wai: staged delivery in the browser — one base decode, the wasm binding, and its check #152

Merged

dcharlot merged 11 commits from wai/land-18-staged-browser into main 2026-10-06 02:26:54 -04:00

Conversation 0 Commits 11 Files changed 31 +3574 -141

dcharlot commented 2026-10-05 05:51:15 -04:00

Owner

Copy link

Staged delivery, rebuilt in the browser by the reference sink.

• One base decode for every sink. staged::decode_base checks the base's pin against the parameter set held in memory, counts the pin toward the tier only where it resolved, and records when a base was decoded through the manifest's fallback. The CLI and the browser binding share it.
• The browser binding. wai-web/src/stage.rs gives JavaScript the staged sink: decoding a base, offering, expiring and removing layers, attestation, the reports, and each unit's stage, producer, tier, output and stage hash. A layer's header, declared cost and byte split are also exposed. Reports and units come back in the corpus's own form.
• Checked against the corpus. demo/verify_staged_wasm.mjs replays every staged-conformance case through the wasm32 build, and CI runs it. It requires each integer base to decode to its stage 0, and every report, unit and stage hash to equal the native sink's.
• Tools.
  • wai stage base writes an integer-video base from raw frames.
  • wai stage apply replays layers and bases in any order and prints a JSON trace.
  • wai_stage_bench reports bytes, quality and time per stage. Energy is reported as unmetered.

A base is bounded and dispatched before it is decoded.

• decode_base and decode_base_via take a cost limit and the sink's key log.
  • The declared cost is checked before any symbol is decoded. A base past the limit is refused cost_over_limit and routes like an unsupported capability.
  • With a key log, check 5 runs over the base's parameter set.
• A base is dispatched by SPEC §4, primary first and then the fallback, so a refinement-only or companion-only primary stays inert.
• StageSink::add_base counts a base's state against the chain budget (staged-delivery §4.5).

In the browser binding:

• StageBase.decode takes a limit.
• stageLayerInfo returns a base's declared cost.
• A base given by the page (fromStage0) is checked against the manifest's capabilities, its tier is capped, and it is marked claimed. That mark carries to every unit, report and stage hash of its chain.
• viaFallback is read-only.

Smaller fixes:

• wai stage apply now routes exactly as the reference sink does, and a test replays the corpus through it.
• Its --json trace records every stage a unit passes through.
• The encoder checks its size caps before allocating.
• A one-file parameter set is checked against every held file.

Checked locally on macOS arm64: the link gate, the wasm verifier, the staged corpus through both verifiers, the CLI tests and the public-text checks. The forge CI runs on this pull request.

🤖 Generated with Claude Code

Staged delivery, rebuilt in the browser by the reference sink. - **One base decode for every sink.** `staged::decode_base` checks the base's pin against the parameter set held in memory, counts the pin toward the tier only where it resolved, and records when a base was decoded through the manifest's fallback. The CLI and the browser binding share it. - **The browser binding.** `wai-web/src/stage.rs` gives JavaScript the staged sink: decoding a base, offering, expiring and removing layers, attestation, the reports, and each unit's stage, producer, tier, output and stage hash. A layer's header, declared cost and byte split are also exposed. Reports and units come back in the corpus's own form. - **Checked against the corpus.** `demo/verify_staged_wasm.mjs` replays every staged-conformance case through the wasm32 build, and CI runs it. It requires each integer base to decode to its stage 0, and every report, unit and stage hash to equal the native sink's. - **Tools.** - `wai stage base` writes an integer-video base from raw frames. - `wai stage apply` replays layers and bases in any order and prints a JSON trace. - `wai_stage_bench` reports bytes, quality and time per stage. Energy is reported as unmetered. **A base is bounded and dispatched before it is decoded.** - `decode_base` and `decode_base_via` take a cost limit and the sink's key log. - The declared cost is checked before any symbol is decoded. A base past the limit is refused `cost_over_limit` and routes like an unsupported capability. - With a key log, check 5 runs over the base's parameter set. - A base is dispatched by SPEC §4, primary first and then the fallback, so a refinement-only or companion-only primary stays inert. - `StageSink::add_base` counts a base's state against the chain budget (staged-delivery §4.5). **In the browser binding:** - `StageBase.decode` takes a limit. - `stageLayerInfo` returns a base's declared cost. - A base given by the page (`fromStage0`) is checked against the manifest's capabilities, its tier is capped, and it is marked `claimed`. That mark carries to every unit, report and stage hash of its chain. - `viaFallback` is read-only. **Smaller fixes:** - `wai stage apply` now routes exactly as the reference sink does, and a test replays the corpus through it. - Its `--json` trace records every stage a unit passes through. - The encoder checks its size caps before allocating. - A one-file parameter set is checked against every held file. **Checked locally on macOS arm64:** the link gate, the wasm verifier, the staged corpus through both verifiers, the CLI tests and the public-text checks. The forge CI runs on this pull request. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dcharlot added 4 commits 2026-10-05 05:51:15 -04:00

wai: one base decode for sinks, a keyframe-0 base writer, and a JSON stage trace ... ed10bacbcf

- staged::decode_base: decode a base envelope for a sink through
  int_payload::decode_int, verifying its pin against the set held in
  memory; the tier counts the pin only where it resolved. The CLI and the
  browser binding both call it, so there is one base path.
- int_payload::encode_wiv1_zero_motion: the reference keyframe-0 WIV1
  encoder (zero motion, one block per frame, closed GOP) moves out of the
  corpus generator into the library. The corpus regenerates byte for byte
  through it.
- wai stage base: writes a wai.video.int_motion base from raw RGB8 frames,
  decoded back before it is written.
- wai stage apply: a StageSink replay. Envelopes are taken in order; a
  later base is decoded and releases the layers held for it. --json prints
  each step's reports in the corpus's form and the units each step changed,
  with their stage hashes, for a sink elsewhere to check against.

Tests: int_payload::tests::encode_wiv1_zero_motion_round_trips,
staged::tests::decode_base_reads_the_pin_and_the_corpus_units,
cli_stage::{base_refine_apply_json_trace, apply_holds_layers_for_a_later_base}.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-web: the staged-delivery sink in the browser, checked against the corpus ... d532d9dbe2

- src/stage.rs binds wai::staged::StageSink for JS. StageBase.decode decodes a
  base through staged::decode_base_via (its pin verified against the set held
  in memory; the manifest's capability or its fallback); StageBase.fromStage0
  takes a base decoded elsewhere. StageSink adds bases, offers layers,
  expires holds, removes, attests and forgets bases, and reads back every
  unit's stage, producer, frozen flag, tier, shape, output, stage hash and
  squared error. stageLayerInfo reads a layer's refines, WIR1 header,
  declared cost and byte split before it is offered. Reports and units are in
  the corpus's own form.
- staged::decode_base_via: a base decoded through its manifest's fallback is
  recorded as decoded through a fallback; any other capability is refused
  (not-offered).
- demo/verify_staged_wasm.mjs replays all of staged-conformance/ through the
  wasm32 build: every integer base decoded in wasm32 to its stage0.bin, and
  every report, final unit, stage hash and clip hash equal to the native
  sink's.
- wai-web-wasm.yml runs it, and watches staged-conformance/; the native unit
  test count is 12 (stage::tests adds three, one of which replays the corpus
  through the binding's pure half).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: wai_stage_bench, a native measurement of one staged set ... fa40aff3bc

Stage 0 is every base decoded, stage k every layer k applied, in the order
given. Per stage: the envelopes' bytes split into WAI1 framing, manifest and
payload, and cumulative; PSNR (8-bit) or SNR (16-bit) per unit and over the
clip from the exact integer SSE, with an exact match reported as exact; the
microseconds the stage took, median and quartiles over at least 20 runs; the
direct comparator, one identity layer per base at the stage's step straight
from stage 0; every unit's stage hash. Energy is reported as unmetered and
receipts as absent: the tool reads no meter, and a set on disk has none.

Test: cli_stage::stage_bench_reports_bytes_quality_and_hashes, which builds a
set with wai stage base and refine and checks the report against the files
and the source frames' SHA-256.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: CHANGELOG — staged delivery in the browser, a base writer, a trace and a bench ... 1ad89e0d71

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot referenced this pull request from a commit 2026-10-05 06:57:14 -04:00

wai: bound a base before it is decoded, and decode it by SPEC §4

dcharlot added 5 commits 2026-10-05 06:57:14 -04:00

wai: bound a base before it is decoded, and decode it by SPEC §4 ... 35c53adb9f

Review findings 1-10 of PR #152 (link 18).

- staged::decode_base / decode_base_via take a cost limit and a key log.
  The payload's declared cost is checked (int_payload::check_cost) before any
  symbol is decoded or output allocated; cost_over_limit, like
  unsupported_capability and set_incomplete, makes the capability unsupported
  and dispatch moves on to the fallback. The key log runs SPEC §3.1 check 5
  over a pin and over an unpinned set; None skips it (a sink with no key log).
- decode_base runs SPEC §4 through Wai::dispatch_verified: the capability,
  then the fallback, only where is_dispatchable accepts it, so a
  refinement-only or companion-only capability makes the envelope inert
  (missing_capability) and its fallback is never reached. decode_base_via asks
  for one of the two, and refuses any other string (not-offered).
- A capability whose set is one file, pinned with no form, offers every held
  file to the pin, the member it reads first: a README beside model.wam no
  longer breaks the decode.
- StageSink::add_base counts the base's state against the chain budget: a
  base past it is refused chain-over-limit, keeps no chain, and its layers
  stay held. staged-delivery §4.5 (and §4.2, §14) say so; the corpus gains
  base_over_budget, and staged_verify.py implements the rule independently.
- StageSink::set_trace / take_trace record every application, so a batch that
  takes a unit up several stages records each.
- wai stage apply routes by content: refines or a refinement-only capability
  is a layer; any other envelope is a base decoded by SPEC §4. not-wai1 and
  encrypted are a step's error under --json, and the replay goes on. --json
  lists every stage reached (from the trace), stage 0 for a base's step, and
  the units whose frozen flag changed.
- wai_stage_bench takes the source at the units' final shape; a stage whose
  unit has another shape has no quality figure, and the comparator says why
  it does not apply.
- encode_wiv1_zero_motion checks MAX_TENSOR, MAX_FRAMES and MAX_CLIP before
  allocating (too_large); wai stage base multiplies --dims checked.
- wai-web: StageBase.decode takes the page's cost limit; stageLayerInfo returns
  a base's declared decode cost; addBase consumes the StageBase. The
  viaFallback setter is gone and attested only rises. fromStage0 parses the
  envelope, takes only the manifest's capability or its fallback (deriving
  via_fallback), caps the claimed tier at base_tier(capability, None), and
  marks the base claimed: every report, units() entry and stage hash
  (unitSha256 and clipSha256 now return {sha256, claimed}) of its chain says
  claimed.

Tests: staged::tests::{decode_base_runs_spec_4, decode_base_applies_the_cost_limit,
decode_base_runs_check_5, decode_base_one_file_pin_ignores_other_files,
add_base_counts_its_state_against_the_budget}, the extended encoder test, the
new corpus case, and wai-web stage::tests::{a_claimed_base_cannot_raise_its_facts,
limit_reads_its_form}.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: tests for the bounded base, the CLI as the corpus's sink, the trace and the bench ... f90367e1aa

- wai-rs/tests/vectors/staged_bounds: the review's two bases that declare
  clips just under the 2^30 and 2^26 caps in 3,243 and 415 bytes, and two
  inert envelopes (a refinement-only and a companion-only capability with an
  int_motion fallback), which staged::tests::decode_base_runs_spec_4 builds
  and checks byte for byte.
- tests/staged_resources.rs: with a cost limit, decode_base refuses each
  bounded base (cost_over_limit) holding a few kilobytes at peak (counting
  allocator); a decoded base past the chain budget leaves nothing in the sink.
- wai-web demo/verify_staged_wasm.mjs: the same refusals in wasm32 with linear
  memory growth checked (wasmMemoryBytes); a base past the chain budget; the
  viaFallback setter gone and attested raise-only; the inert envelopes;
  fromStage0's capability, tier and claimed rules; addBase spends its base;
  claimed marks set aside to compare the PNG and FLAC cases; a seeded fuzz of
  every corpus envelope that must not trap.
- cli_stage::apply_json_replays_the_corpus (the review's cli_vs_corpus.py):
  every case the tool's sink can replay gives the case's reports and final
  units; step1_refusals, unreadable_envelopes and base_via_fallback now match.
- cli_stage::apply_holds_layers_for_a_later_base lists stages 0, 1 and 2 for
  each unit a base's arrival takes up in one step.
- cli_stage::stage_bench_takes_the_source_at_the_final_shape and
  stage_base_refuses_overflowing_dims.
- wai-web-wasm.yml: 14 native tests.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: the bounded-base check never prints a decoded clip when it fails ... dfca621c07

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: CHANGELOG and demo README for the review round ... 72c96bc880

The v0.4.0 subsection states the base rule of staged-delivery §4.5 (a base
past the chain budget is not added; its decode is bounded by the cost limit
first), SPEC §4 for a base with a cost limit and a key log, the claimed base
and the facts a page cannot raise, the routed and traced `wai stage apply`,
the encoder's caps, and the bench's source at the final shape.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: the sidecar rule excludes tests/vectors/staged_bounds, which holds nothing to decode ... e0d85900d9

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot added 1 commit 2026-10-05 07:32:23 -04:00

wai: round 3 of the link-18 review — claimed stage0 in the CLI, inert claims, order and limits ... 06f7de0a4d

- wai stage apply: with --stage0 the base is claimed; its step, its units,
  every report of its chain and its final entry say "claimed": true (as the
  browser binding marks a claimed chain). A base the tool cannot decode
  (encrypted, inert, refused by its pin or payload) is its step's error by
  code, and the replay goes on.
- staged::decode_base refuses in a stated order: not-wai1, encrypted (SPEC
  §6.4 before §4), not-offered, then §4; a parameter set's listing is made
  only for a capability that reads a set, so a stray file name is no refusal
  for wai.video.int_motion. The doc states each token's vocabulary, and that
  the cost limit binds a base whose capability declares a cost (int_synth
  and int_mlicpp decode under their formats' caps, as with_cost_limit does).
- wai-web: fromStage0 applies SPEC §4 as decode_base_via does (an inert
  envelope, a refinement-only or companion-only capability, is claimed
  neither through its capability nor its fallback; the capability must be
  dispatchable). StageBase.decode requires its limit argument: left out it
  is refused; null means the format's caps only.
- cli_stage::apply_json_replays_the_corpus also replays the four PNG and FLAC
  cases through --stage0 (claimed marks set aside, and required) and
  budget_partly_applied: 43 cases agree.

Tests: staged::tests::{decode_base_refuses_in_its_stated_order,
decode_base_limit_binds_declared_costs_only}, cli_stage::{apply_stage0_marks_the_base_claimed,
apply_records_a_refused_base_and_goes_on}, the inert cases in
stage::tests::a_claimed_base_cannot_raise_its_facts and in
demo/verify_staged_wasm.mjs, which also requires the limit argument.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot added 1 commit 2026-10-05 21:02:08 -04:00

wai: the staged sink's linearity test times the thread's CPU, not the wall clock ... 0fe755f954

On the shared macOS runner the wall clock counted other jobs' time: a linear offer
measured 64.5× and 183× for 16× the units, against a 64× bound, while its bytes,
allocations and peak stayed at 16×. The offer runs on the calling thread, so the
thread's CPU time is the offer's own work; under a load of 108 on 18 cores it
measures 16–17.6× for every shape.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot merged commit daa3e4c339 into main 2026-10-06 02:26:54 -04:00

dcharlot referenced this pull request from a commit 2026-10-06 02:26:55 -04:00

Merge pull request 'wai: staged delivery in the browser — one base decode, the wasm binding, and its check' (#152) from wai/land-18-staged-browser into main

dcharlot referenced this pull request from a commit 2026-10-06 02:33:53 -04:00

Merge main (link 18 merged as #152) into wai/w4-wai-pack

dcharlot referenced this pull request from a commit 2026-10-06 05:13:31 -04:00

Merge link 18 (wai/land-18-staged-browser, PR #152) into the W5 measurement branch

dcharlot referenced this pull request from a commit 2026-10-06 05:13:31 -04:00

Merge main (link 18 merged as #152) into wai/w5-staged-measurement

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Transaction-Science/open-standards!152

No description provided.