eeaf732c2c
deny-receipt.hex was pinned to the superseded jcp/1 receipt profile (598 bytes) while the reference gate seals jcp/2, which binds a payload_hash (677 bytes). The gate is deterministic (three runs byte-identical) and the new envelope decodes to every field receipt.json records, so this is a refresh, not a behaviour change. The conformance test now seals the deny exactly as the README reproduces it and requires the published bytes on every run, verifies them under the reference steward against receipt.json, and requires any other key to fail. Falsified: the old receipt back in the pack fails the byte check; a changed deny_reason in receipt.json fails the decode check. Co-Authored-By: Claude Opus 5.5 <[email protected]>
26 lines
1 KiB
TOML
26 lines
1 KiB
TOML
[package]
|
|
name = "joulehook-hook"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
repository.workspace = true
|
|
rust-version.workspace = true
|
|
description = "JouleHook — the claude-code PreToolUse gate binding (joulehook/1 §3): a JCP capability+budget check decided outside the model, sealed, emitting Claude Code's hook decision JSON."
|
|
|
|
[[bin]]
|
|
name = "joulehook-hook"
|
|
path = "src/main.rs"
|
|
|
|
[dependencies]
|
|
# The gate itself — LocalToolGate decides a call against a content-addressed,
|
|
# joule-budgeted capability set and seals every allow/deny. Cross-workspace path
|
|
# dep into jcp-rs (the reference impl composes the sibling standard's crate).
|
|
jcp-bridge = { path = "../../../../jcp/jcp-rs/crates/jcp-bridge" }
|
|
serde_json = "1"
|
|
hex = "0.4"
|
|
|
|
[dev-dependencies]
|
|
# The conformance test decodes + verifies the sealed receipt the gate writes, under
|
|
# the reference gate's fixed dev steward, against the pack's receipt.json.
|
|
jcp-receipt = { path = "../../../../jcp/jcp-rs/crates/jcp-receipt" }
|
|
ed25519-dalek = "2"
|