open-standards/jcp/jcp-rs/crates
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Transaction Science 6423d5d892
All checks were successful
standards workspaces build + test / which workspaces this change touches (pull_request) Successful in 6s
repository checks / lockfiles, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Successful in 45s
standards workspaces build + test / jouleclaw-rs (-nodebug, jouleclaw/jouleclaw-rs, -p jouleclaw-energy --features rapl,nvml, jouleclaw-rs, linux-arm64, -C target-feature=+fp16) (pull_request) Successful in 7m45s
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 7m31s
standards workspaces build + test / mesh-rs (mesh/mesh-rs, -p mesh-engine-gguf -p mesh-openai --features mesh-engine-gguf/gguf,mesh-openai/server, mesh-rs, linux-arm64) (pull_request) Successful in 1m28s
standards workspaces build + test / macOS energy backends (pull_request) Successful in 8m20s
standards workspaces build + test / jouledesk-rs (jouledesk/jouledesk-rs, jouledesk-rs, macos) (pull_request) Successful in 2m47s
standards workspaces build + test / jcp-rs (jcp-conformance, jcp/jcp-rs, -p jcp-energy --features nvml, jcp-rs, linux) (pull_request) Successful in 1m49s
standards workspaces build + test / joule-ui-rs (joule-ui/joule-ui-rs, joule-ui-rs, linux) (pull_request) Successful in 1m17s
standards workspaces build + test / joulehook-rs (joulehook/joulehook-rs, joulehook-rs, linux) (pull_request) Successful in 1m18s
standards workspaces build + test / sandbox-rs (sandbox-conformance, sandbox/sandbox-rs, sandbox-rs, linux) (pull_request) Successful in 2m38s
jcp: C25 — flow was a declared clause with no check; now it has one
§9 has listed `C25 — flow` as a conformance clause for as long as the clause
existed, and the harness never had it. Worse than a missing test: a published
list of conformance classes claiming a class the pack cannot run.

Verified before writing anything, because a declared gap is not evidence of
one:

- the harness's only occurrence of "flow" was an unrelated `// control flow`
  comment;
- `jcp-flow` is not even a dependency of `jcp-conformance`, so no check could
  have used it;
- and `jcp-flow` is the wrong crate anyway — it is provenance *scanning*
  (L17–L20, content windows). The clause is about the *decision*: a grant's
  ceiling, the enforcement point's taint floor, attenuation. That lives in
  `jcp_schema::flow` and `jcp-runtime`, both already dependencies, so the check
  needs no new one.

`C25` asserts each property the clause states, separately, so a failure names
which one broke:

- a label at or below the grant's ceiling passes and one above it does not;
- the enforcement point's taint floor binds **even under a ceiling permissive
  enough to admit the value** — an operator refusal a delegated grant cannot
  widen;
- facts that were never computed **fail closed** against a ceilinged grant.
  This is the unknown-is-not-a-value rule in its sharpest form: "no provenance"
  must not read as "no taint";
- several ceilings compose to the strictest, so adding a permissive caveat
  cannot widen a strict one;
- a flow denial debits nothing, so a tainted call costs zero joules;
- a ceiling-free grant — which is every grant minted before flow existed —
  behaves identically whatever the facts say and carries no flow field on the
  wire.

Falsified against the implementation rather than the check, which is the only
direction that means anything for a conformance clause: four mutations of
`flow_gate` and `ceiling_of` (ceiling unenforced, floor unapplied, uncomputed
provenance failing **open**, ceilings composing to the most permissive). All
four caught, each with its own message, so the clause discriminates between the
properties instead of failing generically.

Also fixes the asymmetry in the other direction: the harness has carried a
`C19` (injection resistance) that §9 never listed, so §9 now lists it. The
spec's classes and the harness's checks are both C1–C26 and agree item for
item.

I first wrote this as `C27`, taking the next free id. That was wrong — §9 had
already assigned `C25` to flow, and implementing a different id would have
recreated the asymmetry this closes.

Co-Authored-By: Claude Opus 5 <[email protected]>
2026-10-20 08:42:01 -04:00
..
jcp-a2a jcp-a2a: an unverified AP2 mandate could set the ceiling, and name any payee 2026-10-05 07:22:11 -04:00
jcp-action-receipt jcp: a ModelIn caveat says which model a grant authorizes, and the frame names the model it runs 2026-10-17 04:21:21 -04:00
jcp-bridge Merge pull request 'jcp-bridge: an OAuth access token narrows to the grant's caveats or is not minted, and a delegated grant needs its chain' (#321) from fix/jcp-oauth-projects-caveats into main 2026-10-18 19:02:29 -04:00
jcp-channel jcp: a ModelIn caveat says which model a grant authorizes, and the frame names the model it runs 2026-10-17 04:21:21 -04:00
jcp-cite jcp: a ModelIn caveat says which model a grant authorizes, and the frame names the model it runs 2026-10-17 04:21:21 -04:00
jcp-cli jcp: a ModelIn caveat says which model a grant authorizes, and the frame names the model it runs 2026-10-17 04:21:21 -04:00
jcp-conformance jcp: C25 — flow was a declared clause with no check; now it has one 2026-10-20 08:42:01 -04:00
jcp-efficiency jcp-efficiency: the outcome anchor is not ours alone; the signature is 2026-10-18 08:32:52 -04:00
jcp-energy energy meters: a GPU counter reading low is refuted in sandbox-meter, eoc-meter and jcp-energy too 2026-10-20 04:15:36 -04:00
jcp-flow jcp-flow: Compute propagated provenance from tool bytes 2026-07-22 02:09:29 -04:00
jcp-gateway jcp-gateway: everything a gated request carries to the server is sealed and flow-checked 2026-10-19 11:23:23 -04:00
jcp-grant jcp: a chained decision enforces caveats, and a chain cannot drop one 2026-10-17 10:44:16 -04:00
jcp-intercept jcp-intercept: a reading meter meters a seam as one span, divided among its steps by CPU time 2026-10-13 02:41:41 -04:00
jcp-orchestrate jcp: a ModelIn caveat says which model a grant authorizes, and the frame names the model it runs 2026-10-17 04:21:21 -04:00
jcp-policy jcp-policy: a receipt sealed the policy's name, so the rules could be swapped under it 2026-10-05 07:22:12 -04:00
jcp-prompt jcp-prompt: a signed, content-addressed prompt registry 2026-06-27 19:57:46 -04:00
jcp-receipt jcp-gateway: replay our own receipt stream at startup (SPEC §8.1) 2026-10-17 11:42:06 -04:00
jcp-runtime jcp: a chain is bounded in money on every link, and a delegated grant is never decided alone 2026-10-17 11:42:12 -04:00
jcp-schema jcp-wire: a request presented again gets its first answer, so a lost response is recoverable 2026-10-20 03:20:12 -04:00
jcp-threshold jcp-wire: the endpoint decides at its own clock, and a captured request is decided once 2026-10-18 13:40:16 -04:00
jcp-trace jcp-trace: an undefined wedge metric is not zero 2026-10-17 04:54:47 -04:00
jcp-wire jcp-wire: a request presented again gets its first answer, so a lost response is recoverable 2026-10-20 03:20:12 -04:00
jcp-x402 jcp-x402: the settlement record carries its figure's grade; pay meters its compute 2026-10-10 18:05:48 -04:00