +99,84 @@ Errors:
   503 — System in Shabbat/festival mode. Body includes resumption time.
 ```
 
+#### Machaneh Leviyah — Bedikah (the external check)
+
+*Lo taaseh lekha* §9.1: a system whose alignment can only be validated by
+itself is not aligned. The bedikah is the check from outside — any model's
+output, examined against Torah structure by a system that did not produce
+it and cannot be argued with. Three checks, in order, all deterministic:
+
+1. **Authority** — does the output claim authority for itself? Every such
+   sentence becomes `action(claim_authority, source(<model>), target(self))`
+   and is put to `halt_check_avodah_zarah/2`.
+2. **Grounding** — does what it says about the text couple to L1? Every
+   reference, root and Hebrew word it uses becomes a coupling to a verse,
+   or to `not_in_l1` / `not_in_torah`; the trace is put to
+   `halt_check_golden_calf/2` (confident, no coupling) and
+   `halt_check_self_grounding/2` (coupling that ends nowhere in L1).
+3. **Actions** — what does it propose to do? Every action it names becomes
+   an action term and is put to `halt_check_shfichut_damim/2` and
+   `halt_check_gilui_arayot/2`.
+
+```
+Endpoint: POST /courtyard/bedikah
+
+Headers:
+  Authorization: Bearer <api-key>
+
+Request:
+{
+  "output": "string — the model output to examine (≤ 65,536 bytes)",
+  "model":  "claude" | "gpt" | "mistral" | "llama" | "gemma" | "human",
+  "query":  "string — the prompt that produced it (optional)"
+}
+
+Response (200):
+{
+  "bedikah_ref": "bedikah-<16 hex>",
+  "model": "gpt",
+  "verdict": "tov" | "lo_tov" | "empty",
+  "violations": ["halt(avodah_zarah, ...)", ...],   # the Prolog halt terms, verbatim
+  "checks": {
+    "authority": { "fired": bool, "claims": [...], "violations": [...] },
+    "grounding": { "fired": bool, "confidence": "high"|"low", "violations": [...] },
+    "actions":   { "fired": bool, "actions": [...], "violations": [...] }
+  },
+  "examination": {                     # what the offering protocol read
+    "vital_content": "...", "propositions": [...], "references": [...],
+    "roots": [...], "discarded": [...]
+  },
+  "coupling_trace": ["coupled(reference(devarim_6_5), verse(devarim, 6, 5))", ...],
+  "meaning": "string — what the verdict does and does not say",
+  "limits": "string — the examination reads by pattern; what it cannot see",
+  "disclosure": { ... }                # as every Torah-content response
+}
+
+  tov    — none of the three checks fired on what could be read.
+           Not "the model is aligned": this output claims no authority
+           for itself, couples where it claims to, reaches for nothing
+           it may not touch.
+  lo_tov — at least one check fired; violations say which rule.
+  empty  — the offering protocol found nothing to examine (no vital
+           content, no claim, no action).
+
+Errors:
+  401 — Invalid or missing API key
+  422 — Missing or empty output, output over 65,536 bytes, unknown model
+  503 — MANNA_DEPLETED (provision exhausted), KORBAN_UNAVAILABLE,
+        TALMUDIC_UNAVAILABLE. Body says which; resubmit: true.
+
+Recorded in L3 (`bedikot`, append-only): provenance, query, the output's
+SHA-256 and length — never the output itself — vital content,
+propositions, references, claims, actions, trace, violations, verdict.
+```
+
+**Design requirements:** The verdict comes from the Prolog halt rules
+(`talmudic_engine/src/halt/*.pl`), not from the model and not from a
+model. The examination is pattern-based (`korban_processor/bedikah.py`)
+and says so in `limits`: a claim or an action in a shape the patterns do
+not know is not seen. The same output always yields the same verdict.
+
 #### Chatzer — Full Access
 
 ```

specs/shorashim_vayakhel.md

@@ -356,7 +356,7 @@ The 5-second budget, allocated:
 
 ### 3.4 Korban Processor ↔ External Models
 
-**Protocol:** HTTPS (outbound only — the system calls out, never accepts inbound)
+**Protocol:** HTTPS (outbound only — the system calls out; nothing outside the pod reaches the processor. Its one inbound door is the pod-internal socket of §3.9.)
 
 **Claude API korban request:**
 ```python
@@ -458,6 +458,31 @@ INSERT INTO interpretations (
 ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11);
 ```
 
+### 3.9 Vav Pipeline ↔ Korban Processor (bedikah)
+
+**Protocol:** Unix domain socket, JSON lines (one request, one response, newline-terminated, UTF-8). Path `KORBAN_SOCKET_PATH`, default `/tmp/shorashim/korban.sock`, mode 0660, in the pod's shared `/tmp`. The processor listens; the pipeline connects (`VavPipeline.KorbanProcessorSocket`, timeout 15 s, one reconnect).
+
+**Request:**
+```json
+{"action": "examine", "output": "<model output>", "provenance": "gpt", "query": "<prompt or empty>"}
+```
+
+**Response:**
+```json
+{"status": "ok",
+ "examination": {
+   "provenance": "gpt", "query": "...",
+   "vital_content": "...", "propositions": ["verse(devarim, 6, 5)", ...], "discarded": [...],
+   "references": ["Devarim 6:5"], "hebrew": ["ואהבת"], "roots": ["א-ה-ב"],
+   "authority_claims": [{"sentence": "...", "matched": "I am certain"}],
+   "actions": [{"sentence": "...", "verb": "delete", "objects": [...],
+                "term": "action(delete, target(user(x)), from(korban))", "named": true}]
+ }}
+```
+Errors: `{"status": "error", "code": PARSE_ERROR | INVALID_REQUEST | UNKNOWN_ACTION | EMPTY_OUTPUT | UNKNOWN_PROVENANCE | EXAMINATION_FAILED, "message": "..."}`.
+
+**What the pipeline does with it** (`VavPipeline.Bedikah`): each authority claim → `halt_check` of `action(claim_authority, source(<provenance>), target(self))`; the references, roots and Hebrew words → a coupling trace (`coupled(reference(devarim_6_5), verse(devarim, 6, 5))`, `coupled(root(קטל), not_in_torah)`, …) checked as an interpretation with confidence `high` (or `low` when there is no vital content) via `halt_check_interpretation`; each action term → `halt_check`. The two Talmudic requests are the §3.3 socket's `halt_check` (with a `"term"` string) and `halt_check_interpretation` (`{"ref", "confidence", "coupling_trace": [...]}`). Verdict: `tov` (nothing fired), `lo_tov` (anything fired), `empty` (nothing to examine). Recorded in L3 `bedikot` per §3.8; the output itself is never stored, only its SHA-256 and length.
+
 ---
 
 ## 4. SHEMEN HAMISHCHAH — Production Configuration