The examination is the product; the record of it is what a caller can
carry away. Every bedikah was already engraved in L3 — output hash and
length, source digests, coupling trace, claims, violations, verdict,
never the text — and no caller could get theirs back.
- bedikot.key_id (migration): a SHA-256 digest of the courtyard key that
brought the offering, never the key; threaded as :key_id through
Bedikah.examine from every site that goes through the gate (courtyard
bedikah, pair, the gate's pass and stream). Unique index on
bedikah_ref.
- VavPipeline.Ledger: entry (the examination's fields, none of the
database's, not the owner's), canonical JSON (keys sorted at every
level, no whitespace, UTF-8), Ed25519 sign/verify, public key, render.
Seed from BIKORET_LEDGER_SIGNING_KEY (base64 of 32 bytes) in
shorashim-secrets; absent → unsigned and says so.
- GET /courtyard/ledger?limit&before — this key's bedikot, newest first,
each rendered and signed; GET /courtyard/bedikah/<ref> — one, 404 for
another key's or none alike; GET /peah/ledger_key — the public key.
- Tamid §1.1 "The ledger" (Doorpost pin moved → 02ddf313…), KOHEN
"Issuing a key" (the seed, once), secrets.yaml template.
Tests: ledger_test (digest, entry, canonical, sign/verify, unsigned
rendering, signed rendering); ledger_l3_test (own records listed newest
first and only own; 404 alike for another's and none; an examination
engraved under the key reads back signed and verifies against
/peah/ledger_key). Elixir 642/0; L3 13/0.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
