| Filename | Latest commit message | Latest commit date |
|---|---|---|
8a0f6073f7
joule-ui takes in OpenUI Lang 1.0 the way it takes in A2UI: a model writes a surface as a program, one widget a line, and joule-ui-lang builds a widget tree against the host's registry as the program streams. After every chunk a snapshot holds the tree as far as it can be built, each widget checked by joule-ui's own validate, and every error with its source line and reason code. State, queries, operators, conditionals, built-in functions and sequences of actions are parsed and refused not-declarative. A canonical writer turns a tree back into the language; it parses back to the same tree. - joule-ui-core: WidgetSchema::positional, the order a positional call passes props in (SPEC §3); absent from the wire form when undeclared. - joule-ui-interaction: begin_interaction and Pending::finish, the lifecycle's three phases in two steps for a host whose handler is asynchronous (SPEC §6); run_interaction is built on them and seals what it sealed before. - conformance/lang/v1: L1 statements, L2 ingest, L3 streaming, L4 the canonical form, L5 refusals, with an independent Python verifier written from §11. - docs/create.md: the design of Create. Co-Authored-By: Claude Opus 5.5 <[email protected]> |
||
| .. | ||
| lang | ||
| v1 | ||
| lang_verify.py | ||
| README.md | ||
joule-ui conformance vectors — v1
Deterministic vectors for independent joule-ui implementations (SPEC §8). Regenerate with:
cargo run -p joule-ui-conformance --bin gen_vectors
A conforming implementation reproduces these from the published JSON alone —
that is what makes joule-ui a vendor-neutral standard rather than one library's
behaviour. Fixed Ed25519 steward key (0x17×32, published, attests nothing) and
fixed meter steps make every vector reproducible.
| Vector | Class | What a conformant implementation must do |
|---|---|---|
c1-validation.json |
C1 — surface validation | Run validate(tree, registry) over both surfaces. The valid one yields no errors; the invalid one yields the exhaustive list (every planted fault — unknown widget, missing required prop, mistyped prop, forbidden child — not just the first). |
c2-interaction.json |
C2 — interaction metering | run_interaction over a deterministic meter (step 4200 µJ) reproduces the Interaction: allow, energy 4200 µJ [HwShunt], and the content addresses of surface, inputs, and outputs. The surface id is the BLAKE3 of the canonical valid_surface JSON; inputs/outputs are content-addressed, never embedded. |
c3-authorization.json |
C3 — authorization | A zero-budget Authorizer denies the action before the handler runs: expected_handler_ran is false, the verdict is deny("budget-exceeded"), and the outputs are the genesis sentinel. A conformant runtime MUST NOT execute a denied action's handler. |
c4-chain.json |
C4 — chain integrity | verify_chain accepts the three-link chain (allow, allow, deny). Removing index 1 MUST break it at index 1: every signature verifies, seq increments from zero, and each link's prev is the prior link's content id, so no interaction can be excised, reordered, or mutated without detection. |
MANIFEST.json |
— | Verify each vector's BLAKE3 content address before relying on it. |
What conformance pins, and what it does not
joule-ui pins the protocol and the receipt, not the product surfaces around
them. There is no renderer vector (the renderer is the host's), no transport
vector (the consumer's — MCP/SSE/Web MoQ), and no widget-library vector (product
surface). The metering and capability mechanisms are recognized edges (SPEC
§9): C2/C3/C4 use a deterministic stub meter and a stub budget so the vectors are
reproducible, while a deployment wires the Sandbox PowerMeter (a hardware
reading while a vendor counter is live, its labelled estimate otherwise) and a
JCP grant. The stub meter declares HwShunt explicitly, so C2 and C4 exercise
the reading path of the signed core (measured_uj present); like the steward
key, that grade is a fixture and attests nothing. Outside the pack, a meter that
declares no grade is Estimator (SPEC §5). What conformance guarantees is the load-bearing claim — that an
interaction is validated, authorized-before-running, metered, and sealed into a
tamper-evident chain, identically across implementations.