# Provenance — adversarial diff as governance

This standard improves by being adversarially diffed, not defended. Each published version was attacked by independent, mutually-blind review lenses; the findings were published as a diff document; the repairs were folded into the next version as a traced amendment under the standard's own §5.2, chained to the real digest of the version it amends. The diffs are therefore part of the standard's provenance, not commentary on it.

| Round | Document | Lenses | What it found |
|---|---|---|---|
| 1 | [`joulecontract-diff-v0.3-global.md`](joulecontract-diff-v0.3-global.md) | global AI-coding canon · highest-regulated code ecosystems | The **semantic** gaps: no frame clause, no generator identity, unqualified verifier tooling — six gaps, folded into v0.4. |
| 2 | [`joulecontract-diff-v0.4-self.md`](joulecontract-diff-v0.4-self.md) | second-order regressions · new attack surfaces · canon fidelity | The **binding** gaps: every new field was a string the producer could self-sign; two unterminated recursions; two canon over-claims — twenty findings, folded into v0.5. |
| 3 | [`joulecontract-diff-v0.5-self.md`](joulecontract-diff-v0.5-self.md) | temporal/operational semantics · economics & collusion · spec-lawyer consistency | The **time, party, and incentive** gaps: the joule itself was the last unbound field; bindings had no evaluation point in time; keys are not parties and parties need consequences — thirty-three findings, folded into v0.6. |
| 4 | [`joulecontract-diff-v0.6-impl.md`](joulecontract-diff-v0.6-impl.md) | spec-vs-code fidelity · Rust soundness & adversarial inputs | The **implementation** gaps: four guarantee bypasses (case-variant key forgery, the entity-omission Party hole, caller-supplied key sets, reseal-under-any-key) and a validator that over-graded JR-4 from receipt-local evidence — twenty-eight findings, repaired in `joulecontract-rs` with the local/composed validator split; the spec consequences folded into v0.7. |
| 5 | [`joulecontract-diff-v0.7-pack.md`](joulecontract-diff-v0.7-pack.md) | clean-room implementability (spec + vector pack only, reference code forbidden) | The **publication** gaps: a receipt-local validator was buildable from the artifacts alone, the composed validator was not — the bundle construction, the negatives' sealed contexts, the key-log event model, and the quorum scope lived only in unreadable code, and the obvious canonicalization RFC produced the wrong digest. Seventeen findings; folded into v0.8 (six normative definitions) and a pack expansion from 13 to 22 vectors with every composed input shipped. The pack itself had been running `evidence:external`; v0.8 seals it. |

The pattern, stated once: each round forces the standard to apply its own newest rule to its own oldest text. The chain anchors live in [`../archive/`](../archive/) byte-exact; verify with `shasum -a 256 ../archive/*.md` against the amendment log in [`../SPEC.md`](../SPEC.md) §16.