| Filename | Latest commit message | Latest commit date |
|---|---|---|
d14f583d92
The repository tracks the latest stable Rust, pinned at the root. A
`rust-version` key states a *floor* -- the oldest toolchain a crate supports --
which is a different promise, and one this repository does not make. It also
said 1.97 while the pin was 1.98.0 and nothing verified it, so it was a claim in
the wrong direction and unchecked in both.
So it goes, everywhere:
59 rust-version = "1.97" (workspace and package declarations)
417 rust-version.workspace = true (members inheriting them)
476 files, 476 deletions, 0 insertions
The 417 are why this is not the sixty-file change it looks like from a grep for
the value. A member inheriting a key that no longer exists does not fall back to
a default -- its manifest stops resolving. Removing the declarations without the
inherits would have broken every workspace that has members.
Deliberately untouched: `joule-code-rs/vendor/wtransport/Cargo.toml`. That is a
vendored third-party crate declaring a floor about itself, not about us, and our
pin is above it. Editing vendored source to satisfy our own policy would make
the copy diverge from upstream for no benefit.
Verified rather than assumed:
- all 493 `Cargo.toml` files in the tree parse (`tomllib`)
- `cargo metadata --no-deps --locked` resolves on `joule-code-rs`, `wai-rs`,
`openpay`, `mesh-rs`, `sandbox-rs` and `jcp-rs` -- the check that actually
exercises workspace inheritance, which a TOML parse does not
- no `Cargo.lock` changed; `rust-version` is not lockfile state
`wai/wai-verify/Cargo.toml` already carried a comment saying it omits
`rust-version` on purpose, so this makes the rest of the tree agree with the one
crate that had already decided.
What this gives up, stated plainly: cargo can no longer greet an older
toolchain with "requires rustc 1.97" and will instead fail wherever the code
first needs something newer. That is the cost of not maintaining a floor, and
it is the right cost when the floor was fiction.
Co-Authored-By: Claude Opus 5 <[email protected]>
|
||
| .. | ||
| archive | ||
| conformance | ||
| joulecontract-rs | ||
| provenance | ||
| LICENSE | ||
| LICENSE-SPEC | ||
| README.md | ||
| SPEC.md | ||
JouleContract
A carrier for obligation. Five clauses, one signed receipt, owned by no one.
JouleContract is the contract cargo class of the Transaction Science substrate. Where Smart Byte carries value, EOC carries compute, Joule Code carries coding work, and Map carries place, JouleContract carries the promise itself: a content-addressed statement of what a unit of work must hold (pre, post, inv), what it may touch (frame), and what it may spend (ceiling, a joule EnPI against a signed baseline). It is the operand the rest of the family acts on — Joule Code carries its changes, the proof standard discharges its obligations, JouleClaw budgets dispatch against its ceiling — and its single signed receipt simultaneously evidences functional safety, energy management, and AI governance: three audit programs collapsed into three projections of one receipt log.
The doctrine
Inherit, don't invent — bind, don't name — seal, don't float. Three normative consequences:
- The binding rule. Every trust-bearing field — generator, frame, qualification, independence, the joule figure itself — binds to a key, a sealed attestation, or an independent timestamp, or serializes one of twenty-two demoted states. A field that is named but not bound does not exist in a conformant receipt.
Meteredwithout a meter attestation ismetered_unattested; independence is computed from key disjointness, never copied from a producer's flag. - The sealing rule. Conformance is evaluated once, at discharge, against a content-addressed evidence bundle, and sealed. Re-verification is resolution-free — no DNS, no live registry, no reachable authority — which is also what makes conformant receipts producible air-gapped. Receipts do not rot, and nothing re-grades them later.
- Breach is deviation without amendment. Contracts bend instead of break: amendments are metered, independently timestamped transitions that govern the future only. A withheld receipt is visible as withheld; a past out-of-frame effect stays a breach forever; an unamended deviation caps the Governance class until closed.
Rigor, honestly
Conformance is a composed profile — ⟨Rigor JR-1..4 · Energy class · Governance class⟩ — gated by the least-bound axis, with a claim-discipline rule: the bare word "conformant" is itself a non-conformant claim. The limits no document can mechanize are named residuals, not hidden: obligation-set adequacy, common control, issuer-pays gravity, and the demand side — the standard prices honesty; relying parties price assurance.
Provenance
This standard was hardened by adversarial diff, and the diffs are part of it: each version was attacked by independent review lenses, the findings published, and the repairs folded as traced amendments with real digests. SPEC.md §16 carries the full chain; archive/ holds every prior version byte-exact so the chain verifies; provenance/ holds the four diff rounds that produced it — three against the spec text, the fourth against the reference implementation itself.
Contents
SPEC.md— normative specification v0.6.0 (RFC 2119), self-hosting amendment log with verified digest chain.archive/— prior spec versions (v0.1.0–v0.5.0), byte-exact anchors of the amendment chain.provenance/— the adversarial diff rounds that drove each amendment.joulecontract-rs/— Rust reference workspace: schema, receipt validation, evidence sealing, amendment/key-log machinery, conformance harness.
Reference implementation and consumers
joulecontract-rs implements the core object, the demoted-state vocabulary, computed independence, the least-bound-axis profile gates, resolution-free sealed verification, and forward-only temporal ordering. The first family consumer is live: joule-code-joulecontract runs a coding operation under a contract — the edit set is the frame, the tier cost is the ceiling, JCR provenance maps downward-only onto the energy classes — and discharges it into a receipt that grades honestly under the two-stage rule. The JouleClaw runtime and the proof standard's cascade are next.
Status
v0.8.0 draft. The amendment chain is real (archive digests verify against §16, mechanically, on every cargo test — seven anchors, v0.1 through v0.7). The reference workspace covers the schema, the receipt-local and composed validators (two-stage evaluation is now normative: local witnesses at most JR-2; JR-3/JR-4 and certified are composed verdicts over the sealed evidence bundle, the office key log, and the transition interval), composition with per-component ceiling accountability (intra-batch netting is structurally dead), the per-EnB ratchet, recourse and sector-equivalence bindings, the mechanical lost/never evidence distinction, cross-digest re-anchoring, evidence sealing with expected-signer verification, the in-toto/DSSE recognized edge, and a regenerable conformance vector pack whose expected verdicts come from the validators themselves. Five adversarial rounds are on the record (provenance/): three against the spec text, the fourth against the implementation (28 findings, four guarantee bypasses, all repaired — folded back as v0.7), and the fifth a clean-room implementability audit of the published artifacts alone, which found the composed validation path unbuildable without reading the reference code — folded back as v0.8, which makes the bundle construction, canonical JSON, quorum scope, obligation matching, and key-log event model normative text, and expands the pack from 13 to 22 vectors with every composed input shipped (member bytes included). Every §15 demoted state is producible by the reference implementation, and a third party can now build the composed validator from the published artifacts alone.
Licence
- Reference code: Apache-2.0
- Specification text: CC-BY-4.0