Transaction-Science/open-standards
Watch
1
0
Fork
You've already forked open-standards
 0
Code Issues Pull requests Projects Releases 15 Packages Wiki Activity Actions

wai: HTTP delivery — a checked head, verified byte-range fetch of one rendition, and cache conformance #170

Merged
dcharlot merged 34 commits from wai/w3-http-delivery into main 2026-10-06 06:45:12 -04:00
Conversation 0 Commits 34 Files changed 180 +11860 -74
dcharlot commented 2026-10-06 05:13:47 -04:00
Owner
Copy link

HTTP delivery: WAI objects over HTTP, a head a client checks before it fetches more, verified byte-range fetch of one rendition, and the cache rules, with a public driver that checks a cache against them.

  • The extension (extensions/http-delivery.md) binds envelopes to HTTP without changing an envelope byte or a manifest member.
    • Names, type and labels:
      • a proposed media type, application/wai, not registered;
      • a codecs parameter that lists the union of capabilities a variant may dispatch to or apply, with its floor carried separately;
      • objects named by their content hash, immutable, with no content coding and no Vary.
    • The head proof (WHP1) proves an envelope's head against its content hash without the rest of the object. Its length is checked separately, because the tree's root does not bind it.
    • Byte-range fetch of one WAI2 component.
      • It picks exactly as whole-envelope selection does.
      • It falls back to the whole object when a pick has no digest, fails its digest, or the plan needs most of the object.
      • On a digest mismatch, every byte past the verified head is discarded before more is requested.
    • Refinements never hold up their base.
      • Only base bytes count toward the whole-object threshold.
      • Refinements go in requests of their own, and a refinement that fails or does not arrive is dropped and reported.
      • The base is available as soon as it verifies, and no later response changes it. A refinement's deadline runs from that moment, on the caller's clock.
    • Layer objects: a WAI1 whose capability is refinement-only is never dispatched. It is fetched whole, checked against its content hash, handed to staged delivery, and declared only in its own base's alternative.
    • Sidecars and adjacency:
      • receipt, key, grant, parameter-set and playlist sidecars;
      • cache rules;
      • HLS and DASH adjacency for on-demand and live.
  • The receipts extension (jwp-receipts §3) accepts the content hash a verified head proof establishes for an object fetched in part. New sections cover objects not delivered (§4.4) and an HTTP cache, which is not a relay (§4.5).
  • The registry's wire identifiers. Each name put on the wire outside a manifest is listed with its defining section, and a test finds it in that section's body.
  • The reference binding (feature http, no I/O in the library), plus wai http publish|codecs|origin|vectors|bench.
    • The test origin bounds its request head, each connection's lifetime and its connection count.
    • Its per-peer limit is opt-in, because it listens on loopback.
  • The corpus (http-conformance/):
    • wai_http_vectors verify and the independent http_verify.py agree on every case;
    • a seeded differential compares the two outside the corpus, refusals by code, family by family;
    • falsification patches and Python mutations must each be caught (wai-http.yml).
  • Cache conformance (cache-conformance/): a driver for the cache rules, run against the reference origin (which must pass) and four negative-control proxies (which must each be caught). Reports name a cache by label, version and configuration digest only.

Checked locally on macOS arm64:

  • the link gate;
  • http_verify.py and the differential at two seeds;
  • falsify/run.sh;
  • the cache-conformance controls;
  • every other corpus verifier;
  • the public-text and section-reference checks.

The forge CI runs on this pull request.

🤖 Generated with Claude Code

HTTP delivery: WAI objects over HTTP, a head a client checks before it fetches more, verified byte-range fetch of one rendition, and the cache rules, with a public driver that checks a cache against them. - **The extension** (`extensions/http-delivery.md`) binds envelopes to HTTP without changing an envelope byte or a manifest member. - **Names, type and labels:** - a proposed media type, `application/wai`, not registered; - a `codecs` parameter that lists the union of capabilities a variant may dispatch to or apply, with its floor carried separately; - objects named by their content hash, immutable, with no content coding and no `Vary`. - **The head proof** (`WHP1`) proves an envelope's head against its content hash without the rest of the object. Its length is checked separately, because the tree's root does not bind it. - **Byte-range fetch of one `WAI2` component.** - It picks exactly as whole-envelope selection does. - It falls back to the whole object when a pick has no digest, fails its digest, or the plan needs most of the object. - On a digest mismatch, every byte past the verified head is discarded before more is requested. - **Refinements never hold up their base.** - Only base bytes count toward the whole-object threshold. - Refinements go in requests of their own, and a refinement that fails or does not arrive is dropped and reported. - The base is available as soon as it verifies, and no later response changes it. A refinement's deadline runs from that moment, on the caller's clock. - **Layer objects:** a `WAI1` whose capability is refinement-only is never dispatched. It is fetched whole, checked against its content hash, handed to staged delivery, and declared only in its own base's alternative. - **Sidecars and adjacency:** - receipt, key, grant, parameter-set and playlist sidecars; - cache rules; - HLS and DASH adjacency for on-demand and live. - **The receipts extension** (jwp-receipts §3) accepts the content hash a verified head proof establishes for an object fetched in part. New sections cover objects not delivered (§4.4) and an HTTP cache, which is not a relay (§4.5). - **The registry's wire identifiers.** Each name put on the wire outside a manifest is listed with its defining section, and a test finds it in that section's body. - **The reference binding** (feature `http`, no I/O in the library), plus `wai http publish|codecs|origin|vectors|bench`. - The test origin bounds its request head, each connection's lifetime and its connection count. - Its per-peer limit is opt-in, because it listens on loopback. - **The corpus** (`http-conformance/`): - `wai_http_vectors verify` and the independent `http_verify.py` agree on every case; - a seeded differential compares the two outside the corpus, refusals by code, family by family; - falsification patches and Python mutations must each be caught (`wai-http.yml`). - **Cache conformance** (`cache-conformance/`): a driver for the cache rules, run against the reference origin (which must pass) and four negative-control proxies (which must each be caught). Reports name a cache by label, version and configuration digest only. **Checked locally on macOS arm64:** - the link gate; - `http_verify.py` and the differential at two seeds; - `falsify/run.sh`; - the cache-conformance controls; - every other corpus verifier; - the public-text and section-reference checks. The forge CI runs on this pull request. 🤖 Generated with [Claude Code](https://claude.com/claude-code) 
W3-1. The extension http-delivery.md binds envelopes to HTTP: the proposed media
type, the codecs union and floor, content-addressed objects, the WHP1 head proof,
verified component range fetch with one pick on every path, receipt, key, grant,
set and playlist sidecars, cache rules, priorities and deadlines, HLS/DASH
adjacency, and the capability probe.

Written against main rather than the design's tree: refinements are staged
delivery's (enhancement companions, refinement components, layer objects whose
layer is refines.layer), a `+cap` may be a companion or a refinement, and a
range-fetched refinement component meets staged-delivery §10 through its exploded
envelope (http-delivery §8.3, jwp-receipts §3 step 4). SPEC §7.1's component
id/sha256 text and digest step were already on main, so W3-1a lands nothing.

jwp-receipts: §1 transport pointer, §3 step 4 head-proof cid, new §4.4 and §4.5,
§7.9 locations. moq-streaming-format §6, SPEC §2, §7.1 and the
wai.video.manifest row. The registry gains WIRE_IDENTIFIERS (the request W3 made
to the registry stream, which had not landed), exported as wire_identifiers and
checked against the sections it names. The section-ref check already runs on
every extension (wai-section-refs.yml).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
W3-2, the library. container::select_entries is SPEC §7.1's walk over a WAI2
manifest's entries with the digest test passed in, so a client holding only the
head and WaiMulti::pick run one function (pick_where now delegates to it);
companion_indices and refinement_indices are companions_of_index and
refinements_of without payloads, which now delegate to them.

http_binding (feature `http`, on jwp_hash's BLAKE3): parse_head and §5.1;
covered_len; the WHP1 head proof built and verified with BLAKE3's tree, checking
the root before any covered byte is parsed; plan_head and plan_components (one
request per range and class, the rest of the object on a missing digest or past
the threshold); a sans-IO FetchSession with §7.1's response checks, component
digests, the whole-object fallback and refinement deadlines; the codecs grammar,
union, floor, check_declared and supports; an origin's headers and Range answers.
Integer constants are associated or crate-private so the C header generator does
not export them.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Appendix D's numbers (head 594, cid eecd2940…, covered 1009, six chaining values,
245 B proof) reproduced; the head proof against whole-input hashing for 2 KiB to
64 MiB objects and every tamper; left_len against BLAKE3's own rule; plans;
response checks; one pick on both paths over eight sinks and three orders;
producer-bad and transport-bad digests; deadlines; codecs grammar, union, floor,
declared and support; the origin's Range answers.

The design's covered_len example (1009 → 2033) is off by one under its own formula:
15 + 1009 is exactly one chunk, so 1009 → 1009 and 1010 → 2033. The root does not
encode the object's length, so a wrong envelope_len that keeps the tree's shape
passes the root: §6.3 now checks, after the root and before anything else is read,
that envelope_len is the length the verified head gives (head_proof_malformed).
§7.2 says what a client reports when the head alone shows nothing can be picked.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
The chunk-counter falsification survived: every subtree before c starts at
offset 0 unless the head spans three or more chunks. A WAI2 with a long target
member now puts covered subtrees past the first chunk.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
W3-2. `wai http publish|codecs|origin|vectors|bench` (feature `http`; without
it `wai http` says so): publish writes <cid>.wai, its head proof and ETag
sidecar; codecs prints a sequence's union and floor; origin serves a directory
with §5.3's headers, byte ranges, head proofs, receipt files, indexes and
preflights, with an optional delay on a byte range; bench fetches an object by
§7 over plain HTTP and writes a measurement record (energy recorded as not
measured). wai_http_vectors is the corpus tool, also reachable as `wai http
vectors`, so the corpus loop runs it like every other corpus.

http-conformance/: objects O1–O5, O7, O8, O9a–c (the design's O1–O9 without
receipts), Appendix D's envelope (OD) and a several-chunk head (OH), each with
its head proof and ETag sidecar; bad/O6.wai; case proofs; and cases over
parse_head, head_proof, plan, response, select, fetch, same_pick, codecs,
union_floor and supports. Sources are frozen under src/ with their SHA-256 in
SOURCES.json; the picture is the pinned int_mlicpp vector's output, so O2's
renditions are one picture. The generator holds every negative case to the
reason it exists for and Appendix D's cid, length and proof size to the text.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
The corpus's second implementation, written from the extension text and SPEC
§7.1, standard library only: head, covered_len, the head proof (and each
committed proof rebuilt from the text), response checks, plans, selection,
the byte-range procedure with its fallback, codecs union, floor and support.
It agrees with wai_http_vectors on every case. It checks itself first against
a subset of the published BLAKE3 test vectors, its tree functions included;
`--mutate` (left-half, no-root, counter-zero, floor-as-codecs, blake3-iv)
makes it fail the cases each defect reaches; `diff` verifies the proofs
`wai_http_vectors diff` writes and refuses exactly the ones it flips.

claim-conformance/_blake3.py, already shared by claim_verify and
staged_verify, gains subtree_cv and parent_cv; its hash is unchanged
(claim_verify and staged_verify pass).

OH now carries a payload past its covered head: verified whole, the
counter-zero mutation had nothing to reach.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Twelve patches, each breaking one function (the content hash's domain, the
root flag, the left-subtree rule, the chunk counter, the component digest
check, the Content-Range and content-coding checks, the union, the trailing-
byte rule, the missing-digest plan, the class merge, the selection digest
test), each naming the cases that must fail. run.sh applies each to a fresh
worktree, requires the build, and requires verify to fail naming them; then
the Python mutations and the differential.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
W3-7, public part. cache-conformance/: tests.json (C1–C13, R1–R5 as MUST
tests of §9 and the sidecar rules, S1–S2 informative), driver.py (stages the
corpus behind an origin and runs the tests against a cache; standard library
and _blake3.py only), mutators.py (flip, gzip, truncate, vary: one §9 defect
each), run.sh (the reference origin must pass every MUST test; each control
must be caught by the tests named for it; labelled caches run where an
environment provides /opt/wai-cache, and the summary says when none did) and
a README. Reports name a cache by label, package version and configuration
digest only. The private harness image is not in this repository.

The reference origin gains what the tests need of it: If-Range by strong
comparison, a live-edge prefix served with a shorter max-age, §8.4's
Cache-Control for the key log and grants, and a request counter
(--count-hits) for the informative tests.

.github/workflows/wai-http.yml: the falsify job (every patch caught, every
Python mutation caught, the differential) and the cache-conformance job
(reports uploaded as an artifact). wai-conformance.yml: `http` joins the
build, the library tests, the corpus loop (wai_http_vectors), the
feature-alone and wasm32 checks; http_verify.py joins the independent
verifiers. wai_http_vectors verify now names a case whose evaluation panics.

http-delivery.md writes byte spans in words where a half-open interval read
as link text to the section-reference check.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
tests/cli_http.rs runs wai http publish, codecs, origin and bench as a user
does (required-features http, a step of its own in wai-conformance.yml).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Neither decodes a payload: http-conformance checks transport and states each
fetched component by its SHA-256; cache-conformance has no objects of its own.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Both say what the reference implementation does: codecs refuses after + only a
capability registered as standalone media, and a WAI1 is dispatched from its
verified manifest before its payload is fetched.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
# Conflicts:
#	wai/CHANGELOG.md
Fix round, items 1-5, 7, 9-11 (library):

- codecs: the `wai` prefix is compared as bytes (a non-ASCII element panicked
  on a str slice); an element beginning `wai` in any ASCII case must be a
  well-formed wai1./wai2. element; an empty element, a cap twice among alts or
  twice in one alt is codecs_malformed; a WAI1 lists only the capability and
  fallback SPEC §4 dispatches (a record with a payload fallback is describable),
  and a WAI2 only selectable entries.
- Layers (§10.4): Head::is_layer (a WAI1 carrying refines or naming a
  refinement-only capability). The session skips SPEC §4 for one, fetches it
  whole at refinement class, verifies it against the cid and delivers it as
  Role::Layer with its envelope; FetchSession::new_layer does the same for an
  object a playlist lists as a layer (not_a_layer otherwise). union_of and
  floor_of take SeqObject (cid, head, exploded component cids) and attach a
  layer's capability after + in its base's alt through refines.base
  (codecs_layer_unbound when the base is not in the sequence); check_declared
  accepts a layer as a + capability of an alt.
- The threshold counts base-class bytes only; refinements are always their own
  requests; a refinement with no digest or a failed digest is dropped alone
  (Fetched::dropped); a refused refinement-class response is discarded and the
  refinement abandoned; only a base-class refusal ends the session.
- After a base component's digest mismatch every byte held past covered_len is
  dropped and bytes=covered_len- requested (stale bytes were reused).
- Content-Range numbers are ASCII digits only; ByteRange and the head proof use
  checked arithmetic, and WHP1 refuses an envelope_len past u64::MAX - 15.
- A base request never answered is base_unanswered.
- playlist::parse_layer_tag reads the #WAI-LAYER line.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
untrusted_input_never_panics (seeded: codecs, Content-Range, #WAI-LAYER,
fragments, head proofs with extreme lengths, heads and manifests with changed
bytes, non-ASCII throughout), untrusted_proof_lengths_refused,
content_range_digits_only, unanswered_base, threshold_stall,
refinement_digest_problems_are_its_own, refused_refinement_responses (every
row), stale_bytes_are_not_reused (stale, stale-small),
layers_are_fetched_for_staged_delivery, layers_in_the_union,
record_capability_with_payload_fallback, codecs_duplicates_and_empty_elements,
layer_tag. The deadline test no longer pads the object with another rendition.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
The corpus gains O10 with its two layers (the committed staged-delivery FLAC
ladder: the design's O10, as layer objects), OS/ON/OW (an enhancement nearly
four times its base, with a right, absent and wrong digest), OT (held whole by
the first request), OF (a record with a payload fallback), OE1/OE2s/OE2t
(SPEC §6.4 on both containers), OR (a malformed refines) and two bad
manifests (a string kid, a numeric kind), with cases for: non-ASCII codecs,
the wai prefix in any case, duplicates and empty elements, ASCII-only
Content-Range numbers, encryption, refines, member types, layers (union,
floor, unbound, discovered, listed, abandoned, refused, not a layer,
declared), the base-only threshold and dropped refinements, every refused
refinement response, stale first responses, a u64-sized proof, the record
fallback, an unanswered base and the #WAI-LAYER line. The corpus tool takes
inline envelopes, these tampers and listed layers.

http_verify.py now runs the client step by step as wai-rs does (a Session
answered request by request, so requests and bytes count alike), reads
manifests with staged_verify's strict reader and member types, reads refines
and explodes components with it, applies SPEC §6.4 on WAI1 and treats a WAI2
security that is not a security object as encrypted, takes Content-Range
numbers as ASCII digits only, and implements the layer, threshold, refusal,
stale-byte, duplicate and record rules. It agrees on all 288 cases, and gains
`cases FILE` to check any case file.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai_http_vectors fuzz writes seeded cases, in the corpus's format, for
Content-Range values (signs, separators, spaces, other scripts' digits),
codecs values (the wai prefix in any case, duplicates, empty elements,
non-ASCII), #WAI-LAYER lines, WAI1 and WAI2 manifests (member types,
security in every shape, refines well and badly formed, duplicate members),
selection, fetches (listed as layers too), unions, and base-and-layer
sequences with the declared check; http_verify.py cases checks each. Three
seeds of about 3,150 cases each agree.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
A lenient number reader (Python's int()) passed the first version: numbers
drawn apart from the request almost never formed a case it would wrongly
accept. Half of the family is now the request's own range with at most one
number given a sign, a separator, a space or another script's digits; the
lenient reader then disagrees on over a hundred cases.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Item 8. The origin reads a request head through Read::take, at most 16 KiB
(431 past it, then a bounded lingering read so the answer is not lost to a
reset); sets a read and write timeout (--read-timeout-ms, 10 s); serves at most
--max-connections at once (64; 503 for one more); percent-decodes /__hits as
bytes (an escape before a non-ASCII character panicked on a str slice); and
answers 400 to a path segment that is empty, . or .., or holds \, :, NUL or a
control byte. Item 13: cli_http stops each origin from a Drop guard. New tests:
a 400 MiB header, /__hits?path=%aé and invalid UTF-8, backslash, drive and
NUL paths, and the connection cap with the idle timeout.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Item 12. The test found a name anywhere in its document, so moving X-WAI-FLOOR
to §3 or wai_receipts to §1 passed. It now reads the section's body, from its
heading to the next heading of its level or above.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
§3.1: the real cost of a wrong n (below 1009, the whole object). §4.1: an
element beginning wai in any ASCII case must be well formed; empty elements
and a capability named twice are malformed. §4.2: a WAI1 lists what SPEC §4
dispatches (a record beside a payload fallback is described by the fallback);
a layer joins its base's alt through refines.base (codecs_layer_unbound when
the base is absent); the floor is over objects that are not layers; a layer is
declared after +. §7 steps 5 and 6 and the 90 % rule count base-class bytes
only and drop a refinement alone; a mismatch discards every byte past
covered_len; a layer is never dispatched. §7.1: Content-Range numbers are
1*DIGIT; a refused refinement response abandons only it. §10.1:
base_unanswered. §10.3, §10.4: dropped refinements, layers fetched whole at
refinement class, not_a_layer, the #WAI-LAYER attribute list. §13 lists the
new codes; §14 states the differential. Appendix D states its #h=1009
assumption and gives the plans without it (2 requests and 16,614 bytes; a
54,039-byte range fetch), which the generator now holds the corpus to.
The corpus README and the CHANGELOG describe the fix round.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-conformance.yml: wai_http_vectors fuzz at two fixed seeds, checked by
http_verify.py cases, beside the corpus check; a note that the library tests
run with overflow checks on. wai-http.yml: the verdict is run.sh's step; a
following step prints every report's path and SHA-256 and the summary; the
upload is its own step with continue-on-error, since no workflow here has used
an artifact action yet. Its paths now include what http_verify.py reads.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
New: threshold-all, refusal-ends, reuse-stale, plus-sign, dispatch-layer,
union-no-layer, wai-prefix-case, dup-caps, record-alt, base-unanswered, each
naming the corpus cases it must fail. accept-gzip, trust-content-range,
skip-on-absent and intersection are the same defects written against the
current code.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
N1. The origin gives the whole request head one deadline, fixed at accept
(--read-timeout-ms, 10 s by default; 408 when it passes): it reads through
Read::take in chunks, each read waiting only until that deadline, so a peer
trickling a byte at a time no longer holds a connection past it. It serves at
most --max-per-peer connections from one address (8 by default; 503 for one
more) besides --max-connections in all.

N2. Head::is_layer means exactly a WAI1 whose capability is refinement-only
(staged-delivery §3); a payload capability carrying refines is an ordinary
object, dispatched by SPEC §4, and not_a_layer when listed as a layer.

N3. FetchSession::base_ready gives the base as soon as its parts verify,
before any refinement resolves; done() adds the refinements as they arrive or
are abandoned. FetchSession::tick takes the caller's clock, and the policy's
refinement_deadline_ms now runs from the moment the base verified, abandoning
every outstanding refinement request when it passes. wai http bench sends
base-class requests first, times ms_to_verified from base_ready, adds
ms_to_complete, takes --refinement-deadline-ms and gives a refinement's
request only what is left of it.

N4. On the whole path a refinement-class entry with no sha256 is dropped as
component_digest_absent, as on the range path.

Minor. check_declared takes the layer's base (Selector::layer_base) and
accepts a layer only after + in its own base's alt, as union_of builds it.

Tests: refines_on_a_payload_capability_is_not_a_layer,
base_ready_before_refinements (the base-waits probe),
refinement_without_digest_dropped_on_every_path, the declared-layer cases,
origin_survives_trickling_heads, origin_per_peer_limit,
bench_times_the_base_apart_from_its_refinement (O8 with the enhancement held
back by --delay-range).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
- Corpus: OPf, OPe, OPw (wai.text.zstd with refines false, {}, well formed) are
  dispatched, described by their capability and not_a_layer when listed as layers;
  ORN's refinement with no sha256 is dropped (component_digest_absent) at 900 and
  1001 permille alike. The O10L1 declared cases name their base; the layer in
  another alt, and with no base held, is codecs_undeclared. The generator holds
  each of these outcomes.
- http_verify.py: a layer is a WAI1 whose capability is refinement-only; the
  whole path drops a refinement stating no digest; check_declared takes the base
  the sink holds and accepts a layer only after + in that base's alt; the declared
  union and the base are read before anything is fetched.
- wai_http_vectors fuzz: a refusal is an outcome compared by its code (the sink's
  declared union, its base, the producer's proof and a WAI2 that does not parse now
  refuse with codes); a case with no outcome stops the run; per family it prints
  the cases generated and refused. New families: WAI1 refines over payload and
  refinement-only capabilities, layers declared against their own base / another
  alt / no base / another base, layers over WAI2 components, refinements with a
  right, wrong and absent digest, and WAI2 objects past the first request through
  an origin tampered one way.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
§2 and §10.4: a layer object is a WAI1 whose capability is refinement-only; a
payload carrying refines is an ordinary object, dispatched under SPEC §4 with
refines unread, and not_a_layer when a playlist lists it as a layer. §4.2: such a
WAI1 is described by its capability; a layer is declared only after + in the alt
of its own base's capability. §10.1: a verified base is presented without waiting
for its refinements. §10.2: a refinement's deadline runs from the moment the base
verified, on the client's clock. CHANGELOG: the origin's whole-head deadline from
accept (10 s), its 64-connection and 8-per-peer limits, and round 3's items.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- R3-1: of a refinement-class response only the range requested is kept, whatever a
  200 carries; a component that verified is frozen and never read again, so nothing
  after base_ready() changes the base's outcome or bytes.
- R3-2: on_response(id, meta, body, now_ms); the base is stamped with the time of the
  response that verified it, so ticks before it never move the deadline's start; the
  deadline arithmetic saturates. drive is clockless and passes the last known time;
  the bench passes its elapsed time.
- R3-3: --max-per-peer is off unless given (a loopback listener gives every client one
  address); --max-connection-ms (60 s) bounds a connection's whole life, writes
  included, so a slow reader of a large response is cut off then.
- Tests: a_refinement_200_never_touches_its_base, the_deadline_runs_from_the_verifying_
  response, origin_serves_past_reconnecting_tricklers, origin_cuts_a_slow_reader_at_the_
  lifetime.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
- wai_http_vectors: op fetch_timed (a script of base / base_once / refinement / tick
  steps, each at a time on the caller's clock) and ten timed_OS_* cases, held at
  generation to their outcomes: the base ready at the first step; deadlines that pass
  exactly at verification plus the deadline whether the clock was never told, told 0,
  stepped back before or after, or near the end of u64; a refinement 200 carrying the
  whole object with a base or enhancement byte changed, after the base is ready and
  before.
- http_verify.py: the session keeps the caller's clock (on_response carries it), the
  base and its time, frozen verified parts and a tick; a refinement's response keeps
  only its range; fetch_timed. Mutations base-at-done, tick-noop and
  refinement-unclipped each fail the timed cases; falsify/run.sh runs them.
- Falsify patches: base-ready-at-done, tick-noop, refinement-200-whole,
  response-no-clock, deadline-wraps; reuse-stale regenerated for the moved context.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>

# Conflicts:
#	.github/workflows/wai-conformance.yml
#	wai/CHANGELOG.md
#	wai/wai-rs/Cargo.toml
A newer push supersedes its run instead of queueing another, as main's workflow
guard requires of every workflow.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Merge main (staged measurement merged as #169) into wai/w3-http-delivery
All checks were successful
standards workspaces build + test / macOS energy backends (pull_request) Successful in 6m52s
Details
standards workspaces build + test / jcp-rs (pull_request) Successful in 1m27s
Details
standards workspaces build + test / joule-ui-rs (pull_request) Successful in 1m12s
Details
standards workspaces build + test / joulehook-rs (pull_request) Successful in 1m11s
Details
standards workspaces build + test / proof-rs (pull_request) Successful in 1m12s
Details
standards workspaces build + test / sandbox-rs (pull_request) Successful in 2m13s
Details
standards workspaces build + test / sense-rs (pull_request) Successful in 1m5s
Details
WAI conformance / cargo-class corpora · macos (pull_request) Successful in 10m46s
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Successful in 36s
Details
standards workspaces build + test / smart-byte-rs (pull_request) Successful in 3m38s
Details
WAI energy receipts / energy receipts · macos (pull_request) Successful in 3m19s
Details
wai-pack / wai-pack · macos (pull_request) Successful in 1m28s
Details
WAI conformance / cargo-class corpora · linux (pull_request) Successful in 5m28s
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Successful in 13s
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Successful in 3m43s
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Successful in 8s
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Successful in 23s
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Successful in 45s
Details
WAI energy receipts / energy receipts · linux (pull_request) Successful in 1m32s
Details
WAI HTTP delivery / HTTP corpus · falsification and differential (pull_request) Successful in 12m59s
Details
WAI HTTP delivery / cache rules · controls and labelled caches (pull_request) Successful in 59s
Details
WAI JPEG-AI whole decode (pinned inputs, required) / fetch pinned JPEG-AI inputs → whole decode + pixel hash, required (pull_request) Successful in 59s
Details
WAI neural sink gates / model-free refusals of the neural sink (pull_request) Successful in 1m3s
Details
wai-pack / wai-pack · linux (pull_request) Successful in 40s
Details
wai-pack / wai-pack · independent verifier (Python) (pull_request) Successful in 55s
Details
wai-pack / wai-pack · dependency licences (pull_request) Successful in 1m6s
Details
WAI section references / cited sections exist (pull_request) Successful in 10s
Details
WAI mbt2018_mean integer decode (regenerated vectors) / regenerate mbt2018_mean integer vectors → Rust decode, required (pull_request) Successful in 3m58s
Details
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Successful in 1m58s
Details
workflow hygiene / every workflow supersedes its own queue (pull_request) Successful in 4s
Details
48456bbdbc 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
Transaction-Science/open-standards!170
No description provided.