open-standards/joulecontract/provenance

Provenance — adversarial diff as governance

This standard improves by being adversarially diffed, not defended. Each published version was attacked by independent, mutually-blind review lenses; the findings were published as a diff document; the repairs were folded into the next version as a traced amendment under the standard's own §5.2, chained to the real digest of the version it amends. The diffs are therefore part of the standard's provenance, not commentary on it.

Round	Document	Lenses	What it found
1	joulecontract-diff-v0.3-global.md	global AI-coding canon · highest-regulated code ecosystems	The semantic gaps: no frame clause, no generator identity, unqualified verifier tooling — six gaps, folded into v0.4.
2	joulecontract-diff-v0.4-self.md	second-order regressions · new attack surfaces · canon fidelity	The binding gaps: every new field was a string the producer could self-sign; two unterminated recursions; two canon over-claims — twenty findings, folded into v0.5.
3	joulecontract-diff-v0.5-self.md	temporal/operational semantics · economics & collusion · spec-lawyer consistency	The time, party, and incentive gaps: the joule itself was the last unbound field; bindings had no evaluation point in time; keys are not parties and parties need consequences — thirty-three findings, folded into v0.6.
4	joulecontract-diff-v0.6-impl.md	spec-vs-code fidelity · Rust soundness & adversarial inputs	The implementation gaps: four guarantee bypasses (case-variant key forgery, the entity-omission Party hole, caller-supplied key sets, reseal-under-any-key) and a validator that over-graded JR-4 from receipt-local evidence — twenty-eight findings, repaired in joulecontract-rs with the local/composed validator split; the spec consequences folded into v0.7.
5	joulecontract-diff-v0.7-pack.md	clean-room implementability (spec + vector pack only, reference code forbidden)	The publication gaps: a receipt-local validator was buildable from the artifacts alone, the composed validator was not — the bundle construction, the negatives' sealed contexts, the key-log event model, and the quorum scope lived only in unreadable code, and the obvious canonicalization RFC produced the wrong digest. Seventeen findings; folded into v0.8 (six normative definitions) and a pack expansion from 13 to 22 vectors with every composed input shipped. The pack itself had been running evidence:external; v0.8 seals it.

The pattern, stated once: each round forces the standard to apply its own newest rule to its own oldest text. The chain anchors live in ../archive/ byte-exact; verify with shasum -a 256 ../archive/*.md against the amendment log in ../SPEC.md §16.