429dc59a83
Round five turned the adversarial method on the published artifacts themselves: a clean-room auditor, forbidden from reading joulecontract-rs, attempted to build a conformant validator from SPEC + conformance pack alone. Verdict: receipt-local yes, composed no. Seventeen findings (provenance/joulecontract-diff-v0.7-pack.md) — the bundle construction was recoverable only by brute force, the negative vectors demanded composed verdicts while omitting their sealed contexts, the key-log event model showed one variant of two, the spec's literal quorum MUST failed the golden vector, and RFC 8785 (the canonicalization any honest implementer reaches for) produces the wrong digest. SPEC v0.8.0 amends v0.7.0 (archived byte-exact; seven verified anchors): bundle address = digest of LF-joined sorted member addresses; canonical JSON defined precisely (float-ness preserved — deliberately not JCS); DSSE PAE in the spec text; quorum scope stated (receipt-scoped k≥2 at JR-3, per-obligation at JR-4); obligation matching exact with the frame synthesis rule; the pack declared the normative wire form; timestamps integer seconds; the KeyLog Added/Revoked enum on the wire. Pack expands 13 → 22 vectors: evidence-bundle.json ships every member's bytes (incl. the transition record), every negative embeds its sealed context, four new mutation negatives (engagement_undisclosed, recourse_undeclared, static_only_frame, unterminated_chain), three context-variant vectors (timestamp_stale, breach_unamended, verifier_revoked_window), and a JR-4 receipt making per-obligation quorum visible. The EnB object is now sealed evidence and resolved by the composed validator. Conformance README rewritten as an implementer's guide; remaining unvectored behaviors stated explicitly. Also: joule-code pre-existing clippy warnings fixed (workspace now zero), binding emits 0.8.0. 76 joulecontract tests + 39 joule-code tests green, clippy zero on both workspaces. Site: Round 5 card + seven-anchor chain, redeployed. The round's lesson in the standard's own grammar: the pack was making composed claims whose evidence was not sealed alongside — it was running evidence:external. v0.8 seals the pack. Co-Authored-By: Claude Fable 5 <[email protected]>
2.9 KiB
2.9 KiB
Provenance — adversarial diff as governance
This standard improves by being adversarially diffed, not defended. Each published version was attacked by independent, mutually-blind review lenses; the findings were published as a diff document; the repairs were folded into the next version as a traced amendment under the standard's own §5.2, chained to the real digest of the version it amends. The diffs are therefore part of the standard's provenance, not commentary on it.
| Round | Document | Lenses | What it found |
|---|---|---|---|
| 1 | joulecontract-diff-v0.3-global.md |
global AI-coding canon · highest-regulated code ecosystems | The semantic gaps: no frame clause, no generator identity, unqualified verifier tooling — six gaps, folded into v0.4. |
| 2 | joulecontract-diff-v0.4-self.md |
second-order regressions · new attack surfaces · canon fidelity | The binding gaps: every new field was a string the producer could self-sign; two unterminated recursions; two canon over-claims — twenty findings, folded into v0.5. |
| 3 | joulecontract-diff-v0.5-self.md |
temporal/operational semantics · economics & collusion · spec-lawyer consistency | The time, party, and incentive gaps: the joule itself was the last unbound field; bindings had no evaluation point in time; keys are not parties and parties need consequences — thirty-three findings, folded into v0.6. |
| 4 | joulecontract-diff-v0.6-impl.md |
spec-vs-code fidelity · Rust soundness & adversarial inputs | The implementation gaps: four guarantee bypasses (case-variant key forgery, the entity-omission Party hole, caller-supplied key sets, reseal-under-any-key) and a validator that over-graded JR-4 from receipt-local evidence — twenty-eight findings, repaired in joulecontract-rs with the local/composed validator split; the spec consequences folded into v0.7. |
| 5 | joulecontract-diff-v0.7-pack.md |
clean-room implementability (spec + vector pack only, reference code forbidden) | The publication gaps: a receipt-local validator was buildable from the artifacts alone, the composed validator was not — the bundle construction, the negatives' sealed contexts, the key-log event model, and the quorum scope lived only in unreadable code, and the obvious canonicalization RFC produced the wrong digest. Seventeen findings; folded into v0.8 (six normative definitions) and a pack expansion from 13 to 22 vectors with every composed input shipped. The pack itself had been running evidence:external; v0.8 seals it. |
The pattern, stated once: each round forces the standard to apply its own newest rule to its own oldest text. The chain anchors live in ../archive/ byte-exact; verify with shasum -a 256 ../archive/*.md against the amendment log in ../SPEC.md §16.