D2c M6: wai.world.model's integer renderer renders through wai-ops/1 (world/1), goldens unchanged; run_net and the convolution dispatch leave production #274

Merged

dcharlot merged 14 commits from wai/d2c-m6 into main 2026-10-16 09:41:26 -04:00

Conversation 0 Commits 14 Files changed 30 +2116 -714

dcharlot commented 2026-10-16 03:39:13 -04:00

Owner

Copy link

D2c M6: wai.world.model's integer renderer (int_world, in wai-rs and in wai-web) renders through the integer operator set wai-ops/1, lowered by world/1. Every golden is unchanged. The renderer stays informative (O11).

What changes

• The renderer. int_world::{decode, decode_deltas, decode_planes} now render through world/1 (integer-operators §13.5), and so does the browser's WorldModel.

  • T and g_s are lowered and loaded under acc64 once, with their certificates (int_world::load gives an int_world::World).
  • Before the first frame: every row must carry A values; z_0 must be [C, lat, lat]; both graphs are planned on that shape, and T must give the shape back.
  • Then the clip runs frame by frame.
  • Each function now returns a Result, and WorldModel's methods throw on a refusal.
  • The per-row step, step_delta and step_planes of a parsed model are replaced by World::{step, step_delta, step_action, render}. The browser holds a World for its session.

• A comes from T. A is T's input channels less C: 3 for the one-agent vector, 4 for the two-agent vector. A row of any other length is refused. Both networks' afrac are checked: each must lie in 1..=30, and the two must be equal.

• wai-ops gains lower::world_net and lower::world_net_loaded: world/1 of the networks already parsed, loading T before it lowers g_s. They write and refuse exactly what lower::world does from the bytes, so no committed graph or certificate changes.

• The direct renderer is int_world::legacy, test-only (legacy_int). The direct renderer never checked any value. int_world::legacy::checked is that renderer with the guard every other integer decoder ran (run_net_checked), and it is the reference for refusal parity.

• Gate 7. With the renderer switched, nothing in production calls the following (wai-web included):

  • int_hyper_synth::run_net, decode and to_rgb8;
  • the fast/reference convolution dispatch run_net used.

  They move into the test-only int_hyper_synth::legacy, on the scalar kernels, with no dispatch, and int_hyper_synth::kernel_equivalence goes with the dispatch it tested. The callers that were not production now go through the lowering:

  • the decode bench;
  • tests/int_kernels_geometry.rs;
  • the pretrained-set test tests/int_hyper_synth.rs.

• No ops member for wai.world.model. The capability's registered payload is its signed action trace, and no payload text yet binds a trace to a renderer's set. The registry test asserts that it has no ops member. SPEC §5's row cites §13.5.

• Text:

  • integer-operators: the status note; §13.5, which now says what the renderer checks before the first frame and that its codes are informative; §15.3 items 2 and 3.
  • SPEC §5 and §8.
  • CHANGELOG.

Planned breaks (integer-operators §15.3 item 2, SPEC §8)

The direct renderer checked nothing: it computed past its exact range, rendered frames from inputs that do not fit, or panicked. The renderer through world/1 refuses each of these before the first frame:

• a set whose afrac is outside 1..=30 or unequal, a set with no action plane, or a set that breaks a WHM1 network's rules (model_mismatch);
• a row without one value per action plane, and T or g_s that does not fit the latent (model_mismatch);
• a latent that is not C·lat·lat values (geometry_mismatch), a latent side of 0, a latent past 2^26 values, and a move whose plane value leaves i64.

A value outside a check range is refused (field_range). No committed set or clip is affected (the_new_rules_affect_no_committed_set). Each break is shown on a hand-made fixture, with what the direct renderer did there (the_renderers_own_checks_refuse_before_any_frame, int_world_planned_breaks_are_new_refusals).

Gates, each red once and restored

gate	commits	falsification	red
1 lowering and certificates	3d950d98	the plane fills read the scalars in reverse	int_world_ops: "the lowering of the bytes differs from the committed T.whg1"; wai-ops world_sets_reproduce_every_frame (frame 0 unchanged, frames 1–8 differ); vectors verify, all three T graphs
2 golden equality	aeccbd41	leaky truncates toward zero (Part 3.5)	"world: frames [1, 2, 3, 4, 5, 6, 7, 8] through the lowering differ from the direct renderer's"; frame 0 untouched; the direct goldens green
2		world/1 builds three planes for a two-agent T (Part 3.5)	the two-agent golden: "world2: ModelMismatch", after the one-agent vector passed; wai-ops' world goldens
3 refusal parity	85becdd4, 407cadd9, 6cc62060	X_ℓ + 1 as the check bound (Part 3.5)	"world T layer 0: 18542385699146 runs directly: accumulation could leave i64"; "z_0[330] = 11733853450241: left (g_s, 0, 1), right (g_s, 0, 0)"; gate 1's bytes; the synthetic set no longer loads
4 differential	ad83e237, f1f21d92	the frame's HWC layout taken as three channels (a fault only random sets reach)	gates 1–3 green; the differential red, seed 5305056718032203265
5 fast kernels	5ceceeb5	channel-0 requantisation on the fast path	--lib int_ops::equivalence 8 of 11 (the world renderer's among them); int_world_ops 4 of 7
6 the switch	dcb1505c, f57e07e2	rq floor → half_up in whm1/1	now the file-based goldens: int_world, int_world2, int_kernels_vectors::int_world_clips, int_world_shared ("shared world clip hash"), and all four wasm32 clips, frames [0..8]
6 memory		the clip keeps a copy of every latent	int_world_memory: "held 677856; the direct renderer held 578520"
7 delete	24539d2b, 5ed8213f, e9a62368	the test-only run_net's leaky ReLU truncates	production green (int_world, int_world2, int_kernels_vectors, int_world_shared, wasm32); the comparisons red: int_world_ops 3 of 7, the memory test's frame check, the differential ("the latents after transition 1 differ")

Gate 7's falsification found a gap, which is now closed. At first the random differential stayed green under that fault. Random transitions saturated T's clamp, so a ±1 in T vanished from both the latents and the frames. Two changes fix it:

• the differential now compares the latents after every transition;
• three cases in four, the generator's T layers have near-unit-gain multipliers and leaky slopes below 1.

With both changes, the differential goes red under the same fault.

Differential (tests/int_ops_differential.rs, the world half)

There was no disagreement in any run. Outside the planned breaks, the renderer through the operator set and the direct renderer with its guard either render the same frames, through the same latents after every transition, or refuse a value in the same network, at the same step and the same layer. Under a planned break, the renderer through the operator set refuses.

run	cases	rendered alike
per push, debug and release	3,000	711
timed 300 s, seed 20261016, debug	54,462	13,150
timed 300 s, seed 20261016, release	3,081,649	752,038

• Per push, the refusals both renderers made were in T's layers 0, 1 and 2 (114, 39 and 28) and in g_s's layers 0, 1 and 2 (203, 104 and 21).

• The planned breaks were:

  • a row without A values, 459;
  • no layer of tag 0, 1 or 2, 434;
  • T or g_s not fitting the latent, 394;
  • the afrac rule, 186;
  • a bias at an end of i64, 136;
  • A < 1, 73;
  • layers that do not chain, 61;
  • an unused shift or gf of 128 or more, 34;
  • an unmeetable range, 3.

• The runs before the generator change (gate 4's commit) were green too: 687 of 3,000 alike per push; 47,691 and 2,471,671 cases in the timed runs.

• Coverage. Both networks' check ranges are reached at every layer. All nine break kinds are reached, each also on a hand-made fixture.

• The bounds-pass oracle test now also covers the world graphs. Per push: 3,000 cases, 24,616 graphs (21 refused, 2,580 acc32, 22,006 acc64 only, 9 neither), with no disagreement.

Memory (tests/int_world_memory.rs, reference kernels)

The renderer declares no cost, because it has no payload. So it is held to the direct renderer it replaced. The one-agent and two-agent vectors give the same figures:

	through the operator set	direct
a clip of 9 frames, set loaded	566,880	578,520
one step	39,193 / 39,786	39,936 / 40,960
one frame	468,360	480,000

• Loading the set held 505,310 and 507,290 bytes.
• A call that loads the set and then renders held 826,538 and 828,518 bytes.
• The first measurement exceeded the direct renderer by 648 bytes (579,168 against 578,520). The excess is the interpreter's per-run bookkeeping, at the last frame, while the clip still held a latent that no transition reads after it. The last frame now takes that latent.

Wasm32

• demo/verify_int_world_wasm.mjs is new, and wai-web-wasm.yml runs it.
• WorldModel, built for wasm32, renders both vectors frame by frame to their sidecars' SHA-256s: one agent by step, stepDelta and stepPlanes, two agents by stepPlanes.
• It ran green before the switch and after it, and red under gate 6's fault.

Checks

• gate.sh on the merged head c75fa9af: GREEN, twice: build, lib-tests, carriage, corpus loop 21/21, fast-kernels, byte-exact, wai-web wasm32 and neural gates. The second run used rb --pull, and there was nothing to pull.
• Also on the merged head: check-lockfiles.sh (1.98.0: 38 current), registry export --check, and wai-ops in debug and release.
• Also run:
  • both fast-kernel steps, in full;
  • byte-exact (97 passed);
  • each integer feature alone, with world_int added;
  • the pretrained-set step (WAI_REQUIRE_SOTA_VECTORS=1, with no skip);
  • int_world_shared;
  • the int_world_decode example (clip 1cc16522e5d57982);
  • the decode bench, built and run on the world clip and on the g_s case;
  • the registry tests;
  • wai-ops' goldens;
  • wai-verify vectors verify;
  • wai_ops_check.py;
  • wai-web native (32 passed) and wasm32, with wasm-bindgen 0.2.127;
  • under Node: verify_int_world_wasm and verify_int_payload_wasm.
• Local: comparative prose, vanity metrics, public names, section refs, tests in CI, orphan sources and lockfiles: all clean (the public names against the host's list, not printed).
• No tracked file changed after any build. include/wai.h is untouched.

Not in this PR, and left

• M7a, the jpegai scale path and entropy decodes (jpegai-int/1). It is the first acc32 segment; mANS becomes total.
• M8, WIV1 and WIR1 (stage operators only; the 32-bit identity forms go behind a feature).
• With M6, every WHM1/WAM1 network a decoder runs goes through the operator set. int_hyper_synth keeps only its plans, its ops module and the test-only legacy: the guard, the unchecked run_net, the scalar kernels, decode and to_rgb8.
• Nothing is deployed. The site's world pages use WorldModel. On success they get the same frames, and a refusal now throws; they pick this up with their next wasm build.
• O11. The renderer's set and trace binding, its refusal codes and a fixture belong in interactive-worlds, as their own item. Until then the renderer stays informative and carries no ops member.
• int_payload::unpinned_read is unused without neural. Every cargo check --lib with a single integer feature warns about it. The warning dates from the loaded-set store (e0a741db), and this PR does not touch that code.

🤖 Generated with Claude Code

D2c M6: `wai.world.model`'s integer renderer (`int_world`, in wai-rs and in wai-web) renders through the integer operator set `wai-ops/1`, lowered by `world/1`. Every golden is unchanged. The renderer stays informative (O11). ## What changes - **The renderer.** `int_world::{decode, decode_deltas, decode_planes}` now render through `world/1` ([integer-operators](wai/extensions/integer-operators.md) §13.5), and so does the browser's `WorldModel`. - `T` and `g_s` are lowered and loaded under `acc64` once, with their certificates (`int_world::load` gives an `int_world::World`). - Before the first frame: every row must carry `A` values; `z_0` must be `[C, lat, lat]`; both graphs are planned on that shape, and `T` must give the shape back. - Then the clip runs frame by frame. - Each function now returns a `Result`, and `WorldModel`'s methods throw on a refusal. - The per-row `step`, `step_delta` and `step_planes` of a parsed model are replaced by `World::{step, step_delta, step_action, render}`. The browser holds a `World` for its session. - **`A` comes from `T`.** `A` is `T`'s input channels less `C`: 3 for the one-agent vector, 4 for the two-agent vector. A row of any other length is refused. Both networks' `afrac` are checked: each must lie in `1..=30`, and the two must be equal. - **wai-ops** gains `lower::world_net` and `lower::world_net_loaded`: `world/1` of the networks already parsed, loading `T` before it lowers `g_s`. They write and refuse exactly what `lower::world` does from the bytes, so no committed graph or certificate changes. - **The direct renderer** is `int_world::legacy`, test-only (`legacy_int`). The direct renderer never checked any value. `int_world::legacy::checked` is that renderer with the guard every other integer decoder ran (`run_net_checked`), and it is the reference for refusal parity. - **Gate 7.** With the renderer switched, nothing in production calls the following (wai-web included): - `int_hyper_synth::run_net`, `decode` and `to_rgb8`; - the fast/reference convolution dispatch `run_net` used. They move into the test-only `int_hyper_synth::legacy`, on the scalar kernels, with no dispatch, and `int_hyper_synth::kernel_equivalence` goes with the dispatch it tested. The callers that were not production now go through the lowering: - the decode bench; - `tests/int_kernels_geometry.rs`; - the pretrained-set test `tests/int_hyper_synth.rs`. - **No `ops` member** for `wai.world.model`. The capability's registered payload is its signed action trace, and no payload text yet binds a trace to a renderer's set. The registry test asserts that it has no `ops` member. SPEC §5's row cites §13.5. - **Text:** - integer-operators: the status note; §13.5, which now says what the renderer checks before the first frame and that its codes are informative; §15.3 items 2 and 3. - SPEC §5 and §8. - CHANGELOG. ## Planned breaks (integer-operators §15.3 item 2, SPEC §8) The direct renderer checked nothing: it computed past its exact range, rendered frames from inputs that do not fit, or panicked. The renderer through `world/1` refuses each of these before the first frame: - a set whose `afrac` is outside `1..=30` or unequal, a set with no action plane, or a set that breaks a `WHM1` network's rules (`model_mismatch`); - a row without one value per action plane, and `T` or `g_s` that does not fit the latent (`model_mismatch`); - a latent that is not `C·lat·lat` values (`geometry_mismatch`), a latent side of 0, a latent past `2^26` values, and a move whose plane value leaves `i64`. A value outside a `check` range is refused (`field_range`). No committed set or clip is affected (`the_new_rules_affect_no_committed_set`). Each break is shown on a hand-made fixture, with what the direct renderer did there (`the_renderers_own_checks_refuse_before_any_frame`, `int_world_planned_breaks_are_new_refusals`). ## Gates, each red once and restored | gate | commits | falsification | red | |---|---|---|---| | 1 lowering and certificates | `3d950d98` | the plane fills read the scalars in reverse | `int_world_ops`: "the lowering of the bytes differs from the committed T.whg1"; wai-ops `world_sets_reproduce_every_frame` (frame 0 unchanged, frames 1–8 differ); `vectors verify`, all three T graphs | | 2 golden equality | `aeccbd41` | `leaky` truncates toward zero (Part 3.5) | "world: frames [1, 2, 3, 4, 5, 6, 7, 8] through the lowering differ from the direct renderer's"; frame 0 untouched; the direct goldens green | | 2 | | `world/1` builds three planes for a two-agent `T` (Part 3.5) | the two-agent golden: "world2: ModelMismatch", after the one-agent vector passed; wai-ops' world goldens | | 3 refusal parity | `85becdd4`, `407cadd9`, `6cc62060` | `X_ℓ + 1` as the check bound (Part 3.5) | "world T layer 0: 18542385699146 runs directly: accumulation could leave i64"; "z_0[330] = 11733853450241: left (g_s, 0, 1), right (g_s, 0, 0)"; gate 1's bytes; the synthetic set no longer loads | | 4 differential | `ad83e237`, `f1f21d92` | the frame's HWC layout taken as three channels (a fault only random sets reach) | gates 1–3 green; the differential red, seed 5305056718032203265 | | 5 fast kernels | `5ceceeb5` | channel-0 requantisation on the fast path | `--lib int_ops::equivalence` 8 of 11 (the world renderer's among them); `int_world_ops` 4 of 7 | | 6 the switch | `dcb1505c`, `f57e07e2` | `rq` floor → half_up in `whm1/1` | now the file-based goldens: `int_world`, `int_world2`, `int_kernels_vectors::int_world_clips`, `int_world_shared` ("shared world clip hash"), and all four wasm32 clips, frames [0..8] | | 6 memory | | the clip keeps a copy of every latent | `int_world_memory`: "held 677856; the direct renderer held 578520" | | 7 delete | `24539d2b`, `5ed8213f`, `e9a62368` | the test-only `run_net`'s leaky ReLU truncates | production green (`int_world`, `int_world2`, `int_kernels_vectors`, `int_world_shared`, wasm32); the comparisons red: `int_world_ops` 3 of 7, the memory test's frame check, the differential ("the latents after transition 1 differ") | **Gate 7's falsification found a gap, which is now closed.** At first the random differential stayed green under that fault. Random transitions saturated `T`'s clamp, so a ±1 in `T` vanished from both the latents and the frames. Two changes fix it: - the differential now compares the latents after every transition; - three cases in four, the generator's `T` layers have near-unit-gain multipliers and leaky slopes below 1. With both changes, the differential goes red under the same fault. ## Differential (`tests/int_ops_differential.rs`, the world half) There was no disagreement in any run. Outside the planned breaks, the renderer through the operator set and the direct renderer with its guard either render the same frames, through the same latents after every transition, or refuse a value in the same network, at the same step and the same layer. Under a planned break, the renderer through the operator set refuses. | run | cases | rendered alike | |---|---|---| | per push, debug and release | 3,000 | 711 | | timed 300 s, seed 20261016, debug | 54,462 | 13,150 | | timed 300 s, seed 20261016, release | 3,081,649 | 752,038 | - **Per push, the refusals both renderers made** were in `T`'s layers 0, 1 and 2 (114, 39 and 28) and in `g_s`'s layers 0, 1 and 2 (203, 104 and 21). - **The planned breaks were:** - a row without `A` values, 459; - no layer of tag 0, 1 or 2, 434; - `T` or `g_s` not fitting the latent, 394; - the `afrac` rule, 186; - a bias at an end of `i64`, 136; - `A < 1`, 73; - layers that do not chain, 61; - an unused `shift` or `gf` of 128 or more, 34; - an unmeetable range, 3. - **The runs before the generator change** (gate 4's commit) were green too: 687 of 3,000 alike per push; 47,691 and 2,471,671 cases in the timed runs. - **Coverage.** Both networks' check ranges are reached at every layer. All nine break kinds are reached, each also on a hand-made fixture. - **The bounds-pass oracle test** now also covers the world graphs. Per push: 3,000 cases, 24,616 graphs (21 refused, 2,580 `acc32`, 22,006 `acc64` only, 9 neither), with no disagreement. ## Memory (`tests/int_world_memory.rs`, reference kernels) The renderer declares no cost, because it has no payload. So it is held to the direct renderer it replaced. The one-agent and two-agent vectors give the same figures: | | through the operator set | direct | |---|---|---| | a clip of 9 frames, set loaded | 566,880 | 578,520 | | one step | 39,193 / 39,786 | 39,936 / 40,960 | | one frame | 468,360 | 480,000 | - Loading the set held 505,310 and 507,290 bytes. - A call that loads the set and then renders held 826,538 and 828,518 bytes. - **The first measurement exceeded the direct renderer by 648 bytes** (579,168 against 578,520). The excess is the interpreter's per-run bookkeeping, at the last frame, while the clip still held a latent that no transition reads after it. The last frame now takes that latent. ## Wasm32 - `demo/verify_int_world_wasm.mjs` is new, and `wai-web-wasm.yml` runs it. - `WorldModel`, built for wasm32, renders both vectors frame by frame to their sidecars' SHA-256s: one agent by `step`, `stepDelta` and `stepPlanes`, two agents by `stepPlanes`. - It ran green before the switch and after it, and red under gate 6's fault. ## Checks - **`gate.sh` on the merged head `c75fa9af`:** GREEN, twice: build, lib-tests, carriage, corpus loop 21/21, fast-kernels, byte-exact, wai-web wasm32 and neural gates. The second run used `rb --pull`, and there was nothing to pull. - **Also on the merged head:** `check-lockfiles.sh` (1.98.0: 38 current), `registry export --check`, and wai-ops in debug and release. - **Also run:** - both fast-kernel steps, in full; - byte-exact (97 passed); - each integer feature alone, with `world_int` added; - the pretrained-set step (`WAI_REQUIRE_SOTA_VECTORS=1`, with no skip); - `int_world_shared`; - the `int_world_decode` example (clip `1cc16522e5d57982`); - the decode bench, built and run on the world clip and on the `g_s` case; - the registry tests; - wai-ops' goldens; - `wai-verify vectors verify`; - `wai_ops_check.py`; - wai-web native (32 passed) and wasm32, with wasm-bindgen 0.2.127; - under Node: `verify_int_world_wasm` and `verify_int_payload_wasm`. - **Local:** comparative prose, vanity metrics, public names, section refs, tests in CI, orphan sources and lockfiles: all clean (the public names against the host's list, not printed). - **No tracked file changed after any build.** `include/wai.h` is untouched. ## Not in this PR, and left - **M7a**, the jpegai scale path and entropy decodes (`jpegai-int/1`). It is the first `acc32` segment; mANS becomes total. - **M8**, `WIV1` and `WIR1` (stage operators only; the 32-bit identity forms go behind a feature). - With M6, every `WHM1`/`WAM1` network a decoder runs goes through the operator set. `int_hyper_synth` keeps only its plans, its `ops` module and the test-only `legacy`: the guard, the unchecked `run_net`, the scalar kernels, `decode` and `to_rgb8`. - **Nothing is deployed.** The site's world pages use `WorldModel`. On success they get the same frames, and a refusal now throws; they pick this up with their next wasm build. - **O11.** The renderer's set and trace binding, its refusal codes and a fixture belong in interactive-worlds, as their own item. Until then the renderer stays informative and carries no `ops` member. - **`int_payload::unpinned_read` is unused without `neural`.** Every `cargo check --lib` with a single integer feature warns about it. The warning dates from the loaded-set store (`e0a741db`), and this PR does not touch that code. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dcharlot added 14 commits 2026-10-16 03:39:13 -04:00

int_world gate 1: world/1 from the parsed models, loaded once; the committed sets' graphs and verdicts ... 3d950d9820

wai-ops: lower::world_net (world/1 of two networks already parsed) and
lower::world_net_loaded (T lowered and loaded, then g_s), both through the one
world_t that lower::world uses, so the bytes and the refusals are world's.

wai-rs: int_world::ops::{lower, load, World}. tests/int_world_ops.rs (world_int,
both fast-kernel steps): every committed world/1 set (one agent, two agents,
synthetic) lowers to its committed graphs from its bytes and from the models
this crate parses; the certificate is those graphs'; the load gives acc64 and
not acc32, first acc32 failure T's input range at 64 bits (Appendix C); A is
T's input channels less C (3, 4).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_world gate 2: the renderer through world/1, beside the direct one; every golden through the lowering ... aeccbd41e1

int_world::legacy holds the direct renderer, unchanged; the crate's int_world
functions are still it (the switch is gate 6). int_world::ops::World renders
through the loaded set: step, render, plan, decode_planes, decode_deltas,
move_row (dequantize(d, afrac, 0)), and the free decode_planes, decode_deltas
and decode. Before the first frame: every row carries A values
(model_mismatch), z_0 is [C, lat, lat], and T and g_s plan on it, T giving
the shape back.

tests/int_world_ops.rs: both committed vectors render through the lowering
to the direct renderer's frames and to every golden (the nine frame and the
clip SHA-256s of the sidecars, the export's FNV-1a frame and clip hashes),
the one agent vector by rows, moves and action indices alike, and one step
and one frame at a time.

wai-web: demo/verify_int_world_wasm.mjs, run in wai-web-wasm.yml: WorldModel
in wasm32 renders both vectors frame by frame to their sidecars' SHA-256s.

Green (build host): int_world_ops debug and release, int_world, int_world2;
wai-web wasm32 release + wasm-bindgen 0.2.127, verify_int_world_wasm.mjs
under Node: step, stepDelta, stepPlanes (one agent) and stepPlanes (two
agents) to clips e97bad20... and 8caa2540....

Falsified (Part 3.5), each restored with git:
- leaky truncates toward zero (interp k_leaky): int_world_ops red, "world:
  frames [1, 2, 3, 4, 5, 6, 7, 8] through the lowering differ from the direct
  renderer's"; frame 0 untouched; the direct goldens int_world, int_world2
  green (pre-switch).
- world/1 builds three planes for a two agent T (a = 3): the two agent golden
  red, "world2: ModelMismatch: T and g_s do not lower by world/1 ...", after
  the one agent vector passed; wai-ops world_sets_reproduce_every_frame red.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_world gate 3 (WIP: committed before running): the check ranges against the direct guard, no ops member, SPEC §5's citation ... 85becdd45f

int_world::legacy::checked (legacy_int): the direct renderer with
run_net_checked before each layer, reporting the network, step and layer.

tests/int_world_ops.rs (now world_int + legacy_int):
- every check range of T and g_s, in every committed set, refuses exactly what
  the guard refuses: the layer's operator alone runs at X_l and is refused at
  X_l + 1 (field_range at its input), as run_net_checked runs and refuses
  (out of range at that layer); the range is the layer's lowered alone, or
  (2^63 - 1) / |slope| for the leaky ReLU;
- through the whole renderer, z_0 and row values at and past the edges render
  alike or are refused alike, in the same network, step and layer;
- the renderer's own checks (afrac, A = 0, rows without A values, T not
  keeping the latent's shape, g_s not reading C, z_0's length, a side of 0,
  the cap, a move past i64) refuse before any frame;
- no committed set is affected.

Registry: wai.world.model carries no ops member (its decode is the trace's
replay; world/1 is informative), asserted in the registry test. SPEC §5's
row cites integer-operators §13.5. CHANGELOG started.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_world gate 3: the test file's gate names legacy_int, as its target requires ... 407cadd970

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_world gate 3: the fixtures report what the direct renderer did; gate 3's results ... 6cc620601f

The fixtures report what the direct renderer did with each input, or that it
takes no such input.

Green (build host): int_world_ops, 6 tests. Of the renderer's own checks, the
direct renderer rendered 9 frames for afrac 0, afrac 31 (one or both), unequal
afrac, a row of A - 1 values and three planes for the two agent T, and panicked
for A = 0, a row of A + 1 values, T halving the latent, g_s reading 23
channels, z_0 one value short and a side of 0; the operator set refuses each
before any frame.

Falsified (Part 3.5, refusal parity): X_l + 1 as the check bound (check_x).
int_world_ops EXIT=101, 4 of 6: "world T layer 0: 18542385699146 runs
directly: layer 0: accumulation could leave i64" (the graph accepts what the
guard refuses); "world z_0[330] = 11733853450241: the network, step and layer
of the refusal, left (g_s, 0, 1), right (g_s, 0, 0)"; gate 1's bytes; and the
synthetic set no longer loads under acc64. Restored with git.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_world gate 4 (WIP: committed before running): the world half of the differential ... ad83e2378b

tests/int_ops_differential.rs (now also world_int; the nightly runs it):
random world sets and clips through the operator set against the direct
renderer with its guard (and, where both render, the unguarded direct
renderer); a classifier of the planned breaks of integer-operators §15.3
item 2 from the set and clip alone; hand-made fixtures for each break; the
world graphs in the bounds-pass oracle test.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_world gate 4: a network that does not plan on the latent is model_mismatch; gate 4's results ... f1f21d92d8

World::plan reports every refusal of T's or g_s's plan on the latent as
model_mismatch, as M5's fit reports a network that does not fit a payload's
shapes (a g_s whose kernel exceeds the latent was geometry_mismatch).

Green (build host), no disagreement anywhere:
- per push, 3000 cases, debug and release alike: 687 rendered alike; refused
  by both T layer 0/1/2: 113/70/22, g_s layer 0/1/2: 222/125/24; planned
  breaks: afrac 186, A < 1 67, no tag-0/1/2 layer 430, unused shift or gf
  41, bias 104, unmeetable range 1, layers that do not chain 52, a row
  without A values 464, T or g_s not fitting the latent 392;
- timed 300 s, seed 20261016, debug: 47,691 cases, 11,095 alike;
- timed 300 s, seed 20261016, release: 2,471,671 cases, 580,529 alike;
  every break kind and every check range of both networks reached;
- the bounds pass equals its oracle on random sets, now with the world graphs:
  3000 cases, 24,616 graphs (21 refused, 2580 acc32, 22,006 acc64 only, 9
  neither);
- the whole differential file, 13 tests, debug and release.

Falsified: a fault only random sets reach, the frame's HWC layout taken as
three channels (every committed g_s gives three). Gates 1-3 stay green
(int_world_ops, 6 passed); the differential is red, "the two renderers'
frames differ", seed 5305056718032203265. Restored with git.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_world gate 5: the fast kernels behind the interpreter, held to it ... 5ceceeb591

int_ops::equivalence:
- the_world_renderer_runs_its_networks_on_the_fast_kernels (world_int): both
  committed world sets; under every fast policy each convolution of T at
  every step and each transposed convolution and inverse GDN of g_s at every
  frame run on the fast kernels, and every frame is the interpreter's;
- padding_beyond_the_pad_factor_runs_on_the_interpreter: int_hyper_synth's
  pad-factor test held to the interpreter: at the factor the fast kernel runs,
  beyond it the interpreter computes, to the same integers.

tests/int_world_ops.rs: every kernel policy renders both vectors alike, and
alike refuses or renders at and past the check ranges.

The rest of int_hyper_synth::kernel_equivalence needs no retargeting: its
random convolution equivalences are whm1_convolutions_equal_the_interpreter
(M4), and its overflow, cropped-border and malformed-geometry cases cannot
reach a loaded graph (the certificate excludes the overflow; the plan refuses
the geometry).

Green (build host): --lib int_ops::equivalence, 11 passed, and int_world_ops,
7 passed, in debug and release.

Falsified (M1's row for this gate): channel-0 requantisation on the fast path
(int_ops::conv). --lib int_ops::equivalence red, 8 of 11, among them "int_world
Policy { path: Fast, threads: 1 }: the frames differ from the interpreter
alone"; int_world_ops red, 4 of 7: the edge test, "world: frames [0..8]
through the lowering differ from the direct renderer's" (the production
policy is fast), the guard parity, and "world committed: Policy { path: Fast,
threads: 1 } renders other than the interpreter alone". Restored with git.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_world gate 6 (WIP: committed before running): the switch ... dcb1505cd8

int_world::{decode, decode_deltas, decode_planes} render through world/1 and
return a Result; int_world::{load, World} hold the set lowered and loaded once,
with step, step_delta, step_action and render for the live path, which replace
the per-row step functions of a parsed model. int_world::legacy is test-only
(legacy_int). wai-web's WorldModel loads its set once and renders through it;
its methods throw on a refusal.

Callers moved: tests int_world, int_world2, int_world_shared,
int_kernels_vectors; the int_world_decode example; the decode bench's world
row. tests/int_world_memory.rs (its own binary; both fast-kernel steps): a
clip, a step and a frame hold no more than the direct renderer's.

Text: integer-operators' status note, §13.5 (before the first frame: the
plan, T giving the shape back, the informative codes), §15.3 items 2 and 3;
SPEC §8's planned breaks; CHANGELOG.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_world gate 6: the last frame takes the latent no transition reads after it; gate 6's results ... f57e07e2fd

The first measurement had the clip through the operator set, its set loaded,
at 579,168 bytes against the direct renderer's 578,520: the interpreter's
per-run bookkeeping, at the last frame, while the clip still held a latent
nothing reads after that frame. The last frame now takes it.

Green (build host), debug and release: int_world_ops (8), int_world_memory,
int_world, int_world2, int_kernels_vectors (int_world_clips among them);
int_world_shared (world_model, world_int); cargo check --lib with world_int
alone (one warning, unpinned_read in int_payload, which this branch does not
touch); the int_world_decode example (frame0 f67d2e64624d6358, clip
1cc16522e5d57982); the decode bench builds; wai-web native lib (32 passed),
wasm32 check, wasm32 release + wasm-bindgen 0.2.127, then under Node
verify_int_world_wasm.mjs (step, stepDelta, stepPlanes; one and two agents:
clips e97bad20..., 8caa2540...) and verify_int_payload_wasm.mjs; the registry
tests (15). Comparative prose, vanity metrics, public names (host list, not
printed) and section refs, all clean.

Memory (reference kernels; tests/int_world_memory.rs), one agent and two
alike: a clip of 9 frames with its set loaded held 566,880 bytes, the direct
renderer 578,520; one step 39,193 (direct 39,936) and 39,786 (40,960); one
frame 468,360 (480,000); loading the set held 505,310 and 507,290; the call
that loads the set and renders held 826,538 and 828,518.

Falsified, each restored with git:
- rq floor -> half_up in whm1/1, after the switch: the file-based goldens go
  red: int_world ("generated frame 0 must reproduce its committed hash"),
  int_world2, int_kernels_vectors (int_world_clips among 6), int_world_shared
  ("shared world clip hash", 063b666d305f02c2), and in wasm32 all four of
  verify_int_world_wasm.mjs's clips, frames [0..8].
- The memory claim: the clip keeps a copy of every latent. int_world_memory
  red, "int_world, set loaded: held 677856; the direct renderer held 578520";
  int_world_ops green.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_world gate 7 (WIP: committed before running): run_net, decode and the convolution dispatch leave production ... 24539d2be1

With the world renderer through world/1, nothing in production calls
int_hyper_synth::run_net, decode, to_rgb8 or the fast/reference convolution
dispatch run_net used (wai-web included). They move into the test-only
int_hyper_synth::legacy, beside the guard: run_net and apply_layer on the
scalar kernels (legacy::reference), with no dispatch; decode and to_rgb8.
int_hyper_synth::kernel_equivalence goes with the dispatch it tested: its
convolution equivalences are int_ops' whm1_convolutions_equal_the_interpreter
(M4), its pad-factor test int_ops' padding_beyond_the_pad_factor_runs_on_the_
interpreter (gate 5), and its overflow and malformed-geometry cases cannot
reach a loaded graph.

The callers that were not production move to the lowering:
- wai_decode_bench: the int_hyper kernel cases, the g_s decoder case and the
  layer profile run whm1/1 graphs through int_ops, as the decoders do;
- tests/int_kernels_geometry.rs: the int_hyper edge geometry runs a WHM1
  layer through its lowering under every policy; strides past 32 bits and
  planes past the cap are refused, not panicked;
- tests/int_hyper_synth.rs: the pretrained synthesis and hyper-decoder hashes
  are checked through the lowering alone;
- int_mlicpp's and int_world's direct decodes take run_net, decode and
  to_rgb8 from legacy; docs in int_kernels and int_transformer.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_world gate 7: the world differential compares the latents after every transition ... 5ed8213f95

Gate 7's falsification (the test-only run_net's leaky ReLU truncating) left
the random differential green: a random g_s mostly saturates the RGB8 step,
which hid the difference in T. Where both renderers render, it now also holds
the latents after every transition equal.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_world gate 7: the world generator's transitions mostly keep the latent's magnitude; gate 7's results ... e9a6236840

Three cases in four, T's convolutions have multipliers about 2^shift over
their terms and largest weight, and a leaky ReLU's slope is below 1, so a
random transition leaves the latent mostly inside T's clamp, where a
difference in T's arithmetic shows.

Gate 7's falsification, the test-only run_net's leaky ReLU truncating:
- production green: int_world, int_world2, int_kernels_vectors (8),
  int_world_shared, and in wasm32 verify_int_world_wasm.mjs;
- the comparisons red: int_world_ops 3 of 7 ("world: frames [1..8] through
  the lowering differ from the direct renderer's", the edge test, the guard
  parity) and int_world_memory's frame check;
- the random differential stayed green at first: random transitions
  saturated T's clamp and hid the difference. With the latents compared
  (5ed8213f) and this generator, it is red: "the latents after transition 1
  differ". Restored with git each time.

Green (build host): each integer feature alone (neural_int, video_int,
audio_int, splat_int, world_int, staged, stage_measure; the one warning is
unpinned_read, which predates this branch); both fast-kernel steps in full;
byte-exact release (97); the pretrained-set step with
WAI_REQUIRE_SOTA_VECTORS=1 (no skip; synthesis fd9ca73af62d40d8, h_s
9b98e6809b3913c6, conditional eb1acd2159f8a966); the decode bench built and
run on the world clip and the g_s case. The differential on this generator:
per push 3000 cases, debug and release, 711 rendered alike, 13 tests;
timed 300 s seed 20261016: debug 54,462 cases (13,150 alike), release
3,081,649 (752,038 alike); no disagreement.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge remote-tracking branch 'origin/main' into wai/d2c-m6 c75fa9af26

dcharlot merged commit 80477972b5 into main 2026-10-16 09:41:26 -04:00

dcharlot referenced this pull request from a commit 2026-10-16 09:41:28 -04:00

Merge pull request 'D2c M6: wai.world.model's integer renderer renders through wai-ops/1 (world/1), goldens unchanged; run_net and the convolution dispatch leave production' (#274) from wai/d2c-m6 into main

dcharlot referenced this pull request 2026-10-16 09:45:37 -04:00

wai: live-events (Draft) — wai.live.events, a signed, timeline-bound event track (WEV1), with its policy, verifier, poll tallies as feed state, MSF/DATERANGE/emsg bindings, corpus and independent verifier #279

dcharlot referenced this pull request 2026-10-17 10:20:25 -04:00

wai: D2c M7a — jpegai's scale path and entropy decodes through wai-ops/1 (jpegai-int/1) #298

dcharlot referenced this pull request from a commit 2026-10-18 07:19:04 -04:00

Merge remote-tracking branch 'origin/main' into wai/d2c-m7a

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Transaction-Science/open-standards!274

No description provided.