gate: Claude Code behind it — OAuth bearer, anthropic-beta, token counting, the gate's own watch

A coding agent's traffic differs from a hand-made request: with a
subscription Claude Code authenticates with an OAuth bearer and sends
anthropic-beta; it counts tokens at /v1/messages/count_tokens; it makes a
request per tool call; its tool-only turns have no text; its context runs
to megabytes. So: with the courtyard key in X-Bikoret-Key, the caller's
Authorization: Bearer is forwarded to Anthropic as its credential, and
anthropic-beta with it; count_tokens is carried through unexamined and
uncharged; the watch counts the gate at its own windows (120/min,
2,000/h per key — tier :gate); a reply with no text is delivered as it
came with bikoret.verdict "none" and no fringe block (stream and
non-stream); the sources keep the newest user turns whole and drop the
oldest past 1 MiB. Ingress body 32 MiB; ConfigMap manna amounts raised
to 5000/5000 (the kohen's lever). Tamid §1.1, KOHEN "Claude Code behind
the gate". Doorpost re-pinned. Elixir 617/0 read before this commit;
gate_test 25.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

vav_pipeline/lib/vav_pipeline/gate.ex

@@ -60,6 +60,8 @@ defmodule VavPipeline.Gate do
           {:ok, deliver(upstream, reply, first, nil)}
       end
     else
+      # A reply with no text (tool use only) is not a reply to a reader: delivered as it came, the object says so.
+      {:no_text, reply} -> {:ok, %{status: 200, reply: reply, bedikah: nil, first: nil, bikoret: %{verdict: "none", reason: "no text", model: Shape.reply_model(upstream, reply)}}}
       # A non-200 from the upstream passes through as it came.
       {:ok, status, reply} -> {:ok, %{status: status, reply: reply, bedikah: nil, first: nil, bikoret: nil}}
       {:error, reason} when is_binary(reason) -> {:error, :upstream_unavailable, reason}
@@ -95,7 +97,7 @@ defmodule VavPipeline.Gate do
   defp examine(upstream, body, reply, opts) do
     case Shape.reply_text(upstream, reply) do
       nil ->
-        {:error, :upstream_unavailable, "the reply from #{upstream} carries no text to examine"}
+        {:no_text, reply}
 
       text ->
         provenance = Shape.provenance(upstream)