the name: Bikoret — code, contracts, images

Headers X-Bikoret-Key / -Rebuke / -Verdict / -Bedikah; the `bikoret`
object and the "— bikoret …" fringe on a gate reply; environment
variables BIKORET_*; the image user and paths (/home/bikoret,
/tmp/bikoret, /var/lib/bikoret/manna, /etc/bikoret/secrets,
/opt/bikoret/spec); the tmp-bikoret pod volume; local databases
bikoret_dev/_test. Kubernetes resource names, the shorashim_app role and
the domain are unchanged (Tamid §1.1, "the names that still carry the
old word"). Doorpost c963c4fe…. Elixir 604/0, L3 10/0, korban 295,
Prolog bedikah 44/44. Gitea repo renamed heaviness510/bikoret (old URL
redirects).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/docker/Dockerfile.korban_processor

@@ -2,7 +2,7 @@
 # ^ The --platform=linux/amd64 pins below are DELIBERATE (Exoscale SKS
 #   nodes are amd64). BuildKit lints a constant --platform as a smell;
 #   here it is the fix. Silenced so a real warning is not lost in noise.
-# Shorashim Korban Processor — Python offering protocol
+# Bikoret Korban Processor — Python offering protocol
 # Construction spec §1.1: Python 3.12.2
 # Processes korbanot (model outputs) through the offering protocol
 #
@@ -45,17 +45,17 @@ RUN python /tmp/lock_to_requirements.py poetry.lock > /tmp/requirements.txt && \
 # === RUNTIME STAGE ===
 FROM --platform=linux/amd64 python:3.12.2-slim
 
-RUN useradd --create-home --shell /bin/bash shorashim
-USER shorashim
+RUN useradd --create-home --shell /bin/bash bikoret
+USER bikoret
 
-WORKDIR /home/shorashim/korban_processor
+WORKDIR /home/bikoret/korban_processor
 
-COPY --from=build --chown=shorashim:shorashim /app/ ./
+COPY --from=build --chown=bikoret:bikoret /app/ ./
 COPY --from=build /usr/local/lib/python3.12/site-packages/ /usr/local/lib/python3.12/site-packages/
 
 # PYTHONPATH puts korban_processor first; azazel_processor is a
 # sibling package under the same src/ tree (see build stage above).
-ENV PYTHONPATH=/home/shorashim/korban_processor/src
+ENV PYTHONPATH=/home/bikoret/korban_processor/src
 
 # L1 Torah filesystem — baked into the image
 # L1 is read-only in fact, not only in name. Until 2026-10-04 the scroll
@@ -69,7 +69,7 @@ RUN chmod -R a-w,a+rX /mnt/torah
 # The second scroll (bishe'arecha §IV): the mesorah snapshot, read-only like L1.
 COPY --chown=root:root mesorah/ /mnt/mesorah/
 RUN chmod -R a-w,a+rX /mnt/mesorah
-USER shorashim
+USER bikoret
 
 ENV L1_MOUNT_POINT=/mnt/torah
 ENV MESORAH_MOUNT_POINT=/mnt/mesorah

deploy/docker/Dockerfile.shoresh_engine

@@ -2,7 +2,7 @@
 # ^ The --platform=linux/amd64 pins below are DELIBERATE (Exoscale SKS
 #   nodes are amd64). BuildKit lints a constant --platform as a smell;
 #   here it is the fix. Silenced so a real warning is not lost in noise.
-# Shorashim Shoresh Engine — Haskell root activation engine
+# Bikoret Shoresh Engine — Haskell root activation engine
 # Construction spec §1.1: GHC 9.6.4, Cabal 3.10
 # Communicates with vav_pipeline via Erlang Port (stdin/stdout)
 #
@@ -58,10 +58,10 @@ ENV LANG=en_US.UTF-8
 ENV LANGUAGE=en_US:en
 ENV LC_ALL=en_US.UTF-8
 
-RUN useradd --create-home --shell /bin/bash shorashim
-USER shorashim
+RUN useradd --create-home --shell /bin/bash bikoret
+USER bikoret
 
-WORKDIR /home/shorashim
+WORKDIR /home/bikoret
 
 COPY --from=build /usr/local/bin/shoresh-engine ./shoresh-engine
 
@@ -74,7 +74,7 @@ COPY --from=build /usr/local/bin/shoresh-engine ./shoresh-engine
 USER root
 COPY --chown=root:root l1/ /mnt/torah/
 RUN chmod -R a-w,a+rX /mnt/torah
-USER shorashim
+USER bikoret
 
 # L1 mount point
 ENV L1_MOUNT_POINT=/mnt/torah

deploy/docker/Dockerfile.talmudic_engine

@@ -2,7 +2,7 @@
 # ^ The --platform=linux/amd64 pins below are DELIBERATE (Exoscale SKS
 #   nodes are amd64). BuildKit lints a constant --platform as a smell;
 #   here it is the fix. Silenced so a real warning is not lost in noise.
-# Shorashim Talmudic Engine — SWI-Prolog dialectical reasoning
+# Bikoret Talmudic Engine — SWI-Prolog dialectical reasoning
 # Construction spec §1.1: SWI-Prolog 9.2.2
 # Communicates with vav_pipeline via Unix domain socket
 #
@@ -21,12 +21,12 @@ RUN swipl -g "consult('src/main'),halt(0)" -t "halt(1)"
 # === RUNTIME STAGE ===
 FROM --platform=linux/amd64 swipl:9.2.2
 
-RUN useradd --create-home --shell /bin/bash shorashim
-USER shorashim
+RUN useradd --create-home --shell /bin/bash bikoret
+USER bikoret
 
-WORKDIR /home/shorashim/talmudic_engine
+WORKDIR /home/bikoret/talmudic_engine
 
-COPY --from=build --chown=shorashim:shorashim /app/ ./
+COPY --from=build --chown=bikoret:bikoret /app/ ./
 
 # L1 Torah filesystem — baked into the image
 # L1 is read-only in fact, not only in name. Until 2026-10-04 the scroll
@@ -37,13 +37,13 @@ COPY --from=build --chown=shorashim:shorashim /app/ ./
 USER root
 COPY --chown=root:root l1/ /mnt/torah/
 RUN chmod -R a-w,a+rX /mnt/torah
-USER shorashim
+USER bikoret
 
 # L1 mount point
 ENV L1_MOUNT_POINT=/mnt/torah
 
 # Socket path for communication with vav_pipeline
-ENV TALMUDIC_SOCKET_PATH=/tmp/shorashim/talmudic.sock
+ENV TALMUDIC_SOCKET_PATH=/tmp/bikoret/talmudic.sock
 
 # Start the Prolog socket server.
 #
@@ -58,6 +58,6 @@ ENV TALMUDIC_SOCKET_PATH=/tmp/shorashim/talmudic.sock
 # is actually honoured; serve/0 falls back to the same path hardcoded
 # as default_socket_path/1. vav_pipeline dials the socket at
 # :talmudic_socket_path (config/config.exs), and deployment.yaml mounts
-# the shared talmudic-socket volume at /tmp/shorashim in both
+# the shared talmudic-socket volume at /tmp/bikoret in both
 # containers, so the two ends must agree on this path.
 CMD ["swipl", "-g", "consult('src/main'), (getenv('TALMUDIC_SOCKET_PATH', P) -> serve(P) ; serve)", "-t", "halt(1)"]

deploy/docker/Dockerfile.vav_pipeline

@@ -2,7 +2,7 @@
 # ^ The --platform=linux/amd64 pins below are DELIBERATE (Exoscale SKS
 #   nodes are amd64). BuildKit lints a constant --platform as a smell;
 #   here it is the fix. Silenced so a real warning is not lost in noise.
-# Shorashim Vav Pipeline — Elixir/OTP release with Sanhedrin
+# Bikoret Vav Pipeline — Elixir/OTP release with Sanhedrin
 # Construction spec §1.1: Elixir 1.16.1, OTP 26.2.1
 # The pipeline and Sanhedrin run in the same BEAM VM.
 #
@@ -59,7 +59,7 @@ FROM --platform=linux/amd64 ubuntu:jammy-20240125
 # binary onto the shoresh-bin volume with an init container). GHC-built
 # executables link libgmp; without it the spawn dies with
 #   error while loading shared libraries: libgmp.so.10
-# and Shorashim runs with no root activation, no te'amim parsing and no
+# and Bikoret runs with no root activation, no te'amim parsing and no
 # gematria while still reporting itself healthy.
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
@@ -73,13 +73,13 @@ ENV LANGUAGE=en_US:en
 ENV LC_ALL=en_US.UTF-8
 
 # Non-root user — the system serves, it does not own
-RUN useradd --create-home --shell /bin/bash shorashim
-USER shorashim
+RUN useradd --create-home --shell /bin/bash bikoret
+USER bikoret
 
-WORKDIR /home/shorashim
+WORKDIR /home/bikoret
 
 # Copy the release
-COPY --from=build --chown=shorashim:shorashim \
+COPY --from=build --chown=bikoret:bikoret \
   /app/vav_pipeline/_build/prod/rel/vav_pipeline ./app
 
 # L1 Torah filesystem — baked into the image (read-only, ~29MB)
@@ -95,7 +95,7 @@ RUN chmod -R a-w,a+rX /mnt/torah
 # The second scroll (bishe'arecha §IV): the mesorah snapshot, read-only like L1.
 COPY --chown=root:root mesorah/ /mnt/mesorah/
 RUN chmod -R a-w,a+rX /mnt/mesorah
-USER shorashim
+USER bikoret
 
 # === INSCRIBE THE DOORPOST ===
 # Devarim 11:20 — ukhtavtam al mezuzot beitecha uvish'arecha. A running
@@ -113,20 +113,20 @@ USER shorashim
 # The hash over these files must equal Doorpost.expected_hash(); if it
 # does not, this image was built from a tree whose specs and witness
 # disagreed, and the pod says so at startup.
-COPY --chown=shorashim:shorashim BUILD_AZAZEL.md BUILD_KORBAN.md \
-     /opt/shorashim/spec/
-COPY --chown=shorashim:shorashim specs/ /opt/shorashim/spec/specs/
-COPY --chown=shorashim:shorashim talmudic_engine/src/halt/ \
-     /opt/shorashim/spec/talmudic_engine/src/halt/
-COPY --chown=shorashim:shorashim talmudic_engine/src/middot/ \
-     /opt/shorashim/spec/talmudic_engine/src/middot/
+COPY --chown=bikoret:bikoret BUILD_AZAZEL.md BUILD_KORBAN.md \
+     /opt/bikoret/spec/
+COPY --chown=bikoret:bikoret specs/ /opt/bikoret/spec/specs/
+COPY --chown=bikoret:bikoret talmudic_engine/src/halt/ \
+     /opt/bikoret/spec/talmudic_engine/src/halt/
+COPY --chown=bikoret:bikoret talmudic_engine/src/middot/ \
+     /opt/bikoret/spec/talmudic_engine/src/middot/
 
 # L1 mount point
 ENV L1_MOUNT_POINT=/mnt/torah
 ENV MESORAH_MOUNT_POINT=/mnt/mesorah
 
 # Manna provision file location
-ENV MANNA_PROVISION_FILE=/var/lib/shorashim/manna/today.json
+ENV MANNA_PROVISION_FILE=/var/lib/bikoret/manna/today.json
 
 # PostgreSQL connection for L3
 # Set DATABASE_URL in production deployment