Conformance

JouleOS is defined by what it guarantees, and the joule-os-conformance crate is the executable specification: 96 test files, 604 tests passing on 7 November 2026 (607 with the JIT).

What it tests

THEOREM v0.2 invariants — eight of the twenty (I3, I7, I8, I9, I15, I17, I19, I20) have dedicated tests today, covering capability-ledger and store properties (e.g. a capability cannot exist without Ledger::issue; the single-level store never tears; delegation only narrows). The other twelve are not yet tested.
AOT ≡ JIT, bit-for-bit — lowering_aot_jit.rs runs programs through both execution tiers and asserts identical output. See Lowering.
Energy honesty — provenance can only be demoted, never promoted (Estimator may not serialize as a measured class).

Running it

cargo test -p joule-os-conformance

The suite is the contract: a third party can implement against the public invariants and verify conformance without a trust relationship with the authors.

Status

v0.1 reference. The single-level-store cutover has landed; the capability ledger, the refine cascade, the measured energy oracle, and the AOT interpreter with the optional Cranelift JIT tier are implemented across the native, browser, and bare-metal surfaces — all under the invariants above.