gate: Claude Code behind it — OAuth bearer, anthropic-beta, token counting, the gate's own watch

A coding agent's traffic differs from a hand-made request: with a
subscription Claude Code authenticates with an OAuth bearer and sends
anthropic-beta; it counts tokens at /v1/messages/count_tokens; it makes a
request per tool call; its tool-only turns have no text; its context runs
to megabytes. So: with the courtyard key in X-Bikoret-Key, the caller's
Authorization: Bearer is forwarded to Anthropic as its credential, and
anthropic-beta with it; count_tokens is carried through unexamined and
uncharged; the watch counts the gate at its own windows (120/min,
2,000/h per key — tier :gate); a reply with no text is delivered as it
came with bikoret.verdict "none" and no fringe block (stream and
non-stream); the sources keep the newest user turns whole and drop the
oldest past 1 MiB. Ingress body 32 MiB; ConfigMap manna amounts raised
to 5000/5000 (the kohen's lever). Tamid §1.1, KOHEN "Claude Code behind
the gate". Doorpost re-pinned. Elixir 617/0 read before this commit;
gate_test 25.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/k8s/configmap.yaml

@@ -16,9 +16,11 @@ data:
   # Friday (manna-cronjob.yaml); Friday's is doubled and stands through
   # Shabbat. The kohen sets the amounts here (Pekudei: from the half-shekel
   # fund); a change takes effect at the next writing.
-  MANNA_COMPUTE_UNITS: "1000"
+  # A Claude Code session behind the gate makes a request per tool call:
+  # raised 2026-10-15 from 1000 / 500 when the gate opened to it.
+  MANNA_COMPUTE_UNITS: "5000"
   MANNA_MEMORY_MB: "32768"
-  MANNA_API_CALLS_EXTERNAL: "500"
+  MANNA_API_CALLS_EXTERNAL: "5000"
   MANNA_STORAGE_DELTA_MB: "100"
   MANNA_SANHEDRIN_PANELS_MAX: "5"
 

deploy/k8s/service.yaml

@@ -57,9 +57,9 @@ metadata:
     # A 71-judge Sanhedrin may deliberate for ten minutes (Construction §2.2).
     nginx.ingress.kubernetes.io/proxy-read-timeout: "620"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "620"
-    # The bedikah accepts 65,536 bytes of output and 1 MiB of sources;
-    # leave room for the envelope.
-    nginx.ingress.kubernetes.io/proxy-body-size: "2m"
+    # The bedikah accepts 65,536 bytes of output and 1 MiB of sources; a
+    # coding agent's request through the gate carries its whole context.
+    nginx.ingress.kubernetes.io/proxy-body-size: "32m"
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
 spec:
   ingressClassName: nginx