# JouleContract v0.4 — Self-Diff (do the repairs open anything new?)

**Method:** v0.4 was attacked from three independent, mutually-blind adversarial lenses — (1) second-order logical regressions, (2) new attack surfaces the new fields create, (3) canon over-claims the new citations introduce. A self-diff that only confirmed the repairs would be worthless; this one was run to break them. It broke them in four clusters.

**Verdict:** Yes — the repairs opened new holes, and they are not scattered. v0.4 closed the **semantic** gaps (what a contract must *say*) but the repairs introduced **binding** gaps (whether what it says is bound to anything) plus two **canon over-claims**. The good news is the same as in the v0.3 diff: the new flaws collapse to a small number of root fixes.

**The one-sentence meta-finding (all three lenses independently reached it):** v0.4 added the *names* of trust — `generator`, `frame`, `qualification`, `independent` — without *binding* them to a key, a timestamp, or an external party. So each new required field is currently a string the incentivized producer writes and self-signs, and the standard's load-bearing claim ("every trusted output names what makes it trustworthy, **or is recorded as untrusted**") fails in its second clause: nothing in v0.4 *demotes to untrusted* a field that is merely *named* rather than *bound*.

---

## Cluster 1 — `frame: unbounded` is an escape hatch that reopens the exact hole §3.4 closes
*(Highest leverage: one fix resolves five findings — R3, R4, R5, R9, A3.)*

§3.4 closes the frame problem, then hands back the key: *"where a transition's full footprint cannot be statically bounded, the frame MUST be declared `unbounded` with a reason."* A frame of `unbounded` means **nothing** is implicitly invariant — semantically identical to having no frame at all, which is precisely v0.3's hole, now relabeled "a disclosure." A disclosed hole is still a hole.

It propagates:
- **R4 / composition:** §3.3 makes a composed frame "no larger than the union of component frames." One `unbounded` leaf poisons the union — the whole pipeline collapses to no-frame, and *every receipt stays conformant*. (Separately, union **widens** each component's permission: component A with `frame:{ledger}` composed with B's `{index}` is now permitted to touch `index`, voiding A's own declared footprint.)
- **R5 / profile:** §10 says SIL-4 "implies frame discharge" — but `frame: unbounded` *is* a frame discharge under §3.4, so the strongest safety class's strongest new guarantee is trivially satisfiable and therefore vacuous.
- **R9 / A6 / breach:** §5.2 says "out-of-frame effect + signed amendment = governed change." With `unbounded` there is no "outside," and frame is amendable, so a producer can pre-declare or retroactively widen to legalize arbitrary effect.

**Root fix (resolve by principle, mirroring `Unaccounted`):** demote `unbounded` from a *closed* discharge to a graded *category that is never a free pass*. An un-boundable frame serializes as `frame: undischarged + reason` (the mechanism §5.1 already has) — non-promotable, capping the achievable Safety class (no SIL-3+ over an unbounded frame), and in composition it surfaces at the top with the offending leaf reference so it cannot hide. This single change restores teeth to R4, R5, R9, A3, A6 at once.

---

## Cluster 2 — two unterminated recursions imported without their terminators
*(R1, R2, A9 — both are MUST-recursions on the receipt critical path, i.e. direct hits on "no illogic.")*

- **R2 — who qualifies the qualifier?** §6.1 mandates every discharge reference "the qualification attestation of the tier that closed it." A qualification attestation is itself a trusted output produced by some process — so by §6.1's own logic it is a qualification target requiring its own qualification, *ad infinitum*. v0.4 quoted DO-330's TQL ladder but omitted the thing DO-330 has that stops the regress: qualification grounds in **human assessor / certification-authority sign-off**, not in another tool.
- **R1 / A9 — generator bootstrap.** §6.3 says a generator SHOULD run "under its own JouleContract," whose receipt names *its* generator, which runs under its own contract… no base case. Worse (A9): the inner receipt is produced *by the generator about itself*, so a compromised/goal-hijacked agent issues its own clean governance receipt — circular, and §12 leans on this circularity as the bound on the generation-loop threat.

**Root fix (name the ground the canon already uses):** every qualification/generator chain MUST terminate at a defined leaf — either **human-attested** (the assessor of record, signed) or a **reference-implementation** whose soundness is a cited proof (the deterministic tiers). Mark roots `qualification: human-attested` / `qualification: reference-impl` and `generator: human-authored`. The human-principal field already exists in §5.1.1; no new machinery. And generation-loop governance MUST be discharged by a verifier *external* to the generator (self-issued generation-loop receipts are `self_attested` and non-promotable), or §6.3 is security theater.

---

## Cluster 3 — named-but-not-bound: every new field is self-asserted by the incentivized party
*(A1, A2, A4, A5, A7, A8, R6, R7 — the security core of the self-diff.)*

| # | Field | The exploit (as an attacker runs it) | Bind it to |
|---|---|---|---|
| **A1** | `generator` | Run an unaligned model; write `"model":"claude-opus-4-8"` + any `version_digest`; sign with my own key. Signature attests "I signed it," not "this digest is what ran." Generator identity and signer are decoupled with no link asserted — *weaker* than the SLSA builder-identity binding §5.1.1 claims to clear. | `version_digest` MUST resolve to a producer attestation signed by a key **distinct from the receipt signer**, or serialize `generator_unattested`. |
| **A2** | `frame` tier | My transition writes outside its declared frame; I "discharge" frame with a no-op tier I control. §6.1 explicitly lets an unqualified, non-independent tier *close* the obligation. Nothing forces the frame tier to **observe execution**. | Frame discharge MUST be independent of the generator at **SIL-2+** (not only SIL-4); a static-only frame check carries a `static_only` qualifier (declared-and-typechecked ≠ observed-and-confined). |
| **A4** | `qualification` | The MUST is satisfied by a *reference* (a digest). Nothing requires it to resolve, be unexpired, or be signed by anyone but me. I self-issue "Qualification of JP-L3-smt, TQL-1," hash it, cite it. §12's "tool-trust bounded by disclosure" is false — I disclosed a pointer to my own rubber stamp. | Reference MUST resolve to a signed attestation, signer ≠ tier operator ≠ generator, with a validity window; else `qualified:false`. The verifier of record validates the chain at discharge. |
| **A5** | `independent` | I am the generator *and* the checker; I write `"independent": true`. A boolean asserted by the party with the incentive to assert it. | `independent` MUST be **computed from key-disjointness**, not copied from a producer-supplied boolean: the discharge entry must be co-signed by a `verifier` key disjoint from the `generator` key set, else it serializes `false` regardless of what the producer wrote. |
| **R6** | per-obligation verifier | §6.2 made independence per-discharge but the `verifier` field is a single global list — you cannot tell *which* verifier independently discharged *which* obligation. The flag is unfalsifiable against the receipt. | Bind verifier DID(s) **into each `discharge` entry** alongside `independent`/`qualification`; the global `verifier` field becomes the derived union. |
| **A6** | frame/ceiling amendment | Exfiltrate outside frame; when detected, sign a reasoned amendment *widening* the frame — §5.2 turns the breach into "governed change" after the fact. Ordering is producer-controlled. | **Temporal pre-commitment:** an amendment governs only effects whose receipts are timestamped *after* it by an independent (eIDAS) timestamp authority. A past out-of-frame effect stays a breach permanently — amendments change future footprint, never reclassify a past effect. |
| **A7** | amendment flooding | §12 says flooding is "bounded by attribution and signature." A key-holding insider satisfies both — emit 10⁴ signed junk amendments around a real breach amendment; the audit log (the assurance case itself) becomes a haystack. The joule ceiling, the standard's one cost-binding primitive, is **not applied to amendments**. | Make amendments real JouleContract transitions bearing a ceiling + metered `joules_spent` (make §0 self-hosting true for amendments); require quorum co-signature on frame/ceiling amendments. |
| **A8** | profile halo | §4.2 non-promotion protects only the energy axis. I file `Unaccounted` energy but decorate with a clean `generator` (A1), `independent:true` (A5), sham `qualification` (A4) → a `⟨SIL-3, Unaccounted, certified⟩` receipt that is mostly fraudulent but conformant; the high Safety/Governance axes lend credibility to the weak energy figure. | The profile tuple is only as trustworthy as its least-bound axis; `SIL-3+` MUST NOT serialize unless qualification + independence are *verified* (A4/A5 fixed). |

**Through-line:** these are one bug. The fix family is uniform — **derive trust mechanically (key-disjointness, resolvable signed attestations, independent timestamps) rather than accept self-assertion; and demote-to-untrusted any field that is named but not bound.** That is exactly the second clause of §12 that v0.4 wrote but did not implement.

---

## Cluster 4 — canon over-claims the repairs introduced
*(C1, C2 blockers; C3, C4 serious; C5 minor. These violate the author's own "precise claims only" rule.)*

- **C1 [blocker] — stochastic tiers cannot be DO-330-qualified.** §6.1's "the cascade is not exempt from the standard it serves" and §15(3)'s "an unqualified cascade is an unqualified tool" imply the whole cascade is a *qualification target*. DO-330 qualifies tools with *defined, reproducible, bounded* behavior. An LLM samples a distribution — variance even at temperature 0 — so model-based tiers are **categorically not qualifiable**. The examples §6.1 lists (SMT, type checker, static analyzer, model checker) are all deterministic and *are* qualifiable; the framing smuggles the stochastic tiers in with them. A DO-330 reviewer flags this instantly. **Fix:** split tiers — *deterministic = qualifiable, MUST carry a qualification record; stochastic/model-based = NOT qualifiable, MUST be recorded unqualified, MAY only close an obligation that is independently re-discharged by a qualifiable tier.* High-assurance discharge never rests on a model verdict alone. (This is also the only reading consistent with the family's own "inference is a bounded last resort, not the control plane" doctrine — and it simultaneously terminates R2 and kills A4's sham-qualification-as-high-assurance path.)
- **C2 [blocker] — ASIL decomposition reduced to "conjunction" drops its load-bearing precondition.** §3.3 calls decomposition "conjunction over the composing contracts, not new machinery." ISO 26262 ASIL decomposition is valid *only* under proven **freedom-from-interference + absence of common-cause failure** (26262-9 Cl. 5, dependent-failure analysis). Plain conjunction carries no independence guarantee — two contracts with a common-cause failure both report "closed." Internally inconsistent too: §3.4 cites 26262 FFI correctly and §6.2 adds an independence flag, yet §3.3 invokes decomposition without binding to either. **Fix:** decomposition is conjunction **only when the contracts are demonstrably independent** (FFI + no-CCF, recorded via §6.2 + a dependent-failure rationale); absent that, the original undecomposed obligation stands.
- **C3 [serious] — DO-178 lineage inversion.** §2.1 casts DO-178C/330/333 as "the avionics derivation" of IEC 61508. DO-178 *predates* IEC 61508 (DO-178 1982 → 178B 1992; IEC 61508 1998–2000) and developed independently; influence ran the *other* way. ISO 26262 / IEC 62304 / EN 50128 *are* fairly called 61508-aligned sector standards — DO-178C is the exception that breaks the single-root framing. **Fix:** inherit the avionics family "on its own authority… independently-evolved," the same honest phrasing §3.4/§14 already use.
- **C4 [serious] — two different "frames" conflated under one citation.** §9 lists "the frame problem (McCarthy & Hayes) **and** separation logic's frame rule" as co-equal sources for the `frame` clause. They share a word, not a concept: McCarthy/Hayes frame *axioms* = what does NOT change across an action (this **is** the `frame` clause — its true modern ancestor is JML `assignable` / Dafny `modifies`); separation logic's frame *rule* (`{P}C{Q} ⊢ {P∗R}C{Q∗R}`) is a *proof-composition / locality* technique — i.e. a way to **discharge** a footprint claim, not the claim itself. The example even names a `JP-L2-separation` tier to *discharge* frame, confirming the split. **Fix:** McCarthy/Hayes = what the clause *is*; separation logic = one *discharge technique* for it.
- **C5 [minor] — DO-333 paraphrase in quote marks.** "will never provide unwarranted confidence" is a fair paraphrase of soundness but is presented as verbatim. Drop the quotes or attribute as paraphrase. Substance is correct.

---

## What v0.4 got right (verified, not assumed)
A diff that only finds holes is as dishonest as one that only finds wins. Three things were attacked and held:
- **§10.1 adequacy residual** — honestly hedged ("named, not claimed closed… neither fully mechanizes"); the move is logically correct (a silent completeness claim would be the real illogic). **Cleared (C6).**
- **§5.1.1 / §8 generator-identity = OWASP AISVS / AI-BOM** — accurate; AISVS App. C control **AC.9.1** does *require* (not merely recommend) signed origin + generation metadata + AI-BOM identifying the AI system, context, and humans. One precision nit: AC.9.1 is an L2 control — scope to L2/L3, don't imply universal baseline. **Cleared (C7).**
- **§13 Register** — every load-bearing edition verified real and current: IEC 61508:2010 Ed.2 ✓, ISO/IEC 30134-2:2026 (pub. 16 Jan 2026) ✓, EN ISO/IEC 42001:2026 ✓, ED-324/ARP6983 (exp. June 2026, frozen supervised ML ≤ DAL C) ✓, SLSA v1.2 (24 Nov 2025) ✓. No hallucinated or not-yet-published entries. **Cleared (C8).**

---

## Proposed v0.5 amendments (under §5.2 — attributed, reasoned, chained)

The 20 findings consolidate to **seven** fixes (note how many findings each one closes — the flaws are correlated, not independent):

1. **Demote `frame: unbounded` to a graded, non-promotable `undischarged` category** (closes R3, R4-poison, R5, R9, A3, A6-partial). Mirror `Unaccounted`: never a free pass, caps Safety class, surfaces to the top of any composition.
2. **Fix frame composition** (closes R4): the composed frame constrains the aggregate but never relicenses a component beyond its own declared footprint; `unbounded` leaf → `undischarged` composite, not silently `unbounded`-closed.
3. **Terminate both recursions at a named root** (closes R1, R2, A9): qualification/generator chains bottom out at `human-attested` or `reference-impl`; the human-principal field already exists.
4. **Bind every named-trust field to a key, an external attestation, or a timestamp — and demote-to-untrusted otherwise** (closes A1, A2, A4, A5, A7, A8, R6): generator-digest signer ≠ receipt signer; `independent` computed from key-disjointness; `qualification` must resolve to a signed, unexpired, independent attestation; verifier DID bound into each discharge entry; profile axis trustworthiness gated on *verified* (not asserted) qualification/independence.
5. **Temporal pre-commitment for amendments** (closes A6): an eIDAS-timestamped amendment governs only later-timestamped effects; a past breach stays a breach. Amendments themselves are metered JouleContract transitions with a ceiling, and frame/ceiling amendments require quorum co-signature (closes A7).
6. **Split discharge tiers into qualifiable-deterministic vs unqualifiable-stochastic** (closes C1, and reinforces 3 & 4): model verdicts never satisfy high-assurance discharge alone; consistent with "inference is a bounded last resort."
7. **Canon-fidelity corrections** (closes C2, C3, C4, C5): ASIL decomposition requires demonstrated independence (FFI + no-CCF), not bare conjunction; DO-178 inherited on its own authority, not as a 61508 derivation; McCarthy/Hayes = the clause, separation logic = a discharge technique; de-quote the DO-333 paraphrase. Plus the minor scoping note that AISVS AC.9.1 is an L2 control.

**Severity roll-up:** Blockers — R1, R2 (unterminated MUST-recursions), C1, C2 (canon over-claims a domain expert seizes on), and the A-critical quartet A1/A2/A4/A6 (self-asserted trust + retroactive breach legalization). Serious — R3-R6, A3/A5/A7, C3/C4. Minor — R7, R8, A8, C5, plus the C6/C7/C8 cleared items.

**The honest headline for all public materials:** v0.4 fixed *what the contract must say*; v0.5 must fix *whether what it says is bound to anything*. The standard is converging — each adversarial pass finds a thinner, more structural layer of the same discipline: **no implicit trust anywhere, including in the words the standard itself introduced.**

---

*Self-diff executed against v0.4.0 by three independent adversarial lenses (second-order regression; new attack surface; canon fidelity). Canon facts web-verified where load-bearing: DO-330/333, ISO 26262-9 ASIL decomposition, DO-178 vs IEC 61508 chronology, McCarthy/Hayes vs separation-logic frame, OWASP AISVS AC.9.1, and all §13 Register editions.*