joulespec: a bullet whose label could not be read was corrupting the obligation above it #568

Merged

dcharlot merged 1 commit from joulespec/applied into main 2026-11-02 03:37:24 -05:00

Conversation 0 Commits 1 Files changed 3 +183 -16

dcharlot commented 2026-11-02 03:30:56 -05:00

Owner

Copy link

Pointing the extractor at this family's other specifications — documents written without this producer in mind — found a soundness bug in the producer and a gap in a sibling standard.

The bug

A list item carrying a bold label the splitter could not read was classified as body and appended to whichever item was open. On a sibling specification a - **C-neg:** bullet ended up inside C5's text:

C5  ... a wrong steward fails. - **C-neg:** provenance coupling is enforced; ...

So C5's obligation address covered words belonging to a different clause. An obligation that says something nobody wrote is the one failure this standard cannot tolerate, because every grade beneath it is then about the wrong sentence.

Three changes, and their ordering matters:

• the splitter accepts the separators that appear in practice, and a bold segment carrying only a label — **C-neg:** — is an item whose name is empty, addressed over its body alone rather than over a separator nobody wrote;
• a bare segment counts as a label only when it carries no whitespace, so a bolded sentence leading an ordinary list is still not an item. That rule already existed via the em dash, and dropping it would have invented obligations out of prose — the core's own label validation refuses whitespace for the same reason, so this is that rule read one step earlier;
• an item-shaped line that still cannot be read fails closed instead of becoming body — but only where an item is open, since that is the only case where folding corrupts anything. With nothing open there is nothing to append to, and a section of ordinary prose should report that it holds no items of the declared shape rather than name one of its sentences malformed.

The pinned obligation address for the default shape is unchanged, which is what makes the first two safe to land.

joulespec clauses

Shows what the extractor reads out of a document and the obligation address each item would carry. Authoring a manifest starts by agreeing with the producer about what the clauses are; without this an operator discovers a mis-declared shape through an item count, which says nothing about which items were missed.

What the survey showed

Across this family's specifications, the bulleted shape reads their conformance lists and the heading shape reads a normative companion kept as one section per obligation. What does not read is reported rather than returned empty: a conformance section written as a table of profiles, or as numbered prose with no labels, says it holds no items of the declared shape.

The gap — reported, not fixed here

sandbox/SPEC.md §10 enumerates C12 (locality evidence, §7.7) among its test obligations. The normative companion it points at, sandbox/spec/conformance.md, defines C1 through C11 and C13 — with no C12 anywhere. Nothing could ever have evidenced it. Left for that standard's owner rather than changed from here.

Verification

On the build host, all under --locked:

cargo clippy --workspace --all-targets -D warnings    zero warnings
cargo test --workspace                                50 + 85 + 2 + 2 passed, 0 failed
pinned default-shape obligation                       unchanged

🤖 Generated with Claude Code

Pointing the extractor at this family's **other** specifications — documents written without this producer in mind — found a soundness bug in the producer and a gap in a sibling standard. ## The bug A list item carrying a bold label the splitter could not read was classified as *body* and appended to whichever item was open. On a sibling specification a `- **C-neg:**` bullet ended up inside C5's text: ``` C5 ... a wrong steward fails. - **C-neg:** provenance coupling is enforced; ... ``` So C5's obligation address covered words belonging to a different clause. An obligation that says something nobody wrote is the one failure this standard cannot tolerate, because every grade beneath it is then about the wrong sentence. Three changes, and their ordering matters: - the splitter accepts the separators that appear in practice, and a bold segment carrying **only** a label — `**C-neg:**` — is an item whose name is empty, addressed over its body alone rather than over a separator nobody wrote; - a bare segment counts as a label only when it carries **no whitespace**, so a bolded *sentence* leading an ordinary list is still not an item. That rule already existed via the em dash, and dropping it would have invented obligations out of prose — the core's own label validation refuses whitespace for the same reason, so this is that rule read one step earlier; - an item-shaped line that still cannot be read **fails closed** instead of becoming body — but only where an item is open, since that is the only case where folding corrupts anything. With nothing open there is nothing to append to, and a section of ordinary prose should report that it holds no items of the declared shape rather than name one of its sentences malformed. **The pinned obligation address for the default shape is unchanged**, which is what makes the first two safe to land. ## `joulespec clauses` Shows what the extractor reads out of a document and the obligation address each item would carry. Authoring a manifest starts by agreeing with the producer about what the clauses *are*; without this an operator discovers a mis-declared shape through an item count, which says nothing about which items were missed. ## What the survey showed Across this family's specifications, the bulleted shape reads their conformance lists and the heading shape reads a normative companion kept as one section per obligation. What does not read is **reported rather than returned empty**: a conformance section written as a table of profiles, or as numbered prose with no labels, says it holds no items of the declared shape. ## The gap — reported, not fixed here `sandbox/SPEC.md` §10 enumerates **C12** (locality evidence, §7.7) among its test obligations. The normative companion it points at, `sandbox/spec/conformance.md`, defines C1 through C11 and C13 — with no C12 anywhere. Nothing could ever have evidenced it. Left for that standard's owner rather than changed from here. ## Verification On the build host, all under `--locked`: ``` cargo clippy --workspace --all-targets -D warnings zero warnings cargo test --workspace 50 + 85 + 2 + 2 passed, 0 failed pinned default-shape obligation unchanged ``` 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dcharlot added 1 commit 2026-11-02 03:30:56 -05:00

joulespec: a bullet whose label could not be read was corrupting the obligation above it ... a62092ecef

Pointing the extractor at this family's other specifications — documents
written without this producer in mind — found a soundness bug in the producer
and a gap in a sibling standard.

The bug: a list item carrying a bold label the splitter could not read was
classified as *body* and appended to whichever item was open. On one sibling
specification a `- **C-neg:**` bullet ended up inside C5's text, so C5's
obligation address covered words belonging to a different clause. An
obligation that says something nobody wrote is the one failure this standard
cannot tolerate, because every grade below it is then about the wrong
sentence.

Three changes, and the ordering of them matters:

- the splitter accepts the separators that appear in practice, and a bold
  segment carrying only a label — `**C-neg:**` — is an item whose name is
  empty, addressed over its body alone rather than over a separator nobody
  wrote;
- a bare segment counts as a label only when it carries no whitespace, so a
  bolded *sentence* leading an ordinary list is still not an item. That rule
  already existed for the em dash and dropping it would have invented
  obligations out of prose; the core's own label validation refuses whitespace
  for the same reason, so this is that rule read one step earlier;
- an item-shaped line that still cannot be read fails closed instead of
  becoming body — but only where an item is open, since that is the only case
  where folding corrupts anything. With nothing open there is nothing to
  append to, and a section of ordinary prose should report that it holds no
  items of the declared shape rather than name one of its sentences as
  malformed.

The pinned obligation address for the default shape is unchanged, which is
what makes the first two safe to land.

New `joulespec clauses` subcommand: show what the extractor reads out of a
document and the obligation address each item would carry. Authoring a
manifest starts by agreeing with the producer about what the clauses *are*,
and without this an operator discovers a mis-declared shape through an item
count, which says nothing about which items were missed.

The gap, reported and not fixed here because it belongs to another standard:
`sandbox/SPEC.md` §10 enumerates C12 (locality evidence, §7.7) among its test
obligations, and the normative companion it points at defines C1 through C11
and C13 with no C12 anywhere. Nothing could ever have evidenced it.

Co-Authored-By: Claude Opus 5 <[email protected]>

dcharlot merged commit 9085634a67 into main 2026-11-02 03:37:24 -05:00

dcharlot referenced this pull request from a commit 2026-11-02 03:37:26 -05:00

Merge pull request 'joulespec: a bullet whose label could not be read was corrupting the obligation above it' (#568) from joulespec/applied into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Transaction-Science/open-standards!568

No description provided.