Run the standard's adversarial-diff method against its own reference
implementation (provenance/joulecontract-diff-v0.6-impl.md): two blind
lenses, 28 findings, four guarantee bypasses — case-variant key forgery,
the entity-omission Party hole, caller-supplied generator key sets, and
reseal-under-any-key — all repaired:
- schema: content addresses are canonical (lowercase, digest-width
enforced); canonicalizer depth-bounded; non-finite joules rejected at
the typed boundary before they can null-collide under addressing.
- receipt: independence computed over the effective generator key set
(declared ∪ receipt signer ∪ attestation signer); Party requires both
entities bound, normalized, unequal; receipt-local validate() honestly
caps at JR-2, with the new composed validate_sealed() evaluating the
full JR-3/JR-4 ladder over sealed evidence resolution, the office key
log, anchor gates, quorum, and loop governance; receipts bind their
allowance and EnB to the contract ceiling (residual minting is
malformed); claims emit the exact §15 token vocabulary.
- seal: verify_offline takes the expected verifier-of-record key —
integrity is no longer mistaken for authenticity.
- amend: the key log evaluates events chronologically (out-of-order
appends cannot resurrect a revoked key); classify takes the named
covering amendment, not "any amendment whatsoever".
- wire (new crate): the receipt as an in-toto Statement v1 with the
JouleContract predicate type in a DSSE envelope, exact PAE, Ed25519.
- conformance: shared fixtures, the four rounds' attacks as tests, and a
regenerable conformance/v1 vector pack (13 vectors + MANIFEST) whose
expected verdicts come from the repaired validators, including both
the local JR-2 and composed JR-3 grades and two malformed cases.
64 tests green, clippy zero warnings. READMEs state what is implemented
and what is named-but-open (composition, ratchet, recourse bindings).
Co-Authored-By: Claude Fable 5 <[email protected]>
448bb75339