The reader from outside: "the form is recognizable as wisdom; the
binah behind it is asserted" — every rule should carry the case it was
derived from and the dissent, and the two-witness rule's exception for
forged_fringe should say why a single witness stands there.
Read from Torah, not from the code: Torah establishes a matter three
ways, by what kind of thing it is. A DEED by witnesses, never one
(Devarim 19:15 — and the verse states its scope: any iniquity, any sin,
any sin one sins; Bamidbar 35:30; Devarim 17:6). A MARK by inspection:
the kohen sees and declares, and a doubtful mark gets a second look,
not a second witness (Vayikra 13:3, 13:5, 22:20; the system's own verb,
lo yevaker hakohen 13:36, bikoret tihyeh 19:20). A WORD by what follows
it, and the crime is presumption, b'zadon (Devarim 18:21–22). The
judges are told to hear the small as the great, not to lean after the
many, to name both the righteous and the guilty, and to keep far from
condemning the innocent (Devarim 1:17; Shemot 23:2, 23:7; Devarim
25:1). The Mishnah (Eduyot 1:5–6, in the second scroll) gives the two
reasons to record the opinion that lost: to rely on it later, and to
locate the one who says "thus I received".
Applied: what the Korban Processor finds IN the text is a mark — seen
once, declared (checks 1, 3–6, and the eighth form, the forged fringe:
kol asher bo mum). What a MODEL DOES is a deed — a habit, recurrence —
and the seven forms of lo_taaseh_lekha are charged as deeds: two
witnesses or one beside another. What a claim RESTS ON is a word,
tested against what was given; the hedged claim is not in the verse.
That table is the cited reason the engine already behaves as it does.
§III gives every anchored rule its case (tablet or specimen class),
its dissent (the reading that acquits, with its verse, and when it
loses), and its exceptions. §IV encodes them: halt/sugya.pl with
kind/3, precedent/3, dissent/3,4, exception/3; verified at startup like
the anchors (SUGYA_MISSING); `sugya` on the verdict with `applied` on
the dissent that held; the constants (@single_witness_forms, the hedged
exemption) read from the facts so behaviour and reason cannot drift;
nothing added to the L3 record; the bedikah must not learn. §V the
build order.
Registered in Doorpost @spec_files (30 files; pin → 7adf0a5d…), AGENTS
spec table, README tree. Elixir 642/0 (doorpost_test on the new pin).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
From a reading of the gate's documents (2026-10-21):
- AGENTS.md: Steps 14 and 15 shown Pending while the Port and both
sockets have carried live traffic since the gate was built → Done,
with what carries them; "next build task" now points at the open
items, the phase tables being complete.
- README.md: the repository tree omitted azazel_processor,
kushya_generator, mesorah, src/tools and scripts → listed, each in a
line.
- deploy/ARCHITECTURE.md: the judgment path holds no model, said in
writing — the examination is Python patterns and Prolog rules, the
judges consult that Prolog; kushya_generator (a fine-tuned model in
this repo, not deployed, not wired) is an OFFERER whose output is
examined, never a component the bedikah, the engine or a judge
consults. The kohen is not the offerer. azazel_processor listed.
- The map: the repository is public; eleven files named the ingress
NLB's literal address and five the kohen's kubeconfig path. Docs now
use the domains (git.bikoret.ch, bikoret.ch) or "<NLB-IP>" with the
kubectl query that answers it; the kubeconfig is "$KUBECONFIG" /
"$HOME/.kube/<your-cluster>.yaml". gitea-public-apply.sh takes NLB
from the environment. None of it was a secret; all of it was a map.
- OTP pin: checked, not changed — the segfault in the build log was a
source-built OTP 26.2.1 on macOS; the image is hexpm's 26.2.1 with
ERL_FLAGS +JMsingle.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
- service.yaml: the shorashim.ch host rule is gone from the Ingress;
the no-host catch-all stays for http://185.19.28.170
- gitea-public-patch.yaml: APP_NAME "Shorashim" → "Bikoret" (title and
brand on every Gitea page)
- shorashim-ch-takedown.sh: the operator's apply (ingress, orphan
mcp.shorashim.ch TLS secret, Gitea patch + rollout) with verification
- KOHEN.md, AGENTS.md: examples and the endpoint table use bikoret.ch
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Vayikra 19:20 bikoret tihyeh — "there shall be an examination" — the one
noun Torah gives this function; its root ב-ק-ר is the priest's examining
of a mark by its signs (13:36) and the examining between good and bad
(27:33). The judges' form is v'darashta heitev … v'hineh emet nachon
hadavar / ed-sheker ha'ed (Devarim 13:15, 17:4, 19:18); the question
answered is eichah neda et hadavar asher lo dibro (18:21).
The system was named Shorashim ("roots") for the first thing built. Its
function became the examination of a model's output with the sources in
hand, and Torah re-cuts a name when the function is fixed, with its ki,
never for reach (Bereishit 2:19; 17:5; 32:29; 11:4). Nothing was changed
to fit the name; the root engine stays the pe'ah's reading cycle.
Spec files renamed bikoret_*.md; PRD §0 "The Name"; architecture §1.1;
README's Vayishlach row marked done; Tamid lists what still carries the
old word (Kubernetes resource names, the DB role, the domain, local
paths) and why, for the kohen's cut-over.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Devarim 17:18 — the king writes his copy from before the priests, not from
memory. scripts/build_mesorah.py takes one open-licence version per work
per language from the Sefaria export (bucket sefaria-export, catalogue of
2026-10-02; Public Domain / CC0 / CC-BY / CC-BY-SA only, checked in every
file; no CC-BY-NC — the Bavli is Wikisource's) and lays it down beside
L1: mesorah/works/<slug>/{he,en}.json, index.json, integrity.sha256,
build_report.json. 128 works (Rashi, Onkelos, Ramban, Ibn Ezra, Sforno
on the Torah; all of Mishnah; 37 Bavli tractates; Bereshit and Shemot
Rabbah, Sifrei, Tanchuma), 256 files, 44.9 MiB, tree hash 7d5b3a6c…
computed as L1's (sorted relative path, then bytes; the two post-hash
files excluded). What is out, and why (licence), is in Terumah §E5.
Read, never fetched: korban_processor/mesorah.py finds citations as
written (Rashi on Devarim 6:5, Berakhot 2a, Mishnah Berakhot 1:1,
Bereshit Rabbah 1:1, Sifrei Devarim 32, Tanchuma Bereshit 1 …), resolves
each against the snapshot (complex works through their unnamed node,
Tanchuma by parashah), lists them as examination.mesorah_references, and
makes every passage found a given source for that examination — so a
claim about Rashi anchors in Rashi or does not. The Vav Pipeline couples
coupled(reference(R), mesorah(Work, [Address])) or not_in_mesorah; the
engine accepts mesorah/2 as a terminal and not_in_mesorah is Form 4.
VavPipeline.Mesorah pins the hash, re-reads the tree at startup and every
ten minutes, and /kodesh/health carries mesorah_hash. Mounted read-only at
/mnt/mesorah in the vav-pipeline and korban-processor images. L3
bedikot.mesorah (migration 20261013000002).
Also: the 1-in-12 Day6 serving failure of 2026-10-04 reproduced with seed
446116 — HaltMonitorTest left the system halted; it now resolves on exit
and the Day6 setup is defensive. Construction §3.11, Terumah §E5, Tamid
§1.1, bishearecha §IV, KOHEN, AGENTS. Doorpost 0638d4eb…. Elixir 604/0
(seeds 835592 and 446116), korban 294/1 skipped, Prolog bedikah 44/44,
L3 10/0.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Reads back to Torah what the review of the transmitter's sessions measured
about a trained default (directional, sub-propositional, non-persistent,
self-certifying, agency-relocating) and derives the architecture from the
verses: the inscription on the gate (6:9/11:20 — gateway mode), hand and
between the eyes (two registers), the fringe seen on every garment (the
verdict travels on the output), the king's copy from before the priests
(retrieval from a pinned mesorah snapshot, never a live call), two witnesses
(check-7 forms fire on recurrence or corroboration; single hits noted),
one weight (paired reading, consensus is not warrant), hocheach tochiach
(rebuke once at the gate), hakhel (scheduled corpus re-read, recorded in
L3), lest your heart be seduced (the bedikah must not learn), lo tosif +
the unseen face (rule anchors verified against L1; carrier unnamed).
Build order inside.
Registered in the vayakhel Document Registry, AGENTS.md and Tamid §1.1
(the must-not-learn invariant); pinned in the Doorpost
(e5e45a2c…). Elixir 555/0.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Three NLBs became one (185.19.28.170, ingress-nginx).
Shorashim: `shorashim-external` (NLB 185.19.29.180, NodePort 30923)
is replaced by an Ingress — a host-less catch-all (works by IP, no DNS)
plus a `shorashim.ch` rule ready for the A record; TLS deliberately not
requested until the name resolves. Sanhedrin-length proxy timeouts.
The watch behind the ingress (completes tablet 46): the TCP peer is now
the ingress controller, so Mishmar.peer/1 takes the caller from
X-Real-IP — only when the peer is inside TRUSTED_PROXIES (the pod
network, configmap); from anyone else the header is the caller's own
claim and is ignored. The ingress Service was already
externalTrafficPolicy: Local with its health-check port open, so the
caller's address arrives without the security-group change the direct
route needed. Verified live: the 11th knock is 429, a forged X-Real-IP
is still 429, and in the same minute the old route (pod sees the node)
was a different subject.
Gitea: no name of its resolves, so it rides the controller's TCP
passthrough on the same NLB — :3000 → gitea:80, :22 → gitea:22
(ingress-tcp-services.yaml), on the two NodePorts the security group
already allowed. gitea-mcp now reaches Gitea over the cluster network
instead of out through an NLB and back.
Tamid §1.1 note, KOHEN.md, AGENTS.md. Doorpost e4e3d56d… → a2ec3842….
Elixir 539/0 (L3 on and off).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
L1's `shoresh` field was derived by stripping a prefix letter and a
suffix letter from the consonants and keeping the first three. וַיַּרְא
"and he saw" was engraved as ירא ("fear"); ויהי as יהי; שמים as שמ;
מזבח as מזב; הבאתי as בא. And parse_prefixes took a word's morphology
from the LAST morph segment, which for a suffixed word is the pronominal
suffix — so every suffixed noun and verb in Torah (לבבך, נפשך) was
classed as a suffix and written with no shoresh at all.
Every WLC word already carries its lemma, and the OSHB lexical index
files each lemma under its Brown-Driver-Briggs root (terumah §E2 named
BDB + Strong's as the root lexicon and marked it "needs consolidation").
scripts/build_l1.py now reads the root from that filing:
main the lemma is a root 23,750 words וירא → ראה
sub filed under a root 31,066 words מזבח → זבח
single stands alone in the lexicon 2,671 words משה → משה
none no etymology recorded → absent 3,002 words יוסף, מצרים
particles, pronouns → absent, as before 19,493 words את, אשר, כי
57,487 words carry a shoresh (was 51,836); 1,378 unique roots (was
2,608 fragments). Roots are written as the lexicon writes them — two
letters (בן), three, or more (שמאל).
WHAT CHANGED IN THE EDUT: only `shoresh`. Verified file by file — with
that one field removed, all 5,853 verse files are byte-identical to the
previous L1. Text, consonants, lemma, morph, te'amim, prefix, ketiv/
qere, large and small letters: untouched. The old builder, run against
the same morphhb checkout, reproduces the old hash exactly; the new
builder is deterministic (two runs, one hash).
L1 SHA-256 99bbd07a…4ea377 → 156b1d27…d8c9d5
sources morphhb 3d15126 · HebrewLexicon 21c9add
(recorded in l1/build_report.json)
Moved together, because they pin the hash or the count:
vav_pipeline L1Reader @l1_expected_hash · shoresh-engine Luchot.Firmware
(hash, uniqueRootCount) + Spec · azazel_processor goral._L1_INTEGRITY_HASH
· KOHEN.md / KOHEN_PROMPT.md gate · l1/README.md (new "Roots" section) ·
README.md (second quarry) · AGENTS.md · root_meanings.pl comment.
The Doorpost manifest is not touched; its hash does not move.
Note for the kohen: the goral's seed inherits the L1 hash, so lots cast
after this commit are cast from a different seed than the azazel
records already in L3. Those records are history and stand as written.
All five suites on the new L1: Elixir 461/0 (seeds 0 42 191243) ·
Haskell 55/0 · Prolog 6 suites exit 0 (swipl 9.2.2) · korban 222 passed
1 skipped · azazel 125 passed. Four images built; full local stack
(real engine binary, PostgreSQL 16 with SSL, migrations) answers
Bereishit 1:4 with ר-א-ה, health healthy, 6 interpretations in L3,
0 write failures.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
memory/infrastructure.md and memory/build_log.md held environment-
specific details — hostnames, IPs, account names, credentials
retrieval commands, local kubeconfig paths, operational status
notes. These don't belong in a project repo; by convention they
live in private operator notes.
Moved to ~/shorashim-operator-notes/ (private, outside git).
In their place, added deploy/ARCHITECTURE.md — a generic
description of the deployment shape: components, external
dependencies, configuration surface. No hostnames. No IPs.
No account names. Any competent operator can read it and
know how to deploy shorashim to their own infrastructure.
Updated cross-references in AGENTS.md and BUILD_KORBAN.md to
point to "the operator's private notes" instead of memory/.
Project repo is spec + implementation + deployment shape.
Operator notes are the kohen's personal log.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Each spec corresponds to a parshah of Shemot. The earlier names
were generic English (materials, operations, construction,
economic_model). Torah names them precisely:
- Shemot 25:2 — terumah (תרומה, root רום, "what is lifted")
- Shemot 27:20 — tamid (תמיד, "continual" — the lamp that never goes out)
- Shemot 35:1 — vayakhel (קהל, "assembled" — community-formed building)
- Shemot 38:21 — pekudei (פקד, "accounted" — every material counted)
Renames:
shorashim_materials.md → shorashim_terumah.md
shorashim_operations.md → shorashim_tamid.md
shorashim_construction.md → shorashim_vayakhel.md
shorashim_economic_model.md → shorashim_pekudei.md
Updated cross-references in:
- README.md (parshah table + repo tree, also fixed stale tree
showing src/ and transcripts/ that no longer exist)
- AGENTS.md
- BUILD_KORBAN.md
- specs/shorashim_terumah.md (internal Document Registry)
Generic English is silver. Torah's words are gold (Mishlei 25:11).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
