429dc59a83
Round five turned the adversarial method on the published artifacts themselves: a clean-room auditor, forbidden from reading joulecontract-rs, attempted to build a conformant validator from SPEC + conformance pack alone. Verdict: receipt-local yes, composed no. Seventeen findings (provenance/joulecontract-diff-v0.7-pack.md) — the bundle construction was recoverable only by brute force, the negative vectors demanded composed verdicts while omitting their sealed contexts, the key-log event model showed one variant of two, the spec's literal quorum MUST failed the golden vector, and RFC 8785 (the canonicalization any honest implementer reaches for) produces the wrong digest. SPEC v0.8.0 amends v0.7.0 (archived byte-exact; seven verified anchors): bundle address = digest of LF-joined sorted member addresses; canonical JSON defined precisely (float-ness preserved — deliberately not JCS); DSSE PAE in the spec text; quorum scope stated (receipt-scoped k≥2 at JR-3, per-obligation at JR-4); obligation matching exact with the frame synthesis rule; the pack declared the normative wire form; timestamps integer seconds; the KeyLog Added/Revoked enum on the wire. Pack expands 13 → 22 vectors: evidence-bundle.json ships every member's bytes (incl. the transition record), every negative embeds its sealed context, four new mutation negatives (engagement_undisclosed, recourse_undeclared, static_only_frame, unterminated_chain), three context-variant vectors (timestamp_stale, breach_unamended, verifier_revoked_window), and a JR-4 receipt making per-obligation quorum visible. The EnB object is now sealed evidence and resolved by the composed validator. Conformance README rewritten as an implementer's guide; remaining unvectored behaviors stated explicitly. Also: joule-code pre-existing clippy warnings fixed (workspace now zero), binding emits 0.8.0. 76 joulecontract tests + 39 joule-code tests green, clippy zero on both workspaces. Site: Round 5 card + seven-anchor chain, redeployed. The round's lesson in the standard's own grammar: the pack was making composed claims whose evidence was not sealed alongside — it was running evidence:external. v0.8 seals the pack. Co-Authored-By: Claude Fable 5 <[email protected]>
41 lines
5.9 KiB
Markdown
41 lines
5.9 KiB
Markdown
# JouleContract
|
||
|
||
A carrier for obligation. Five clauses, one signed receipt, owned by no one.
|
||
|
||
JouleContract is the **contract cargo class** of the Transaction Science substrate. Where Smart Byte carries value, EOC carries compute, Joule Code carries coding work, and Map carries place, JouleContract carries **the promise itself**: a content-addressed statement of what a unit of work must hold (`pre`, `post`, `inv`), what it may touch (`frame`), and what it may spend (`ceiling`, a joule EnPI against a signed baseline). It is the operand the rest of the family acts on — Joule Code carries its changes, the proof standard discharges its obligations, JouleClaw budgets dispatch against its ceiling — and its single signed receipt simultaneously evidences functional safety, energy management, and AI governance: three audit programs collapsed into three projections of one receipt log.
|
||
|
||
## The doctrine
|
||
|
||
**Inherit, don't invent — bind, don't name — seal, don't float.** Three normative consequences:
|
||
|
||
1. **The binding rule.** Every trust-bearing field — generator, frame, qualification, independence, the joule figure itself — binds to a key, a sealed attestation, or an independent timestamp, or serializes one of twenty-two **demoted states**. A field that is named but not bound does not exist in a conformant receipt. `Metered` without a meter attestation is `metered_unattested`; independence is computed from key disjointness, never copied from a producer's flag.
|
||
2. **The sealing rule.** Conformance is evaluated once, at discharge, against a content-addressed **evidence bundle**, and sealed. Re-verification is resolution-free — no DNS, no live registry, no reachable authority — which is also what makes conformant receipts producible air-gapped. Receipts do not rot, and nothing re-grades them later.
|
||
3. **Breach is deviation without amendment.** Contracts bend instead of break: amendments are metered, independently timestamped transitions that govern the future only. A withheld receipt is visible as withheld; a past out-of-frame effect stays a breach forever; an unamended deviation caps the Governance class until closed.
|
||
|
||
## Rigor, honestly
|
||
|
||
Conformance is a composed profile — ⟨Rigor JR-1..4 · Energy class · Governance class⟩ — gated by the least-bound axis, with a claim-discipline rule: the bare word "conformant" is itself a non-conformant claim. The limits no document can mechanize are **named residuals**, not hidden: obligation-set adequacy, common control, issuer-pays gravity, and the demand side — the standard prices honesty; relying parties price assurance.
|
||
|
||
## Provenance
|
||
|
||
This standard was hardened by adversarial diff, and the diffs are part of it: each version was attacked by independent review lenses, the findings published, and the repairs folded as traced amendments with real digests. `SPEC.md` §16 carries the full chain; `archive/` holds every prior version byte-exact so the chain verifies; `provenance/` holds the four diff rounds that produced it — three against the spec text, the fourth against the reference implementation itself.
|
||
|
||
## Contents
|
||
|
||
- `SPEC.md` — normative specification v0.6.0 (RFC 2119), self-hosting amendment log with verified digest chain.
|
||
- `archive/` — prior spec versions (v0.1.0–v0.5.0), byte-exact anchors of the amendment chain.
|
||
- `provenance/` — the adversarial diff rounds that drove each amendment.
|
||
- `joulecontract-rs/` — Rust reference workspace: schema, receipt validation, evidence sealing, amendment/key-log machinery, conformance harness.
|
||
|
||
## Reference implementation and consumers
|
||
|
||
`joulecontract-rs` implements the core object, the demoted-state vocabulary, computed independence, the least-bound-axis profile gates, resolution-free sealed verification, and forward-only temporal ordering. The first family consumer is live: [`joule-code-joulecontract`](../joule-code/joule-code-rs/crates/joule-code-joulecontract/) runs a coding operation under a contract — the edit set is the frame, the tier cost is the ceiling, JCR provenance maps downward-only onto the energy classes — and discharges it into a receipt that grades honestly under the two-stage rule. The JouleClaw runtime and the proof standard's cascade are next.
|
||
|
||
## Status
|
||
|
||
**v0.8.0 draft.** The amendment chain is real (archive digests verify against §16, mechanically, on every `cargo test` — seven anchors, v0.1 through v0.7). The reference workspace covers the schema, the receipt-local and **composed** validators (two-stage evaluation is now normative: local witnesses at most JR-2; JR-3/JR-4 and `certified` are composed verdicts over the sealed evidence bundle, the office key log, and the transition interval), composition with per-component ceiling accountability (intra-batch netting is structurally dead), the per-EnB ratchet, recourse and sector-equivalence bindings, the mechanical lost/never evidence distinction, cross-digest re-anchoring, evidence sealing with expected-signer verification, the in-toto/DSSE recognized edge, and a regenerable conformance vector pack whose expected verdicts come from the validators themselves. Five adversarial rounds are on the record (`provenance/`): three against the spec text, the fourth against the implementation (28 findings, four guarantee bypasses, all repaired — folded back as v0.7), and the fifth a **clean-room implementability audit** of the published artifacts alone, which found the composed validation path unbuildable without reading the reference code — folded back as v0.8, which makes the bundle construction, canonical JSON, quorum scope, obligation matching, and key-log event model normative text, and expands the pack from 13 to 22 vectors with every composed input shipped (member bytes included). **Every §15 demoted state is producible by the reference implementation, and a third party can now build the composed validator from the published artifacts alone.**
|
||
|
||
## Licence
|
||
|
||
- Reference code: Apache-2.0
|
||
- Specification text: CC-BY-4.0
|