the name: Bikoret — code, contracts, images

Headers X-Bikoret-Key / -Rebuke / -Verdict / -Bedikah; the `bikoret`
object and the "— bikoret …" fringe on a gate reply; environment
variables BIKORET_*; the image user and paths (/home/bikoret,
/tmp/bikoret, /var/lib/bikoret/manna, /etc/bikoret/secrets,
/opt/bikoret/spec); the tmp-bikoret pod volume; local databases
bikoret_dev/_test. Kubernetes resource names, the shorashim_app role and
the domain are unchanged (Tamid §1.1, "the names that still carry the
old word"). Doorpost c963c4fe…. Elixir 604/0, L3 10/0, korban 295,
Prolog bedikah 44/44. Gitea repo renamed heaviness510/bikoret (old URL
redirects).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/k8s/deployment.yaml

@@ -1,4 +1,4 @@
-# Shorashim Deployment — the mishkan
+# Bikoret Deployment — the mishkan
 #
 # Shemot 40:33 — Vay'khal Mosheh et ham'lakhah.
 #
@@ -41,13 +41,13 @@ spec:
       # --- VOLUMES ---
       #
       # ONE shared /tmp volume, not two. There used to be a separate
-      # `talmudic-socket` volume mounted at /tmp/shorashim in
-      # vav-pipeline and talmudic-engine, WHILE `tmp-shorashim` was
+      # `talmudic-socket` volume mounted at /tmp/bikoret in
+      # vav-pipeline and talmudic-engine, WHILE `tmp-bikoret` was
       # mounted at /tmp in vav-pipeline and korban-processor. Nested
-      # mounts meant /tmp/shorashim resolved to a DIFFERENT volume than
-      # /tmp/shorashim reached through /tmp — so:
+      # mounts meant /tmp/bikoret resolved to a DIFFERENT volume than
+      # /tmp/bikoret reached through /tmp — so:
       #   - korban/azazel (Python) wrote AzazelRecord JSON to
-      #     tmp-shorashim:/shorashim/azazel/pending_l3
+      #     tmp-bikoret:/bikoret/azazel/pending_l3
       #   - AzazelIngest (Elixir) watched
       #     talmudic-socket:/azazel/pending_l3
       # Two directories with the same pathname on two different disks.
@@ -67,9 +67,9 @@ spec:
           persistentVolumeClaim:
             claimName: manna-pvc
         # Shared /tmp for every container that speaks over it:
-        # the Talmudic Unix socket (/tmp/shorashim/talmudic.sock) and
-        # the azazel file bridge (/tmp/shorashim/azazel/pending_l3).
-        - name: tmp-shorashim
+        # the Talmudic Unix socket (/tmp/bikoret/talmudic.sock) and
+        # the azazel file bridge (/tmp/bikoret/azazel/pending_l3).
+        - name: tmp-bikoret
           emptyDir: {}
         # Staging area for the Haskell shoresh-engine binary. Written
         # once by the shoresh-engine-install init container, read by
@@ -85,7 +85,7 @@ spec:
             defaultMode: 0440
 
       # --- POD SECURITY CONTEXT ---
-      # Every image runs as the non-root user `shorashim` (uid/gid
+      # Every image runs as the non-root user `bikoret` (uid/gid
       # 1000). fsGroup makes the kubelet chgrp the emptyDir volumes to
       # 1000 and set the setgid bit, so uid 1000 can actually WRITE
       # them. Without it the write side of each shared path depends on
@@ -94,7 +94,7 @@ spec:
       #   - shoresh-engine-install: cp ... Permission denied (loud —
       #     init fails, pod never starts; this one at least shouts)
       #   - azazel: the Python side cannot create
-      #     /tmp/shorashim/azazel/pending_l3 and the disposal channel
+      #     /tmp/bikoret/azazel/pending_l3 and the disposal channel
       #     has nowhere to put a record
       #   - talmudic-engine: cannot bind the Unix socket
       securityContext:
@@ -142,7 +142,7 @@ spec:
             - -c
             - |
               set -e
-              cp /home/shorashim/shoresh-engine /opt/shoresh/shoresh-engine
+              cp /home/bikoret/shoresh-engine /opt/shoresh/shoresh-engine
               chmod 0755 /opt/shoresh/shoresh-engine
               /opt/shoresh/shoresh-engine gematria שלום >/dev/null
               echo "shoresh-engine staged and exercised at /opt/shoresh/shoresh-engine"
@@ -223,13 +223,13 @@ spec:
                 name: shorashim-secrets
           volumeMounts:
             - name: manna
-              mountPath: /var/lib/shorashim/manna
+              mountPath: /var/lib/bikoret/manna
             # One /tmp. The Talmudic socket and the azazel pending_l3
             # directory both live under it.
-            - name: tmp-shorashim
+            - name: tmp-bikoret
               mountPath: /tmp
             - name: api-keys
-              mountPath: /etc/shorashim/secrets
+              mountPath: /etc/bikoret/secrets
               readOnly: true
             - name: shoresh-bin
               mountPath: /opt/shoresh
@@ -279,10 +279,10 @@ spec:
           image: exo.container-registry.com/the-recognition-protocol/talmudic-engine:latest
           volumeMounts:
             # Shares vav-pipeline's /tmp so the Unix socket at
-            # /tmp/shorashim/talmudic.sock is the same file on both
-            # sides. Mounted at /tmp (not /tmp/shorashim) so this is
+            # /tmp/bikoret/talmudic.sock is the same file on both
+            # sides. Mounted at /tmp (not /tmp/bikoret) so this is
             # the same volume korban-processor writes azazel records to.
-            - name: tmp-shorashim
+            - name: tmp-bikoret
               mountPath: /tmp
           resources:
             requests:
@@ -295,10 +295,10 @@ spec:
         # === KORBAN PROCESSOR (sidecar) ===
         # Korban_processor imports azazel_processor (the disposal
         # channel) in the same Python process. The Python side writes
-        # AzazelRecord JSON files to /tmp/shorashim/azazel/pending_l3/;
+        # AzazelRecord JSON files to /tmp/bikoret/azazel/pending_l3/;
         # vav-pipeline's AzazelIngest GenServer watches that directory
         # and ingests into L3. Both containers must mount the shared
-        # tmp-shorashim volume for the file bridge to work.
+        # tmp-bikoret volume for the file bridge to work.
         # Since 2026-10-05 it also listens on KORBAN_SOCKET_PATH (shared
         # /tmp) for the bedikah — vav-pipeline is the only caller.
         - name: korban-processor
@@ -307,7 +307,7 @@ spec:
             - configMapRef:
                 name: shorashim-config
           volumeMounts:
-            - name: tmp-shorashim
+            - name: tmp-bikoret
               mountPath: /tmp
           resources:
             requests: