# Transaction Science Open Standards

This repository houses the open reference standards stewarded by [Transaction Science](https://transaction.science). Each is published as a separate top-level directory with its own README, its own licence file, and its own status.

The wire format and the right to fork are public. Transaction Science writes the reference implementation and runs the optional hosted services — the protocols themselves are owned by no one.

## The standards

### [openpay/](openpay/) — Payment acceptance without the SaaS tax

A reference payment-acceptance stack in Rust. Card, account-to-account (FedNow, PIX, SEPA Instant), and stablecoin rails behind one orchestrator; typestate-enforced payment lifecycle; append-only double-entry ledger with bi-temporal time-travel. One core compiles to iOS, Android, browser, and Linux. PAN never crosses a non-vault boundary.

- **Site:** [openpay.transaction.science](https://openpay.transaction.science) · [spec](https://openpay.transaction.science/spec)
- **Licence:** Apache-2.0 (see [`openpay/LICENSE`](openpay/LICENSE))
- **Status:** v0.1.0 reference. `cargo test --workspace` is 1124 passing, 0 failing; `cargo clippy --workspace --all-targets` is zero warnings. Not certified by a card scheme, not audited by a PCI QSA, not run in regulated production.

### [smart-byte/](smart-byte/) — A carrier for value

A content-addressed, signed envelope that carries any cargo with provenance and energy cost intrinsic, replicated by deterministic lockstep, owned by no one. TCP/IP for value: settlement-agnostic, energy-attributed, with no off switch.

- **Site:** [byte.transaction.science](https://byte.transaction.science)
- **Licence:** CC-BY-4.0 (see [`smart-byte/LICENSE`](smart-byte/LICENSE))
- **Status:** Reference protocol. Treatise + conformance specification published; reference implementation pending.

### [eoc/](eoc/) — AI that costs joules, not tokens

Energy-optimised compute: every query resolves through a four-stage pipeline — cache, key-value, graph, neural — and only invokes a neural model when nothing cheaper can. The substrate runs in a browser, on commodity CPUs, and cannot be turned off because no single entity runs it.

- **Site:** [eoc.transaction.science](https://eoc.transaction.science)
- **Licence:** CC-BY-4.0 (see [`eoc/LICENSE`](eoc/LICENSE))
- **Status:** Reference protocol. Specification suite published across `spec/`; reference implementation pending.

### [wai/](wai/) — Web AI Media Transport & Execution

A container + capability-dispatch standard for media. WAI does not re-implement codecs; it dispatches to SOTA standard libraries (PNG, FLAC, zstd as the mandatory floor; AVIF, JPEG-XL, Opus, AV1, XZ as the recommended modern set) and adds an envelope that lets a neural-shared-prior path coexist with the model-free floor. Two paths open every conforming file: the **neural condition** (sink regenerates from a shared ambient prior) and the **zeroth condition** (registered SOTA codec menu). The capability a file requires is named, not supplied.

- **Site:** [wai.transaction.science](https://wai.transaction.science)
- **Licence:** Apache-2.0 (see [`wai/LICENSE`](wai/LICENSE))
- **Status:** v1.0 draft standard. `wai-rs/` reference implementation (Rust lib + cdylib + staticlib, C FFI) round-trips every registered capability through the full envelope. Known consumer: CommunicationOS.

### [jouleclaw/](jouleclaw/) — Energy-optimised AI runtime

A pure-Rust, omni-modal AI runtime that dispatches every operation through an energy-tiered cascade — `L0:Cache` (picojoules) → `L1:Lawful` (nanojoules, deterministic primitives) → `L2:Embed` (sub-millijoules, Matryoshka embeddings + hybrid search) → `L3:Model` (joules, local SSM / ternary / multimodal / diffusion) → `L4:Wire` (tens of joules, remote frontier as the escape hatch). Inference is the **last resort**, not the entry point. Frozen weights are less trustworthy than fresh, provenance-stamped retrieval. Every operation is metered in microjoules where the hardware permits, with an honest `Provenance` tag (`HwShunt | ModelBased | Estimator`) on every reading so the spec never claims accuracy the platform can't deliver. Omni-modal: text, code, vision, audio, video, image diffusion, 3D Gaussian splatting, and cross-modal fusion all dispatch through the same cascade.

- **Site:** [jouleclaw.transaction.science](https://jouleclaw.transaction.science)
- **Licence:** Apache-2.0 (see [`jouleclaw/LICENSE`](jouleclaw/LICENSE))
- **Status:** v0.1.0 reference implementation in active development.

### [arl/](arl/) — AI Readiness Level

A universal, vendor-neutral standard for measuring the readiness of an AI system to perform a defined task in a defined context — what the Technology Readiness Level scale is to technology. Tied to no model, runtime, or vendor. Every score has four required parts, each anchored in math or physics that does not move: validation depth (1–9, statistics), convergence class (A–E, stochastic process theory), energy profile (joules, thermodynamics), and security class (S0–S4, information theory and cryptography). Cross-axis gates make a high readiness claim unreachable without matching convergence and security, and energy non-disclosure caps the score. The companion ARL Sandbox (ARL-S) specifies the measurement environment.

- **Site:** [arl.transaction.science](https://arl.transaction.science)
- **Licence:** CC-BY-4.0 (see [`arl/LICENSE`](arl/LICENSE)); forthcoming reference implementation Apache-2.0.
- **Status:** Document stack v1.3 (May 2026). Specification published (`ARL.md`, `ARL-S.md`, `LEXICON.md`), with `RATIONALE.md` covering the trends and reasoning behind it; standalone reference impl in `arl-rs/` — `arl-core` (four-axis claim model + cross-axis gates + lexicon enforcement) `arl-sandbox` (ARL-S session model + tier/telemetry gates + Ed25519-over-JCS + SHA-256 attestation + a trait-based Supervisor), `arl-cli` (the `arl` reference checker — validate / lint / verify / explain, CI-ready exit codes), and `arl-wasm` (the same gates compiled to WASM for an in-browser playground). Covered by a test suite; no runtime coupling.

### [joule-code/](joule-code/) — A carrier for coding work

The coding cargo class of the substrate. A coding operation — an edit, a refactor, a generated function — is a content-addressed, signed transition over a source tree, with its energy cost intrinsic. Every request resolves through an explicit energy-tiered cascade (`L0:Cache → L1:Lawful → L2:Embed → L3:Model → L4:Wire`) and stops at the first tier that closes it; inference is the escape hatch, not the entry point. The agent schema is JouleClaw; remote frontier agents (Claude Code, Gemini, Codex) are the L4 tier, reached over the Agent Client Protocol with the credential held by the vendor's own client — the protocol carries no token and a conforming endpoint performs its core function without contacting any single company. Every operation emits a signed JCR-1 receipt (the family's canonical det-CBOR + COSE_Sign1 format): a two-part `measured + estimated` energy cost with an honest provenance tag.

- **Site:** [joulecode.transaction.science](https://joulecode.transaction.science)
- **Licence:** Apache-2.0 for reference code (see [`joule-code/LICENSE`](joule-code/LICENSE)); CC-BY-4.0 for specification text (see [`joule-code/LICENSE-SPEC`](joule-code/LICENSE-SPEC)).
- **Status:** v0.2.0 draft. Specification core published (`SPEC.md` + `spec/`); reference library in `joule-code-rs/` (`joule-code-schema`, `-cargo`, `-receipt`, `-cascade`, `-conformance`) with the C1–C4 conformance harness (vectors are real cryptographic values; the harness passes the pack with no skips). Receipts seal as JCR-1 envelopes, interoperable with the family's existing JCR-1 verifiers. Single-endpoint operation is the current surface; the federated-collaboration binding is specified at interface level and classified Research. The flagship consumer is a hard fork of the Zed editor that drives logged-in vendor agents over ACP and meters every turn.

### [sandbox/](sandbox/) — A sandbox for the heterogeneous compute fabric

An isolated-execution substrate where the unit of isolation is not a CPU process but a **heterogeneous unit of work** across the whole fabric — CPU, GPU, NPU, TPU, photonic, quantum. Every run carries four guarantees: it runs at the lowest rung of an eight-tier isolation ladder (`S0:Bare → S7:Sovereign`) that its capabilities require; every resource it touches — each accelerator device class included — is explicitly granted, deny-by-default; it emits a signed energy receipt with **per-device-class joule attribution** and an honest provenance tag; and it emits an attestation of what image ran, at what tier, under what grants, on what hardware, for what cost. The accelerator is a first-class capability, a first-class metered resource, and a first-class attested line item — not an opaque passthrough.

- **Site:** [sandbox.transaction.science](https://sandbox.transaction.science)
- **Licence:** Apache-2.0 for reference code (see [`sandbox/LICENSE`](sandbox/LICENSE)); CC-BY-4.0 for specification text (see [`sandbox/LICENSE-SPEC`](sandbox/LICENSE-SPEC)).
- **Status:** v0.1.0 draft. Specification core published (`SPEC.md` + `spec/`); reference library in `sandbox-rs/` (`sandbox-schema`, `-capability`, `-meter`, `-attest`, `-runtime`, `-tee`, `-exec-wasm`, `-exec-microvm`, `-conformance`, `-proof`, `-cli`) with the C1–C5 + C-neg + C-tee conformance harness (in-code + file-backed vectors via `gen_vectors`). Real tier executors ship across the ladder: a wasmtime S2 executor (runs untrusted WASM, brokers capabilities, meters fuel→joules), a Firecracker S5 executor (boots a microVM, meters CPU and an assigned accelerator separately), and the S6/S7 confidential + sovereign path (verified SEV-SNP TEE evidence via real ECDSA-P384, locality binding, hash-chained audit log). Energy receipts seal as **JCR-1** envelopes (shared with the family); attestations sign Ed25519 over JCS, interoperable with the ARL Sandbox. The one hardware-bound piece — *generating* a genuine vendor-signed TEE report — uses the Linux `configfs-tsm` interface on real confidential hardware; verification is implemented and vectored.

### [map/](map/) — A carrier for place

The geospatial cargo class of the substrate. A region of the world — at a position, an altitude, an instant, and a fidelity — is a content-addressed, signed **tile** with its energy cost intrinsic, addressed by a 4D **cell key** (S2 cell + altitude band + *time bucket* + LOD). Tiles pack into a single range-requestable **tileset** on dumb storage — Hilbert-ordered so a viewport is a near-contiguous byte range, with no server and no per-request billing — under a signed manifest whose **revisions** are append-only, dated transitions (a new forecast hour, a new AIRAC cycle), so a published map works forever. Render requests resolve through an energy-tiered fidelity cascade — `F0:Cache → F1:Base → F2:Field → F3:Feature → F4:Photoreal` — returning the highest tier at or below the request that holds data and **falling back to the F1 base floor, which is defined everywhere**: graceful fallback is a property of the standard, not of an implementation. Every resolve emits a signed JCR-1 receipt (`measured + estimated` microjoules with an honest provenance tag). The temporal axis is first-class — what 3D Tiles lacks and what weather and flight navigation require.

- **Site:** [maps.transaction.science](https://maps.transaction.science) — a `wgpu` globe demonstrating the standard end to end.
- **Licence:** Apache-2.0 for reference code (see [`map/LICENSE`](map/LICENSE)); CC-BY-4.0 for specification text (see [`map/LICENSE-SPEC`](map/LICENSE-SPEC)).
- **Status:** v0.1.0 draft. Specification core published (`SPEC.md` + `spec/`); reference workspace `map-rs/` — `map-schema` (4D cell key, content addressing, tile, Hilbert directory + range planner, signed manifest + revision chain), `map-cascade` (F0–F4 resolver with guaranteed F1 fallback), `map-receipt` (JCR-1 sealing, byte-compatible with the family verifiers), `map-conformance` (C1–C5 + negative pack, all checks real, published vectors in `conformance/v1/`), and `map-index` (pure-Rust S2 geometry ported from `joule-s2` — with its broken polygon containment/area corrected — plus the `volume` 4D scheme from `joule-spatial3d`: logarithmic altitude bands + time tiers, and a bridge that covers a region or a region × altitude × time volume into the directory's cell keys), and `map-tiles` (the `Tile`-cargo codecs ported from `joule-tiles` — MVT vector (encode **and** decode), raster PNG/WebP, terrain quantized-mesh, 3D Tiles (encode + b3dm/glTF decode), an SPZ-style splat codec, and INRIA .ply ingest (F4) — each bridged to a content-addressed tile at its cascade tier), `map-orbital` (TLE + SGP4/SDP4 propagation from `joule-orbital`, with a bridge mapping a satellite sub-point to a `CellKey` for the F3 live-satellite layer), and `map-route` (local geocode/routing/geofencing over a tileset from `joule-maps`, plus a feed-agnostic `Feed`/`Entity` adapter that resolves any source — flights, vessels, satellites, CVEs, incidents, enterprise signals — to a `CellKey`). The substrate port is complete; `cargo test` green, `cargo clippy --all-targets` zero warnings. The demonstrator ([maps.transaction.science](https://maps.transaction.science)) is a `wgpu` globe (write-once native + WASM) that consumes the standard end to end — cascade-resolved basemap (`F2`), MVT-decoded feature lines (`F3`), and cell-addressed feed entities — with `map-receipt` metering. Not certified for primary navigation (SPEC §9).

### [aac/](aac/) — A carrier for voice

The communication cargo class of the substrate. A **board** — a non-speaking person's communication surface and every bit of customization invested in it — is a content-addressed, portable file: cells placed once and **locked** so muscle memory is never invalidated, symbols referenced by source and id rather than baked-in pixels, the access method and its timing carried with the user, language as a graph edge so a bilingual user code-switches by traversal, and a two-part joule cost on every operation that is shown for transparency and **never** billed. Communication resolves through a ten-level energy-tiered cascade — `L0:Cache → L1:Symbol → L2:LocalPredict → … → L9:AdaptiveModel` — where **exactly** L0–L2 are offline and carry the overwhelming majority of utterances, so a network drop never silences anyone, and every level is free at the protocol layer. The board exports to a canonical interchange form and **ingests** the open board format and community exports, so a user brings their existing boards in and takes everything with them when they leave — augmentative & alternative communication as a file, not a subscription.

- **Site:** [aac.transaction.science](https://aac.transaction.science)
- **Licence:** Apache-2.0 for reference code (see [`aac/LICENSE`](aac/LICENSE)); CC-BY-4.0 for specification text (see [`aac/LICENSE-SPEC`](aac/LICENSE-SPEC)).
- **Status:** v0.1.0 draft. Specification core published (`SPEC.md`); reference workspace `aac-rs/` — `aac-core` (the engine: boards, symbols, vocabulary, motor planning, switch scanning, dwell/eye-gaze, prediction, context, multilingual, accessibility, partner tools, analytics, the L0–L9 cascade router, the store, interchange import/export), `aac-web` (a free offline-first reference app on Leptos), and `aac-conformance` (C1–C4: cascade routing, energy monotonicity, the offline invariant, wire round-trips — all checks real, published vectors in `conformance/v1/`). `cargo test` green, `cargo clippy --all-targets` zero warnings on the engine and harness. Not a medical device; not certified as a speech-generating device for funding (SPEC §11).

### [proof/](proof/) — A carrier for verified work

The verification cargo class of the substrate. A **proof obligation** is a content-addressed `{statement, context, kind, intent, grounding}`; a **solver** is anything that can attempt one at a declared tier; a discharged obligation seals as a signed **JCR-1 receipt** recording which tier closed it and the joules it cost. The standard fixes the one axis the theorem-proving field leaves implicit — *joules per verified proof* — and makes it portable. The cheapest sufficient solver wins: every obligation goes to the cheapest rung that can discharge it — deterministic automation (`T0`) → SMT (`T1`) → a small distilled prover (`T2`) → a frontier model (`T3`, last resort) — and escalates only on failure. **Correctness is the verifier's, never the optimizer's:** a solver returns `proved` only when a verifier would accept the artifact, so the standard changes *which tier pays*, not whether a proof is checked; the joules a cheaper solver spent before failing are **disclosed** (`wasted_uj`), never hidden. Energy carries an honest provenance tag (`HwShunt`/`ModelBased`/`Estimator`), the per-tier breakdown keeps Amdahl behaviour visible, and a receipt for an `Ungrounded` statement says, in the signed artifact itself, that the statement was never validated against intent — *a proof is not a specification.*

- **Site:** [jouleproof.transaction.science](https://jouleproof.transaction.science) (the JouleProof pillar is the steward + services layer over this standard).
- **Licence:** Apache-2.0 for reference code (see [`proof/LICENSE`](proof/LICENSE)); CC-BY-4.0 for specification text (see [`proof/LICENSE-SPEC`](proof/LICENSE-SPEC)).
- **Status:** v0.1.0 draft. Specification core published (`SPEC.md` + `conformance/v1/`); reference workspace `proof-rs/` — `proof-schema` (content-addressed goal, the strictly-monotone tier ladder, the `HwShunt`/`ModelBased`/`Estimator` energy model with the coupling enforced, `SpecGrounding`, the `Solver` trait, canonical det-CBOR), `proof-solvers` (**two real rungs, measured energy**: an in-process propositional decider at `T0` and `z3` — shelled or kept **resident** across goals — at `T1`, each refusing rather than faking; `T2`/`T3` are honest stand-ins), `proof-cascade` (the escalation router with every joule accounted and `wasted_uj` disclosed, the content-addressed proof cache as the durable energy flywheel, and batch accounting against a frontier-only baseline), `proof-receipt` (the `proof/1` JCR-1 receipt — canonical det-CBOR + COSE_Sign1/EdDSA, byte-compatible with the family verifiers, refuses to seal an unproved goal), `proof-conformance` (C1–C5 + a negative pack, all checks real, published vectors in `conformance/v1/`), and `proof-cli` (the `proof` demo: joules-per-proof vs a frontier-only baseline, the Amdahl breakdown, the cache flywheel, a sealed + verified receipt). `cargo test --workspace` green, `cargo clippy --workspace --all-targets` zero warnings. The two bottom rungs decide for real; the model rungs are honestly marked as stand-ins until inference backends are wired.

### [jcp/](jcp/) — The Joule Context Protocol

The unified, energy-native, capability-secured protocol for agentic systems. Where today's stack splits across MCP (tool/context connection), A2A/ACP (agent-to-agent), an identity layer, and an authorization layer — and standardizes energy nowhere — JCP is one spec built on one object: **a capability and an energy budget are the same thing, a signed, bounded, debited *Grant*.** A capability you can't pay for is denied; an expenditure you're not capable of is denied — one check, made deterministically **outside the model**, sealed in a receipt. It answers the documented failure modes head-on: tool descriptions are untrusted input, so a tool's *output* can never take control (data ≠ control, defeating tool poisoning); prompts can't enforce access control and a more capable model only follows injected instructions *better*, so every action is decided by the runtime, not the LLM (the inverse-scaling-law result made model-side control unsound by construction); agent loops have no cost ceiling, so every grant carries a joule budget debited and enforced *before* the side effect; audit is a mutable span, so every decision — allow and deny — seals as a non-repudiable JCR-1 receipt. Delegation is object-capability **attenuation**: a child grant can only narrow, so a chain never conveys more authority or energy than its root. Every actor is a `did:key`; every resource is content-addressed (audience binding an attacker can't spoof by name).

- **Licence:** Apache-2.0 for reference code (see [`jcp/LICENSE`](jcp/LICENSE)); CC-BY-4.0 for specification text (see [`jcp/LICENSE-SPEC`](jcp/LICENSE-SPEC)).
- **Status:** v0.1.0 draft. Specification core published (`SPEC.md` + `conformance/v1/`); reference workspace `jcp-rs/` — `jcp-schema` (the `did:key` actor, the metered **Grant** = capability ⊗ joule budget content-addressed and signed, the **Frame** with its `control`/`data` trust tag, the family `Energy`/`Provenance` model, canonical det-CBOR), `jcp-grant` (issuance, signature verification, strictly-narrowing object-capability **attenuation** with delegation-depth control, hop-by-hop **chain verification**, issuer-only signed **revocation**, budget **sharding** for consensus-free distributed enforcement, and KERI-style pre-committed **key rotation**), `jcp-runtime` (the deterministic enforcer — one ordered check fusing untrusted-control, revocation, audience binding, signature, expiry, capability, and budget, decided outside any model, then debit; `decide_chained` enforces full delegation chains with the cost debited from every link, so sibling delegations share their root's budget), `jcp-receipt` (the `jcp/1` JCR-1 receipt, byte-compatible with the family verifiers; allow and deny both seal), `jcp-bridge` (a reference gateway wrapping existing MCP tool calls and A2A tasks in Grants and Frames — decided against the grant before the call reaches the endpoint, results framed as untrusted data — so an existing server keeps its transport while every call becomes capability-scoped and joule-budgeted), `jcp-energy` (the metering ladder — RAPL and optional NVML hardware counters when the platform exposes them, a time×calibrated-power model and a constant estimator when it doesn't, the provenance always honest), `jcp-wire` (the `jcp/1` wire binding — length-prefixed canonical det-CBOR over TCP/Unix/any byte stream; requests carry the full grant chain, responses the decision + sealed receipt), `jcp-threshold` (k-of-n FROST threshold actors — the two-agent rule: the group key is an ordinary did:key, so a 2-of-3 team signs wire requests with nothing else changing), `jcp-channel` (receipt-settled budget channels: optimistic multi-point spend settled by signed statements, bounded provable overdraft), `jcp-conformance` (C1–C18 + a negative pack, all checks real, published vectors in `conformance/v1/`), and `jcp-cli` (the `jcp` demo: one metered grant through an agent loop — legit calls debited, a poisoned tool-result refused structurally, out-of-scope action/resource denied, the budget stopping a runaway loop, a weaker delegated sub-grant, a verified receipt). `cargo test --workspace` green, `cargo clippy --workspace --all-targets` zero warnings. Consumed in-repo by JouleClaw (`jouleclaw-jcp`: MCP dispatch gated pre-call), Sandbox (`sandbox-jcp`: execution authorized against the image's content address before the executor runs), and Joule Code (`joule-code-jcp`: cascade stages decided per consultation — no grant, no L4).

### [joulecontract/](joulecontract/) — A carrier for obligation

Five clauses, one signed receipt, owned by no one. JouleContract is the **contract cargo class**: a content-addressed statement of what a unit of work must hold (`pre`, `post`, `inv`), what it may touch (`frame` — everything outside is implicitly invariant), and what it may spend (`ceiling`, a joule EnPI against a signed baseline) — the operand the rest of the family acts on. One receipt simultaneously evidences functional safety, energy management, and AI governance: three audit programs as three projections of one log. The doctrine is **inherit, don't invent — bind, don't name — seal, don't float**: every trust-bearing field (including the joule figure itself) binds to a key, a sealed attestation, or an independent timestamp, or serializes one of twenty-two demoted states; conformance seals once at discharge against a content-addressed evidence bundle, so re-verification is resolution-free (air-gapped capable) and receipts never rot; breach is deviation without a timely amendment, amendments govern the future only, and a withheld receipt gains nothing. Hardened by four published adversarial diff rounds — three against the spec text, the fourth against the reference implementation itself — whose findings folded back as traced amendments and repaired code, with a real, mechanically-verified digest chain.

- **Site:** [joulecontract.transaction.science](https://joulecontract.transaction.science) · [spec](joulecontract/SPEC.md) · [provenance](joulecontract/provenance/)
- **Licence:** Apache-2.0 for reference code (see [`joulecontract/LICENSE`](joulecontract/LICENSE)); CC-BY-4.0 for specification text (see [`joulecontract/LICENSE-SPEC`](joulecontract/LICENSE-SPEC)).
- **Status:** v0.8.0 draft. Specification published with its full amendment history (`archive/` byte-exact, seven anchors, digests verify against `SPEC.md` §16 mechanically on every test run); two-stage evaluation normative (receipt-local witnesses at most JR-2; JR-3+/certified are composed verdicts); reference workspace `joulecontract-rs/` — `joulecontract-schema` (the five-obligation core object, algorithm-prefixed content addressing over canonical JSON, the JCAP composed profile, the demoted-state vocabulary), `joulecontract-receipt` (one discharge entry per declared obligation or the receipt is malformed; independence computed from key disjointness over the *effective* generator key set, never copied from a producer flag; receipt-local validation honestly capped at JR-2 with JR-3/JR-4 and `certified` as composed verdicts over sealed evidence + key log + interval; the least-bound-axis gates and the §15-token claim-discipline rule), `joulecontract-seal` (content-addressed evidence bundles, Ed25519 envelopes, resolution-free offline re-verification, evidence-lost vs unresolvable), `joulecontract-amend` (sealed intervals, start-anchor governance — the withheld-receipt attack gains nothing — breach classification against a named covering amendment, the chronologically-evaluated office key log with forward-only revocation windows), `joulecontract-wire` (the recognized edge: the receipt as an in-toto Statement with the JouleContract predicate type, wrapped in DSSE with exact PAE), and `joulecontract-conformance` (the worked example through the composed path, the adversarial scenarios from all four diff rounds as tests, a regenerable vector pack, mechanical verification of the amendment digest chain); composition with per-component ceiling accountability, the per-EnB ratchet, recourse + sector-equivalence bindings, and cross-digest re-anchoring round out the surface — every §15 demoted state is producible. `cargo test --workspace` green, `cargo clippy --workspace --all-targets` zero warnings.

### [joule-os/](joule-os/) — An operating system that bills in joules

The **runtime** the rest of the substrate lowers onto — the UDA reference runtime realized on commodity hardware. One intent IR is specialized at boot against a control vector (address-space ownership, capability enforcement, persistence directness, dispatch reach), so the same program runs as a native app, in a browser, or on bare metal with the lowering chosen for the coordinate it lands on. State lives in a **single-level store** — the in-memory bytes ARE the durable bytes, every mutation wrapped in a transaction with an undo log so a power loss at any instruction boundary rolls back or commits, never tears. Every intent dispatches through a cost-ordered cascade of refine families (`Lawful` ~1 µJ → `DeterministicSm` → `LocalSearch` → `StateGraph` → `ConstrainedSearch` → `TinyRecursive` → `LlmInLoop` ~5 mJ) and stops at the cheapest that closes it; inference is the last resort, and `check` is deterministic, never an LLM-as-judge. A capability ledger unforgeable by construction (eight typed classes) gates every I/O path; a measured energy oracle (Apple Silicon AMU / Linux RAPL / estimator) tags every reading's provenance and pins work across eight non-fungible classes; receipts seal as JCR-1, shared with the family verifiers.

- **Site:** [jos.transaction.science](https://jos.transaction.science)
- **Licence:** Apache-2.0 for reference code (see [`joule-os/LICENSE`](joule-os/LICENSE)); CC-BY-4.0 for specification text once published.
- **Status:** v0.1 reference. The single-level-store cutover has landed; the capability ledger, the refine-family cascade, the measured energy oracle, and the AOT interpreter with an optional out-of-TCB Cranelift JIT tier are implemented across the native (winit + wgpu), PWA (wasm + WebGPU), and bare-metal (`x86_64-unknown-none`, `no_std`) surfaces. The conformance suite enforces the THEOREM v0.2 invariants I1–I20 and asserts **AOT ≡ JIT bit-for-bit** (`lowering_aot_jit.rs`). Not certified for production; the bare-metal surface is a development target, not a shipping OS.

### [mesh/](mesh/) — Energy-accounted inference serving & routing

The **serving + routing fabric**: the front door in front of many models and many backends. A request declares a **joule ceiling** and a **fidelity floor**; the mesh routes it to the cheapest-sufficient model on the cheapest-sufficient backend, serves it under an energy meter, and seals a receipt whose headline figure is **microjoules per accepted output token** — measured at the meter, not estimated from a price list. The serving shelf reports dollars-per-token and tokens-per-second; Mesh reports the one unit that is physical, comparable across hardware, and impossible to inflate. It rides on JCP (a serve request is authorised by a metered Grant; receipts seal in JCR-1), dispatches to runtimes such as JouleClaw, and routes across compute described by EOC and isolated by Sandbox — introducing no new cryptography. The route is auditable from the receipt alone: every backend weighed, with the reason each was kept (fidelity ≥ floor, estimate ≤ ceiling) or rejected, and the cheapest-sufficient choice recorded — so the deterministic/cached tier is preferred and a frontier model is the expensive last resort, priced in joules.

- **Licence:** Apache-2.0 for reference code (see [`mesh/LICENSE`](mesh/LICENSE)); CC-BY-4.0 for specification text (see [`mesh/LICENSE-SPEC`](mesh/LICENSE-SPEC)).
- **Status:** v0.1.0-draft.1. Specification core published (`SPEC.md` + `conformance/v1/`); reference workspace `mesh-rs/` — `mesh-schema` (the content-addressed `ServeRequest` carrying joule ceiling + fidelity floor, the ordered `F0–F4` fidelity scale, the two-part `HwShunt`/`ModelBased`/`Estimator` `Energy` model with the coupling enforced, the model-as-recipe, the `RouteDecision`/`RouteCandidate` audit and `ServeOutcome` counters), `mesh-router` (energy-weighted cheapest-sufficient routing — admissibility by fidelity floor **and** joule ceiling, cheapest admissible chosen, every candidate and its reject reason recorded), `mesh-engine` (the `ServingEngine` interface plus a deterministic, weights-free `ReferenceEngine`), `mesh-meter` (the meter window — an always-available load estimator plus an optional bridge to the family hardware meter (RAPL / NVML / Apple) behind `hw-meter`, provenance preserved across the bridge), `mesh-receipt` (the `mesh/1` JCR-1 receipt — canonical det-CBOR + COSE_Sign1/EdDSA, byte-compatible with the family verifiers, the wedge metric `uj_per_accepted_token` sealed in, refuses to seal a dishonest `HwShunt`, hash-chained log), `mesh-core` (the orchestration — authorise the JCP grant, route, meter around the engine, seal — `infer` decided outside the model), `mesh-conformance` (the deterministic reference serve, field-by-field checks, vectors in `conformance/v1/`), and `mesh-openai` (an OpenAI-compatible `/v1/chat/completions` ingest — any OpenAI client drives metered serving and gets the sealed receipt back in `usage.energy`) — plus `mesh-engine-gguf`, a **real** backend behind the `gguf` feature wrapping the family's pure-Rust GGUF/Metal inference substrate, kept out of the default build so it needs no weights. The input token payload travels with the serve call and is never sealed — the receipt records only the content-addressed `prompt_hash`. `cargo test --workspace` green, `cargo clippy --workspace --all-targets` zero warnings.
### [pool/](pool/) — Energy-accounted multi-tenant scheduling

The **entitlement layer** in front of a contended pool: who may start, on whose budget, and what gets reclaimed when capacity runs short. A cluster scheduler's quota is conventionally a device count, which is a proxy — the quantity paid for, drawn from a grid and reported under an energy-disclosure regime is energy, and a guarantee of "eight accelerators" cannot express "this team may spend 40 MJ this window". In `pool/1` an entitlement guarantees **microjoules and devices together**, and both bind. Three rules need that unit to state at all: an **`Estimator` figure may not draw on surplus** borrowed from a sibling (a tenant may bear its own mis-estimate; a neighbour's unspent joules are not the tenant's to gamble); a **gang is all-or-nothing in joules, not only in slots** (admitting part of a gang against a budget that cannot finish it spends real energy and delivers nothing); and **preemption follows evidence before declaration** — workloads with a measured cost per *completed* unit are reclaimed worst-first, while workloads that have completed nothing are unmeasured rather than wasteful and fall back to declared priority. That last rule is why the energy unit is load-bearing: ranking by cost per completed unit needs an outcome anchor, which device-seconds cannot supply. Surplus is shared by weight among borrowers under one parent and never crosses roots; a claim that cannot fit today queues, and one that can never fit is refused with the reason. Scope is narrow on purpose: `pool/1` decides, and does not place, meter or execute — the grade of every energy figure travels into the verdict rather than sitting beside it.

- **Licence:** Apache-2.0 for reference code (see [`pool/LICENSE`](pool/LICENSE)); CC-BY-4.0 for specification text (see [`pool/LICENSE-SPEC`](pool/LICENSE-SPEC)).
- **Status:** v0.1.0-draft.1. `SPEC.md` published; reference workspace `pool-rs/` — `pool-core` carries the entitlement tree with weighted sibling surplus, the normative §4 admission order (impossibility before pendency, guarantee, then borrowing), and the §5.2 preemption order. `cargo test --workspace` green.

### [joulespec/](joulespec/) — A carrier for intent

The **specification cargo class**: what software owes, and whether anything
established it. Specification-driven practice converged on prose an agent
interprets and a human reads, and the difficulties catalogued wherever it is
examined — specifications drifting from the code they describe, generated
artifacts trusted past their evidence, no method for checking conformance, a
review burden heavy enough that practitioners report preferring to read the
code — are measurement problems rather than methodology ones. They persist
because the specification is a *document*: a clause cannot be addressed, so
nothing binds to it; conformance is a sentence in a review, so it cannot be
graded or capped; the cost of the ceremony is an anecdote, so the argument about
whether it earns its overhead has no units. `joulespec/1` leaves the prose
alone and changes what the specification *is*. A clause is addressed by its
**obligation** — the content address of its kind and text, with the label
deliberately excluded — so renaming a clause loses no evidence while rewording
one invalidates exactly that clause's evidence, which is the inversion that
lets drift go unobserved under label-bound citations. Evidence climbs a ladder
ordered by one question, *how hard would it be for this obligation to be
violated without this evidence noticing*: `E0:Cited` (testimony — where
prevailing practice lands) → `E1:Reviewed` → `E2:Exercised` (a green check,
which flatters: a test with no assertion passes) → `E3:Falsifiable` (the same
check on record **failing** against a named counter-artifact) → `E4:Proved`.
**Every rung above `E2` rests on a demonstrated failure**, and the rule binds
proofs as much as tests: a formal statement can hold *vacuously*, true because
nothing ever reaches the condition it guards, so `E4` needs the statement
refuted against a counter-model and its formalization cross-checked by a key
other than the prover's. Whether a check can fail is also structural, not only
empirical — an oracle whose expected value derives from the system it judges
cannot disagree with that system when a fault moves measurement and expectation
together — so every check declares an **anchor** (`specification` / `state` /
`unstated`), and an unstated one caps at `E2` because the answer is free to
whoever wrote the check. A second axis runs beside the first: **attestation**
(`A0:self-attested` → `A1:independent` → `A2:reproduced`), derived from work
authorship and from agreement between disjoint keys, never declared, and absent
rather than independent where no implementer is known — because how strong a
check is and who vouches for it fail separately, most obviously when the
implementer and the reporter are one process. Both axes are minima over the
owed obligations and both gate conformance; non-goals are first-class, and
evidence that one was implemented is a flag that blocks conformance however
good the rest is. Revising a specification yields the exact partition of which
evidence survives, while a witness names the **footprint** it depended on and
survives any later state that still contains it — so a documentation edit does
not expire the evidence for an authentication requirement, which is how
traceability decays in practice. Every witness and every unit of work carries
its joules, so the receipt seals the **specified share** (how much energy went
into work citing no clause, with that work **named**, because unintended
function is what backward traceability exists to exclude) and **microjoules per
falsifiable obligation** — the denominator deliberately the rung whose evidence
can fail, and comparable only at a fixed specification address, since any
evidenced-over-total figure improves when trivial items are added. Receipts are
derived from the evidence and never from a verdict handed in, so every claim in
one is reproducible by anyone holding the same inputs.

- **Licence:** Apache-2.0 for reference code (see [`joulespec/LICENSE`](joulespec/LICENSE)); CC-BY-4.0 for specification text (see [`joulespec/LICENSE-SPEC`](joulespec/LICENSE-SPEC)).
- **Status:** v0.3.0-draft.1. `SPEC.md` published, with §9 setting out what it takes from requirements-traceability tooling, assurance-case structure, certified-airborne traceability, supply-chain provenance levels, mutation testing and carbon-intensity accounting, and what it adds to each. The traceability family is the nearest prior art and narrows the claim honestly: it already binds evidence to a requirement by identifier and revision, and its strongest member already requires the covering check to have *run* — so `E2` is independent convergence rather than a contribution. What it leaves open is what this standard closes: the revision is bumped by hand, where an obligation address is computed; and a passing check that asserts nothing still satisfies such a gate, with test quality deferred to human review, where `E3` makes it mechanical. Reference workspace `joulespec-rs/` — `joulespec-core` carries obligation-addressed clauses and signed revisions, the graded evidence ladder with oracle anchoring, vacuity and independence computed from key disjointness, the deterministic two-axis evaluator with both minima, the four flag conditions and footprint-aware staleness, the revision partition, and the `joulespec/1` JCR-1 receipt with its per-clause audit. `joulespec-cli` is the reference **producer**: it reads clauses from the published specification document, runs each declared check, runs it again against a declared counter-artifact, and emits a signed witness only at the rung the observations support — distinguishing a check that failed from one that did not compile from one that should not have passed. It also drives a **model checker** for the `E4` path, where it parses the property table rather than the verdict line: a checker reports success for a harness whose assumptions emptied the domain in the same words it uses for one that examined all of it, so a gate reading the verdict passes vacuous proofs. A budget per harness makes an undecided run a finding instead of a hang. Two conformance packs: byte-stable wire vectors carrying one witness of every rung plus one bound to a superseded state, and the standard **applied to its own implementation**, where every conformance item of §7 reaches `E3` against a counter-artifact that made its check fail, and two items also carry a proof discharged over their whole input domain. That exercise keeps finding real defects inspection missed — a test whose assertion could not fail, a branch that could not change a verdict, and two counter-artifacts silently aimed at text a refactor had moved, which now fails closed before anything runs. It also measured why the top rung exists: the counter-artifact that narrows the ratio rule's arithmetic to 64 bits is invisible to the whole test suite and refuted by the prover at once. `cargo test --workspace` green, `cargo clippy --workspace --all-targets` zero warnings, both gated in CI alongside the harvest and a live proof leg.

## How this is organised

Each subdirectory is self-contained: it carries its own README, its own licence, and its own contribution guidance. Cross-protocol consistency lives at this level — in this README and in [`CHARTER.md`](CHARTER.md).

```
open-standards/
├── README.md       — this file
├── CHARTER.md      — the stewardship pattern
├── openpay/        — payment-acceptance stack (Apache-2.0, Rust)
├── smart-byte/     — value-carrier substrate (CC-BY-4.0, spec)
├── eoc/            — energy-optimised compute (CC-BY-4.0, spec)
├── wai/            — media transport + capability dispatch (Apache-2.0, Rust ref impl)
├── jouleclaw/      — energy-optimised AI runtime (Apache-2.0, Rust ref impl)
├── arl/            — AI Readiness Level measurement standard (CC-BY-4.0, spec; ref impl in progress)
├── joule-code/     — energy-attributed federated coding operations (Apache-2.0 code / CC-BY-4.0 spec, Rust ref impl)
├── sandbox/        — isolated, metered, attested execution across the heterogeneous compute fabric (Apache-2.0 code / CC-BY-4.0 spec, Rust ref impl)
├── map/            — geospatial cargo class: range-requestable signed tilesets + fidelity cascade (Apache-2.0 code / CC-BY-4.0 spec, Rust ref impl)
├── aac/            — communication cargo class: portable boards + a ten-level offline-first cascade (Apache-2.0 code / CC-BY-4.0 spec, Rust ref impl)
├── proof/          — verification cargo class: energy-accounted cheapest-sufficient cascade + signed proof receipts (Apache-2.0 code / CC-BY-4.0 spec, Rust ref impl)
├── jcp/            — Joule Context Protocol: unified energy-native capability-secured agentic substrate (metered grants + signed receipts, decided outside the model) (Apache-2.0 code / CC-BY-4.0 spec, Rust ref impl)
├── joulecontract/  — contract cargo class: five-obligation energy-accounted interface contracts, bound + sealed receipts, adversarial-diff provenance (Apache-2.0 code / CC-BY-4.0 spec, Rust ref impl)
├── joule-os/       — the UDA reference runtime: single-level store + refine-family cascade + capability ledger, lowered per coordinate across native / PWA / bare-metal (Apache-2.0 code / CC-BY-4.0 spec, Rust ref impl)
├── mesh/           — inference serving + routing fabric: joule-ceiling × fidelity-floor requests routed cheapest-sufficient, metered, sealed as µJ-per-accepted-token receipts (Apache-2.0 code / CC-BY-4.0 spec, Rust ref impl)
└── joulespec/      — specification cargo class: obligation-addressed clauses, a graded evidence ladder from testimony to proof beside a derived attestation axis, deterministic drift, and the joules a specification cost to evidence (Apache-2.0 code / CC-BY-4.0 spec, Rust ref impl)```

The standards do not depend on one another. They share a steward and a doctrine — that the protocol is the public commitment and the operations are the offer. (Most also share a unit of accounting, joules; ARL is universal and tied to nothing, joules being one of its four measured axes rather than a shared substrate.)

## Contributing

Contributions are welcome at the subdirectory level. Issues, discussions, and pull requests scope by subdirectory tag. The smallest valuable contributions:

- **OpenPay:** new driver implementations, persistence backends for the domain stores, FFI platform glue, ISO 20022 / EMV test vectors.
- **Smart Byte:** worked examples of cargo types, additional conformance vectors, security-engineering critique.
- **EOC:** evaluation suites, additional `eval*` worked instances, registry entries.
- **WAI:** new capability registrations (neural codec extensions), conformance test vectors per registered capability, language bindings against the `wai-rs` C ABI (Python ctypes, Node N-API, Swift, JNI, Go cgo).
- **Joule Code:** additional conformance vectors (especially adversarial negatives), real `L0`/`L2` cascade stages, measured-energy backends feeding the receipt's `HwShunt` path, and independent third-party implementations certifying against the public suite.
- **Sandbox:** adversarial conformance negatives (folded accelerator energy, grant-set mutation mid-run, tier-minimization violations), per-device measured-energy backends (NVML / RAPL / ROCm SMI / Level Zero) feeding the `HwShunt` path, and real S2 (WASM) and S5 (microVM) tier executors behind the `sandbox-runtime` executor trait.
- **Map:** adversarial conformance negatives (a directory root disagreeing with its entries, a revision-chain fork, an over-fetching range planner), the substrate port (`map-index` S2 + 4D, `map-tiles` MVT/raster/3D-Tiles, `map-orbital` SGP4, `map-route`), measured-energy backends feeding the receipt's `HwShunt` path, and new tile-payload codecs with per-codec vectors.
- **Proof:** real solver backends behind the `Solver` trait (a Lean tactic runner at `T0`, CVC5 alongside `z3` at `T1`, a distilled prover at `T2`), a `HwShunt` measured-energy backend (RAPL/NVML), adversarial conformance negatives (a router hiding escalation waste, a receipt sealed for an unproved goal, a provenance/measured mismatch), and spec-grounding cross-checkers that earn a `CrossChecked` grounding against an independent encoding.
- **JCP:** transport bindings that wrap existing MCP/A2A tool and agent calls in Grants and Frames without moving the decision into the model; a `HwShunt` measured-energy cost backend (RAPL/NVML); grant revocation lists and multi-hop attenuation-chain verification; a signed content-addressed capability-discovery catalog; and adversarial conformance negatives (a chain that amplifies mid-delegation, a receipt whose budget disagrees with its grant, a replayed nonce).
- **JouleContract:** the in-toto/DSSE `JouleContract` predicate emission at the recognized edge; a signed conformance vector pack (`conformance/v1/`); adversarial negatives from the published diff rounds (a frame amendment racing its breach, a quorum whose members share a parent entity, an evidence bundle with one swapped attestation); meter-attestation backends (RAPL / NVML / substrate telemetry) feeding the `Metered` binding; and a fourth adversarial diff round.
- **Joule OS:** additional refine-family backends behind the cascade (real `LocalSearch` / `StateGraph` / `ConstrainedSearch` stages); per-platform measured-energy oracles feeding the work-class receipts; conformance negatives against the THEOREM I1–I20 invariants (a capability minted outside `Ledger::issue`, a single-level-store mutation that tears across an instruction boundary, an AOT/JIT divergence); and bare-metal surface drivers.

- **JouleSpec:** witness producers that emit `E3` evidence from suites already in use (a mutation runner recording the mutant each test was written against is the natural one, and a test harness that observes its own reads can emit the footprint rather than leaving it empty), a bridge that turns the verification standard's discharged goals into `E4` witnesses with their formalizations and vacuity checks carried through, adversarial negatives (a witness re-bound to a reworded obligation, a footprint widened after signing, a review countersigned by the citing key, a receipt sealed from a hand-built verdict), and measured-energy backends feeding the witness `HwShunt` path.

A `CONTRIBUTING.md` per standard captures the specifics where they diverge.

## Contact

- Web: [transaction.science](https://transaction.science)
- Mail: [hello@transaction.science](mailto:hello@transaction.science)