wai: the parameter-set pin, component identity, pin-aware selection #132

Merged

dcharlot merged 13 commits from wai/land-13-parameter-set-identity into main 2026-10-01 14:50:19 -04:00

Conversation 0 Commits 13 Files changed 121 +9903 -2139

dcharlot commented 2026-10-01 09:58:43 -04:00

Owner

Copy link

SPEC §3.1 makes the model pin normative. A manifest's conditioning.prior, and each WAI2 rendition's prior, carries id, sha256 and determinism, plus the optional form, tier and supersedes. The digest covers the whole parameter set; a set of several files is pinned through its listing, registered as the prior form wai.prior.set. A sink verifies the pin before it decodes, refuses with one of an ordered set of reasons, and decodes only from the bytes it verified. A pin that does not resolve makes its capability unsupported for that envelope: §4 dispatch continues at the fallback and §7.1 selection at the next rendition.

• Component identity (§7.1). A rendition entry may carry id and sha256 (its payload digest) beside its prior, and a companion may name its base by companion_of_id. §7 gains a Digests subsection, and §8 says how a MINOR revision adds an optional member.
• One predicate on every path. Wai::dispatch_verified, WaiMulti::pick and primary, the C wai_envelope_select and wai-web all use codecs::is_dispatchable, so a candidate stays inert on every path; the candidate tests run on the pin-aware API and on the C ABI.
• wai-rs. The manifest types are #[non_exhaustive] with builders; a pin module verifies pins in memory and on disk; every neural decoder reads through ParamSource; a codec-free ffi feature carries the C envelope surface; a pinned ONNX model may not reference tensors outside the verified bytes.
• Registry and vocabulary. wai.prior.set is in the registry table. Vocab v2, generated from the registry, carries the pin terms, which v1 gains additively.
• Vectors. The pin-conformance corpus with an independent Python verifier, the int_mlicpp set-form twin, and SHA-256 sidecars for the decoded output of every capability that decodes against a parameter set.

Lands after #131.

Checked locally on macOS arm64: the link gate (build, library tests, carriage, every conformance corpus including pin conformance, fast kernels, byte-exact conformance, the wasm32 check and the neural gates) and the workflow steps this link adds. The forge CI runs on this pull request.

🤖 Generated with Claude Code

SPEC §3.1 makes the model pin normative. A manifest's `conditioning.prior`, and each WAI2 rendition's `prior`, carries `id`, `sha256` and `determinism`, plus the optional `form`, `tier` and `supersedes`. The digest covers the whole parameter set; a set of several files is pinned through its listing, registered as the prior form `wai.prior.set`. A sink verifies the pin before it decodes, refuses with one of an ordered set of reasons, and decodes only from the bytes it verified. A pin that does not resolve makes its capability unsupported for that envelope: §4 dispatch continues at the fallback and §7.1 selection at the next rendition. - **Component identity (§7.1).** A rendition entry may carry `id` and `sha256` (its payload digest) beside its `prior`, and a companion may name its base by `companion_of_id`. §7 gains a Digests subsection, and §8 says how a MINOR revision adds an optional member. - **One predicate on every path.** `Wai::dispatch_verified`, `WaiMulti::pick` and `primary`, the C `wai_envelope_select` and wai-web all use `codecs::is_dispatchable`, so a candidate stays inert on every path; the candidate tests run on the pin-aware API and on the C ABI. - **wai-rs.** The manifest types are `#[non_exhaustive]` with builders; a `pin` module verifies pins in memory and on disk; every neural decoder reads through `ParamSource`; a codec-free `ffi` feature carries the C envelope surface; a pinned ONNX model may not reference tensors outside the verified bytes. - **Registry and vocabulary.** `wai.prior.set` is in the registry table. Vocab v2, generated from the registry, carries the pin terms, which v1 gains additively. - **Vectors.** The pin-conformance corpus with an independent Python verifier, the `int_mlicpp` set-form twin, and SHA-256 sidecars for the decoded output of every capability that decodes against a parameter set. Lands after #131. **Checked locally on macOS arm64:** the link gate (build, library tests, carriage, every conformance corpus including pin conformance, fast kernels, byte-exact conformance, the wasm32 check and the neural gates) and the workflow steps this link adds. The forge CI runs on this pull request. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dcharlot added 18 commits 2026-10-01 09:58:43 -04:00

wai: one registry table, candidate capabilities, public-text checks ... fb103ac5ae

Every registered string now lives in one table (codecs/registry.rs) with
its kind, status, media class, registering SPEC section, edition and
registration date. `wai registry export` writes registry/capabilities.json,
its JSON Schema, the generated table in REGISTRY.md and vocab v2; --check
fails on drift. vocab v1 stays stable.

A candidate capability (a registered string whose payload format no
revision has pinned) must not be emitted. The C packers, the browser
writers and `wai wrap` refuse one, and `codecs::is_dispatchable` is the
single dispatch and selection predicate (SPEC §4): candidates,
companion-only capabilities, records and derivations are not
dispatchable, and an unregistered string is decoded only where the sink
advertises it.

The codec glossary is linked to the registry through a reviewed table and
held to its schema by a library test; `org` becomes `body`, from a closed
allowlist. The SPEC gains §5 sections on kinds and candidates, a §8
edition rule, corrected citations and rewritten appendices. The
quantum-ops vectors are regenerated with neutral device ids.

CI declares the feature-gated test targets with required-features, checks
the registry export, builds wai-web for wasm32, and runs two public-text
checks (comparative prose, and private name patterns) with a self-test.
The specification, extensions, research notes, READMEs, glossary and
source comments are rewritten to name no company or product and to make
no comparisons.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: hold research/content-taxonomy.md to both public-text checks ... f62e7d8557

The content-taxonomy note has been rewritten on main, so the exclusion
both checks carried for it is removed, as their comments said to do once
that change landed. The note now passes both checks: lever 1 names a
registered codec, and the gain, wedge and endgame phrasing is restated as
what each lever applies to.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: the parameter-set pin, component identity, pin-aware selection ... 22928147f3

SPEC §3.1 defines the pin a manifest carries (conditioning.prior, and a
WAI2 rendition's prior): id, sha256, determinism, and the optional form,
tier and supersedes. The digest covers the whole parameter set. A set of
several files is pinned through its listing, the new registered prior
form wai.prior.set. A sink verifies the pin before it decodes, reports a
refusal with one of an ordered set of snake_case reasons, and decodes
only from the set it verified. Tier is a closed vocabulary; supersedes is
informative.

A pin that does not resolve makes its capability unsupported for that
envelope: SPEC §4 dispatch continues at the fallback, §7.1 selection at
the next rendition, and an inert envelope's error names the reasons. A
rendition entry may carry id, sha256 and, on a companion,
companion_of_id. SPEC §7 gains a Digests subsection, and §8 says how a
MINOR revision adds an optional member.

In wai-rs: the manifest types are #[non_exhaustive] with builders; a new
pin module verifies pins in memory and on disk; Wai::dispatch_verified,
WaiMulti::pick and primary check pins and component digests; every
neural decoder reads through ParamSource; a codec-free `ffi` feature
carries the C envelope surface with wai_envelope_select and
wai_neural_decode_ex. wai-web wraps wai::container. New vectors: the
int_mlicpp set-form twin and the pin-conformance corpus with an
independent Python verifier, plus sha256.json sidecars for the vectors
of capabilities that decode against a parameter set.

Squashed from wai/stream-a-parameter-set-identity onto link 12. Conflicts
are resolved to keep both sides; the integration commits that follow
make the two streams agree.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: one dispatch predicate, codecs::is_dispatchable, on every path ... 33abd9ecb6

codecs::dispatchable (not companion-only) is removed. Wai::dispatch_verified
takes a capability or fallback only when is_dispatchable accepts it, and
RenditionMeta::is_selectable already goes through it, so WaiMulti::pick,
primary, the neural sink's decode_multi, the C wai_envelope_select, the
wai-web core module and the CLI's inspect all refuse a candidate, a
record and a derivation as well as a companion-only capability. A string
this revision does not register stays dispatchable when the sink
advertises it, and a pin on it is verified as several files, so it fails
closed.

SPEC §7.1 step 2 takes an entry whose capability is dispatchable (§4),
step 5's not_selectable says the same, and §3.1 notes that an
unregistered string is dispatchable. §5's candidate paragraph names the
pin-aware functions.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: candidate tests on the pin-aware selection API and the C ABI ... ecaae09149

The link-12 candidate tests are ported to link 13's API:
a_candidate_is_never_dispatched_picked_or_emitted builds its envelopes
with Manifest::new and ModelRequirement::new(..).with_fallback(..),
dispatches through dispatch_verified, and picks with
pick(.., no_parameter_sets()) and primary(..), now also checking the
not_selectable reason a candidate entry gets. the_emit_path_refuses_a_candidate
builds the WAI2 envelope through WaiMulti::from_parts, as the C packer
now does. `wai wrap` sets its fallback through the builder.

New candidate cases: in the pin-aware dispatch and selection tests, a
candidate carrying a pin is never dispatched or picked and its pin is
never verified; in tests/ffi_envelope.rs (feature `ffi`, which the C ABI
envelope step runs), wai_envelope_select never picks a candidate and the
WAI2 table marks it not selectable, and envelope_pack_refuses_a_candidate,
which needed the codecs feature before, checks that wai_envelope_pack and
wai_envelope_pack_multi refuse one.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: register wai.prior.set in the registry table and regenerate ... 60d2486c79

wai.prior.set (SPEC §5, Prior artifacts) gets its row in the registry
table: a registered payload, media class binary, registered 2026-09-30,
with the edition left to the registration. It is listed in
GLOSSARY_NO_ENTRY as a WAI-native class. `wai registry export` regenerates
registry/capabilities.json, the table in REGISTRY.md and vocab
v2.{ttl,shapes.ttl}; `wai registry export --check` is clean, and the
registry tests that hold every registered string to one row pass again.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: vocab v2 carries the parameter-set pin, generated from the registry ... 25bcd9b4ef

`wai registry export` now writes the pin terms into v2 as v1 states them:
the ParameterSetPin class, wai:prior and the members pinId, pinSha256,
pinDeterminism, pinForm, pinTier and pinSupersedes in v2.ttl; a scoped
`prior` term in v2.jsonld whose members are the manifest's own names; and
ParameterSetPinShape and SupersedesShape in v2.shapes.ttl, with the tier
list taken from codecs::TIER_TOKENS. v1 keeps its additive pin terms.

vocab_pin_terms_match_prior_members reads v1 and v2 and holds each
scoped term to the pin's serialized members and each shape's tier list
to the registered tokens. check_shapes.py gains pin cases (a full and a
minimal pin, an unregistered tier, an uppercase digest, a missing
determinism, a supersedes with no digest, and a WAI2 component's pin);
against the v2 files before this change, the five non-conforming cases
conform. The vocab README says what each version carries.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: declare link 13's feature-gated tests and say where the C ABI runs ... ec818bca21

Cargo.toml declares the feature-gated integration tests that CI names
with --test, with their features, beside link 12's: generate (generate),
ffi_envelope (ffi), ffi_neural_pin (neural, ffi), neural_native_decode
(neural) and jpegai_e2e_full (neural_int). Naming one without its
features now stops cargo with an error instead of running an empty
binary that reports ok.

The C ABI envelope step's comment says it also checks the candidate
refusal of selection and of the packers, and determinism-tiers §6 no
longer says the C packers build only with the codecs feature: they build
under `ffi`, and tests/ffi_envelope.rs runs in that step.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai/CHANGELOG: the parameter-set pin entry records the assembly ... c0bcb4c432

Stream A's subsection, under link 12's, now records what assembling the
two changes did: one dispatch predicate (codecs::is_dispatchable) on every
selection path, wai.prior.set in the registry table and its exports, the
pin terms and shapes in the generated vocab v2 as well as in v1, and the
C packers' candidate refusal tested under the codec-free `ffi` feature.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: give each CLI registry test its own payload directory ... 05032bfef5

Three tests in tests/cli_registry.rs wrote their payload into one shared
directory, which scratch_dir empties before returning. Run in parallel,
one test removed the directory while another wrote into it, and the write
failed with EINVAL. Each test now names its own payload directory; the
carriage and CLI step passed three runs in a row.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: restate the ranking phrases the retrofit left in research and extensions ... 348a2d9259

The retrofit's commit says the research notes, extensions and source
comments make no comparisons. These lines still ranked or promoted:

- research/cargo-roadmap.md: the sequencing rationale and the phase
  reasons now say what each phase reuses or carries, and the status note
  points to content-taxonomy.md for each class's status.
- research/content-taxonomy.md: the "white space" table is now the
  cargo-roadmap phase table, with each phase marked shipped and its
  capability named, so it no longer contradicts the taxonomy rows above
  it; the closing clause of the spatial-audio row and "That's the whole
  map" are removed.
- extensions/spatial-audio.md and research/spatial-audio-draft.md: the
  appendix says why spatial audio was first without ranking it.
- SPEC.md §5, extensions/ternary-tt.md and the CAP_TERNARY_TT comment:
  wai.ternary.tt is stated by its own measured operating point (13.3 dB
  SNR at 3.8x with six residual layers, the extension's table) and its
  Lossy tier.
- research/2030-transport-landscape.md: three lines restated as what WAI
  specifies; the CHANGELOG entry now says comparative framing in dated
  records is restated in place, as names are redacted.
- wai-rs/src/lib.rs: the quantum_qec comment ends at the metric it carries.

scripts/check-comparative-prose.sh gains five phrases (commercial wedge,
unclaimed, fast win, differentiator, rate-competitive), each with a case
in scripts/test-public-text-checks.sh.

REGISTRY.md and vocab/README.md say that the v2 SHACL shape checks the
capability and fallback against this revision's registry and only the
form of media, and that a violation for an unregistered string means it
is not registered in this revision, not that the envelope fails to
conform or cannot be dispatched (SPEC §4, §8).

The CHANGELOG's candidate-capability bullet states the MINOR rule as a
full sentence.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

ci: give the WAI name list only to the push-to-main run ... 913c994b18

The wai-public-names job set WAI_NAME_DENYLIST at job level, so on a
pull request from a branch of this repository the list reached a script
taken from the pull request's own tree, whose log is public. The secret
is now set on the one step that runs the check, and that step runs only
on a push to main; a pull request shows a failed (continue-on-error) step
saying the check did not run. On a push to main an empty list still fails
the job. wai/CONTRIBUTING.md and the CHANGELOG entry say so.

A correction to the record: the message of the commit that added these
checks says CI declares the feature-gated test targets with
required-features. wai/wai-rs/Cargo.toml declares them with their
required-features, and the conformance workflow names them with their
features.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai/glossary: the codec glossary declares its schema version ... d96739e436

The retrofit renamed each entry's `org` field to `body`, and the file
carried no version, so a reader of the earlier form found no `org` and no
way to tell the two forms apart. codecs.json now carries
`"schema_version": 2`. SCHEMA.md describes the field: version 2 is the
form it documents, a file without the field is the earlier `org` form,
and a change that renames or removes a field, or changes what one means,
raises the version. glossary_links_agree_with_the_registry requires the
value, and glossary_check_names_each_broken_rule has two cases for a
missing and a wrong version. The CHANGELOG's glossary bullet records the
break.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge wai/land-12-registry-and-text into wai/land-13-parameter-set-identity ... f93f7074d8

Brings link 12's three follow-up commits onto link 13: the restated
ranking phrases in the research notes, extensions and source comments,
with five more phrases in the comparative-prose check; the WAI name list
given only to the push-to-main run; and the codec glossary's
schema_version.

One conflict, wai/vocab/README.md: link 13's rows (the prior term in the
JSON-LD context, the parameter-set pin in the shapes) are kept, and link
12's sentence on what a violation for an unregistered string means is
added before the pin sentence. REGISTRY.md's row for the v2 files now
also names the parameter-set pins the shapes check.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai/neural: the strict gate reads only dispatchable capabilities; a pinned model keeps no tensor outside the verified bytes ... e0d16bc14c

decode_envelope_strict chose the capabilities its early replicate refusal
reads by what the sink's registry holds alone. A candidate, companion-only
capability, record or derivation held at the sink could then decide that
refusal, though dispatch never takes one. The gate now reads only
capabilities codecs::is_dispatchable accepts and the sink advertises, so a
held candidate gives the reason an empty registry gives
(strict_gate_ignores_a_held_capability_it_cannot_dispatch).

A pinned decode builds its ONNX session from the verified bytes, but an
ONNX tensor can name another file for its data. Run locally against the
linked ONNX Runtime, a model loaded from memory read such a file from the
process's working directory, outside every pin. neural::onnx_external now
reads the model's protobuf for a tensor stored as external data (graph
initializers, attribute tensors and subgraphs, training graphs, local
functions) and the pinned decode refuses such a model with set_incomplete,
naming the file, before the runtime sees it. Bytes that do not parse are
refused too.

wai-neural-gates.yml adds the new tests to its exact lists and counts.
determinism-tiers.md scopes its forge-run statement to the job as it was
before the pin-aware tests were added; those have no recorded forge run.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: correct public text the parameter-set link left stale or overstated ... 9dee86559c

- CHANGELOG, registry subsection: is_dispatchable is named as the
  predicate of every dispatch and selection function, with
  Wai::dispatch_verified (formerly dispatch_capability), instead of a
  function this release removes. The pin subsection records the strict
  gate's dispatchable filter and the refusal of a pinned ONNX model whose
  tensors live in another file.
- SPEC §3.1: a file a model names for part of its own data is a file the
  decode needs; one the decode cannot take from the verified set is
  refused with set_incomplete.
- SPEC §7.1: staged layers, byte-range and referenced renditions and
  per-rendition tracks are stated as a rule for a later mechanism, not as
  mechanisms that exist.
- SPEC §8: the parse failure of a mistyped defined member is stated as its
  own bullet, the one exception to the 1.x freeze, and says that the
  envelope's wai value does not signal it. §3.1 and the CHANGELOG point
  to it.
- wai-web dispatch_capability and the ffi_neural comment in lib.rs say
  what the code now does: only dispatchable capabilities are taken, and
  the neural C ABI builds with neural and ffi, without a codec library.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai/tests: serialize sha256.json sidecar writes and document their regeneration ... bc06242f9f

Several tests of one binary write entries of the same sidecar (three of
them write tests/vectors/int_video/sha256.json), each by reading the file,
inserting its entry and writing it back. Under parallel test threads two
writes could interleave and drop an entry. Each write now holds a
process-wide lock. The support module documents the command that
regenerates the sidecars under tests/vectors/ and neural-conformance/.
Regenerated with that command locally, every sidecar came out byte for
byte as committed, and the same tests then passed in check mode.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai/neural: the strict-gate test holds a record, which the old gate refused ... 7d01de3dcc

The test added in e0d16bc1 held only a candidate, wai.tensor.nnc. That
candidate's replicate class does not refuse `replicate`, so the old gate
gave the same reason, and the test passed with the dispatchable filter
removed. It now holds a record, wai.video.manifest, too. A record has no
replicate class, so the old gate refused the envelope as naming an
unknown capability. With the filter it gets step 6's missing model, as
from an empty registry and from the non-strict path. Locally, with the
filter removed, the test fails on the record, and with it, it passes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot referenced this pull request 2026-10-01 09:58:47 -04:00

wai: energy reports, labelled JWP leaves and what signatures cover #133

dcharlot merged commit 46db5f722f into main 2026-10-01 14:50:19 -04:00

dcharlot referenced this pull request from a commit 2026-10-01 14:50:20 -04:00

Merge pull request 'wai: the parameter-set pin, component identity, pin-aware selection' (#132) from wai/land-13-parameter-set-identity into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Transaction-Science/open-standards!132

No description provided.