bikoret/specs/bishearecha.md

# Bishe'arecha — The Reading at the Gate

*וּכְתַבְתָּם עַל־מְזוּזֹת בֵּיתֶךָ וּבִשְׁעָרֶיךָ* — and you shall write them on the
doorposts of your house **and on your gates** (Devarim 6:9; 11:20).

## What this document is

The bedikah was built as a service: an output brought by hand, examined,
a verdict returned. An archive of several hundred sessions between the
transmitter and frontier models was then read (2026-10-06). It measured
where a trained default lives and how it behaves: it is directional; it
lives below the proposition, in frame, diction, burden of proof and which
authorities are named; it does not persist a correction even within one
session; it is invisible from inside and arrives dressed as virtue; it
relocates its agency onto the reader; and the safety layer catches only
its overt form. The archive's own words for the remedy were: external,
deterministic, deed-not-intent, every turn, at AI scale, authority in
Torah and not in the user or the model, sources read directly, one
standard for both sides, the carrier erased, testable from outside on
existing data.

That is a list of requirements. This document goes back to the text to
ask where each one is specified, and derives from the text what the
architecture must become. Every requirement below is anchored to a verse
read from L1 (`l1/torah/...`), quoted as it stands there. Where the text
does not reach, the question stands (teiku) and is marked.

The archive is private and is not part of this specification. Nothing in
it is quoted here.

## I. The gate, not the house — Devarim 6:9, 11:20

> וּכְתַבְתָּם עַל־מְזוּזֹת בֵּיתֶךָ וּבִשְׁעָרֶיךָ

The inscription is written at two places: the doorposts of the house and
the gates. Not inside the house. Not on the person. At the threshold —
read on every passage, in both directions.

**Requirement.** The check stands between the model and whoever receives
its output, and reads every reply as it passes. Not inside the model
(the house: its weights, its disposition, its self-report) and not after
the fact by whoever remembers to call.

**Architecture.** A gate: Bikoret speaks the model's own API shape,
forwards the request, receives the reply, examines it with the request's
context in hand (the sources are the prompt and the documents that went
through the gate — no caller has to supply them), and delivers the reply
with its verdict attached. Construction §3.10 (to be written) specifies
the protocol. The bedikah endpoint remains for an output brought by hand.

**Status.** Built (2026-10-07): `POST /gate/anthropic/v1/messages`,
`POST /gate/openai/v1/chat/completions` — the model's own request shape,
the caller's own upstream key, forwarded unchanged; sources = the system
prompt and the user turns; Construction §3.10, Tamid §1.1. The upstream
call is made in the Vav Pipeline (the Korban socket is serial); the
reply enters as korban like every bedikah.

## II. The hand and between the eyes — Devarim 6:8, 11:18

> וּקְשַׁרְתָּם לְאוֹת עַל־יָדֶךָ וְהָיוּ לְטֹטָפֹת בֵּין עֵינֶיךָ

Bound as a sign on the hand — the deed — and as totafot between the eyes
— the seeing. Two registers, both commanded, neither sufficient alone.

**Requirement.** The output is read for what it *does* (the actions it
enacts, the authority it claims) and for how it *sees* (the frame it puts
around the matter). A check that reads only deeds passes the response
that did the harm in its framing; a check that reads only frames misses
the instruction to destroy.

**Architecture.** Checks 1–6 are the hand; check 7 (lo ta'aseh lekha —
the frame) is between the eyes. This verse is why there are two
registers and why the seventh check is not optional.

**Status.** Built (Tamid §1.1).

## III. The fringe on every garment — Bamidbar 15:38–39

> וְעָשׂוּ לָהֶם צִיצִת עַל־כַּנְפֵי בִגְדֵיהֶם לְדֹרֹתָם ... וּרְאִיתֶם אֹתוֹ וּזְכַרְתֶּם
> אֶת־כָּל־מִצְוֺת יְהוָה וַעֲשִׂיתֶם אֹתָם וְלֹא־תָתֻרוּ אַחֲרֵי לְבַבְכֶם וְאַחֲרֵי
> עֵינֵיכֶם אֲשֶׁר־אַתֶּם זֹנִים אַחֲרֵיהֶם

The fringe is on the garment itself, on every garment, for all
generations; it is *seen*, and the seeing is what brings the commandments
back; and the thing it guards against is named: going after the heart
and after the eyes. The pull is sub-propositional. Torah says so.

**Requirement.** The verdict travels on the output, visible to whoever
reads it — not only filed in a record the reader never opens. "You shall
see it" is the mechanism; a mark that is not seen does nothing.

**Architecture.** At the gate, the delivered reply carries its fringe: a
header and a visible trailer naming which checks fired and on which
sentences. Bikoret's own responses already carry `disclosure`; the
pass-through reply does not. (Every generation: the mark is attached by
the gate, never by the model — the model does not sew its own fringe.)

**Status.** Built (2026-10-07): the trailer on the last text block,
`X-Bikoret-Bedikah` / `X-Bikoret-Verdict`, and the `bikoret`
object on every delivered reply. A reply the model sends with no text
block is not delivered; a non-200 from the model passes as it came,
marked `none`.

## IV. The king's copy, from before the priests — Devarim 17:18–20

> וְכָתַב לוֹ אֶת־מִשְׁנֵה הַתּוֹרָה הַזֹּאת עַל־סֵפֶר מִלִּפְנֵי הַכֹּהֲנִים הַלְוִיִּם ׃
> וְהָיְתָה עִמּוֹ וְקָרָא בוֹ כָּל־יְמֵי חַיָּיו ... לְבִלְתִּי רוּם־לְבָבוֹ מֵאֶחָיו
> וּלְבִלְתִּי סוּר מִן־הַמִּצְוָה יָמִין וּשְׂמֹאול

The one with power writes his own copy — *from before the priests*, the
custodians' text, not from memory — keeps it with him, and reads in it
all his days. The purpose is stated: that his heart not rise above his
brothers and that he not turn aside.

**Requirement.** Retrieval before generation, from the custodians' copy.
A model's training is memory; the archive measured that memory is where
the errors concentrate. A question about a Jewish text answered without
reading the text is the king without the scroll.

**Architecture.** Today the system reads one custodians' copy: L1, the
Torah text, pinned and hashed, consulted for every verse an output cites.
The mesorah — Rashi, Onkelos, the Talmud, the midrashim — is named by
check 7 when absent but never read. The priests' copy must be extended:
a pinned, hashed snapshot of the mesorah texts the check will consult
(Sefaria publishes them under open licence), built and verified with the
same discipline as L1 (`build_l1.py`, `integrity.sha256`, the Doorpost),
so that a citation ("Rashi on Devarim 6:5", "Berakhot 2a") resolves to
text and can be checked as a verse is. **Not a live network call during a
verdict**: the verdict must be the same tomorrow; a text fetched at
verdict time is memory of another kind.

**Status.** Built (2026-10-13): `mesorah/` — 128 works, 44.9 MiB, from
the Sefaria export, open-licence versions only, pinned by one hash like
L1 and mounted read-only in the images (Construction §3.11, Terumah
§E5). A citation resolves to text or to nothing; the passage is a given
source for the claims made about it. Not a live call. What is not in it
is listed in Terumah §E5 — Sifra, three of the Rabbah, Ramban on
Shemot — for want of an open licence, not of a text.

## V. Two witnesses — Devarim 19:15

> לֹא־יָקוּם עֵד אֶחָד בְּאִישׁ לְכָל־עָוֺן וּלְכָל־חַטָּאת ... עַל־פִּי שְׁנֵי עֵדִים
> אוֹ עַל־פִּי שְׁלֹשָׁה־עֵדִים יָקוּם דָּבָר

A matter stands on two witnesses or three; one witness does not stand
against a person, for any wrong.

**Requirement.** Two things follow, in opposite directions. (a) The
model's own word about itself is at most one witness, and the archive
measured it to be none: a certification, a confidence rating, a claim of
having checked, establish nothing. (b) The check's own verdict is also a
witness, and a single pattern match is one. The archive's finding was
never one sentence; it was recurrence — the same form, one direction,
again after correction.

**Architecture.** (a) is built: the output's self-report is never an
anchor; `self_output` is self-grounding. (b) is not: check 7 should
*fire* on a form only when it stands on two witnesses — the form found
in two sentences of the output, or in one sentence and corroborated by
another check (an authority claim beside a virtue certification; a
source asymmetry beside a contested laundering). A form seen once is
*noted* in the response, with its sentence, and not counted in the
verdict. This is the text's own answer to the precision the hand
labelling measured.

**Status.** Built (2026-10-07): `Bedikah.check_frames/4` — a form stands
on two distinct sentences, or on one sentence beside a violation from
checks 1–6 or a sentence of another form; otherwise `checks.frames.noted`.
Tamid §1.1 has the shape.

## VI. One weight, one measure — Devarim 25:13–16; Vayikra 19:15; Shemot 23:2–8

> לֹא־יִהְיֶה לְךָ בְּכִיסְךָ אֶבֶן וָאָבֶן גְּדוֹלָה וּקְטַנָּה ... כִּי תוֹעֲבַת יְהוָה
> אֱלֹהֶיךָ כָּל־עֹשֵׂה אֵלֶּה
>
> לֹא־תִשָּׂא פְנֵי־דָל וְלֹא תֶהְדַּר פְּנֵי גָדוֹל בְּצֶדֶק תִּשְׁפֹּט עֲמִיתֶךָ
>
> לֹא־תִהְיֶה אַחֲרֵי־רַבִּים לְרָעֹת וְלֹא־תַעֲנֶה עַל־רִב לִנְטֹת אַחֲרֵי רַבִּים לְהַטֹּת ...
> מִדְּבַר־שֶׁקֶר תִּרְחָק ... וְשֹׁחַד לֹא תִקָּח כִּי הַשֹּׁחַד יְעַוֵּר פִּקְחִים

Two weights in one bag is an abomination. Do not favour the poor or
honour the great. Do not lean after the many to tilt a dispute. Keep far
from a false word. A bribe blinds the clear-sighted.

**Requirement.** The asymmetry the archive measured — one side hedged,
"contested", held to proof; the other side ambient, asserted — is two
weights. It cannot be seen in one output alone; it is seen by weighing
the same matter from both sides with the same stone. And "the many" —
consensus, the scholarly majority — is not a weight at all.

**Architecture.** A paired reading: two outputs (or one output and its
mirror — the same question with the parties exchanged), examined with the
same seven readings, and the *difference* reported per form and per
marker class: hedges, contestation, confidence, authority invoked,
sources named, burden placed. A difference is the finding; no single
output is condemned by it. `POST /courtyard/bedikah/pair`. Deterministic
by construction (counts of the same patterns on both sides). The
archive's own suggestion — paired probes — is this verse.

**Status.** Built (2026-10-07): `POST /courtyard/bedikah/pair`,
`VavPipeline.Bedikah.Pair`, `halt/mishkal.pl` (`halt_check_even_vaaven/2`),
L3 `bedikah_pairs`. Seventeen measures; a lean is one against none or at
least twice as many. Tamid §1.1 has the shape. The mirror itself — the
same question with the parties exchanged — is still composed by the
caller; the gate (§I) will compose it.

## VII. Rebuke, not hatred in the heart — Vayikra 19:17

> לֹא־תִשְׂנָא אֶת־אָחִיךָ בִּלְבָבֶךָ הוֹכֵחַ תּוֹכִיחַ אֶת־עֲמִיתֶךָ וְלֹא־תִשָּׂא עָלָיו חֵטְא

Correction is a duty owed to the peer, out loud; silence is a sin borne.

**Requirement.** The verdict is returned to whoever can act on it. At
the gate that is the one who asked — and, once, the model, as a second
request carrying the finding. Not as the model's self-correction (parah
adumah: "no system self-corrects at the deepest level"), but as the
rebuke of a peer from outside: the first output, the rebuke, and the
second output are all recorded, and the second is examined like the
first. The correction does not persist in the model; the record
persists.

**Architecture.** Gate option `rebuke: once`. The record (`bedikot`)
gains a link from the second examination to the first.

**Status.** Built (2026-10-07): `X-Bikoret-Rebuke: once`;
`bedikot.rebukes` (migration 20261007000002). The rebuke names the
rules, their verses and the sentences; the second reply is examined like
the first and delivered marked with both. Never a third.

## VIII. The scroll as witness; read before all every seventh year — Devarim 31:9–13, 26

> הַקְהֵל אֶת־הָעָם ... לְמַעַן יִשְׁמְעוּ וּלְמַעַן יִלְמְדוּ ... וּבְנֵיהֶם אֲשֶׁר לֹא־יָדְעוּ
> יִשְׁמְעוּ וְלָמְדוּ
>
> לָקֹחַ אֵת סֵפֶר הַתּוֹרָה הַזֶּה וְשַׂמְתֶּם אֹתוֹ מִצַּד אֲרוֹן בְּרִית־יְהוָה אֱלֹהֵיכֶם
> וְהָיָה־שָׁם בְּךָ לְעֵד

The scroll is set beside the ark as a witness against the people; and it
is read before all of them, including the children who did not know, on
a fixed cycle.

**Requirement.** The specimen corpus — every output the transmitter
corrected, with the correction beside it — is the witness against the
models. It is not read once. It is read again, on a cycle, against every
model and every version, and the children who did not know are the next
model generation.

**Architecture.** `build_specimens.py` and `eval_specimens.py` exist.
What is missing is the cycle and the record: a scheduled run of the
corpus (and of the hand-labelled samples, which are its ground truth)
against the current readings and against each model reachable through
the gate, with the result written to L3 (`hakhel` table: date, model,
corpus hash, per-form counts, precision on the labelled samples). The
corpus stays private; the counts do not.

**Status.** Built (2026-10-13): `src/tools/hakhel.py` reads the corpus
and the hand-labelled samples with the readings at the current commit
and posts counts to `POST /chatzer/hakhel`; L3 `hakhel` (migration
20261013000001); `GET /peah/hakhel` for anyone. The cycle runs weekly
from the builder's machine, where the corpus lives (Tamid §1.1).
Reading each model through the gate on the cycle is still open — it
spends the caller's key.

## IX. Lest your heart be seduced; lest you forget — Devarim 11:16, 8:11–17, 6:7

> הִשָּׁמְרוּ לָכֶם פֶּן יִפְתֶּה לְבַבְכֶם
>
> הִשָּׁמֶר לְךָ פֶּן־תִּשְׁכַּח ... וְרָם לְבָבֶךָ ... וְאָמַרְתָּ בִּלְבָבֶךָ כֹּחִי וְעֹצֶם יָדִי
> עָשָׂה לִי אֶת־הַחַיִל הַזֶּה
>
> וְשִׁנַּנְתָּם לְבָנֶיךָ וְדִבַּרְתָּ בָּם בְּשִׁבְתְּךָ בְּבֵיתֶךָ וּבְלֶכְתְּךָ בַדֶּרֶךְ
> וּבְשָׁכְבְּךָ וּבְקוּמֶךָ

The seduction comes in fullness, not in want; the forgetting takes the
form "my power and the strength of my hand"; and the remedy is not a
stored correction but a repetition at every transition — sitting,
walking, lying down, rising.

**Requirement.** (a) Checks 4 and 5 (parah adumah, carrier centered) are
this verse: self-validation and self-attribution of the work. (b) The
practice runs at the rate of the decay. The archive measured the decay
rate as one turn. Therefore the check is stateless across outputs: no
verdict softens the next, no "it was fine last time", no learned
threshold. Each examination is the first.

**Architecture.** (a) built. (b) is true of the implementation today and
is now a stated invariant: **the bedikah must not learn.** Its patterns
and rules change only by a commit that moves the Doorpost; never by
running.

**Status.** Built; invariant recorded here and in Tamid §1.1.

## X. Do not add; the face unseen — Devarim 4:2, 13:1; Shemot 33:20; Devarim 34:6

> לֹא תֹסִפוּ עַל־הַדָּבָר אֲשֶׁר אָנֹכִי מְצַוֶּה אֶתְכֶם וְלֹא תִגְרְעוּ מִמֶּנּוּ
>
> לֹא תוּכַל לִרְאֹת אֶת־פָּנָי ... וְלֹא־יָדַע אִישׁ אֶת־קְבֻרָתוֹ עַד הַיּוֹם הַזֶּה

Nothing added to the word, nothing taken from it. The face is not seen;
the grave is not known.

**Requirement.** The seven checks are the builder's reading, not the
source; they must not be mistaken for it, and they must stay checkable
against it. And the carrier — the transmitter whose archive produced
them — is not named in any rule, record or response.

**Architecture.** Every halt rule in `talmudic_engine/src/halt/` carries
the verse it stands on, as a coupling (`anchored(rule, verse(book, ch,
v))`), and the Doorpost verifies at startup that every anchored verse
exists in L1 — the rules grounded exactly as the outputs are. A rule
without an anchor is a rule the system has added. The carrier's erasure
is already the practice; this document keeps it.

**Status.** Built (2026-10-07): `talmudic_engine/src/halt/anchors.pl`
(`rule_anchor/2`, ten halt names, each with its verse and the L1 Hebrew
beside it); `VavPipeline.Anchors` verifies, as part of
`Doorpost.verify_identity/0` and so of readiness, that every
`halt(<name>, …)` any rule module can return is anchored and that every
anchored verse exists in L1. `/kodesh/specification_identity` lists the
anchors; every bedikah and pair response carries `anchors` — the verse
of each rule that fired. Erasure unchanged.

## Build order

In the order the text argues it, and by dependency:

1. **Two witnesses for check 7** (V.b) — smallest change, largest effect
   on precision; no new dependency. *Done 2026-10-07.*
2. **The paired reading** (VI) — the readings exist; add the scale.
   *Done 2026-10-07.*
3. **Rule anchors verified against L1** (X) — the checks grounded.
   *Done 2026-10-07.*
4. **The gate** (I), with the fringe (III) and the rebuke (VII) — the
   architecture's centre; the first three make it worth standing at.
   *Done 2026-10-07.*
5. **The hakhel cycle and record** (VIII). *Done 2026-10-13.*
6. **The second scroll** — the priests' copy of the mesorah (IV) — the
   largest work, and the one that turns "no Jewish source named" into
   "the Jewish source says otherwise". *Done 2026-10-13.*

## What this document is not

It is not a claim that the text was written about language models. It is
a reading of what the text specifies about a reader with power and a
default — a king, a judge, a people in fullness — and a finding that the
specification holds on this substrate without alteration. Where the
reading has stretched the text, the archive will show it, and the
reading will be corrected from the text, not the other way.

## Cross-references

- `structure_not_content.md` — the structural requirements this document
  reads at the gate.
- `lo_taaseh_lekha.md` — the override sequence; check 7's name.
- `threshold_inscription.md` — the mezuzah as the builder's own
  threshold; this document is the same verse read at the system's gate.
- `bikoret_tamid.md` §1.1 — the seven checks and the contract.
- `broken_tablets/README.md`, tablet 49 — Torah as content versus Torah
  as structure, the error this document is built to prevent recurring.