open-standards/joulecontract/SPEC.md

JouleContract

An Open Standard for Energy-Accounted Interface Contracts

Status	Draft for Review
Version	0.8.0 — amends 0.7.0, digest sha2-256:e2f6dd215244bf18e0ea7e1ddc0a6889f66de427baa4130d5be82b3c0ac7c5a4 (see Amendment Log, §16)
Canonical home	joulecontract.transaction.science
License	Specification text: CC-BY-4.0 · Reference implementation: Apache-2.0 (Rust)
Stewardship	The protocol is ownerless. Stewardship is an office, not an owner (§11). Transaction Science, Inc. is the inaugural steward.
Position	The operand between JouleCode, JouleProof, and JouleClaw; denominated in the EOC joule unit; readiness scored by ARL.
Prime directive	Energy optimization, safety, and auditability — served by one receipt, not three programs. Every point of failure is named, graded, and traced; the residuals the assurance canon cannot mechanize are named, not hidden (§10.1).

---

0. Self-Hosting Clause

This specification is governed by its own amendment model. Each published version is a content-addressed document; each new version is an attributed, reasoned, signed amendment chained to the digest of the version it amends — the chain carries real digests (§16), not placeholders, because a self-hosting claim discharged by its own vocabulary would otherwise serialize undischarged. No version of this standard depends on any person, organization, algorithm, or jurisdiction remaining in place: every named fixed point in this document is an office or a parameter with a defined succession or migration rule, not a dependency.

Self-hosting is literal: amendments to contracts are themselves JouleContract transitions, metered and receipted under §5.2, with a defined base case so the recursion terminates (§5.2.2).

---

1. Design Principle: Inherit, Don't Invent — Bind, Don't Name — Seal, Don't Float

The three concerns this standard serves — energy optimization, safety, auditability — each have a mature, internationally recognized management-system standard. JouleContract does not replace them. It is the technical control object whose single signed receipt simultaneously discharges evidence for functional safety (IEC 61508 and the independently-evolved avionics family), energy management (ISO 50001 with ISO/IEC 30134), and AI governance (ISO/IEC 42001) — three programs collapsed into three projections of one receipt log.

Where an inherited standard is superseded, the inheritance binds to the current edition of that standard or its formally designated successor for new contracts; an issued receipt pins the Register snapshot in force at issuance (§5.1.4), so revision of the canon never changes what a past receipt claims.

The binding rule (normative, global). A trust-bearing field is one whose value, if false, would cause a reader to over-trust the receipt: generator, frame, qualification, independent, verifier, engagement, provenance, joules_spent, ceiling, enb_ref, profile (including its rigor target), and all timestamps. Every trust-bearing field MUST be bound — derivable from or verified against a key, a signed attestation sealed in the receipt's evidence (§5.1.3), or an independent timestamp — or MUST serialize in a demoted form (§15) that a reader and a profile can act on. A field that is named but not bound does not exist in a conformant receipt: there is no implicit trust anywhere, including in this standard's own vocabulary, and including in the joule figure itself (§4.2).

The sealing rule (normative, global). Every binding is evaluated once, at discharge, by the verifier of record, against evidence captured as of that moment, and sealed into the receipt's evidence bundle (§5.1.3). Conformance is a property of the receipt at issuance; it never floats with later infrastructure. Re-verification is resolution-free: it re-checks the sealed evidence, not the live network. Changes to trust inputs after issuance — key rotation, revocation, attestation expiry, edition revision, baseline change — act forward only, through the amendment and key-log discipline (§5.2.1, §6.4); they demote or govern future receipts and never silently re-grade past ones.

---

2. Normative Inheritance

Conformant implementations MUST be expressible in terms of the following, by role:

2.1 Safety and rigor — the functional-safety standard and the avionics assurance family

Two independently-evolved lineages are inherited, each on its own authority:

• IEC 61508 (currently Ed. 2) and its aligned sector standards (ISO 26262 automotive, IEC 62304 medical, EN 50128 rail): goal-based assurance — risk-reduction targets demonstrated through structured evidence across a defined lifecycle, formal methods admitted as assurance techniques, graded by Safety Integrity Level (SIL 1–4). JouleContract inherits the assurance-case-as-evidence model (the receipt log is the assurance case) and RFC 2119 normative discipline. SIL itself attaches to a safety function's required risk reduction, derived from hazard analysis; JouleContract does not self-assign SILs — see the Rigor class (§10), which maps to a sector level only through a bound risk-assessment attestation.
• The avionics assurance family (DO-178C/ED-12C with supplements DO-330 tool qualification and DO-333 formal methods), which predates IEC 61508 and evolved independently — its objective-based discipline, tool-qualification regime, and formal-methods soundness requirements are inherited where high rigor is claimed (§6.1, §10).

2.2 Energy — the energy-management system (currently ISO 50001) + the measurement-KPI series (currently ISO/IEC 30134)

The joule ceiling is an Energy Performance Indicator (EnPI) against a declared Energy Baseline (EnB); the ratchet (§5.3) is the continual-improvement loop, scoped per-EnB; the provenance tag (§4.2) is the measurement category — now bound, not asserted.

2.3 Governance — the AI management system (currently ISO/IEC 42001 and family: 23894, 42005, 42006, 42007, 38507, 5338)

The AIMS is the wrapper JouleContract operates inside; the amendment model (§5.2) is its change control — which is why an unamended breach is, by definition, a change-control failure and caps the Governance class (§15).

2.4 Assurance, evidence, and trust

ISAE 3000 / SOC 2 (independent attestation reads the receipts; its practitioner-liability regime is a recognized recourse regime, §6.2) · eIDAS qualified signatures/seals/timestamps (seals bind keys to legal entities with statutory identity-proofing — deployed at high rigor, §6.2; QTSPs carry statutory liability, a recognized recourse regime) and FIPS 140-3 validated cryptography · vLEI / GLEIF legal-entity identifiers (party binding outside eIDAS jurisdictions) · RFC 3161 timestamping under a named policy (timestamp regime outside eIDAS jurisdictions, §5.2.1) · in-toto / SLSA / DSSE / Sigstore (supply-chain envelope at the recognized edge, §7) · NIST SP 800-218 SSDF and 800-218A · ISO 19011 (the audit is a query over the receipt log).

---

3. The Core Object

A JouleContract is a content-addressed object bound to a unit of work, declaring five obligations:

1. Precondition (pre) — MUST hold for the transition to be admissible.
2. Postcondition (post) — MUST hold once the transition completes.
3. Invariant (inv) — MUST hold throughout and survive the boundary unchanged.
4. Frame (frame) — the declared mutable footprint: the complete set of state the transition is permitted to touch. All state outside the frame is implicitly invariant. (§3.4.)
5. Joule ceiling (ceiling) — maximum energy, in the EOC joule unit, expressed as an EnPI against a declared EnB, with a bound derivation (§4.2).

The contract also records its rigor target (§10) — the conformance class the producer undertakes to discharge — so the promise is visible before the work, not retrofitted after it.

3.1 Identity and cryptographic agility

A contract MUST be content-addressed by the digest of its canonical serialization. The digest MUST be algorithm-prefixed (multihash-style), and conformant implementations MUST support digest-algorithm migration: when an algorithm is deprecated by the steward (§11) on published cryptanalytic grounds, existing objects are re-anchored by a signed, independently-anchored re-anchor record (old address → new address, reasoned, appended to a forward-only re-anchor log; resolution follows the chain, hop-bounded) mapping old identity to new. This discipline applies to every identity in a contract or receipt: human-readable names (model, system, tier labels, DID strings) are non-normative labels; the algorithm-prefixed digest of the sealed object — attestation bytes, key material, tier definition — is the identity (§5.1.3).

3.2 Correctness stays the verifier's

A contract states a specification; it does not certify itself. A proof is not a specification: discharge establishes that an implementation satisfies the stated obligations, not that those were the right obligations. Conformant systems MUST keep correctness with an independent verifier of record (§6).

3.3 Composition — and composition never relicenses anything

Contracts compose. A contract over a composed transition (a batch, a pipeline, a workflow) is the conjunction of its components' obligations with a ceiling no greater than the sum of component ceilings, and a frame no larger than the union of component frames. Composition is associative; receipts for a composed transition MUST reference the component receipts or carry the composed discharge directly.

Composition never relicenses — frames or ceilings. The composed frame bounds the aggregate; each component remains bound by its own declared frame within the composition, and a component's effect outside its own frame is that component's breach even where it falls inside the composed frame. Identically for energy: each component remains bound by its own ceiling within the composition; a composed discharge MUST carry per-component joules_spent attribution, or its composed energy figure serializes component_unattributed — it cannot feed a ratchet, cannot support residual claims, and caps Energy-class comparability. A component overrun inside a passing batch is still that component's deviation under §5.2; intra-batch netting of one component's overrun against another's slack is the energy-axis form of the relicensing this clause forbids. If any component's frame is undischarged (§3.4), the composed frame is undischarged, carrying the offending component's reference.

Decomposition — discharging one high-rigor obligation across redundant lower-rated elements (the ISO 26262 ASIL-decomposition pattern) — is expressed as conjunction over the composing contracts only where the composing elements are demonstrably independent: freedom from interference plus absence of common-cause failure, recorded via the independence binding (§6.2) and a dependent-failure rationale carried in the profile (§10). Absent demonstrated independence, the original high-rigor obligation stands undecomposed.

3.4 The frame obligation — no unintended function

pre/post/inv establish what a transition guarantees; none of them bounds what it may additionally do. The frame closes that: anything not named in frame is implicitly invariant, so an effect outside the declared footprint is a breach (§5.2) exactly as a violated postcondition is. This is the standard's form of two independently-evolved canon requirements — DO-178C's absence of unintended function and ISO 26262's freedom from interference.

There is no closed unbounded frame. Where a transition's full footprint cannot be bounded, the frame obligation serializes undischarged with a reason — non-promotable, Rigor-capping (§10), propagating to the top of any composition (§3.3).

Frame discharge modes. Each frame discharge MUST record its mode:

• observed — the verifying tier monitored the actual execution footprint of a computational transition.
• attested — for transitions whose footprint is not computationally observable (a clinical handoff, a custody transfer, an operational procedure): an independent witness or receiver — a party disjoint from the generator under §6.2 — attests, by signature, that the transition's effects stayed within the declared scope of state, care, or custody. This is the receiver-confirmation step ("synthesis by receiver," I-PASS) made a first-class discharge mode, and it is what keeps a refactor, a settlement, and a clinical handoff on one ledger at every rigor class rather than only at the bottom (the cross-domain claim of §4 is an assurance claim, not only a ledger claim).
• static_only — the footprint was bounded by analysis of the artifact without observing execution. A weaker claim: declared-and-analyzed, not observed-and-confined. JR-4 (§10) requires observed or attested.

Because the frame is the one obligation that bounds unstated effects, frame discharge MUST be independent of the generator (§6.2) at JR-2 and above.

---

4. Energy as Coordinate

Energy is the coordinate system, not a feature. The joule is the only unit present in every transition in every domain; that shared unit is what places a refactor, a settlement, and a clinical handoff on one ledger under one audit.

4.1 The ceiling is the one measured clause — and the residual is a control signal, not a savings claim

Correctness clauses are binary; the ceiling yields a measured residual (allowed − spent), the continuous signal that drives improvement loops and the ratchet (§5.3). Disclosure semantics are strict: the quantity summable into external energy disclosures (CSRD/ESRS E1) is joules_spent — a measured figure carrying its provenance binding. The residual MUST NOT be presented as a savings, efficiency, or reduction claim: a residual is the gap between spend and a declared ceiling, and a declared ceiling can be declared generously. A residual against an unanchored ceiling (§4.2) has zero evidentiary weight.

4.2 Energy provenance — bound, not asserted

Every joule figure MUST carry one of three measurement categories, and the category itself is a trust-bearing field under §1 — it binds or it demotes:

• Metered — hardware-measured, and the claim MUST be bound: the figure resolves (within the sealed evidence, §5.1.3) to a meter or substrate attestation — a signed reading or telemetry statement from the metering subsystem (hardware shunt, PDU, substrate/cloud telemetry endpoint) — signed by a key distinct from the receipt signer, validity-windowed per §6.1's pattern. A Metered tag without a resolving meter attestation serializes metered_unattested: an unbound reading is no reading, so the Energy class falls to what the receipt's remaining evidence supports — ModelBased where it seals the metered-baseline anchor that class is defined by, else Unaccounted. Whoever owns the meter owns the unit of account; on producer-owned bare metal with no independent meter, the lower categories exist precisely to record that honestly.
• ModelBased — anchored to a metered baseline for a comparable workload; the anchor reference is sealed.
• Unaccounted — estimated by published energy-traceability methods where the substrate exposes nothing; the method reference is sealed.

The tag MUST travel with the number; downstream consumers MUST NOT promote a category. The failure prevented is estimation laundering itself into apparent measurement — including by the standard's own serializer.

The ceiling and the baseline are bound too. The EnB is a signed object (signed by its declaring authority, sealed in evidence), and the ceiling MUST carry a derivation binding to its EnB — the measured or modeled basis on which joules_allowed was set. A ceiling without a derivation binding serializes ceiling_unanchored: the contract remains valid, the spend remains reportable, but the residual carries no evidentiary weight and cannot feed disclosure projections or ratchet claims. grid_mix, where present, SHOULD carry a source attestation (grid operator or registry); unattested grid-mix is informative only and MUST be excluded from disclosure projections.

4.3 Cross-domain ledger rule

The ledger is additive across domains and comparative only within an EnB scope. Sums of joules are physically meaningful regardless of domain, so a global ledger MAY total compute-joules and operational work-joules for aggregate disclosure. But an EnPI is meaningful only against its own baseline: residuals compare only under the same EnB, and never constitute an equivalence claim across EnBs. Receipts MUST carry the EnB reference; conformant ledgers MUST refuse cross-EnB comparison while permitting cross-EnB summation.

4.4 Resource-bound lineage (precise claim)

The functional-safety canon already verifies time (WCET) and memory (stack/heap bounds) as objectives. JouleContract does not claim to verify resources for the first time. It generalizes resource-bound verification from time and memory to energy, and makes the bound a billed, receipted, ratcheting EnPI rather than a one-time certification objective.

---

5. The Receipt, the Amendment, and the Ratchet

The contract is the promise; the receipt is the record that the promise held — the unit of evidence for all three inherited management systems at once. Any compliance report is a projection over the receipt log.

5.1 Required receipt fields

contract · transition (§5.1.5) · interval (§5.2.1) · generator (§5.1.1) · discharge (one entry per declared obligation — every pre, post, inv, and the frame — each carrying: tier that closed it or undischarged + reason; tier class and qualification binding (§6.1); discharging verifier identity, computed key-disjointness/independence, and engagement disclosure (§6.2); and for frame, the mode, §3.4) · execution (§5.1.5) · joules_spent + meter binding (§4.2) · joules_allowed + derivation binding (§4.2) · residual · provenance · enb_ref · grid_mix (OPTIONAL) · verifier (derived union) · profile (§10) · register_pin (§5.1.4) · timestamp (§5.2.1) · evidence (§5.1.3) · signature.

A receipt missing a discharge entry for any declared obligation is malformed — not demoted, malformed. (An obligation nobody could close is undischarged; an obligation nobody mentioned is a hole in the record.)

Obligation matching is exact. A discharge entry matches a declared obligation by (kind, text) string equality. The contract's frame array declares one obligation whose synthesized text is "frame: " followed by the frame entries joined by "+". Any other synthesis diverges silently and is non-conformant.

The conformance pack is the normative wire form. Where this section's field list and the wire diverge, the wire rules: profile is carried as claimed_profile; the verifier union is derived by the validator, not carried; interval and its anchors are supplied by the anchoring layer and sealed alongside the receipt; signature is the seal/wire envelope's. All timestamps on the wire are integer seconds.

The residual is derived, never carried. residual is computed at read time as joules_allowed − joules_spent; a carried copy could lie, and a field whose only honest value is a function of two other fields is not a field (v0.7 amendment — the round-four implementation diff surfaced this: the reference implementation refused to store it, and the implementation was right).

5.1.1 Generator identity — bound, with a defined key set

The receipt MUST identify the producer of the work — AI-BOM-compatible (OWASP AISVS Appendix C, control AC.9.1, a Level-2 control), the producer-identity SLSA/in-toto carry for builders. Identity is bound: generator.version_digest MUST be an algorithm-prefixed content address resolving (within sealed evidence) to a producer attestation signed by a key distinct from the receipt signer, else generator_unattested (non-promotable; caps Governance class).

The generator key set — the operand of every disjointness computation in this standard (§6.2) — is defined as: the receipt signer's key(s) ∪ all keys enumerated in the resolved producer attestation ∪ the human principals' keys ∪ any key that has signed an amendment to this contract on the producer's behalf. The producer attestation MUST enumerate its keys so disjointness is decidable from sealed evidence.

5.1.2 Trust-chain termination — two roots, one vocabulary

Every trust chain in this standard — qualification chains (§6.1), generator chains (§6.3), assignment chains (§10) — terminates at one of two defined roots, and the receipt names which:

• human-attested — a signed attestation by a named human principal (the assessor of record, the human author, the witnessing receiver). The signing human is the root; there is no contract behind the human. (This is the single root vocabulary for human grounding; the token human-authored is retired as an undefined synonym.)
• reference-impl — a published deterministic artifact whose soundness is a cited proof or public reference implementation.

A chain that does not reach a defined root within the sealed evidence serializes unterminated and is treated as unattested — and an unterminated qualification chain is a qualified:false trigger (§6.1).

5.1.3 Sealing and the evidence bundle — resolution-free re-verification

The receipt carries, or references by digest into a content-addressed evidence bundle sealed under the same signature, every object needed to re-run verification: the producer attestation, qualification attestations, the EnB object, the meter attestation, the risk-assessment attestation (§10), entity credentials (§6.2), and the key material — DID document digests, not DID strings — as of discharge. DID strings, domains, and URLs are non-normative labels (§3.1); the sealed bytes are the evidence. Consequences, each load-bearing:

• Re-verification requires no network. A receipt is checkable from the receipt plus its bundle, at any later date, in any enclave — which is what makes conformant receipts producible in air-gapped and classified environments: no DNS, no live registry, no reachable public TSA is ever required to verify, and §5.2.1 names an offline-capable timestamp regime so they can also amend.
• Receipts do not rot. Validity windows (valid_until) bound when an attestation may be used for new discharges; they are evaluated once, at discharge (validated_at is recorded), and never re-grade past receipts. Loss of an original external object after sealing demotes nothing — the sealed copy is the evidence. Where a bundle itself is lost, the demotion distinguishes validation_recorded, evidence_lost (the verifier's signed issuance-time verdict survives in the receipt) from unresolvable (never validated) — two states an auditor treats very differently.
• Retention is an obligation with an office. The profile names a retention office and period by role (per the governing regime's predicate rule — the Part 11 inheritance); the verifier of record archives the bundle content-addressed at discharge.
• The bundle construction is normative. An evidence bundle is a set of byte objects, each identified by its algorithm-prefixed content address. The bundle's own address is the digest of the LF-joined, lexicographically sorted list of its members' address strings (no trailing newline). Two bundles with the same members address identically regardless of insertion order; adding or removing one member changes the address. A conformant verifier MUST be able to recompute it from the member list alone.
• A receipt whose evidence is reference-only (no sealed bundle) serializes evidence:external — conformant, demoted, and exactly as trustworthy as the infrastructure it floats on.
• The lost/never distinction is mechanical. A missing object when the receipt seals the presented bundle (addresses match) was never validated: unresolvable, and the gate fails. A missing object when the receipt seals a different bundle than presented is evidence lost after issuance: validation_recorded, evidence_lost — the sealed verdict stands, re-checkability demotes, and the bundle mismatch itself already serializes evidence:external and caps the receipt below JR-3. No judgment call is involved; the bundle address decides.

5.1.4 Register pinning — editions never float

The receipt carries the digest of the Register snapshot (§13) in force at issuance. Classes and inherited-standard claims are evaluated against the pinned snapshot, permanently. Current-edition binding (§1) governs new contracts only; a steward Register update can never change what a past receipt claims — the no-retroactive-authority rule (§11) applied to the canon itself.

5.1.5 transition and execution, defined

transition is the algorithm-prefixed digest of the canonical serialization of the transition record: the subject's content addresses before and after, the interval anchors (§5.2.1), and the input references. execution entries are algorithm-prefixed digests of the executing tier definitions (labels non-normative per §3.1).

5.2 Amendment model

Every amendment to a contract — including to its ceiling or its frame — is an attributed, reasoned, signed transition chained to the prior digest. The contract is its own amendment log. Breach is deviation without a matching amendment; a measured overrun, or an out-of-frame effect, with a signed, reasoned, timely amendment is governed change — subject to the temporal-ordering invariant (§5.2.1).

Unamended breach has a price in the standard's own currency. A deviation left without a forward-looking amendment or fix-receipt serializes breach_unamended on the contract's subsequent receipts: non-promotable, and capping the Governance class until closed — an unamended deviation is by definition a change-control failure under the §2.3 inheritance. This makes the amendment the cheap branch: governed change costs a de minimis metered amendment; ungoverned deviation costs the Governance axis. (The prior inversion — where amending cost joules, timestamps, and quorum while silent breach cost a log line — taxed honesty and missed the budgeted attacker.)

Amendments are metered, with the ceiling priced by the office. An amendment is itself a JouleContract transition: it bears a ceiling, spends joules, and produces a receipt (§0). The amendment ceiling is set by the verifier office or the profile, not by the producer (a self-priced cost bounds nothing), and SHOULD be de minimis: metering exists for attribution and self-hosting, not deterrence. The anti-flooding bound at high rigor is quorum (§5.2.1), not the meter.

5.2.1 Temporal-ordering invariant — sealed intervals, anchored stamps, future-only amendments

Transitions are intervals, not points. The receipt's interval carries an independently-anchored start timestamp (the admission of pre) and the receipt's anchoring timestamp. A transition is governed, end to end, by the contract version in force at its start anchor — the version that admitted it — so a transition spanning an amendment is never judged against obligations that did not exist when it was admitted.

Receipts are anchored promptly or say they weren't. A receipt MUST be anchored within the profile-stated maximum latency of transition end; a later stamp serializes timestamp_stale — a withheld receipt is visible as withheld. At JR-3 and above, all receipt timestamps — not only amendment timestamps — MUST come from an independent timestamp authority; an effect receipt without an independent anchor serializes timestamp_unanchored and is treated, for breach classification, as predating every amendment — so withholding a receipt to slip it behind a frame-widening amendment gains nothing.

Amendments govern the future only. An amendment MUST carry an independent timestamp and governs only transitions whose start anchors postdate it. An out-of-frame effect or overrun whose interval predates the relevant amendment is, and permanently remains, a breach: amendments change future obligations; they never reclassify past effects.

The timestamp authority is an office, not a dependency. The normative text names the role — the independent timestamp authority — and the Register (§13) lists recognized regimes by jurisdiction: eIDAS qualified timestamps (EU), RFC 3161 under a named policy (US/global), or an enclave-internal authority operated under the §6 office pattern (published key log, generator-disjoint, succession rule) for air-gapped deployments. At JR-3+, amendments MUST carry timestamp quorum (k-of-n independent authorities) and frame/ceiling amendments MUST carry verification quorum co-signature (§6), so no single suborned authority or key-holder can re-enable retroactive legalization.

5.2.2 The amendment base case — the recursion terminates

An amendment-transition runs under the normative minimal amendment-contract, fixed by this standard (not authored per-amendment): its frame is the amended contract object plus the log head, and nothing else; its rigor class is inherited from the amended contract; its generator is the amendment signer. Amendments chain; they do not meta-amend — the minimal amendment-contract is not itself amendable, which is the base case. (Without it, amendment-as-transition would be an unterminated recursion of exactly the class §5.1.2 exists to purge.)

5.3 Enforcement and ratchet

Enforcement is at receipt-time (observed), never compile-time (rigid): deviations are recorded, the system keeps running, resolution is amend-or-fix — amendment forward-looking only (§5.2.1), unamended breach Governance-capping (§5.2). Over successive transitions the ceiling MAY ratchet toward the measured floor and reject regressions. The ratchet is scoped per-EnB: an EnB change (itself a signed amendment under §5.2) resets the ratchet floor, because a regression test across baselines would be a cross-EnB comparison §4.3 forbids. Ratchet claims require an anchored ceiling (§4.2) and component-attributed energy in compositions (§3.3).

5.4 Granularity

The standard fixes no transition granularity. Granularity is discovered economically by the cheapest-sufficient discharge cascade; obligations batch by composition (§3.3) — with per-component energy attribution preserved — until discharge clears at an acceptable tier, and the receipt records the batch boundary. Coding-rule rulesets (MISRA C/C++, CERT, NASA Power of Ten) are naturally cheap deterministic discharge tiers, carried in the tier field like any other.

---

6. Independent Verification — keys, parties, and consequences

Conformant systems MUST designate a verifier of record distinct from the generator of the work; where one agent drafts both obligation and implementation, an independent checker MUST discharge the obligation. The verifier of record MUST be replaceable without invalidating prior receipts — possible precisely because receipts are sealed (§5.1.3): verification authority attaches to the verifier office and its published key log (§6.4), not the incumbent.

The verifier office, defined. An office is a named role with: a published membership, an append-only signed key log (§6.4), and a succession rule per the §11 pattern. Office quorum means k-of-n across independent verifiers — party-disjoint members at JR-3+ (§6.2) — never k-of-n keys of a single member, which one capture defeats. Quorum support is MUST at JR-3 and above (and SHOULD below); profiles state k and n with k ≥ 2 at JR-3+. This single requirement discharges the independent functional-safety assessment (IEC 61508), effective challenge (SR 11-7), and independent attestation (ISAE 3000), and corresponds to receiver-confirmation in clinical handoff protocols (I-PASS).

Quorum economics (why this is affordable, stated rather than hoped). Quorum is economical exactly where discharge is deterministic re-execution: k verifiers re-running a type check or an SMT query cost k × near-zero — the §6.1 split is what makes high-rigor quorum viable at all. Where quorum touches non-reproducible discharge — observed/attested frames, human-attested roots — the cost is real, linear, and the deliberate price of a genuinely expensive claim. Profiles weigh that price explicitly.

6.1 Discharge tiers: two classes, one qualified and one not

A discharge verdict trusted without subsequent re-verification makes the tier that produced it a trust target — the DO-330 tool-qualification lesson, the DO-333 requirement that the soundness of any formal method be justified (a sound method never asserts a property holds when it may not), and ISO 26262's tool confidence levels. The canon's qualification machinery applies only where it can:

• Deterministic tiers (type checkers, SMT backends, static analyzers, model checkers, coding-rule checkers): defined, reproducible, bounded behavior — qualifiable. Each deterministic discharge MUST carry its qualification binding: a signed attestation, sealed in evidence, whose signer is distinct from both the tier operator and the generator, validity-windowed (evaluated at discharge, §5.1.3), with a chain terminating per §5.1.2. A reference that does not resolve within sealed evidence, was expired at discharge, is self-signed, or whose chain is unterminated serializes qualified:false.
• Stochastic tiers (model-based discharge): not qualifiable — no defined, reproducible behavior to qualify, and this standard does not pretend otherwise. A stochastic verdict MUST be recorded unqualified and MAY close an obligation only where that obligation is independently re-discharged by a deterministic tier or an independent verifier. A model verdict alone never satisfies a high-rigor discharge. (The cascade doctrine applied to verification itself: inference is a bounded last resort, not the control plane.)

The verifier of record validates qualification chains at discharge and seals the result; a profile states tier class and qualification requirements per obligation at a given Rigor class.

6.2 Independence: key disjointness is the floor; parties and consequences are the walls

Three layers, each binding what the previous cannot:

Layer 1 — key disjointness (computed, the floor). Each discharge entry carries the discharging verifier's identity and a disjointness verdict computed over the generator key set (§5.1.1) and the discharge signature, against the key log as of the discharge timestamp (§6.4) — never copied from a producer-supplied flag. Keys overlap → independent:false, regardless of any claim. But key disjointness is necessary, not sufficient: keys are free, and two disjoint key sets can have one owner. What §6.2 computes at this layer is precisely key disjointness, and the receipt says so: a discharge whose independence rests on keys alone serializes independent:key_only.

Layer 2 — party disjointness (bound, required at JR-3+). At JR-3 and above, verifier identity MUST bind to a legal-entity credential — eIDAS qualified seal, vLEI, or equivalent party-level attestation sealed in evidence — and independence at that class means disjointness of the bound legal entities. independent:key_only cannot satisfy any JR-3+ independence requirement. Entity binding moves the cost of manufactured independence from a domain registration to incorporation fraud — no further; see the named residual below.

Layer 3 — engagement and consequences (disclosed, hooked). Engagement economics are trust-bearing under §1: each discharge MUST carry engagement: { selected_by, compensated_by } as bound identities, else engagement_undisclosed (cannot satisfy JR-3+ independence). Profiles MAY require producer-independent verifier selection — relying-party-selected, registry-assigned, or rotation (the post-Enron audit-rotation move the canon already made). Each discharge carries the verifier's recourse regime — statutory (eIDAS QTSP liability), professional (ISAE 3000 practitioner liability), or bonded/insured — bound in the entity credential; an absent regime serializes recourse_undeclared (a disclosure, not a rigor cap: profiles MAY reject). A signature carries economic weight only where some regime outside this standard attaches consequence to its being wrong; relying parties weight recourse_undeclared signatures accordingly.

Named incentive residuals (the §10.1 pattern — mechanize what can be, name what can't):

• Common control. Two legal entities under one parent — or one person, two LLCs — defeat party disjointness, and no credential scheme mechanizes corporate control graphs. The canon handles this with party-level independence rules and conflict disclosure (ISAE 3000; IEC 61508 FS-assessment independence); this standard makes the disclosure legible and names the limit.
• Issuer-pays gravity. Where the producer selects and pays all n verifiers, the ratings-agency equilibrium (issuer-pays + competition for issuer business → grade inflation) operates with full cryptographic formality throughout. No document mechanizes market structure. Engagement disclosure makes capture legible — a relying party can see that every verifier is paid by the producer — it does not make capture impossible, and this standard does not claim it does.

6.3 Security of the generation loop

A generator is itself a transition-executing system and — at JR-3 and above — MUST operate under its own JouleContract bounding tool scope, context integrity, and escalation authority, with receipts in the same log. Composition is not self-certification: the loop contract's obligations MUST be discharged by a verifier independent of the generator (§6.2), its generator chain MUST terminate at a human-attested root (§5.1.2), and a loop receipt discharged only by the generator itself serializes self_attested, non-promotable. Below JR-3 this is SHOULD, with the same demotion when claimed.

6.4 Key lifecycle — forward-only, logged, never retroactive

Key events are governed by the same discipline as everything else: rotation, revocation, and succession are signed, independently-timestamped amendments to an append-only office key log — §5.2 applied to keys. The log's wire form carries two event kinds: Added { key, at } and Revoked { key, attested_compromise_at, recorded_at } — revocation's two timestamps are what define the demoted window. Events are evaluated in chronological order of effective time (a revocation outranks an addition at the same instant), never in append order. Consequences:

• Disjointness has a time coordinate. Independence is computed over key sets as of the discharge timestamp per the key log and sealed (§5.1.3). Later rotation-into-overlap (an acquisition, a merger) never re-grades past discharges.
• Revocation demotes forward, never invalidates backward. A compromise is recorded as a signed attestation with an attested compromise time. Receipts signed between attested-compromise and revocation-record serialize verifier_revoked_window — treated as unattested. Receipts sealed before the attested compromise time stand. This is consistent with no-retroactive-authority (§11) because it is grounded demotion by signed evidence, not fiat invalidation — and it closes the gap between the slow key failure this standard already handled (cryptanalysis, §3.1) and the fast one it didn't (theft).

---

7. Wire Format and Recognized-Edge Emission

Novel core, recognized edge. Contract and receipt serialize as canonical JSON, defined as: UTF-8; object keys sorted lexicographically by Unicode code point at every depth; no insignificant whitespace; strings escaped per RFC 8259 minimal escaping; numbers in shortest round-trip decimal form with float-ness preserved (a float serializes with its decimal point: 3.0, never 3). This is deliberately not RFC 8785/JCS — JCS collapses 3.0 to 3, which would erase the integer/float distinction energy figures carry. Content addresses are digests over the canonical form's UTF-8 bytes. (JSON Web Proof permitted for selective disclosure.) A receipt MUST be expressible as an in-toto Statement with a JouleContract predicate type wrapped in DSSE, and MAY carry a SLSA provenance predicate. The DSSE signature is computed over the Pre-Authentication Encoding — "DSSEv1" SP LEN(payloadType) SP payloadType SP LEN(payload) SP payload, lengths as ASCII-decimal byte counts — with standard padded base64 for payload and signature; the in-toto subject digest map uses that ecosystem's bare algorithm names (sha256: unprefixed hex) while every native field keeps the algorithm-prefixed form of §3.1. Signatures MUST verify with standard tooling; eIDAS qualified signatures/seals for EU legal effect; FIPS 140-3 validated cryptography for US federal boundaries; algorithm-agile under §3.1. Governance mappings SHOULD emit as OSCAL; energy figures SHOULD be reportable as ISO/IEC 30134 KPIs and ISO 50001 EnPIs.

---

8. Regulatory and Standards Mapping

JouleContract element	Recognized standard / control
Discharged obligation + Rigor class	IEC 61508 assurance case; ISO 26262 / IEC 62304 / EN 50128; DO-178C (independent lineage)
Rigor↔SIL mapping via bound risk assessment	IEC 61508 hazard & risk analysis; ISO 26262 HARA
Frame (no unintended function)	DO-178C absence of unintended function; ISO 26262 freedom from interference
Tier classes + qualification binding	DO-330 TQL (deterministic tiers); DO-333 soundness; ISO 26262 TCL
Computed key-disjointness / party binding / quorum	IEC 61508 FS assessment; DO-178C DAL-A/B independence; SR 11-7; ISAE 3000; eIDAS seals; vLEI
Engagement disclosure / recourse hook	PCAOB auditor-independence lineage; eIDAS Art. 13 liability; ISAE 3000 practitioner regime
Bound generator identity (AI-BOM)	OWASP AISVS App. C AC.9.1 (L2); SLSA/in-toto builder identity; NIST SP 800-218A
Sealed evidence bundle + retention office	21 CFR Part 11 (records retained & producible); NIST 800-53 AU
Amendment = metered, anchored, future-only transition	ISO/IEC 42001 change control; NIST 800-53 CM; SOX; DORA; eIDAS / RFC 3161 timestamps
Continuous receipt log	NIST 800-53 CA ConMon; EU AI Act record-keeping; ISO 19011
Generation-loop security	OWASP AISVS; OWASP Agentic Top 10
Bound joule ceiling as EnPI vs signed EnB	ISO 50001
Bound energy provenance (meter attestation)	ISO/IEC 30134 measurement categories & unaccounted-energy rules
joules_spent (not residual) into disclosure	CSRD / ESRS E1; ISO/IEC 30134-8 (CUE)
Governance wrapper	ISO/IEC 42001 AIMS (certifiable per 42006); NIST SP 800-218 SSDF

---

9. Lineage

Hoare logic and Dijkstra's weakest precondition (the obligation generator) · Meyer's Design by Contract (pre/post/invariant in the signature; frame and joule ceiling are two more clauses) · the frame problem (McCarthy & Hayes) — what must be declared not to change — realized as a mutable-footprint declaration whose direct modern ancestors are modifies-clauses (JML assignable, Dafny modifies); separation logic's frame rule admitted as a discharge technique, not the source of the clause · Knuth's literate programming (intent is the durable source; code is extracted) · the governance canon itself (IEC 61508 and the independently-evolved DO-178C family; ISO 50001; ISO/IEC 42001), composed rather than reinvented. The name "pseudocode" is declined as homage: pseudo means false, and this is the most rigorous artifact in the stack, not the least.

---

10. Conformance: a Composed Profile

JCAP = ⟨ Rigor class, Energy class, Governance class ⟩

Rigor class (JR-1 to JR-4) — this standard's own scale of discharge rigor, defined by requirements, not borrowed authority:

• JR-1: obligations declared; discharge recorded honestly (demoted states permitted throughout).
• JR-2: generator-independent frame discharge (§3.4); bound generator identity.
• JR-3: bounded discharged frame (an undischarged obligation — any of the five, not only the frame — caps Rigor below JR-3); party-disjoint independence with engagement disclosure (§6.2); qualified deterministic tiers per obligation (§6.1); generator loop governance (§6.3); verification and timestamp quorum (§5.2.1, §6) — quorum at JR-3 is receipt-scoped: k counts distinct party-disjoint verifier entities across the receipt's discharge entries, k ≥ 2; independent anchors on all receipts.
• JR-4: all of JR-3, plus frame mode observed or attested (never static_only), and per-obligation quorum: every declared obligation discharged by ≥ 2 distinct party-disjoint verifier entities (an obligation MAY carry multiple discharge entries; that is how per-obligation quorum is expressed on the wire).

JR is not SIL. SIL attaches to a safety function's risk reduction, derived from hazard analysis by an assessor — a derivation this standard cannot perform and does not fake. Where a transition is a safety function under an inherited sector standard, the contract MAY carry a sector-equivalence claim — the scheme and level (e.g. IEC61508:SIL-3), the risk-assessment attestation's content address, and the assessor of record's key — and the claim binds only when the attestation resolves in sealed evidence and the assessor's key is disjoint from the effective generator key set; otherwise it serializes target_self_assigned and no sector equivalence may be stated. The rigor target is recorded in the contract (§3) and profile is trust-bearing (§1): a producer who targets JR-1 evades nothing — the low target is the visible, legible promise, priced by the relying party.

Energy class: Metered (bound, §4.2) > ModelBased > Unaccounted. Metered MUST NOT serialize unless the meter attestation is sealed and resolving — the energy gate.

Governance class: AIMS maturity from declared to certified; generator_unattested, self_attested, or open breach_unamended caps the class.

Evaluation is two-stage, and the stages are normative. Receipt-local evaluation — the receipt and contract alone — can witness at most JR-2 and managed: the JR-3+ gates (sealed-evidence resolution, key-log time coordinates, independent anchors, quorum, loop governance) are not visible from the receipt alone, and a validator that grades higher from local evidence is non-conformant. JR-3, JR-4, and certified are composed verdicts, evaluated over the receipt plus the sealed evidence bundle, the office key log, and the transition interval. (Codified in v0.7 from the round-four implementation diff, where a single-stage validator was found over-grading JR-4 from local evidence.)

The least-bound-axis rule. A class may be claimed only where its supporting fields are bound (§1), on all three axes: JR-3+ requires resolving qualifications and computed-plus-party independence; certified requires an attested generator and closed breaches; Metered requires the meter binding. No axis can be inflated by assertion, and no axis's shine can halo another's demotion.

The claim-discipline rule. A conformance claim MUST be made as the full JCAP tuple plus its demoted-state disclosure; the bare word "conformant," unqualified, is itself a non-conformant claim. (A receipt with every field demoted is conformant — and must be visibly so at the point where the halo would otherwise be harvested.)

10.1 Named residuals — what this standard cannot mechanize, graded instead of hidden

A standard that silently implied completeness it cannot have would contain illogic; JouleContract names its limits:

1. Obligation-set adequacy. Discharge proves stated obligations; nothing certifies the obligation set is complete against the behavior space. This residual is the entire canon's (DO-178C requirements validation; the ML ODD coverage question taken up by the forthcoming ED-324/ARP6983). A contract MAY carry an ODD-style domain annex making the boundary of the claim auditable.
2. Common control. Party disjointness is bound by entity credentials; corporate control graphs are not mechanizable by any credential scheme. Disclosure and party-level rules (ISAE 3000 lineage) are the available instrument.
3. Issuer-pays gravity. Engagement disclosure makes verifier capture legible, not impossible. Market structure is not mechanizable by a document.
4. The demand side. This standard prices honesty; it cannot price assurance. A fully-demoted receipt is conformant by design — truthful disclosure beats driven-underground lying — and the demoted floor is therefore the intended floor. Assurance is priced by relying parties demanding profiles: the JCAP tuple is the demand-side instrument, and the claim-discipline rule exists so the market can see what it is buying.

---

11. Stewardship Succession — no organization as point of failure

Stewardship is an office. The protocol is ownerless; the steward maintains the Register (§13), publishes algorithm deprecations (§3.1), and convenes amendment review. The office is bound by:

• Fork-freedom. CC-BY-4.0 (text) and Apache-2.0 (reference implementation) guarantee any party may continue the standard if the steward fails, defects, or captures. The ultimate succession mechanism is the license itself.
• Succession rule. Transfer by signed amendment; on dissolution or published-timeout unresponsiveness, any party maintaining a conformant reference implementation MAY assume interim stewardship by signed public declaration; competing claims resolve by implementer adoption, auditable in the log.
• No retroactive authority. A steward cannot invalidate prior receipts or versions; with Register pinning (§5.1.4), a steward cannot even reinterpret them. All authority is forward-looking, exercised through traced amendments — the same direction-of-time discipline imposed on producers (§5.2.1) and keys (§6.4).

---

12. Security Considerations

The posture is §1's two rules: bind or demote; seal or float visibly. Stated bounds, each now precise about what it does and does not bound:

• Generator spoofing — bounded by attestation binding with a defined key set (§5.1.1).
• Frame minimization / sham tiers — bounded by generator-independent frame discharge at JR-2+, mode disclosure, and the nonexistence of a closed unbounded frame (§3.4).
• Qualification laundering — bounded by sealed, validity-windowed, independently-signed, root-terminating qualification bindings (§6.1, §5.1.2).
• Manufactured independence — key-only disjointness is named as insufficient (independent:key_only); party binding raises the forgery cost to incorporation fraud; common control and issuer-pays capture are named residuals (§10.1), not claimed bounds — disclosure makes them legible, nothing in this document makes them impossible.
• Retroactive breach legalization — bounded by sealed intervals, start-anchor governance, prompt-anchoring latency, independent stamps on all receipts at JR-3+ (an unanchored receipt is treated as predating every amendment), and timestamp + verification quorum on amendments (§5.2.1).
• Amendment flooding — bounded by quorum at high rigor; the meter exists for attribution, not deterrence, and its ceiling is office-priced so it cannot be self-priced away (§5.2).
• Meter capture / estimator abuse — bounded by the meter-attestation binding and the non-promotion rule (§4.2); residual-minting bounded by ceiling-derivation binding and the residual-is-not-a-savings-claim rule (§4.1).
• Receipt rot / identifier hijack — bounded by sealing: re-verification runs against sealed evidence, never live identifiers (§5.1.3).
• Key theft — bounded by the forward-only key log and revocation windows (§6.4).
• Verifier capture (single) — bounded by office/key separation, party-disjoint quorum, replaceability over sealed receipts (§6). Verifier alignment (all-of-n, issuer-paid) — not bounded by this document; see §10.1.
• Generation-loop compromise — bounded by external discharge and self_attested demotion (§6.3).

---

13. Register (non-normative; receipts pin a snapshot, §5.1.4)

Current editions as of this version: IEC 61508:2010 (Ed. 2) · DO-178C/ED-12C + DO-330/331/332/333 (independent lineage) · ARP4754A; ED-324/ARP6983 (in development, first publication expected 2026; Issue 1 scoped to frozen, supervised, non-adaptive ML up to DAL C) · ISO 26262 · IEC 62304 · EN 50128 · ISO 50001:2018 · ISO/IEC 30134-2:2026 · ISO/IEC 42001 (EN ISO/IEC 42001:2026 in the EU) · ISO/IEC 42005:2025, 42006:2025 · NIST SP 800-218 + 800-218A · OWASP AISVS v1.0 + Agentic Top 10 (2026) · eIDAS (Reg. 910/2014 as amended; qualified timestamps & seals; Art. 13 liability) · RFC 3161 · vLEI (GLEIF) · FIPS 140-3 · SLSA v1.2 · RFC 2119/8174. Recognized timestamp regimes by jurisdiction: eIDAS qualified (EU) · RFC 3161 under a named policy (US/global) · enclave-internal office (§5.2.1) for air-gapped deployments. Updated by steward amendment; never alters normative text or past receipts.

---

14. Lineage of this document's own holes (informative)

Three adversarial rounds, each finding the layer beneath the last repair: the v0.3 diff against the global canons found the semantic gaps (frame, generator, qualification — what the contract must say). The v0.4 self-diff found the binding gaps (every new word was a string the producer could self-sign). The v0.5 self-diff found three more layers at once: the original words were still unbound — including the joule itself, the standard's namesake, sitting in §4.2 as exactly the estimation-laundering the section forbids; the bindings had no coordinate in time (resolution, rotation, expiry, editions); and cryptography stops at keys, while assurance needs parties and consequences — part mechanizable (entity credentials, engagement disclosure, recourse hooks), part nameable only (§10.1). The law of evolution, stated once: each round, the standard is forced to apply its own newest rule to its own oldest text. The standard improves by being adversarially diffed, not defended; the diffs are part of its provenance (joulecontract-diff-v0.3-global.md, joulecontract-diff-v0.4-self.md, joulecontract-diff-v0.5-self.md).

---

15. Demoted states (normative)

Promotion, defined generally: promotion is any downstream re-serialization, summary, or claim that presents a demoted state as its corresponding bound state — prohibited for every state below, by any consumer. Demotion is the standard's universal answer to unverifiable claims: record-as-untrusted, never forbid-and-drive-underground, never present-as-clean.

State	Meaning	Effect
undischarged (+ reason)	An obligation no tier closed — any of the five, including an unboundable frame	Caps Rigor class below JR-3 (§10)
generator_unattested	Generator identity not bound to a non-signer attestation	Caps Governance class at declared
qualified:false	Qualification unresolvable in evidence, expired at discharge, self-signed, or unterminated chain	Discharge counts as unqualified (§6.1)
independent:false (computed)	Discharge key set not disjoint from generator key set	Fails independence at every class
independent:key_only	Keys disjoint but no party-level entity binding	Fails independence at JR-3+ (§6.2)
engagement_undisclosed	Verifier selection/compensation not disclosed as bound identities	Fails independence at JR-3+ (§6.2)
recourse_undeclared	Verifier under no recognized liability regime	Profiles MAY reject; relying parties weight accordingly
self_attested	Generation-loop receipt discharged only by the generator	Non-promotable (§6.3)
unterminated	Trust chain reaching no defined root (§5.1.2)	Treated as unattested; qualification trigger (§6.1)
metered_unattested	Metered tag without a sealed, non-signer meter attestation	Energy class falls to ModelBased where a metered-baseline anchor is sealed, else Unaccounted (§4.2)
ceiling_unanchored	Ceiling without a derivation binding to its EnB	Residual carries no evidentiary weight (§4.2)
component_unattributed	Composed energy figure without per-component attribution	Cannot feed ratchet or residual claims (§3.3)
breach_unamended	Deviation with no forward-looking amendment or fix-receipt	Caps Governance class until closed (§5.2)
timestamp_unanchored	Receipt without an independent timestamp where required	Treated as predating every amendment (§5.2.1)
timestamp_stale	Receipt anchored after the profile's maximum latency	Withheld-receipt disclosure (§5.2.1)
verifier_revoked_window	Signed in the attested-compromise-to-revocation window	Treated as unattested (§6.4)
target_self_assigned	Sector-level (SIL/DAL/ASIL) equivalence claimed without a bound risk assessment	No sector equivalence may be stated (§10)
validation_recorded, evidence_lost	Sealed verdict survives; bundle lost after issuance	Verdict stands; re-checkability demoted (§5.1.3)
unresolvable	Reference never validated by the verifier of record	Treated as the corresponding false/unattested state
evidence:external	No sealed bundle; references float on live infrastructure	Conformant; exactly as trustworthy as that infrastructure
static_only	Frame bounded by analysis, not observed/witnessed	Disallowed at JR-4 (§10)
Unaccounted	Energy estimated where the substrate exposes nothing	Never promotable (§4.2)

---

16. Amendment Log

Each entry: version, amends-digest (real, computed over the published markdown serialization of the amended version), change, reason. The log is normative history; the standard practices its own §5.2.

v0.8.0 — amends sha2-256:e2f6dd215244bf18e0ea7e1ddc0a6889f66de427baa4130d5be82b3c0ac7c5a4 (v0.7.0) — the implementability amendment

1. §5.1.3: the evidence-bundle construction is normative (digest of the LF-joined, lexicographically sorted member addresses). Reason: round five's clean-room auditor recovered it only by brute force; a content-addressed object whose addressing is unpublished is named-but-not-bound at the standard's own front door. (Round-5 P1.)
2. §7: canonical JSON is defined (code-point-sorted keys, no whitespace, shortest round-trip numbers with float-ness preserved — explicitly not RFC 8785) and the DSSE PAE is in the spec text. Reason: the obvious canonicalization RFC produces the wrong digest; an implementer must not discover that by experiment. (P4, P14.)
3. §10: quorum scope stated — receipt-scoped k ≥ 2 at JR-3; per-obligation at JR-4, expressed as multiple discharge entries per obligation. Reason: the spec's literal per-obligation reading failed the golden vector; spec and vector now agree, and a JR-4 vector makes the distinction visible. (P3.)
4. §5.1: obligation matching is exact; the conformance pack is the normative wire form; timestamps are integer seconds. Reason: three published shapes with none declared normative is silent-divergence machinery. (P5, P6, P13.)
5. §6.4: the key-log event enum is on the wire (Added/Revoked with the two-timestamp window, effective-time evaluation order). Reason: the semantics-bearing event was unrecoverable from one observed variant. (P9.)
6. Pack expansion recorded: member bytes shipped (evidence-bundle.json), sealed contexts embedded in every negative vector, and vectors added for previously unvectored demoted states plus a JR-4 receipt. Reason: the pack was making composed claims whose evidence was not sealed alongside — the pack itself was running evidence:external; v0.8 seals the pack. (P2, P12.)
7. Named, not closed: the contract-amendment wire object (the §5.1.1 fourth union term's carrier) and composition/ratchet/re-anchor vectors. Reason: stating the remainder beats implying completeness. (P10.)

v0.7.0 — amends sha2-256:a4b8554ee0f3920c980868907360ddc4b114a2b8a30d5b5acd5f9476a4c64931 (v0.6.0)

1. §5.1: the residual is derived, never carried. Reason: a carried copy of joules_allowed − joules_spent could lie; the round-four implementation diff surfaced the divergence (the reference implementation refused to store it) and the implementation was right. (Round-4 F4-residual.)
2. §10: two-stage evaluation codified — receipt-local witnesses at most JR-2/managed; JR-3, JR-4, and certified are composed verdicts over sealed evidence + key log + interval. Reason: round four found a single-stage validator over-grading JR-4 from local evidence; the spec now states what a receipt alone can and cannot witness, so a non-composed high grade is non-conformant by text, not just by implementation. (Round-4 F3/F5.)
3. §6.2: the recourse regime is a per-discharge bound field; absent serializes recourse_undeclared as disclosure, not a rigor cap. Reason: the demoted state existed with no carrying field — named but not bindable, the exact defect class §1 forbids. (Round-4 F15.)
4. §10: the sector-equivalence claim has a concrete structure (scheme + risk-assessment address + assessor key) and a mechanical binding test (resolves in evidence, assessor disjoint from the effective generator keys). Reason: target_self_assigned existed with no claim to demote; the trigger is now decidable. (Round-4 F15/S7-residue.)
5. §5.1.3: the lost/never distinction is mechanical — the bundle address decides unresolvable vs validation_recorded, evidence_lost. Reason: the round-three demoted states were defined but their boundary was a judgment call; it is now a comparison. (Round-4 deferred item, closed.)
6. §3.1: the cross-digest re-anchor record is named (forward-only log, hop-bounded resolution). Reason: the migration rule existed without its record structure. (Round-4 F18.)
7. Implementation closure recorded: composition (§3.3) with per-component ceiling accountability and frame propagation, and the per-EnB ratchet (§5.3) with anchored-ceiling and attribution preconditions, are now implemented in the reference workspace; component_unattributed, recourse_undeclared, target_self_assigned, and evidence_lost are all producible. Reason: §15's vocabulary must be producible or marked future; after v0.7 every demoted state is producible.

v0.6.0 — amends sha2-256:86800c4bc7d5dcffd920da23370f7e3eb4acb91dc66e4038da74102b6e061441 (v0.5.0)

1. Bound the energy axis (§4.1, §4.2, §3.3, §10): meter attestation behind Metered or metered_unattested; signed EnB; ceiling-derivation binding or ceiling_unanchored; energy gate in the least-bound-axis rule; residual declared a control signal, never a savings claim; composition never relicenses ceilings (per-component attribution or component_unattributed). Reason: the standard's namesake field was its last unbound trust-bearing string — Metered was self-asserted, the ceiling and EnB were producer-declared, and §4.1 routed the resulting manufactured residual into CSRD disclosure: estimation laundering inside the section that forbids it. (S1, E6, E5, E7.)
2. Sealing rule (§1, §5.1.3): conformance evaluated once at discharge and sealed; content-addressed evidence bundles; resolution-free re-verification; DID strings demoted to labels; validity windows evaluated at discharge; retention office; validation_recorded, evidence_lost vs unresolvable; evidence:external; air-gapped conformance. Reason: "resolve" had no when and no against-what — receipts became verifiably wrong when domains changed hands, rotted when attestation stores went dark, and structurally excluded air-gapped deployments; binding-as-liveness decayed against §6's own no-invalidating-prior-receipts rule. (T1, T5, T6, T7, S5, S12.)
3. Key lifecycle (§6.4): append-only office key log; disjointness computed as-of discharge; revocation demotes forward (verifier_revoked_window), never invalidates backward. Reason: "revocation" did not appear in v0.5; a stolen key either invalidated thousands of receipts retroactively (against §11) or attested forever; rotation-into-overlap retroactively flipped past independence. (T2.)
4. Temporal closure (§5.2.1, §5.1.4): transitions are intervals governed by the contract at start-anchor; prompt-anchoring latency or timestamp_stale; independent stamps on all receipts at JR-3+ (unanchored = predates every amendment); TSA as an office by role with jurisdictional regimes and quorum; Register pinning. Reason: the temporal-ordering invariant compared against a stamp the producer scheduled — withholding a receipt slipped a breach behind a frame amendment; transitions spanning amendments were judged against contracts that hadn't admitted them; the TSA was a dependency of exactly the class §0 forbids; editions floated, letting Register updates reinterpret past receipts. (T4, S2, T3, T8.)
5. Keys→parties→consequences (§6.2, §5.1.1): generator key set defined; §6.2's computation named as key disjointness (floor); legal-entity credentials at JR-3+ (independent:key_only below the bar); engagement disclosure or engagement_undisclosed; recourse hook or recourse_undeclared; common-control and issuer-pays as named residuals (§10.1); §12's "structurally impossible" retracted. Reason: computed independence was Sybil-trivial (two $12 domains, one owner) and its operand was undefined; verifier markets are issuer-paid with zero signature downside — part bindable with instruments the spec already inherited (eIDAS seals) and never deployed, part not mechanizable by any document and now named instead of over-claimed. (E1, E2, E8, S6.)
6. Incentive repair (§5.2, §10): breach_unamended caps Governance until closed; amendment ceilings office-priced and de minimis; claim-discipline rule (full tuple + demotion disclosure, or the claim is non-conformant); the honest equilibrium named — the standard prices honesty, relying parties price assurance, the demoted floor is intended. Reason: governed change cost joules/stamps/quorum while silent breach cost nothing — the meter taxed honesty and missed the budgeted flooder; and the all-demoted conformant receipt was the market's rational equilibrium, harvestable as a halo unless the claim itself must disclose its demotions. (E4, E3.)
7. Recursion and quorum closure (§5.2.2, §6): normative minimal amendment-contract as base case (amendments chain, never meta-amend); verifier office defined (membership, key log, succession); quorum MUST at JR-3+ across party-disjoint verifiers, k ≥ 2; "implies" replaced; quorum-economics paragraph (deterministic re-execution is why quorum is affordable). Reason: amendment-as-transition was a new unterminated recursion; quorum was simultaneously SHOULD (§6) and MUST (§5.2.1) over an undefined "office," satisfiable at k=1/n=1, and keys-of-one-office quorum was defeated by capturing that office. (S8, S4, E9.)
8. Rigor class replaces borrowed SIL (§10, §2.1, §3): JR-1..4 defined by this standard's own requirements; sector equivalence only via bound risk-assessment attestation, else target_self_assigned; rigor target recorded in the contract; profile added to §1; frame mode attested (independent witness/receiver) restores the cross-domain assurance claim; ratchet scoped per-EnB. Reason: SIL was self-assigned with no hazard analysis — canon misuse of the class rounds 1–2 policed, and an escape hatch (declare SIL-1, evade every gate); software-only frame modes had quietly capped every non-computational transition below high rigor, breaking the claim the standard was born from; the ratchet across an EnB change was a comparison §4.3 forbids. (S7, S9, T10.)
9. Hygiene: exemplar made conformant (all seven obligations discharged); §15 table completed and reconciled with §10 (non-frame undischarged caps; unterminated as qualification trigger; static_only disallowed at JR-4; timestamp rows); one root vocabulary (human-attested; human-authored retired); promotion defined generally; transition/execution defined (§5.1.5); grammar; real digests in this log. Reason: the showcase receipt failed the standard it showcased; the demoted-state table promised effects no profile delivered; three roots were declared as two; the self-hosting chain was four versions of angle-bracket placeholders — the Self-Hosting Clause was undischarged by its own vocabulary. (S3, S10, S11, S13, S14, T9.)

v0.5.0 — amends sha2-256:ee932a71b94d71ddd4fc1abfb5805f2066e925fa17b6587b735cfdfc61b3835a (v0.4.0). Binding rule; no closed unbounded frame; composition never relicenses (frames); trust-chain termination; bound generator; temporal-ordering invariant; metered amendments; deterministic/stochastic tier split; computed independence; least-bound-axis rule; canon-fidelity corrections; demoted-state vocabulary.

v0.4.0 — amends sha2-256:97a957abac569d07d0a3a71dcdd418378ae1f852108280f549329c19cde0222a (v0.3.0). Frame as fifth obligation; generator identity; discharge-tier qualification; per-obligation independence; generation-loop composition; adequacy residual named; resource-bound precise claim; security considerations.

v0.3.0 — amends sha2-256:1c4bd6a0232174a04f6a04857fd7522c9799873d963da89692a8c024992f73b8 (v0.2.0). Self-Hosting Clause; cryptographic agility; cross-domain ledger rule; economic granularity; verifier office + quorum; stewardship succession; inheritance by role with Register; composition.

v0.2.0 — amends sha2-256:8c042e984dd54400a78bbafb654efac3dc8031b191b14c302e31d5f5888128cd (v0.1.0). Re-founded on the recognized canon (IEC 61508, ISO 50001/30134, ISO/IEC 42001); composed profile replaced the invented ladder.

v0.1.0 — genesis. Core object (pre/post/inv/ceiling), receipt, amendment-as-transition, breach redefinition, energy-as-coordinate, verifier-of-record, recognized-edge emission.

---

Appendix A — Example (informative)

{
  "joulecontract": "0.8.0",
  "subject": "fn settle_batch(orders) -> Settlement",
  "rigor_target": "JR-3",
  "pre":   ["all orders signed", "sum(debits) == sum(credits)"],
  "post":  ["ledger balanced", "each order has a settlement id"],
  "inv":   ["no order in two settlements", "no negative balance at any step"],
  "frame": ["ledger table", "settlement index"],
  "ceiling": {
    "enpi_joules": 3.0, "unit": "EOC-J",
    "enb_ref": "sha2-256:ab19…",
    "derivation": { "ref": "sha2-256:dc41…", "basis": "metered median of 200 comparable batches", "signer": "did:web:energy-office.example" }
  },
  "amends": "sha2-256:9b2c…"
}

{
  "ReceiptPayload": {
    "contract":  "sha2-256:1f4a…",
    "transition":"sha2-256:77de…",
    "interval": { "start_anchor": { "authority": "did:web:tsa-1.example", "at": "2026-06-10T14:00:02Z" },
                  "receipt_anchor": { "authorities": ["did:web:tsa-1.example", "did:web:tsa-2.example"], "at": "2026-06-10T14:02:11Z", "latency_ok": true } },
    "generator": {
      "system": "joulecode-agent", "model": "claude-opus-4-8",
      "version_digest": "sha2-256:5c0d…",
      "attestation": { "ref": "sha2-256:77aa…", "signer_keys": ["sha2-256:k9aa…"], "binding": "attested" },
      "key_set": ["sha2-256:k1ff…", "sha2-256:k9aa…", "sha2-256:k3b2…"],
      "human_principals": ["did:web:eng-a.example"],
      "context": "ticket SETL-4821",
      "loop_governance": { "contract": "sha2-256:90ef…", "discharged_by": "did:web:audit-a.example", "root": "human-attested" }
    },
    "discharge": [
      { "obligation": "pre: all orders signed",        "tier": "sha2-256:t0aa…", "tier_class": "deterministic", "result": "closed",
        "qualification": { "ref": "sha2-256:q0…", "signer": "did:web:assessor.example", "valid_until": "2027-06-01", "validated_at": "2026-06-10", "root": "human-attested", "qualified": true },
        "verifier": "did:web:audit-a.example", "independence": "party", "engagement": { "selected_by": "did:web:relying-bank.example", "compensated_by": "did:web:relying-bank.example" } },
      { "obligation": "pre: sum(debits) == sum(credits)", "tier": "sha2-256:t0aa…", "tier_class": "deterministic", "result": "closed",
        "qualification": { "ref": "sha2-256:q0…", "signer": "did:web:assessor.example", "valid_until": "2027-06-01", "validated_at": "2026-06-10", "root": "human-attested", "qualified": true },
        "verifier": "did:web:audit-a.example", "independence": "party", "engagement": { "selected_by": "did:web:relying-bank.example", "compensated_by": "did:web:relying-bank.example" } },
      { "obligation": "post: ledger balanced",          "tier": "sha2-256:t1bb…", "tier_class": "deterministic", "result": "closed",
        "qualification": { "ref": "sha2-256:q1…", "signer": "did:web:assessor.example", "valid_until": "2027-06-01", "validated_at": "2026-06-10", "root": "human-attested", "qualified": true },
        "verifier": "did:web:audit-a.example", "independence": "party", "engagement": { "selected_by": "did:web:relying-bank.example", "compensated_by": "did:web:relying-bank.example" } },
      { "obligation": "post: each order has a settlement id", "tier": "sha2-256:t1bb…", "tier_class": "deterministic", "result": "closed",
        "qualification": { "ref": "sha2-256:q1…", "signer": "did:web:assessor.example", "valid_until": "2027-06-01", "validated_at": "2026-06-10", "root": "human-attested", "qualified": true },
        "verifier": "did:web:audit-b.example", "independence": "party", "engagement": { "selected_by": "did:web:relying-bank.example", "compensated_by": "did:web:relying-bank.example" } },
      { "obligation": "inv: no order in two settlements", "tier": "sha2-256:t3cc…", "tier_class": "deterministic", "result": "closed",
        "qualification": { "ref": "sha2-256:q2…", "signer": "did:web:assessor.example", "valid_until": "2027-06-01", "validated_at": "2026-06-10", "root": "reference-impl", "qualified": true },
        "verifier": "did:web:audit-b.example", "independence": "party", "engagement": { "selected_by": "did:web:relying-bank.example", "compensated_by": "did:web:relying-bank.example" } },
      { "obligation": "inv: no negative balance at any step", "tier": "sha2-256:t3cc…", "tier_class": "deterministic", "result": "closed",
        "qualification": { "ref": "sha2-256:q2…", "signer": "did:web:assessor.example", "valid_until": "2027-06-01", "validated_at": "2026-06-10", "root": "reference-impl", "qualified": true },
        "verifier": "did:web:audit-b.example", "independence": "party", "engagement": { "selected_by": "did:web:relying-bank.example", "compensated_by": "did:web:relying-bank.example" } },
      { "obligation": "frame: ledger+index",            "tier": "sha2-256:t2dd…", "tier_class": "deterministic", "result": "closed", "mode": "observed",
        "qualification": { "ref": "sha2-256:q3…", "signer": "did:web:assessor.example", "valid_until": "2027-06-01", "validated_at": "2026-06-10", "root": "human-attested", "qualified": true },
        "verifier": "did:web:audit-a.example", "independence": "party", "engagement": { "selected_by": "did:web:relying-bank.example", "compensated_by": "did:web:relying-bank.example" } }
    ],
    "execution": ["sha2-256:x0aa…", "sha2-256:x3bb…"],
    "joules_spent": 2.1,
    "meter": { "attestation": "sha2-256:m7ee…", "signer": "did:web:substrate-telemetry.example", "category": "Metered" },
    "joules_allowed": 3.0,
    "provenance": "Metered",
    "enb_ref": "sha2-256:ab19…",
    "grid_mix": { "renewable": 0.61, "region": "eu-w-1", "attestation": "sha2-256:g2cc…" },
    "verifier": ["did:web:audit-a.example", "did:web:audit-b.example"],
    "verifier_entities": [ { "did": "did:web:audit-a.example", "entity": "vLEI:5493…A1" }, { "did": "did:web:audit-b.example", "entity": "vLEI:5493…B2" } ],
    "profile": { "rigor": "JR-3", "energy": "Metered", "governance": "certified" },
    "register_pin": "sha2-256:r8ff…",
    "evidence": { "bundle": "sha2-256:e4dd…", "sealed": true },
    "signature": "eIDAS-QES…"
  }
}

Every declared obligation — both preconditions, both postconditions, both invariants, and the frame — carries a discharge entry, as §5.1 requires of any receipt, including this showcase. The receipt verifies without network access: all referenced attestations, key material, and the EnB are sealed in bundle e4dd…; the DID strings are labels. Independence is party-level (vLEI-bound entities disjoint from the generator), engagement is relying-party-paid (not issuer-paid — and the disclosure is what lets a reader see that), the energy figure carries a substrate-signed meter attestation, the ceiling carries its derivation, the interval is dual-anchored, and the Register snapshot is pinned. The JR-3 claim is legal under §10 because every supporting field on all three axes is bound — which is the claim-discipline rule satisfied in full: tuple, plus demotions (none), visible.

---

End of v0.8.0 — a traced amendment of v0.7.0 under the standard's own §5.2, with the five adversarial diffs that produced it recorded in its provenance.