no fabricated readings: every figure sealed as a reading was read #212

Merged

dcharlot merged 21 commits from fix/no-fabricated-readings into main 2026-10-10 22:24:51 -04:00

Conversation 0 Commits 21 Files changed 48 +1703 -298

dcharlot commented 2026-10-10 18:16:55 -04:00

Owner

Copy link

Why

A repo-wide sweep of every place that meters energy found shipped binaries and examples that seal figures nothing measured, graded as hardware readings. For example, a test-fixture "4.8 J rapl" reading on every request served by an example server, and literal measured_uj records in CLI demos. A receipt is only worth what its grade is worth, so any figure presented as a reading must have been read.

What

Every site now either meters the real work or seals the figure as an illustrative estimate.

• Real meters, where the work is real:
  • mesh-openai serve example: the meter now follows the build features: estimator, machine meter, or this process's meter.
  • sandbox-tee attested_efficiency: it used to attest a literal 117 mJ as a RAPL reading. It now meters a real workload on its own thread and attests the counter class the meter actually used. A new class, CounterClass::ProcessEnergy, covers the kernel's per-process count. Existing classes are unchanged.
  • jcp-x402 pay meters a fixed workload.
  • jcp-cli's meter line prints the rung and only the probe's own grade.
• Illustrative estimates, where there is no work to read:
  • sandbox-cli demo / confidential, now with capability-named placeholder identities instead of named products;
  • jcp-cli scripted rows;
  • the jcp-efficiency, jcp-cite and jcp-action-receipt examples;
  • jouledesk tag();
  • jouleclaw-harness-econ, jouleclaw-corpus and jouleclaw-stack stand-ins;
  • the smart-byte CLI's command-line cost.
  • jcp-runtime's authorization zero and jcp-x402's settlement zero are now graded Estimator. They under-claim; nothing pinned depends on them.
• Grades carried through:
  • jcp-x402: the settlement record now carries its figure's grade (energy_provenance, energy_coverage), so the rule is enforced by the type. API change: seal_settlement, coupling_record and coupling_id take an Energy instead of a bare u64.
  • jouleclaw-hydra-client (Rust, Go, Python): a transport's joules figure now carries a grade. An ungraded figure is sealed Estimator, never HwShunt.
• mesh-meter:
  • On an estimator-only host, HwMeter sealed every sub-millisecond request at 0 µJ. It now bills through mesh's µs-resolution estimator.
  • In the Metal build, a request that cost about 0.1 mJ was billed about 9.5 J, because the fallback window bracketed its own snapshot waits. It is now billed over the work's own window: 180 µJ, Estimator.
• CI: mesh-rs now runs mesh-openai's tests with server, so the serve-example regression test runs.
• Docs: jouledesk (examples, lib, SPEC §6, room.rs) and joulehook INSTALL now say each figure carries the grade of the meter that produced it.

Not touched: jouleclaw-omni/src/runtime/energy.rs, which an open PR owns, and wai/.

Evidence

• Tests: each fixed site has a test that fails if a literal hardware figure comes back.
• No vector changed. jcp-conformance and sandbox-conformance pass, and hydra-client's 9/9 vectors still match.
• Review: an independent review re-ran the search across the repo and found 8 more defects, all fixed.
• Suites:
  • jcp-rs workspace: 479 passed.
  • mesh-openai: 13 passed under every feature set.
  • mesh workspace: 57 passed.
  • sandbox-cli + sandbox-tee: 41 passed.
  • jouledesk: 38 passed.
  • hydra-client: Rust 22, Go ok, Python 3 + 9/9.
• Linux cross-checks: clean, except sandbox-cli, which needs a Linux C cross compiler this Mac doesn't have.

Not covered

• Named device identities elsewhere in sandbox. They remain in sandbox-proof-wasm, sandbox-conformance (they may feed file-backed vectors, so they were left alone) and sandbox/SPEC.md's example.
• A wider grading question: wall time × a default 15 W graded ModelBased (jcp-energy, proof-solvers, aac-core) is not a host-calibrated model. It is left for a separate pass.

🤖 Generated with Claude Code

## Why A repo-wide sweep of every place that meters energy found shipped binaries and examples that seal figures nothing measured, graded as hardware readings. For example, a test-fixture "4.8 J rapl" reading on every request served by an example server, and literal `measured_uj` records in CLI demos. A receipt is only worth what its grade is worth, so any figure presented as a reading must have been read. ## What Every site now either meters the real work or seals the figure as an illustrative estimate. - **Real meters, where the work is real:** - **mesh-openai serve example:** the meter now follows the build features: estimator, machine meter, or this process's meter. - **sandbox-tee `attested_efficiency`:** it used to attest a literal 117 mJ as a RAPL reading. It now meters a real workload on its own thread and attests the counter class the meter actually used. A new class, `CounterClass::ProcessEnergy`, covers the kernel's per-process count. Existing classes are unchanged. - **jcp-x402 `pay`** meters a fixed workload. - **jcp-cli's meter line** prints the rung and only the probe's own grade. - **Illustrative estimates, where there is no work to read:** - sandbox-cli `demo` / `confidential`, now with capability-named placeholder identities instead of named products; - jcp-cli scripted rows; - the jcp-efficiency, jcp-cite and jcp-action-receipt examples; - jouledesk `tag()`; - jouleclaw-harness-econ, jouleclaw-corpus and jouleclaw-stack stand-ins; - the smart-byte CLI's command-line cost. - jcp-runtime's authorization zero and jcp-x402's settlement zero are now graded `Estimator`. They under-claim; nothing pinned depends on them. - **Grades carried through:** - **jcp-x402:** the settlement record now carries its figure's grade (`energy_provenance`, `energy_coverage`), so the rule is enforced by the type. **API change:** `seal_settlement`, `coupling_record` and `coupling_id` take an `Energy` instead of a bare `u64`. - **jouleclaw-hydra-client** (Rust, Go, Python): a transport's joules figure now carries a grade. An ungraded figure is sealed `Estimator`, never `HwShunt`. - **mesh-meter:** - On an estimator-only host, `HwMeter` sealed every sub-millisecond request at 0 µJ. It now bills through mesh's µs-resolution estimator. - In the Metal build, a request that cost about 0.1 mJ was billed about 9.5 J, because the fallback window bracketed its own snapshot waits. It is now billed over the work's own window: 180 µJ, `Estimator`. - **CI:** mesh-rs now runs mesh-openai's tests with `server`, so the serve-example regression test runs. - **Docs:** jouledesk (examples, lib, SPEC §6, `room.rs`) and joulehook INSTALL now say each figure carries the grade of the meter that produced it. Not touched: `jouleclaw-omni/src/runtime/energy.rs`, which an open PR owns, and `wai/`. ## Evidence - **Tests:** each fixed site has a test that fails if a literal hardware figure comes back. - **No vector changed.** `jcp-conformance` and `sandbox-conformance` pass, and hydra-client's 9/9 vectors still match. - **Review:** an independent review re-ran the search across the repo and found 8 more defects, all fixed. - **Suites:** - jcp-rs workspace: 479 passed. - mesh-openai: 13 passed under every feature set. - mesh workspace: 57 passed. - sandbox-cli + sandbox-tee: 41 passed. - jouledesk: 38 passed. - hydra-client: Rust 22, Go ok, Python 3 + 9/9. - **Linux cross-checks:** clean, except sandbox-cli, which needs a Linux C cross compiler this Mac doesn't have. ## Not covered - **Named device identities elsewhere in sandbox.** They remain in `sandbox-proof-wasm`, `sandbox-conformance` (they may feed file-backed vectors, so they were left alone) and `sandbox/SPEC.md`'s example. - **A wider grading question:** wall time × a default 15 W graded `ModelBased` (jcp-energy, proof-solvers, aac-core) is not a host-calibrated model. It is left for a separate pass. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dcharlot added 21 commits 2026-10-10 18:16:55 -04:00

mesh-openai: the serve example seals what its meter read, not a fixture ... 15af36c0b1

The reference server metered every request with a test fixture,
SteppingMeter("rapl", HwShunt, 4.8 J), so each sealed mesh/1 receipt
claimed a 4.8 J "rapl" hardware reading of work nothing measured. A
mesh/1 receipt has no coverage field, so HwShunt there claims a reading of
the whole request (SPEC §3.3).

The example now serves with the meter its build can read: ProcessMeter
(this process's own CPU and GPU energy; the reference engine runs in this
process) with the new `metal` feature, HwMeter::detect with `hw-meter`
(and -rapl/-nvml/-apple), and the load estimator otherwise. The features
are forwarded to an optional mesh-meter dependency; the library itself
still never meters.

tests/serve_example.rs compiles the example into the test and drives one
real HTTP request through its own meter and mesh: a build with no hardware
meter must seal Estimator with no measured figure, and a metal build's
HwShunt figure must lie within this process's CPU energy read raw
(ri_energy_nj) around the request.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

sandbox-cli: demo and confidential seal illustrative estimates, not readings ... ce5690bbf2

`sandbox demo` and `sandbox confidential` run no unit: they build a run
report and seal it to show the receipt and attestation formats. They
sealed literal records — CPU measured_uj Some(2_000) and GPU Some(50_000),
both HwShunt — so every receipt claimed hardware readings of work that
never happened (SPEC §6.3: HwShunt is read from a hardware interface for
that device class).

Each record is now `illustrative()`: the same estimated figure, graded
Estimator, with no measured figure. The demo says it is illustrative, its
measured line says "none (illustrative figures, sealed as estimates)"
rather than "partial", and confidential prints each sealed run's energy
record so its grade is visible. run-wasm, which meters a real unit, is
unchanged.

Tests: a unit test checks both reports carry only Estimator records with
no measured figure; tests/illustrative_runs.rs runs the built binary and
checks every printed record is [Estimator], none carries meas=, and no
line says HwShunt.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

jcp-cli: the demo's scripted costs are sealed as estimates ... 9fb3e38e13

The `jcp` demo scripts its agent loop with fixed costs, and built each
with Energy::measured(...): every allowed row was debited and sealed as a
HwShunt reading of a tool call that never ran, and the receipt line read
`allow · 50000 µJ · HwShunt`. No tool runs in the demo, so nothing read
those figures.

The rows now come from `script()`, each cost Energy::estimator(...) with
no measured figure; the figures are unchanged, so the budget still runs
out at the last row. The demo says the costs are scripted and sealed as
estimates, and the meter line now also prints the probe's own grade (the
probe is the demo's one real measurement). jcp/README.md's demo block is
updated to the output, with the read-again row it had dropped.

Tests: a unit test checks every scripted cost is Estimator with no
measured figure and decodes the signed core of the last allow's receipt
(energy_provenance "Estimator"); tests/demo.rs runs the built binary and
checks the printed receipt line is graded Estimator, never HwShunt.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

jcp-efficiency: the session example's illustrative figures are estimates ... b0f174bb8c

The `session` example seals five efficiency/1 receipts for an
illustrative fleet — no task runs — and built each energy figure with
Energy::measured(uj), commented "a HwShunt reading in this demo". Every
receipt claimed a hardware reading nothing took.

`task()` now seals Energy::estimator(uj), the module docs say the fleet is
illustrative and that a binding metering real work seals its meter's
grade, and the run prints that the energy is sealed as estimates. The
figures, and so every rate the example prints, are unchanged.

tests/session_example.rs compiles the example in as a module, builds its
records and seals them: each record must be Estimator with no measured
figure, and each verified receipt's provenance "Estimator".

Co-Authored-By: Claude Opus 5.5 <[email protected]>

jcp-cite: the cite example's illustrative retrieval is sealed as an estimate ... 68cb3c1b13

The `cite` example records a retrieval of 4_200 µJ that no fetch spent
(no document is read) and decided and sealed it as Energy::measured, so
its jcp receipt claimed a hardware reading of work no meter saw.

The cost now comes from `retrieval_cost()`, the citation's figure graded
Estimator with no measured figure; the docs and the first output line say
the retrieval is illustrative. The figure, and so the receipt's cost_uj
and the citation commitment, are unchanged.

tests/cite_example.rs compiles the example in as a module: its cost must
be Estimator with no measured figure, and the receipt sealed over it must
carry energy_provenance "Estimator", decoded from the signed core.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

jcp-action-receipt: end_to_end authorises at an estimate, not a reading ... 7f41c9a807

The end_to_end example decides its action before the work runs and
debited Energy::measured(250_000), so the authority receipt it seals and
binds into the AR-1 receipt claimed a 0.25 J hardware reading of work
that had not happened. Its own docs promise HwShunt "only when every
record the meter returned is a hardware reading".

The decision now debits `authorised_cost()`, the action's 0.25 J
estimate graded Estimator with no measured figure, and the docs say the
work's reading is step 3's. The work receipt and the AR-1 receipt are
unchanged: they already carry the meter's own grade.

tests/end_to_end_example.rs compiles the example in as a module and
checks the authorised cost is Estimator with no measured figure.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

jouledesk: tag() seals the skill's cost as an estimate, not a reading ... 11f3ba9d35

Teammate::tag (and tag_mention, which calls it) sealed each task's
efficiency/1 energy as a HwShunt hardware reading. The figure is the cost
the dispatch's last decision receipt sealed — the spend the skill
reported, else the cost it committed before it ran; the reference Skill
reports a constant — and that decision receipt already grades it
Estimator. So the same figure was an estimate in one receipt and a
hardware reading nothing took in the other, against SPEC §6's "honest
provenance".

tag() now seals Estimator; a binding whose skill meters its work passes
its meter's grade through tag_with_provenance, unchanged. The decision
receipts, and so the published jouledesk/1 conformance vector
(summarize-allow.hex, checked by tests/pack.rs), are untouched.

The unit test that pinned the old default ("plain tag seals the committed
cost as a hardware reading") asserted the fabrication; it now asserts
that tag and tag_mention both seal "Estimator", read back through the
verified efficiency chain.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

jouleclaw-harness-econ: cache and skill joules are estimates, not readings ... 9bb4203737

provenance_of graded the cache (L0) and compiled-skill (L0.5) tiers'
joules HwShunt, "exact by construction". They are the figures the tiers
report: a skill's constant (SKILL_JOULES, 20 nJ a resolution) and a
cache's estimate of a lookup. Nothing read them, and a cascade answer
carries no grade, so a run that only hit compiled skills reported its
joules-per-verified-fix floor as a hardware reading of constants — the
figure the swebench/local-model examples print beside the headline.

Every tier's figure is now graded Estimator: the harness cannot see a
grade for any of them. Runs whose model dispatches are metered already
print each dispatch's own grade beside the report (window_joules,
span_joules); the report's floor stays an estimate's. The EconReport
field's docs say so.

Test: a_skill_only_run_is_reported_as_an_estimate compiles the class
before round one, so all three rounds resolve through the skill and are
billed exactly 3 × SKILL_JOULES; the report's floor must be Estimator
(it was HwShunt).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

jouleclaw-corpus: the example ledgers' stand-in receipts are estimates ... f296c762b8

emit_corpus and emit_corpus_semantic stand in a synthetic ledger for the
receipts a deployment would read off disk, and graded every stand-in
HwShunt. The corpus encodes the grade as a feature (the provenance
one-hot, dims 7–9), so the emitted rows told a router that chosen figures
were hardware readings.

Both now grade their stand-ins Estimator, and say why. The semantic
example (behind `candle`) is compile-checked with the feature.

tests/emit_corpus_example.rs compiles emit_corpus in as a module, builds
stand-ins across the tiers with its own `receipt` (now pub) and the corpus
from them: every receipt must be Estimator and every row's one-hot must
be Estimator's slot, never HwShunt's.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

jouleclaw-stack: ledger_breakdown's simulated workload is sealed as estimates ... 12b9f4c080

The ledger_breakdown example simulates a workload — no tier runs, no
meter reads — and sealed its tool touches HwShunt at the cheap tiers and
ModelBased at the model tier, so the printed summary's rows claimed
hardware readings and an energy model's figures for work that never ran.

Every touch now comes from `simulated_touch`, graded Estimator, and the
module docs say the workload is simulated. The printed floor and rows
read [Estimator].

tests/ledger_breakdown_example.rs compiles the example in as a module,
seals touches at three tiers through its `simulated_touch`, and checks
each touch, the summary's floor, and every by-tier and by-tool row are
Estimator.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

jcp-runtime: an authorization's zero is graded Estimator, not HwShunt ... 51341edae9

Runtime::authorize and authorize_flow put Energy::measured(0) on every
decision they return. Nothing has run at authorization, and a refusal
never runs, so the zero is exact — but nothing read it. Sealed (the
gateway seals every refusal authorize returns), each refusal's receipt
claimed a 0 µJ hardware reading of a call that never happened, and a
ledger's "all readings" floor counted it as one (SPEC §5: a figure never
claims better provenance than how it was obtained).

Every zero authorize returns now comes from `nothing_ran()`,
Energy::estimator(0). decide/charge keep the caller's cost and grade.
No pinned vector seals an authorize decision: the jcp workspace suite
(440 tests, conformance vectors included) and the downstream crates that
use the runtime (sandbox-jcp, joule-code-jcp, jouleclaw-jcp,
joule-ui-interaction, jouledesk) pass unchanged.

Test: an_authorizations_zero_is_never_a_reading drives authorize and
authorize_flow through allow, untrusted control, an ungranted action and
a spent budget: every cost is 0, Estimator, with no measured figure.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

jcp-x402: the settlement receipt's zero is an estimate; pay's figure illustrative ... ee9f8cf8c7

seal_settlement seals the receipt that binds an on-chain settlement to
the joules the paid compute consumed. It debits nothing, and sealed its
own cost as Energy::measured(0): a 0 µJ hardware reading that nothing
took, beside a record whose joules are the host's. It is now
Energy::estimator(0), and the docs say the host's figure is committed as
the host gives it, in a record with no grade, so a host must not pass an
estimate there as a reading.

The pay example passed a literal 5_812 µJ commented "what the meter
read", with no meter and no compute. It is now labelled illustrative, in
the comment and in the printed coupling line.

Test: settlement_receipt_binds_tx_to_measured_joules now also decodes the
settlement receipt's signed core: cost_uj 0, energy_provenance
"Estimator".

Co-Authored-By: Claude Opus 5.5 <[email protected]>

smart-byte: the CLI seals a command-line cost as an estimate, not a reading ... 1e1b59e7a6

`envelope new` sealed the `--microjoules` figure as JouleCost::measured.
The CLI runs no work a meter could read, so that figure is the issuer's
claim; sealing it as a hardware measurement put a reading nobody took into
the byte. It is now sealed as an estimate, with a test that a round-tripped
byte carries no measured figure whatever the command line gives.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

sandbox-tee: attested_efficiency attests what this host's meter read ... c2b7f8af04

The example attested a literal 117,000 µJ, described as "the on-device
meter read 117 mJ … a real sensor reading", under CounterClass::Rapl and
sealed it into efficiency/1 as Energy::modeled. No meter ran and no task
ran; on a host with no RAPL counter it printed a RAPL "real sensor
reading" at IntegrityAttested.

It now runs a bounded SHA-512 chain on this thread, meters it with
PowerMeter::detect_in_process, and attests the figure under the class of
the counter that read the CPU work, sealing it HwShunt; where no counter
read it (none live, or one that did not advance), the figure is the
meter's estimate, attested as CounterClass::Estimator and sealed
Estimator. The closing text follows the attested class. No value figure
is invented (value_uusd: None).

The kernel's per-process count (macOS ri_energy_nj) is the counter
detect_in_process reads on macOS, and no class named it, so
CounterClass::ProcessEnergy is added (tag process_energy, binding
discriminant 7; existing discriminants unchanged; not independently
rooted). jcp-efficiency MAPPING.md now describes the example as it is.

Tests: tests/attested_efficiency_example.rs compiles the example in and
asserts the attested class is one of the meter's live probes over a span
with a CPU reading and sealed HwShunt, else Estimator/Estimator, and that
a span with no CPU reading (the machine meter here) is attested as a
non-zero estimate. energy.rs: every class binds a distinct statement.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

sandbox-cli: demo and confidential seal illustrative identities, not named devices ... 3f7a5c1755

`sandbox demo` and `sandbox confidential` detect no device and run no
unit, yet the attestations they seal named a CPU model, a GPU product
with a driver release, and a confidential-compute CPU product: device
identities no probe saw, sealed as if detected.

Each identity is now a capability-named placeholder labelled
illustrative ("illustrative host CPU (none detected)", driver
"illustrative"), built by illustrative_identity beside the existing
illustrative() energy records. The module docs say so.

Test: the_illustrative_runs_seal_no_detected_identity fails on the old
reports (demo: model "Generic x86_64") and passes now.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

mesh-meter: an estimate of a served span is never 0 µJ nor the meter's waits ... f456270ca4

HwMeter passed the family meter's whole-host estimators straight through.
Those accrue by the millisecond, so a span shorter than one — a served
request, here — read 0 µJ: on a host with no live whole-request counter
(this M5 Max), every request served with `server,hw-meter` or
`server,hw-meter-apple` sealed 0 µJ [Estimator], against HwMeter's own
rule that a span is never billed a zero. A backend that is a whole-host
estimate is now billed through this crate's EstimatorMeter, which
resolves a microjoule, and the bridge names itself `estimator` then.

ProcessMeter (`server,metal`) sealed ~1.5–9.5 J [Estimator] per request
for ~11 µs of engine work. The process CPU count does not advance over
so short a serve, so ProcessSpanMeter falls back to the host meter,
whose window opens before its first GPU-rail snapshot and closes after
its last — 100 ms or more of the meter's own waiting at each end — and
its load estimate billed that. A whole Estimator span (only that
fallback gives one) is now billed this crate's estimate over the work's
own window. The estimator's window for the rest of the host now opens
after the span meter's starting readings, the same window as the CPU
reading, instead of before its GPU snapshot wait.

Measured here, one served request: hw-meter 0 → 103 µJ, hw-meter-apple
0 → 113 µJ, metal 9,480,000 → 168 µJ, all [Estimator].

Tests (each fails before): an_estimator_backend_never_bills_a_short_
span_nothing (50 spans of 50 µs over the family EstimationMeter);
an_estimated_fallback_span_is_billed_the_works_own_window (energy_of over
the fallback span seen here); serve_example asserts usage.energy.uj > 0
for every grade.

The waits sit in jouleclaw-energy's ProcessSpanMeter (its fallback reads
bracket the GPU snapshots); that is not changed here.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

ci: run mesh-openai's serve_example test in the mesh-rs feature step ... 23508f227d

The serve_example regression test (the reference server seals what its
meter read, never a fixture's figure) has required-features `server`.
`cargo test --workspace` builds none of it, and the mesh-rs feature step
ran `-p mesh-engine-gguf --features gguf`, which compiles mesh-openai
with `server` but runs only mesh-engine-gguf's tests. Reinstating the
4.8 J fixture would have kept CI green.

The step now selects both packages with package-qualified features:
`-p mesh-engine-gguf -p mesh-openai --features
mesh-engine-gguf/gguf,mesh-openai/server`. Run locally in mesh/mesh-rs:
mesh-openai's 11 lib tests and serve_example (1) ran and passed, beside
mesh-engine-gguf's.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

jouleclaw-hydra-client: a transport's joule figure carries its grade; ungraded is an estimate ... 0c14dc33c8

The client sealed any transport-supplied joules figure as HwShunt, in
all three clients (Rust lib.rs, Go jclaw_hydra.go, Python client.py),
though TransportResponse.joules_uj carries no grade: a transport with an
estimate, or a figure of unknown origin, had it sealed as a hardware
reading.

TransportResponse now carries the grade of the meter that produced the
figure (Rust joules_provenance: Option<Provenance>, plus with_joules;
Go JoulesProvenance string; Python joules_provenance), and one rule,
graded_joules / GradedJoules, decides what is sealed in every client:
the figure at its stated grade; an ungraded figure (or, in Go/Python, a
grade that is not HwShunt/ModelBased/Estimator) as Estimator; no figure
as a zero Estimator. The conformance vectors carry no touch and are
unchanged; Go and Python still verify 9/9.

Tests (each fails before on HwShunt): Rust an_ungraded_transport_figure_
is_sealed_as_an_estimate, a_graded_transport_figure_keeps_its_grade;
Go TestUngradedJoulesAreSealedAsEstimates, TestGradedJoulesKeepTheirGrade;
Python tests/test_energy_grade.py (pytest).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

jcp-x402: the settlement record carries its figure's grade; pay meters its compute ... 3844e05974

seal_settlement committed a bare `measured_uj: u64` into the coupling
record — "the measured joules" — with a doc rule that a host must not
pass an estimate there. Nothing enforced it, and the pay example passed
a literal 5_812, no meter and no compute.

The record now carries the grade with the figure: seal_settlement,
coupling_record and coupling_id take an Energy, and the record holds
joules_uj, energy_provenance and energy_coverage. A figure is committed
at the grade its meter gave it; one whose grade does not hold together
(HwShunt with no measured figure, Estimator with one) is committed as an
estimate. This makes the rule structural and lets a host with only an
estimate seal an honest settlement, where refusing would leave it none.
No conformance vector pins the record (none exists for x402), so no
vector changes; the receipt's own cost stays the Estimator zero.

pay now runs a small fixed workload as the paid compute, meters it with
jcp_energy::Meter::detect, and seals and prints the figure at its grade
(here: ProcessEnergy rung, 103,971 µJ [HwShunt]); the tx hash is labelled
illustrative.

Tests: the_coupling_record_carries_the_figures_grade (grades, coverage,
a forged HwShunt committed as Estimator); the settlement test now also
checks the same joules at another grade, or partial, give another id.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

jcp-cli: the meter line names the rung and the probe's own grade ... 667d75916d

The demo printed `meter HwShunt backend → 2388 µJ probe [ModelBased]
(estimated, and says so)` here: the rung's best grade (Meter::provenance)
beside a probe the model graded, because the 20,000-addition probe was
too short for the per-process counter to advance. The module docs and
jcp/README.md called the line "a real reading" / "its one measurement".

The line now names the rung (Meter::rung) and prints only the probe's
figure at the grade the meter gave it, "a hardware reading of the probe"
or "an estimate: no counter read the probe". The probe is a fixed
2,000,000-step loop, long enough for a live counter to read it (here:
`ProcessEnergy rung → 44215 µJ probe [HwShunt]`). The docs say what the
line is.

Test: the_meter_line_names_only_the_probes_grade (exactly one grade
label on the line, and it is the bracketed probe grade) fails on the old
line and passes now.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

jouledesk, joulehook: the docs say a figure carries its meter's grade, not "measured" ... 4759874771

After the branch graded these figures by how they were obtained, the
docs still called them measured: jouledesk's channel example printed
"the teammate's measured contribution", Joule::energy_summary's doc and
SPEC §6 said the contribution "is *measured*", the room example sealed
an Estimator figure and closed "at its measured energy" (each turn
"metered {est} µJ" for a scripted estimate), and joulehook INSTALL.md
promised the Mesh proxy as "the only *measured* + *capped* option" that
"returns the measured energy".

Each now says the figure carries the grade of the meter that produced it
(a hardware reading only where a live counter read the work, else an
estimate graded as one), that a rollup is no better than the weakest
figure it sums, and the room example calls its figures estimates.
Text only; jouledesk and jouledesk-github tests pass unchanged.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot merged commit 2db417f344 into main 2026-10-10 22:24:51 -04:00

dcharlot referenced this pull request from a commit 2026-10-10 22:24:53 -04:00

Merge pull request 'no fabricated readings: every figure sealed as a reading was read' (#212) from fix/no-fabricated-readings into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Transaction-Science/open-standards!212

No description provided.