d43ce9e55b
By the family's bar a standard ships conformance vectors a third party can reproduce — that is what makes it vendor-neutral rather than one library's behaviour. joule-ui-conformance provides shared fixtures, a deterministic vector generator, and self-verifying tests, with the pack in conformance/v1/: - C1 surface validation — exhaustive error list (valid → none; invalid → every planted fault, not first-only). - C2 interaction metering — run_interaction over a fixed-step meter reproduces the Interaction (allow, 4200 µJ HwShunt, content addresses). - C3 authorization — a zero-budget Authorizer denies before the handler runs; handler_ran=false, outputs=genesis sentinel. - C4 chain integrity — verify_chain accepts a sealed allow/allow/deny chain; excising index 1 breaks it at index 1. Fixed Ed25519 steward key (0x17*32, attests nothing) and fixed meter steps make every vector reproducible. conformance/README.md is the implementer's guide; MANIFEST.json content-addresses each vector. The suite pins the protocol + receipt, not the renderer/transport/widgets (product surfaces) — metering and capability stay recognized edges, stubbed deterministically in the vectors. 4 conformance tests; the crate is clippy-clean. Co-Authored-By: Claude Fable 5 <[email protected]>
2.7 KiB
joule-ui conformance vectors — v1
Deterministic vectors for independent joule-ui implementations (SPEC §8). Regenerate with:
cargo run -p joule-ui-conformance --bin gen_vectors
A conforming implementation reproduces these from the published JSON alone —
that is what makes joule-ui a vendor-neutral standard rather than one library's
behaviour. Fixed Ed25519 steward key (0x17×32, published, attests nothing) and
fixed meter steps make every vector reproducible.
| Vector | Class | What a conformant implementation must do |
|---|---|---|
c1-validation.json |
C1 — surface validation | Run validate(tree, registry) over both surfaces. The valid one yields no errors; the invalid one yields the exhaustive list (every planted fault — unknown widget, missing required prop, mistyped prop, forbidden child — not just the first). |
c2-interaction.json |
C2 — interaction metering | run_interaction over a deterministic meter (step 4200 µJ) reproduces the Interaction: allow, energy 4200 µJ [HwShunt], and the content addresses of surface, inputs, and outputs. The surface id is the BLAKE3 of the canonical valid_surface JSON; inputs/outputs are content-addressed, never embedded. |
c3-authorization.json |
C3 — authorization | A zero-budget Authorizer denies the action before the handler runs: expected_handler_ran is false, the verdict is deny("budget-exceeded"), and the outputs are the genesis sentinel. A conformant runtime MUST NOT execute a denied action's handler. |
c4-chain.json |
C4 — chain integrity | verify_chain accepts the three-link chain (allow, allow, deny). Removing index 1 MUST break it at index 1: every signature verifies, seq increments from zero, and each link's prev is the prior link's content id, so no interaction can be excised, reordered, or mutated without detection. |
MANIFEST.json |
— | Verify each vector's BLAKE3 content address before relying on it. |
What conformance pins, and what it does not
joule-ui pins the protocol and the receipt, not the product surfaces around
them. There is no renderer vector (the renderer is the host's), no transport
vector (the consumer's — MCP/SSE/Web MoQ), and no widget-library vector (product
surface). The metering and capability mechanisms are recognized edges (SPEC
§9): C2/C3/C4 use a deterministic stub meter and a stub budget so the vectors are
reproducible, while a deployment wires the Sandbox PowerMeter (real hardware)
and a JCP grant. What conformance guarantees is the load-bearing claim — that an
interaction is validated, authorized-before-running, metered, and sealed into a
tamper-evident chain, identically across implementations.