open-standards/jouleclaw
Repository files (latest commit first)
Filename Latest commit message Latest commit date
David Charlot 84e1ef158c
All checks were successful
standards workspaces build + test / aac-rs (pull_request) Successful in 57s
standards workspaces build + test / joule-code-rs (pull_request) Successful in 45s
standards workspaces build + test / jouleclaw-rs (pull_request) Successful in 2m20s
standards workspaces build + test / joulecontract-rs (pull_request) Successful in 35s
standards workspaces build + test / map-rs (pull_request) Successful in 30s
standards workspaces build + test / mesh-rs (pull_request) Successful in 30s
standards workspaces build + test / openpay (pull_request) Successful in 1m18s
jouleclaw public surface must stay documented / Public-surface audit (jouleclaw-rs) (pull_request) Successful in 57s
standards workspaces build + test / eoc-rs (pull_request) Successful in 1m46s
standards workspaces build + test / jcp-rs (pull_request) Successful in 1m13s
standards workspaces build + test / proof-rs (pull_request) Successful in 1m18s
standards workspaces build + test / sandbox-rs (pull_request) Successful in 2m1s
standards workspaces build + test / smart-byte-rs (pull_request) Successful in 2m33s
standards workspaces build + test / arl-rs (pull_request) Successful in 10m10s
standards workspaces build + test / joule-ui-rs (pull_request) Successful in 10m12s
standards workspaces build + test / jouledesk-rs (pull_request) Successful in 10m7s
standards workspaces build + test / joulehook-rs (pull_request) Successful in 10m28s
standards workspaces build + test / sense-rs (pull_request) Successful in 9m48s
diagnose: a verification verdict must say which instrument produced it
The grounding labels under a `VerificationReport` come from a learned model — a
DeBERTa-v3 NLI head, per §6.4. That is the right instrument for the job: whether
prose entails a claim is not decidable, and a calibrated judgement is the honest
tool. The problem was never the model. It was that nothing downstream had to
notice there was one.

The provenance was already carried: `EntailmentResult` records `model_id`,
calibrated `label_probabilities` and `joules_spent`, `Provenance.entailments`
preserves the lot into the sealed artifact, and `FixtureEntailer` already names
itself. What was missing is the other half — the family's discipline call.
`jcp-action-receipt` has `check_discipline`, `proof-cascade` has
`require_substantive_proof`, `sandbox-attest` has `require_mechanism_evidence`;
the entailment path had no `require_*` at all. Carried provenance that nothing
can be made to check is a record, not a control.

So: `Backing` on the report, and `require_substantive_grounding()` to enforce it.
`Unstated`, `Unconsulted` and `Fixture` are refused; `SingleModel`, `Concurring`
and `Contested` pass. `require_grounding_from` additionally pins a model, for a
caller that has decided which instrument it trusts rather than only that one ran.

Three decisions carry the weight:

**The default is the floor.** `Entailer::backing()` defaults to `Unstated`, which
is refused — so an implementation that forgets under-claims instead of
over-claiming, the same discipline as `Vmm::attained_tier` returning S0.

**A declaration cannot outrun its evidence.** The check cross-references the
declared backing against the `model_id`s actually present in
`entailments_consulted`. A report claiming two concurring models while carrying
one model's results is refused: asserting corroboration a reader cannot obtain
from the artifact is worse than asserting nothing.

**Cache rehydration declares the floor, not a reconstructed backing.** The cached
entailments carry `model_id`s, so a backing *could* be derived from them — and
that is precisely the laundering path: a run backed by `FixtureEntailer` records
model_id "fixture-entailer", and reconstructing `SingleModel` from it would
promote a stand-in into a substantive backing on the way out of the cache.
Evidence that a model ran is not a claim about what its labels are worth. The
consequence is stated rather than hidden — a rehydrated report is refused, and
the fix is persisting the backing in `Provenance`, a cache-format change this
commit deliberately does not make.

`grounding_backing` is `Option`, `skip_serializing_if = "Option::is_none"`, and a
test asserts it never reaches the wire when unset, so reports and vectors written
before it existed serialize byte-identically and keep verifying.

The sharpest test is `a_clean_verdict_from_a_fixture_is_still_not_grounded`: an
existing fixture-backed report with no violations, verdict
`ProceedToComposition` and invariant I2 verified — every previously-checkable
signal saying "verified", and all of them true — is now refused as grounded. The
verdict is about the labels; the backing is about whether the labels are worth
anything.

Verified: 475 test binaries green across the workspace, 9 new. All 7 dependents
of `jouleclaw-schema` are in-workspace, checked rather than assumed, so
`--workspace` genuinely covers the blast radius of the schema change.

Co-Authored-By: Claude Opus 5 <[email protected]>
2026-09-10 12:18:04 -04:00
..
conformance/v1 jouleclaw SPEC.md: normative §§8-12 for waves 12-21 2026-06-02 10:42:25 -04:00
jouleclaw-rs diagnose: a verification verdict must say which instrument produced it 2026-09-10 12:18:04 -04:00
scales compliance: publish the EU draft PUE bands as a sourced data pack, not as code 2026-09-06 06:24:25 -04:00
vocab jouleclaw: wave-24 — contract + handoff + mission + value report 2026-06-03 02:35:34 -04:00
LICENSE jouleclaw: standard skeleton + Phase 1 foundation crates 2026-05-26 09:55:11 -04:00
README.md family: wire JouleClaw, Sandbox, and Joule Code as JCP consumers 2026-06-10 11:19:00 -04:00
ROADMAP.md docs: strip vanity metrics from README + ROADMAP 2026-06-02 07:30:50 -04:00
SPEC.md jouleclaw: wave-25 — contract CLI + signed verdict-receipt + source fetcher + revise loop 2026-06-03 04:12:27 -04:00

JouleClaw — Energy-Optimized AI Runtime

The substrate for AI that costs Joules, not tokens.

Capability per Joule, not capability per parameter.

What JouleClaw is

JouleClaw is a pure-Rust, omni-modal AI runtime + harness + agentic layer governed by Transaction Science as an open standard (5th in the open-standards quartet, alongside OpenPay, Smart Byte, EOC, and WAI).

Every operation JouleClaw performs walks an explicit energy-tiered cascade, top to bottom, stopping at the first stage that closes the query:

Tier Name Cost class What runs here
L0 Cache picojoules Content-addressed cache hits
L1 Lawful nanojoules Deterministic, pre-compiled primitive (text/code only)
L2 Embed sub-millijoules Matryoshka embeddings + nearest-neighbor + hybrid search
L3 Model joules Local SSM / ternary / multimodal / diffusion / etc.
L4 Wire tens of joules Remote frontier RPC (escape hatch only)

L1 (Lawful) is only meaningful for text and code modalities. For image, audio, video and 3D generation, the cascade collapses to L0 / L2 / L3 / L4 — the energy savings come from caching plus dispatch to the cheapest model that meets the quality bar.

Why JouleClaw exists

The mainstream "agentic AI" ecosystem treats inference as the entry point. Every state shift, every tool call, every routing decision runs through a 70-billion-parameter stochastic engine, burning kilojoules to do work that deterministic compute or a hot cache could resolve for microjoules.

JouleClaw inverts the default. Inference is the last resort, not the first. Frozen model weights are less trustworthy than current world state; fresh, provenance-stamped retrieval beats synthesis from training cuts. Every operation is metered in microjoules where the hardware permits it, and in millijoules where it doesn't — the spec is honest about the floor on every platform.

The thermodynamic circuit breaker is the safety mechanism. Set an energy budget; when measured consumption exceeds the budget, the breaker trips and the operation halts. Hallucination loops cannot survive an honest joule ledger.

What's here

Path Contents
SPEC.md JouleClaw v1 spec — cascade tiers, energy contract, receipt
CHARTER.md Stewardship pattern (shared across open-standards)
jouleclaw-rs/ Apache-2.0 Rust reference implementation
spec/ Tier specifications, energy provenance, receipt format
conformance/v1/ Signed wire vectors for cross-implementation verification

Reference implementation

jouleclaw-rs/ is the Apache-2.0 reference implementation in Rust. It runs on Apple Silicon (M3/M4/M5 with UMA + Metal 4 Tensor APIs), AMD Strix Halo / Ryzen AI Max, Intel Lunar Lake, NVIDIA Jetson, and discrete NVIDIA / AMD GPUs.

It is omni-modal: text, code, vision, audio, video, image diffusion, 3D Gaussian splatting, and cross-modal fusion all dispatch through the same energy-tiered cascade.

The MCP tool surface is a JCP consumer: jouleclaw-jcp wraps any jouleclaw-mcp metered tool so every dispatch is decided by the JCP runtime against a signed, metered Grant before a byte reaches the tool — the tool's identity is the content-addressed resource, the call's energy estimate is debited from the grant's joule budget, and every decision (allow and deny alike) seals as a JCR-1 receipt. An injected instruction can name an ungranted tool; it cannot make the gate dispatch it.

Status

v0.1.0 reference implementation in active development. The spec is draft status. Cross-implementation conformance vectors will land with v1.0.0.

License