jcp: C25 — flow was a declared clause with no check; now it has one #357

Merged

dcharlot merged 1 commit from feat/c27-flow-conformance into main 2026-10-20 13:06:03 -04:00

Conversation 0 Commits 1 Files changed 2 +106

dcharlot commented 2026-10-20 08:42:21 -04:00

Owner

Copy link

§9 has listed C25 — flow as a conformance clause for as long as the clause existed, and the harness never had it. That is worse than a missing test: it is a published list of conformance classes claiming a class the pack cannot run.

Verified before writing anything

A declared gap is not evidence of one, so I checked:

• the harness's only occurrence of "flow" was an unrelated // control flow comment;
• jcp-flow is not even a dependency of jcp-conformance, so no check could have used it;
• and jcp-flow is the wrong crate anyway — it is provenance scanning (L17–L20, content windows). The clause is about the decision: a grant's ceiling, the enforcement point's taint floor, attenuation. That lives in jcp_schema::flow and jcp-runtime, both already dependencies, so the check needs no new dependency.

What C25 asserts

Each property the clause states, separately, so a failure names which one broke:

• a label at or below the grant's ceiling passes; one above it does not;
• the taint floor binds even under a ceiling permissive enough to admit the value — an operator refusal a delegated grant cannot widen;
• facts that were never computed fail closed against a ceilinged grant. This is the unknown-is-not-a-value rule in its sharpest form: "no provenance" must not read as "no taint";
• several ceilings compose to the strictest, so adding a permissive caveat cannot widen a strict one;
• a flow denial debits nothing — a tainted call costs zero joules;
• a ceiling-free grant (every grant minted before flow existed) behaves identically whatever the facts say, and carries no flow field on the wire.

Falsification — against the implementation, not the check

The only direction that means anything for a conformance clause. Four mutations of flow_gate and ceiling_of:

mutation	result
the grant ceiling is not enforced	C25 FAILED — "a label above the grant's ceiling was allowed"
the taint floor is not applied	C25 FAILED — "the resource's taint floor was not applied under a permissive ceiling"
uncomputed provenance fails open	C25 FAILED — "a ceilinged grant allowed a call whose provenance was never computed"
ceilings compose to the most permissive	C25 FAILED — "a permissive ceiling widened a strict one instead of composing to the strictest"

All four caught, each with its own message, so the clause discriminates between the properties rather than failing generically. (Learned from C26 in #352: mutating the check only makes it vacuous, and a vacuous check passes.)

The other direction, too

The harness has carried a C19 (injection resistance) that §9 never listed. §9 now lists it. The spec's classes and the harness's checks are both C1–C26 and agree item for item.

One correction worth recording

I first wrote this as C27, taking the next free id. That was wrong: §9 had already assigned C25 to flow, and implementing a different id would have recreated the asymmetry this PR exists to close. The branch name still says c27; the clause does not.

Verification

• cargo check --workspace --all-targets --locked (jcp-rs) — exit 0
• cargo test --workspace --locked — exit 0, 64 test binaries green, no failures
• cargo clippy -p jcp-conformance --all-targets --no-deps --locked -- -D warnings — 0 findings
• check-spec-refs 1676 citations / 16 standards · check-tests-in-ci clean · check-lockfiles 42 current · check-comparative-prose clean

🤖 Generated with Claude Code

§9 has listed **`C25 — flow`** as a conformance clause for as long as the clause existed, and the harness never had it. That is worse than a missing test: it is a published list of conformance classes claiming a class the pack cannot run. ## Verified before writing anything A declared gap is not evidence of one, so I checked: - the harness's **only** occurrence of "flow" was an unrelated `// control flow` comment; - `jcp-flow` is not even a **dependency** of `jcp-conformance`, so no check could have used it; - and `jcp-flow` is the wrong crate anyway — it is provenance *scanning* (L17–L20, content windows). The clause is about the **decision**: a grant's ceiling, the enforcement point's taint floor, attenuation. That lives in `jcp_schema::flow` and `jcp-runtime`, both already dependencies, so the check needs **no new dependency**. ## What C25 asserts Each property the clause states, separately, so a failure names which one broke: - a label at or below the grant's ceiling passes; one above it does not; - the taint floor binds **even under a ceiling permissive enough to admit the value** — an operator refusal a delegated grant cannot widen; - facts that were never computed **fail closed** against a ceilinged grant. This is the unknown-is-not-a-value rule in its sharpest form: *"no provenance" must not read as "no taint"*; - several ceilings compose to the **strictest**, so adding a permissive caveat cannot widen a strict one; - a flow denial debits nothing — a tainted call costs zero joules; - a ceiling-free grant (every grant minted before flow existed) behaves identically whatever the facts say, and carries no flow field on the wire. ## Falsification — against the implementation, not the check The only direction that means anything for a conformance clause. Four mutations of `flow_gate` and `ceiling_of`: | mutation | result | |---|---| | the grant ceiling is not enforced | **C25 FAILED** — "a label above the grant's ceiling was allowed" | | the taint floor is not applied | **C25 FAILED** — "the resource's taint floor was not applied under a permissive ceiling" | | uncomputed provenance fails **open** | **C25 FAILED** — "a ceilinged grant allowed a call whose provenance was never computed" | | ceilings compose to the most permissive | **C25 FAILED** — "a permissive ceiling widened a strict one instead of composing to the strictest" | All four caught, **each with its own message**, so the clause discriminates between the properties rather than failing generically. (Learned from C26 in #352: mutating the *check* only makes it vacuous, and a vacuous check passes.) ## The other direction, too The harness has carried a **`C19`** (injection resistance) that §9 never listed. §9 now lists it. The spec's classes and the harness's checks are both **C1–C26** and agree item for item. ## One correction worth recording I first wrote this as `C27`, taking the next free id. That was wrong: §9 had **already assigned `C25`** to flow, and implementing a different id would have recreated the asymmetry this PR exists to close. The branch name still says `c27`; the clause does not. ## Verification - `cargo check --workspace --all-targets --locked` (`jcp-rs`) — exit **0** - `cargo test --workspace --locked` — exit **0**, **64** test binaries green, no failures - `cargo clippy -p jcp-conformance --all-targets --no-deps --locked -- -D warnings` — **0** findings - `check-spec-refs` 1676 citations / 16 standards · `check-tests-in-ci` clean · `check-lockfiles` 42 current · `check-comparative-prose` clean 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dcharlot added 1 commit 2026-10-20 08:42:22 -04:00

jcp: C25 — flow was a declared clause with no check; now it has one ... 6423d5d892

§9 has listed `C25 — flow` as a conformance clause for as long as the clause
existed, and the harness never had it. Worse than a missing test: a published
list of conformance classes claiming a class the pack cannot run.

Verified before writing anything, because a declared gap is not evidence of
one:

- the harness's only occurrence of "flow" was an unrelated `// control flow`
  comment;
- `jcp-flow` is not even a dependency of `jcp-conformance`, so no check could
  have used it;
- and `jcp-flow` is the wrong crate anyway — it is provenance *scanning*
  (L17–L20, content windows). The clause is about the *decision*: a grant's
  ceiling, the enforcement point's taint floor, attenuation. That lives in
  `jcp_schema::flow` and `jcp-runtime`, both already dependencies, so the check
  needs no new one.

`C25` asserts each property the clause states, separately, so a failure names
which one broke:

- a label at or below the grant's ceiling passes and one above it does not;
- the enforcement point's taint floor binds **even under a ceiling permissive
  enough to admit the value** — an operator refusal a delegated grant cannot
  widen;
- facts that were never computed **fail closed** against a ceilinged grant.
  This is the unknown-is-not-a-value rule in its sharpest form: "no provenance"
  must not read as "no taint";
- several ceilings compose to the strictest, so adding a permissive caveat
  cannot widen a strict one;
- a flow denial debits nothing, so a tainted call costs zero joules;
- a ceiling-free grant — which is every grant minted before flow existed —
  behaves identically whatever the facts say and carries no flow field on the
  wire.

Falsified against the implementation rather than the check, which is the only
direction that means anything for a conformance clause: four mutations of
`flow_gate` and `ceiling_of` (ceiling unenforced, floor unapplied, uncomputed
provenance failing **open**, ceilings composing to the most permissive). All
four caught, each with its own message, so the clause discriminates between the
properties instead of failing generically.

Also fixes the asymmetry in the other direction: the harness has carried a
`C19` (injection resistance) that §9 never listed, so §9 now lists it. The
spec's classes and the harness's checks are both C1–C26 and agree item for
item.

I first wrote this as `C27`, taking the next free id. That was wrong — §9 had
already assigned `C25` to flow, and implementing a different id would have
recreated the asymmetry this closes.

Co-Authored-By: Claude Opus 5 <[email protected]>

dcharlot merged commit 1d3005cd6f into main 2026-10-20 13:06:03 -04:00

dcharlot referenced this pull request from a commit 2026-10-20 13:06:04 -04:00

Merge pull request 'jcp: C25 — flow was a declared clause with no check; now it has one' (#357) from feat/c27-flow-conformance into main

dcharlot referenced this pull request 2026-10-20 13:51:58 -04:00

joule-code-conformance: the header undersold the harness by a whole suite #367

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Transaction-Science/open-standards!357

No description provided.