Transaction-Science/open-standards
Watch
1
0
Fork
You've already forked open-standards
 0
Code Issues Pull requests Projects Releases 15 Packages Wiki Activity Actions

wai-ops: wai.splat.int_codec decodes through the integer operator set, goldens unchanged (D2c, M2) #257

Closed
dcharlot wants to merge 0 commits from wai/d2c-m2-m3 into main
pull from: wai/d2c-m2-m3
merge into: Transaction-Science:main
Conversation 0 Commits - Files changed -
dcharlot commented 2026-10-14 11:04:03 -04:00
Owner
Copy link

D2c, second decoder: wai.splat.int_codec decodes through the integer operator set wai-ops/1 (integer-operators, Draft). Every committed golden is byte-identical. The splat synthesis g_s is lowered by whm1/1 (§13.2, with the RGB8 step of §13.0) and loaded with its certificate, and the interpreter runs it, with the fast transposed convolutions behind it held to it. The direct decode remains only as a test oracle.

First, before any switch

d4f08117. wai.audio.int_codec and wai.splat.int_codec join the cross-architecture byte-equality matrix, which compiled neither decoder. byte-exact-conformance includes both and gains int_codec_golden: the committed WIA1 and WIS1 payloads, pinned by SHA-256 and parsed with the sink's wire parser, decode under the reference and the fast kernels to the PCM SHA-256 4b0344c8… (FNV-1a e5ff66ad1b86117c) and the attribute SHA-256 f07679de…; their JSON forms decode alike. wai-byte-equality.yml fires on both sources and both vector directories.

The seven gates, each in its own commit

  1. Lowering and certificate (b5796000). wai-ops gains lower::whm1_net (whm1/1 of a parsed network). wai-rs gains int_ops::whm1_net, its parsed model (IntModel) in wai-ops' form. The committed set lowers to its committed g_s.whg1 from its bytes and from the parsed model. Loading it gives the certificate's verdict: acc64, not acc32, first failing at g_s's input range (44 bits), as Appendix C predicted. New test tests/int_splat_ops.rs.
  2. Golden equality (9acb8830). int_splat::ops::decode_typed decodes through the lowering; the direct decode becomes int_splat::legacy. The committed vector, as WIS1 and as its JSON form, gives the direct decode's bytes, the SHA-256 sidecar and the export's FNV-1a. byte-exact-conformance gains the golden through the lowering.
  3. Refusal parity (0b6d6aa1). Every committed splat fixture keeps its code both ways. Twenty more fixtures, one for each refusal the direct decode makes, in integer-payloads §7's order, are refused alike. At the edge of every check range, each layer of the set alone runs at ±X_ℓ and is refused at one past it, by the graph and by the direct guard alike. Also: the registry ops member (acc64, full, whm1/1, rans64 t4097/lenient/canonical), SPEC §5 and §7, and the CHANGELOG entry.
  4. Differential (ead026f3). The splat half of tests/int_ops_differential.rs.
    • A planned-break oracle from the set's bytes alone: the set is refused at load for a rule the direct decode does not make.
    • Random WHM1 sets and WIS1 clouds coded with the crate's rANS encoder (escapes, medians at the 2^47 bound, whole channels placed at the input's check range and one past it, cut or extended streams).
    • Outside a break both decodes agree or refuse with the same code, and the direct decode never panics. Under a break the new decode refuses. A planned-breaks test shows each one on a case the direct decode decodes, or refuses with another code.
    • 3000 cases per push in both fast-kernels steps; the nightly runs an hour per profile (--features legacy_int,splat_int).
  5. Fast kernels behind the interpreter (a044e93a). The committed set's two transposed convolutions run on the fast kernel under every fast policy, counted, and give the interpreter's bytes. Under the reference kernels and four fast policies the decode gives the same bytes or refusal, at the check range's edges too. Its inverse GDN runs on the interpreter: the host lends no IGDN kernel, and the splat decode does not need one.
  6. The switch (975e29d4, abfbbc6a, 1f3c4525, 2ffc8c8b).
    • 975e29d4, wai-ops: a run releases each tensor after its last reader, run_with takes its inputs by value, and conv_transpose holds its uncropped plane in i64 (each cell is a partial sum of one residue's taps, so it lies in the certified convT.acc, which fits i64 under acc64). No output or certificate changes. Without it, the splat decode through the operator set held 1.8 times the payload's declared working bytes.
    • int_splat::decode_typed decodes through the lowering; the direct path is cfg(any(test, feature = "legacy_int")). int_payload::declared_cost runs the same pre-stream plan, lowering included.
    • The planned breaks are written down (integer-payloads §2, §6, §7, §12; integer-operators §15.3 item 3 and its status note; SPEC §8; CHANGELOG): a bias of magnitude 2^63 − 1 or more, or a check range its producer cannot meet, is refused at load (model_mismatch, before any stream) where every decode was refused with field_range; a network with no layer of tag 0, 1 or 2, or with a header shift or gf of 128 or more that no layer uses, is refused where it decoded.
    • The scan: every committed splat set and payload (the vector, the eleven fixtures, the staged base) is unaffected.
  7. Deletion (45b2579a). The splat decode's guard was int_hyper_synth::run_net_checked; the production splat decode no longer reaches it. It cannot be deleted yet: the conditional codec's checked decode calls it in production (M4), and int_audio's guard calls igdn_check (M3). Its doc now says which decoders make its checks as check ranges and which still call it.

Merge of main: b9b594d0.

Falsifications (each shown red, then green after restore)

gate fault caught by
first commit the RGB8 and PCM half-up addends dropped both new byte-exact goldens
1 the conversion drops output padding the conversion-equals-parse check
2 rq rounding floor → half_up in whm1/1 the golden-equality test; the byte-exact golden through the lowering (the file-based one stays green); gate 1's graph bytes
2 igdn sums first, then shifts once splat survives, as Part 3.5 predicts; wai-ops' audio and world goldens fail (the audio golden carries this row, M3)
3 the check bound X_ℓ + 1 the edge test ("5632249656116 runs directly: accumulation could leave i64")
4 a convolution's padding lowered as pad.min(1) (no committed splat layer is a tag-1 convolution) the differential; gates 1–3 stay green
5 every channel requantised with channel 0's parameters the per-operator and per-decoder tests
6 rq floor → half_up, after the switch both byte-exact splat goldens, including the file-based one; int_kernels_vectors::int_splat_cloud; the corpus verify (splat ≠ sidecar)
6 the previous interpreter put back the cost test: with the set loaded, held 622,992 bytes against 344,656 declared (325,878 with this PR)
7 run_net_checked's value checks removed the tests against the direct decode and the shared guard's own tests fail; the production splat tests (int_splat.rs, every int_payload fixture, int_splat_cloud, byte-exact's splat goldens) stay green

Checks at the head (build host)

  • The landing gate on the merged head: GREEN.
  • At gate 6: the release fast-kernels step; wai-ops tests in debug and release; wai-verify vectors verify; wai_ops_check.py; wai-web's native tests; wai-web built for wasm32, whose WIA1 and WIS1 decodes under Node give the native sidecars' SHA-256; the int_synth wasm corpus check.
  • The differential ran 300 s per profile with no disagreement: 136,948 cases in debug and 7,738,770 in release.
  • A Kani compile check of the cheap harnesses passed (interp.rs changed). The harnesses that exercise k_conv_t (K7, K8) are kani_open, in no CI shard, and were not run.
  • Repository checks pass: comparative prose, vanity metrics, public names (private list), section references, lockfiles, orphan sources, tests-in-CI and workflow concurrency.

Decisions

  • The driver keeps integer-payloads §7's plan (splat_plan) ahead of the lowering, so every refusal the direct decode makes before the stream keeps its code and its order, and the lowering adds only the planned breaks.
  • The declared-cost test counts, for splat, the set parsed, lowered and loaded as the set (the same for every payload), and separately requires that, with the set loaded, the decode holds no more than the payload's declared working bytes.

Not in this PR

  • wai.audio.int_codec through its lowering (M3), next.
  • K7 and K8 over the i64 plane.
  • The per-decode cost of lowering and loading a set: about 3 ms for this one in a noisy measurement, more than the decode from a loaded set. Noted for O23 and M4.
  • wai-rs/include/wai.h is left as it is on main.

🤖 Generated with Claude Code

D2c, second decoder: `wai.splat.int_codec` decodes through the integer operator set `wai-ops/1` ([integer-operators](wai/extensions/integer-operators.md), Draft). Every committed golden is byte-identical. The splat synthesis `g_s` is lowered by `whm1/1` (§13.2, with the RGB8 step of §13.0) and loaded with its certificate, and the interpreter runs it, with the fast transposed convolutions behind it held to it. The direct decode remains only as a test oracle. ## First, before any switch `d4f08117`. `wai.audio.int_codec` and `wai.splat.int_codec` join the cross-architecture byte-equality matrix, which compiled neither decoder. `byte-exact-conformance` includes both and gains `int_codec_golden`: the committed `WIA1` and `WIS1` payloads, pinned by SHA-256 and parsed with the sink's wire parser, decode under the reference and the fast kernels to the PCM SHA-256 `4b0344c8…` (FNV-1a `e5ff66ad1b86117c`) and the attribute SHA-256 `f07679de…`; their JSON forms decode alike. `wai-byte-equality.yml` fires on both sources and both vector directories. ## The seven gates, each in its own commit 1. **Lowering and certificate** (`b5796000`). wai-ops gains `lower::whm1_net` (whm1/1 of a parsed network). wai-rs gains `int_ops::whm1_net`, its parsed model (`IntModel`) in wai-ops' form. The committed set lowers to its committed `g_s.whg1` from its bytes and from the parsed model. Loading it gives the certificate's verdict: `acc64`, not `acc32`, first failing at `g_s`'s input range (44 bits), as Appendix C predicted. New test `tests/int_splat_ops.rs`. 2. **Golden equality** (`9acb8830`). `int_splat::ops::decode_typed` decodes through the lowering; the direct decode becomes `int_splat::legacy`. The committed vector, as `WIS1` and as its JSON form, gives the direct decode's bytes, the SHA-256 sidecar and the export's FNV-1a. byte-exact-conformance gains the golden through the lowering. 3. **Refusal parity** (`0b6d6aa1`). Every committed splat fixture keeps its code both ways. Twenty more fixtures, one for each refusal the direct decode makes, in integer-payloads §7's order, are refused alike. At the edge of every `check` range, each layer of the set alone runs at `±X_ℓ` and is refused at one past it, by the graph and by the direct guard alike. Also: the registry `ops` member (`acc64`, `full`, `whm1/1`, `rans64` t4097/lenient/canonical), SPEC §5 and §7, and the CHANGELOG entry. 4. **Differential** (`ead026f3`). The splat half of `tests/int_ops_differential.rs`. - A planned-break oracle from the set's bytes alone: the set is refused at load for a rule the direct decode does not make. - Random `WHM1` sets and `WIS1` clouds coded with the crate's rANS encoder (escapes, medians at the 2^47 bound, whole channels placed at the input's check range and one past it, cut or extended streams). - Outside a break both decodes agree or refuse with the same code, and the direct decode never panics. Under a break the new decode refuses. A planned-breaks test shows each one on a case the direct decode decodes, or refuses with another code. - 3000 cases per push in both fast-kernels steps; the nightly runs an hour per profile (`--features legacy_int,splat_int`). 5. **Fast kernels behind the interpreter** (`a044e93a`). The committed set's two transposed convolutions run on the fast kernel under every fast policy, counted, and give the interpreter's bytes. Under the reference kernels and four fast policies the decode gives the same bytes or refusal, at the check range's edges too. Its inverse GDN runs on the interpreter: the host lends no IGDN kernel, and the splat decode does not need one. 6. **The switch** (`975e29d4`, `abfbbc6a`, `1f3c4525`, `2ffc8c8b`). - `975e29d4`, wai-ops: a run releases each tensor after its last reader, `run_with` takes its inputs by value, and `conv_transpose` holds its uncropped plane in `i64` (each cell is a partial sum of one residue's taps, so it lies in the certified `convT.acc`, which fits i64 under `acc64`). No output or certificate changes. Without it, the splat decode through the operator set held 1.8 times the payload's declared working bytes. - `int_splat::decode_typed` decodes through the lowering; the direct path is `cfg(any(test, feature = "legacy_int"))`. `int_payload::declared_cost` runs the same pre-stream plan, lowering included. - The planned breaks are written down (integer-payloads §2, §6, §7, §12; integer-operators §15.3 item 3 and its status note; SPEC §8; CHANGELOG): a bias of magnitude `2^63 − 1` or more, or a `check` range its producer cannot meet, is refused at load (`model_mismatch`, before any stream) where every decode was refused with `field_range`; a network with no layer of tag 0, 1 or 2, or with a header `shift` or `gf` of 128 or more that no layer uses, is refused where it decoded. - The scan: every committed splat set and payload (the vector, the eleven fixtures, the staged base) is unaffected. 7. **Deletion** (`45b2579a`). The splat decode's guard was `int_hyper_synth::run_net_checked`; the production splat decode no longer reaches it. It cannot be deleted yet: the conditional codec's checked decode calls it in production (M4), and int_audio's guard calls `igdn_check` (M3). Its doc now says which decoders make its checks as check ranges and which still call it. Merge of main: `b9b594d0`. ## Falsifications (each shown red, then green after restore) | gate | fault | caught by | |---|---|---| | first commit | the RGB8 and PCM half-up addends dropped | both new byte-exact goldens | | 1 | the conversion drops output padding | the conversion-equals-parse check | | 2 | `rq` rounding floor → half_up in whm1/1 | the golden-equality test; the byte-exact golden through the lowering (the file-based one stays green); gate 1's graph bytes | | 2 | `igdn` sums first, then shifts once | splat survives, as Part 3.5 predicts; wai-ops' audio and world goldens fail (the audio golden carries this row, M3) | | 3 | the check bound `X_ℓ + 1` | the edge test ("5632249656116 runs directly: accumulation could leave i64") | | 4 | a convolution's padding lowered as `pad.min(1)` (no committed splat layer is a tag-1 convolution) | the differential; gates 1–3 stay green | | 5 | every channel requantised with channel 0's parameters | the per-operator and per-decoder tests | | 6 | `rq` floor → half_up, after the switch | both byte-exact splat goldens, including the file-based one; `int_kernels_vectors::int_splat_cloud`; the corpus verify (splat ≠ sidecar) | | 6 | the previous interpreter put back | the cost test: with the set loaded, held 622,992 bytes against 344,656 declared (325,878 with this PR) | | 7 | `run_net_checked`'s value checks removed | the tests against the direct decode and the shared guard's own tests fail; the production splat tests (`int_splat.rs`, every `int_payload` fixture, `int_splat_cloud`, byte-exact's splat goldens) stay green | ## Checks at the head (build host) - The landing gate on the merged head: GREEN. - At gate 6: the release fast-kernels step; wai-ops tests in debug and release; `wai-verify vectors verify`; `wai_ops_check.py`; wai-web's native tests; wai-web built for wasm32, whose `WIA1` and `WIS1` decodes under Node give the native sidecars' SHA-256; the int_synth wasm corpus check. - The differential ran 300 s per profile with no disagreement: 136,948 cases in debug and 7,738,770 in release. - A Kani compile check of the cheap harnesses passed (`interp.rs` changed). The harnesses that exercise `k_conv_t` (K7, K8) are `kani_open`, in no CI shard, and were not run. - Repository checks pass: comparative prose, vanity metrics, public names (private list), section references, lockfiles, orphan sources, tests-in-CI and workflow concurrency. ## Decisions - The driver keeps integer-payloads §7's plan (`splat_plan`) ahead of the lowering, so every refusal the direct decode makes before the stream keeps its code and its order, and the lowering adds only the planned breaks. - The declared-cost test counts, for splat, the set parsed, lowered and loaded as the set (the same for every payload), and separately requires that, with the set loaded, the decode holds no more than the payload's declared working bytes. ## Not in this PR - `wai.audio.int_codec` through its lowering (M3), next. - K7 and K8 over the `i64` plane. - The per-decode cost of lowering and loading a set: about 3 ms for this one in a noisy measurement, more than the decode from a loaded set. Noted for O23 and M4. - `wai-rs/include/wai.h` is left as it is on main. 🤖 Generated with [Claude Code](https://claude.com/claude-code) 
The cross-architecture matrix did not compile int_audio.rs or int_splat.rs, so
neither capability's PCM or attribute bytes were checked anywhere but the dev
host. byte-exact-conformance now includes both, and int_codec_golden parses the
committed WIA1 and WIS1 payloads with the sink's wire parser and decodes them,
under the reference and the fast kernels, to the pinned digests: PCM SHA-256
4b0344c8... (FNV-1a e5ff66ad1b86117c), attributes SHA-256 f07679de...; the JSON
forms decode to the same bytes. The payloads are pinned by their SHA-256.

int_audio's own plan test reads its vector through ../wai-rs so the path holds in
both crates, and the crate re-exports its wire parser as int_wire, the name
int_audio's test uses. wai-byte-equality.yml fires on both sources and both
vector directories.

This lands before either decoder moves onto the integer operator set (D2c M2,
M3), so their goldens run on linux, linux-arm64 and macos before anything changes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
whm1/1 already lowers the splat set and its graph and certificate are committed
(ops-conformance/certificates/wai.splat.int_codec/033a37c9...). This gate holds
wai-rs to them.

- wai-ops: lower::whm1_net, whm1/1 of a network already parsed; whm1() is it
  over parse_whm1 of the bytes.
- wai-rs int_ops::whm1_net: the model this crate parses (IntModel) in the form
  wai-ops lowers it from. A layer's input channels, which IntModel does not
  keep, are its weights' count over its other dimensions; an inverse GDN's are
  its beta's count; a field past 32 bits is refused (model_mismatch).
- tests/int_splat_ops.rs (splat_int; named in both fast-kernels steps): the
  committed set lowers to its committed g_s.whg1 from its bytes and from the
  parsed model (which equals parse_whm1 of the bytes); the certificate is that
  graph's; the load gives acc64 and not acc32; the certificate's verdict and
  first acc32 failure (g_s input 0, range, 44 bits) are Appendix C's, and the
  input's check range is X_0 = 5632249656115.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
int_splat gains the decode through the integer operator set beside the direct one,
which still serves decode_typed (the switch is gate 6):

- int_splat::legacy::decode_typed: the direct decode, moved unchanged (the latent
  decode factored into latent(), shared by both).
- int_splat::ops::decode_typed: splat_plan (integer-payloads 7's planning, in its
  order), then g_s lowered by whm1/1 with the RGB8 step from the parsed model
  (int_ops::whm1_net) and loaded under acc64 with its certificate, then the stream,
  then the graph through the interpreter (int_ops::run1). A check-range refusal is
  field_range; the operator set's other codes map to the payload extension's.
  ops::plan is everything before the first symbol.
- tests/int_splat_ops.rs: the committed vector (int-payload-conformance's index),
  as WIS1 and as its JSON form, decodes through the lowering to the direct decode's
  bytes, the SHA-256 sidecar and the export's FNV-1a; the staged splat base carries
  the same payload.
- byte-exact-conformance: splat_through_its_lowering_is_golden, the same pinned
  attribute SHA-256 through the lowering, under both kernel paths, on every leg.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Refusal parity (tests/int_splat_ops.rs):
- every committed wai.splat.int_codec fixture of int-payload-conformance is refused
  by a sink with its code, and each that parses is refused alike, with that code, by
  the decode through the lowering and by the direct decode;
- a fixture for each refusal the direct decode makes, in integer-payloads 7's order,
  each one change from the committed set or cloud (afrac, the per-channel lengths, a
  median, a table, the three caps, a layer's lengths and padding, the attribute
  shape, a stream too short, run out, or with a word unread, latents past layer 0's
  range): both decodes refuse it with the same code, the one section 8 gives;
- at the edge of every check range: each layer of the committed set alone, lowered,
  takes tensor l's range [-X_l, X_l] from the full graph; an input at X_l runs to the
  same output both ways, and one at X_l + 1 is refused by the graph (field_range, input
  0) and by run_net_checked (out of range, that layer).

Registry: codecs::capability_ops gives wai.splat.int_codec {acc64, full, whm1/1,
stage rans64 t4097/lenient/canonical}; registry/capabilities.json regenerated by
`wai registry export`; the unit test names both capabilities. SPEC 5's row cites
integer-payloads 6 and integer-operators 13.2; SPEC 7 names the capability. The
CHANGELOG entry starts (the byte-equality matrix, the ops member).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
tests/int_ops_differential.rs gains the splat half (the file now needs
legacy_int and splat_int; Cargo.toml's required-features and the nightly
workflow's features say so):

- a planned-break oracle from the set's bytes alone: the set is refused at load
  by whm1/1 + acc64 for a rule the direct decode does not make (no layer of tag
  0, 1 or 2; a header shift or gf of 128 or more no layer uses; a bias of
  magnitude 2^63 - 1 or more, whose predicate fails at 0; a check range its
  producer cannot meet, load step 8). A set refused at load for a rule the plan
  also makes is not a break: both decodes run integer-payloads 7's plan first;
- a generator of WHM1 sets (transposed convolutions, convolutions, inverse
  GDNs, ReLUs, leaky ReLUs; weights, multipliers and biases up to i64's ends)
  and WIS1 clouds coded with the crate's rANS encoder (escapes, medians at and
  past 2^47, whole channels placed at the input's check range or one past it;
  streams cut, extended or changed); outside a break both decode alike or both
  refuse with the same code and the direct decode never panics; under a break
  the decode through the operator set refuses;
- int_splat_planned_breaks_are_new_refusals: each break on a case the direct
  decode decodes, or refuses with another code (field_range after the stream,
  or stream_exhausted where the stream runs out).

3000 cases in each fast-kernels step; an hour per profile nightly.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
- int_ops equivalence: the committed splat synthesis through whm1/1 runs both of its
  transposed convolutions on the fast kernel under every fast policy (counted), and
  every attribute byte is the interpreter's. Its inverse GDN runs on the interpreter
  under every policy: the host lends no IGDN kernel (that arm is M4's; the splat
  decode does not need it to be exact).
- tests/int_splat_ops.rs: under the reference kernels and four fast policies (serial
  and threaded) the decode through the lowering gives the same bytes, or the same
  refusal, on the committed vector as WIS1 and as its JSON form, and on clouds with
  a channel moved to the input's check range and one past it, at each end.
- byte-exact-conformance declares splat_int (on by default): it always includes
  int_splat, so the included sources' splat tests run on every leg too.

The per-operator half for conv and conv_transpose (random graphs, every rounding
and bias kind) is M1's int_ops::equivalence::convolutions_equal_the_interpreter.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
So that a capability decoding through the operator set holds, beside its set, no
more than its payload declares (integer-payloads 7, Memory and work), as the
direct decoders did:

- run_inner releases each tensor once the last operator that reads it has run
  (outputs are held to the end and taken, not cloned, unless listed twice);
- run_with takes its data inputs by value, so a decode holds no second copy of
  its input (its one caller, int_ops::run1, passes it); run and run_observed
  keep their signatures;
- conv_transpose's uncropped plane holds i64 rather than i128. Every cell, kept or
  cropped, is at every step a sum of some of one residue's taps, so it lies in
  convT.acc's certified interval, which fits i64 under acc64, the profile every
  loaded graph meets; a term or cell that would leave i64 still refuses
  (model_mismatch), as before for i128.

No output, refusal or certificate changes. Measured on the committed splat set
(int_payload_cost, next commit): with the set loaded, its decode through the
operator set holds what the payload declares, where the interpreter had held every
tensor and an i128 plane, about 1.6 times that.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
- int_splat::decode_typed is ops::decode_typed: integer-payloads 7's plan, g_s
  lowered by whm1/1 and loaded under acc64, the stream, then the graph through the
  interpreter with the fast convolutions behind it. The direct decode is
  legacy::decode_typed, test-only (cfg(any(test, feature = "legacy_int"))), and
  run_net_checked is no longer reached from the splat decode outside it.
- ops::decode_loaded: the decode after its plan, from the set's loaded lowering;
  ops::load is public (the set as the decode holds it).
- int_payload::declared_cost for WIS1 runs ops::plan, so a payload the decode
  refuses before its first symbol (the lowering's load included) is refused there
  with the same code.
- tests/int_payload_cost.rs: the set allowance for splat is the set parsed, lowered
  and loaded (payload-independent); and, with the set loaded beforehand, the decode
  holds no more than the declared working bytes.

Landing gate on this tree (with the previous commit): GREEN.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Completes the switch (abfbbc6a).

- tests/int_splat_ops.rs needs legacy_int now that the direct decode is test-only
  (required-features), and gains the scan: every committed splat set (the one that
  int-payload-conformance and the staged splat case name) has a layer of tag 0, 1 or
  2, header shifts under 128, no bias of magnitude 2^63 - 1 or more, and lowers and
  loads under acc64; every committed payload (the vector, the refusal fixtures, the
  staged base's) decodes or is refused through the lowering exactly as directly.
- integer-payloads: 2 names the decode its stream rules define (E1, t4097, lenient,
  canonical); 6 cites whm1/1 and the RGB8 step; 7's set rules add the lowering and
  load, its order puts them after g_s's shape and before the stream, and Exactness
  says a lowered network makes its checks as check ranges; 12 lists WIA1 and WIS1
  among the byte-equality goldens (so does int-payload-conformance's README).
- integer-operators: the status note names wai.splat.int_codec; 15.3 item 3 states
  the codes and order of its breaks and the two more the lowering makes.
- SPEC 8's planned breaks and the CHANGELOG entry (the decode, the breaks, the
  interpreter's memory) record them.

Measured (int_payload_cost): with the set loaded, the splat decode holds 325878 bytes
against 344656 declared; with the previous interpreter it held 622992 (1.8 times the
declared bytes, not the 1.6 the previous commit's message estimated).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Gate 7 deletes a decoder's direct guard once its check ranges carry it. For
wai.splat.int_codec that guard is int_hyper_synth::run_net_checked (with
check_layer and igdn_check), and since the switch the production splat decode no
longer reaches it: only the test-only direct decode (int_splat::legacy) calls it.
It cannot go yet: the conditional codec's checked decode (int_hyper, M4) calls it in
production, and int_audio's guard calls igdn_check (M3). Its doc now says which
decoders make these checks as check ranges and which still call it, so M4's gate 7
starts from that list.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Merge origin/main (at 86785571, with #243-#246, #250, #252) into wai/d2c-m2-m3
Some checks failed
WAI HTTP delivery / HTTP corpus · falsify patches 0/3 (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · falsify patches 1/3 (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · falsify patches 2/3 (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · every patch and mutation in exactly one shard (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · verified both ways, and the differential (pull_request) Has been cancelled
Details
WAI HTTP delivery / cache rules · controls and labelled caches (pull_request) Has been cancelled
Details
WAI JPEG-AI whole decode (pinned inputs, required) / fetch pinned JPEG-AI inputs → whole decode + pixel hash, required (pull_request) Has been cancelled
Details
WAI neural sink gates / model-free refusals of the neural sink (pull_request) Has been cancelled
Details
wai-ops integer operators / linux-aarch64 (pull_request) Has been cancelled
Details
wai-ops integer operators / linux-x86_64 (pull_request) Has been cancelled
Details
wai-ops integer operators / macos-arm64 (pull_request) Has been cancelled
Details
wai-ops integer operators / wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
wai-ops integer operators / wasm32 under Node (pull_request) Has been cancelled
Details
wai-ops integer operators / independent checker (Python) (pull_request) Has been cancelled
Details
wai-pack / wai-pack · linux (pull_request) Has been cancelled
Details
wai-pack / wai-pack · macos (pull_request) Has been cancelled
Details
wai-pack / wai-pack · independent verifier (Python) (pull_request) Has been cancelled
Details
wai-pack / wai-pack · the floor through a media prober (pull_request) Has been cancelled
Details
wai-pack / wai-pack · dependency licences (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / shader checks · browser build · wasip2 inertness · MSRV (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · software Vulkan (linux) (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · Metal (macos) (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · browser WebGPU (macos) (pull_request) Has been cancelled
Details
WAI mbt2018_mean integer decode (regenerated vectors) / regenerate mbt2018_mean integer vectors → Rust decode, required (pull_request) Has been cancelled
Details
wai-web reach builds / wai-web reach builds · the package of record, every output as recorded (pull_request) Has been cancelled
Details
wai-web reach builds / wai-web reach builds · this tree's wai-web, every rung on its engine line (pull_request) Has been cancelled
Details
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Has been cancelled
Details
wai-pack / wai-pack · linux-arm64 (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · discrete GPU, Vulkan (jetson-hub) (pull_request) Has been cancelled
Details
b9b594d0f5 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Merge main into wai/d2c-m2-m3
Some checks failed
wai formal verification (integer core) / kani (stage) (pull_request) Successful in 3m38s
Details
wai formal verification (integer core) / kani (isqrt512) (pull_request) Successful in 44m19s
Details
wai formal verification (integer core) / kani (stage-long) (pull_request) Successful in 21m29s
Details
WAI JPEG-AI whole decode (pinned inputs, required) / fetch pinned JPEG-AI inputs → whole decode + pixel hash, required (pull_request) Successful in 2m10s
Details
WAI neural sink gates / model-free refusals of the neural sink (pull_request) Successful in 1m17s
Details
wai-ops integer operators / linux-x86_64 (pull_request) Successful in 53s
Details
wai-ops integer operators / wasm32-wasip2 (wasmtime) (pull_request) Successful in 31s
Details
wai-ops integer operators / wasm32 under Node (pull_request) Successful in 21s
Details
wai-ops integer operators / independent checker (Python) (pull_request) Successful in 12s
Details
wai formal verification (integer core) / kani (integer-core) (pull_request) Successful in 6m33s
Details
wai-quantum WebGPU member / member · software Vulkan (linux) (pull_request) Successful in 2m8s
Details
wai-quantum WebGPU member / shader checks · browser build · wasip2 inertness · MSRV (pull_request) Successful in 3m5s
Details
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Successful in 3m13s
Details
WAI mbt2018_mean integer decode (regenerated vectors) / regenerate mbt2018_mean integer vectors → Rust decode, required (pull_request) Successful in 5m17s
Details
WAI HTTP delivery / HTTP corpus · falsify mutations 0/3 (pull_request) Successful in 39m50s
Details
WAI HTTP delivery / HTTP corpus · falsify mutations 1/3 (pull_request) Successful in 39m12s
Details
WAI HTTP delivery / HTTP corpus · falsify patches 0/3 (pull_request) Failing after 1m0s
Details
WAI HTTP delivery / HTTP corpus · falsify patches 1/3 (pull_request) Failing after 1m2s
Details
WAI HTTP delivery / HTTP corpus · falsify patches 2/3 (pull_request) Failing after 1m1s
Details
WAI HTTP delivery / HTTP corpus · every patch and mutation in exactly one shard (pull_request) Successful in 5s
Details
WAI HTTP delivery / HTTP corpus · verified both ways, and the differential (pull_request) Successful in 2m26s
Details
WAI HTTP delivery / cache rules · controls and labelled caches (pull_request) Successful in 1m7s
Details
wai-pack / wai-pack · linux (pull_request) Successful in 1m20s
Details
wai-pack / wai-pack · independent verifier (Python) (pull_request) Successful in 3m58s
Details
wai-pack / wai-pack · the floor through a media prober (pull_request) Successful in 21s
Details
wai-pack / wai-pack · dependency licences (pull_request) Successful in 1m17s
Details
wai-web reach builds / wai-web reach builds · the package of record, every output as recorded (pull_request) Successful in 2m38s
Details
wai-web reach builds / wai-web reach builds · this tree's wai-web, every rung on its engine line (pull_request) Successful in 5m1s
Details
WAI HTTP delivery / HTTP corpus · falsify mutations 2/3 (pull_request) Successful in 39m9s
Details
wai-quantum WebGPU member / member · DX12 and Vulkan (cbio-windows) (pull_request) Has been cancelled
Details
60b6e593ce 
# Conflicts:
#	wai/CHANGELOG.md
Merge main (with #258) into wai/d2c-m2-m3
Some checks failed
WAI HTTP delivery / cache rules · controls and labelled caches (pull_request) Has been cancelled
Details
wai formal verification (integer core) / every harness in one shard (pull_request) Has been cancelled
Details
wai formal verification (integer core) / kani (arith) (pull_request) Has been cancelled
Details
wai formal verification (integer core) / kani (isqrt512) (pull_request) Has been cancelled
Details
wai formal verification (integer core) / kani (plan) (pull_request) Has been cancelled
Details
wai formal verification (integer core) / kani (sound) (pull_request) Has been cancelled
Details
wai formal verification (integer core) / kani (stage) (pull_request) Has been cancelled
Details
wai formal verification (integer core) / kani (rans64-t2) (pull_request) Has been cancelled
Details
wai formal verification (integer core) / kani (stage-long) (pull_request) Has been cancelled
Details
wai formal verification (integer core) / kani (integer-core) (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
wai cross-architecture byte-equality / linux-aarch64 (pull_request) Has been cancelled
Details
wai cross-architecture byte-equality / linux-x86_64 (pull_request) Has been cancelled
Details
wai cross-architecture byte-equality / macos-arm64 (reference) (pull_request) Has been cancelled
Details
jouleclaw public surface must stay documented / Public-surface audit (jouleclaw-rs) (pull_request) Has been cancelled
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Has been cancelled
Details
3bd4d56637 
# Conflicts:
#	wai/CHANGELOG.md
dcharlot closed this pull request 2026-10-15 09:06:03 -04:00
Some checks failed
energy meters on real hardware / RAPL and NVML on jetson-hub (pull_request) Successful in 38s
Details
repository checks / lockfiles, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Successful in 1m53s
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Successful in 11s
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been skipped
Details
wai cross-architecture byte-equality / does this change touch it (pull_request) Successful in 14s
Details
WAI conformance / does this change touch it (pull_request) Successful in 12s
Details
WAI energy receipts / does this change touch it (pull_request) Successful in 8s
Details
wai formal verification (integer core) / does this change touch it (pull_request) Successful in 8s
Details
WAI JPEG-AI whole decode (pinned inputs, required) / does this change touch it (pull_request) Successful in 6s
Details
WAI neural sink gates / does this change touch it (pull_request) Successful in 6s
Details
wai-ops integer operators / does this change touch it (pull_request) Successful in 14s
Details
wai-quantum WebGPU member / does this change touch it (pull_request) Successful in 21s
Details
WAI mbt2018_mean integer decode (regenerated vectors) / does this change touch it (pull_request) Successful in 14s
Details
wai-web wasm32 / does this change touch it (pull_request) Successful in 15s
Details
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Has been cancelled
Details
wai-web reach builds / wai-web reach · does this change touch it (pull_request) Has been cancelled
Details
wai-web reach builds / wai-web reach builds · the package of record, every output as recorded (pull_request) Has been cancelled
Details
wai-web reach builds / wai-web reach builds · this tree's wai-web, every rung on its engine line (pull_request) Has been cancelled
Details
WAI mbt2018_mean integer decode (regenerated vectors) / regenerate mbt2018_mean integer vectors → Rust decode, required (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / shader checks · browser build · wasip2 inertness · MSRV (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · software Vulkan (linux) (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · Metal (macos) (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · discrete GPU, Vulkan (jetson-hub) (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · browser WebGPU (macos) (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · DX12 and Vulkan (cbio-windows) (pull_request) Has been cancelled
Details
wai-pack / wai-pack · does this change touch it (pull_request) Has been cancelled
Details
wai-pack / wai-pack · linux (pull_request) Has been cancelled
Details
wai-pack / wai-pack · linux-arm64 (pull_request) Has been cancelled
Details
wai-pack / wai-pack · macos (pull_request) Has been cancelled
Details
wai-pack / wai-pack · independent verifier (Python) (pull_request) Has been cancelled
Details
wai-pack / wai-pack · the floor through a media prober (pull_request) Has been cancelled
Details
wai-pack / wai-pack · dependency licences (pull_request) Has been cancelled
Details
wai-ops integer operators / linux-aarch64 (pull_request) Has been cancelled
Details
wai-ops integer operators / linux-x86_64 (pull_request) Has been cancelled
Details
wai-ops integer operators / macos-arm64 (pull_request) Has been cancelled
Details
wai-ops integer operators / wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
wai-ops integer operators / wasm32 under Node (pull_request) Has been cancelled
Details
wai-ops integer operators / independent checker (Python) (pull_request) Has been cancelled
Details
wai-ops differential (nightly) / differential · debug (pull_request) Has been cancelled
Details
wai-ops differential (nightly) / differential · release (pull_request) Has been cancelled
Details
WAI neural sink gates / model-free refusals of the neural sink (pull_request) Has been cancelled
Details
WAI JPEG-AI whole decode (pinned inputs, required) / fetch pinned JPEG-AI inputs → whole decode + pixel hash, required (pull_request) Has been cancelled
Details
WAI HTTP delivery / WAI HTTP · does this change touch it (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · falsify mutations 0/3 (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · falsify mutations 1/3 (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · falsify mutations 2/3 (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · falsify patches 0/3 (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · falsify patches 1/3 (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · falsify patches 2/3 (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · every patch and mutation in exactly one shard (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · verified both ways, and the differential (pull_request) Has been cancelled
Details
WAI HTTP delivery / cache rules · controls and labelled caches (pull_request) Has been cancelled
Details
wai formal verification (integer core) / every harness in one shard (pull_request) Has been cancelled
Details
wai formal verification (integer core) / kani (arith) (pull_request) Has been cancelled
Details
wai formal verification (integer core) / kani (isqrt512) (pull_request) Has been cancelled
Details
wai formal verification (integer core) / kani (plan) (pull_request) Has been cancelled
Details
wai formal verification (integer core) / kani (sound) (pull_request) Has been cancelled
Details
wai formal verification (integer core) / kani (stage) (pull_request) Has been cancelled
Details
wai formal verification (integer core) / kani (rans64-t2) (pull_request) Has been cancelled
Details
wai formal verification (integer core) / kani (stage-long) (pull_request) Has been cancelled
Details
wai formal verification (integer core) / kani (integer-core) (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
wai cross-architecture byte-equality / linux-aarch64 (pull_request) Has been cancelled
Details
wai cross-architecture byte-equality / linux-x86_64 (pull_request) Has been cancelled
Details
wai cross-architecture byte-equality / macos-arm64 (reference) (pull_request) Has been cancelled
Details
jouleclaw public surface must stay documented / Public-surface audit (jouleclaw-rs) (pull_request) Has been cancelled
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Has been cancelled
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
Transaction-Science/open-standards!257
No description provided.