5a7af57afb
All checks were successful
standards workspaces build + test / which workspaces this change touches (pull_request) Successful in 7s
standards workspaces build + test / joulehook-rs (joulehook/joulehook-rs, joulehook-rs, linux) (pull_request) Successful in 45s
standards workspaces build + test / jouledesk-rs (jouledesk/jouledesk-rs, jouledesk-rs, macos) (pull_request) Successful in 59s
standards workspaces build + test / pool-rs (pool/pool-rs, pool-rs, linux) (pull_request) Successful in 1m5s
standards workspaces build + test / arl-rs (arl/arl-rs, arl-rs, linux) (pull_request) Successful in 1m16s
standards workspaces build + test / jcp-rs (jcp-conformance, jcp/jcp-rs, -p jcp-energy --features nvml, jcp-rs, linux) (pull_request) Successful in 1m19s
standards workspaces build + test / proof-rs (proof-conformance, proof/proof-rs, proof-rs, linux, true) (pull_request) Successful in 44s
standards workspaces build + test / joule-ui-rs (joule-ui/joule-ui-rs, joule-ui-rs, linux) (pull_request) Successful in 1m41s
standards workspaces build + test / sense-rs (sense/sense-rs, sense-rs, linux) (pull_request) Successful in 34s
standards workspaces build + test / joulespec-rs (true, joulespec/joulespec-rs, joulespec-rs, linux) (pull_request) Successful in 38s
standards workspaces build + test / sandbox-rs (sandbox-conformance, sandbox/sandbox-rs, -p sandbox-tee --features amd-kds,intel-pcs, sandbox-rs, linux) (pull_request) Successful in 1m9s
standards workspaces build + test / eoc-rs (eoc/eoc-rs, -p eoc-meter --features cuda, eoc-rs, linux) (pull_request) Successful in 2m24s
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Successful in 2m48s
standards workspaces build + test / smart-byte-rs (smart-byte/smart-byte-rs, smart-byte-rs, linux) (pull_request) Successful in 2m11s
standards workspaces build + test / aac-rs (aac-conformance, aac/aac-rs, aac-rs, linux-arm64) (pull_request) Successful in 4m7s
standards workspaces build + test / jouleclaw-rs (-nodebug, jouleclaw/jouleclaw-rs, -p jouleclaw-energy --features rapl,nvml, jouleclaw-rs, linux-arm64, -C target-feature=+fp16) (pull_request) Successful in 4m10s
standards workspaces build + test / joulecontract-rs (joulecontract/joulecontract-rs, joulecontract-rs, linux-arm64, true) (pull_request) Successful in 1m6s
standards workspaces build + test / map-rs (map-conformance, map/map-rs, map-rs, linux-arm64) (pull_request) Successful in 1m9s
standards workspaces build + test / mesh-rs (mesh/mesh-rs, -p mesh-engine-gguf -p mesh-openai --features mesh-engine-gguf/gguf,mesh-openai/server, mesh-rs, linux-arm64) (pull_request) Successful in 1m4s
standards workspaces build + test / openpay (openpay, openpay, linux-arm64) (pull_request) Successful in 3m37s
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 6m39s
standards workspaces build + test / macOS energy backends (pull_request) Successful in 10m31s
Specification-driven practice converged on prose an agent interprets and a
human reads. The difficulties catalogued wherever it is examined -- specs
drifting from the code they describe, generated artifacts trusted past their
evidence, no method for checking conformance, a review burden heavy enough
that practitioners report preferring to read the code -- are measurement
problems rather than methodology ones, and they persist for one reason: the
specification is a document. A clause cannot be addressed, so nothing binds
to it; conformance is a sentence in a review, so it cannot be graded or
capped; the cost of the ceremony is an anecdote, so the argument about
whether it earns its overhead has no units.
joulespec/1 leaves the prose alone and changes what the specification is.
Addressing (SPEC 1.2, 2.1). A clause carries a label AND an obligation: the
content address of its kind and text, with the label deliberately excluded.
Evidence binds to the obligation, so renaming a clause loses no evidence
while rewording one invalidates exactly that clause's evidence. Binding by
label inverts both halves -- it survives the edit that changed the
requirement and breaks on the edit that renamed it -- which is the mechanism
by which drift goes unobserved rather than a discipline failure.
This corrects our own prior art. joule-code-spec shipped the signed,
content-addressed clause and the citation binding a coding op to it, and its
citations bind by clause LABEL with a single notion of coverage: a clause is
covered when something claims it. That is the E0 rung here.
The ladder (SPEC 2.5, 2.6), ordered by one question -- how hard would it be
for this obligation to be violated without this evidence noticing?
E0 cited the implementer says so; where prevailing practice lands
E1 reviewed a second party read the artifact, once
E2 exercised a named check ran and passed -- and flatters: a test with
no assertion passes, as does one whose fixture never
reaches the condition the clause cares about
E3 falsifiable the same check is on record FAILING against a named
counter-artifact: the first rung where green means
something, and the cheapest strong one
E4 proved no input violates it, under a formalization cross-checked
by a key other than the prover's
A proof under a merely declared formalization grades E2, not E4: it is
machine-checked evidence that the something is this clause on the prover's
word. Demotion rather than refusal -- the proof is not fake. The crate never
formalizes a clause itself, and independence is computed from key
disjointness, never read from a producer's flag: a review signed by the
citing key is the citation again.
Evaluation (SPEC 3). A specification's grade is its WEAKEST owed obligation,
absent entirely when any has no surviving evidence; averaging would let nine
proved obligations conceal one nobody looked at. Non-goals are first-class
and excluded from the cap -- an unwitnessed non-goal is correct -- while
evidence that one WAS implemented is a flag that blocks conformance however
good the rest is. Nothing is dropped quietly: an unverifiable witness, one
naming another specification, and one naming an obligation the spec does not
state are each reported, that last being the normal aftermath of a rewording.
Ties break on address, so reordering the inputs cannot change the verdict.
Drift (SPEC 4) is a partition over addresses, not a warning: kept,
relabelled (editorial, no evidence lost), reworded (that clause's evidence
invalidated), added, removed -- from which the two sets a revision review
wants fall out. A freed label reused by a new clause is an addition, not a
rewording, because the old obligation still stands. The other direction needs
no diff: a witness is bound to the artifact state it observed, so evidence
from an earlier state is stale rather than counted.
Cost (SPEC 5). Witnesses and work each carry their joules, so the receipt
seals the specified share -- how much energy went into work citing no clause,
the measured form of agents producing features nobody requested -- and
microjoules per falsifiable obligation. That denominator is deliberately the
rung whose evidence can fail: a figure per ATTEMPTED obligation rewards
ceremony, and this family's other per-unit figures count accepted tokens and
verified proofs rather than attempts. Absent where nothing reaches the bar; a
cost per unit of nothing is not a small number.
Receipts (SPEC 6) are derived from the specification, artifact, witnesses and
work -- never from a verdict handed in. A verdict is an ordinary struct, and
an interface that signed one would let a producer construct the grade it
wanted. Sealed as joulespec/1 JCR-1 (canonical det-CBOR under COSE_Sign1,
Ed25519), byte-compatible with the family verifiers. The core admits no
nulls and several figures are legitimately absent, so those keys are OMITTED
rather than zeroed: a reader finding no grade knows none was established,
where one finding E0 would believe otherwise. Each receipt carries the
per-clause audit, because which obligation is the weak one is the actionable
fact and must be answerable from the receipt alone.
CI: joulespec-rs joins the standards matrix on `linux` with a new opt-in
`clippy: true` flag that gates the workspace at zero warnings on its own
runner. Deliberately not added to the macOS lint step -- that exists for code
only a macOS host can compile, and this workspace has no Apple anything. The
flag is per-entry rather than repo-wide because several workspaces are not at
zero yet, and a gate that fails on arrival teaches people to pass
--no-verify.
The modules cite their normative sections, so check-spec-refs binds the code
to the specification mechanically -- which this standard of all of them
should do.
cargo check/clippy/test --workspace --all-targets --locked: green, zero
warnings, on the M3 Ultra build host.
Co-Authored-By: Claude Opus 5 <[email protected]>
30 lines
1.3 KiB
Text
30 lines
1.3 KiB
Text
Creative Commons Attribution 4.0 International
|
|
|
|
Copyright (c) 2026 Transaction Science, Inc.
|
|
|
|
This specification text and accompanying documents are licensed under the
|
|
Creative Commons Attribution 4.0 International License (CC BY 4.0).
|
|
|
|
You are free to:
|
|
- Share — copy and redistribute the material in any medium or format
|
|
- Adapt — remix, transform, and build upon the material for any purpose,
|
|
even commercially
|
|
|
|
Under the following terms:
|
|
- Attribution — You must give appropriate credit, provide a link to the
|
|
license, and indicate if changes were made. You may do so in any
|
|
reasonable manner, but not in any way that suggests the licensor
|
|
endorses you or your use.
|
|
|
|
No additional restrictions — You may not apply legal terms or technological
|
|
measures that legally restrict others from doing anything the license
|
|
permits.
|
|
|
|
Full licence text: https://creativecommons.org/licenses/by/4.0/legalcode
|
|
|
|
────────────────────────────────────────────────────────────────────────
|
|
|
|
Reference implementations and software accompanying this specification, if
|
|
and when published in this directory, may be released under a separate
|
|
licence (typically Apache-2.0). Refer to the licence file alongside each
|
|
artefact.
|