d43ce9e55b
By the family's bar a standard ships conformance vectors a third party can reproduce — that is what makes it vendor-neutral rather than one library's behaviour. joule-ui-conformance provides shared fixtures, a deterministic vector generator, and self-verifying tests, with the pack in conformance/v1/: - C1 surface validation — exhaustive error list (valid → none; invalid → every planted fault, not first-only). - C2 interaction metering — run_interaction over a fixed-step meter reproduces the Interaction (allow, 4200 µJ HwShunt, content addresses). - C3 authorization — a zero-budget Authorizer denies before the handler runs; handler_ran=false, outputs=genesis sentinel. - C4 chain integrity — verify_chain accepts a sealed allow/allow/deny chain; excising index 1 breaks it at index 1. Fixed Ed25519 steward key (0x17*32, attests nothing) and fixed meter steps make every vector reproducible. conformance/README.md is the implementer's guide; MANIFEST.json content-addresses each vector. The suite pins the protocol + receipt, not the renderer/transport/widgets (product surfaces) — metering and capability stay recognized edges, stubbed deterministically in the vectors. 4 conformance tests; the crate is clippy-clean. Co-Authored-By: Claude Fable 5 <[email protected]>
33 lines
2.7 KiB
Markdown
33 lines
2.7 KiB
Markdown
# joule-ui conformance vectors — v1
|
||
|
||
Deterministic vectors for independent joule-ui implementations (SPEC §8).
|
||
Regenerate with:
|
||
|
||
```
|
||
cargo run -p joule-ui-conformance --bin gen_vectors
|
||
```
|
||
|
||
A conforming implementation reproduces these from the published JSON alone —
|
||
that is what makes joule-ui a vendor-neutral standard rather than one library's
|
||
behaviour. Fixed Ed25519 steward key (`0x17`×32, published, attests nothing) and
|
||
fixed meter steps make every vector reproducible.
|
||
|
||
| Vector | Class | What a conformant implementation must do |
|
||
|---|---|---|
|
||
| `c1-validation.json` | **C1 — surface validation** | Run `validate(tree, registry)` over both surfaces. The valid one yields **no** errors; the invalid one yields the **exhaustive** list (every planted fault — unknown widget, missing required prop, mistyped prop, forbidden child — not just the first). |
|
||
| `c2-interaction.json` | **C2 — interaction metering** | `run_interaction` over a deterministic meter (step 4200 µJ) reproduces the `Interaction`: `allow`, energy `4200 µJ [HwShunt]`, and the content addresses of surface, inputs, and outputs. The surface id is the BLAKE3 of the canonical `valid_surface` JSON; inputs/outputs are content-addressed, never embedded. |
|
||
| `c3-authorization.json` | **C3 — authorization** | A zero-budget `Authorizer` denies the action **before** the handler runs: `expected_handler_ran` is `false`, the verdict is `deny("budget-exceeded")`, and the outputs are the genesis sentinel. A conformant runtime MUST NOT execute a denied action's handler. |
|
||
| `c4-chain.json` | **C4 — chain integrity** | `verify_chain` accepts the three-link chain (allow, allow, deny). Removing index 1 MUST break it **at index 1**: every signature verifies, `seq` increments from zero, and each link's `prev` is the prior link's content id, so no interaction can be excised, reordered, or mutated without detection. |
|
||
| `MANIFEST.json` | — | Verify each vector's BLAKE3 content address before relying on it. |
|
||
|
||
## What conformance pins, and what it does not
|
||
|
||
joule-ui pins the **protocol and the receipt**, not the product surfaces around
|
||
them. There is no renderer vector (the renderer is the host's), no transport
|
||
vector (the consumer's — MCP/SSE/Web MoQ), and no widget-library vector (product
|
||
surface). The metering and capability mechanisms are **recognized edges** (SPEC
|
||
§9): C2/C3/C4 use a deterministic stub meter and a stub budget so the vectors are
|
||
reproducible, while a deployment wires the Sandbox `PowerMeter` (real hardware)
|
||
and a JCP grant. What conformance guarantees is the load-bearing claim — that an
|
||
interaction is validated, authorized-before-running, metered, and sealed into a
|
||
tamper-evident chain, identically across implementations.
|