9ded4f4dad
All checks were successful
standards workspaces build + test / which workspaces this change touches (pull_request) Successful in 1m24s
standards workspaces build + test / joulehook-rs (joulehook/joulehook-rs, joulehook-rs, linux) (pull_request) Successful in 32s
standards workspaces build + test / pool-rs (pool/pool-rs, pool-rs, linux) (pull_request) Successful in 33s
standards workspaces build + test / joule-ui-rs (joule-ui/joule-ui-rs, joule-ui-rs, linux) (pull_request) Successful in 35s
standards workspaces build + test / jcp-rs (jcp-conformance, jcp/jcp-rs, -p jcp-energy --features nvml, jcp-rs, linux) (pull_request) Successful in 52s
standards workspaces build + test / sense-rs (sense/sense-rs, sense-rs, linux) (pull_request) Successful in 32s
standards workspaces build + test / proof-rs (proof-conformance, proof/proof-rs, proof-rs, linux, true) (pull_request) Successful in 52s
standards workspaces build + test / arl-rs (arl/arl-rs, arl-rs, linux) (pull_request) Successful in 1m30s
standards workspaces build + test / sandbox-rs (sandbox-conformance, sandbox/sandbox-rs, -p sandbox-tee --features amd-kds,intel-pcs, sandbox-rs, linux) (pull_request) Successful in 1m5s
standards workspaces build + test / joulespec-rs (true, joulespec/joulespec-rs, true, joulespec-rs, linux) (pull_request) Successful in 1m1s
standards workspaces build + test / eoc-rs (eoc/eoc-rs, -p eoc-meter --features cuda, eoc-rs, linux) (pull_request) Successful in 2m18s
standards workspaces build + test / smart-byte-rs (smart-byte/smart-byte-rs, smart-byte-rs, linux) (pull_request) Successful in 2m6s
standards workspaces build + test / macOS energy backends (pull_request) Successful in 6m9s
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Successful in 18m6s
standards workspaces build + test / jouledesk-rs (jouledesk/jouledesk-rs, jouledesk-rs, macos) (pull_request) Successful in 25m19s
standards workspaces build + test / jouleclaw-rs (-nodebug, jouleclaw/jouleclaw-rs, -p jouleclaw-energy --features rapl,nvml, jouleclaw-rs, linux-arm64, -C target-feature=+fp16) (pull_request) Successful in 19m52s
standards workspaces build + test / aac-rs (aac-conformance, aac/aac-rs, aac-rs, linux-arm64) (pull_request) Successful in 17m38s
standards workspaces build + test / joulecontract-rs (joulecontract/joulecontract-rs, joulecontract-rs, linux-arm64, true) (pull_request) Successful in 13m6s
standards workspaces build + test / map-rs (map-conformance, map/map-rs, map-rs, linux-arm64) (pull_request) Successful in 11m39s
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 23m34s
standards workspaces build + test / mesh-rs (mesh/mesh-rs, -p mesh-engine-gguf -p mesh-openai --features mesh-engine-gguf/gguf,mesh-openai/server, mesh-rs, linux-arm64) (pull_request) Successful in 10m30s
standards workspaces build + test / openpay (openpay, openpay, linux-arm64) (pull_request) Successful in 17m5s
v0.2 was a kernel nobody could emit into. This adds the reference producer and
then points it at the implementation it describes -- which found two defects
inspection had not.
THE PRODUCER (joulespec-cli). `joulespec harvest` reads the clauses from a
published specification document, runs each declared check, runs it again
against a counter-artifact, and emits a signed witness at the rung the
observations support. Also `verify` (a sealed receipt) and `drift` (two spec
revisions).
It refuses to confuse the three ways a run can fail to pass, which is the
whole soundness story:
* a test that did not RUN is not a test that passed. A harness filtered to a
name nothing matches prints "running 0 tests", reports success and exits
zero -- the shape of every check that silently stopped checking -- so the
count is parsed and required;
* a counter-artifact that did not COMPILE demonstrates nothing, because the
check never ran. Treating it as E3 evidence would manufacture
falsifiability out of a syntax error, which is the most misleading possible
result;
* a counter-artifact that compiled, ran and PASSED is a finding: the check
cannot see the thing it is about.
Exit 2 on a finding, 3 below --require-grade, so a pipeline can gate. Mutations
revert on Drop, so a panic cannot leave one in place, and the CI step asserts
the tree is clean afterwards rather than trusting that.
Three things in the manifest are declared, because they are human judgements
the standard refuses to guess: which check stands for which obligation (the
same act as formalizing a clause, SPEC 2.6), each check's anchor, and each
check's footprint -- a harness that cannot observe its own reads must not guess
(SPEC 8). Everything else is computed, including the clauses: they are PARSED
from SPEC.md 7 rather than copied into the manifest, so the manifest cannot
drift from the specification. Reword an item and its obligation address moves.
Re-wrapping a paragraph does not, because continuation lines join on one space
-- a standard that punished `fmt` would teach people to avoid it.
WHAT IT FOUND, pointed at joulespec itself (SPEC 7.1, conformance/v1/README):
1. A check whose assertion could not fail. A footprint test narrowed to a
SINGLE member, and on a one-element footprint `all` and `any` are the same
function -- so mutating the conjunction left it green and the conjunction
was never checked. A second test now covers it.
2. Dead logic in the implementation. `applies_at` guarded on the state having
no enumerable parts, and that guard could not change a single verdict: an
`all` over a non-empty footprint against no parts is already false. It
looked like care. It is gone.
A third report was a mistake in the manifest -- a counter-artifact aimed at a
branch its check never takes -- which the harvester correctly reported as a
check that cannot see its subject. Telling those two readings apart is the
operator's job; the harvester reports what it observed rather than guessing.
Every conformance item C1-C11 now reaches E3 against a counter-artifact that
made its check fail. Attestation is reported ABSENT, not independent: no work
was declared, so no implementer is known, and the standard's own rule says
absence of information about who built something is not evidence that someone
else checked it. Inventing a figure there would have been the easy lie.
TWO CONFORMANCE PACKS, and the distinction matters:
* conformance/v1/vectors/ -- the certifiable surface the charter means.
Fixed keys, clauses, witnesses and FIXED energy, byte-stable, regenerable
with JOULESPEC_GEN_VECTORS=1 and asserted byte-for-byte otherwise. One
witness of every rung the format can express, plus one bound to a
superseded state, so an implementation that mishandles any rung or
mishandles staleness fails the pack rather than passing it quietly. A test
asserts that coverage, because a pack exercising one rung certifies one
rung. Its verdict is the doctrine in miniature: two obligations well
evidenced, one carrying only the implementer's citation, specification
therefore E0 at A0.
* the self-conformance receipt -- a MEASUREMENT, not a vector. Its energy
comes from a wall clock graded Estimator, so re-running produces different
bytes. A pack that held measured energy fixed would publish a figure nobody
measured.
CI gains a `harvest: true` matrix flag beside `clippy: true`, running the
harvest on every change to this standard. It is the only gate that keeps the
suite's falsifiability from decaying, which is precisely what inspection missed
twice above.
cargo check/clippy/test --workspace --all-targets --locked: green, zero
warnings; harvest exits 0 with the tree clean after every mutation, on the M3
Ultra build host.
Co-Authored-By: Claude Opus 5 <[email protected]>
88 lines
1.1 KiB
JSON
88 lines
1.1 KiB
JSON
[
|
|
{
|
|
"id": "b3:c91a66ba27cd0f22ea5e7e18b5cf2e8a7e2da57ce0aefa28fb3f0d3631980b15",
|
|
"cites": [
|
|
"b3:d60a5a1bf07e22708d5804e949d68753889866cba079fae8c374e35047827e32"
|
|
],
|
|
"energy": {
|
|
"uj": 750000,
|
|
"provenance": "hw-shunt"
|
|
},
|
|
"author": [
|
|
202,
|
|
147,
|
|
172,
|
|
23,
|
|
5,
|
|
24,
|
|
112,
|
|
113,
|
|
214,
|
|
123,
|
|
131,
|
|
199,
|
|
255,
|
|
14,
|
|
254,
|
|
129,
|
|
8,
|
|
232,
|
|
236,
|
|
69,
|
|
48,
|
|
87,
|
|
93,
|
|
119,
|
|
38,
|
|
135,
|
|
147,
|
|
51,
|
|
219,
|
|
218,
|
|
190,
|
|
124
|
|
]
|
|
},
|
|
{
|
|
"id": "b3:70b11c91e7cb2bf75d701f1a476069f87245a3ef90d4be7d3d138847221d80db",
|
|
"cites": [],
|
|
"energy": {
|
|
"uj": 250000,
|
|
"provenance": "hw-shunt"
|
|
},
|
|
"author": [
|
|
202,
|
|
147,
|
|
172,
|
|
23,
|
|
5,
|
|
24,
|
|
112,
|
|
113,
|
|
214,
|
|
123,
|
|
131,
|
|
199,
|
|
255,
|
|
14,
|
|
254,
|
|
129,
|
|
8,
|
|
232,
|
|
236,
|
|
69,
|
|
48,
|
|
87,
|
|
93,
|
|
119,
|
|
38,
|
|
135,
|
|
147,
|
|
51,
|
|
219,
|
|
218,
|
|
190,
|
|
124
|
|
]
|
|
}
|
|
]
|