The field converged on spec-driven development with two-stage review
(Superpowers, spec-kit, Amplifier), but every artifact in that consensus is
prompt-enforced testimony. These three crates make the methodology
checkable, in the family's house style (canonical det-CBOR, content
addresses, Ed25519 over id ‖ context preimages):
- joule-code-spec: the Spec artifact — intent + individually addressable
clauses (requirements, constraints, and first-class NON-GOALS), signed
and content-addressed, revisions chained by parent. A signed Citation
binds a coding op to the clauses it claims to implement (the op stays
wire-identical; traceability is additive, like the receipt). coverage()
is the deterministic audit: open obligations, cited non-goals (a flag,
not a pass), and invalid citations — recorded, never silently dropped.
Completes the chain spec → clause → op → receipt.
- joule-code-review: two-stage review (spec-compliance, then quality) as
signed rounds. Separation of duties is ENFORCED, not advised: a review
whose reviewer key equals the op author's key fails verification —
self-approval is structurally void. RequestChanges without findings is
malformed; approval() audits the latest verified round per stage, with
rejected rounds kept on the record (the cost of convergence is part of
the artifact).
- joulecontract-proof: vericoding for the contract — each obligation with
an explicit Formalization (statement + grounding tag; this crate NEVER
invents one) becomes a ProofGoal citing the contract's content address
and runs the JouleProof cascade. Per-obligation ledger: Proved (full
CascadeResult, cache flywheel included) / Unproved (attempts + joules on
record) / Unformalized (demoted, never dropped). discharged() is true
only when every obligation proved — a contract is not "mostly"
discharged.
16 new tests across the three crates; clippy clean.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
31093b2680