# JouleContract

**An Open Standard for Energy-Accounted Interface Contracts**

| | |
|---|---|
| **Status** | Draft for Review |
| **Version** | 0.7.0 — amends 0.6.0, digest `sha2-256:a4b8554ee0f3920c980868907360ddc4b114a2b8a30d5b5acd5f9476a4c64931` (see Amendment Log, §16) |
| **Canonical home** | `joulecontract.transaction.science` |
| **License** | Specification text: CC-BY-4.0 · Reference implementation: Apache-2.0 (Rust) |
| **Stewardship** | The protocol is ownerless. Stewardship is an office, not an owner (§11). Transaction Science, Inc. is the inaugural steward. |
| **Position** | The operand between JouleCode, JouleProof, and JouleClaw; denominated in the EOC joule unit; readiness scored by ARL. |
| **Prime directive** | Energy optimization, safety, and auditability — served by one receipt, not three programs. Every point of failure is named, graded, and traced; the residuals the assurance canon cannot mechanize are named, not hidden (§10.1). |

---

## 0. Self-Hosting Clause

This specification is governed by its own amendment model. Each published version is a content-addressed document; each new version is an attributed, reasoned, signed amendment chained to the digest of the version it amends — the chain carries **real digests** (§16), not placeholders, because a self-hosting claim discharged by its own vocabulary would otherwise serialize `undischarged`. No version of this standard depends on any person, organization, algorithm, or jurisdiction remaining in place: every named fixed point in this document is an **office or a parameter with a defined succession or migration rule**, not a dependency.

Self-hosting is literal: amendments to contracts are themselves JouleContract transitions, metered and receipted under §5.2, with a defined base case so the recursion terminates (§5.2.2).

---

## 1. Design Principle: Inherit, Don't Invent — Bind, Don't Name — Seal, Don't Float

The three concerns this standard serves — energy optimization, safety, auditability — each have a mature, internationally recognized management-system standard. JouleContract does not replace them. It is the technical control object whose single signed receipt simultaneously discharges evidence for functional safety (IEC 61508 and the independently-evolved avionics family), energy management (ISO 50001 with ISO/IEC 30134), and AI governance (ISO/IEC 42001) — three programs collapsed into three projections of one receipt log.

Where an inherited standard is superseded, the inheritance binds to the **current edition** of that standard or its formally designated successor for **new contracts**; an issued receipt pins the Register snapshot in force at issuance (§5.1.4), so revision of the canon never changes what a past receipt claims.

**The binding rule (normative, global).** A trust-bearing field is one whose value, if false, would cause a reader to over-trust the receipt: `generator`, `frame`, `qualification`, `independent`, `verifier`, `engagement`, `provenance`, `joules_spent`, `ceiling`, `enb_ref`, `profile` (including its rigor target), and all timestamps. Every trust-bearing field MUST be **bound** — derivable from or verified against a key, a signed attestation sealed in the receipt's evidence (§5.1.3), or an independent timestamp — or MUST serialize in a **demoted** form (§15) that a reader and a profile can act on. A field that is named but not bound does not exist in a conformant receipt: there is no implicit trust anywhere, including in this standard's own vocabulary, and **including in the joule figure itself** (§4.2).

**The sealing rule (normative, global).** Every binding is evaluated **once, at discharge, by the verifier of record**, against evidence captured as of that moment, and sealed into the receipt's evidence bundle (§5.1.3). Conformance is a property of the receipt at issuance; it never floats with later infrastructure. Re-verification is **resolution-free**: it re-checks the sealed evidence, not the live network. Changes to trust inputs after issuance — key rotation, revocation, attestation expiry, edition revision, baseline change — act **forward only**, through the amendment and key-log discipline (§5.2.1, §6.4); they demote or govern future receipts and never silently re-grade past ones.

---

## 2. Normative Inheritance

Conformant implementations MUST be expressible in terms of the following, by role:

### 2.1 Safety and rigor — the functional-safety standard and the avionics assurance family
Two independently-evolved lineages are inherited, each on its own authority:

- **IEC 61508** (currently Ed. 2) and its aligned sector standards (ISO 26262 automotive, IEC 62304 medical, EN 50128 rail): goal-based assurance — risk-reduction targets demonstrated through structured evidence across a defined lifecycle, formal methods admitted as assurance techniques, graded by Safety Integrity Level (SIL 1–4). JouleContract inherits the assurance-case-as-evidence model (the receipt log *is* the assurance case) and RFC 2119 normative discipline. **SIL itself attaches to a safety function's required risk reduction, derived from hazard analysis; JouleContract does not self-assign SILs** — see the Rigor class (§10), which maps to a sector level only through a bound risk-assessment attestation.
- **The avionics assurance family** (DO-178C/ED-12C with supplements DO-330 tool qualification and DO-333 formal methods), which **predates IEC 61508 and evolved independently** — its objective-based discipline, tool-qualification regime, and formal-methods soundness requirements are inherited where high rigor is claimed (§6.1, §10).

### 2.2 Energy — the energy-management system (currently ISO 50001) + the measurement-KPI series (currently ISO/IEC 30134)
The joule ceiling is an **Energy Performance Indicator (EnPI)** against a declared **Energy Baseline (EnB)**; the ratchet (§5.3) is the continual-improvement loop, scoped per-EnB; the provenance tag (§4.2) is the measurement category — now bound, not asserted.

### 2.3 Governance — the AI management system (currently ISO/IEC 42001 and family: 23894, 42005, 42006, 42007, 38507, 5338)
The AIMS is the wrapper JouleContract operates inside; the amendment model (§5.2) is its change control — which is why an unamended breach is, by definition, a change-control failure and caps the Governance class (§15).

### 2.4 Assurance, evidence, and trust
ISAE 3000 / SOC 2 (independent attestation reads the receipts; its practitioner-liability regime is a recognized recourse regime, §6.2) · eIDAS qualified signatures/**seals**/timestamps (seals bind keys to **legal entities** with statutory identity-proofing — deployed at high rigor, §6.2; QTSPs carry statutory liability, a recognized recourse regime) and FIPS 140-3 validated cryptography · vLEI / GLEIF legal-entity identifiers (party binding outside eIDAS jurisdictions) · RFC 3161 timestamping under a named policy (timestamp regime outside eIDAS jurisdictions, §5.2.1) · in-toto / SLSA / DSSE / Sigstore (supply-chain envelope at the recognized edge, §7) · NIST SP 800-218 SSDF and 800-218A · ISO 19011 (the audit is a query over the receipt log).

---

## 3. The Core Object

A JouleContract is a content-addressed object bound to a unit of work, declaring **five** obligations:

1. **Precondition (`pre`)** — MUST hold for the transition to be admissible.
2. **Postcondition (`post`)** — MUST hold once the transition completes.
3. **Invariant (`inv`)** — MUST hold throughout and survive the boundary unchanged.
4. **Frame (`frame`)** — the declared **mutable footprint**: the complete set of state the transition is permitted to touch. All state outside the frame is implicitly invariant. (§3.4.)
5. **Joule ceiling (`ceiling`)** — maximum energy, in the EOC joule unit, expressed as an EnPI against a declared EnB, **with a bound derivation** (§4.2).

The contract also records its **rigor target** (§10) — the conformance class the producer undertakes to discharge — so the promise is visible before the work, not retrofitted after it.

### 3.1 Identity and cryptographic agility

A contract MUST be content-addressed by the digest of its canonical serialization. The digest MUST be **algorithm-prefixed** (multihash-style), and conformant implementations MUST support digest-algorithm migration: when an algorithm is deprecated by the steward (§11) on published cryptanalytic grounds, existing objects are re-anchored by a signed, independently-anchored **re-anchor record** (old address → new address, reasoned, appended to a forward-only re-anchor log; resolution follows the chain, hop-bounded) mapping old identity to new. This discipline applies to **every** identity in a contract or receipt: human-readable names (`model`, `system`, tier labels, DID strings) are non-normative labels; the algorithm-prefixed digest of the sealed object — attestation bytes, key material, tier definition — is the identity (§5.1.3).

### 3.2 Correctness stays the verifier's

A contract states a specification; it does not certify itself. A proof is not a specification: discharge establishes that an implementation satisfies the stated obligations, not that those were the right obligations. Conformant systems MUST keep correctness with an independent verifier of record (§6).

### 3.3 Composition — and composition never relicenses anything

Contracts compose. A contract over a composed transition (a batch, a pipeline, a workflow) is the conjunction of its components' obligations with a ceiling no greater than the sum of component ceilings, and a frame no larger than the union of component frames. Composition is associative; receipts for a composed transition MUST reference the component receipts or carry the composed discharge directly.

**Composition never relicenses — frames *or* ceilings.** The composed frame bounds the aggregate; each component remains bound by its own declared frame within the composition, and a component's effect outside its own frame is that component's breach even where it falls inside the composed frame. Identically for energy: each component remains bound by its **own ceiling** within the composition; a composed discharge MUST carry per-component `joules_spent` attribution, or its composed energy figure serializes **`component_unattributed`** — it cannot feed a ratchet, cannot support residual claims, and caps Energy-class comparability. A component overrun inside a passing batch is still that component's deviation under §5.2; intra-batch netting of one component's overrun against another's slack is the energy-axis form of the relicensing this clause forbids. If any component's frame is `undischarged` (§3.4), the composed frame is `undischarged`, carrying the offending component's reference.

**Decomposition** — discharging one high-rigor obligation across redundant lower-rated elements (the ISO 26262 ASIL-decomposition pattern) — is expressed as conjunction over the composing contracts **only where the composing elements are demonstrably independent**: freedom from interference plus absence of common-cause failure, recorded via the independence binding (§6.2) and a dependent-failure rationale carried in the profile (§10). Absent demonstrated independence, the original high-rigor obligation stands undecomposed.

### 3.4 The frame obligation — no unintended function

`pre`/`post`/`inv` establish what a transition guarantees; none of them bounds what it may *additionally* do. The frame closes that: anything not named in `frame` is implicitly invariant, so an effect outside the declared footprint is a breach (§5.2) exactly as a violated postcondition is. This is the standard's form of two independently-evolved canon requirements — DO-178C's *absence of unintended function* and ISO 26262's *freedom from interference*.

**There is no closed `unbounded` frame.** Where a transition's full footprint cannot be bounded, the frame obligation serializes **`undischarged`** with a reason — non-promotable, Rigor-capping (§10), propagating to the top of any composition (§3.3).

**Frame discharge modes.** Each frame discharge MUST record its mode:

- **`observed`** — the verifying tier monitored the actual execution footprint of a computational transition.
- **`attested`** — for transitions whose footprint is not computationally observable (a clinical handoff, a custody transfer, an operational procedure): an **independent witness or receiver** — a party disjoint from the generator under §6.2 — attests, by signature, that the transition's effects stayed within the declared scope of state, care, or custody. This is the receiver-confirmation step ("synthesis by receiver," I-PASS) made a first-class discharge mode, and it is what keeps a refactor, a settlement, and a clinical handoff on one ledger at every rigor class rather than only at the bottom (the cross-domain claim of §4 is an assurance claim, not only a ledger claim).
- **`static_only`** — the footprint was bounded by analysis of the artifact without observing execution. A weaker claim: declared-and-analyzed, not observed-and-confined. JR-4 (§10) requires `observed` or `attested`.

Because the frame is the one obligation that bounds *unstated* effects, frame discharge MUST be independent of the generator (§6.2) at **JR-2 and above**.

---

## 4. Energy as Coordinate

Energy is the coordinate system, not a feature. The joule is the only unit present in every transition in every domain; that shared unit is what places a refactor, a settlement, and a clinical handoff on one ledger under one audit.

### 4.1 The ceiling is the one measured clause — and the residual is a control signal, not a savings claim
Correctness clauses are binary; the ceiling yields a **measured residual** (allowed − spent), the continuous signal that drives improvement loops and the ratchet (§5.3). Disclosure semantics are strict: the quantity summable into external energy disclosures (CSRD/ESRS E1) is **`joules_spent`** — a measured figure carrying its provenance binding. The **residual MUST NOT be presented as a savings, efficiency, or reduction claim**: a residual is the gap between spend and a declared ceiling, and a declared ceiling can be declared generously. A residual against an unanchored ceiling (§4.2) has zero evidentiary weight.

### 4.2 Energy provenance — bound, not asserted

Every joule figure MUST carry one of three measurement categories, and the category itself is a trust-bearing field under §1 — it binds or it demotes:

- **`Metered`** — hardware-measured, and the claim MUST be bound: the figure resolves (within the sealed evidence, §5.1.3) to a **meter or substrate attestation** — a signed reading or telemetry statement from the metering subsystem (hardware shunt, PDU, substrate/cloud telemetry endpoint) — signed by a key **distinct from the receipt signer**, validity-windowed per §6.1's pattern. A `Metered` tag without a resolving meter attestation serializes **`metered_unattested`** and is treated as `ModelBased` for the Energy class. Whoever owns the meter owns the unit of account; on producer-owned bare metal with no independent meter, the lower categories exist precisely to record that honestly.
- **`ModelBased`** — anchored to a metered baseline for a comparable workload; the anchor reference is sealed.
- **`Unaccounted`** — estimated by published energy-traceability methods where the substrate exposes nothing; the method reference is sealed.

The tag MUST travel with the number; downstream consumers MUST NOT promote a category. The failure prevented is estimation laundering itself into apparent measurement — **including by the standard's own serializer**.

**The ceiling and the baseline are bound too.** The EnB is a signed object (signed by its declaring authority, sealed in evidence), and the ceiling MUST carry a **derivation binding** to its EnB — the measured or modeled basis on which `joules_allowed` was set. A ceiling without a derivation binding serializes **`ceiling_unanchored`**: the contract remains valid, the spend remains reportable, but the residual carries no evidentiary weight and cannot feed disclosure projections or ratchet claims. `grid_mix`, where present, SHOULD carry a source attestation (grid operator or registry); unattested grid-mix is informative only and MUST be excluded from disclosure projections.

### 4.3 Cross-domain ledger rule

The ledger is **additive across domains and comparative only within an EnB scope.** Sums of joules are physically meaningful regardless of domain, so a global ledger MAY total compute-joules and operational work-joules for aggregate disclosure. But an EnPI is meaningful only against its own baseline: residuals compare only under the same EnB, and never constitute an equivalence claim across EnBs. Receipts MUST carry the EnB reference; conformant ledgers MUST refuse cross-EnB comparison while permitting cross-EnB summation.

### 4.4 Resource-bound lineage (precise claim)
The functional-safety canon already verifies **time** (WCET) and **memory** (stack/heap bounds) as objectives. JouleContract does not claim to verify resources for the first time. It **generalizes resource-bound verification from time and memory to energy, and makes the bound a billed, receipted, ratcheting EnPI** rather than a one-time certification objective.

---

## 5. The Receipt, the Amendment, and the Ratchet

The contract is the promise; the receipt is the record that the promise held — the unit of evidence for all three inherited management systems at once. Any compliance report is a projection over the receipt log.

### 5.1 Required receipt fields
`contract` · `transition` (§5.1.5) · `interval` (§5.2.1) · `generator` (§5.1.1) · `discharge` (one entry per declared obligation — every `pre`, `post`, `inv`, and the `frame` — each carrying: tier that closed it or `undischarged` + reason; tier class and **qualification** binding (§6.1); discharging **verifier identity**, computed **key-disjointness/independence**, and **engagement** disclosure (§6.2); and for `frame`, the mode, §3.4) · `execution` (§5.1.5) · `joules_spent` + meter binding (§4.2) · `joules_allowed` + derivation binding (§4.2) · `residual` · `provenance` · `enb_ref` · `grid_mix` (OPTIONAL) · `verifier` (derived union) · `profile` (§10) · `register_pin` (§5.1.4) · `timestamp` (§5.2.1) · `evidence` (§5.1.3) · `signature`.

A receipt missing a discharge entry for any declared obligation is malformed — not demoted, malformed. (An obligation nobody could close is `undischarged`; an obligation nobody *mentioned* is a hole in the record.)

**The residual is derived, never carried.** `residual` is computed at read time as `joules_allowed − joules_spent`; a carried copy could lie, and a field whose only honest value is a function of two other fields is not a field (v0.7 amendment — the round-four implementation diff surfaced this: the reference implementation refused to store it, and the implementation was right).

#### 5.1.1 Generator identity — bound, with a defined key set
The receipt MUST identify the producer of the work — AI-BOM-compatible (OWASP AISVS Appendix C, control AC.9.1, a Level-2 control), the producer-identity SLSA/in-toto carry for builders. Identity is bound: `generator.version_digest` MUST be an algorithm-prefixed content address resolving (within sealed evidence) to a producer attestation signed by a key **distinct from the receipt signer**, else **`generator_unattested`** (non-promotable; caps Governance class).

**The generator key set** — the operand of every disjointness computation in this standard (§6.2) — is defined as: the receipt signer's key(s) ∪ all keys enumerated in the resolved producer attestation ∪ the human principals' keys ∪ any key that has signed an amendment to this contract on the producer's behalf. The producer attestation MUST enumerate its keys so disjointness is decidable from sealed evidence.

#### 5.1.2 Trust-chain termination — two roots, one vocabulary
Every trust chain in this standard — qualification chains (§6.1), generator chains (§6.3), assignment chains (§10) — terminates at one of **two** defined roots, and the receipt names which:

- **`human-attested`** — a signed attestation by a named human principal (the assessor of record, the human author, the witnessing receiver). The signing human is the root; there is no contract behind the human. (This is the single root vocabulary for human grounding; the token `human-authored` is retired as an undefined synonym.)
- **`reference-impl`** — a published deterministic artifact whose soundness is a cited proof or public reference implementation.

A chain that does not reach a defined root within the sealed evidence serializes `unterminated` and is treated as unattested — and an unterminated qualification chain is a `qualified:false` trigger (§6.1).

#### 5.1.3 Sealing and the evidence bundle — resolution-free re-verification
The receipt carries, or references by digest into a content-addressed **evidence bundle** sealed under the same signature, every object needed to re-run verification: the producer attestation, qualification attestations, the EnB object, the meter attestation, the risk-assessment attestation (§10), entity credentials (§6.2), and the **key material — DID *document digests*, not DID strings — as of discharge**. DID strings, domains, and URLs are non-normative labels (§3.1); the sealed bytes are the evidence. Consequences, each load-bearing:

- **Re-verification requires no network.** A receipt is checkable from the receipt plus its bundle, at any later date, in any enclave — which is what makes conformant receipts producible in **air-gapped and classified environments**: no DNS, no live registry, no reachable public TSA is ever required to *verify*, and §5.2.1 names an offline-capable timestamp regime so they can also *amend*.
- **Receipts do not rot.** Validity windows (`valid_until`) bound when an attestation may be used for **new** discharges; they are evaluated once, at discharge (`validated_at` is recorded), and never re-grade past receipts. Loss of an original external object after sealing demotes nothing — the sealed copy is the evidence. Where a bundle itself is lost, the demotion distinguishes **`validation_recorded, evidence_lost`** (the verifier's signed issuance-time verdict survives in the receipt) from **`unresolvable`** (never validated) — two states an auditor treats very differently.
- **Retention is an obligation with an office.** The profile names a retention office and period **by role** (per the governing regime's predicate rule — the Part 11 inheritance); the verifier of record archives the bundle content-addressed at discharge.
- A receipt whose evidence is reference-only (no sealed bundle) serializes **`evidence:external`** — conformant, demoted, and exactly as trustworthy as the infrastructure it floats on.
- **The lost/never distinction is mechanical.** A missing object when the receipt seals *the presented bundle* (addresses match) was never validated: `unresolvable`, and the gate fails. A missing object when the receipt seals a *different* bundle than presented is evidence lost after issuance: `validation_recorded, evidence_lost` — the sealed verdict stands, re-checkability demotes, and the bundle mismatch itself already serializes `evidence:external` and caps the receipt below JR-3. No judgment call is involved; the bundle address decides.

#### 5.1.4 Register pinning — editions never float
The receipt carries the digest of the Register snapshot (§13) in force at issuance. Classes and inherited-standard claims are evaluated against the pinned snapshot, permanently. Current-edition binding (§1) governs new contracts only; a steward Register update can never change what a past receipt claims — the no-retroactive-authority rule (§11) applied to the canon itself.

#### 5.1.5 `transition` and `execution`, defined
`transition` is the algorithm-prefixed digest of the canonical serialization of the **transition record**: the subject's content addresses before and after, the interval anchors (§5.2.1), and the input references. `execution` entries are algorithm-prefixed digests of the executing tier definitions (labels non-normative per §3.1).

### 5.2 Amendment model

Every amendment to a contract — including to its ceiling or its frame — is an attributed, reasoned, signed transition chained to the prior digest. The contract is its own amendment log. **Breach is deviation without a matching amendment**; a measured overrun, or an out-of-frame effect, with a signed, reasoned, **timely** amendment is governed change — subject to the temporal-ordering invariant (§5.2.1).

**Unamended breach has a price in the standard's own currency.** A deviation left without a forward-looking amendment or fix-receipt serializes **`breach_unamended`** on the contract's subsequent receipts: non-promotable, and capping the Governance class until closed — an unamended deviation is by definition a change-control failure under the §2.3 inheritance. This makes the amendment the *cheap* branch: governed change costs a de minimis metered amendment; ungoverned deviation costs the Governance axis. (The prior inversion — where amending cost joules, timestamps, and quorum while silent breach cost a log line — taxed honesty and missed the budgeted attacker.)

**Amendments are metered, with the ceiling priced by the office.** An amendment is itself a JouleContract transition: it bears a ceiling, spends joules, and produces a receipt (§0). The amendment ceiling is set by the verifier office or the profile, not by the producer (a self-priced cost bounds nothing), and SHOULD be de minimis: metering exists for attribution and self-hosting, not deterrence. The anti-flooding bound at high rigor is **quorum** (§5.2.1), not the meter.

#### 5.2.1 Temporal-ordering invariant — sealed intervals, anchored stamps, future-only amendments

**Transitions are intervals, not points.** The receipt's `interval` carries an independently-anchored **start timestamp** (the admission of `pre`) and the receipt's anchoring timestamp. A transition is governed, end to end, by the contract version in force at its **start anchor** — the version that admitted it — so a transition spanning an amendment is never judged against obligations that did not exist when it was admitted.

**Receipts are anchored promptly or say they weren't.** A receipt MUST be anchored within the profile-stated maximum latency of transition end; a later stamp serializes **`timestamp_stale`** — a withheld receipt is visible as withheld. At JR-3 and above, **all** receipt timestamps — not only amendment timestamps — MUST come from an independent timestamp authority; an effect receipt without an independent anchor serializes **`timestamp_unanchored`** and is treated, for breach classification, as **predating every amendment** — so withholding a receipt to slip it behind a frame-widening amendment gains nothing.

**Amendments govern the future only.** An amendment MUST carry an independent timestamp and governs only transitions whose **start anchors** postdate it. An out-of-frame effect or overrun whose interval predates the relevant amendment is, and permanently remains, a breach: amendments change future obligations; they never reclassify past effects.

**The timestamp authority is an office, not a dependency.** The normative text names the role — *the independent timestamp authority* — and the Register (§13) lists recognized regimes by jurisdiction: eIDAS qualified timestamps (EU), RFC 3161 under a named policy (US/global), or an **enclave-internal authority operated under the §6 office pattern** (published key log, generator-disjoint, succession rule) for air-gapped deployments. At JR-3+, amendments MUST carry **timestamp quorum** (k-of-n independent authorities) and frame/ceiling amendments MUST carry **verification quorum co-signature** (§6), so no single suborned authority or key-holder can re-enable retroactive legalization.

#### 5.2.2 The amendment base case — the recursion terminates
An amendment-transition runs under the **normative minimal amendment-contract**, fixed by this standard (not authored per-amendment): its frame is the amended contract object plus the log head, and nothing else; its rigor class is inherited from the amended contract; its generator is the amendment signer. Amendments **chain; they do not meta-amend** — the minimal amendment-contract is not itself amendable, which is the base case. (Without it, amendment-as-transition would be an unterminated recursion of exactly the class §5.1.2 exists to purge.)

### 5.3 Enforcement and ratchet
Enforcement is at receipt-time (observed), never compile-time (rigid): deviations are recorded, the system keeps running, resolution is amend-or-fix — amendment forward-looking only (§5.2.1), unamended breach Governance-capping (§5.2). Over successive transitions the ceiling MAY ratchet toward the measured floor and reject regressions. **The ratchet is scoped per-EnB**: an EnB change (itself a signed amendment under §5.2) resets the ratchet floor, because a regression test across baselines would be a cross-EnB comparison §4.3 forbids. Ratchet claims require an anchored ceiling (§4.2) and component-attributed energy in compositions (§3.3).

### 5.4 Granularity
The standard fixes no transition granularity. Granularity is discovered economically by the cheapest-sufficient discharge cascade; obligations batch by composition (§3.3) — with per-component energy attribution preserved — until discharge clears at an acceptable tier, and the receipt records the batch boundary. Coding-rule rulesets (MISRA C/C++, CERT, NASA Power of Ten) are naturally cheap deterministic discharge tiers, carried in the tier field like any other.

---

## 6. Independent Verification — keys, parties, and consequences

Conformant systems MUST designate a **verifier of record** distinct from the generator of the work; where one agent drafts both obligation and implementation, an independent checker MUST discharge the obligation. The verifier of record MUST be replaceable without invalidating prior receipts — possible precisely because receipts are sealed (§5.1.3): verification authority attaches to the **verifier office** and its published key log (§6.4), not the incumbent.

**The verifier office, defined.** An office is a named role with: a published membership, an append-only signed key log (§6.4), and a succession rule per the §11 pattern. Office quorum means **k-of-n across independent verifiers** — party-disjoint members at JR-3+ (§6.2) — never k-of-n keys of a single member, which one capture defeats. Quorum support is **MUST at JR-3 and above** (and SHOULD below); profiles state k and n with k ≥ 2 at JR-3+. This single requirement discharges the independent functional-safety assessment (IEC 61508), effective challenge (SR 11-7), and independent attestation (ISAE 3000), and corresponds to receiver-confirmation in clinical handoff protocols (I-PASS).

**Quorum economics (why this is affordable, stated rather than hoped).** Quorum is economical exactly where discharge is **deterministic re-execution**: k verifiers re-running a type check or an SMT query cost k × near-zero — the §6.1 split is what makes high-rigor quorum viable at all. Where quorum touches non-reproducible discharge — `observed`/`attested` frames, `human-attested` roots — the cost is real, linear, and the deliberate price of a genuinely expensive claim. Profiles weigh that price explicitly.

### 6.1 Discharge tiers: two classes, one qualified and one not

A discharge verdict trusted without subsequent re-verification makes the tier that produced it a trust target — the DO-330 tool-qualification lesson, the DO-333 requirement that the soundness of any formal method be justified (a sound method never asserts a property holds when it may not), and ISO 26262's tool confidence levels. The canon's qualification machinery applies only where it can:

- **Deterministic tiers** (type checkers, SMT backends, static analyzers, model checkers, coding-rule checkers): defined, reproducible, bounded behavior — **qualifiable**. Each deterministic discharge MUST carry its qualification binding: a signed attestation, sealed in evidence, whose signer is **distinct from both the tier operator and the generator**, validity-windowed (evaluated at discharge, §5.1.3), with a chain terminating per §5.1.2. A reference that does not resolve within sealed evidence, was expired at discharge, is self-signed, **or whose chain is unterminated** serializes **`qualified:false`**.
- **Stochastic tiers** (model-based discharge): **not qualifiable** — no defined, reproducible behavior to qualify, and this standard does not pretend otherwise. A stochastic verdict MUST be recorded `unqualified` and MAY close an obligation **only** where that obligation is independently re-discharged by a deterministic tier or an independent verifier. A model verdict alone never satisfies a high-rigor discharge. (The cascade doctrine applied to verification itself: inference is a bounded last resort, not the control plane.)

The verifier of record validates qualification chains at discharge and seals the result; a profile states tier class and qualification requirements per obligation at a given Rigor class.

### 6.2 Independence: key disjointness is the floor; parties and consequences are the walls

Three layers, each binding what the previous cannot:

**Layer 1 — key disjointness (computed, the floor).** Each `discharge` entry carries the discharging verifier's identity and a disjointness verdict **computed** over the generator key set (§5.1.1) and the discharge signature, against the key log **as of the discharge timestamp** (§6.4) — never copied from a producer-supplied flag. Keys overlap → `independent:false`, regardless of any claim. But key disjointness is **necessary, not sufficient**: keys are free, and two disjoint key sets can have one owner. What §6.2 computes at this layer is precisely *key disjointness*, and the receipt says so: a discharge whose independence rests on keys alone serializes **`independent:key_only`**.

**Layer 2 — party disjointness (bound, required at JR-3+).** At JR-3 and above, verifier identity MUST bind to a **legal-entity credential** — eIDAS qualified seal, vLEI, or equivalent party-level attestation sealed in evidence — and independence at that class means disjointness of the bound **legal entities**. `independent:key_only` cannot satisfy any JR-3+ independence requirement. Entity binding moves the cost of manufactured independence from a domain registration to incorporation fraud — no further; see the named residual below.

**Layer 3 — engagement and consequences (disclosed, hooked).** Engagement economics are trust-bearing under §1: each discharge MUST carry `engagement: { selected_by, compensated_by }` as bound identities, else **`engagement_undisclosed`** (cannot satisfy JR-3+ independence). Profiles MAY require producer-independent verifier selection — relying-party-selected, registry-assigned, or rotation (the post-Enron audit-rotation move the canon already made). Each discharge carries the verifier's **recourse regime** — statutory (eIDAS QTSP liability), professional (ISAE 3000 practitioner liability), or bonded/insured — bound in the entity credential; an absent regime serializes **`recourse_undeclared`** (a disclosure, not a rigor cap: profiles MAY reject). A signature carries economic weight only where some regime outside this standard attaches consequence to its being wrong; relying parties weight `recourse_undeclared` signatures accordingly.

**Named incentive residuals (the §10.1 pattern — mechanize what can be, name what can't):**
- **Common control.** Two legal entities under one parent — or one person, two LLCs — defeat party disjointness, and **no credential scheme mechanizes corporate control graphs**. The canon handles this with party-level independence rules and conflict disclosure (ISAE 3000; IEC 61508 FS-assessment independence); this standard makes the disclosure legible and names the limit.
- **Issuer-pays gravity.** Where the producer selects and pays all n verifiers, the ratings-agency equilibrium (issuer-pays + competition for issuer business → grade inflation) operates with full cryptographic formality throughout. **No document mechanizes market structure.** Engagement disclosure makes capture *legible* — a relying party can see that every verifier is paid by the producer — it does not make capture impossible, and this standard does not claim it does.

### 6.3 Security of the generation loop
A generator is itself a transition-executing system and — at JR-3 and above — MUST operate under its own JouleContract bounding tool scope, context integrity, and escalation authority, with receipts in the same log. Composition is not self-certification: the loop contract's obligations MUST be discharged by a verifier independent of the generator (§6.2), its generator chain MUST terminate at a `human-attested` root (§5.1.2), and a loop receipt discharged only by the generator itself serializes **`self_attested`**, non-promotable. Below JR-3 this is SHOULD, with the same demotion when claimed.

### 6.4 Key lifecycle — forward-only, logged, never retroactive

Key events are governed by the same discipline as everything else: **rotation, revocation, and succession are signed, independently-timestamped amendments to an append-only office key log** — §5.2 applied to keys. Consequences:

- **Disjointness has a time coordinate.** Independence is computed over key sets *as of the discharge timestamp per the key log* and sealed (§5.1.3). Later rotation-into-overlap (an acquisition, a merger) never re-grades past discharges.
- **Revocation demotes forward, never invalidates backward.** A compromise is recorded as a signed attestation with an attested compromise time. Receipts signed between attested-compromise and revocation-record serialize **`verifier_revoked_window`** — treated as unattested. Receipts sealed before the attested compromise time stand. This is consistent with no-retroactive-authority (§11) because it is grounded demotion by signed evidence, not fiat invalidation — and it closes the gap between the slow key failure this standard already handled (cryptanalysis, §3.1) and the fast one it didn't (theft).

---

## 7. Wire Format and Recognized-Edge Emission

Novel core, recognized edge. Contract and receipt serialize as canonical JSON (JSON Web Proof permitted for selective disclosure). A receipt MUST be expressible as an in-toto Statement with a `JouleContract` predicate type wrapped in DSSE, and MAY carry a SLSA provenance predicate. Signatures MUST verify with standard tooling; eIDAS qualified signatures/seals for EU legal effect; FIPS 140-3 validated cryptography for US federal boundaries; algorithm-agile under §3.1. Governance mappings SHOULD emit as OSCAL; energy figures SHOULD be reportable as ISO/IEC 30134 KPIs and ISO 50001 EnPIs.

---

## 8. Regulatory and Standards Mapping

| JouleContract element | Recognized standard / control |
|---|---|
| Discharged obligation + Rigor class | IEC 61508 assurance case; ISO 26262 / IEC 62304 / EN 50128; DO-178C (independent lineage) |
| Rigor↔SIL mapping via bound risk assessment | IEC 61508 hazard & risk analysis; ISO 26262 HARA |
| Frame (no unintended function) | DO-178C absence of unintended function; ISO 26262 freedom from interference |
| Tier classes + qualification binding | DO-330 TQL (deterministic tiers); DO-333 soundness; ISO 26262 TCL |
| Computed key-disjointness / party binding / quorum | IEC 61508 FS assessment; DO-178C DAL-A/B independence; SR 11-7; ISAE 3000; eIDAS seals; vLEI |
| Engagement disclosure / recourse hook | PCAOB auditor-independence lineage; eIDAS Art. 13 liability; ISAE 3000 practitioner regime |
| Bound generator identity (AI-BOM) | OWASP AISVS App. C AC.9.1 (L2); SLSA/in-toto builder identity; NIST SP 800-218A |
| Sealed evidence bundle + retention office | 21 CFR Part 11 (records retained & producible); NIST 800-53 **AU** |
| Amendment = metered, anchored, future-only transition | ISO/IEC 42001 change control; NIST 800-53 **CM**; SOX; DORA; eIDAS / RFC 3161 timestamps |
| Continuous receipt log | NIST 800-53 **CA** ConMon; EU AI Act record-keeping; ISO 19011 |
| Generation-loop security | OWASP AISVS; OWASP Agentic Top 10 |
| Bound joule ceiling as EnPI vs signed EnB | ISO 50001 |
| Bound energy provenance (meter attestation) | ISO/IEC 30134 measurement categories & unaccounted-energy rules |
| `joules_spent` (not residual) into disclosure | CSRD / ESRS E1; ISO/IEC 30134-8 (CUE) |
| Governance wrapper | ISO/IEC 42001 AIMS (certifiable per 42006); NIST SP 800-218 SSDF |

---

## 9. Lineage

Hoare logic and Dijkstra's weakest precondition (the obligation generator) · Meyer's Design by Contract (pre/post/invariant in the signature; frame and joule ceiling are two more clauses) · the frame problem (McCarthy & Hayes) — *what must be declared not to change* — realized as a mutable-footprint declaration whose direct modern ancestors are modifies-clauses (JML `assignable`, Dafny `modifies`); separation logic's frame rule admitted as a **discharge technique**, not the source of the clause · Knuth's literate programming (intent is the durable source; code is extracted) · the governance canon itself (IEC 61508 and the independently-evolved DO-178C family; ISO 50001; ISO/IEC 42001), composed rather than reinvented. The name "pseudocode" is declined as homage: *pseudo* means false, and this is the most rigorous artifact in the stack, not the least.

---

## 10. Conformance: a Composed Profile

```
JCAP = ⟨ Rigor class, Energy class, Governance class ⟩
```

**Rigor class (JR-1 to JR-4)** — this standard's own scale of discharge rigor, defined by requirements, not borrowed authority:

- **JR-1**: obligations declared; discharge recorded honestly (demoted states permitted throughout).
- **JR-2**: generator-independent frame discharge (§3.4); bound generator identity.
- **JR-3**: bounded discharged frame (an `undischarged` obligation — *any* of the five, not only the frame — caps Rigor below JR-3); party-disjoint independence with engagement disclosure (§6.2); qualified deterministic tiers per obligation (§6.1); generator loop governance (§6.3); verification and timestamp quorum (§5.2.1, §6); independent anchors on all receipts.
- **JR-4**: all of JR-3, plus frame mode `observed` or `attested` (never `static_only`), and formal discharge of every obligation by quorum verification (MUST, not "implies").

**JR is not SIL.** SIL attaches to a safety function's risk reduction, derived from hazard analysis by an assessor — a derivation this standard cannot perform and does not fake. Where a transition **is** a safety function under an inherited sector standard, the contract MAY carry a **sector-equivalence claim** — the scheme and level (e.g. `IEC61508:SIL-3`), the risk-assessment attestation's content address, and the assessor of record's key — and the claim binds **only** when the attestation resolves in sealed evidence and the assessor's key is disjoint from the effective generator key set; otherwise it serializes **`target_self_assigned`** and no sector equivalence may be stated. The rigor *target* is recorded in the contract (§3) and `profile` is trust-bearing (§1): a producer who targets JR-1 evades nothing — the low target is the visible, legible promise, priced by the relying party.

**Energy class:** `Metered` (bound, §4.2) > `ModelBased` > `Unaccounted`. **`Metered` MUST NOT serialize unless the meter attestation is sealed and resolving** — the energy gate.

**Governance class:** AIMS maturity from declared to certified; `generator_unattested`, `self_attested`, or open `breach_unamended` caps the class.

**Evaluation is two-stage, and the stages are normative.** Receipt-**local** evaluation — the receipt and contract alone — can witness at most **JR-2** and `managed`: the JR-3+ gates (sealed-evidence resolution, key-log time coordinates, independent anchors, quorum, loop governance) are not visible from the receipt alone, and a validator that grades higher from local evidence is non-conformant. JR-3, JR-4, and `certified` are **composed** verdicts, evaluated over the receipt *plus* the sealed evidence bundle, the office key log, and the transition interval. (Codified in v0.7 from the round-four implementation diff, where a single-stage validator was found over-grading JR-4 from local evidence.)

**The least-bound-axis rule.** A class may be claimed only where its supporting fields are bound (§1), on **all three axes**: JR-3+ requires resolving qualifications and computed-plus-party independence; `certified` requires an attested generator and closed breaches; `Metered` requires the meter binding. No axis can be inflated by assertion, and no axis's shine can halo another's demotion.

**The claim-discipline rule.** A conformance claim MUST be made as the **full JCAP tuple plus its demoted-state disclosure**; the bare word "conformant," unqualified, is itself a non-conformant claim. (A receipt with every field demoted is conformant — and must be visibly so at the point where the halo would otherwise be harvested.)

### 10.1 Named residuals — what this standard cannot mechanize, graded instead of hidden

A standard that silently implied completeness it cannot have would contain illogic; JouleContract names its limits:

1. **Obligation-set adequacy.** Discharge proves *stated* obligations; nothing certifies the obligation set is complete against the behavior space. This residual is the entire canon's (DO-178C requirements validation; the ML ODD coverage question taken up by the forthcoming ED-324/ARP6983). A contract MAY carry an ODD-style domain annex making the boundary of the claim auditable.
2. **Common control.** Party disjointness is bound by entity credentials; corporate control graphs are not mechanizable by any credential scheme. Disclosure and party-level rules (ISAE 3000 lineage) are the available instrument.
3. **Issuer-pays gravity.** Engagement disclosure makes verifier capture legible, not impossible. Market structure is not mechanizable by a document.
4. **The demand side.** **This standard prices honesty; it cannot price assurance.** A fully-demoted receipt is conformant by design — truthful disclosure beats driven-underground lying — and the demoted floor is therefore the *intended* floor. Assurance is priced by relying parties demanding profiles: the JCAP tuple is the demand-side instrument, and the claim-discipline rule exists so the market can see what it is buying.

---

## 11. Stewardship Succession — no organization as point of failure

Stewardship is an **office**. The protocol is ownerless; the steward maintains the Register (§13), publishes algorithm deprecations (§3.1), and convenes amendment review. The office is bound by:

- **Fork-freedom.** CC-BY-4.0 (text) and Apache-2.0 (reference implementation) guarantee any party may continue the standard if the steward fails, defects, or captures. The ultimate succession mechanism is the license itself.
- **Succession rule.** Transfer by signed amendment; on dissolution or published-timeout unresponsiveness, any party maintaining a conformant reference implementation MAY assume interim stewardship by signed public declaration; competing claims resolve by implementer adoption, auditable in the log.
- **No retroactive authority.** A steward cannot invalidate prior receipts or versions; with Register pinning (§5.1.4), a steward cannot even *reinterpret* them. All authority is forward-looking, exercised through traced amendments — the same direction-of-time discipline imposed on producers (§5.2.1) and keys (§6.4).

---

## 12. Security Considerations

The posture is §1's two rules: bind or demote; seal or float visibly. Stated bounds, each now precise about what it does and does not bound:

- **Generator spoofing** — bounded by attestation binding with a defined key set (§5.1.1).
- **Frame minimization / sham tiers** — bounded by generator-independent frame discharge at JR-2+, mode disclosure, and the nonexistence of a closed unbounded frame (§3.4).
- **Qualification laundering** — bounded by sealed, validity-windowed, independently-signed, root-terminating qualification bindings (§6.1, §5.1.2).
- **Manufactured independence** — key-only disjointness is *named as insufficient* (`independent:key_only`); party binding raises the forgery cost to incorporation fraud; common control and issuer-pays capture are **named residuals (§10.1), not claimed bounds** — disclosure makes them legible, nothing in this document makes them impossible.
- **Retroactive breach legalization** — bounded by sealed intervals, start-anchor governance, prompt-anchoring latency, independent stamps on all receipts at JR-3+ (an unanchored receipt is treated as predating every amendment), and timestamp + verification quorum on amendments (§5.2.1).
- **Amendment flooding** — bounded by **quorum** at high rigor; the meter exists for attribution, not deterrence, and its ceiling is office-priced so it cannot be self-priced away (§5.2).
- **Meter capture / estimator abuse** — bounded by the meter-attestation binding and the non-promotion rule (§4.2); residual-minting bounded by ceiling-derivation binding and the residual-is-not-a-savings-claim rule (§4.1).
- **Receipt rot / identifier hijack** — bounded by sealing: re-verification runs against sealed evidence, never live identifiers (§5.1.3).
- **Key theft** — bounded by the forward-only key log and revocation windows (§6.4).
- **Verifier capture (single)** — bounded by office/key separation, party-disjoint quorum, replaceability over sealed receipts (§6). **Verifier alignment (all-of-n, issuer-paid)** — *not* bounded by this document; see §10.1.
- **Generation-loop compromise** — bounded by external discharge and `self_attested` demotion (§6.3).

---

## 13. Register (non-normative; receipts pin a snapshot, §5.1.4)

Current editions as of this version: IEC 61508:2010 (Ed. 2) · DO-178C/ED-12C + DO-330/331/332/333 (independent lineage) · ARP4754A; ED-324/ARP6983 (in development, first publication expected 2026; Issue 1 scoped to frozen, supervised, non-adaptive ML up to DAL C) · ISO 26262 · IEC 62304 · EN 50128 · ISO 50001:2018 · ISO/IEC 30134-2:2026 · ISO/IEC 42001 (EN ISO/IEC 42001:2026 in the EU) · ISO/IEC 42005:2025, 42006:2025 · NIST SP 800-218 + 800-218A · OWASP AISVS v1.0 + Agentic Top 10 (2026) · eIDAS (Reg. 910/2014 as amended; qualified timestamps & seals; Art. 13 liability) · RFC 3161 · vLEI (GLEIF) · FIPS 140-3 · SLSA v1.2 · RFC 2119/8174. **Recognized timestamp regimes by jurisdiction:** eIDAS qualified (EU) · RFC 3161 under a named policy (US/global) · enclave-internal office (§5.2.1) for air-gapped deployments. Updated by steward amendment; never alters normative text or past receipts.

---

## 14. Lineage of this document's own holes (informative)

Three adversarial rounds, each finding the layer beneath the last repair: the v0.3 diff against the global canons found the **semantic** gaps (frame, generator, qualification — what the contract must say). The v0.4 self-diff found the **binding** gaps (every new word was a string the producer could self-sign). The v0.5 self-diff found three more layers at once: the **original** words were still unbound — including the joule itself, the standard's namesake, sitting in §4.2 as exactly the estimation-laundering the section forbids; the bindings had no coordinate in **time** (resolution, rotation, expiry, editions); and cryptography stops at keys, while assurance needs **parties and consequences** — part mechanizable (entity credentials, engagement disclosure, recourse hooks), part nameable only (§10.1). The law of evolution, stated once: **each round, the standard is forced to apply its own newest rule to its own oldest text.** The standard improves by being adversarially diffed, not defended; the diffs are part of its provenance (`joulecontract-diff-v0.3-global.md`, `joulecontract-diff-v0.4-self.md`, `joulecontract-diff-v0.5-self.md`).

---

## 15. Demoted states (normative)

**Promotion, defined generally:** promotion is any downstream re-serialization, summary, or claim that presents a demoted state as its corresponding bound state — prohibited for every state below, by any consumer. Demotion is the standard's universal answer to unverifiable claims: record-as-untrusted, never forbid-and-drive-underground, never present-as-clean.

| State | Meaning | Effect |
|---|---|---|
| `undischarged` (+ reason) | An obligation no tier closed — any of the five, including an unboundable frame | Caps Rigor class below JR-3 (§10) |
| `generator_unattested` | Generator identity not bound to a non-signer attestation | Caps Governance class at declared |
| `qualified:false` | Qualification unresolvable in evidence, expired at discharge, self-signed, or unterminated chain | Discharge counts as unqualified (§6.1) |
| `independent:false` (computed) | Discharge key set not disjoint from generator key set | Fails independence at every class |
| `independent:key_only` | Keys disjoint but no party-level entity binding | Fails independence at JR-3+ (§6.2) |
| `engagement_undisclosed` | Verifier selection/compensation not disclosed as bound identities | Fails independence at JR-3+ (§6.2) |
| `recourse_undeclared` | Verifier under no recognized liability regime | Profiles MAY reject; relying parties weight accordingly |
| `self_attested` | Generation-loop receipt discharged only by the generator | Non-promotable (§6.3) |
| `unterminated` | Trust chain reaching no defined root (§5.1.2) | Treated as unattested; qualification trigger (§6.1) |
| `metered_unattested` | `Metered` tag without a sealed, non-signer meter attestation | Treated as `ModelBased` for Energy class (§4.2) |
| `ceiling_unanchored` | Ceiling without a derivation binding to its EnB | Residual carries no evidentiary weight (§4.2) |
| `component_unattributed` | Composed energy figure without per-component attribution | Cannot feed ratchet or residual claims (§3.3) |
| `breach_unamended` | Deviation with no forward-looking amendment or fix-receipt | Caps Governance class until closed (§5.2) |
| `timestamp_unanchored` | Receipt without an independent timestamp where required | Treated as predating every amendment (§5.2.1) |
| `timestamp_stale` | Receipt anchored after the profile's maximum latency | Withheld-receipt disclosure (§5.2.1) |
| `verifier_revoked_window` | Signed in the attested-compromise-to-revocation window | Treated as unattested (§6.4) |
| `target_self_assigned` | Sector-level (SIL/DAL/ASIL) equivalence claimed without a bound risk assessment | No sector equivalence may be stated (§10) |
| `validation_recorded, evidence_lost` | Sealed verdict survives; bundle lost after issuance | Verdict stands; re-checkability demoted (§5.1.3) |
| `unresolvable` | Reference never validated by the verifier of record | Treated as the corresponding `false`/unattested state |
| `evidence:external` | No sealed bundle; references float on live infrastructure | Conformant; exactly as trustworthy as that infrastructure |
| `static_only` | Frame bounded by analysis, not observed/witnessed | Disallowed at JR-4 (§10) |
| `Unaccounted` | Energy estimated where the substrate exposes nothing | Never promotable (§4.2) |

---

## 16. Amendment Log

Each entry: version, amends-digest (real, computed over the published markdown serialization of the amended version), change, reason. The log is normative history; the standard practices its own §5.2.

**v0.7.0** — amends `sha2-256:a4b8554ee0f3920c980868907360ddc4b114a2b8a30d5b5acd5f9476a4c64931` (v0.6.0)
1. **§5.1: the residual is derived, never carried.** *Reason:* a carried copy of `joules_allowed − joules_spent` could lie; the round-four implementation diff surfaced the divergence (the reference implementation refused to store it) and the implementation was right. (Round-4 F4-residual.)
2. **§10: two-stage evaluation codified — receipt-local witnesses at most JR-2/`managed`; JR-3, JR-4, and `certified` are composed verdicts over sealed evidence + key log + interval.** *Reason:* round four found a single-stage validator over-grading JR-4 from local evidence; the spec now states what a receipt alone can and cannot witness, so a non-composed high grade is non-conformant by text, not just by implementation. (Round-4 F3/F5.)
3. **§6.2: the recourse regime is a per-discharge bound field; absent serializes `recourse_undeclared` as disclosure, not a rigor cap.** *Reason:* the demoted state existed with no carrying field — named but not bindable, the exact defect class §1 forbids. (Round-4 F15.)
4. **§10: the sector-equivalence claim has a concrete structure (scheme + risk-assessment address + assessor key) and a mechanical binding test (resolves in evidence, assessor disjoint from the effective generator keys).** *Reason:* `target_self_assigned` existed with no claim to demote; the trigger is now decidable. (Round-4 F15/S7-residue.)
5. **§5.1.3: the lost/never distinction is mechanical — the bundle address decides `unresolvable` vs `validation_recorded, evidence_lost`.** *Reason:* the round-three demoted states were defined but their boundary was a judgment call; it is now a comparison. (Round-4 deferred item, closed.)
6. **§3.1: the cross-digest re-anchor record is named (forward-only log, hop-bounded resolution).** *Reason:* the migration rule existed without its record structure. (Round-4 F18.)
7. **Implementation closure recorded:** composition (§3.3) with per-component ceiling accountability and frame propagation, and the per-EnB ratchet (§5.3) with anchored-ceiling and attribution preconditions, are now implemented in the reference workspace; `component_unattributed`, `recourse_undeclared`, `target_self_assigned`, and `evidence_lost` are all producible. *Reason:* §15's vocabulary must be producible or marked future; after v0.7 every demoted state is producible.

**v0.6.0** — amends `sha2-256:86800c4bc7d5dcffd920da23370f7e3eb4acb91dc66e4038da74102b6e061441` (v0.5.0)
1. **Bound the energy axis (§4.1, §4.2, §3.3, §10): meter attestation behind `Metered` or `metered_unattested`; signed EnB; ceiling-derivation binding or `ceiling_unanchored`; energy gate in the least-bound-axis rule; residual declared a control signal, never a savings claim; composition never relicenses ceilings (per-component attribution or `component_unattributed`).** *Reason:* the standard's namesake field was its last unbound trust-bearing string — `Metered` was self-asserted, the ceiling and EnB were producer-declared, and §4.1 routed the resulting manufactured residual into CSRD disclosure: estimation laundering inside the section that forbids it. (S1, E6, E5, E7.)
2. **Sealing rule (§1, §5.1.3): conformance evaluated once at discharge and sealed; content-addressed evidence bundles; resolution-free re-verification; DID strings demoted to labels; validity windows evaluated at discharge; retention office; `validation_recorded, evidence_lost` vs `unresolvable`; `evidence:external`; air-gapped conformance.** *Reason:* "resolve" had no when and no against-what — receipts became verifiably wrong when domains changed hands, rotted when attestation stores went dark, and structurally excluded air-gapped deployments; binding-as-liveness decayed against §6's own no-invalidating-prior-receipts rule. (T1, T5, T6, T7, S5, S12.)
3. **Key lifecycle (§6.4): append-only office key log; disjointness computed as-of discharge; revocation demotes forward (`verifier_revoked_window`), never invalidates backward.** *Reason:* "revocation" did not appear in v0.5; a stolen key either invalidated thousands of receipts retroactively (against §11) or attested forever; rotation-into-overlap retroactively flipped past independence. (T2.)
4. **Temporal closure (§5.2.1, §5.1.4): transitions are intervals governed by the contract at start-anchor; prompt-anchoring latency or `timestamp_stale`; independent stamps on all receipts at JR-3+ (unanchored = predates every amendment); TSA as an office by role with jurisdictional regimes and quorum; Register pinning.** *Reason:* the temporal-ordering invariant compared against a stamp the producer scheduled — withholding a receipt slipped a breach behind a frame amendment; transitions spanning amendments were judged against contracts that hadn't admitted them; the TSA was a dependency of exactly the class §0 forbids; editions floated, letting Register updates reinterpret past receipts. (T4, S2, T3, T8.)
5. **Keys→parties→consequences (§6.2, §5.1.1): generator key set defined; §6.2's computation named as key disjointness (floor); legal-entity credentials at JR-3+ (`independent:key_only` below the bar); engagement disclosure or `engagement_undisclosed`; recourse hook or `recourse_undeclared`; common-control and issuer-pays as named residuals (§10.1); §12's "structurally impossible" retracted.** *Reason:* computed independence was Sybil-trivial (two $12 domains, one owner) and its operand was undefined; verifier markets are issuer-paid with zero signature downside — part bindable with instruments the spec already inherited (eIDAS seals) and never deployed, part not mechanizable by any document and now named instead of over-claimed. (E1, E2, E8, S6.)
6. **Incentive repair (§5.2, §10): `breach_unamended` caps Governance until closed; amendment ceilings office-priced and de minimis; claim-discipline rule (full tuple + demotion disclosure, or the claim is non-conformant); the honest equilibrium named — the standard prices honesty, relying parties price assurance, the demoted floor is intended.** *Reason:* governed change cost joules/stamps/quorum while silent breach cost nothing — the meter taxed honesty and missed the budgeted flooder; and the all-demoted conformant receipt was the market's rational equilibrium, harvestable as a halo unless the claim itself must disclose its demotions. (E4, E3.)
7. **Recursion and quorum closure (§5.2.2, §6): normative minimal amendment-contract as base case (amendments chain, never meta-amend); verifier office defined (membership, key log, succession); quorum MUST at JR-3+ across party-disjoint verifiers, k ≥ 2; "implies" replaced; quorum-economics paragraph (deterministic re-execution is why quorum is affordable).** *Reason:* amendment-as-transition was a new unterminated recursion; quorum was simultaneously SHOULD (§6) and MUST (§5.2.1) over an undefined "office," satisfiable at k=1/n=1, and keys-of-one-office quorum was defeated by capturing that office. (S8, S4, E9.)
8. **Rigor class replaces borrowed SIL (§10, §2.1, §3): JR-1..4 defined by this standard's own requirements; sector equivalence only via bound risk-assessment attestation, else `target_self_assigned`; rigor target recorded in the contract; `profile` added to §1; frame mode `attested` (independent witness/receiver) restores the cross-domain assurance claim; ratchet scoped per-EnB.** *Reason:* SIL was self-assigned with no hazard analysis — canon misuse of the class rounds 1–2 policed, and an escape hatch (declare SIL-1, evade every gate); software-only frame modes had quietly capped every non-computational transition below high rigor, breaking the claim the standard was born from; the ratchet across an EnB change was a comparison §4.3 forbids. (S7, S9, T10.)
9. **Hygiene: exemplar made conformant (all seven obligations discharged); §15 table completed and reconciled with §10 (non-frame `undischarged` caps; unterminated as qualification trigger; `static_only` disallowed at JR-4; timestamp rows); one root vocabulary (`human-attested`; `human-authored` retired); promotion defined generally; `transition`/`execution` defined (§5.1.5); grammar; real digests in this log.** *Reason:* the showcase receipt failed the standard it showcased; the demoted-state table promised effects no profile delivered; three roots were declared as two; the self-hosting chain was four versions of angle-bracket placeholders — the Self-Hosting Clause was undischarged by its own vocabulary. (S3, S10, S11, S13, S14, T9.)

**v0.5.0** — amends `sha2-256:ee932a71b94d71ddd4fc1abfb5805f2066e925fa17b6587b735cfdfc61b3835a` (v0.4.0). Binding rule; no closed unbounded frame; composition never relicenses (frames); trust-chain termination; bound generator; temporal-ordering invariant; metered amendments; deterministic/stochastic tier split; computed independence; least-bound-axis rule; canon-fidelity corrections; demoted-state vocabulary.

**v0.4.0** — amends `sha2-256:97a957abac569d07d0a3a71dcdd418378ae1f852108280f549329c19cde0222a` (v0.3.0). Frame as fifth obligation; generator identity; discharge-tier qualification; per-obligation independence; generation-loop composition; adequacy residual named; resource-bound precise claim; security considerations.

**v0.3.0** — amends `sha2-256:1c4bd6a0232174a04f6a04857fd7522c9799873d963da89692a8c024992f73b8` (v0.2.0). Self-Hosting Clause; cryptographic agility; cross-domain ledger rule; economic granularity; verifier office + quorum; stewardship succession; inheritance by role with Register; composition.

**v0.2.0** — amends `sha2-256:8c042e984dd54400a78bbafb654efac3dc8031b191b14c302e31d5f5888128cd` (v0.1.0). Re-founded on the recognized canon (IEC 61508, ISO 50001/30134, ISO/IEC 42001); composed profile replaced the invented ladder.

**v0.1.0** — genesis. Core object (pre/post/inv/ceiling), receipt, amendment-as-transition, breach redefinition, energy-as-coordinate, verifier-of-record, recognized-edge emission.

---

## Appendix A — Example (informative)

```json
{
  "joulecontract": "0.7.0",
  "subject": "fn settle_batch(orders) -> Settlement",
  "rigor_target": "JR-3",
  "pre":   ["all orders signed", "sum(debits) == sum(credits)"],
  "post":  ["ledger balanced", "each order has a settlement id"],
  "inv":   ["no order in two settlements", "no negative balance at any step"],
  "frame": ["ledger table", "settlement index"],
  "ceiling": {
    "enpi_joules": 3.0, "unit": "EOC-J",
    "enb_ref": "sha2-256:ab19…",
    "derivation": { "ref": "sha2-256:dc41…", "basis": "metered median of 200 comparable batches", "signer": "did:web:energy-office.example" }
  },
  "amends": "sha2-256:9b2c…"
}
```

```json
{
  "ReceiptPayload": {
    "contract":  "sha2-256:1f4a…",
    "transition":"sha2-256:77de…",
    "interval": { "start_anchor": { "authority": "did:web:tsa-1.example", "at": "2026-06-10T14:00:02Z" },
                  "receipt_anchor": { "authorities": ["did:web:tsa-1.example", "did:web:tsa-2.example"], "at": "2026-06-10T14:02:11Z", "latency_ok": true } },
    "generator": {
      "system": "joulecode-agent", "model": "claude-opus-4-8",
      "version_digest": "sha2-256:5c0d…",
      "attestation": { "ref": "sha2-256:77aa…", "signer_keys": ["sha2-256:k9aa…"], "binding": "attested" },
      "key_set": ["sha2-256:k1ff…", "sha2-256:k9aa…", "sha2-256:k3b2…"],
      "human_principals": ["did:web:eng-a.example"],
      "context": "ticket SETL-4821",
      "loop_governance": { "contract": "sha2-256:90ef…", "discharged_by": "did:web:audit-a.example", "root": "human-attested" }
    },
    "discharge": [
      { "obligation": "pre: all orders signed",        "tier": "sha2-256:t0aa…", "tier_class": "deterministic", "result": "closed",
        "qualification": { "ref": "sha2-256:q0…", "signer": "did:web:assessor.example", "valid_until": "2027-06-01", "validated_at": "2026-06-10", "root": "human-attested", "qualified": true },
        "verifier": "did:web:audit-a.example", "independence": "party", "engagement": { "selected_by": "did:web:relying-bank.example", "compensated_by": "did:web:relying-bank.example" } },
      { "obligation": "pre: sum(debits) == sum(credits)", "tier": "sha2-256:t0aa…", "tier_class": "deterministic", "result": "closed",
        "qualification": { "ref": "sha2-256:q0…", "signer": "did:web:assessor.example", "valid_until": "2027-06-01", "validated_at": "2026-06-10", "root": "human-attested", "qualified": true },
        "verifier": "did:web:audit-a.example", "independence": "party", "engagement": { "selected_by": "did:web:relying-bank.example", "compensated_by": "did:web:relying-bank.example" } },
      { "obligation": "post: ledger balanced",          "tier": "sha2-256:t1bb…", "tier_class": "deterministic", "result": "closed",
        "qualification": { "ref": "sha2-256:q1…", "signer": "did:web:assessor.example", "valid_until": "2027-06-01", "validated_at": "2026-06-10", "root": "human-attested", "qualified": true },
        "verifier": "did:web:audit-a.example", "independence": "party", "engagement": { "selected_by": "did:web:relying-bank.example", "compensated_by": "did:web:relying-bank.example" } },
      { "obligation": "post: each order has a settlement id", "tier": "sha2-256:t1bb…", "tier_class": "deterministic", "result": "closed",
        "qualification": { "ref": "sha2-256:q1…", "signer": "did:web:assessor.example", "valid_until": "2027-06-01", "validated_at": "2026-06-10", "root": "human-attested", "qualified": true },
        "verifier": "did:web:audit-b.example", "independence": "party", "engagement": { "selected_by": "did:web:relying-bank.example", "compensated_by": "did:web:relying-bank.example" } },
      { "obligation": "inv: no order in two settlements", "tier": "sha2-256:t3cc…", "tier_class": "deterministic", "result": "closed",
        "qualification": { "ref": "sha2-256:q2…", "signer": "did:web:assessor.example", "valid_until": "2027-06-01", "validated_at": "2026-06-10", "root": "reference-impl", "qualified": true },
        "verifier": "did:web:audit-b.example", "independence": "party", "engagement": { "selected_by": "did:web:relying-bank.example", "compensated_by": "did:web:relying-bank.example" } },
      { "obligation": "inv: no negative balance at any step", "tier": "sha2-256:t3cc…", "tier_class": "deterministic", "result": "closed",
        "qualification": { "ref": "sha2-256:q2…", "signer": "did:web:assessor.example", "valid_until": "2027-06-01", "validated_at": "2026-06-10", "root": "reference-impl", "qualified": true },
        "verifier": "did:web:audit-b.example", "independence": "party", "engagement": { "selected_by": "did:web:relying-bank.example", "compensated_by": "did:web:relying-bank.example" } },
      { "obligation": "frame: ledger+index",            "tier": "sha2-256:t2dd…", "tier_class": "deterministic", "result": "closed", "mode": "observed",
        "qualification": { "ref": "sha2-256:q3…", "signer": "did:web:assessor.example", "valid_until": "2027-06-01", "validated_at": "2026-06-10", "root": "human-attested", "qualified": true },
        "verifier": "did:web:audit-a.example", "independence": "party", "engagement": { "selected_by": "did:web:relying-bank.example", "compensated_by": "did:web:relying-bank.example" } }
    ],
    "execution": ["sha2-256:x0aa…", "sha2-256:x3bb…"],
    "joules_spent": 2.1,
    "meter": { "attestation": "sha2-256:m7ee…", "signer": "did:web:substrate-telemetry.example", "category": "Metered" },
    "joules_allowed": 3.0,
    "provenance": "Metered",
    "enb_ref": "sha2-256:ab19…",
    "grid_mix": { "renewable": 0.61, "region": "eu-w-1", "attestation": "sha2-256:g2cc…" },
    "verifier": ["did:web:audit-a.example", "did:web:audit-b.example"],
    "verifier_entities": [ { "did": "did:web:audit-a.example", "entity": "vLEI:5493…A1" }, { "did": "did:web:audit-b.example", "entity": "vLEI:5493…B2" } ],
    "profile": { "rigor": "JR-3", "energy": "Metered", "governance": "certified" },
    "register_pin": "sha2-256:r8ff…",
    "evidence": { "bundle": "sha2-256:e4dd…", "sealed": true },
    "signature": "eIDAS-QES…"
  }
}
```

Every declared obligation — both preconditions, both postconditions, both invariants, and the frame — carries a discharge entry, as §5.1 requires of any receipt, including this showcase. The receipt verifies without network access: all referenced attestations, key material, and the EnB are sealed in bundle `e4dd…`; the DID strings are labels. Independence is party-level (vLEI-bound entities disjoint from the generator), engagement is relying-party-paid (not issuer-paid — and the disclosure is what lets a reader see that), the energy figure carries a substrate-signed meter attestation, the ceiling carries its derivation, the interval is dual-anchored, and the Register snapshot is pinned. The JR-3 claim is legal under §10 because every supporting field on **all three axes** is bound — which is the claim-discipline rule satisfied in full: tuple, plus demotions (none), visible.

---

*End of v0.7.0 — a traced amendment of v0.6.0 under the standard's own §5.2, with the four adversarial diffs that produced it recorded in its provenance.*