| Filename | Latest commit message | Latest commit date |
|---|---|---|
2688e2b936
Some checks failed
wai cross-architecture byte-equality / windows-x86_64 (pull_request) Successful in 23s
wai cross-architecture byte-equality / linux-aarch64 (pull_request) Successful in 40s
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Failing after 1m3s
WAI conformance / cargo-class corpora · windows (pull_request) Successful in 1m13s
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Successful in 1m8s
wai cross-architecture byte-equality / macos-arm64 (reference) (pull_request) Successful in 1m57s
WAI conformance / cross-arch byte-equality · windows (pull_request) Successful in 23s
jouleclaw public surface must stay documented / Public-surface audit (jouleclaw-rs) (pull_request) Successful in 58s
no-vanity-metrics / Scan committed Markdown for vanity metrics (pull_request) Successful in 3s
standards workspaces build + test / jcp-rs (pull_request) Failing after 12s
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Successful in 39s
standards workspaces build + test / sandbox-rs (pull_request) Successful in 2m1s
wai cross-architecture byte-equality / linux-x86_64 (pull_request) Has been cancelled
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
WAI neural decoders end-to-end / synthetic fixtures → Rust decode → reference (±4) (pull_request) Has been cancelled
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
standards workspaces build + test / smart-byte-rs (pull_request) Has been cancelled
Lockfiles only — newest versions WITHIN the semver ranges the manifests already declare. No manifest constraint was widened by this commit. That distinction is load-bearing here. `cargo upgrade`, which rewrites manifests to the latest major, is precisely what killed smart-byte: rand was pinned to "0.10" against source written for 0.8, and the crypto stack it sits on (ed25519-dalek, curve25519-dalek, bls12_381, bulletproofs) all require rand_core 0.6 — so 0.8 is a ceiling those crates impose, not a preference. Moving past it means waiting for that ecosystem or migrating 41 call sites of cryptographic code, and neither belongs in a routine update. Largest moves: smart-byte 207 packages, openpay 189, jouleclaw 182, eoc 164. Verified on 1.98.0 with the updated lockfiles — 12 workspaces green: smart-byte 616 openpay 1935 joule-code 278 jcp 258 map 220 sandbox 186 aac 89 joulecontract 82 arl 58 sense 38 proof 31 joulehook 24 One pre-existing failure is deliberately NOT addressed here: jouledesk's `the_joule_budget_is_enforced_across_tags` seals two decisions where the budget permits one. It fails identically on the original lockfile, so it is not a dependency problem — it is a budget-enforcement defect in the Joule Desk standard, and a ceiling that seals a receipt for work it refused deserves its own fix and its own commit rather than burial in a dependency sweep. Co-Authored-By: Claude Opus 4.8 <[email protected]> |
||
| .. | ||
| conformance | ||
| joule-ui-rs | ||
| LICENSE | ||
| README.md | ||
| SPEC.md | ||
joule-ui
A typed declarative protocol for agent-emitted user interfaces.
joule-ui is the sibling to JouleClaw for the moment when an
agent's resolution has to become something a human can see and interact
with. The agent emits a widget tree — (name, props, children),
recursively — against a widget registry the host has published. The
host renders. No React in the spec, no HTML over the wire, no agent
holding the renderer.
The shape the field has converged on for this is declarative components against a registry: agents are far more reliable emitting structured data than emitting code, and renderers are far easier to harden when they own their own widgets. joule-ui pins that shape as a protocol; the renderer is product surface, owned by the consumer.
What ships in v1
-
joule-ui-rs/crates/joule-ui-core/— the protocol types (Widget,PropValue,WidgetSchema,Registry) and the recursive validator. Pure Rust, no IO, JSON-serialisable. -
joule-ui-rs/crates/joule-ui-interaction/(v0.2) — the layer no other UI protocol carries: when a human or an agent fires anAction, the invocation is an accountable event. Every fire names the principal that made it — adid:key, the same whether a person or an agent (the protocol draws no distinction; both are traced).run_interactionauthorizes it against a capability before it runs (a denied action's handler never executes), meters it in joules, charges the measured cost, and anInteractionLogseals it as the next link of a hash-chained receipt. The actor is bound into the signed core, so an interaction cannot be re-attributed without breaking the chain. A joule-ui session becomes a tamper-evident ledger of who fired it, what it computed, and what it cost — verifiable by anyone holding the host's key. The metering (SandboxPowerMeter) and the capability (JCP grant) are recognized edges; the receipt, the chain, and the lifecycle are joule-ui's. SeeSPEC.md§5–§7 andexamples/metered_surface.rsfor the full loop.
The surface layer makes joule-ui a peer of the declarative-UI protocols (A2UI, MCP Apps). The interaction layer makes it the only one you can hand to an auditor: a UI whose every interaction is energy-accounted and sealed, by construction.
What is not here:
- A renderer. The renderer is owned by the host (browser app, native shell, terminal UI). joule-ui validates the surface and seals the interaction; it does not paint pixels.
- A transport. The validated spec and the interaction stream ride MCP, REST, SSE, gRPC, Web MoQ — any bytes-out protocol. Transport-agnostic.
- A "model emits React" path. The agent emits a declarative tree against the registry; arbitrary code emission is out of scope.
Why a sibling, not inside JouleClaw
The spec layer is protocol — small, stable, conformant. The renderer registry is product surface — many of them, evolving fast. Splitting them protects the tools for use line: JouleClaw stays the runtime substrate; joule-ui is the UI protocol; consumers ship their own widgets.
Licence
Specification text and protocol document: CC-BY-4.0 (see LICENSE).
Reference implementation in joule-ui-rs/: Apache-2.0.