Open standard · joulespec/1
What software owes, and whether anything established it.
Specification-driven practice converged on prose an agent interprets and a human reads. The difficulties catalogued wherever it is examined — specifications drifting from the code they describe, generated artifacts trusted past their evidence, no method for checking conformance, a review burden heavy enough that practitioners report preferring to read the code — are measurement problems. They persist because the specification is a document: a clause cannot be addressed, so nothing binds to it; conformance is a sentence in a review, so it cannot be graded or capped; the cost of the ceremony is an anecdote, so the argument about whether it earns its overhead has no units.
JouleSpec leaves the prose alone and changes what a specification is.
How hard would it be for this obligation to be violated without this evidence noticing? The order is re-checkability, not diligence: a human review is bound to the state a person looked at and cannot notice a violation introduced afterwards, where a named check can run again against any later state.
E0 is where prevailing practice lands. A clause an agent claims to have implemented, with a human skim at the end, is testimony from the party being evaluated. Much of it is true. It is still testimony.
A clause is addressed by the content address of its kind and text, with the label deliberately excluded. Renaming a clause loses no evidence. Rewording one invalidates exactly that clause’s evidence, and nothing else’s. That inversion is the whole mechanism: under citations bound to a label, a reworded clause keeps evidence for wording nobody checked.
A green check establishes that something ran, not that the obligation holds — a test with no assertion passes, and so does one whose fixture never reaches the condition the clause cares about. So nothing climbs past E2 on a passing run. A check must be on record failing against a counter-artifact; a proof must have been refuted against a counter-model.
Nothing says the state in which a check should fail is one edit away from the state in which it passes. An obligation enforced in two independent places survives either edit alone, so a counter-artifact may declare several edits, applied together and reverted together — and the witness records how many it took.
A check’s anchor is declared: specification, state, or unstated. An oracle whose expected value is derived from the system it judges cannot disagree with that system when a fault moves the measurement and the expectation together, so an unstated anchor caps evidence at E2 however the check behaved.
A grade says how hard the obligation would be to violate unnoticed. An attestation says who established that. A proof nobody independent of the implementer ever saw, and a citation from an independent auditor, are each strong on one axis and weakest on the other. Both are capped at the minimum over the owed obligations, independently.
A witness carries a signed footprint: the parts of the artifact it actually depended on. A later state whose parts still contain every footprint member keeps the evidence alive; one that does not makes it stale and says so. An empty footprint means the whole artifact, which is the conservative reading.
Between two revisions, every clause lands in exactly one of kept, relabelled, reworded, added or removed. Relabelling is editorial and costs nothing. Rewording invalidates that clause’s evidence. The question “did this edit change what is owed” has a mechanical answer.
Microjoules per falsifiable obligation, with the energy of the work and the energy of the evidence accounted separately, and the specified share reported as integer parts-per-million. Every aggregate carries the weakest provenance that fed it — a figure graded as a default guess stays a guess however precisely it is printed.
The reference producer reads the clauses from a published specification document — not from a copy in its own configuration, so the two cannot drift — runs each declared check, runs it again against a counter-artifact, and emits a signed witness only at the rung the observations support.
| Observed | Read as |
|---|---|
| ran and failed | the evidence |
| did not compile | the check never ran, so nothing was demonstrated |
| reported success having run no checks | not evidence that any ran |
| ran and passed | a finding: the check cannot see the thing it is about |
Crediting a failed build as a demonstrated failure would manufacture falsifiability out of a syntax error. The producer also drives a bit-precise model checker for the top rung, and parses its property table rather than its verdict line: a checker reports success for a harness whose assumptions emptied the domain in the same words it uses for one that examined all of it, so a gate reading the verdict passes vacuous proofs.
Three things are declared because they are human judgements the standard refuses to guess: which check stands for which obligation, where each check’s expected values come from, and which inputs it depends on. Everything else is computed.
Wire vectors
Fixed keys, clauses, witnesses and fixed energy, producing receipt bytes that must not change without a version bump. One witness of every rung, plus one bound to a superseded state, so an implementation that mishandles staleness fails rather than passing quietly.
Evaluation corpus
Round-tripping a receipt says nothing about whether an implementation graded correctly. Each case here is a complete set of evaluation inputs plus the verdict the standard requires, chosen so a plausible but generous implementation disagrees. Most catch over-grading; at least one catches under-grading, because an implementation that graded nothing would pass all the others.
A measurement, not a vector
The standard is applied to its own implementation, and to other standards in this family, with the clauses read from their published documents. Those receipts carry wall-clock energy, so re-running produces different bytes. A pack that held measured energy fixed would publish a figure nobody measured.
A grade is a property of evidence, not of software. JouleSpec cannot tell:
Software can satisfy every clause of its specification and be unfit for its purpose, because the specification was incomplete — and an incomplete specification is exactly the case where every clause is covered. The top rung is also not uniformly affordable: the cost of discharging a statement is a property of the statement and of the method, neither of which the ladder mentions.