Transaction-Science/open-standards
Watch
1
0
Fork
You've already forked open-standards
 0
Code Issues Pull requests Projects Releases 15 Packages Wiki Activity Actions

wai.media.takedown: takedown across every rendition and cache, against the regime's clock (TKD) #420

Closed
dcharlot wants to merge 0 commits from wai/takedown into main
pull from: wai/takedown
merge into: Transaction-Science:main
Conversation 0 Commits - Files changed -
dcharlot commented 2026-10-21 20:06:59 -04:00
Owner
Copy link

What this is

wai.media.takedown (TKD): the removal of an item and of every rendition and derivative WAI made of it, from every party that held it, timed against the clock of the regime the service runs under. WAI decides no legal question: it computes what was removed, where and when.

  • Extension wai/extensions/takedown.md (§1–§13, reasons table §11).
  • Registry of regime clocks wai/registry/takedown-clocks.json (data, pinned by a policy by link hash; no duration is fixed in prose). Read from the primary texts:
    • Public Law 119-12, section 3(a)(3) (removal and known identical copies within 48 hours of receiving a valid request), section 3(a)(1)(A) (the process due one year after enactment, so from 2026-05-19), section 3(b);
    • Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, rule 3(1)(d) (three hours from receipt of an order or reasoned intimation) and rule 3(2)(b) (two hours from a complaint), in the consolidated text that incorporates G.S.R. 120(E) of 10 February 2026, in force 20 February 2026 (the commencement read from the questions and answers published with the notification; the Gazette itself was not read);
    • Regulation (EU) 2024/1083, Article 18(4) (a 24-hour reply window before a restriction takes effect), Article 29;
    • Regulation (EU) 2022/2065, Article 16(6) ("timely": an unfixed clock), Article 16(4), Article 15(1), Article 93.
  • Reference module wai-rs/src/takedown.rs + takedown/corpus.rs (feature takedown = derive_edge + synthesis + settlement; no new dependency), bin wai_takedown_vectors, test tests/takedown.rs.
  • Corpus wai/live-conformance/takedown/ (vectors.json, README with a Provenance. line): 33 cases and 2 counts entries.
  • Independent verifier wai/live-conformance/takedown_verify.py (python3 -I), sharing no code with wai-rs; reads derivation records and receipts with edge_verify.py, origin claims with synthesis_verify.py, acknowledgements with settlement_verify.py.
  • Reference relay (joule-moq-relay): the DVR store honours a signed takedown, and a new test in tests/dvr.rs.
  • Plumbing: codecs/registry.rs (record + 7 document kinds), registry export regenerated (capabilities.json, vocab/v2.ttl, REGISTRY.md), SPEC §5 paragraph, CHANGELOG, wai-conformance.yml step and path, live-conformance/README.md row, int_kernels_vectors.rs exclusion reason (now the merged generic one), a pointer from live-moderation §1.

Design decisions

  1. Sibling record, not a live-moderation revision. live-moderation's WMS1 statement is version 1 and its target_type admits only an event or a media object (§4.3 there refuses anything else), and its decisions ride a room's event chain. A catalogue object has no room. A new target_type or version would make every existing verifier refuse, so takedowns are JSON records of their own (jwp-receipts §2.4.3 encodings, JCS, wai:takedown\x01), carrying the statement's fields (ground, explanation, facts, automated, a §9.5 category). live-moderation's records and verifier are unchanged (its verifier was rerun).
  2. Subjects are synthesis §3.1's (object by content hash, group by receipt link hash, track by digest from a group) plus take. The closure is the least fixpoint over derivation records (input content hash → output), origin claims (input → subject), and group expansion from delivery receipts; it is exact for the records given. A group that cannot be expanded is refused (group_unexpanded), since its objects could hide derivatives. Tracks and takes are covered by name; the text says the closure does not reach through them, and that copies made outside every WAI derivation are out of reach, while every copy of the same bytes is reached by its content hash.
  3. Perceptual matches are signed wai-takedown-match records listed in matched, never in exact; an exact member the closure lacks is match_as_exact when a held match names it, closure_unsupported otherwise. Matched objects are purged and stated apart; no clock verdict rests on them.
  4. Holders (the required pairs): the policy's stores (every subject), each closure record's signer (deriver), each closure claim's signer (claimant), each expanded group's publisher (publisher), and, now that settlement (#404) is on main, the upstream of each acknowledgement or declaration naming a covered object (served) and the downstream of a hop's acknowledgement (received); a sink is never held. A purge counts only for its signer's own required pairs; anything else it names is stated uncounted.
  5. Purges list their subjects explicitly (no root form): a verifier needs the list to check coverage, and a holder of many signs several. A group is covered by naming it or all its objects, an object by naming it or a group holding it.
  6. Clocks: deadline (met / deadline_missed; purge_missing once as_of is past the deadline, pending before), reply_window (no purge before the window's end, which a reply can bring forward: window_not_observed), unfixed (complete removals are stated unfixed with their time to removal). Times are whole-second UTC; durations come only from the registry.
  7. Counts rows are keyed by clock, ground, category and source (order / request / own), with met / missed / pending / unfixed, automated, and the lower median time to removal, recomputed at the counts' as_of. Compatible with live-moderation §9 where they meet: the same categories, grounds and automated fields, and a takedown's link hash as the puid of the statement of reasons a service submits. No statement-of-reasons export is written for a takedown in this revision (no source for content_type, territorial_scope, content_date).
  8. The clock's start is the service's signed clock_start, held to be at or after the notice's signing and at or before the decision; the security section says what that rests on.
  9. No consent requirements: notice contact data is the service's to process; the text points to lawful-basis (jwp-receipts §2.4.6).

The relay (joule-moq-relay)

A takedown rides the track [K, takedown], 0; the store honours it when K is in dvr.takedown_keys (or auth.authorities) and is the signer, and the signature verifies. It erases, in every room, every object whose content hash exact or matched names and every object of an exact track from its from_group on (erased reason 3); never stores them again (an identical copy on another track included); withholds them from every FETCH, from the store and from the cache, moderator sessions included; logs takedowns in takedowns.wdl (re-verified on start, undone erasures redone); and signs a purge with the relay's summary key into purges/<link>.json, once. Dvr::open gained a purge_key argument (one caller). It does not check the live fan-out: the text says so.

Deployment note: the relay changed, so the live room must be redeployed as one unit (page assets, relay and room service together). This PR does not deploy.

Checks (all cargo on the build host via rb)

check command result
takedown unit tests cargo test --locked --no-default-features --features takedown --lib takedown:: 5 passed
corpus test cargo test --locked --no-default-features --features takedown --test takedown 4 passed (regenerates byte for byte, every case, §11 = Reason::ALL, registry = published file)
independent verifier python3 -I live-conformance/takedown_verify.py live-conformance/takedown every case and counts entry PASS, 18 mutations caught, 35 dropped checks each caught; exit 0
clippy (takedown files) cargo clippy --locked --no-default-features --features takedown --all-targets 0 notes in src/takedown* (others pre-existing)
relay, every target cargo test --locked -p joule-moq-relay --all-targets all pass (dvr: 8 passed)
relay test loop new DVR test ×12, dvr suite ×4 12/12, 4/4
relay clippy cargo clippy --locked -p joule-moq-relay --all-targets 0 new notes in the crate (2 pre-existing, untouched lines)
relay dependents cargo build --locked -p joule-moq-ingest -p joule-moq-web; joule-moq-room: cargo test --locked --no-run build
registry export cargo run --no-default-features --bin wai -- registry export then --check up to date
registry tests cargo test --no-default-features --features <the CI set> --lib codecs::registry 14 passed
corpus sidecar rule --test int_kernels_vectors every_decoded_output passed
settlement (dependency) cargo test --no-default-features --features settlement --test settlement 4 passed
lockfiles cargo metadata --locked --offline (wai-rs, joule-code workspace, joule-moq-room) ok (no lock change)
repo checks (local) check-tests-in-ci.py, check-workflow-concurrency.sh, check-spec-refs.py, check-wai-section-refs.py, check-no-vanity-metrics.sh, test-public-text-checks.sh, check-comparative-prose.sh, check-orphan-sources.py all clean
shared text live_moderation_verify.py (§1 edited) PASS

check-public-names.sh needs the CI secret; it was not run locally (a manual scan of the changed files found no names).

Falsifications (committed first, then broken on the build host, then restored)

broken expected failure result
deadline rule (last <= deadline dropped) tests/takedown.rs exit 101 (order-3h-missed accepted)
claim closure rule disabled tests/takedown.rs exit 101
served holder role removed tests/takedown.rs exit 101 (cache-purge-missing)
relay: covered objects stored at seal time DVR takedown test exit 101 (identical copy stored)
relay: cache-path withholding removed DVR takedown test exit 101 (cache served covered objects)
relay: takedowns not reloaded on start DVR takedown test exit 101 (counts after restart)
corpus stating an accepted late purge takedown_verify.py on a copy exit 1
each of the Python verifier's 35 checks dropped in turn the corpus each caught

Restored runs pass in each case.

Negative controls in the corpus

A derivative left out of the closure (closure_incomplete); a purge after the deadline (deadline_missed, never accepted); a purge signed by a party that never held the object, standing in for a holder's (purge_missing, its subjects uncounted); a perceptual match presented as exact (match_as_exact); a takedown of an object no derivation names claiming derivatives (closure_unsupported); a cache shown by acknowledgements to have served the thumbnail that never purged (purge_missing); and one case or more for every other reason of §11.

Not done

  • No statement-of-reasons record is written for a takedown (§9.3 says why); counts are compatible by category, ground, automation and puid.
  • The relay does not filter the live fan-out; recording packages are not rewritten after sealing; the wai http origin command has no store to purge (its operator deletes files). Each is named in §10.
  • Takes and tracks are covered by name only; no record binds a track digest to its groups' receipts, so the closure does not reach through them (§6.2).
  • Reinstatement of a disabled object is not expressed in this revision.
  • The Gazette text of G.S.R. 120(E) itself was not read (the consolidated rules and the published questions and answers were).

🤖 Generated with Claude Code

Closed: Landed in #428 (merge train, merged as aa61ab3b with all 65 checks green).

## What this is `wai.media.takedown` (TKD): the removal of an item and of every rendition and derivative WAI made of it, from every party that held it, timed against the clock of the regime the service runs under. WAI decides no legal question: it computes what was removed, where and when. - **Extension** `wai/extensions/takedown.md` (§1–§13, reasons table §11). - **Registry of regime clocks** `wai/registry/takedown-clocks.json` (data, pinned by a policy by link hash; no duration is fixed in prose). Read from the primary texts: - Public Law 119-12, section 3(a)(3) (removal and known identical copies within 48 hours of receiving a valid request), section 3(a)(1)(A) (the process due one year after enactment, so from 2026-05-19), section 3(b); - Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, rule 3(1)(d) (three hours from receipt of an order or reasoned intimation) and rule 3(2)(b) (two hours from a complaint), in the consolidated text that incorporates G.S.R. 120(E) of 10 February 2026, in force 20 February 2026 (the commencement read from the questions and answers published with the notification; the Gazette itself was not read); - Regulation (EU) 2024/1083, Article 18(4) (a 24-hour reply window before a restriction takes effect), Article 29; - Regulation (EU) 2022/2065, Article 16(6) ("timely": an `unfixed` clock), Article 16(4), Article 15(1), Article 93. - **Reference module** `wai-rs/src/takedown.rs` + `takedown/corpus.rs` (feature `takedown` = `derive_edge` + `synthesis` + `settlement`; no new dependency), bin `wai_takedown_vectors`, test `tests/takedown.rs`. - **Corpus** `wai/live-conformance/takedown/` (`vectors.json`, README with a **Provenance.** line): 33 cases and 2 counts entries. - **Independent verifier** `wai/live-conformance/takedown_verify.py` (`python3 -I`), sharing no code with wai-rs; reads derivation records and receipts with `edge_verify.py`, origin claims with `synthesis_verify.py`, acknowledgements with `settlement_verify.py`. - **Reference relay** (`joule-moq-relay`): the DVR store honours a signed takedown, and a new test in `tests/dvr.rs`. - **Plumbing**: `codecs/registry.rs` (record + 7 document kinds), registry export regenerated (`capabilities.json`, `vocab/v2.ttl`, `REGISTRY.md`), SPEC §5 paragraph, CHANGELOG, `wai-conformance.yml` step and path, `live-conformance/README.md` row, `int_kernels_vectors.rs` exclusion reason (now the merged generic one), a pointer from live-moderation §1. ## Design decisions 1. **Sibling record, not a live-moderation revision.** live-moderation's `WMS1` statement is version 1 and its `target_type` admits only an event or a media object (§4.3 there refuses anything else), and its decisions ride a room's event chain. A catalogue object has no room. A new `target_type` or version would make every existing verifier refuse, so takedowns are JSON records of their own (jwp-receipts §2.4.3 encodings, JCS, `wai:takedown\x01`), carrying the statement's fields (ground, explanation, facts, automated, a §9.5 category). live-moderation's records and verifier are unchanged (its verifier was rerun). 2. **Subjects** are synthesis §3.1's (`object` by content hash, `group` by receipt link hash, `track` by digest from a group) plus `take`. **The closure** is the least fixpoint over derivation records (input content hash → output), origin claims (input → subject), and group expansion from delivery receipts; it is exact for the records given. A group that cannot be expanded is refused (`group_unexpanded`), since its objects could hide derivatives. Tracks and takes are covered by name; the text says the closure does not reach through them, and that copies made outside every WAI derivation are out of reach, while every copy of the same bytes is reached by its content hash. 3. **Perceptual matches** are signed `wai-takedown-match` records listed in `matched`, never in `exact`; an `exact` member the closure lacks is `match_as_exact` when a held match names it, `closure_unsupported` otherwise. Matched objects are purged and stated apart; no clock verdict rests on them. 4. **Holders** (the required pairs): the policy's stores (every subject), each closure record's signer (`deriver`), each closure claim's signer (`claimant`), each expanded group's publisher (`publisher`), and, now that settlement (#404) is on main, the upstream of each acknowledgement or declaration naming a covered object (`served`) and the downstream of a hop's acknowledgement (`received`); a sink is never held. A purge counts only for its signer's own required pairs; anything else it names is stated `uncounted`. 5. **Purges** list their subjects explicitly (no root form): a verifier needs the list to check coverage, and a holder of many signs several. A group is covered by naming it or all its objects, an object by naming it or a group holding it. 6. **Clocks**: `deadline` (met / `deadline_missed`; `purge_missing` once `as_of` is past the deadline, `pending` before), `reply_window` (no purge before the window's end, which a reply can bring forward: `window_not_observed`), `unfixed` (complete removals are stated `unfixed` with their time to removal). Times are whole-second UTC; durations come only from the registry. 7. **Counts** rows are keyed by clock, ground, category and source (order / request / own), with met / missed / pending / unfixed, automated, and the lower median time to removal, recomputed at the counts' `as_of`. Compatible with live-moderation §9 where they meet: the same categories, grounds and automated fields, and a takedown's link hash as the `puid` of the statement of reasons a service submits. No statement-of-reasons export is written for a takedown in this revision (no source for `content_type`, `territorial_scope`, `content_date`). 8. **The clock's start** is the service's signed `clock_start`, held to be at or after the notice's signing and at or before the decision; the security section says what that rests on. 9. **No consent requirements**: notice contact data is the service's to process; the text points to `lawful-basis` (jwp-receipts §2.4.6). ## The relay (joule-moq-relay) A takedown rides the track `[K, takedown]`, `0`; the store honours it when `K` is in `dvr.takedown_keys` (or `auth.authorities`) and is the signer, and the signature verifies. It erases, in every room, every object whose content hash `exact` or `matched` names and every object of an `exact` track from its `from_group` on (erased reason 3); never stores them again (an identical copy on another track included); withholds them from every FETCH, from the store and from the cache, moderator sessions included; logs takedowns in `takedowns.wdl` (re-verified on start, undone erasures redone); and signs a purge with the relay's summary key into `purges/<link>.json`, once. `Dvr::open` gained a `purge_key` argument (one caller). It does **not** check the live fan-out: the text says so. **Deployment note: the relay changed, so the live room must be redeployed as one unit (page assets, relay and room service together). This PR does not deploy.** ## Checks (all cargo on the build host via `rb`) | check | command | result | |---|---|---| | takedown unit tests | `cargo test --locked --no-default-features --features takedown --lib takedown::` | 5 passed | | corpus test | `cargo test --locked --no-default-features --features takedown --test takedown` | 4 passed (regenerates byte for byte, every case, §11 = `Reason::ALL`, registry = published file) | | independent verifier | `python3 -I live-conformance/takedown_verify.py live-conformance/takedown` | every case and counts entry PASS, 18 mutations caught, 35 dropped checks each caught; exit 0 | | clippy (takedown files) | `cargo clippy --locked --no-default-features --features takedown --all-targets` | 0 notes in `src/takedown*` (others pre-existing) | | relay, every target | `cargo test --locked -p joule-moq-relay --all-targets` | all pass (dvr: 8 passed) | | relay test loop | new DVR test ×12, dvr suite ×4 | 12/12, 4/4 | | relay clippy | `cargo clippy --locked -p joule-moq-relay --all-targets` | 0 new notes in the crate (2 pre-existing, untouched lines) | | relay dependents | `cargo build --locked -p joule-moq-ingest -p joule-moq-web`; `joule-moq-room`: `cargo test --locked --no-run` | build | | registry export | `cargo run --no-default-features --bin wai -- registry export` then `--check` | up to date | | registry tests | `cargo test --no-default-features --features <the CI set> --lib codecs::registry` | 14 passed | | corpus sidecar rule | `--test int_kernels_vectors every_decoded_output` | passed | | settlement (dependency) | `cargo test --no-default-features --features settlement --test settlement` | 4 passed | | lockfiles | `cargo metadata --locked --offline` (wai-rs, joule-code workspace, joule-moq-room) | ok (no lock change) | | repo checks (local) | `check-tests-in-ci.py`, `check-workflow-concurrency.sh`, `check-spec-refs.py`, `check-wai-section-refs.py`, `check-no-vanity-metrics.sh`, `test-public-text-checks.sh`, `check-comparative-prose.sh`, `check-orphan-sources.py` | all clean | | shared text | `live_moderation_verify.py` (§1 edited) | PASS | `check-public-names.sh` needs the CI secret; it was not run locally (a manual scan of the changed files found no names). ## Falsifications (committed first, then broken on the build host, then restored) | broken | expected failure | result | |---|---|---| | deadline rule (`last <= deadline` dropped) | `tests/takedown.rs` | exit 101 (`order-3h-missed` accepted) | | claim closure rule disabled | `tests/takedown.rs` | exit 101 | | `served` holder role removed | `tests/takedown.rs` | exit 101 (`cache-purge-missing`) | | relay: covered objects stored at seal time | DVR takedown test | exit 101 (identical copy stored) | | relay: cache-path withholding removed | DVR takedown test | exit 101 (cache served covered objects) | | relay: takedowns not reloaded on start | DVR takedown test | exit 101 (counts after restart) | | corpus stating an accepted late purge | `takedown_verify.py` on a copy | exit 1 | | each of the Python verifier's 35 checks dropped in turn | the corpus | each caught | Restored runs pass in each case. ## Negative controls in the corpus A derivative left out of the closure (`closure_incomplete`); a purge after the deadline (`deadline_missed`, never accepted); a purge signed by a party that never held the object, standing in for a holder's (`purge_missing`, its subjects `uncounted`); a perceptual match presented as exact (`match_as_exact`); a takedown of an object no derivation names claiming derivatives (`closure_unsupported`); a cache shown by acknowledgements to have served the thumbnail that never purged (`purge_missing`); and one case or more for every other reason of §11. ## Not done - No statement-of-reasons record is written for a takedown (§9.3 says why); counts are compatible by category, ground, automation and `puid`. - The relay does not filter the live fan-out; recording packages are not rewritten after sealing; the `wai http origin` command has no store to purge (its operator deletes files). Each is named in §10. - Takes and tracks are covered by name only; no record binds a track digest to its groups' receipts, so the closure does not reach through them (§6.2). - Reinstatement of a disabled object is not expressed in this revision. - The Gazette text of G.S.R. 120(E) itself was not read (the consolidated rules and the published questions and answers were). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- **Closed:** Landed in #428 (merge train, merged as aa61ab3b with all 65 checks green). 
extensions/takedown.md registers wai.media.takedown: a service's signed takedown of a
source (object, group, track or take) under a policy that pins a registry of regime
clocks (registry/takedown-clocks.json, read from Public Law 119-12 s3(a)(3), the IT
Rules 2021 rule 3(1)(d) and 3(2)(b) as amended by G.S.R. 120(E), Regulation (EU)
2024/1083 Art. 18(4) and Regulation (EU) 2022/2065 Art. 16(6)). The closure is
computed from deriving-edge records, synthesis origin claims and group receipts and
held to the takedown's stated set; perceptual matches are a class apart; holders sign
purges and the time to removal is held to the clock (purge_missing, deadline_missed,
window_not_observed); counts per clock, ground, category and source recompute.

The wai-rs module (feature takedown), its corpus (live-conformance/takedown, 31 cases
and 2 counts) and live-conformance/takedown_verify.py agree on every case.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
A takedown (WAI takedown §10.1) rides the track [K, takedown], 0, signed by K, a key in
dvr.takedown_keys or auth.authorities. The store erases every object whose content
hash its exact or matched set names, and every object of a track its exact set names
from a group on (erased reason 3), in every room; never stores one again (an identical
copy on another track included); withholds them from every FETCH, from the store and
the cache, to moderators too; logs the takedown in takedowns.wdl, verified again on
start; and signs a purge with the relay's key under purges/<link>.json, once.

Also: the takedown module's clippy notes (type aliases, slice::from_ref), and the
Python verifier memoises its signature checks.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
The record and its seven document kinds (wai-takedown, -clocks, -policy, -notice,
-match, -purge, -counts) in codecs/registry.rs, the export regenerated
(capabilities.json, vocab/v2.ttl, REGISTRY.md's table); SPEC §5's record list and a
paragraph; the CHANGELOG entry; the wai-conformance step (the module's unit tests,
tests/takedown.rs, takedown_verify.py) and its path; live-conformance/README.md; and a
pointer from live-moderation §1 to the sibling record.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: takedown — settlement acknowledgements show who served or received a covered object
Some checks failed
joule-moq-room room service / joule-moq-room, every target (pull_request) Successful in 1m55s
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Successful in 2m10s
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Successful in 26s
Details
WAI energy receipts / energy receipts · linux (pull_request) Successful in 10m0s
Details
wai-ops-gpu integer operators on GPUs / builds · no adapter is not a pass (linux) (pull_request) Successful in 1m50s
Details
wai-pack / wai-pack · linux (pull_request) Successful in 1m27s
Details
WAI conformance / cargo-class corpora · linux (pull_request) Successful in 19m22s
Details
wai-quantum studio and desktop / studio · browser (pull_request) Successful in 2m28s
Details
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Successful in 4m9s
Details
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 4m21s
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Successful in 38s
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Successful in 10s
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Successful in 24s
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Successful in 1m39s
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Successful in 16m11s
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Successful in 7m9s
Details
wai-pack / wai-pack · linux-arm64 (pull_request) Successful in 1m18s
Details
wai-pack / wai-pack · the floor through a media prober (pull_request) Successful in 23s
Details
wai-pack / wai-pack · dependency licences (pull_request) Successful in 1m10s
Details
wai-pack / wai-pack · independent verifier (Python) (pull_request) Successful in 4m0s
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Successful in 29m34s
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Successful in 7m7s
Details
wai-quantum studio and desktop / desktop app · macos (pull_request) Has been cancelled
Details
wai-pack / wai-pack · macos (pull_request) Has been cancelled
Details
wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
e96da2f6d7 
With wai.delivery.settlement on main, the reserved 'served' slot is filled: the upstream
of an acknowledgement or declaration whose item lists name a covered object is a holder
(role served), and the downstream of a hop's acknowledgement is one too (role received);
a sink is never held to purge. Acknowledgements read under settlement §3.6 with their
item lists recomputed (evidence_invalid otherwise), and count for the matched class too.
The corpus gains two acknowledgements (a viewer's from a cache outside the stores, and
that cache's from the relay), a case whose cache never purged (purge_missing) and one
whose item list does not recompute; the Python verifier reads them with
settlement_verify.py and gains two mutations and two droppable checks.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
dcharlot closed this pull request 2026-10-22 12:02:34 -04:00
Some checks failed
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Successful in 5s
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Successful in 6s
Details
wai-web reach builds / wai-web reach · does this change touch it (pull_request) Successful in 5s
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Successful in 2m47s
Details
wai-web reach builds / wai-web reach builds · the package of record, every output as recorded (pull_request) Successful in 2m42s
Details
wai-web reach builds / wai-web reach builds · this tree's wai-web, every rung on its engine line (pull_request) Successful in 4m34s
Details
repository checks / lockfiles, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Successful in 1m1s
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Successful in 1m49s
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Successful in 6s
Details
WAI conformance / does this change touch it (pull_request) Successful in 5s
Details
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Successful in 1m32s
Details
WAI energy receipts / does this change touch it (pull_request) Successful in 7s
Details
wai-ops-gpu integer operators on GPUs / does this change touch it (pull_request) Successful in 9s
Details
wai-pack / wai-pack · does this change touch it (pull_request) Successful in 8s
Details
wai-quantum studio and desktop / does this change touch it (pull_request) Successful in 8s
Details
wai-web wasm32 / does this change touch it (pull_request) Successful in 5s
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Successful in 1m55s
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Successful in 2m10s
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Successful in 26s
Details
WAI energy receipts / energy receipts · linux (pull_request) Successful in 10m0s
Details
wai-ops-gpu integer operators on GPUs / builds · no adapter is not a pass (linux) (pull_request) Successful in 1m50s
Details
wai-pack / wai-pack · linux (pull_request) Successful in 1m27s
Details
WAI conformance / cargo-class corpora · linux (pull_request) Successful in 19m22s
Details
wai-quantum studio and desktop / studio · browser (pull_request) Successful in 2m28s
Details
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Successful in 4m9s
Details
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 4m21s
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Successful in 38s
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Successful in 10s
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Successful in 24s
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Successful in 1m39s
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Successful in 16m11s
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Successful in 7m9s
Details
wai-pack / wai-pack · linux-arm64 (pull_request) Successful in 1m18s
Details
wai-pack / wai-pack · the floor through a media prober (pull_request) Successful in 23s
Details
wai-pack / wai-pack · dependency licences (pull_request) Successful in 1m10s
Details
wai-pack / wai-pack · independent verifier (Python) (pull_request) Successful in 4m0s
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Successful in 29m34s
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Successful in 7m7s
Details
wai-quantum studio and desktop / desktop app · macos (pull_request) Has been cancelled
Details
wai-pack / wai-pack · macos (pull_request) Has been cancelled
Details
wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
Transaction-Science/open-standards!420
No description provided.