agent-joule/dev-docs/STATUS.md

Fruition Audit — what's live vs aspirational

Generated 2026-06-14. Skeptical pass: the project claims "live-verified" often — this checks the code, not the claims. file:line against audited HEAD.

Bottom line

The crate is substantially real, not a Potemkin demo. The cascade (L0→L4 stop-at-first-close), both JCP gates (cascade-tier + agent-tool), lifecycle hooks (PreTool/PreMerge), the persistent sealed ledger, git-worktree sessions, the control protocol + MCP bridge, FIM edit-prediction, and the conformance harness are all genuinely wired, compile (11 MB rlib built today), and covered by non-trivial unit tests with real assertions (~270 across 13 files). Real crypto/energy/cascade work is delegated to the open-standards git deps, not faked.

The honest gaps are narrow and mostly disclosed:

1. On-device tiers (L2/L3), the codebase index, and FIM are never CI-verified — every real-model test is #[ignore]'d behind JOULE_CODE_TEST_MODEL. CI proves the plumbing (prompt-building, cleanup, vector math, cache round-trips), never that a model produces a usable edit.
2. author: [0u8;32] is hardcoded on every emitted CodingOp despite a real identity existing — ops are content-addressed but anonymous.
3. L0 cache keys on intent only (prior empty) — blind to buffer divergence.
4. Sandbox sealing + MCP are best-effort, dependent on sandbox-mcp on PATH; absent → edits silently apply unsealed.
5. PostTool/SessionEnd hooks defined but never fired; the L4 receipt is token-estimated, never measured (honestly tagged).
6. JOULE_CODE.md is partly stale — describes deps as path = ... (now git deps pinned to 4132daa).

Incomplete markers

No unimplemented!/todo!/// TODO/// FIXME/// HACK in production paths. panic!s are all in tests. "no-op"/"best-effort"/"placeholder" hits are honest descriptors. Load-bearing ones:

Marker	Location	Load-bearing?
author: [0u8; 32] "per-run placeholder"	agent_joule_panel.rs:3181, 3252	Yes — anonymizes every op
deterministic-seed identity fallback	:4005-4018	Minor — only when keyfile unwritable
"inert pre/post/inv" contracts	methodology.rs:87	Honest scoping — structural frame_check only
PostTool/SessionEnd "the place to record"	hooks.rs:25,29	Defined, never fired
"best-effort: write failure is logged"	agent_joule_panel.rs:684,737,827,969	Honest — memory degrades, never errors

Silent/empty paths

• author: [0u8;32] — captured_op :3181, build_coding_op :3252. op_id() is real BLAKE3, but the author is zeroed; session_identity :3994 builds a real ed25519 key used for ledger/methodology seals but not stamped into op cargo. The single most material gap vs "signed transition" claims.
• L0 prior always empty — :676,1133,1625,2136,2565. Cache key = intent string only.
• Load-bearing let _ = discards (vs the repo's CLAUDE.md rule): :633 (adopt_from_file), :953 (cite_op), :978/981 (persistence writes), :2893 (record_primary_op). The rest (~35) are test cleanup.
• session_receipt :3107: sequence:0, nonce:[0u8;8] hardcoded — fine for a session-summary receipt, not per-op (disclosed).

Tests

5 #[ignore]'d tests, all gated on a real model/server:

Test	File:line	Proves	CI
l3_probe_simple_vs_harness	agent_joule_panel.rs:4861	L3 produces usable edits	never
harness_probe_one	:4910	a code model emits a valid <<<FILE>>> edit	never
codebase_index_retrieves_relevant_file_with_real_model	:4933	semantic retrieval	never
embeds_separate_paraphrase_from_unrelated	:5114	L2 embedding separation	never
connects_to_a_real_mcp_server_and_lists_tools	mcp_client.rs:219	MCP bridge to a real server	never

Non-ignored tests are load-bearing, not smoke — e.g. ledger_chain_round_trips_through_a_real_file_and_detects_tampering (real I/O + seal + tamper), sealed_ledger_receipt_binds_op_to_one_identity (wrong-key + tampered-op rejection), the cascade_gate budget/grant/lifetime trio, tool_gate deny tests, hooks deny-wins + point-isolation, the sessions real-git worktree merge tests, and the conformance test's report.pass > 0 vacuity guard. The gap is entirely the on-device-model layer.

Claim vs reality

Feature	Claimed	Actual	Evidence	Gap
L0 cache	session + cross-session memory	Live	submit_prompt:1624; rehydrate :676	Keys on intent only — blind to buffer
L1 deterministic	literal substitution, no model	Live	:1834; parse_substitution:3273	None significant
L2 retrieval	on-device embed, paraphrase replay	Live code, model-unverified	:1673; best_l2_match tested :5051	Real-model separation only in an ignored test
L3 on-device model	GGUF/Mellum generates edits	Live wiring, model-unverified	:1883; l3_generate:3540	Off by default; edit-quality manual only
L4 ACP federation	Claude/Gemini/Codex	Live	send_to_l4:2462 real thread.send	Receipt energy estimated, not measured
Energy metering	real counter, honest provenance	Live (Apple ModelBased / Linux HwShunt), Estimator fallback	host_energy:3196; baseline-subtracted	L4 estimator-only; Apple ModelBased not a shunt (tagged)
JCR-1 sealing	COSE_Sign1 ledger, chain	Live	seal_op_receipt:738; tamper test :5252	Op author zeroed; some seal failures let _ =
JCP grant gating	tiers structurally un/reachable	Live (strongest part)	CascadeGate real JcpGate; authorize_tier:2611	None
Agent tool-gate	read-only loop can't run/write	Live	tool_gate.rs real LocalToolGate	Ungated default still uses is_allowed_command prefix-match
Sessions (worktrees)	git worktree per session, gated merge	Live (real git)	sessions.rs:404 worktree add, :487 git merge	None significant
Hooks PreTool/PreMerge	deny-capable, fired	Live & fired	authorize_tier:2623; merge_session:2855	PostTool/SessionEnd never fired
Control protocol	newline-JSON Unix/TCP, peers/relay	Live & wired	control.rs; main.rs:221	Mutating cmds ack-then-async (disclosed)
MCP bridge	--jc-mcp stdio server	Live & wired	main.rs:245	Outbound MCP client tested only by ignored test
Codebase index	on-device embed + cosine	Live code, model-unverified	codebase_index.rs	Retrieval-quality only in ignored test
FIM prediction	Cursor-Tab on-device	Live & registered	edit_prediction_local.rs; registered :115	Infill quality unverified in CI
Sandbox sealing	S0–S7 attested receipt	Live client, external-binary-dependent	sandbox_bridge.rs:67	Needs sandbox-mcp; absent → silent skip
Methodology/contracts	sign spec, cite ops, frame_check	Live (structural only)	methodology.rs real ed25519	Pre/post/inv inert, no proof discharge (disclosed)
Conformance C1–C5	vector pack passes in-tree	Live	tests/conformance.rs; non-vacuous guard	Pinned to one rev

Net: the enforcement-and-accounting machinery is real and CI-tested; the weakness is concentrated in the loaded-model layer (ignored tests + manual runs) and the anonymized op author.