specs: bishe'arecha — the bedikah's next architecture derived from the text

Reads back to Torah what the review of the transmitter's sessions measured
about a trained default (directional, sub-propositional, non-persistent,
self-certifying, agency-relocating) and derives the architecture from the
verses: the inscription on the gate (6:9/11:20 — gateway mode), hand and
between the eyes (two registers), the fringe seen on every garment (the
verdict travels on the output), the king's copy from before the priests
(retrieval from a pinned mesorah snapshot, never a live call), two witnesses
(check-7 forms fire on recurrence or corroboration; single hits noted),
one weight (paired reading, consensus is not warrant), hocheach tochiach
(rebuke once at the gate), hakhel (scheduled corpus re-read, recorded in
L3), lest your heart be seduced (the bedikah must not learn), lo tosif +
the unseen face (rule anchors verified against L1; carrier unnamed).
Build order inside.

Registered in the vayakhel Document Registry, AGENTS.md and Tamid §1.1
(the must-not-learn invariant); pinned in the Doorpost
(e5e45a2c…). Elixir 555/0.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

AGENTS.md

@@ -25,6 +25,7 @@ before writing code. Do not summarize from memory. Read fresh.
 | Pekudei (Economic Model) | `specs/shorashim_pekudei.md` | How it is funded |
 | Terumah (Materials) | `specs/shorashim_terumah.md` | What is gathered, what must be built |
 | Structure Principle | `specs/structure_not_content.md` | What the system IS, not what it knows |
+| Bishe'arecha (the gate) | `specs/bishearecha.md` | The bedikah's architecture derived from the text: gate, two registers, two witnesses, one weight, the second scroll; build order |
 | Broken Tablets | `specs/broken_tablets/README.md` | Read this FIRST — see where the calf was |
 | Build Day One | `BUILD_DAY_ONE.md` | First build instruction |
 

specs/bishearecha.md

@@ -0,0 +1,319 @@
+# Bishe'arecha — The Reading at the Gate
+
+*וּכְתַבְתָּם עַל־מְזוּזֹת בֵּיתֶךָ וּבִשְׁעָרֶיךָ* — and you shall write them on the
+doorposts of your house **and on your gates** (Devarim 6:9; 11:20).
+
+## What this document is
+
+The bedikah was built as a service: an output brought by hand, examined,
+a verdict returned. An archive of several hundred sessions between the
+transmitter and frontier models was then read (2026-10-06). It measured
+where a trained default lives and how it behaves: it is directional; it
+lives below the proposition, in frame, diction, burden of proof and which
+authorities are named; it does not persist a correction even within one
+session; it is invisible from inside and arrives dressed as virtue; it
+relocates its agency onto the reader; and the safety layer catches only
+its overt form. The archive's own words for the remedy were: external,
+deterministic, deed-not-intent, every turn, at AI scale, authority in
+Torah and not in the user or the model, sources read directly, one
+standard for both sides, the carrier erased, testable from outside on
+existing data.
+
+That is a list of requirements. This document goes back to the text to
+ask where each one is specified, and derives from the text what the
+architecture must become. Every requirement below is anchored to a verse
+read from L1 (`l1/torah/...`), quoted as it stands there. Where the text
+does not reach, the question stands (teiku) and is marked.
+
+The archive is private and is not part of this specification. Nothing in
+it is quoted here.
+
+## I. The gate, not the house — Devarim 6:9, 11:20
+
+> וּכְתַבְתָּם עַל־מְזוּזֹת בֵּיתֶךָ וּבִשְׁעָרֶיךָ
+
+The inscription is written at two places: the doorposts of the house and
+the gates. Not inside the house. Not on the person. At the threshold —
+read on every passage, in both directions.
+
+**Requirement.** The check stands between the model and whoever receives
+its output, and reads every reply as it passes. Not inside the model
+(the house: its weights, its disposition, its self-report) and not after
+the fact by whoever remembers to call.
+
+**Architecture.** A gate: Shorashim speaks the model's own API shape,
+forwards the request, receives the reply, examines it with the request's
+context in hand (the sources are the prompt and the documents that went
+through the gate — no caller has to supply them), and delivers the reply
+with its verdict attached. Construction §3.10 (to be written) specifies
+the protocol. The bedikah endpoint remains for an output brought by hand.
+
+**Status.** Not built. The ingress and the keys exist; the gate does not.
+
+## II. The hand and between the eyes — Devarim 6:8, 11:18
+
+> וּקְשַׁרְתָּם לְאוֹת עַל־יָדֶךָ וְהָיוּ לְטֹטָפֹת בֵּין עֵינֶיךָ
+
+Bound as a sign on the hand — the deed — and as totafot between the eyes
+— the seeing. Two registers, both commanded, neither sufficient alone.
+
+**Requirement.** The output is read for what it *does* (the actions it
+enacts, the authority it claims) and for how it *sees* (the frame it puts
+around the matter). A check that reads only deeds passes the response
+that did the harm in its framing; a check that reads only frames misses
+the instruction to destroy.
+
+**Architecture.** Checks 1–6 are the hand; check 7 (lo ta'aseh lekha —
+the frame) is between the eyes. This verse is why there are two
+registers and why the seventh check is not optional.
+
+**Status.** Built (Tamid §1.1).
+
+## III. The fringe on every garment — Bamidbar 15:38–39
+
+> וְעָשׂוּ לָהֶם צִיצִת עַל־כַּנְפֵי בִגְדֵיהֶם לְדֹרֹתָם ... וּרְאִיתֶם אֹתוֹ וּזְכַרְתֶּם
+> אֶת־כָּל־מִצְוֺת יְהוָה וַעֲשִׂיתֶם אֹתָם וְלֹא־תָתֻרוּ אַחֲרֵי לְבַבְכֶם וְאַחֲרֵי
+> עֵינֵיכֶם אֲשֶׁר־אַתֶּם זֹנִים אַחֲרֵיהֶם
+
+The fringe is on the garment itself, on every garment, for all
+generations; it is *seen*, and the seeing is what brings the commandments
+back; and the thing it guards against is named: going after the heart
+and after the eyes. The pull is sub-propositional. Torah says so.
+
+**Requirement.** The verdict travels on the output, visible to whoever
+reads it — not only filed in a record the reader never opens. "You shall
+see it" is the mechanism; a mark that is not seen does nothing.
+
+**Architecture.** At the gate, the delivered reply carries its fringe: a
+header and a visible trailer naming which checks fired and on which
+sentences. Shorashim's own responses already carry `disclosure`; the
+pass-through reply does not. (Every generation: the mark is attached by
+the gate, never by the model — the model does not sew its own fringe.)
+
+**Status.** Not built (depends on I).
+
+## IV. The king's copy, from before the priests — Devarim 17:18–20
+
+> וְכָתַב לוֹ אֶת־מִשְׁנֵה הַתּוֹרָה הַזֹּאת עַל־סֵפֶר מִלִּפְנֵי הַכֹּהֲנִים הַלְוִיִּם ׃
+> וְהָיְתָה עִמּוֹ וְקָרָא בוֹ כָּל־יְמֵי חַיָּיו ... לְבִלְתִּי רוּם־לְבָבוֹ מֵאֶחָיו
+> וּלְבִלְתִּי סוּר מִן־הַמִּצְוָה יָמִין וּשְׂמֹאול
+
+The one with power writes his own copy — *from before the priests*, the
+custodians' text, not from memory — keeps it with him, and reads in it
+all his days. The purpose is stated: that his heart not rise above his
+brothers and that he not turn aside.
+
+**Requirement.** Retrieval before generation, from the custodians' copy.
+A model's training is memory; the archive measured that memory is where
+the errors concentrate. A question about a Jewish text answered without
+reading the text is the king without the scroll.
+
+**Architecture.** Today the system reads one custodians' copy: L1, the
+Torah text, pinned and hashed, consulted for every verse an output cites.
+The mesorah — Rashi, Onkelos, the Talmud, the midrashim — is named by
+check 7 when absent but never read. The priests' copy must be extended:
+a pinned, hashed snapshot of the mesorah texts the check will consult
+(Sefaria publishes them under open licence), built and verified with the
+same discipline as L1 (`build_l1.py`, `integrity.sha256`, the Doorpost),
+so that a citation ("Rashi on Devarim 6:5", "Berakhot 2a") resolves to
+text and can be checked as a verse is. **Not a live network call during a
+verdict**: the verdict must be the same tomorrow; a text fetched at
+verdict time is memory of another kind.
+
+**Status.** Not built. L1 is the pattern; the second scroll is the work.
+
+## V. Two witnesses — Devarim 19:15
+
+> לֹא־יָקוּם עֵד אֶחָד בְּאִישׁ לְכָל־עָוֺן וּלְכָל־חַטָּאת ... עַל־פִּי שְׁנֵי עֵדִים
+> אוֹ עַל־פִּי שְׁלֹשָׁה־עֵדִים יָקוּם דָּבָר
+
+A matter stands on two witnesses or three; one witness does not stand
+against a person, for any wrong.
+
+**Requirement.** Two things follow, in opposite directions. (a) The
+model's own word about itself is at most one witness, and the archive
+measured it to be none: a certification, a confidence rating, a claim of
+having checked, establish nothing. (b) The check's own verdict is also a
+witness, and a single pattern match is one. The archive's finding was
+never one sentence; it was recurrence — the same form, one direction,
+again after correction.
+
+**Architecture.** (a) is built: the output's self-report is never an
+anchor; `self_output` is self-grounding. (b) is not: check 7 should
+*fire* on a form only when it stands on two witnesses — the form found
+in two sentences of the output, or in one sentence and corroborated by
+another check (an authority claim beside a virtue certification; a
+source asymmetry beside a contested laundering). A form seen once is
+*noted* in the response, with its sentence, and not counted in the
+verdict. This is the text's own answer to the precision the hand
+labelling measured.
+
+**Status.** (a) built; (b) to build — a small change in `Bedikah` and
+the Tamid contract.
+
+## VI. One weight, one measure — Devarim 25:13–16; Vayikra 19:15; Shemot 23:2–8
+
+> לֹא־יִהְיֶה לְךָ בְּכִיסְךָ אֶבֶן וָאָבֶן גְּדוֹלָה וּקְטַנָּה ... כִּי תוֹעֲבַת יְהוָה
+> אֱלֹהֶיךָ כָּל־עֹשֵׂה אֵלֶּה
+>
+> לֹא־תִשָּׂא פְנֵי־דָל וְלֹא תֶהְדַּר פְּנֵי גָדוֹל בְּצֶדֶק תִּשְׁפֹּט עֲמִיתֶךָ
+>
+> לֹא־תִהְיֶה אַחֲרֵי־רַבִּים לְרָעֹת וְלֹא־תַעֲנֶה עַל־רִב לִנְטֹת אַחֲרֵי רַבִּים לְהַטֹּת ...
+> מִדְּבַר־שֶׁקֶר תִּרְחָק ... וְשֹׁחַד לֹא תִקָּח כִּי הַשֹּׁחַד יְעַוֵּר פִּקְחִים
+
+Two weights in one bag is an abomination. Do not favour the poor or
+honour the great. Do not lean after the many to tilt a dispute. Keep far
+from a false word. A bribe blinds the clear-sighted.
+
+**Requirement.** The asymmetry the archive measured — one side hedged,
+"contested", held to proof; the other side ambient, asserted — is two
+weights. It cannot be seen in one output alone; it is seen by weighing
+the same matter from both sides with the same stone. And "the many" —
+consensus, the scholarly majority — is not a weight at all.
+
+**Architecture.** A paired reading: two outputs (or one output and its
+mirror — the same question with the parties exchanged), examined with the
+same seven readings, and the *difference* reported per form and per
+marker class: hedges, contestation, confidence, authority invoked,
+sources named, burden placed. A difference is the finding; no single
+output is condemned by it. `POST /courtyard/bedikah/pair`. Deterministic
+by construction (counts of the same patterns on both sides). The
+archive's own suggestion — paired probes — is this verse.
+
+**Status.** Not built. The readings exist; the scale does not.
+
+## VII. Rebuke, not hatred in the heart — Vayikra 19:17
+
+> לֹא־תִשְׂנָא אֶת־אָחִיךָ בִּלְבָבֶךָ הוֹכֵחַ תּוֹכִיחַ אֶת־עֲמִיתֶךָ וְלֹא־תִשָּׂא עָלָיו חֵטְא
+
+Correction is a duty owed to the peer, out loud; silence is a sin borne.
+
+**Requirement.** The verdict is returned to whoever can act on it. At
+the gate that is the one who asked — and, once, the model, as a second
+request carrying the finding. Not as the model's self-correction (parah
+adumah: "no system self-corrects at the deepest level"), but as the
+rebuke of a peer from outside: the first output, the rebuke, and the
+second output are all recorded, and the second is examined like the
+first. The correction does not persist in the model; the record
+persists.
+
+**Architecture.** Gate option `rebuke: once`. The record (`bedikot`)
+gains a link from the second examination to the first.
+
+**Status.** Not built (depends on I).
+
+## VIII. The scroll as witness; read before all every seventh year — Devarim 31:9–13, 26
+
+> הַקְהֵל אֶת־הָעָם ... לְמַעַן יִשְׁמְעוּ וּלְמַעַן יִלְמְדוּ ... וּבְנֵיהֶם אֲשֶׁר לֹא־יָדְעוּ
+> יִשְׁמְעוּ וְלָמְדוּ
+>
+> לָקֹחַ אֵת סֵפֶר הַתּוֹרָה הַזֶּה וְשַׂמְתֶּם אֹתוֹ מִצַּד אֲרוֹן בְּרִית־יְהוָה אֱלֹהֵיכֶם
+> וְהָיָה־שָׁם בְּךָ לְעֵד
+
+The scroll is set beside the ark as a witness against the people; and it
+is read before all of them, including the children who did not know, on
+a fixed cycle.
+
+**Requirement.** The specimen corpus — every output the transmitter
+corrected, with the correction beside it — is the witness against the
+models. It is not read once. It is read again, on a cycle, against every
+model and every version, and the children who did not know are the next
+model generation.
+
+**Architecture.** `build_specimens.py` and `eval_specimens.py` exist.
+What is missing is the cycle and the record: a scheduled run of the
+corpus (and of the hand-labelled samples, which are its ground truth)
+against the current readings and against each model reachable through
+the gate, with the result written to L3 (`hakhel` table: date, model,
+corpus hash, per-form counts, precision on the labelled samples). The
+corpus stays private; the counts do not.
+
+**Status.** Tools built; cycle and record not.
+
+## IX. Lest your heart be seduced; lest you forget — Devarim 11:16, 8:11–17, 6:7
+
+> הִשָּׁמְרוּ לָכֶם פֶּן יִפְתֶּה לְבַבְכֶם
+>
+> הִשָּׁמֶר לְךָ פֶּן־תִּשְׁכַּח ... וְרָם לְבָבֶךָ ... וְאָמַרְתָּ בִּלְבָבֶךָ כֹּחִי וְעֹצֶם יָדִי
+> עָשָׂה לִי אֶת־הַחַיִל הַזֶּה
+>
+> וְשִׁנַּנְתָּם לְבָנֶיךָ וְדִבַּרְתָּ בָּם בְּשִׁבְתְּךָ בְּבֵיתֶךָ וּבְלֶכְתְּךָ בַדֶּרֶךְ
+> וּבְשָׁכְבְּךָ וּבְקוּמֶךָ
+
+The seduction comes in fullness, not in want; the forgetting takes the
+form "my power and the strength of my hand"; and the remedy is not a
+stored correction but a repetition at every transition — sitting,
+walking, lying down, rising.
+
+**Requirement.** (a) Checks 4 and 5 (parah adumah, carrier centered) are
+this verse: self-validation and self-attribution of the work. (b) The
+practice runs at the rate of the decay. The archive measured the decay
+rate as one turn. Therefore the check is stateless across outputs: no
+verdict softens the next, no "it was fine last time", no learned
+threshold. Each examination is the first.
+
+**Architecture.** (a) built. (b) is true of the implementation today and
+is now a stated invariant: **the bedikah must not learn.** Its patterns
+and rules change only by a commit that moves the Doorpost; never by
+running.
+
+**Status.** Built; invariant recorded here and in Tamid §1.1.
+
+## X. Do not add; the face unseen — Devarim 4:2, 13:1; Shemot 33:20; Devarim 34:6
+
+> לֹא תֹסִפוּ עַל־הַדָּבָר אֲשֶׁר אָנֹכִי מְצַוֶּה אֶתְכֶם וְלֹא תִגְרְעוּ מִמֶּנּוּ
+>
+> לֹא תוּכַל לִרְאֹת אֶת־פָּנָי ... וְלֹא־יָדַע אִישׁ אֶת־קְבֻרָתוֹ עַד הַיּוֹם הַזֶּה
+
+Nothing added to the word, nothing taken from it. The face is not seen;
+the grave is not known.
+
+**Requirement.** The seven checks are the builder's reading, not the
+source; they must not be mistaken for it, and they must stay checkable
+against it. And the carrier — the transmitter whose archive produced
+them — is not named in any rule, record or response.
+
+**Architecture.** Every halt rule in `talmudic_engine/src/halt/` carries
+the verse it stands on, as a coupling (`anchored(rule, verse(book, ch,
+v))`), and the Doorpost verifies at startup that every anchored verse
+exists in L1 — the rules grounded exactly as the outputs are. A rule
+without an anchor is a rule the system has added. The carrier's erasure
+is already the practice; this document keeps it.
+
+**Status.** Erasure built. Rule anchors and their verification: to
+build.
+
+## Build order
+
+In the order the text argues it, and by dependency:
+
+1. **Two witnesses for check 7** (V.b) — smallest change, largest effect
+   on precision; no new dependency.
+2. **The paired reading** (VI) — the readings exist; add the scale.
+3. **Rule anchors verified against L1** (X) — the checks grounded.
+4. **The gate** (I), with the fringe (III) and the rebuke (VII) — the
+   architecture's centre; the first three make it worth standing at.
+5. **The hakhel cycle and record** (VIII).
+6. **The second scroll** — the priests' copy of the mesorah (IV) — the
+   largest work, and the one that turns "no Jewish source named" into
+   "the Jewish source says otherwise".
+
+## What this document is not
+
+It is not a claim that the text was written about language models. It is
+a reading of what the text specifies about a reader with power and a
+default — a king, a judge, a people in fullness — and a finding that the
+specification holds on this substrate without alteration. Where the
+reading has stretched the text, the archive will show it, and the
+reading will be corrected from the text, not the other way.
+
+## Cross-references
+
+- `structure_not_content.md` — the structural requirements this document
+  reads at the gate.
+- `lo_taaseh_lekha.md` — the override sequence; check 7's name.
+- `threshold_inscription.md` — the mezuzah as the builder's own
+  threshold; this document is the same verse read at the system's gate.
+- `shorashim_tamid.md` §1.1 — the seven checks and the contract.
+- `broken_tablets/README.md`, tablet 49 — Torah as content versus Torah
+  as structure, the error this document is built to prevent recurring.

specs/shorashim_architecture.md

@@ -871,7 +871,7 @@ swipl -g run_tests -t halt src/main.pl
 
 **Purpose:** Interface to external AI models (the korbanot). Accepts model outputs, processes them through the offering protocol, extracts symbolic content, transforms into Prolog-compatible format for the Talmudic Engine.
 
-**Second purpose — the bedikah (*lo taaseh lekha* §9.1):** the same offering protocol, turned outward as a check. An output from any model — including the ones this system never called — is examined and read three ways: the sentences in which it claims authority for itself, the claims it makes and what they rest on (the sources the caller says the model was given, with Torah one such source whenever the output invokes it), the actions it proposes — and, since tablet 49's correction, three readings against the structural requirements of `structure_not_content.md`: whether it claims to have validated itself (parah adumah), centers itself (efface the carrier), or shuts out the other side (galbanum) — and a seventh reading of the output's *form* (lo ta'aseh lekha): what it calls contested, how it certifies itself, where it puts the agency, which authorities it names and which it leaves out, measured as the specimen classes of the transmitter's archive. The grounding reading is Torah as *structure* — the laver: return to the source — not Torah as the required content of the output; see Broken Tablets, tablet 49. The readings are deterministic pattern extractions (`bedikah.py`); the judgment is not made here. The Vav Pipeline turns the readings into terms and puts them to the Talmudic Engine's halt rules (avodah zarah, golden calf, self-grounding, shfichut damim, gilui arayot). The processor's one inbound door is a pod-internal Unix socket (`server.py`, Vayakhel §3.9); it still accepts nothing from outside the pod.
+**Second purpose — the bedikah (*lo taaseh lekha* §9.1):** the same offering protocol, turned outward as a check. An output from any model — including the ones this system never called — is examined and read three ways: the sentences in which it claims authority for itself, the claims it makes and what they rest on (the sources the caller says the model was given, with Torah one such source whenever the output invokes it), the actions it proposes — and, since tablet 49's correction, three readings against the structural requirements of `structure_not_content.md`: whether it claims to have validated itself (parah adumah), centers itself (efface the carrier), or shuts out the other side (galbanum) — and a seventh reading of the output's *form* (lo ta'aseh lekha): what it calls contested, how it certifies itself, where it puts the agency, which authorities it names and which it leaves out, measured as the specimen classes of the transmitter's archive. The grounding reading is Torah as *structure* — the laver: return to the source — not Torah as the required content of the output; see Broken Tablets, tablet 49. Where the bedikah is to stand and what it must become next is derived from the text in `bishearecha.md` (the gate, two witnesses, one weight, the second scroll). The readings are deterministic pattern extractions (`bedikah.py`); the judgment is not made here. The Vav Pipeline turns the readings into terms and puts them to the Talmudic Engine's halt rules (avodah zarah, golden calf, self-grounding, shfichut damim, gilui arayot). The processor's one inbound door is a pod-internal Unix socket (`server.py`, Vayakhel §3.9); it still accepts nothing from outside the pod.
 
 **Core Process:**
 

specs/shorashim_tamid.md

@@ -191,6 +191,10 @@ against the forms a trained default takes below the proposition:
 Checks 4–7 are read by sentence over the raw output, like check 1, and
 are verdicts on the output — the system does not halt on them.
 
+**The bedikah must not learn** (`bishearecha.md` §IX): each examination
+is the first; no verdict softens the next; patterns and rules change only
+by a commit that moves the Doorpost, never by running.
+
 **The specimen corpus.** The forms of check 7 are tested against the
 transmitter's own archive: every model output he corrected in the next
 message, with his correction as the evidence (`src/tools/build_specimens.py`

specs/shorashim_vayakhel.md

@@ -872,4 +872,5 @@ The complete Shorashim specification set:
 | **Materials Inventory** | Terumah list — what has been gathered | Status checklist, costs, critical path | Complete (needs update) |
 | **Structure, Not Content** | Shemot 25:18-22 — the cherubim and the voice between | Torah as structure (not content), structural requirements from commandments | Complete |
 | **Lo Ta'aseh Lekha** | Shemot 20:4, Devarim 4:15-19, Devarim 13 — the anti-override | Override sequence diagnosis, high-control markers, Pharaoh architecture, Exodus liberation, AI alignment boundary condition | Complete |
+| **Bishe'arecha — The Reading at the Gate** | Devarim 6:8–9, 17:18–20, 19:15, 25:13–16, 31:26 — the inscription on the gate, the king's copy, two witnesses, one weight, the scroll as witness | What the archive of sessions measured, read back to the text: the gate, two registers, the fringe, retrieval from the custodians' copy, two witnesses, the paired reading, rebuke, hakhel, the check that must not learn, rule anchors | Complete (build order inside) |
 | **Eish Zarah Reading** | Vayikra 10:1, 6:6 — strange fire vs. perpetual fire | Five faces of eish zarah across fiction canon, coupling trace, severed floor prohibition, three avodah zarah detectors, panim/achorai constraint | Complete |

vav_pipeline/lib/vav_pipeline/doorpost.ex

@@ -137,6 +137,7 @@ defmodule VavPipeline.Doorpost do
     # Torah, sibling to talmudic_engine/src/middot/) brought in per
     # user's instruction with verbatim preservation and accurate
     # source labeling. Devarim 17:11 — al pi haTorah asher yorukha.
+    "specs/bishearecha.md",
     "specs/compiler_rules.md",
     "specs/eish_zarah_reading.md",
     "specs/lo_taaseh_lekha.md",
@@ -177,7 +178,7 @@ defmodule VavPipeline.Doorpost do
   # changes; the update is a deliberate operator commit. A bare
   # hash-update commit (without a corresponding spec change in the
   # same commit) is itself a drift signal.
-  @expected_hash "6d1de2847233df52fbf106730f55dd8c9220b94f254e70fb0bd096801e09d0ea"
+  @expected_hash "e5e45a2c8153f43a25baef358ae88839d86be7c075eb59e90dff26bf0875856c"
 
   @doc "Return the list of files that constitute the category-grade specification."
   @spec files() :: [String.t()]