A coding change,
measured in joules.
Coding tools resell tokens. Joule Code makes the unit a content-addressed, signed transition over a source tree — resolved at the cheapest tier that can close it, carried over a vendor-neutral cascade, and billed in honest joules. The frontier agent is a wire endpoint, not the owner.
The cascade
Resolve at the cheapest tier that can close.
A request enters at L0 and descends only as far as it must. The first tier that can produce the change closes the request — nothing higher is consulted. A cache hit never wakes a model; a lint-fix never calls the wire. Energy spent tracks difficulty, not habit.
The operation was resolved before, keyed by (prior tree, intent). A hit closes the request without consulting any higher tier — picojoule class. The cheapest possible close.
A formatter, a codemod, a lint-fix, a rename — a transformation with a known, deterministic answer. No model needed; closed by a rule.
Answerable from an embedding index over the tree and prior operations — the nearest known transition, surfaced without generation.
A local model generates the change. Cheapest capable backend by joule cost; the reference runs a from-scratch GGUF tensor engine on-device, energy metered over the inference.
The hardest changes go to a frontier agent over the Agent Client Protocol — vendor-neutral, the vendor CLI owns its own login. No protocol token, no resale.
The cargo
The change is the object. Five commitments make it portable.
A coding operation is a set of edits — byte-range or hunk anchors over paths — bound to the prior state of the tree, content-addressed and signed. It is a Transaction Science cargo: it inherits the family's identity, signing, federation, energy, and conformance commitments unchanged.
Content-addressed identity
Every coding operation and source state is named by its BLAKE3 hash (b3:…) over a canonical det-CBOR encoding. Identity is the content; two runs that produce the same change produce the same id.
Signed transitions
An operation is an Ed25519-signed transition bound to the prior tree state. The signature covers the operation id ‖ prior, so a change cannot be replayed against a different base or reattributed to another author.
Federated, bounded membership
Collaboration is lockstep deterministic simulation with BFT supermajority commit among a known, signed-membership cluster — not one company's server. The substrate scales by federating bounded clusters, one per project.
Energy attribution
Every operation carries a receipt with its joule cost as measured + estimated integer microjoules, each reading tagged HwShunt, ModelBased, or Estimator. The work's energy is a first-class, signed line item.
Conformance-defined canonicity
What counts as a valid operation, receipt, and cascade close is fixed by signed wire vectors (C1–C4), not by any implementation. A second implementation is correct iff it reproduces the vectors byte-for-byte.
The receipt
Energy, signed and honest about how it was known.
Every closed operation carries a receipt: its joule cost as measured + estimated integer microjoules, sealed as a JCR-1 envelope (canonical det-CBOR inside COSE_Sign1, EdDSA) — the family's shared wire format. The energy ledger of a whole collaboration is re-walkable offline by anyone holding the log. Each reading declares its provenance, so no estimate is ever dressed as a measurement.
- op
- b3:Rtqw6jFwDKCtrvplkbLw…
- prior
- b3:8fK2q9Lm4nRtZ0xV…
- tier
- L3 · Model
- energy
- 63.2 J · ModelBased
- sig
- ed25519 ✓ verified
Read from a real hardware energy interface — Intel/AMD x86 RAPL via powercap, NVIDIA via NVML, Jetson via INA3221 shunts. A measured figure must come from here.
Honest to the counter's resolution.
A vendor freq/voltage/utilisation model — a real on-device reading, not a coulomb shunt. Apple Silicon's IOReport Energy Model channels (CPU/GPU/ANE/DRAM) land here.
An estimate the auditor can discount — but a real one.
A static architecture × precision × batch cost model, used only where no counter exists at all. Carries no measured figure, by construction.
Wide tolerance, declared.
Federation · Research
Cloud collaboration with no tie to one company.
Ownerless collaboration composes existing substrate faces rather than routing every change through one vendor's server. All four layers are implemented and tested in-process; they earn a conformance pack as they harden.
Consensus
LockstepCluster — a multi-node lockstep deterministic simulation with BFT supermajority commit. An operation commits only when ≥ 2f+1 of n = 3f+1 honest nodes validate it; committed ops are id-ordered, so every honest node derives a byte-identical log. Safety holds with up to f Byzantine nodes.
Threshold authorization
FROST (Ed25519) t-of-n threshold signatures over an operation id for protected changes — a protected-branch commit needs a quorum of signers, and no single member holds the whole key.
Group keying
MLS (RFC 9420) — the collaborating set forms a group and derives a shared key with no central server; adding a member advances the epoch, and past epochs stay forward-secret.
Transport
CommunicationOS over MoQT (Media over QUIC Transport) carries committed operations between members, each object bearing a signed receipt; a subscriber recovers every operation and verifies it against the publisher's key.
Measured energy
The estimator is the fallback, not the default.
The reference energy layer reads a real counter wherever the hardware exposes one. Verified on real silicon — the same probe, the same trait, four platforms:
| Platform | Counter | Provenance | Reading |
|---|---|---|---|
| Apple Silicon | IOReport Energy Model | ModelBased | 25.5 W / 74 J |
| Windows + RTX 2060 | NVML | HwShunt | 9.4 W / 18.8 J |
| Linux x86 + Tesla T4 | NVML | HwShunt | 71.8 W / 148 J |
| Linux x86 Xeon | RAPL powercap | HwShunt | 77.1 W / 154 J |
Readings over a ~2 s CPU-churn window. Apple's Energy Model is a vendor model (ModelBased); GPU and x86 package counters are hardware shunts (HwShunt). Where no counter exists, the reading is an Estimator and says so.
Reference
An Apache-2.0 library and a working consumer.
The spec is CC-BY-4.0; the reference library is Apache-2.0. The reference consumer is agent-zed — a fork of the Zed editor that drives frontier coding agents over ACP, emits a real receipt per session, and closes the cascade at L0 on a repeat request.
joule-code-schema Content addressing (b3:… BLAKE3), canonical det-CBOR, the L0–L4 tier ladder, the signature algorithm tag.
joule-code-cargo The coding operation: edits with byte-range or hunk anchors over paths, signed and prior-bound; the operation id validates ordering and non-overlap.
joule-code-receipt The energy receipt — measured + estimated microjoules with provenance coupling — sealed as a JCR-1 envelope (det-CBOR + COSE_Sign1, EdDSA) shared across the family.
joule-code-cascade The L0–L4 cascade with stop-at-first-close, a content-addressed L0 cache stage, and a generic FnStage so any tier binds without the library depending on a runtime.
joule-code-collab Federated collaboration (Research): the BFT LockstepCluster, FROST threshold authorization, MLS group keying, and the CommunicationOS/MoQT transport binding.
joule-code-conformance The C1–C4 vector harness — coding op, signature, receipt envelope, and cascade close — with real crypto, no skips.
