| Filename | Latest commit message | Latest commit date |
|---|---|---|
2557c4c58e
- BENCHMARKS.md / joulecontract diff: replace "16 tests" / "64 tests"
count phrasings with shape descriptions, per the no-vanity-metrics rule.
- check-no-vanity-metrics.sh: require the count to be a standalone number
(start-of-line or a non-identifier char before it), so an identifier like
"JR-2 tests" — where "tests" is a verb — is no longer flagged. Genuine
counts (" 16 tests", "64 tests") still match.
Scanner passes clean (exit 0).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
|
||
| .. | ||
| joulecontract-diff-v0.3-global.md | ||
| joulecontract-diff-v0.4-self.md | ||
| joulecontract-diff-v0.5-self.md | ||
| joulecontract-diff-v0.6-impl.md | ||
| joulecontract-diff-v0.7-pack.md | ||
| README.md | ||
Provenance — adversarial diff as governance
This standard improves by being adversarially diffed, not defended. Each published version was attacked by independent, mutually-blind review lenses; the findings were published as a diff document; the repairs were folded into the next version as a traced amendment under the standard's own §5.2, chained to the real digest of the version it amends. The diffs are therefore part of the standard's provenance, not commentary on it.
| Round | Document | Lenses | What it found |
|---|---|---|---|
| 1 | joulecontract-diff-v0.3-global.md |
global AI-coding canon · highest-regulated code ecosystems | The semantic gaps: no frame clause, no generator identity, unqualified verifier tooling — six gaps, folded into v0.4. |
| 2 | joulecontract-diff-v0.4-self.md |
second-order regressions · new attack surfaces · canon fidelity | The binding gaps: every new field was a string the producer could self-sign; two unterminated recursions; two canon over-claims — twenty findings, folded into v0.5. |
| 3 | joulecontract-diff-v0.5-self.md |
temporal/operational semantics · economics & collusion · spec-lawyer consistency | The time, party, and incentive gaps: the joule itself was the last unbound field; bindings had no evaluation point in time; keys are not parties and parties need consequences — thirty-three findings, folded into v0.6. |
| 4 | joulecontract-diff-v0.6-impl.md |
spec-vs-code fidelity · Rust soundness & adversarial inputs | The implementation gaps: four guarantee bypasses (case-variant key forgery, the entity-omission Party hole, caller-supplied key sets, reseal-under-any-key) and a validator that over-graded JR-4 from receipt-local evidence — twenty-eight findings, repaired in joulecontract-rs with the local/composed validator split; the spec consequences folded into v0.7. |
| 5 | joulecontract-diff-v0.7-pack.md |
clean-room implementability (spec + vector pack only, reference code forbidden) | The publication gaps: a receipt-local validator was buildable from the artifacts alone, the composed validator was not — the bundle construction, the negatives' sealed contexts, the key-log event model, and the quorum scope lived only in unreadable code, and the obvious canonicalization RFC produced the wrong digest. Seventeen findings; folded into v0.8 (six normative definitions) and a pack expansion from 13 to 22 vectors with every composed input shipped. The pack itself had been running evidence:external; v0.8 seals it. |
The pattern, stated once: each round forces the standard to apply its own newest rule to its own oldest text. The chain anchors live in ../archive/ byte-exact; verify with shasum -a 256 ../archive/*.md against the amendment log in ../SPEC.md §16.