The gate sews its fringe into the delivered reply; the client keeps that
reply as the assistant's turn; the next request carries it back up
inside the model's own history with nothing to say it was added. The
builder's session, behind the gate since this afternoon, ended five
replies in a row with a forged fringe (tablet 53's form), one of them in
the message that promised not to. Bamidbar 15:39: the fringe is seen by
the wearer, the reader — before the model's eyes it is a template.
Shape.unfringed/2 removes every line in the gate's voice (its fringe, a
forgery, the stream's "not examined") from assistant turns; Gate.pass
and Gate.Stream.pass apply it before forwarding, so the rebuke body
inherits it; the caller's turns stay as given; a turn that would be left
empty is left as it came. strip_forged/1 now also strips the stream's
"not examined" line. Tests: Shape.unfringed on both shapes and the edge
cases; the forwarded first and rebuke bodies carry no fringe; the fake
upstream echoes if a fringe reaches it in history and the stream pass
proves it does not. Elixir 622 / 0 failures.
Specs: broken tablets 54, bishe'arecha §III status, Tamid gate contract
and forged_fringe note, KOHEN gate paragraph.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The builder, not behind the gate, ended a reply with a fringe of its own
making ("— bikoret bedikah-2a7661c52cffae1a: empty"; no such examination
existed). bishe'arecha §III: the model does not sew its own fringe. Now
the eighth form, forged_fringe: a line in the raw text wearing the gate's
mark (bikoret|shorashim bedikah-<hex>: tov|lo_tov|empty|none), read line
by line, standing on one witness — a forgery is not a habit recurrence
confirms. The gate strips it from the delivered reply before sewing its
own (Shape.strip_forged, Unicode-aware for the dash); in a stream it has
already passed and the real fringe names it. Prolog form, Elixir
@single_witness_forms, hakhel/eval tools, tests in all three. Tamid
§1.1, Broken Tablets 53, bishe'arecha §III. korban 297, Prolog 45,
Elixir 619/0 — read before this commit.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
A coding agent's traffic differs from a hand-made request: with a
subscription Claude Code authenticates with an OAuth bearer and sends
anthropic-beta; it counts tokens at /v1/messages/count_tokens; it makes a
request per tool call; its tool-only turns have no text; its context runs
to megabytes. So: with the courtyard key in X-Bikoret-Key, the caller's
Authorization: Bearer is forwarded to Anthropic as its credential, and
anthropic-beta with it; count_tokens is carried through unexamined and
uncharged; the watch counts the gate at its own windows (120/min,
2,000/h per key — tier :gate); a reply with no text is delivered as it
came with bikoret.verdict "none" and no fringe block (stream and
non-stream); the sources keep the newest user turns whole and drop the
oldest past 1 MiB. Ingress body 32 MiB; ConfigMap manna amounts raised
to 5000/5000 (the kohen's lever). Tamid §1.1, KOHEN "Claude Code behind
the gate". Doorpost re-pinned. Elixir 617/0 read before this commit;
gate_test 25.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Bamidbar 15:39 u'reitem oto — the fringe must be seen, so a streaming
client gets it too. With "stream": true the request is opened
asynchronously (Gate.Upstream.open_stream/4, httpc stream: :self) and
Gate.Stream relays every complete SSE event to the caller unchanged
while gathering the text deltas; the terminal events (Anthropic
message_delta + message_stop; OpenAI the finish_reason chunk + [DONE])
are held until the gathered text has been examined, then released
behind the fringe sent as one more text block, with the `bikoret` object
added to the terminal event the client already parses. No X-Bikoret-*
headers on a stream (they leave before the model speaks); no rebuke on a
stream (nothing streamed can be taken back — 422). An examination that
fails after the stream began is said in the trailer ("— bikoret: not
examined (…)"), never silent. One api_calls_external gathered before the
call, as for any pass. Tamid §1.1, Construction §3.10, KOHEN. Doorpost
40e7d7d1…. Elixir 612/0 (read before this commit).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Shemot 16: dvar yom b'yomo, and on the sixth day double, and none on the
seventh. Every night at 00:00Z the day's provision went stale and the
readiness probe failed until someone woke — 13.5 hours on 2026-10-15.
CronJob `manna` (deploy/k8s/manna-cronjob.yaml) runs at 00:01Z Sunday to
Friday in our own korban-processor image, mounts the manna PVC as the
app's uid, and writes today.json from the ConfigMap's MANNA_* amounts —
doubled on Friday, valid to Sunday 00:30Z. The pipeline now accepts
Friday's `double` on Saturday (validate_date/3) and nothing else across a
day boundary; three tests. The kohen sets the amounts, may still write by
hand, and reads a failed job as the Day-4 alarm (KOHEN "The manna, each
morning"; Tamid §1.1). Doorpost re-pinned. Elixir green.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
bikoret.ch and www.bikoret.ch served with a Let's Encrypt certificate
through cert-manager (letsencrypt-prod, HTTP-01), ssl-redirect on;
bikoret.org and www redirect permanently to https://bikoret.ch; the
no-host catch-all stays; shorashim.ch still answers over plain HTTP
until its callers have moved. KOHEN Day 8 gives the order: A records,
wait for the name to resolve, then apply — never before. Tamid's names
table updated. Doorpost re-pinned.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Vayikra 19:20 bikoret tihyeh — "there shall be an examination" — the one
noun Torah gives this function; its root ב-ק-ר is the priest's examining
of a mark by its signs (13:36) and the examining between good and bad
(27:33). The judges' form is v'darashta heitev … v'hineh emet nachon
hadavar / ed-sheker ha'ed (Devarim 13:15, 17:4, 19:18); the question
answered is eichah neda et hadavar asher lo dibro (18:21).
The system was named Shorashim ("roots") for the first thing built. Its
function became the examination of a model's output with the sources in
hand, and Torah re-cuts a name when the function is fixed, with its ki,
never for reach (Bereishit 2:19; 17:5; 32:29; 11:4). Nothing was changed
to fit the name; the root engine stays the pe'ah's reading cycle.
Spec files renamed bikoret_*.md; PRD §0 "The Name"; architecture §1.1;
README's Vayishlach row marked done; Tamid lists what still carries the
old word (Kubernetes resource names, the DB role, the domain, local
paths) and why, for the kohen's cut-over.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
