open-standards/joulecontract/provenance/joulecontract-diff-v0.5-self.md

# JouleContract v0.5 — Self-Diff, Round Three (did the binding repairs open anything new?)

**Method:** three new, mutually-blind adversarial lenses, one layer down from round two — (1) operational and temporal semantics (what the receipt means at an audit ten years out), (2) economics, incentives, collusion, and equilibria (what rational actors do with the rules), (3) spec-lawyer internal consistency (does v0.5's own text deliver what it claims). 33 findings: T1–T10, E1–E9, S1–S14.

**Verdict:** Yes — and the headline finding is the sharpest irony of the three rounds:

> **The energy axis — the standard's namesake — is the last unbound trust-bearing field in the document.** §1's binding rule explicitly lists `provenance` as trust-bearing, yet `Metered` is a producer-written string with no meter attestation behind it, `joules_spent` is an unbound number, the EnB is producer-declared, and §10's least-bound-axis rule gates Safety and Governance but states **no gate for claiming `Metered`**. v0.5 bound every field v0.4 introduced and forgot the field v0.1 introduced. The standard of energy accountability does not yet bind its energy claim. (S1, E6 — found independently by two blind lenses.)

**The round's meta-finding, extending the law of evolution:** v0.4 fixed what the receipt *says*; v0.5 fixed whether what it says is bound to a *key* — **at one instant, for the new fields only**. The layer v0.5 cannot reach: (a) every binding is a function of **time** evaluated against mutable infrastructure (domains lapse, keys rotate, attestations expire, editions revise) with no fixed evaluation point; (b) cryptography binds **keys**, but assurance needs keys bound to **parties** and parties bound to **consequences** — and part of that is not mechanizable by any document and must be *named as residual*, the §10.1 pattern.

---

## Cluster A — The unbound energy axis (S1, E6, E5, part of S14)

The founding violation of the standard's own §1:

- **`provenance: "Metered"`** — no required meter attestation, no signed shunt/RAPL/PDU reading, no key. A producer running its own hardware reports any counter value, tags it `Metered`, and collects the maximal Energy class. Whoever owns the meter owns the unit of account — meter capture is the monetary-policy attack on a joule-denominated system. §15 has no demoted state for it: `Unaccounted` covers "substrate exposes nothing," not "producer asserted Metered without evidence."
- **The ceiling and the EnB are both producer-declared** (E5) — declare `joules_allowed: 100` for a 2-joule workload and every receipt mints `residual: 98`, which §4.1 *explicitly* routes into CSRD/ESRS E1 disclosure. Manufactured ESG savings with a receipt. Nothing binds the initial ceiling's derivation.
- **`enb_ref`** resolves to a baseline nobody but the producer signs; **`grid_mix`** is bare self-asserted numbers routed to regulatory disclosure; **`execution`** is a list of labels §3.1 itself rules non-normative.
- Consequence: Appendix A's `⟨SIL-3, Metered, certified⟩` is the cross-axis halo §10 claims to prevent — with the unbound axis being energy itself.

**Fixes:** `Metered` MUST resolve to a meter/substrate attestation signed by a key distinct from the receipt signer (validity-windowed, §6.1's pattern), else demote `metered_unattested` → treated as `ModelBased`. The ceiling is trust-bearing (a false-high ceiling makes the reader over-trust the residual): it MUST carry a derivation binding to its EnB or serialize `ceiling_unanchored`, zeroing the residual's evidentiary weight. The EnB MUST be a signed object. Add the energy gate to the least-bound-axis rule. Fix §4.1: the summable disclosure quantity is `joules_spent` (measured, provenance-tagged); **`residual` is an internal control signal and MUST NOT be presented as a savings or efficiency claim.** Name the limit: on producer-owned bare metal there is no independent meter — that is exactly what the lower categories exist to record honestly.

---

## Cluster B — Time is the unbound dimension (T1, T2, T4, T5, T6, T8, S2, S12, T9, T10)

Every binding v0.5 added — resolution, key disjointness, qualification validity, timestamps, editions — is evaluated against mutable infrastructure, and the spec never fixes the evaluation point.

- **T1 [blocker] — "resolve" has no when and no against-what.** A receipt conformant in 2026 whose `did:web:audit-a.example` lapses and is re-registered by an attacker in 2031 becomes *verifiably wrong* (computes `independent:false`) at a 2032 audit — or the attacker makes never-independent receipts verify clean. The receipt binds trust to identifiers; the identifier→key mapping is itself an unbound, time-varying claim. Same bug class v0.5 fixed, one level down.
- **T2 [blocker] — no key lifecycle.** "Revocation" does not appear in the document. A verifier key compromised in 2029 after signing four thousand discharges: demote them retroactively (collides with §11 no-retroactive-authority) or trust a known-compromised key forever? v0.5 built migration for the slow failure (cryptanalysis) and nothing for the fast one (theft). Independence is computed over key sets with no temporal anchor — rotation-into-overlap retroactively flips past `independent` values. And there is no published, append-only office key log for quorum's n to be evaluated against.
- **T4 + S2 [blocker] — receipt-withholding defeats the temporal-ordering invariant.** Found independently by two lenses. §5.2.1 orders amendments against *receipt* timestamps, but the producer schedules when the receipt is stamped, and the independent-TSA MUST covers amendments only. Breach Monday; withhold the receipt; obtain a frame-widening amendment Wednesday; stamp the receipt Thursday — "timestamped after," governed change, retroactive legalization re-enabled through the issuance gap. Also: transitions are intervals, not points — a long-running transition spanning an amendment is admitted under C₁'s `pre` and judged against C₂'s `post`, and the receipt can't express it.
- **T3 [blocker] — the TSA is a dependency, not an office.** §0 promises every fixed point is an office with succession; the steward got §11, verifiers got §6, algorithms got §3.1 — the timestamp authority got a parenthesis. A suborned TSA backdates an amendment and re-enables the exact attack §5.2.1 exists to kill. "eIDAS or equivalent" is undefined for US/global deployments.
- **T5/S12 [serious] — receipt rot.** Digests guarantee integrity, never availability. No retention rule anywhere. When `assessor.example` winds down in 2029, every discharge demotes to `qualified:false` at the 2031 FDA audit — and the spec cannot distinguish "never qualified" from "qualified, evidence lost," two states an auditor treats very differently. Binding-as-*resolvability* is a liveness property that decays, retroactively downgrading receipts against §6's own "without invalidating prior receipts."
- **T6 [serious] — `valid_until` has no read-time semantics.** The spec's own example self-demotes thirteen months after publication if expiry is read-time-evaluated; if issuance-frozen, the spec never says so.
- **T8 [serious] — edition float.** Receipts carry `SIL-3` with no edition pin; when IEC 61508 Ed. 3 lands, a steward Register update changes what past receipts claim — retroactive authority laundered through an edition pointer.
- **T7 [serious] — air-gapped exclusion.** DoD/classified enclaves — an explicit target market — have no DNS, no reachable TSA. As written they can produce *only demoted receipts*, and §5.2.1's MUST makes amendments impossible at all: breach can never become governed change in exactly the highest-assurance environments. Locked out by plumbing, not policy.
- **T9 [minor, sharpest small finding] — the amendment log's own chain is placeholders.** `amends sha2-256:<digest of v0.4.0>` — a literal angle-bracket placeholder, four versions deep. The Self-Hosting Clause is currently *undischarged by the standard's own vocabulary*.
- **T10 [minor] — the ratchet across an EnB re-baseline is a cross-EnB comparison §4.3 forbids.** Every long-lived contract crosses this on hardware refresh.

**The uniform fix (one move, applied everywhere):** **seal at issuance; change moves forward only.** Conformance is established once, at discharge, by the verifier of record; the receipt carries or references into a content-addressed **evidence bundle** (attestation bytes + digest-pinned key material as of discharge) so re-verification is resolution-free — `did:web:` strings become non-normative labels exactly as §3.1 already rules for model names. Key events (rotation, revocation, succession) are signed amendments to an append-only office key log — §5.2 applied to keys; independence computes over key sets *as of the discharge timestamp per the log*; revocation demotes forward from attested compromise time (`verifier_revoked_window`), never invalidates backward — consistent with §11 because it's grounded demotion, not fiat. Transitions carry an interval (anchored start + receipt stamp), governed end-to-end by the contract in force at start; receipts MUST anchor within a profile-stated latency or serialize `timestamp_stale`. The TSA becomes an office by role (Register lists recognized regimes per jurisdiction: eIDAS / RFC 3161-under-policy / enclave-internal under the §6 office pattern), with timestamp quorum at SIL-3+. Receipts pin the Register snapshot digest in force at issuance. Retention gets an office and a period by role; lost evidence demotes *re-checkability*, not the sealed issuance-time verdict (`validation_recorded, evidence_lost` ≠ `unresolvable`). Ratchet scoped per-EnB; EnB change resets the floor. Air-gapped conformance falls out automatically: verification never requires network.

---

## Cluster C — Keys ≠ parties ≠ consequences (E1, E2, E8, S6)

- **E1 [blocker] — computed independence is Sybil-trivial.** Two domains at $12 each, two disjoint keypairs, one owner: `independent: true`, computed correctly. v0.4's asserted lie cost a keystroke; v0.5's manufactured topology costs a domain registration. §12's "self-asserted independence is structurally impossible" is now false in spirit — *self-manufactured* independence is structurally trivial. The bitter detail: §2.4 already inherits eIDAS qualified **seals** — the one instrument in the spec's own canon that binds a key to a legal entity with statutory identity-proofing — and never deploys them where they'd bite.
- **S6 [serious] — the computed check's operand is undefined.** "Disjoint from the generator's key set" — which keys? The receipt signer's? The registry's? The human principals'? Each answer yields a different `independent` for the same receipt; in practice the flagship "computed, not asserted" repair re-collapses to a producer-serialized boolean.
- **E2 [blocker] — issuer-pays capture.** Verifiers are a market whose product is `closed` and whose customer needs `closed`. The 2008 ratings-agency equilibrium, with full cryptographic formality throughout. Quorum makes it *worse* at the margin: k-of-n where the producer selects and pays all n is k-of-n captured firms — and §5.2.1 hands those same keys co-signature over the amendments widening the producer's own obligations. The words "payment," "selection," "engagement," "rotation" appear nowhere in v0.5.
- **E8 [serious] — verifier signatures have no downside.** No bond, no liability hook, not even a named gap. The canon the spec inherits carries downside structurally: auditors carry professional liability; eIDAS QTSPs carry *statutory* liability (Art. 13). The spec imported their signatures and left their liability behind. Upside per `closed`, zero downside per wrong `closed` — grade inflation isn't a temptation, it's the gradient.

**Fixes:** Rename what §6.2 computes — it proves *key disjointness*, a necessary-not-sufficient floor, and the spec must say so. Define the generator key set normatively (receipt-signer ∪ keys enumerated in the resolved producer attestation ∪ human-principal keys) so disjointness is decidable. At SIL-3+, verifier identity MUST bind to a **legal-entity credential** (eIDAS qualified seal, vLEI, or equivalent); key-only disjointness serializes `independent:key_only`, insufficient at SIL-3+. Engagement economics are trust-bearing under §1's own definition: each discharge carries `engagement: {selected_by, compensated_by}` as bound identities or demotes `engagement_undisclosed`; profiles MAY require producer-independent selection (registry-assigned or rotation — the post-Enron/PCAOB move the canon already made). Profiles MAY require verifiers under a recognized liability regime (statutory / professional / bonded), carried in the entity credential, else `recourse_undeclared`. **And name the residuals honestly, §10.1-style:** common control (one parent, two LLCs) is not mechanizable by any credential scheme — entity binding moves forgery cost from a domain registration to incorporation fraud, no further; issuer-pays gravity is not mechanizable by any document — disclosure makes capture *legible*, not impossible. Retract the §12 over-claim.

---

## Cluster D — Equilibria and incentive inversions (E3, E4, E5, E7, E9)

- **E3 [blocker] — the demotion equilibrium.** A receipt with every field demoted is *fully conformant*, and costs a JSON serializer; the bound path costs TSAs, attestations, quorums. Absent demand-side pressure, the rational market converges on all-demoted `⟨SIL-1, Unaccounted, declared⟩` — the standard "succeeds" by universal conformance while delivering zero assurance, and the *standard's name* becomes the halo §10 was built to prevent, one level up. **Fixes:** the one mechanizable piece — a **claim-discipline rule**: a conformance claim MUST be made as the full JCAP tuple plus demoted-state disclosure; the bare word "conformant" is itself a non-conformant claim. And the missing honest sentence: *this standard prices honesty; it cannot price assurance — assurance is priced by relying parties demanding profiles. The demoted floor is the intended floor: truthful disclosure beats driven-underground lying.*
- **E4 [serious] — amendment metering taxes honesty and misses its attacker.** Governed change costs joules, a TSA, a quorum; ungoverned deviation costs a log line — `breach` appears in no profile cap and no §15 row. The flooding insider the meter targets has budget by construction. The fix inverts it back: add **`breach_unamended`** to §15 — non-promotable, caps Governance class (it is by definition a change-control failure under the §2.3 inheritance) until a forward-looking amendment or fix-receipt closes it. Now amending is the cheap branch. Amendment ceilings SHOULD be de minimis; the anti-flood load lives on quorum, not the meter — fix §12 accordingly.
- **E7 [serious] — composition relicenses ceilings.** "Composition never relicenses" — v0.5's repair — speaks only of frames. Component A (3J ceiling) spends 9J, B (10J) spends 2J, batch at the composed level: 11J under 13J, no breach anywhere, A's 3× overrun netted silently. The spec diagnosed this disease in frames and didn't apply its own cure to the other quantitative clause. Fix: each component remains bound by its own ceiling within composition; composed discharge without per-component `joules_spent` attribution demotes (cannot feed a ratchet).
- **E9 [minor] — quorum economics, the missing viability paragraph.** The cheapest-sufficient standard maximizes verification cost exactly at the high-assurance end. The answer exists in the spec's own architecture and is never stated: **deterministic discharge is reproducible at near-zero marginal cost** — k verifiers re-running an SMT check is k × cheap, which is what makes quorum viable at all; where quorum touches non-reproducible discharge (`observed` frames, human roots), the cost is real and is the deliberate price of the claim. Say it, or the first procurement spreadsheet kills SIL-3 adoption.

---

## Cluster E — v0.5's own machinery, incomplete (S3, S4, S7, S8, S9, S10, S11, S13, S14)

- **S3 [blocker] — the exemplar receipt is non-conformant with §5.1.** The contract declares seven obligations; the receipt discharges three. Both preconditions, one postcondition, and one invariant carry neither a closing tier nor `undischarged`. Repaired honestly, four obligations serialize `undischarged` → Safety capped → the closing sentence "The SIL-3 profile claim is legal under §10" is false twice over. The standard's own showcase fails the standard.
- **S7 [serious] — SIL is self-assigned.** No hazard analysis, no assessor, nothing binds the target level — and every SIL-2+/3+ MUST in the document is conditional on it, so a producer evades the entire high-assurance regime by writing `"safety": "SIL-1"`. Worse, it's the canon-misuse class rounds 1–2 policed: the exemplar assigns SIL-3 to a financial settlement — not a safety function; a 61508 assessor rejects the assignment and the domain. And `profile` is absent from §1's trust-bearing list — the field whose falsity most directly causes over-trust. Fix: bind SIL assignment (signed risk-assessment attestation, chain terminating per §5.1.2, else `sil_unassessed`) **or** rename the axis (Assurance Rigor Level) and inherit SIL as analogy with target-setting explicitly out of scope; either way, add `profile` to §1.
- **S8 [serious] — amendment-as-transition is a new unterminated recursion.** An amendment is a transition; transitions have contracts; contracts have frames (what is the frame of an amendment?), generators, SILs (inherited from where?), and are themselves amendable — recursively, with §5.1.2 terminating only qualification and generator chains. The same lazily-unterminated recursion §14 declares purged. Also: who sets the amendment's ceiling? If the producer, §12's "cost bounds volume" is self-priced and bounds nothing. Fix: a normative minimal amendment-contract as base case (fixed frame = contract object + log head; SIL inherited from the amended contract; generator = amendment signer); amendments chain, they don't meta-amend; the verifier office or profile prices the amendment ceiling.
- **S9 [serious] — frame modes break the cross-domain claim.** `observed`/`static_only` are defined purely in software terms. A clinical handoff's frame discharge is undefinable as written → permanently `undischarged` → capped below SIL-3: v0.5's hardening quietly demoted the handoff from "one ledger, one audit" to permanently-low-assurance without acknowledging it. Fix: define an operational mode — **witness/receiver attestation** as `observed`'s non-computational analogue; the I-PASS receiver is already sitting in §6.
- **S4 [serious] — quorum modality contradiction.** SHOULD in §6, MUST at SIL-3 in §5.2.1, "implies" (not an RFC 2119 keyword) in §10; "verifier office" never defined; k-of-n unconstrained (k=1, n=1 satisfies the letter); and §5.2.1's quorum is keys-of-one-office, defeated by capturing that office — the exact threat §12 says quorum bounds. Fix: quorum MUST at SIL-3+, office defined (membership, published key log per Cluster B, succession per §11's pattern), quorum across independent verifiers, k/n bounded per profile, "implies" replaced with a MUST.
- **S10 [serious] — demoted-state table gaps.** `undischarged` on `pre`/`post`/`inv` caps nothing in §10's letter (only the frame cap is stated); an unterminated-but-resolving qualification chain is `qualified:true` by §6.1's exhaustive trigger list while `unterminated` by §5.1.2; `static_only`'s "profiles MAY require observed" is a hook no profile exercises — SIL-4 is claimable over a never-observed frame; no demoted state covers timestamp failures at all. Fix: close all four meets.
- **S11 [minor] — three roots, not two.** §5.1.2 declares "two defined roots," then uses `human-authored` — a third, undefined token — in the same section, in §6.3, and in the example. If it's weaker than `human-attested`, the headline R1 repair bottoms out at an unbound assertion. Fix: one token, or define the third.
- **S13 [minor] — "non-promotable" is used five times and defined only for energy.** Generalize in §15: promotion = any downstream re-serialization presenting a demoted state as its bound counterpart; prohibited for all states, by any consumer.
- **S14 [minor] — `transition` digest-of-what undefined; `execution` required but never defined (and its values are non-normative labels); "an `generator_unattested`" grammar.**

---

## What held (attacked and survived)

- **§4.3's cross-domain ledger rule** — the additive-not-comparative construction survived all three lenses (the *assurance* reach broke, S9; the *ledger* did not).
- **§5.1.2's two named roots** terminate the round-two recursions as designed (the flaw found was a vocabulary leak, S11, not a structural one).
- **§6.1's deterministic/stochastic split** survived and turned out to carry the answer to the quorum-economics objection (E9): deterministic re-execution is what makes quorum affordable.
- **The §10.1 adequacy residual** again held — and is now the *template* this round's fixes reuse twice (the common-control residual, the issuer-pays residual).

---

## Proposed v0.6 amendments (under §5.2 — attributed, reasoned, chained)

The 33 findings consolidate to **nine** fixes:

1. **Bind the energy axis** (S1, E6, E5): meter attestation behind `Metered` or `metered_unattested`; signed EnB; ceiling derivation binding or `ceiling_unanchored`; energy gate in the least-bound-axis rule; `residual` declared a control signal, never a savings claim; per-component ceiling accountability in composition (E7).
2. **Seal at issuance, evidence bundles, resolution-free re-verification** (T1, T5, T6, S5, S12, T7): conformance evaluated once at discharge by the verifier of record and sealed; receipts carry/reference content-addressed evidence bundles; demotions distinguish never-validated from evidence-lost; air-gapped conformance falls out free; "checkable from the receipt alone" becomes true instead of aspirational.
3. **Key lifecycle as forward-only amendment log** (T2, S4-partial): append-only office key log; independence computed as-of discharge time; revocation demotes forward from attested compromise (`verifier_revoked_window`), never invalidates backward.
4. **Close the temporal gaps** (T4, S2, T3, T8): transitions are intervals governed by the contract at start-anchor; receipt-anchoring latency bound or `timestamp_stale`; independent timestamps on all receipts at SIL-3+ (an unanchored effect receipt is treated as predating every amendment); TSA becomes an office by role with jurisdictional Register entries and timestamp quorum at SIL-3+; receipts pin the Register snapshot digest.
5. **Bind keys to parties to consequences — and name what can't be** (E1, E2, E8, S6): define the generator key set; rename §6.2's output key-disjointness; legal-entity credentials at SIL-3+ (`independent:key_only` below the bar); engagement disclosure (`selected_by`/`compensated_by`) or `engagement_undisclosed`; liability-regime hook or `recourse_undeclared`; two new **named incentive residuals** (common control; issuer-pays gravity) alongside §10.1; retract §12's "structurally impossible."
6. **Fix the incentive inversions** (E4, E3): `breach_unamended` demoted state capping Governance until amended-or-fixed (amending becomes the cheap branch); de minimis amendment ceilings priced by the office, not the producer; the claim-discipline rule (conformance claimable only as full tuple + demotion disclosure); the honest equilibrium sentence: *the standard prices honesty; relying parties price assurance.*
7. **Terminate the amendment recursion; fix quorum modality** (S8, S4): normative minimal amendment-contract base case; amendments chain, never meta-amend; quorum MUST at SIL-3+ across independent verifiers with bounded k/n and a defined office.
8. **Bind or rename the safety target; restore the cross-domain claim** (S7, S9, T10): SIL assignment bound to a signed risk assessment or the axis renamed with target-setting explicitly out of scope; `profile` added to §1's trust-bearing list; witness-attestation as the operational `observed` mode so a clinical handoff can reach high assurance again; ratchet scoped per-EnB.
9. **Hygiene** (S3, S10, S11, S13, S14, T9, E9): conformant exemplar (all seven obligations discharged); demoted-state table meets closed; one root vocabulary; "non-promotable" generalized; `transition`/`execution` defined; real digests in the amendment chain or the chain marked `undischarged` (the self-hosting clause currently fails its own vocabulary — the single most quotable finding of the round); the quorum-economics viability paragraph.

**The honest headline:** v0.4 fixed what the contract says. v0.5 fixed whether the new words are bound to keys. v0.6 must (a) bind the *original* words — starting with the joule itself, (b) fix the bindings in *time*, and (c) say out loud which trust the cryptography cannot manufacture — parties and incentives — and hand those to the §10.1 residual pattern instead of to §12's over-claims. The standard's discipline is converging on its own first principle from three rounds ago: *the failure isn't estimation, it's estimation laundering itself into apparent measurement* — which is exactly what an unbound `Metered` tag was doing in the spec's own §4.2 all along.

---

*Round-three diff executed against v0.5.0 by three blind lenses (temporal/operational; economic/incentive; spec-lawyer). Prior rounds: `joulecontract-diff-v0.3-global.md` (canon gaps), `joulecontract-diff-v0.4-self.md` (binding gaps).*