Transaction-Science/open-standards
Watch
1
0
Fork
You've already forked open-standards
 0
Code Issues Pull requests Projects Releases 17 Packages Wiki Activity Actions 232

joule-code: close the two gaps its conformance gate cannot see #97

Closed
dcharlot wants to merge 1 commit from ci/joule-code-pack into main
pull from: ci/joule-code-pack
merge into: Transaction-Science:main
Conversation 0 Commits 1 Files changed 2 +164 -2

2026-09-19

Transaction Science
joule-code: close the two gaps its conformance gate cannot see
All checks were successful
standards workspaces build + test / jouleclaw-rs (pull_request) Successful in 1m29s
Details
standards workspaces build + test / aac-rs (pull_request) Successful in 31s
Details
standards workspaces build + test / joule-code-rs (pull_request) Successful in 33s
Details
standards workspaces build + test / joulecontract-rs (pull_request) Successful in 32s
Details
standards workspaces build + test / map-rs (pull_request) Successful in 28s
Details
standards workspaces build + test / mesh-rs (pull_request) Successful in 22s
Details
standards workspaces build + test / openpay (pull_request) Successful in 1m15s
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Successful in 1m30s
Details
standards workspaces build + test / eoc-rs (pull_request) Successful in 1m49s
Details
standards workspaces build + test / arl-rs (pull_request) Successful in 2m3s
Details
standards workspaces build + test / jcp-rs (pull_request) Successful in 1m19s
Details
standards workspaces build + test / joule-ui-rs (pull_request) Successful in 1m56s
Details
standards workspaces build + test / proof-rs (pull_request) Successful in 1m13s
Details
standards workspaces build + test / jouledesk-rs (pull_request) Successful in 2m4s
Details
standards workspaces build + test / sandbox-rs (pull_request) Successful in 2m8s
Details
standards workspaces build + test / joulehook-rs (pull_request) Successful in 1m57s
Details
standards workspaces build + test / smart-byte-rs (pull_request) Successful in 2m30s
Details
standards workspaces build + test / sense-rs (pull_request) Successful in 1m59s
Details 
`joule-code-conformance` ships a complete pack verifier — `verify_pack` reads
all six files of `joule-code/conformance/v1`, recomputes every derived field
(each `op_id` is BLAKE3 over canonical CBOR of its `CodingOp`, each binding and
receipt signature a real Ed25519 signature over the spec's preimage) and returns
a FAIL count that `main()` turns into a non-zero exit. A dedicated workflow,
`joule-code-conformance.yml`, already runs it. The pack is not unchecked, and
this commit is not what makes it checked.

It closes the two gaps that gate cannot see.

**It cannot distinguish a verified pack from a skipped one.** The gate is
`grep -Eq '0 failed'` over the summary line, and `verify_pack` is documented to
let SKIPs pass. So `0 passed, 0 failed, 24 skipped` satisfies that grep exactly
as well as `24 passed, 0 failed, 0 skipped` — verified by running the three
summary strings through the gate's own expression. A pack that shrank to one
vector passes it too. This pins the count and requires `skip == 0`, which is
the distinction the grep cannot draw. The count is pinned rather than bounded
because `>= 24` would let a case be deleted as long as another was added.

**It is `paths:`-filtered to `joule-code/**`, and this crate reaches outside
it.** `joule-code-conformance` depends on `jcp-schema`, `jcp-grant` and
`jcp-receipt` by relative path across workspaces, and `joule-code-joulecontract`
on `joulecontract-schema`. A change in `jcp` to canonical CBOR or the receipt
preimage would change the `op_id`s and signatures this pack pins, and would not
touch `joule-code/**` — so that workflow would not run. `standards-build.yml`
carries a deliberate "NO `paths:` filter" and runs `cargo test --workspace`,
confirmed by running that exact command rather than reasoning about it.

The second test is the load-bearing one. A verifier reporting PASS on a pack it
never read is worse than none, because it manufactures confidence — a tampered
copy of `map`'s pack once still reported 15/15. So the tamper case does not
trust the report: it flips one hex digit of a signature in a scratch copy and
requires the verifier to notice. The offset is found by scanning to the value's
opening quote, since the pack is column-aligned and the run of spaces is not
something a test should depend on.

Falsified, each assertion separately: corrupting a published signature fails
the verify test; claiming 25 vectors fails the count; neutering the flip to a
no-op fails the tamper test with "the verifier is not checking what it
publishes". The pack was restored afterwards and is byte-identical to main.

One honest limit: I could not force a SKIP to confirm that assertion fires, so
unlike the other three it is reasoned rather than falsified.

Corrects the workflow comment claiming nothing in CI validates the published
`conformance/v1` files on disk. That stopped being true with the `tests/pack.rs`
suites, and a missing `conformance:` key is not evidence a pack is unchecked —
`joule-code` and `sandbox` are both covered without one.

Co-Authored-By: Claude Opus 5 <[email protected]>
b8006b9b00
2026-09-19 05:24:01 -04:00