Skip to content
JouleOS Docs

Conformance

JouleOS is defined by what it guarantees, and those guarantees are enforced mechanically. The joule-os-conformance crate is the executable specification.

What it enforces

Section titled “What it enforces”
  • THEOREM v0.2 invariants I1–I20 — the capability-ledger and store properties (e.g. a capability cannot exist without Ledger::issue; the single-level store never tears; delegation only narrows).
  • AOT ≡ JIT, bit-for-bit — lowering_aot_jit.rs runs programs through both execution tiers and asserts identical output. See Lowering.
  • Energy honesty — provenance can only be demoted, never promoted (Estimator may not serialize as a measured class).

Running it

Section titled “Running it”
Terminal window
cargo test -p joule-os-conformance

The suite is the contract: a third party can implement against the public invariants and verify conformance without a trust relationship with the authors.

Status

Section titled “Status”

v0.1 reference. The single-level-store cutover has landed; the capability ledger, the refine cascade, the measured energy oracle, and the AOT interpreter with the optional Cranelift JIT tier are implemented across the native, browser, and bare-metal surfaces — all under the invariants above.