no fabricated readings: every figure sealed as a reading was read #212
2026-10-10
jouledesk, joulehook: the docs say a figure carries its meter's grade, not "measured"
All checks were successful
standards workspaces build + test / jouleclaw-rs (pull_request) Successful in 2m3s
standards workspaces build + test / aac-rs (pull_request) Successful in 1m42s
standards workspaces build + test / joule-code-rs (pull_request) Successful in 46s
standards workspaces build + test / joulecontract-rs (pull_request) Successful in 33s
standards workspaces build + test / map-rs (pull_request) Successful in 29s
standards workspaces build + test / mesh-rs (pull_request) Successful in 34s
standards workspaces build + test / openpay (pull_request) Successful in 1m23s
jouleclaw public surface must stay documented / Public-surface audit (jouleclaw-rs) (pull_request) Successful in 1m1s
no-vanity-metrics / Scan committed Markdown for vanity metrics (pull_request) Successful in 5s
no-vanity-metrics / WAI public text names no comparison (pull_request) Successful in 6s
no-vanity-metrics / WAI public text names no company or product (pull_request) Successful in 6s
standards workspaces build + test / arl-rs (pull_request) Successful in 1m14s
standards workspaces build + test / eoc-rs (pull_request) Successful in 2m0s
standards workspaces build + test / jcp-rs (pull_request) Successful in 1m39s
standards workspaces build + test / joule-ui-rs (pull_request) Successful in 1m11s
standards workspaces build + test / joulehook-rs (pull_request) Successful in 1m12s
standards workspaces build + test / proof-rs (pull_request) Successful in 1m18s
standards workspaces build + test / sense-rs (pull_request) Successful in 1m13s
standards workspaces build + test / sandbox-rs (pull_request) Successful in 2m20s
workflow hygiene / every workflow supersedes its own queue (pull_request) Successful in 5s
standards workspaces build + test / smart-byte-rs (pull_request) Successful in 4m2s
standards workspaces build + test / jouledesk-rs (pull_request) Successful in 4m38s
standards workspaces build + test / macOS energy backends (pull_request) Successful in 7m8s
After the branch graded these figures by how they were obtained, the
docs still called them measured: jouledesk's channel example printed
"the teammate's measured contribution", Joule::energy_summary's doc and
SPEC §6 said the contribution "is *measured*", the room example sealed
an Estimator figure and closed "at its measured energy" (each turn
"metered {est} µJ" for a scripted estimate), and joulehook INSTALL.md
promised the Mesh proxy as "the only *measured* + *capped* option" that
"returns the measured energy".
Each now says the figure carries the grade of the meter that produced it
(a hardware reading only where a live counter read the work, else an
estimate graded as one), that a rollup is no better than the weakest
figure it sums, and the room example calls its figures estimates.
Text only; jouledesk and jouledesk-github tests pass unchanged.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
jcp-cli: the meter line names the rung and the probe's own grade
The demo printed `meter HwShunt backend → 2388 µJ probe [ModelBased] (estimated, and says so)` here: the rung's best grade (Meter::provenance) beside a probe the model graded, because the 20,000-addition probe was too short for the per-process counter to advance. The module docs and jcp/README.md called the line "a real reading" / "its one measurement". The line now names the rung (Meter::rung) and prints only the probe's figure at the grade the meter gave it, "a hardware reading of the probe" or "an estimate: no counter read the probe". The probe is a fixed 2,000,000-step loop, long enough for a live counter to read it (here: `ProcessEnergy rung → 44215 µJ probe [HwShunt]`). The docs say what the line is. Test: the_meter_line_names_only_the_probes_grade (exactly one grade label on the line, and it is the bracketed probe grade) fails on the old line and passes now. Co-Authored-By: Claude Opus 5.5 <[email protected]>
jcp-x402: the settlement record carries its figure's grade; pay meters its compute
seal_settlement committed a bare `measured_uj: u64` into the coupling record — "the measured joules" — with a doc rule that a host must not pass an estimate there. Nothing enforced it, and the pay example passed a literal 5_812, no meter and no compute. The record now carries the grade with the figure: seal_settlement, coupling_record and coupling_id take an Energy, and the record holds joules_uj, energy_provenance and energy_coverage. A figure is committed at the grade its meter gave it; one whose grade does not hold together (HwShunt with no measured figure, Estimator with one) is committed as an estimate. This makes the rule structural and lets a host with only an estimate seal an honest settlement, where refusing would leave it none. No conformance vector pins the record (none exists for x402), so no vector changes; the receipt's own cost stays the Estimator zero. pay now runs a small fixed workload as the paid compute, meters it with jcp_energy::Meter::detect, and seals and prints the figure at its grade (here: ProcessEnergy rung, 103,971 µJ [HwShunt]); the tx hash is labelled illustrative. Tests: the_coupling_record_carries_the_figures_grade (grades, coverage, a forged HwShunt committed as Estimator); the settlement test now also checks the same joules at another grade, or partial, give another id. Co-Authored-By: Claude Opus 5.5 <[email protected]>
jouleclaw-hydra-client: a transport's joule figure carries its grade; ungraded is an estimate
The client sealed any transport-supplied joules figure as HwShunt, in all three clients (Rust lib.rs, Go jclaw_hydra.go, Python client.py), though TransportResponse.joules_uj carries no grade: a transport with an estimate, or a figure of unknown origin, had it sealed as a hardware reading. TransportResponse now carries the grade of the meter that produced the figure (Rust joules_provenance: Option<Provenance>, plus with_joules; Go JoulesProvenance string; Python joules_provenance), and one rule, graded_joules / GradedJoules, decides what is sealed in every client: the figure at its stated grade; an ungraded figure (or, in Go/Python, a grade that is not HwShunt/ModelBased/Estimator) as Estimator; no figure as a zero Estimator. The conformance vectors carry no touch and are unchanged; Go and Python still verify 9/9. Tests (each fails before on HwShunt): Rust an_ungraded_transport_figure_ is_sealed_as_an_estimate, a_graded_transport_figure_keeps_its_grade; Go TestUngradedJoulesAreSealedAsEstimates, TestGradedJoulesKeepTheirGrade; Python tests/test_energy_grade.py (pytest). Co-Authored-By: Claude Opus 5.5 <[email protected]>
ci: run mesh-openai's serve_example test in the mesh-rs feature step
The serve_example regression test (the reference server seals what its meter read, never a fixture's figure) has required-features `server`. `cargo test --workspace` builds none of it, and the mesh-rs feature step ran `-p mesh-engine-gguf --features gguf`, which compiles mesh-openai with `server` but runs only mesh-engine-gguf's tests. Reinstating the 4.8 J fixture would have kept CI green. The step now selects both packages with package-qualified features: `-p mesh-engine-gguf -p mesh-openai --features mesh-engine-gguf/gguf,mesh-openai/server`. Run locally in mesh/mesh-rs: mesh-openai's 11 lib tests and serve_example (1) ran and passed, beside mesh-engine-gguf's. Co-Authored-By: Claude Opus 5.5 <[email protected]>
mesh-meter: an estimate of a served span is never 0 µJ nor the meter's waits
HwMeter passed the family meter's whole-host estimators straight through. Those accrue by the millisecond, so a span shorter than one — a served request, here — read 0 µJ: on a host with no live whole-request counter (this M5 Max), every request served with `server,hw-meter` or `server,hw-meter-apple` sealed 0 µJ [Estimator], against HwMeter's own rule that a span is never billed a zero. A backend that is a whole-host estimate is now billed through this crate's EstimatorMeter, which resolves a microjoule, and the bridge names itself `estimator` then. ProcessMeter (`server,metal`) sealed ~1.5–9.5 J [Estimator] per request for ~11 µs of engine work. The process CPU count does not advance over so short a serve, so ProcessSpanMeter falls back to the host meter, whose window opens before its first GPU-rail snapshot and closes after its last — 100 ms or more of the meter's own waiting at each end — and its load estimate billed that. A whole Estimator span (only that fallback gives one) is now billed this crate's estimate over the work's own window. The estimator's window for the rest of the host now opens after the span meter's starting readings, the same window as the CPU reading, instead of before its GPU snapshot wait. Measured here, one served request: hw-meter 0 → 103 µJ, hw-meter-apple 0 → 113 µJ, metal 9,480,000 → 168 µJ, all [Estimator]. Tests (each fails before): an_estimator_backend_never_bills_a_short_ span_nothing (50 spans of 50 µs over the family EstimationMeter); an_estimated_fallback_span_is_billed_the_works_own_window (energy_of over the fallback span seen here); serve_example asserts usage.energy.uj > 0 for every grade. The waits sit in jouleclaw-energy's ProcessSpanMeter (its fallback reads bracket the GPU snapshots); that is not changed here. Co-Authored-By: Claude Opus 5.5 <[email protected]>
sandbox-cli: demo and confidential seal illustrative identities, not named devices
`sandbox demo` and `sandbox confidential` detect no device and run no
unit, yet the attestations they seal named a CPU model, a GPU product
with a driver release, and a confidential-compute CPU product: device
identities no probe saw, sealed as if detected.
Each identity is now a capability-named placeholder labelled
illustrative ("illustrative host CPU (none detected)", driver
"illustrative"), built by illustrative_identity beside the existing
illustrative() energy records. The module docs say so.
Test: the_illustrative_runs_seal_no_detected_identity fails on the old
reports (demo: model "Generic x86_64") and passes now.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sandbox-tee: attested_efficiency attests what this host's meter read
The example attested a literal 117,000 µJ, described as "the on-device meter read 117 mJ … a real sensor reading", under CounterClass::Rapl and sealed it into efficiency/1 as Energy::modeled. No meter ran and no task ran; on a host with no RAPL counter it printed a RAPL "real sensor reading" at IntegrityAttested. It now runs a bounded SHA-512 chain on this thread, meters it with PowerMeter::detect_in_process, and attests the figure under the class of the counter that read the CPU work, sealing it HwShunt; where no counter read it (none live, or one that did not advance), the figure is the meter's estimate, attested as CounterClass::Estimator and sealed Estimator. The closing text follows the attested class. No value figure is invented (value_uusd: None). The kernel's per-process count (macOS ri_energy_nj) is the counter detect_in_process reads on macOS, and no class named it, so CounterClass::ProcessEnergy is added (tag process_energy, binding discriminant 7; existing discriminants unchanged; not independently rooted). jcp-efficiency MAPPING.md now describes the example as it is. Tests: tests/attested_efficiency_example.rs compiles the example in and asserts the attested class is one of the meter's live probes over a span with a CPU reading and sealed HwShunt, else Estimator/Estimator, and that a span with no CPU reading (the machine meter here) is attested as a non-zero estimate. energy.rs: every class binds a distinct statement. Co-Authored-By: Claude Opus 5.5 <[email protected]>
smart-byte: the CLI seals a command-line cost as an estimate, not a reading
`envelope new` sealed the `--microjoules` figure as JouleCost::measured. The CLI runs no work a meter could read, so that figure is the issuer's claim; sealing it as a hardware measurement put a reading nobody took into the byte. It is now sealed as an estimate, with a test that a round-tripped byte carries no measured figure whatever the command line gives. Co-Authored-By: Claude Opus 5.5 <[email protected]>
jcp-x402: the settlement receipt's zero is an estimate; pay's figure illustrative
seal_settlement seals the receipt that binds an on-chain settlement to the joules the paid compute consumed. It debits nothing, and sealed its own cost as Energy::measured(0): a 0 µJ hardware reading that nothing took, beside a record whose joules are the host's. It is now Energy::estimator(0), and the docs say the host's figure is committed as the host gives it, in a record with no grade, so a host must not pass an estimate there as a reading. The pay example passed a literal 5_812 µJ commented "what the meter read", with no meter and no compute. It is now labelled illustrative, in the comment and in the printed coupling line. Test: settlement_receipt_binds_tx_to_measured_joules now also decodes the settlement receipt's signed core: cost_uj 0, energy_provenance "Estimator". Co-Authored-By: Claude Opus 5.5 <[email protected]>
jcp-runtime: an authorization's zero is graded Estimator, not HwShunt
Runtime::authorize and authorize_flow put Energy::measured(0) on every decision they return. Nothing has run at authorization, and a refusal never runs, so the zero is exact — but nothing read it. Sealed (the gateway seals every refusal authorize returns), each refusal's receipt claimed a 0 µJ hardware reading of a call that never happened, and a ledger's "all readings" floor counted it as one (SPEC §5: a figure never claims better provenance than how it was obtained). Every zero authorize returns now comes from `nothing_ran()`, Energy::estimator(0). decide/charge keep the caller's cost and grade. No pinned vector seals an authorize decision: the jcp workspace suite (440 tests, conformance vectors included) and the downstream crates that use the runtime (sandbox-jcp, joule-code-jcp, jouleclaw-jcp, joule-ui-interaction, jouledesk) pass unchanged. Test: an_authorizations_zero_is_never_a_reading drives authorize and authorize_flow through allow, untrusted control, an ungranted action and a spent budget: every cost is 0, Estimator, with no measured figure. Co-Authored-By: Claude Opus 5.5 <[email protected]>
jouleclaw-stack: ledger_breakdown's simulated workload is sealed as estimates
The ledger_breakdown example simulates a workload — no tier runs, no meter reads — and sealed its tool touches HwShunt at the cheap tiers and ModelBased at the model tier, so the printed summary's rows claimed hardware readings and an energy model's figures for work that never ran. Every touch now comes from `simulated_touch`, graded Estimator, and the module docs say the workload is simulated. The printed floor and rows read [Estimator]. tests/ledger_breakdown_example.rs compiles the example in as a module, seals touches at three tiers through its `simulated_touch`, and checks each touch, the summary's floor, and every by-tier and by-tool row are Estimator. Co-Authored-By: Claude Opus 5.5 <[email protected]>
jouleclaw-corpus: the example ledgers' stand-in receipts are estimates
emit_corpus and emit_corpus_semantic stand in a synthetic ledger for the receipts a deployment would read off disk, and graded every stand-in HwShunt. The corpus encodes the grade as a feature (the provenance one-hot, dims 7–9), so the emitted rows told a router that chosen figures were hardware readings. Both now grade their stand-ins Estimator, and say why. The semantic example (behind `candle`) is compile-checked with the feature. tests/emit_corpus_example.rs compiles emit_corpus in as a module, builds stand-ins across the tiers with its own `receipt` (now pub) and the corpus from them: every receipt must be Estimator and every row's one-hot must be Estimator's slot, never HwShunt's. Co-Authored-By: Claude Opus 5.5 <[email protected]>
jouleclaw-harness-econ: cache and skill joules are estimates, not readings
provenance_of graded the cache (L0) and compiled-skill (L0.5) tiers' joules HwShunt, "exact by construction". They are the figures the tiers report: a skill's constant (SKILL_JOULES, 20 nJ a resolution) and a cache's estimate of a lookup. Nothing read them, and a cascade answer carries no grade, so a run that only hit compiled skills reported its joules-per-verified-fix floor as a hardware reading of constants — the figure the swebench/local-model examples print beside the headline. Every tier's figure is now graded Estimator: the harness cannot see a grade for any of them. Runs whose model dispatches are metered already print each dispatch's own grade beside the report (window_joules, span_joules); the report's floor stays an estimate's. The EconReport field's docs say so. Test: a_skill_only_run_is_reported_as_an_estimate compiles the class before round one, so all three rounds resolve through the skill and are billed exactly 3 × SKILL_JOULES; the report's floor must be Estimator (it was HwShunt). Co-Authored-By: Claude Opus 5.5 <[email protected]>
jouledesk: tag() seals the skill's cost as an estimate, not a reading
Teammate::tag (and tag_mention, which calls it) sealed each task's
efficiency/1 energy as a HwShunt hardware reading. The figure is the cost
the dispatch's last decision receipt sealed — the spend the skill
reported, else the cost it committed before it ran; the reference Skill
reports a constant — and that decision receipt already grades it
Estimator. So the same figure was an estimate in one receipt and a
hardware reading nothing took in the other, against SPEC §6's "honest
provenance".
tag() now seals Estimator; a binding whose skill meters its work passes
its meter's grade through tag_with_provenance, unchanged. The decision
receipts, and so the published jouledesk/1 conformance vector
(summarize-allow.hex, checked by tests/pack.rs), are untouched.
The unit test that pinned the old default ("plain tag seals the committed
cost as a hardware reading") asserted the fabrication; it now asserts
that tag and tag_mention both seal "Estimator", read back through the
verified efficiency chain.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
jcp-action-receipt: end_to_end authorises at an estimate, not a reading
The end_to_end example decides its action before the work runs and debited Energy::measured(250_000), so the authority receipt it seals and binds into the AR-1 receipt claimed a 0.25 J hardware reading of work that had not happened. Its own docs promise HwShunt "only when every record the meter returned is a hardware reading". The decision now debits `authorised_cost()`, the action's 0.25 J estimate graded Estimator with no measured figure, and the docs say the work's reading is step 3's. The work receipt and the AR-1 receipt are unchanged: they already carry the meter's own grade. tests/end_to_end_example.rs compiles the example in as a module and checks the authorised cost is Estimator with no measured figure. Co-Authored-By: Claude Opus 5.5 <[email protected]>
jcp-cite: the cite example's illustrative retrieval is sealed as an estimate
The `cite` example records a retrieval of 4_200 µJ that no fetch spent (no document is read) and decided and sealed it as Energy::measured, so its jcp receipt claimed a hardware reading of work no meter saw. The cost now comes from `retrieval_cost()`, the citation's figure graded Estimator with no measured figure; the docs and the first output line say the retrieval is illustrative. The figure, and so the receipt's cost_uj and the citation commitment, are unchanged. tests/cite_example.rs compiles the example in as a module: its cost must be Estimator with no measured figure, and the receipt sealed over it must carry energy_provenance "Estimator", decoded from the signed core. Co-Authored-By: Claude Opus 5.5 <[email protected]>
jcp-efficiency: the session example's illustrative figures are estimates
The `session` example seals five efficiency/1 receipts for an illustrative fleet — no task runs — and built each energy figure with Energy::measured(uj), commented "a HwShunt reading in this demo". Every receipt claimed a hardware reading nothing took. `task()` now seals Energy::estimator(uj), the module docs say the fleet is illustrative and that a binding metering real work seals its meter's grade, and the run prints that the energy is sealed as estimates. The figures, and so every rate the example prints, are unchanged. tests/session_example.rs compiles the example in as a module, builds its records and seals them: each record must be Estimator with no measured figure, and each verified receipt's provenance "Estimator". Co-Authored-By: Claude Opus 5.5 <[email protected]>
jcp-cli: the demo's scripted costs are sealed as estimates
The `jcp` demo scripts its agent loop with fixed costs, and built each with Energy::measured(...): every allowed row was debited and sealed as a HwShunt reading of a tool call that never ran, and the receipt line read `allow · 50000 µJ · HwShunt`. No tool runs in the demo, so nothing read those figures. The rows now come from `script()`, each cost Energy::estimator(...) with no measured figure; the figures are unchanged, so the budget still runs out at the last row. The demo says the costs are scripted and sealed as estimates, and the meter line now also prints the probe's own grade (the probe is the demo's one real measurement). jcp/README.md's demo block is updated to the output, with the read-again row it had dropped. Tests: a unit test checks every scripted cost is Estimator with no measured figure and decodes the signed core of the last allow's receipt (energy_provenance "Estimator"); tests/demo.rs runs the built binary and checks the printed receipt line is graded Estimator, never HwShunt. Co-Authored-By: Claude Opus 5.5 <[email protected]>
sandbox-cli: demo and confidential seal illustrative estimates, not readings
`sandbox demo` and `sandbox confidential` run no unit: they build a run report and seal it to show the receipt and attestation formats. They sealed literal records — CPU measured_uj Some(2_000) and GPU Some(50_000), both HwShunt — so every receipt claimed hardware readings of work that never happened (SPEC §6.3: HwShunt is read from a hardware interface for that device class). Each record is now `illustrative()`: the same estimated figure, graded Estimator, with no measured figure. The demo says it is illustrative, its measured line says "none (illustrative figures, sealed as estimates)" rather than "partial", and confidential prints each sealed run's energy record so its grade is visible. run-wasm, which meters a real unit, is unchanged. Tests: a unit test checks both reports carry only Estimator records with no measured figure; tests/illustrative_runs.rs runs the built binary and checks every printed record is [Estimator], none carries meas=, and no line says HwShunt. Co-Authored-By: Claude Opus 5.5 <[email protected]>
mesh-openai: the serve example seals what its meter read, not a fixture
The reference server metered every request with a test fixture,
SteppingMeter("rapl", HwShunt, 4.8 J), so each sealed mesh/1 receipt
claimed a 4.8 J "rapl" hardware reading of work nothing measured. A
mesh/1 receipt has no coverage field, so HwShunt there claims a reading of
the whole request (SPEC §3.3).
The example now serves with the meter its build can read: ProcessMeter
(this process's own CPU and GPU energy; the reference engine runs in this
process) with the new `metal` feature, HwMeter::detect with `hw-meter`
(and -rapl/-nvml/-apple), and the load estimator otherwise. The features
are forwarded to an optional mesh-meter dependency; the library itself
still never meters.
tests/serve_example.rs compiles the example into the test and drives one
real HTTP request through its own meter and mesh: a build with no hardware
meter must seal Estimator with no measured figure, and a metal build's
HwShunt figure must lie within this process's CPU energy read raw
(ri_energy_nj) around the request.
Co-Authored-By: Claude Opus 5.5 <[email protected]>