open-standards/joulecontract/provenance/joulecontract-diff-v0.5-self.md

JouleContract v0.5 — Self-Diff, Round Three (did the binding repairs open anything new?)

Method: three new, mutually-blind adversarial lenses, one layer down from round two — (1) operational and temporal semantics (what the receipt means at an audit ten years out), (2) economics, incentives, collusion, and equilibria (what rational actors do with the rules), (3) spec-lawyer internal consistency (does v0.5's own text deliver what it claims). 33 findings: T1–T10, E1–E9, S1–S14.

Verdict: Yes — and the headline finding is the sharpest irony of the three rounds:

The energy axis — the standard's namesake — is the last unbound trust-bearing field in the document. §1's binding rule explicitly lists provenance as trust-bearing, yet Metered is a producer-written string with no meter attestation behind it, joules_spent is an unbound number, the EnB is producer-declared, and §10's least-bound-axis rule gates Safety and Governance but states no gate for claiming Metered. v0.5 bound every field v0.4 introduced and forgot the field v0.1 introduced. The standard of energy accountability does not yet bind its energy claim. (S1, E6 — found independently by two blind lenses.)

The round's meta-finding, extending the law of evolution: v0.4 fixed what the receipt says; v0.5 fixed whether what it says is bound to a key — at one instant, for the new fields only. The layer v0.5 cannot reach: (a) every binding is a function of time evaluated against mutable infrastructure (domains lapse, keys rotate, attestations expire, editions revise) with no fixed evaluation point; (b) cryptography binds keys, but assurance needs keys bound to parties and parties bound to consequences — and part of that is not mechanizable by any document and must be named as residual, the §10.1 pattern.

---

Cluster A — The unbound energy axis (S1, E6, E5, part of S14)

The founding violation of the standard's own §1:

• provenance: "Metered" — no required meter attestation, no signed shunt/RAPL/PDU reading, no key. A producer running its own hardware reports any counter value, tags it Metered, and collects the maximal Energy class. Whoever owns the meter owns the unit of account — meter capture is the monetary-policy attack on a joule-denominated system. §15 has no demoted state for it: Unaccounted covers "substrate exposes nothing," not "producer asserted Metered without evidence."
• The ceiling and the EnB are both producer-declared (E5) — declare joules_allowed: 100 for a 2-joule workload and every receipt mints residual: 98, which §4.1 explicitly routes into CSRD/ESRS E1 disclosure. Manufactured ESG savings with a receipt. Nothing binds the initial ceiling's derivation.
• enb_ref resolves to a baseline nobody but the producer signs; grid_mix is bare self-asserted numbers routed to regulatory disclosure; execution is a list of labels §3.1 itself rules non-normative.
• Consequence: Appendix A's ⟨SIL-3, Metered, certified⟩ is the cross-axis halo §10 claims to prevent — with the unbound axis being energy itself.

Fixes: Metered MUST resolve to a meter/substrate attestation signed by a key distinct from the receipt signer (validity-windowed, §6.1's pattern), else demote metered_unattested → treated as ModelBased. The ceiling is trust-bearing (a false-high ceiling makes the reader over-trust the residual): it MUST carry a derivation binding to its EnB or serialize ceiling_unanchored, zeroing the residual's evidentiary weight. The EnB MUST be a signed object. Add the energy gate to the least-bound-axis rule. Fix §4.1: the summable disclosure quantity is joules_spent (measured, provenance-tagged); residual is an internal control signal and MUST NOT be presented as a savings or efficiency claim. Name the limit: on producer-owned bare metal there is no independent meter — that is exactly what the lower categories exist to record honestly.

---

Cluster B — Time is the unbound dimension (T1, T2, T4, T5, T6, T8, S2, S12, T9, T10)

Every binding v0.5 added — resolution, key disjointness, qualification validity, timestamps, editions — is evaluated against mutable infrastructure, and the spec never fixes the evaluation point.

• T1 [blocker] — "resolve" has no when and no against-what. A receipt conformant in 2026 whose did:web:audit-a.example lapses and is re-registered by an attacker in 2031 becomes verifiably wrong (computes independent:false) at a 2032 audit — or the attacker makes never-independent receipts verify clean. The receipt binds trust to identifiers; the identifier→key mapping is itself an unbound, time-varying claim. Same bug class v0.5 fixed, one level down.
• T2 [blocker] — no key lifecycle. "Revocation" does not appear in the document. A verifier key compromised in 2029 after signing four thousand discharges: demote them retroactively (collides with §11 no-retroactive-authority) or trust a known-compromised key forever? v0.5 built migration for the slow failure (cryptanalysis) and nothing for the fast one (theft). Independence is computed over key sets with no temporal anchor — rotation-into-overlap retroactively flips past independent values. And there is no published, append-only office key log for quorum's n to be evaluated against.
• T4 + S2 [blocker] — receipt-withholding defeats the temporal-ordering invariant. Found independently by two lenses. §5.2.1 orders amendments against receipt timestamps, but the producer schedules when the receipt is stamped, and the independent-TSA MUST covers amendments only. Breach Monday; withhold the receipt; obtain a frame-widening amendment Wednesday; stamp the receipt Thursday — "timestamped after," governed change, retroactive legalization re-enabled through the issuance gap. Also: transitions are intervals, not points — a long-running transition spanning an amendment is admitted under C₁'s pre and judged against C₂'s post, and the receipt can't express it.
• T3 [blocker] — the TSA is a dependency, not an office. §0 promises every fixed point is an office with succession; the steward got §11, verifiers got §6, algorithms got §3.1 — the timestamp authority got a parenthesis. A suborned TSA backdates an amendment and re-enables the exact attack §5.2.1 exists to kill. "eIDAS or equivalent" is undefined for US/global deployments.
• T5/S12 [serious] — receipt rot. Digests guarantee integrity, never availability. No retention rule anywhere. When assessor.example winds down in 2029, every discharge demotes to qualified:false at the 2031 FDA audit — and the spec cannot distinguish "never qualified" from "qualified, evidence lost," two states an auditor treats very differently. Binding-as-resolvability is a liveness property that decays, retroactively downgrading receipts against §6's own "without invalidating prior receipts."
• T6 [serious] — valid_until has no read-time semantics. The spec's own example self-demotes thirteen months after publication if expiry is read-time-evaluated; if issuance-frozen, the spec never says so.
• T8 [serious] — edition float. Receipts carry SIL-3 with no edition pin; when IEC 61508 Ed. 3 lands, a steward Register update changes what past receipts claim — retroactive authority laundered through an edition pointer.
• T7 [serious] — air-gapped exclusion. DoD/classified enclaves — an explicit target market — have no DNS, no reachable TSA. As written they can produce only demoted receipts, and §5.2.1's MUST makes amendments impossible at all: breach can never become governed change in exactly the highest-assurance environments. Locked out by plumbing, not policy.
• T9 [minor, sharpest small finding] — the amendment log's own chain is placeholders. amends sha2-256:<digest of v0.4.0> — a literal angle-bracket placeholder, four versions deep. The Self-Hosting Clause is currently undischarged by the standard's own vocabulary.
• T10 [minor] — the ratchet across an EnB re-baseline is a cross-EnB comparison §4.3 forbids. Every long-lived contract crosses this on hardware refresh.

The uniform fix (one move, applied everywhere): seal at issuance; change moves forward only. Conformance is established once, at discharge, by the verifier of record; the receipt carries or references into a content-addressed evidence bundle (attestation bytes + digest-pinned key material as of discharge) so re-verification is resolution-free — did:web: strings become non-normative labels exactly as §3.1 already rules for model names. Key events (rotation, revocation, succession) are signed amendments to an append-only office key log — §5.2 applied to keys; independence computes over key sets as of the discharge timestamp per the log; revocation demotes forward from attested compromise time (verifier_revoked_window), never invalidates backward — consistent with §11 because it's grounded demotion, not fiat. Transitions carry an interval (anchored start + receipt stamp), governed end-to-end by the contract in force at start; receipts MUST anchor within a profile-stated latency or serialize timestamp_stale. The TSA becomes an office by role (Register lists recognized regimes per jurisdiction: eIDAS / RFC 3161-under-policy / enclave-internal under the §6 office pattern), with timestamp quorum at SIL-3+. Receipts pin the Register snapshot digest in force at issuance. Retention gets an office and a period by role; lost evidence demotes re-checkability, not the sealed issuance-time verdict (validation_recorded, evidence_lost ≠ unresolvable). Ratchet scoped per-EnB; EnB change resets the floor. Air-gapped conformance falls out automatically: verification never requires network.

---

Cluster C — Keys ≠ parties ≠ consequences (E1, E2, E8, S6)

• E1 [blocker] — computed independence is Sybil-trivial. Two domains at $12 each, two disjoint keypairs, one owner: independent: true, computed correctly. v0.4's asserted lie cost a keystroke; v0.5's manufactured topology costs a domain registration. §12's "self-asserted independence is structurally impossible" is now false in spirit — self-manufactured independence is structurally trivial. The bitter detail: §2.4 already inherits eIDAS qualified seals — the one instrument in the spec's own canon that binds a key to a legal entity with statutory identity-proofing — and never deploys them where they'd bite.
• S6 [serious] — the computed check's operand is undefined. "Disjoint from the generator's key set" — which keys? The receipt signer's? The registry's? The human principals'? Each answer yields a different independent for the same receipt; in practice the flagship "computed, not asserted" repair re-collapses to a producer-serialized boolean.
• E2 [blocker] — issuer-pays capture. Verifiers are a market whose product is closed and whose customer needs closed. The 2008 ratings-agency equilibrium, with full cryptographic formality throughout. Quorum makes it worse at the margin: k-of-n where the producer selects and pays all n is k-of-n captured firms — and §5.2.1 hands those same keys co-signature over the amendments widening the producer's own obligations. The words "payment," "selection," "engagement," "rotation" appear nowhere in v0.5.
• E8 [serious] — verifier signatures have no downside. No bond, no liability hook, not even a named gap. The canon the spec inherits carries downside structurally: auditors carry professional liability; eIDAS QTSPs carry statutory liability (Art. 13). The spec imported their signatures and left their liability behind. Upside per closed, zero downside per wrong closed — grade inflation isn't a temptation, it's the gradient.

Fixes: Rename what §6.2 computes — it proves key disjointness, a necessary-not-sufficient floor, and the spec must say so. Define the generator key set normatively (receipt-signer ∪ keys enumerated in the resolved producer attestation ∪ human-principal keys) so disjointness is decidable. At SIL-3+, verifier identity MUST bind to a legal-entity credential (eIDAS qualified seal, vLEI, or equivalent); key-only disjointness serializes independent:key_only, insufficient at SIL-3+. Engagement economics are trust-bearing under §1's own definition: each discharge carries engagement: {selected_by, compensated_by} as bound identities or demotes engagement_undisclosed; profiles MAY require producer-independent selection (registry-assigned or rotation — the post-Enron/PCAOB move the canon already made). Profiles MAY require verifiers under a recognized liability regime (statutory / professional / bonded), carried in the entity credential, else recourse_undeclared. And name the residuals honestly, §10.1-style: common control (one parent, two LLCs) is not mechanizable by any credential scheme — entity binding moves forgery cost from a domain registration to incorporation fraud, no further; issuer-pays gravity is not mechanizable by any document — disclosure makes capture legible, not impossible. Retract the §12 over-claim.

---

Cluster D — Equilibria and incentive inversions (E3, E4, E5, E7, E9)

• E3 [blocker] — the demotion equilibrium. A receipt with every field demoted is fully conformant, and costs a JSON serializer; the bound path costs TSAs, attestations, quorums. Absent demand-side pressure, the rational market converges on all-demoted ⟨SIL-1, Unaccounted, declared⟩ — the standard "succeeds" by universal conformance while delivering zero assurance, and the standard's name becomes the halo §10 was built to prevent, one level up. Fixes: the one mechanizable piece — a claim-discipline rule: a conformance claim MUST be made as the full JCAP tuple plus demoted-state disclosure; the bare word "conformant" is itself a non-conformant claim. And the missing honest sentence: this standard prices honesty; it cannot price assurance — assurance is priced by relying parties demanding profiles. The demoted floor is the intended floor: truthful disclosure beats driven-underground lying.
• E4 [serious] — amendment metering taxes honesty and misses its attacker. Governed change costs joules, a TSA, a quorum; ungoverned deviation costs a log line — breach appears in no profile cap and no §15 row. The flooding insider the meter targets has budget by construction. The fix inverts it back: add breach_unamended to §15 — non-promotable, caps Governance class (it is by definition a change-control failure under the §2.3 inheritance) until a forward-looking amendment or fix-receipt closes it. Now amending is the cheap branch. Amendment ceilings SHOULD be de minimis; the anti-flood load lives on quorum, not the meter — fix §12 accordingly.
• E7 [serious] — composition relicenses ceilings. "Composition never relicenses" — v0.5's repair — speaks only of frames. Component A (3J ceiling) spends 9J, B (10J) spends 2J, batch at the composed level: 11J under 13J, no breach anywhere, A's 3× overrun netted silently. The spec diagnosed this disease in frames and didn't apply its own cure to the other quantitative clause. Fix: each component remains bound by its own ceiling within composition; composed discharge without per-component joules_spent attribution demotes (cannot feed a ratchet).
• E9 [minor] — quorum economics, the missing viability paragraph. The cheapest-sufficient standard maximizes verification cost exactly at the high-assurance end. The answer exists in the spec's own architecture and is never stated: deterministic discharge is reproducible at near-zero marginal cost — k verifiers re-running an SMT check is k × cheap, which is what makes quorum viable at all; where quorum touches non-reproducible discharge (observed frames, human roots), the cost is real and is the deliberate price of the claim. Say it, or the first procurement spreadsheet kills SIL-3 adoption.

---

Cluster E — v0.5's own machinery, incomplete (S3, S4, S7, S8, S9, S10, S11, S13, S14)

• S3 [blocker] — the exemplar receipt is non-conformant with §5.1. The contract declares seven obligations; the receipt discharges three. Both preconditions, one postcondition, and one invariant carry neither a closing tier nor undischarged. Repaired honestly, four obligations serialize undischarged → Safety capped → the closing sentence "The SIL-3 profile claim is legal under §10" is false twice over. The standard's own showcase fails the standard.
• S7 [serious] — SIL is self-assigned. No hazard analysis, no assessor, nothing binds the target level — and every SIL-2+/3+ MUST in the document is conditional on it, so a producer evades the entire high-assurance regime by writing "safety": "SIL-1". Worse, it's the canon-misuse class rounds 1–2 policed: the exemplar assigns SIL-3 to a financial settlement — not a safety function; a 61508 assessor rejects the assignment and the domain. And profile is absent from §1's trust-bearing list — the field whose falsity most directly causes over-trust. Fix: bind SIL assignment (signed risk-assessment attestation, chain terminating per §5.1.2, else sil_unassessed) or rename the axis (Assurance Rigor Level) and inherit SIL as analogy with target-setting explicitly out of scope; either way, add profile to §1.
• S8 [serious] — amendment-as-transition is a new unterminated recursion. An amendment is a transition; transitions have contracts; contracts have frames (what is the frame of an amendment?), generators, SILs (inherited from where?), and are themselves amendable — recursively, with §5.1.2 terminating only qualification and generator chains. The same lazily-unterminated recursion §14 declares purged. Also: who sets the amendment's ceiling? If the producer, §12's "cost bounds volume" is self-priced and bounds nothing. Fix: a normative minimal amendment-contract as base case (fixed frame = contract object + log head; SIL inherited from the amended contract; generator = amendment signer); amendments chain, they don't meta-amend; the verifier office or profile prices the amendment ceiling.
• S9 [serious] — frame modes break the cross-domain claim. observed/static_only are defined purely in software terms. A clinical handoff's frame discharge is undefinable as written → permanently undischarged → capped below SIL-3: v0.5's hardening quietly demoted the handoff from "one ledger, one audit" to permanently-low-assurance without acknowledging it. Fix: define an operational mode — witness/receiver attestation as observed's non-computational analogue; the I-PASS receiver is already sitting in §6.
• S4 [serious] — quorum modality contradiction. SHOULD in §6, MUST at SIL-3 in §5.2.1, "implies" (not an RFC 2119 keyword) in §10; "verifier office" never defined; k-of-n unconstrained (k=1, n=1 satisfies the letter); and §5.2.1's quorum is keys-of-one-office, defeated by capturing that office — the exact threat §12 says quorum bounds. Fix: quorum MUST at SIL-3+, office defined (membership, published key log per Cluster B, succession per §11's pattern), quorum across independent verifiers, k/n bounded per profile, "implies" replaced with a MUST.
• S10 [serious] — demoted-state table gaps. undischarged on pre/post/inv caps nothing in §10's letter (only the frame cap is stated); an unterminated-but-resolving qualification chain is qualified:true by §6.1's exhaustive trigger list while unterminated by §5.1.2; static_only's "profiles MAY require observed" is a hook no profile exercises — SIL-4 is claimable over a never-observed frame; no demoted state covers timestamp failures at all. Fix: close all four meets.
• S11 [minor] — three roots, not two. §5.1.2 declares "two defined roots," then uses human-authored — a third, undefined token — in the same section, in §6.3, and in the example. If it's weaker than human-attested, the headline R1 repair bottoms out at an unbound assertion. Fix: one token, or define the third.
• S13 [minor] — "non-promotable" is used five times and defined only for energy. Generalize in §15: promotion = any downstream re-serialization presenting a demoted state as its bound counterpart; prohibited for all states, by any consumer.
• S14 [minor] — transition digest-of-what undefined; execution required but never defined (and its values are non-normative labels); "an generator_unattested" grammar.

---

What held (attacked and survived)

• §4.3's cross-domain ledger rule — the additive-not-comparative construction survived all three lenses (the assurance reach broke, S9; the ledger did not).
• §5.1.2's two named roots terminate the round-two recursions as designed (the flaw found was a vocabulary leak, S11, not a structural one).
• §6.1's deterministic/stochastic split survived and turned out to carry the answer to the quorum-economics objection (E9): deterministic re-execution is what makes quorum affordable.
• The §10.1 adequacy residual again held — and is now the template this round's fixes reuse twice (the common-control residual, the issuer-pays residual).

---

Proposed v0.6 amendments (under §5.2 — attributed, reasoned, chained)

The 33 findings consolidate to nine fixes:

1. Bind the energy axis (S1, E6, E5): meter attestation behind Metered or metered_unattested; signed EnB; ceiling derivation binding or ceiling_unanchored; energy gate in the least-bound-axis rule; residual declared a control signal, never a savings claim; per-component ceiling accountability in composition (E7).
2. Seal at issuance, evidence bundles, resolution-free re-verification (T1, T5, T6, S5, S12, T7): conformance evaluated once at discharge by the verifier of record and sealed; receipts carry/reference content-addressed evidence bundles; demotions distinguish never-validated from evidence-lost; air-gapped conformance falls out free; "checkable from the receipt alone" becomes true instead of aspirational.
3. Key lifecycle as forward-only amendment log (T2, S4-partial): append-only office key log; independence computed as-of discharge time; revocation demotes forward from attested compromise (verifier_revoked_window), never invalidates backward.
4. Close the temporal gaps (T4, S2, T3, T8): transitions are intervals governed by the contract at start-anchor; receipt-anchoring latency bound or timestamp_stale; independent timestamps on all receipts at SIL-3+ (an unanchored effect receipt is treated as predating every amendment); TSA becomes an office by role with jurisdictional Register entries and timestamp quorum at SIL-3+; receipts pin the Register snapshot digest.
5. Bind keys to parties to consequences — and name what can't be (E1, E2, E8, S6): define the generator key set; rename §6.2's output key-disjointness; legal-entity credentials at SIL-3+ (independent:key_only below the bar); engagement disclosure (selected_by/compensated_by) or engagement_undisclosed; liability-regime hook or recourse_undeclared; two new named incentive residuals (common control; issuer-pays gravity) alongside §10.1; retract §12's "structurally impossible."
6. Fix the incentive inversions (E4, E3): breach_unamended demoted state capping Governance until amended-or-fixed (amending becomes the cheap branch); de minimis amendment ceilings priced by the office, not the producer; the claim-discipline rule (conformance claimable only as full tuple + demotion disclosure); the honest equilibrium sentence: the standard prices honesty; relying parties price assurance.
7. Terminate the amendment recursion; fix quorum modality (S8, S4): normative minimal amendment-contract base case; amendments chain, never meta-amend; quorum MUST at SIL-3+ across independent verifiers with bounded k/n and a defined office.
8. Bind or rename the safety target; restore the cross-domain claim (S7, S9, T10): SIL assignment bound to a signed risk assessment or the axis renamed with target-setting explicitly out of scope; profile added to §1's trust-bearing list; witness-attestation as the operational observed mode so a clinical handoff can reach high assurance again; ratchet scoped per-EnB.
9. Hygiene (S3, S10, S11, S13, S14, T9, E9): conformant exemplar (all seven obligations discharged); demoted-state table meets closed; one root vocabulary; "non-promotable" generalized; transition/execution defined; real digests in the amendment chain or the chain marked undischarged (the self-hosting clause currently fails its own vocabulary — the single most quotable finding of the round); the quorum-economics viability paragraph.

The honest headline: v0.4 fixed what the contract says. v0.5 fixed whether the new words are bound to keys. v0.6 must (a) bind the original words — starting with the joule itself, (b) fix the bindings in time, and (c) say out loud which trust the cryptography cannot manufacture — parties and incentives — and hand those to the §10.1 residual pattern instead of to §12's over-claims. The standard's discipline is converging on its own first principle from three rounds ago: the failure isn't estimation, it's estimation laundering itself into apparent measurement — which is exactly what an unbound Metered tag was doing in the spec's own §4.2 all along.

---

Round-three diff executed against v0.5.0 by three blind lenses (temporal/operational; economic/incentive; spec-lawyer). Prior rounds: joulecontract-diff-v0.3-global.md (canon gaps), joulecontract-diff-v0.4-self.md (binding gaps).