Transaction-Science/open-standards
Watch
1
0
Fork
You've already forked open-standards
 0
Code Issues Pull requests Projects Releases 15 Packages Wiki Activity Actions

WAI for coding agents: wai mcp, the room service's API in OpenAPI 3.1 held to the code, wai setup-agent #500

Closed
dcharlot wants to merge 3 commits from wai/dx-agent-mcp into main
pull from: wai/dx-agent-mcp
merge into: Transaction-Science:main
Conversation 0 Commits 3 Files changed 20 +7689 -17
dcharlot commented 2026-10-26 18:24:43 -04:00
Owner
Copy link

WAI for coding agents: an MCP server (wai mcp), the room service's API described in OpenAPI 3.1 and held to the code, and wai setup-agent.

Base. Built on train/wai-e at 5b79d1550, because Train E (#499) had not merged when the work started. Until #499 lands, this PR's diff against main includes Train E's commits. This PR's own commits are 0ed57b7d9, cca79ed50 and 2b09b960e.

What is in it

wai mcp (wai-rs, feature mcp, no new dependency)

A Model Context Protocol server (revision 2025-06-18; it also answers clients that ask for 2025-03-26 or 2024-11-05). It speaks newline-delimited JSON-RPC on standard input and output. Standard output carries only the protocol.

The tools are kept in one table, src/bin/wai_cli/mcp/tools.rs, so renaming a tool changes one line. Each tool has an input schema, a one-line description, safety hints (readOnlyHint and the others), and returns structuredContent with the same JSON as text.

Tool Input Answer
inspect path (a .wai file or a directory) an envelope: its format (WAI1/WAI2), media and intent; each component's capability, licence class, tier, role, replicate class, pin and size, and whether this build decodes it; its checks (pin, component roles, candidates, integer payload). A directory: each .wai file read the same way, the capabilities with their licences, and the SHA-256 of the listing (SPEC §3.1)
list_capabilities media, licence, kind, status, contains (all optional) the registry entries that match, from codecs::registry
describe_capability capability its registry entry; what this build knows of it (dispatched standalone, companion-only, candidate, decoded here); the specification lines that name it
verify_receipt receipt; for an object receipt group and envelope_hex or envelope_path; optional previous the verdict, step and reason code, in the reference's order (jwp-receipts §3); the link hash for a group receipt, the evidence for an object receipt
verify_claim claim (wire text); context: previous, object, oer, gap_object the verdict, class and link hash, or the step and reason code (jwp-receipts §3.1). A claim whose figure is in another receipt is refused figure_not_held, as the reference refuses it without that receipt
verify_room_session descriptor, grants, key_log_head, chains (hex) accept, gap or refuse; the reason and where; the room id; who is present; how many records are in the merged order (live-rooms §9)
verify_audit_bundle bundle, owner, channels stream-audit §10's outcome
package_media input, capability, output, intent, fallback, companions, overwrite the envelope, written by wai wrap's code under its rules, inside the project directory only, never through a link, and never over a file unless overwrite is set
list_conformance each corpus and its independent verifier: the python3 -I <verifier> <corpus> lines of wai-conformance.yml, and every *-conformance/*_verify.py
run_conformance corpus, verifier, timeout_s whether the verifier passed, its exit code, how long it took, and the end of its output. Only *_verify.py scripts inside the tree are run
search_spec query, limit lines of SPEC.md, REGISTRY.md, extensions/ and glossary/ that hold every word of the query, each with its file, line and section heading
dev_room_start room_bin, publishers DEVELOPMENT ONLY. Starts joule-moq-room dev as a child process: a relay and a room service on 127.0.0.1, with a room. Returns the addresses and the room id
dev_grant principal (a name), role, service DEVELOPMENT ONLY. Asks a loopback room service for a grant. The test key is SHA-256 of the name under a fixed label. A service whose address is not a loopback address is refused before any connection is made, and no hostname is resolved
dev_join principal, objects DEVELOPMENT ONLY. The principal enters with its grant and a proof, and publishes audio and video. The answer comes once the room's clock has signed its join and publishes
dev_leave principal DEVELOPMENT ONLY. The principal's session closes; the answer comes once the clock has signed its leave
dev_room_session DEVELOPMENT ONLY. The room as a verifier is given it, ready for verify_room_session
dev_room_stop DEVELOPMENT ONLY. Stops the room

Flags: --spec-root <wai-dir> (or WAI_SPEC_ROOT; by default the tree the binary was built from), --room-bin <path> (or WAI_ROOM_BIN; by default joule-moq-room on PATH), --project <dir> (where the server may write; by default the directory it starts in), and --read-only (only the tools that read or run a verifier). No tool sends anything off the machine. The server's instructions name no tool.

The room service's API (joule-moq-room/openapi.json, OpenAPI 3.1)

The description covers every route of the service in every mode it keeps: 40 operations on 40 paths, with request bodies, answers, statuses and the grant-and-proof security schemes. tests/openapi_contract.rs holds it to the code in both directions:

  • routes: the (Method, "/path") arms the routers match (http.rs, messaging.rs, call.rs) are exactly the description's operations;
  • statuses, from the source: each operation names the functions that answer it. Every status the description lists must be one those functions return, and every status a function returns must be listed for an operation it answers. 405, the answer to a method a path does not take, is stated once in the description;
  • statuses, live: the service runs beside a relay in each mode: a plain room, end-to-end encryption, admission by age, co-performance, a watch room, a remote desktop room, a conversation, calls, without its relay, and a rate-limited service. Every operation is asked at least once in the mode that serves it, and every answer must be a status the description lists. Each probe must also reach the status it was written for. 130 of the 203 documented (operation, status) pairs are reached by the running service; 30 operations answer 200. A method a documented path does not take answers 405 (404 under /msg and the call paths).

joule-moq-room dev (src/dev.rs)

This runs the relay and the service in one process on loopback, with keys made at start and kept only in memory. Media tracks are held to no receipts and rate limits are open, and the program says on standard error that it is for development only. It answers JSON control lines (join, leave, session, describe, stop) and stops when its standard input closes. Its log goes to standard error. The change adds tokio's io-std feature; the lock file is unchanged.

wai setup-agent

In a project directory, wai setup-agent writes AGENTS.md (a WAI section between two markers, which it adds or replaces) and CLAUDE.md (a block that imports AGENTS.md). It also registers the server as wai in the project's MCP configuration files, by their documented formats. .mcp.json is always written. The project-level MCP files of four other agents are written when the project already holds that agent's directory or file, or with --all; --dry-run lists them. For one agent's settings, the file is also set to read AGENTS.md.

  • A file that does not exist is created. A file that exists is changed only after its diff is shown and the change is confirmed, by a prompt on a terminal or by --confirm. Without either, nothing that exists is changed, and the command exits 4 with every diff and the exact command that confirms them.
  • --dry-run writes nothing. Output is JSON when stdout is not a terminal, or with --json. Errors are structured, with a hint. Exit codes: 0 done, 1 failed, 2 usage, 4 confirmation required.
  • Every path it writes is checked against the project directory's canonical path, and a link among them is refused. A JSON file it cannot read as plain JSON (one with comments, say) is left alone, and the entry to add by hand is printed.

Design decisions

  • wai mcp lives in the wai binary, not the library, behind its own feature. The library opens no connection. The binary reaches a room service only on loopback, and only from the development tools.
  • The room runs as a child process (joule-moq-room dev), not inside wai. joule-moq-room depends on wai-rs, so wai-rs cannot depend on it. The child is driven by JSON control lines, and the MCP server asks for grants over HTTP itself. That keeps the loopback guard in the tool that takes a service address.
  • The end-to-end test lives in joule-moq-room, which has the room binary (CARGO_BIN_EXE_joule-moq-room), and it builds wai --features mcp into a target directory of its own. I found that when the two workspaces share one target directory, the wai lib artifacts built with different features get mixed: building the room crate after wai-rs in one target directory failed with wai::age_assurance missing. The test therefore never shares one.
  • One table of verbs in wai.rs (COMMANDS, MCP_COMMAND) and one table of tools, so the toolchain study can rename either at one line. wrap now returns its printed lines and its facts as JSON; the CLI prints the same text as before (cli_wrap_intent passes unchanged).
  • The verifiers mirror the reference runners' step order, so their verdicts agree with the corpora vector by vector: jwp-conformance's group and object procedures, and claim-conformance's claim procedure for the context the tool takes.
  • Agent-facing CLI conventions from the toolchain study applied to setup-agent: JSON off a terminal, a confirm gate with its own exit code, --dry-run, structured errors with hints. For the MCP server: safety hints on every tool, a read-only mode, and writes scoped to the project.
  • Streamable HTTP was not built. The study's finding is that remote MCP use means streamable HTTP with OAuth. That belongs to a hosted service, not to a local developer tool; stdio covers local use.

Checks

All runs are on the Framework box ([email protected] rb), since nothing here is macOS-specific. The room crate builds in its own target directory (CARGO_TARGET_DIR=$CARGO_TARGET_DIR/room).

Check Result
cd wai/wai-rs && cargo test --locked --no-default-features --features mcp --bin wai --test cli_mcp --test cli_setup_agent 5 + 10 + 5 passed
cd wai/wai-rs && cargo test --locked --no-default-features --test carriage --test manifest_builders --test cli_wrap_intent --test cli_registry --test corpus_provenance (the wrap refactor) 3 + 6 + 9 + 2 + 3 passed
cd wai/wai-rs && cargo build --locked --no-default-features --bin wai (no mcp) builds
cd joule-moq-room && cargo test --locked --all-targets every target passes: lib 20, age_admission 1, call_room 1, co_performance 1, mcp_dev_room 1, messaging_room 2, openapi_contract 3, remote_room 3, room_service 3, world_room 2
cargo test --test openapi_contract --test mcp_dev_room, five runs in a row 5 of 5 runs: mcp_dev_room 1 passed (6.1 to 6.7 s), openapi_contract 3 passed (31 to 41 s)
cargo clippy --no-default-features --features mcp --bin wai --test cli_mcp --test cli_setup_agent, and --no-default-features --bin wai no note in the new or changed code. The two print_literal notes in wai.rs (the inspect and capabilities header lines) predate this PR
cd joule-moq-room && cargo clippy --all-targets no note
cargo metadata --locked --offline --format-version 1, wai-rs and joule-moq-room both lock files current; no lock change
python3 -I scripts/check-tests-in-ci.py ok
./scripts/check-workflow-concurrency.sh 53 workflows, each grouped per ref
python3 scripts/check-spec-refs.py 1848 citations, all resolve
python3 scripts/check-wai-section-refs.py ok
bash scripts/check-no-vanity-metrics.sh, bash scripts/test-public-text-checks.sh, bash scripts/check-comparative-prose.sh, python3 scripts/check-orphan-sources.py all clean
scripts/check-public-names.sh on the 20 changed files, and the commit messages and this body checked against the same patterns clean
ruby -ryaml on every workflow parses

The wai library warns of two dead functions (unpinned_read, limbs) under these feature sets; that predates this PR.

Falsifications

Each was run on the committed tree with one guard broken, and restored with git checkout -- <file>.

Guard broken Test that fails
dev_room.rs: the loopback check made if false && !ip.is_loopback() mcp::dev_room::tests::only_a_loopback_service_is_taken (http://10.0.0.5:9682 taken), and cli_mcp::development_tools_refuse_any_service_off_this_machine: the tool then tried to connect to 10.0.0.5 (connection timed out)
tools.rs: the group receipt's signature check removed cli_mcp::receipts_agree_with_the_jwp_corpus_and_a_changed_one_is_refused: group_bad_signature accepted where the corpus refuses it
setup_agent.rs: the confirmation gate made let go = true || … cli_setup_agent::an_existing_file_changes_only_when_confirmed: exit 0 instead of 4, with AGENTS.md and .mcp.json changed without confirmation
http.rs: the (Method::GET, "/co/state") arm removed every_route_the_routers_match_is_documented_and_no_other (GET /co/state described but matched by no router), and the running check ([plain] GET /co/state answered 405)
openapi.json: 409 dropped from POST /grant the source check (http.rs:grant returns [409]), and the running check (POST /grant answered 409 … full)
openapi.json: 410 added to GET /room the source check (GET /room: openapi.json lists [410], which none of [http.rs handle] returns)

Not done

  • Streamable HTTP and OAuth for remote use (see above). There is no hosted server.
  • Packaging (package_media) is wai wrap's single-file envelope. Building a package of a whole title (wai-pack, packaging.md) is not a tool here.
  • verify_claim takes the context previous, object, oer and gap_object. It does not take figure, the session contexts (outputs, objects, envelopes, stage_claims, redecoded) or a recovery's declaration. Those claims are verified on the claim alone, and a claim that needs its figure is refused figure_not_held, as the reference does.
  • verify_receipt covers JWP delivery receipts (group and object). It does not cover other receipt families, such as package receipts, OER receipts on their own, or composition and metering receipts.
  • run_conformance runs a corpus's independent Python verifier. It does not also run the Rust reference over the corpus.
  • setup-agent writes no user-level configuration, so agents that read only a file in the user's home directory are not registered (that would be outside the project).
  • Nothing is published to a package registry, and nothing is deployed.

For the owner

  • Package registries. Out of scope here. Publishing wai with the feature mcp (or adding mcp to the default features) would make wai mcp one install away; today it is cargo install --path wai/wai-rs --no-default-features --features mcp. joule-moq-room would need publishing too for the development room.
  • Which coding agents first. .mcp.json is always written; four more project-level formats are written where the project already holds that agent's directory or file. Whether to keep all five, add user-level ones (outside the project, which the brief excludes), or narrow the list is a decision for the toolchain study.
  • Names. Every verb, tool, flag and file introduced here is in one table each, ready for the toolchain study to adopt or rename.

🤖 Generated with Claude Code

Closed: Replaced by #505 (wai/dx-agent-mcp-2): these commits rebased onto main after #504, linear, with the toolchain names approved on 2026-10-27 (tools named by their operations, in toolsets; catalogue operationIds; setup-agent on the JSON envelope and exit table).

WAI for coding agents: an MCP server (`wai mcp`), the room service's API described in OpenAPI 3.1 and held to the code, and `wai setup-agent`. **Base.** Built on `train/wai-e` at 5b79d1550, because Train E (#499) had not merged when the work started. Until #499 lands, this PR's diff against main includes Train E's commits. This PR's own commits are 0ed57b7d9, cca79ed50 and 2b09b960e. ## What is in it ### `wai mcp` (wai-rs, feature `mcp`, no new dependency) A Model Context Protocol server (revision 2025-06-18; it also answers clients that ask for 2025-03-26 or 2024-11-05). It speaks newline-delimited JSON-RPC on standard input and output. Standard output carries only the protocol. The tools are kept in one table, `src/bin/wai_cli/mcp/tools.rs`, so renaming a tool changes one line. Each tool has an input schema, a one-line description, safety hints (`readOnlyHint` and the others), and returns `structuredContent` with the same JSON as text. | Tool | Input | Answer | |---|---|---| | `inspect` | `path` (a `.wai` file or a directory) | an envelope: its format (WAI1/WAI2), media and intent; each component's capability, licence class, tier, role, replicate class, pin and size, and whether this build decodes it; its checks (pin, component roles, candidates, integer payload). A directory: each `.wai` file read the same way, the capabilities with their licences, and the SHA-256 of the listing (SPEC §3.1) | | `list_capabilities` | `media`, `licence`, `kind`, `status`, `contains` (all optional) | the registry entries that match, from `codecs::registry` | | `describe_capability` | `capability` | its registry entry; what this build knows of it (dispatched standalone, companion-only, candidate, decoded here); the specification lines that name it | | `verify_receipt` | `receipt`; for an object receipt `group` and `envelope_hex` or `envelope_path`; optional `previous` | the verdict, step and reason code, in the reference's order (jwp-receipts §3); the link hash for a group receipt, the evidence for an object receipt | | `verify_claim` | `claim` (wire text); context: `previous`, `object`, `oer`, `gap_object` | the verdict, class and link hash, or the step and reason code (jwp-receipts §3.1). A claim whose figure is in another receipt is refused `figure_not_held`, as the reference refuses it without that receipt | | `verify_room_session` | `descriptor`, `grants`, `key_log_head`, `chains` (hex) | accept, gap or refuse; the reason and where; the room id; who is present; how many records are in the merged order (live-rooms §9) | | `verify_audit_bundle` | `bundle`, `owner`, `channels` | stream-audit §10's outcome | | `package_media` | `input`, `capability`, `output`, `intent`, `fallback`, `companions`, `overwrite` | the envelope, written by `wai wrap`'s code under its rules, inside the project directory only, never through a link, and never over a file unless `overwrite` is set | | `list_conformance` | | each corpus and its independent verifier: the `python3 -I <verifier> <corpus>` lines of wai-conformance.yml, and every `*-conformance/*_verify.py` | | `run_conformance` | `corpus`, `verifier`, `timeout_s` | whether the verifier passed, its exit code, how long it took, and the end of its output. Only `*_verify.py` scripts inside the tree are run | | `search_spec` | `query`, `limit` | lines of SPEC.md, REGISTRY.md, `extensions/` and `glossary/` that hold every word of the query, each with its file, line and section heading | | `dev_room_start` | `room_bin`, `publishers` | DEVELOPMENT ONLY. Starts `joule-moq-room dev` as a child process: a relay and a room service on 127.0.0.1, with a room. Returns the addresses and the room id | | `dev_grant` | `principal` (a name), `role`, `service` | DEVELOPMENT ONLY. Asks a loopback room service for a grant. The test key is SHA-256 of the name under a fixed label. A service whose address is not a loopback address is refused before any connection is made, and no hostname is resolved | | `dev_join` | `principal`, `objects` | DEVELOPMENT ONLY. The principal enters with its grant and a proof, and publishes audio and video. The answer comes once the room's clock has signed its join and publishes | | `dev_leave` | `principal` | DEVELOPMENT ONLY. The principal's session closes; the answer comes once the clock has signed its leave | | `dev_room_session` | | DEVELOPMENT ONLY. The room as a verifier is given it, ready for `verify_room_session` | | `dev_room_stop` | | DEVELOPMENT ONLY. Stops the room | Flags: `--spec-root <wai-dir>` (or `WAI_SPEC_ROOT`; by default the tree the binary was built from), `--room-bin <path>` (or `WAI_ROOM_BIN`; by default `joule-moq-room` on `PATH`), `--project <dir>` (where the server may write; by default the directory it starts in), and `--read-only` (only the tools that read or run a verifier). No tool sends anything off the machine. The server's `instructions` name no tool. ### The room service's API (`joule-moq-room/openapi.json`, OpenAPI 3.1) The description covers every route of the service in every mode it keeps: 40 operations on 40 paths, with request bodies, answers, statuses and the grant-and-proof security schemes. `tests/openapi_contract.rs` holds it to the code in both directions: - **routes:** the `(Method, "/path")` arms the routers match (`http.rs`, `messaging.rs`, `call.rs`) are exactly the description's operations; - **statuses, from the source:** each operation names the functions that answer it. Every status the description lists must be one those functions return, and every status a function returns must be listed for an operation it answers. 405, the answer to a method a path does not take, is stated once in the description; - **statuses, live:** the service runs beside a relay in each mode: a plain room, end-to-end encryption, admission by age, co-performance, a watch room, a remote desktop room, a conversation, calls, without its relay, and a rate-limited service. Every operation is asked at least once in the mode that serves it, and every answer must be a status the description lists. Each probe must also reach the status it was written for. 130 of the 203 documented (operation, status) pairs are reached by the running service; 30 operations answer 200. A method a documented path does not take answers 405 (404 under `/msg` and the call paths). ### `joule-moq-room dev` (`src/dev.rs`) This runs the relay and the service in one process on loopback, with keys made at start and kept only in memory. Media tracks are held to no receipts and rate limits are open, and the program says on standard error that it is for development only. It answers JSON control lines (`join`, `leave`, `session`, `describe`, `stop`) and stops when its standard input closes. Its log goes to standard error. The change adds tokio's `io-std` feature; the lock file is unchanged. ### `wai setup-agent` In a project directory, `wai setup-agent` writes `AGENTS.md` (a WAI section between two markers, which it adds or replaces) and `CLAUDE.md` (a block that imports AGENTS.md). It also registers the server as `wai` in the project's MCP configuration files, by their documented formats. `.mcp.json` is always written. The project-level MCP files of four other agents are written when the project already holds that agent's directory or file, or with `--all`; `--dry-run` lists them. For one agent's settings, the file is also set to read AGENTS.md. - A file that does not exist is created. A file that exists is changed only after its diff is shown and the change is confirmed, by a prompt on a terminal or by `--confirm`. Without either, nothing that exists is changed, and the command exits **4** with every diff and the exact command that confirms them. - `--dry-run` writes nothing. Output is JSON when stdout is not a terminal, or with `--json`. Errors are structured, with a hint. Exit codes: 0 done, 1 failed, 2 usage, 4 confirmation required. - Every path it writes is checked against the project directory's canonical path, and a link among them is refused. A JSON file it cannot read as plain JSON (one with comments, say) is left alone, and the entry to add by hand is printed. ## Design decisions - **`wai mcp` lives in the `wai` binary, not the library**, behind its own feature. The library opens no connection. The binary reaches a room service only on loopback, and only from the development tools. - **The room runs as a child process (`joule-moq-room dev`), not inside `wai`.** `joule-moq-room` depends on wai-rs, so wai-rs cannot depend on it. The child is driven by JSON control lines, and the MCP server asks for grants over HTTP itself. That keeps the loopback guard in the tool that takes a service address. - **The end-to-end test lives in joule-moq-room**, which has the room binary (`CARGO_BIN_EXE_joule-moq-room`), and it builds `wai --features mcp` into a target directory of its own. I found that when the two workspaces share one target directory, the `wai` lib artifacts built with different features get mixed: building the room crate after wai-rs in one target directory failed with `wai::age_assurance` missing. The test therefore never shares one. - **One table of verbs in wai.rs** (`COMMANDS`, `MCP_COMMAND`) and **one table of tools**, so the toolchain study can rename either at one line. `wrap` now returns its printed lines and its facts as JSON; the CLI prints the same text as before (`cli_wrap_intent` passes unchanged). - **The verifiers mirror the reference runners' step order**, so their verdicts agree with the corpora vector by vector: jwp-conformance's group and object procedures, and claim-conformance's claim procedure for the context the tool takes. - **Agent-facing CLI conventions from the toolchain study** applied to `setup-agent`: JSON off a terminal, a confirm gate with its own exit code, `--dry-run`, structured errors with hints. For the MCP server: safety hints on every tool, a read-only mode, and writes scoped to the project. - **Streamable HTTP was not built.** The study's finding is that remote MCP use means streamable HTTP with OAuth. That belongs to a hosted service, not to a local developer tool; stdio covers local use. ## Checks All runs are on the Framework box (`[email protected] rb`), since nothing here is macOS-specific. The room crate builds in its own target directory (`CARGO_TARGET_DIR=$CARGO_TARGET_DIR/room`). | Check | Result | |---|---| | `cd wai/wai-rs && cargo test --locked --no-default-features --features mcp --bin wai --test cli_mcp --test cli_setup_agent` | 5 + 10 + 5 passed | | `cd wai/wai-rs && cargo test --locked --no-default-features --test carriage --test manifest_builders --test cli_wrap_intent --test cli_registry --test corpus_provenance` (the `wrap` refactor) | 3 + 6 + 9 + 2 + 3 passed | | `cd wai/wai-rs && cargo build --locked --no-default-features --bin wai` (no `mcp`) | builds | | `cd joule-moq-room && cargo test --locked --all-targets` | every target passes: lib 20, age_admission 1, call_room 1, co_performance 1, mcp_dev_room 1, messaging_room 2, openapi_contract 3, remote_room 3, room_service 3, world_room 2 | | `cargo test --test openapi_contract --test mcp_dev_room`, five runs in a row | 5 of 5 runs: mcp_dev_room 1 passed (6.1 to 6.7 s), openapi_contract 3 passed (31 to 41 s) | | `cargo clippy --no-default-features --features mcp --bin wai --test cli_mcp --test cli_setup_agent`, and `--no-default-features --bin wai` | no note in the new or changed code. The two `print_literal` notes in wai.rs (the `inspect` and `capabilities` header lines) predate this PR | | `cd joule-moq-room && cargo clippy --all-targets` | no note | | `cargo metadata --locked --offline --format-version 1`, wai-rs and joule-moq-room | both lock files current; no lock change | | `python3 -I scripts/check-tests-in-ci.py` | ok | | `./scripts/check-workflow-concurrency.sh` | 53 workflows, each grouped per ref | | `python3 scripts/check-spec-refs.py` | 1848 citations, all resolve | | `python3 scripts/check-wai-section-refs.py` | ok | | `bash scripts/check-no-vanity-metrics.sh`, `bash scripts/test-public-text-checks.sh`, `bash scripts/check-comparative-prose.sh`, `python3 scripts/check-orphan-sources.py` | all clean | | `scripts/check-public-names.sh` on the 20 changed files, and the commit messages and this body checked against the same patterns | clean | | `ruby -ryaml` on every workflow | parses | The `wai` library warns of two dead functions (`unpinned_read`, `limbs`) under these feature sets; that predates this PR. ## Falsifications Each was run on the committed tree with one guard broken, and restored with `git checkout -- <file>`. | Guard broken | Test that fails | |---|---| | `dev_room.rs`: the loopback check made `if false && !ip.is_loopback()` | `mcp::dev_room::tests::only_a_loopback_service_is_taken` (`http://10.0.0.5:9682` taken), and `cli_mcp::development_tools_refuse_any_service_off_this_machine`: the tool then **tried to connect** to 10.0.0.5 (`connection timed out`) | | `tools.rs`: the group receipt's signature check removed | `cli_mcp::receipts_agree_with_the_jwp_corpus_and_a_changed_one_is_refused`: `group_bad_signature` accepted where the corpus refuses it | | `setup_agent.rs`: the confirmation gate made `let go = true \|\| …` | `cli_setup_agent::an_existing_file_changes_only_when_confirmed`: exit 0 instead of 4, with AGENTS.md and .mcp.json changed without confirmation | | `http.rs`: the `(Method::GET, "/co/state")` arm removed | `every_route_the_routers_match_is_documented_and_no_other` (`GET /co/state` described but matched by no router), and the running check (`[plain] GET /co/state answered 405`) | | `openapi.json`: 409 dropped from `POST /grant` | the source check (`http.rs:grant returns [409]`), and the running check (`POST /grant answered 409 … full`) | | `openapi.json`: 410 added to `GET /room` | the source check (`GET /room: openapi.json lists [410], which none of [http.rs handle] returns`) | ## Not done - Streamable HTTP and OAuth for remote use (see above). There is no hosted server. - Packaging (`package_media`) is `wai wrap`'s single-file envelope. Building a package of a whole title (`wai-pack`, packaging.md) is not a tool here. - `verify_claim` takes the context `previous`, `object`, `oer` and `gap_object`. It does not take `figure`, the session contexts (`outputs`, `objects`, `envelopes`, `stage_claims`, `redecoded`) or a recovery's `declaration`. Those claims are verified on the claim alone, and a claim that needs its figure is refused `figure_not_held`, as the reference does. - `verify_receipt` covers JWP delivery receipts (group and object). It does not cover other receipt families, such as package receipts, OER receipts on their own, or composition and metering receipts. - `run_conformance` runs a corpus's independent Python verifier. It does not also run the Rust reference over the corpus. - `setup-agent` writes no user-level configuration, so agents that read only a file in the user's home directory are not registered (that would be outside the project). - Nothing is published to a package registry, and nothing is deployed. ## For the owner - **Package registries.** Out of scope here. Publishing `wai` with the feature `mcp` (or adding `mcp` to the default features) would make `wai mcp` one install away; today it is `cargo install --path wai/wai-rs --no-default-features --features mcp`. `joule-moq-room` would need publishing too for the development room. - **Which coding agents first.** `.mcp.json` is always written; four more project-level formats are written where the project already holds that agent's directory or file. Whether to keep all five, add user-level ones (outside the project, which the brief excludes), or narrow the list is a decision for the toolchain study. - **Names.** Every verb, tool, flag and file introduced here is in one table each, ready for the toolchain study to adopt or rename. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- **Closed:** Replaced by #505 (wai/dx-agent-mcp-2): these commits rebased onto main after #504, linear, with the toolchain names approved on 2026-10-27 (tools named by their operations, in toolsets; catalogue operationIds; setup-agent on the JSON envelope and exit table). 
A new crate, wai/wai-ops-npu, with no dependency but wai-ops. Its kernel runs
on one compute core of a tile array, built at run time with the array's open
toolchain; its host side is compiled against the device runtime and loaded.
The interpreter runs each graph through wai_ops::run_with and asks the core for
every arithmetic operator's outputs: conv and conv_transpose as multiply-
accumulate lines (8- and 16-bit operands into 32-bit accumulator lanes, 32-bit
operands into 64-bit lanes, the width the certificate's mac record allows),
rescale, chscale and mul through the unit's shift-round step under the mode
that is the operator's rounding, the elementwise operators, and lut16 a table
block at a time. Movement, policies, checks and state stay the interpreter's.

The unit's shift-round step is exact for shifts 0..59 only: it takes 60..63 as
a left shift by 64 - s (measured), so those shifts go through the core's scalar
unit in 64-bit arithmetic.

Tests: the corpus (every graph vector in the subset, against the committed
results and the interpreter), the rounding, saturation, lane and
requantisation probes, twelve kernel edits the corpus must catch, and the
graphs outside the subset by acc32 alone, which are not exact here.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
One line per graph vector of vectors/ and graphs/ whose graph loads, with the
npu, npu_flags and npu_reasons of its graph's own verdict (§8.5): the vectors an
operator implementation of the accelerator subset must reproduce, and the
features each exercises. The generator (wai-verify vectors gen) writes it, so
vectors verify requires its bytes; the independent checker computes it from
its own bounds pass and requires the same bytes. 733 of the 1635 graph vectors
that load are in the subset.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
- ops-npu-bench: time and energy of the corpus and of an int_synth graph on
  the device and on the CPU, every device result compared with the
  interpreter's first; the package's energy counter (a vendor counter) and the
  device runtime's own estimate (a model), each named as what it is.
- wai-ops-npu.yml: on the linux-amd runner, the probes, the corpus, the twelve
  kernel edits and the width test on the device, with the device declared and
  required; on linux-arm64, the crate builds and an absent device is SKIPPED
  without WAI_OPS_NPU_REQUIRE and a failure with it.
- The corpus test requires the vectors it runs to be exactly those npu.jsonl
  lists in the subset.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
- §9.5: how wai/wai-ops-npu runs the subset; the unit's arithmetic as
  measured (which of its rounding modes is which rounding of §2 and at which
  shifts, its shifts of 60 to 63, its saturation and its accumulator lanes);
  the results by neural processor; time and energy with each reading's class;
  and, per operator, what the Web Neural Network API's Candidate
  Recommendation Draft of 21 October 2026 allows exactly, and why not
  through its convolution, matrix and quantize operators.
- §14.5: npu.jsonl, the subset's vectors.
- determinism-tiers §5 and §6: the device run; no decoder runs its graphs on
  a neural processor yet, so the tier is not claimed for a decode there.
- SPEC, CHANGELOG, the corpus README with the command that runs it by hand.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
npu.jsonl is a .jsonl file that is not a vector file; step 4 already checks it
as the generator writes it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
prior-carriage §9 to §14 and Appendix A: wai.prior.safetensors and
wai.prior.gguf registered as prior forms and listed as established exact;
the integer-quantised profile wai-int/1 with the bindings wsr1/1 and
whm1/1; the digest rule (a canonical file per form); the NNC reader and
writer for the subset an open implementation of the 2024 edition reads
(integer tensors under the context-adaptive arithmetic coding, raw
floats), with where it stops. wai-rs: prior_wire (feature prior_wire),
the corpus generator wai_prior_forms_vectors and tests/prior_wire.rs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
integer-operators §9.5: the CR's sections cited as such, and the work counted in the core's units
Some checks failed
wai formal verification (integer core) / kani (integer-core) (pull_request) Has been cancelled
Details
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
wai cross-architecture byte-equality / does this change touch it (pull_request) Has been cancelled
Details
wai cross-architecture byte-equality / linux-aarch64 (pull_request) Has been cancelled
Details
wai cross-architecture byte-equality / linux-x86_64 (pull_request) Has been cancelled
Details
wai cross-architecture byte-equality / macos-arm64 (reference) (pull_request) Has been cancelled
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
repository checks / lockfiles, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Has been cancelled
Details
08f4d23146 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
prior_forms_verify.py implements prior-carriage §9 to §12 and Appendix A
from the text (strict readers, canonical writers, the arithmetic coder both
ways, both bindings) and agrees with wai-rs on every vector; it also flips
bytes of every accepted file and requires each copy to be caught.

§12.4 records the measurement: an open implementation of ISO/IEC 15938-17
reads our NNC files to the same integers, its encoder writes byte-identical
data units, and our reader reads its bitstreams. tools/nnc_interop_check.py
is the check; it runs that implementation's code and is not a CI step.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-rs scene_map (feature scene_map): a bundle (a WWLD world, a WSCN audio
scene, timed media items by content hash) exported as a glTF 2.0 document
with MPEG_media, MPEG_buffer_circular, MPEG_accessor_timed,
MPEG_audio_spatial and MPEG_texture_video, and as a USDA layer of the USD
Core Specification v1.0.1 (prims, translate ops, time samples, asset
references by urn:wai:asset), each carrying the bundle's bytes exactly;
imports read a WAI-written document back to the same bundle (refused
unless re-exporting gives the same bytes) and a foreign one to new WAI
bytes, refused where a value would not carry exactly. Corpus generator
wai_scene_vectors and tests/scene_map.rs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
extensions/scene-carriage.md: the bundle, the numbers that cross the
mapping, the glTF document (MPEG_media, MPEG_buffer_circular,
MPEG_accessor_timed, MPEG_audio_spatial, MPEG_texture_video) and the USD
layer each direction writes and reads, the refusals and the corpus.
scene_verify.py implements it from the text and agrees with wai-rs on
every vector; it also flips bytes of every exported document and
requires each copy to be caught.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Each probe identifies a payload as its capability's format and reads the
parameters its headers state, or refuses it with one of thirteen codes
(extensions/format-probes.md §12). Pure integer code over bytes, feature
format_probe, no new dependency. The corpus module generates and checks
format-probe-conformance/; wai_format_probe probes a file, generates the
corpus and verifies it, with the fetched LCEVC streams.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
JPEG XS (image and video, StandardDefined on ISO/IEC 21122-4's strict
conformance point, which the registration requires of a sink), MV-HEVC
(StandardDefined on H.265 (V11) §F.13.5.1), the WPJ1 projection
descriptor (a companion, as the HDR descriptors are) and IEEE 1857.11
(a candidate: its text is not openly readable and its reference software
writes no start code). SPEC §5 and §7, the registry export, the glossary
links and the research registry.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
External vectors written by permissively licensed encoders at pinned
revisions from synthetic pictures (tools/make_external.sh, provenance.json),
generated vectors and negative controls, the facts each encoder was asked
for, the LCEVC streams fetch.sh fetches by digest, and
format_probe_verify.py, written from the two texts.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai.prior.safetensors and wai.prior.gguf join SPEC §5's prior-artifact
table (lossless, royalty-free, StandardDefined, established exact); the
NNC row says what the reference now reads. Wire identifiers wai-int/1,
wsr1/1, whm1/1 (prior-carriage §10), wai-scene/1 and urn:wai:asset:
(scene-carriage §2). A §5 paragraph states scene carriage. The registry
export is regenerated. wai-conformance.yml runs both modules' tests and
both independent verifiers, and fires on edits of the two extension
texts. Clippy notes on the new code fixed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
delivery-telemetry §6.6 reads a CMSD field back into the description
§6.1 to §6.3 write, passing over other senders' keys, and refuses with
cmsd_malformed, cmsd_type or cmsd_version; §10 lists the extension's
CMCD and CMSD custom keys in full, and the registry lists each as a wire
identifier of the new kind telemetry-key (and WPJ1, the projection
descriptor's magic). telemetry-conformance/cmsd-read/ holds the fields
and their outcomes; cmsd_read_verify.py is the second implementation.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Positions where JSON and USD switch to exponent form, binary32 and
binary64 ties in both directions, the least step and the largest value,
so a verifier that spells or rounds one of them otherwise fails.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
scene corpus: a transform operation the layer's order does not list is refused too
Some checks failed
WAI HTTP delivery / HTTP corpus · every patch and mutation in exactly one shard (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · verified both ways, and the differential (pull_request) Has been cancelled
Details
WAI HTTP delivery / cache rules · controls and labelled caches (pull_request) Has been cancelled
Details
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
repository checks / lockfiles, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Has been cancelled
Details
6064a35c82 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
extensions/loc-carriage.md maps an envelope whose payload is one WebCodecs
chunk (an Opus packet, an AVC or HEVC access unit in Annex B, an ADTS
frame) onto one object of a track of packaging loc (draft-ietf-moq-loc-04):
the payload as the LOC Payload, the manifest as the Immutable Property
WAI_MANIFEST (0x3A61), the receipt commitment as WAI_RECEIPT. A reader
rebuilds the envelope byte for byte and checks the receipt against it,
refusing with the extension's codes. joule-moq's loc module writes and
reads; its example writes the corpus and tests/loc_vectors.rs checks it;
loc_verify.py is the second implementation. WAI_MANIFEST is registered as
a wire identifier; moq-streaming-format §6 points to the carriage.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-conformance: the probe unit tests on every leg and the feature built
alone and for wasm32; a step running tests/format_probe.rs, the fetched
LCEVC streams under wai_format_probe and format_probe_verify.py; steps for
cmsd_read_verify.py and loc_verify.py; the new extensions in its paths.
joule-code-conformance: the LOC corpus and the H.265 vector it reads in
its paths. SPEC cites format-probes by its headed section.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Registers wai.avatar.face (GenerativeDeterministic, ops face-int/1, one-file parameter set):
the WFG1 generator, WFI1 identity prior and WFK1 keypoint segment readers and writers; the
driver's integer warp and keypoint maps; the lowering face-int/1 to one wai-ops/1-i32 graph,
with the same arithmetic written out loop by loop for the tests; the identity and track
records; verification over them and synthesis's claims, log and label policy; the corpus
generator (bin wai_avatar_face_vectors) and the corpus and GPU tests. Registry export
regenerated.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
live-conformance/avatar-face: the generator trained on faces the tool draws, two held-out
identity priors and their tracks, the training report, the seeded generator and identity, and
vectors.json (forms, frames, cases). avatar_face_verify.py runs the driver and the generator's
arithmetic in Python's integers, verifies records and synthesis, and mutates the corpus.
tools/wai_avatar_face_train.py renders the faces, trains, quantises and measures.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
The extension text of wai.avatar.face, its SPEC §3.1, §5 and §7 entries, the determinism-tiers
fabric and evidence rows, and the changelog.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
format-probe-conformance: README with the corpus's provenance, licences and what was measured
Some checks failed
WAI HTTP delivery / HTTP corpus · every patch and mutation in exactly one shard (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · verified both ways, and the differential (pull_request) Has been cancelled
Details
WAI HTTP delivery / cache rules · controls and labelled caches (pull_request) Has been cancelled
Details
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
repository checks / lockfiles, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Has been cancelled
Details
da3c09c5a1 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-ops-npu: the package energy counter is an OnChipCounter, not HwShunt
Some checks failed
wai formal verification (integer core) / kani (sound) (pull_request) Has been cancelled
Details
wai formal verification (integer core) / kani (stage) (pull_request) Has been cancelled
Details
wai formal verification (integer core) / kani (rans64-t2) (pull_request) Has been cancelled
Details
wai formal verification (integer core) / kani (stage-long) (pull_request) Has been cancelled
Details
wai formal verification (integer core) / kani (integer-core) (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
wai cross-architecture byte-equality / linux-aarch64 (pull_request) Has been cancelled
Details
wai cross-architecture byte-equality / macos-arm64 (reference) (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
repository checks / lockfiles, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
wai cross-architecture byte-equality / linux-x86_64 (pull_request) Has been cancelled
Details
WAI conformance / does this change touch it (pull_request) Has been cancelled
Details
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 9m41s
Details
standards workspaces build + test / macOS energy backends (pull_request) Successful in 12m32s
Details
069b551c85 
The powercap package-0 counter is an on-chip vendor counter, so its class is
OnChipCounter (energy-measurement §2), with the whole package as its scope.
HwShunt is the legacy class, accepted when read and never emitted (§2.6).
Corrected in integer-operators §9.5, the CHANGELOG entry and the bench's
documentation.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
A frame rarely reads the table at 0, so the frames alone did not catch a table without §7.6's
clamp (the second implementation passed with it). The corpus now states the table's SHA-256 and
its entries at nine values, and both implementations check them.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Merge remote-tracking branch 'origin/main' into wai/avatar-telepresence
Some checks failed
wai-ops-gpu integer operators on GPUs / does this change touch it (pull_request) Has been cancelled
Details
wai-ops-gpu integer operators on GPUs / builds · no adapter is not a pass (linux) (pull_request) Has been cancelled
Details
wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Has been cancelled
Details
WAI neural sink gates / does this change touch it (pull_request) Has been cancelled
Details
WAI neural sink gates / model-free refusals of the neural sink (pull_request) Has been cancelled
Details
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / faces from keypoints under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
repository checks / lockfiles, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
9804962c0b 
stream-termination.md registers wai.live.termination: a sink's signed
stream log (WSL1) with an open record (autoplay setting, termination
policy, display declaration, ladder), a receipt per segment (the
rendition's match against the panel, each hop's joules with its class),
observations (visibility, occlusion, display power, interaction) and a
termination with its reason, media time and totals per hop and class.
capability-constraints §4 adds the display declaration, the match and
the admissible renditions, and wai:transfer to the register.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
stream_termination_verify.py is the corpus's second implementation,
written from the two extensions' text; it agrees with wai-rs on every
match and log and requires every mutated copy to fail. The browser
sink's register follows capability-constraints §3.1, and a test holds
the two to each other.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai_determinism_cost.py selects the pinned reference set's self-test
pictures, exports mbt2018_mean at all eight published qualities to integer
sets (each checkpoint pinned by SHA-256), codes every picture with both
codecs, decodes the float streams on any device, and computes distortion,
BD-rate and the record's summary. wai_det_energy.py times a decoder child
in rounds and reads its counters around them (per-task CPU energy and the
GPU rail on macOS, package energy on Linux), with idle brackets.
wai_det_cost (wai-rs bin, neural_int; ops_gpu for a GPU) decodes WIH1
payloads through int_payload::decode_int, and serves timed rounds.
wai_determinism_cost_verify.py recomputes the record's summary from its
readings and checks every figure the text quotes from it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-live-web gains StreamLog (records written by wai-rs's writer), the
panel match, the log verifier and the corpus check for a page, and
wai_live_web termination-verify for the host. The room page keeps a
stream log for each track it receives (web/room/termination.js): the
panel it declares, segment receipts with the match, the observations of
visibility, occlusion and interaction, and a signed termination when a
video stream has been unseen for its grace; the subscription is then
ended and the audio kept, and a new log opens when the page is seen.
The e2e scenario drives the receiving page over the DevTools protocol
so its tab really goes to the background.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The lock still named 0.6.12 after wai-quantum moved to 0.6.14, so every
--locked build of the room service refused to start (its CI job, and
joule-moq-web's end-to-end run, which builds it). Resolve-only refresh.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The per-host scripts that took the readings (build host, two x86_64
hosts) go beside the record, with how each platform is tagged. The
summary gains the integer decodes' total across platforms and the PSNR
change of float decodes whose entropy decode diverged, in both the tool
and its independent verifier; per-decode energy is stated in joules.
wai_det_energy reads each accelerator client's GPU time per registry
node. The conformance workflow's independent-verifiers job checks the
record, the texts quoting it, and the decoder bin.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Two mutations of the reference survived the corpus: ignoring a display
record's declaration, and restarting a signal's grace at a repeated
observation. Each now changes a log's outcome.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
research/determinism-cost.md and its record (record.json): mbt2018_mean at
all eight published qualities, integer export against the model's own
float codec, on the pinned reference set's 24 self-test pictures. BD-rate
by PSNR and MS-SSIM per picture; each codec's decodes repeated across nine
integer and seven float platforms and compared byte for byte, the float
ones placed in or after the entropy decode; decode time and energy with
counter, scope, idle brackets, liveness and ratio over seven rounds.

determinism-tiers §7.1 quotes the record, each figure tied to its place in
it by a marker the verifier checks; §7.2 says what WAI claims and does not,
and makes normative that a record figure is never stated beyond what the
record names, that no receipt takes its energy from it, and that a cost
figure in the spec names its measurement. SPEC §5's int_hyper row points
to §7. CHANGELOG entry.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
energy-measurement §3.1's liveness rule (two advances in a row, five or
more, four in five, over 300 ms) for the busy bracket and both idle
brackets, recomputed from the bracket facts the record keeps, as the tool
that writes the record applies it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
cbindgen skips the module, whose record constants are not part of the C
surface, so include/wai.h is unchanged by a build.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Two-point Gauss-Legendre on each knot interval's share of the common
range is exact for the cubic the interpolant carries there, so the
verifier's BD-rates agree with the tool's analytic integral to float
precision, and a one-unit change in one picture's SSE no longer falls
inside the tolerance.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
det_cost_bin: a refusal line must carry its code exactly
Some checks failed
wai-pack / wai-pack · independent verifier (Python) (pull_request) Has been cancelled
Details
wai-pack / wai-pack · the floor through a media prober (pull_request) Has been cancelled
Details
wai-pack / wai-pack · dependency licences (pull_request) Has been cancelled
Details
wai-ops-gpu integer operators on GPUs / does this change touch it (pull_request) Has been cancelled
Details
wai-ops-gpu integer operators on GPUs / builds · no adapter is not a pass (linux) (pull_request) Has been cancelled
Details
wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Has been cancelled
Details
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
repository checks / lockfiles, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
4863036d8a 
The test compared a refusal line by prefix, so a decoder reporting
`bad_magicx` for `bad_magic` passed; found by falsifying it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Merge origin/main (b1681667) into wai/energy-waste
Some checks failed
wai-ops-gpu integer operators on GPUs / does this change touch it (pull_request) Has been cancelled
Details
wai-ops-gpu integer operators on GPUs / builds · no adapter is not a pass (linux) (pull_request) Has been cancelled
Details
wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Has been cancelled
Details
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Has been cancelled
Details
2a99c78fd5 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The sink profiles name the fabrics a reading covers (cpu, gpu, media, neural) and how it is
the sink's: task, the operating system's account of the sink's own processes, or bracket,
the marginal over an idle bracket on a shared counter. No counter is divided among its users
by their busy time; a hop's figure is restated in a session's split only where the session
was its sole user, at least 99% of its busy time, and is otherwise absent as hop_shared.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The session receipt carries hop entries by the roles a stream log's hop entries use
(1 origin, 2 relay, 3 sink decode, 4 display): a figure with its own class, the unmetered
marker with its reason where the sink knows the hop took place and has no figure, and no
entry where the sink states nothing. A segment receipt is the sink-decode hop's figure for
its segment.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Settled with the per-fabric record: the fabric term is npu; task is the operating system's
account of the sink's own processes; rail is a sole user's whole rail. A counter every user
shares gives the sink no attribution: its figure is the bracket over the whole decode, not a
fabric's share, and like a Partial figure it carries no division by fabric.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sink-energy §5: a segment receipt is the sink-decode hop's figure for its segment
Some checks failed
WAI HTTP delivery / HTTP corpus · falsify patches 2/3 (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · every patch and mutation in exactly one shard (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · verified both ways, and the differential (pull_request) Has been cancelled
Details
WAI HTTP delivery / cache rules · controls and labelled caches (pull_request) Has been cancelled
Details
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
energy meters on real hardware / sink decode table · per-task energy and the GPU rail on macOS (pull_request) Has been cancelled
Details
energy meters on real hardware / sink decode table · RAPL on jetson-hub (NVML surveyed) (pull_request) Has been cancelled
Details
b3f4b48fb7 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The integer decoders' convolutions spent their time in 32x32->64-bit
multiply-accumulates, portable Rust on x86_64. A kernel set (Isa) now
selects narrow kernels where the processor runs them: 16-bit operands
(an input past 2^15 - 1 split into two 15-bit limbs), 32-bit partial sums
over blocks of taps sized so no partial sum leaves i32, then 64-bit sums
(vpmaddwd / vpdpwssd on x86_64 with two channels per word, smlal on
aarch64). The inverse GDN's norms run in 64-bit SIMD lanes on x86_64
(vpmuldq, an exact product, then the floor shift), the NEON ones fuse the
shift and the add at gf = 16, and each integer root is seeded from the
IEEE-754 square root and corrected in integers. The wide kernels stay, as
Isa::Wide, and run wherever a narrow plan does not apply.

int_ops lends the interpreter rescale, clamp, relu and leaky on the
workers, and requantises in i64 where every value fits (else in the
interpreter's i128). max|x| is read in parallel, once per inverse GDN.

The equivalence tests run every kernel set the processor runs: random
geometry against the exact sums written out, the block edges, the limb
edges, the seeded root, the i64 requantisation and the element-wise
operators against the interpreter.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Each decoder-level equivalence test now runs int_kernels::equivalence_policies:
the reference, the fast kernels on every tiling, and each kernel set the
processor runs. tests/int_ops_conformance.rs decodes every graph vector of
ops-conformance/ (vectors/ and graphs/) through the interpreter with the
fast kernels behind it, under each of those policies, and holds every
decode to the integers or refusal the vector states.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The narrow kernels now take a block of at most 128 taps outermost and sweep
the whole row under it, so one block's weights and the input lines its
taps read stay in the first-level cache. On AVX-512 (now F, BW and DQ) the
inverse GDN's roots are seeded from the IEEE-754 square root, corrected
and held to s^2 <= n < (s+1)^2 in lanes, and (x * s) >> frac is vpmullq,
exact for |x| < 2^31; a step that fails the check is left to the scalar
form. The weights' largest magnitude is read in parallel too.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Taken by wai_sink_table on the host once it had been idle for a minute: the package
counter live, every row a figure.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Merge origin/main into wai/energy-sink-metering
Some checks failed
WAI conformance / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
jouleclaw public surface must stay documented / Public-surface audit (jouleclaw-rs) (pull_request) Has been cancelled
Details
jouleclaw fabrics / metal (macOS, Apple GPU) (pull_request) Has been cancelled
Details
jouleclaw fabrics / cuda (linux, RTX 4050 + Vulkan loader) (pull_request) Has been cancelled
Details
jouleclaw fabrics / vulkan (linux, RTX 4050 + Vulkan loader) (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
energy meters on real hardware / sink decode table · RAPL on jetson-hub (NVML surveyed) (pull_request) Has been cancelled
Details
energy meters on real hardware / sink decode table · per-task energy and the GPU rail on macOS (pull_request) Has been cancelled
Details
energy meters on real hardware / RAPL and NVML on jetson-hub (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Has been cancelled
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Has been cancelled
Details
df8c7f493f 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The kernel steps of wai-conformance run tests/int_ops_conformance.rs on
each leg. A new job on the linux-amd host runs the same tests in both
profiles there, whose processor runs every x86_64 kernel set, AVX-512
among them, which no other leg's does; the host declares its sets, and
the_kernel_sets_found_are_the_declared_ones fails where the sets found
differ, so a missing set is a failure and not a skip.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
research/determinism-cost.md §4.6, in the same record and by the same
procedure: the 192 payloads decoded again on every platform with every
kernel set it runs (15 new runs, 0 decodes differing from the record's),
and the record's time and energy runs repeated in one session per host
beside the record's own build and the float decoder. On x86_64 host A the
integer decode on the narrow kernels took 144.8 ms and 12.43 J of marginal
package energy at quality 6 against 210.7 ms and 14.03 J for the float
decode beside it (the record's build: 728.0 ms, 92.14 J). On the build
host its own CPU energy fell from 11.01 J to 6.43 J at quality 6 and is
still above the float decode's 1.28 J by that count. Host B's integer
decode was measured before and after, without a float decode beside it.
The scripts that took the readings are in runs/; decode-throughput.md
notes the new sets; the changelog records the change.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
A correctly rounded square root seeds every u64 within one of its root, so
the correction steps that undo a wrong seed ran in no test; removing the
upward one passed them all. The root is now formed from any seed by
isqrt_from, and the test seeds it up to a thousand below and above the
root, and with the largest seed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Falsifying the NEON fused-shift kernel (one lane's ssra made a rounding
shift) passed every test: a norm a unit off seldom moves its integer root,
so the output tests could not see it. the_simd_norms_are_the_scalar_norms
holds each SIMD form of the norms (NEON at any gf and fused at 16, AVX2
with non-negative and signed gamma, AVX-512) to the scalar sum before any
root is taken. The requantisation and element-wise tests drew magnitudes
past Rng::signed's 2^62, which overflowed with overflow checks on; they
now draw within it and list the ends of i64 instead.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-rs: the narrow kernels' files are named by path, and the model checker runs the wide kernels
Some checks failed
wai formal verification (integer core) / kani (integer-core) (pull_request) Has been cancelled
Details
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / fast integer kernels, every x86_64 kernel set (AVX-512 silicon) (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
wai cross-architecture byte-equality / does this change touch it (pull_request) Has been cancelled
Details
wai cross-architecture byte-equality / linux-aarch64 (pull_request) Has been cancelled
Details
wai cross-architecture byte-equality / linux-x86_64 (pull_request) Has been cancelled
Details
wai cross-architecture byte-equality / macos-arm64 (reference) (pull_request) Has been cancelled
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
repository checks / lockfiles, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
986edfea33 
wai-verify and byte-exact-conformance include int_kernels.rs by `path`,
and a file included that way resolves its own `mod narrow;` beside it, so
wai-verify's native build failed (file not found for module `narrow`).
Both submodules now carry their `path`, relative to int_kernels.rs, which
holds in either build. Under `cfg(kani)` the narrow sets are left out:
no processor-feature probe, no SIMD, the wide kernels and the integer
root, as the IGDN harness checked them before.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
A content owner's evidence from the players of a stream another service
delivers over HTTP. settlement §14 acknowledges such objects by plain
SHA-256 from an upstream named by its origin. stream-audit defines the
session key and channel, the acknowledgement windows and chains, the
WAS1 session record (spans presented, start time and stalls recomputed
from the delivery-telemetry log, energy per role with its class, how the
session ended), WPC1 claims for marked ads under the channel, the bundle
a collector verifies, and the channel report it signs and any holder of
the bundles recomputes. No price, tariff or amount.

wai-rs module stream_audit (feature stream_audit), the generator
wai_stream_audit_vectors, tests/stream_audit.rs, and the corpus
live-conformance/audit/.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
extensions/receipt-ledger.md: a tariff (WLT1) a seller and a buyer both sign,
pricing every unit WAI's records state in one currency (a room session's units,
acknowledged bytes by object class, a package's packages, entries and stored
bytes, counted ad impressions) with the scope of rooms, parties, packagers and
deciders it bills; sources verified by their own extensions; an invoice (WLI1)
whose lines cite their records, whose energy is per scope and per class with
its largest declared uncertainty, chained so no record is billed twice; and the
ad and delivery reports.

wai-rs: the receipt_ledger module (feature receipt_ledger), its corpus
generator and wai_receipt_ledger_vectors; live-conformance/ledger/ and
receipt_ledger_verify.py, the second implementation.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
The scheme (cenc, cbc1, cens, cbcs; the HLS methods AES-128, SAMPLE-AES,
AES-256-GCM) and the key delivery (HLS key URI, Clear Key, a content protection
system by its system ID) of each released key; the commitment list WKL1 derived
from a CPIX document, so the proxy copies each key_commit and holds no key; the
entitlement WKE1 bound to a device key and the device's proof over each request;
the release decision as a pure function of signed inputs (freshness, replay, key
periods, offline licences and renewals); the release ticket WKT1 for a clear
delivery, so the proxy never relays a key; verification of a proxy's log.

The key_release module of wai-rs (feature key_release), its unit tests, and the
corpus live-conformance/keys/, generated from fixed seeds by
wai_key_release_vectors and checked by tests/key_release.rs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
live-conformance/stream_audit_verify.py, written from the extension's
text: it reads acknowledgements with settlement_verify.py, claims with
ad_presentation_verify.py and logs and energy classes with
live_metering_verify.py, recomputes every report, gives every vector the
corpus's outcome, requires 15 mutated copies to fail and catches each of
its 31 checks dropped. Dropping three of them first went uncaught (an
item that is not a whole object, a chain's first acknowledgement naming
a prev, notes that are not the bound ones); the corpus gains a control
for each.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Written from extensions/key-release.md, sharing no code with wai-rs: it reads the
scheme, delivery, decision and reason tables from the extension, derives each list
from its CPIX document with the standard library's XML parser, recomputes every
decision of every log, and requires every mutated copy of the corpus to fail.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai.video.stitched_presentation (extensions/stitched-presentation.md): a WPS1 claim names an ad
by the marker the stream carries for it (an EXT-X-DATERANGE tag, an interstitial's asset, a DASH
event) in the manifest it states the SHA-256 of; a WPI1 pod-input record, signed by the
stitcher or a proxy in front of the ad server, binds the response digest, the chosen ads, their
creatives and prices, the avail, the frame and the measurement terms; a verifier recomputes
each ad's presentations, quartiles and the spend that counts by currency. A form-1
wai.video.ssai receipt gains a JSON carriage (its signed bytes unchanged) so it can be a
record's response. live-compose gains the squeeze and double-box ad frames (§5.9). Corpus
live-conformance/stitched/, its independent verifier stitched_presentation_verify.py, and the
browser producer web/ads/stitched.js with tests against the corpus.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai/wai-ledger: tariffs, sources and invoices kept in a directory the service
owns (one process holds its lock; every file written whole; the state read back
and verified again on start); POST /v1/tariffs, /v1/sources, /v1/invoices and
/v1/verify, GET /v1/invoices/{digest} with the invoice's verification document.
Its tests issue the corpus's invoices byte for byte and recover the chain after
a restart; smoke.sh checks it over HTTP, the document checked by
receipt_ledger_verify.py --document.

wai.delivery.ledger registered with WLT1 and WLI1 (registry export
regenerated); unit tests of the module; the CI step beside settlement's and
.github/workflows/wai-ledger.yml.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
A proxy in front of any licence server: it decides each licence request from signed
inputs, appends its signed receipt to a durable single-writer log before it
answers, refuses without forwarding, forwards a granted content protection
system's request and returns the licence unchanged, and answers a clear key with a
307 and a release ticket instead of relaying it. A replay sent while the first
request is still being forwarded waits and is refused after it, so the log stays in
decision order. The key server, run by the key holder, redeems each ticket once.

CLI: serve, keyserver, keygen, pubkey, list (a commitment list from a CPIX
document), entitle, sign-request, verify. tests/end_to_end.rs runs everything on
loopback against a fixture licence server; smoke.sh runs the release binary.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai/wai-audit is the reference collector of stream-audit §12: it
verifies each bundle a player posts (wai-rs stream_audit), stores the
accepted ones one file per session (a different record of a stored
session is refused audit_session_duplicate), takes Event-mode CMCD
batches as advisory telemetry, and serves each channel's report signed
with its key. Limits per client (an IPv4 address or an IPv6 /64), per
route body limits, CORS for the configured page origins. The CLI also
verifies a bundle, recomputes a report from a data directory, and
checks a served report against its bundles. Its tests post every corpus
session and require the corpus's outcome, and require the stored
sessions to report exactly the corpus's served reports.

web/audit.js is the player integration: it hashes each object with
WebCrypto, signs the acknowledgements, claims and session record with
WebCrypto's Ed25519, computes the settlement tree root with a one-chunk
BLAKE3 of its own, records spans, ads, the log and its CMCD batch. Its
Node tests drive it with the corpus's inputs and require the corpus's
records byte for byte. adapter-tap.js wraps fetch and XMLHttpRequest for
any player; adapter-hlsjs.js wraps a player's loader class.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
The pod-input record and the claim were first written as WPI1 and WPS1, which co-performance
already defines (§5.1, §7.7); the registry's wire-identifier table showed the collision. They
are WSI1 and WSC1 now, the corpus regenerated. The capability is registered in
codecs/registry.rs with its two wire identifiers, the registry export regenerated, SPEC §5
gains its paragraph, the CHANGELOG its entries, and wai-conformance a step that runs the
module's tests, the corpus through the tool, the independent verifier and the browser
producer.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
The wire identifiers of extensions/key-release.md (WKL1, WKE1, WKT1 and the WAI-Key-*
header fields) in the registry table, and the export regenerated; the wai.video.keys
row of SPEC §5 names its proxy form, and a §5 paragraph describes it; §6.2 states
how a request missing a field is read. CI: the key-release step in the independent
verifiers job (the module's tests, form 1's, tests/key_release.rs and
key_release_verify.py), the extension under the workflow's paths, and the
wai-key-proxy workflow (tests, clippy, the release binary end to end).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
An ad frame's function takes the descriptor's fields it reads (allowed too_many_arguments,
with the reason); the verifier keeps each ad's own claims by index alone; the XML subset's
name reader takes its stop characters as an array.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: key release corpus, a grant of a licence never forwarded
Some checks failed
wai-pack / wai-pack · independent verifier (Python) (pull_request) Has been cancelled
Details
wai-pack / wai-pack · the floor through a media prober (pull_request) Has been cancelled
Details
wai-pack / wai-pack · dependency licences (pull_request) Has been cancelled
Details
wai-ops-gpu integer operators on GPUs / does this change touch it (pull_request) Has been cancelled
Details
wai-ops-gpu integer operators on GPUs / builds · no adapter is not a pass (linux) (pull_request) Has been cancelled
Details
wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Has been cancelled
Details
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
e60c7dbee5 
A negative control for §8.4 rule 8's first clause on its own: a granted request of a
content protection system whose receipt records no answer from the licence server.
Falsifying that clause alone had let the corpus pass, the other clauses of the rule
catching each earlier control.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
A falsification moved a squeeze's side band onto the window's side and the corpus still
verified: the share is the same area, and no fact stated the rectangles. Each accepted record
now states its frame's share and its ad region's rectangles (live-compose §5.9), so wai-rs and
stitched_presentation_verify.py must agree on the region, not only its area; the Python
verifier gains the matching mutation.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
e2e/run.sh builds the collector, installs the automation package and an
open-source web player from e2e/package-lock.json (npm ci, no install
scripts), runs the player integration's unit tests, then
e2e/audit.e2e.mjs: an HLS stream made with the host's media tool (H.264
and AAC in 2 s CMAF segments, a program time, a marked ad over two
segments) served from another origin with CMSD-Static exposed, played in
a real browser twice, once through the loader adapter and once through
the network tap, each session sent to a collector on loopback. It checks
the outcome, the acknowledged objects against the origin's own SHA-256
of what it served, the ad's claim, the CMSD notes, the unmetered energy,
the CMCD batches, the report, its recomputation by `wai-audit check`, a
replay stored once and a tampered record refused.

Three defects it found, fixed here:
- the player hands fragment buffers on (to a worker), emptying them
  after the loader's callback: the session now copies the bytes at once,
  and keeps each object in the order it was given;
- the tap read XMLHttpRequest responses after the player had moved them:
  it now listens from the request's construction, so it reads first;
- a stitched ad is entered between two observations, so its claim began
  past media time 0 and reached quartile 1: play that enters an ad
  continuously now starts its first span at 0 (stream-audit §6.3), as
  leaving it already ran the last span to the ad's end.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Falsifying the reference found that no vector refused a package outside the
tariff's scope: a reference that skipped that rule wrote a corpus the second
implementation accepted. The corpus now refuses a delivering party, a packager
and an ad decider outside the scope, a room receipt under other prices, and a
delivering party's statement and an ad break outside the invoice's period.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: stitched-presentation §7.2 step 5 states its refusal plainly
Some checks failed
wai-ops-gpu integer operators on GPUs / does this change touch it (pull_request) Has been cancelled
Details
wai-ops-gpu integer operators on GPUs / builds · no adapter is not a pass (linux) (pull_request) Has been cancelled
Details
wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Has been cancelled
Details
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Has been cancelled
Details
4623548d63 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The record wai.delivery.audit and the magic WAS1 in REGISTRY.md and the
code registry, the export regenerated; a SPEC §5 paragraph for the
audit, and a sentence on settlement §14 in settlement's; the changelog
entry; the corpus in live-conformance's index; a step in
wai-conformance.yml (the module's tests, tests/stream_audit.rs and
stream_audit_verify.py) with the extension in its paths; and
wai-audit.yml for the collector on Linux and macOS and the player
integration with the browser end to end on the macOS host; the
collector's README.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Of twelve rules of web/audit.js and its adapters broken one at a time,
two first went uncaught by the Node tests: an ad entered between two
observations (the corpus's observations fall on the ad's start, so only
the browser end to end caught it), and a stall begun before the first
presentation counted. A test for each; all twelve now fail the tests.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- The falsifications found the check that refuses an acknowledgement the
  record does not name guarded by no vector in either implementation:
  the corpus gains ack_not_named (audit_bundle_invalid), and the Python
  verifier can drop that check too, which the corpus now catches.
- The collector's default port moves to 9694: 9690 is the stitched
  presentation tool's.
- stream-audit §6.3 states that this revision claims every marked ad
  with WPC1, and that a stitched ad is claimed with the stitched
  presentation record where a deployment holds it, its bundle then
  carrying the manifests its claims name.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
# Conflicts:
#	wai/CHANGELOG.md
A stitched source (extensions/stitched-presentation.md, PR #470, which this
branch merges): the stitcher's pod-input records (WSI1) and the players'
claims (WSC1), verified by that extension with the tariff's ad scope as its
signers. Its presentations bill as presented impressions, each line citing the
accepted records and the presented own claims; its report is that extension's
§7.5 statement unchanged, a form-1 receipt's own quartiles and spend beside the
presented ones. The corpus bills two vectors of live-conformance/stitched/ and
refuses a stitched source given twice and a stitcher outside the scope.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
native_sink (feature native_sink): what a native host's player integration runs for
one playback session. It verifies a media playlist against its playlist receipt and
the chain of its live revisions (http-delivery §8.6), holds a WAI object to the content
hash its name or fragment states and a fragment named by its SHA-256 to that name
(packaging §7.6), and answers per object whether the host may hand it to its decoder.
It signs what stream-audit has a player sign, under a fresh session key: settlement
acknowledgements by plain SHA-256, presentation claims for marked ads, the session
record, and the bundle. And it ends a session nobody can see, or whose viewer has gone
idle.

ffi_sink: the C ABI over it, an opaque wai_sink_t with JSON in and JSON or bytes out,
include/wai.h regenerated. The corpus live-conformance/native-sink/ is written from
fixed seeds over the reference package's floor fragments.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
extensions/native-sink.md: what a native host's sink does for a stream it plays through
its platform's player. Verification (§4): a media playlist against its playlist receipt
and the chain of its live revisions, an object against the content hash its URL states,
the host told per object whether it may hand the bytes to the player. Observations and
the log (§5), the rule that ends a session nobody can see or attends to (§6), the energy
a native host states (§7: the platform's decoder is outside every counter an application
reads, so the sink decode is the unmetered marker there), the reasons (§8), and the C
interface every native integration shares (§9).

The corpus gains a live revision that rebinds an alias, a parent served under another
name, and page-parity: wai-audit/web/native-sink.test.mjs replays it through the page's
integration of stream-audit, which signs the same bundle byte for byte.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: receipt ledger — a stitched shared break whose own claims are not all presented
Some checks failed
wai-ledger service / does this change touch it (pull_request) Has been cancelled
Details
wai-ledger service / service · linux (pull_request) Has been cancelled
Details
wai-ledger service / service · macos (pull_request) Has been cancelled
Details
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Has been cancelled
Details
9cea6b5c71 
Falsifying the stitched source found that a reference billing every own claim,
presented or not, wrote a corpus both implementations accepted: every own claim
of the billed records was presented. The squeezeback vector's shared break,
three of whose six sessions' claims are presented, is now among the stitched
sources.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-audit e2e: the collector ends with the run, however it ends
Some checks failed
wai-ops-gpu integer operators on GPUs / does this change touch it (pull_request) Has been cancelled
Details
wai-ops-gpu integer operators on GPUs / builds · no adapter is not a pass (linux) (pull_request) Has been cancelled
Details
wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Has been cancelled
Details
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
wai-audit collector and player integration / does this change touch it (pull_request) Has been cancelled
Details
wai-audit collector and player integration / collector · linux (pull_request) Has been cancelled
Details
wai-audit collector and player integration / collector, player integration and the browser end to end · macos (pull_request) Has been cancelled
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
d56916dac5 
A run that failed left the collector it started running, holding the
output of whatever started the script open (the falsification harness
waited on it). It is now killed on the process's exit.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
The RTMP handshake and chunk stream, AMF0, FLV legacy and enhanced tag bodies
(ModEx, multitrack), configuration records and the payload of each frame; a
stream key issued under a room grant; SCTE 104 messages translated to SCTE 35
sections and cues, signed with an injection record before each.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
A second native sink, from the extension's text: it opens each case's session from its
configuration and seed (the session key derived as RFC 8032 §5.1.5 derives it), reaches
every call's answer by §3 to §7, and holds the bundle the corpus states to what its own
session holds, field by field (acknowledgements and their item lists, claims, the
record, the log and the notes byte for byte), and to the collector's outcome through
stream_audit_verify.py. Playlist receipts and their chain are http_verify.py's. It
catches every one of 17 mutations of the corpus and every one of 17 checks dropped.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Legacy AVC and AAC; enhanced HEVC with composition offsets and Opus; AV1 with FLAC,
VP9 with enhanced AAC, a ModEx nanosecond offset; multitrack layers bound by the
grant's publish profile; stream-key refusals; RTMPS and the reconnect request.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
SRT (draft-sharabayko-srt-01): a listener that serves many callers on one
UDP port by socket ID and a caller; the HSv5 caller-listener handshake with
its SYN cookie, HSREQ/HSRSP, the stream ID, key material; live mode with
TSBPD over the negotiated latency, too-late packet drop, ACK/ACKACK and the
RTT estimate, immediate and periodic NAKs, retransmission, and AES-CTR with
the SEK wrapped (RFC 3394) under a PBKDF2-HMAC-SHA1 key.

RIST (VSF TR-06-1:2020, TR-06-2:2024), feature rist: the Simple Profile's RTP
on P and RTCP on P+1, SR/RR/SDES CNAME, range and bitmask requests, SSRC
low-bit retransmissions, the RTT echo; the Main Profile's GRE-over-UDP tunnel
in reduced overhead mode with the VSF EtherType and the legacy one,
keep-alives, and PSK (PBKDF2-HMAC-SHA256 over the nonce, AES-CTR on the GRE
sequence number).

An MPEG-TS demultiplexer and multiplexer, a PCR pacer, an account of every
sequence number's delivery, recovery or drop, an impairing UDP proxy, and
send, receive and bench tools.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
The binding rules, sequence starts and frames of one publish move to rtmp::Tracks,
which the connection feeds and the conformance corpus is generated through.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
An automation system of our own initialises the injector, keeps it alive, and sends
splice and time-signal requests; each cue is signed when its splice comes, after its
injection record, and reaches a relay subscriber on the principal's events track,
published from the injector's start.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The extension text; the corpus's scenarios state the breaks live-ads §4.3 makes,
written by hand; the second implementation, from the text, agrees on every vector.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
A publisher POSTs /srt or /rist under its room grant and proof and gets a
one-time session: for SRT the stream ID and passphrase the gateway's listener
admits (live-ingest §13's mapping, its rejection codes), or the gateway calls
the publisher's listener where call_allow lets it; for RIST a port of its own,
the CNAME its RTCP must give and, in the Main Profile, a PSK passphrase.

The link's transport stream is demultiplexed: the first H.264 or HEVC stream
and the first AAC stream go to the same packagers, groups, catalog and first-hop
receipts as a WHIP session's, one access unit or one ADTS frame an object, the
PTS mapped onto the room clock. WAI capabilities wai.video.hevc and
wai.audio.aac join the gateway's codecs; WHIP and WHEP keep WebRTC's.

Every record interval and at the end, the gateway signs a part of the link's
WCL1 record: each sequence number delivered at the first try, recovered,
dropped or outstanding, its loss runs, requests, retransmissions, RTT and
recovery times, chained part to part and naming the head of each media track's
receipt chain; published with receipts on the owner's link track.

The corpus wai/live-conformance/links/ comes from joule-moq-ingest-link-vectors,
from fixed seeds; tests/link_corpus.rs holds the reader to it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The stream key, the connection, the binding of tracks to layers, the FourCCs and
their payloads, time, groups, bounds and the reconnect request; §6's cto member; the
reasons. The corpus's second implementation agrees on every object.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai/wai-sink-swift: the native sink for the platforms whose native player is reached
from Swift. WaiSink wraps the C interface (every call JSON in, JSON out); WaiRelay is the
loopback server the player is given in place of the origin: it fetches each object,
gives the sink a playlist with its receipt and the chain's parents, and answers the
player only with bytes the sink presents (502 otherwise), every URI of a playlist
rewritten to it; WaiPlayerSession drives the platform's player through it, observes it
every 200 ms, logs its first frame, stalls and end, ends a session nobody can see, and
posts the bundle to the owner's collector; WaiViewAttention reads the platform's signals
of who can see the player. scripts/build-xcframework.sh builds WaiFFI.xcframework from
wai-rs. Tests: the corpus through the wrapper, the relay over the reference floor, and
the player end to end over a presentation made with the platform's own encoder.

A native host's player and its requests run on threads of their own, so an object can
reach the sink with a time before the log's last entry. delivery-telemetry §7.1 has a
log's times never decrease and nothing after end or abandon: the sink logs such an entry
at the last entry's time, and takes no entry after end or abandon, while an object
received then is still verified and acknowledged (native-sink §5.2). The corpus gains
log-order, and the second implementation checks both rules.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
tests/ertmp_ffmpeg.rs (ignored unless an encoder is present) publishes from a local
encoder through a proxy that holds Publish.Start until the subscriber is in place,
and decodes each track's frames in a conformant decoder: AVC with B-frames and AAC,
HEVC and AVC on the platform's media engine, HEVC with Opus, AV1 with FLAC, VP9 with
Opus. The encoder sends a FLAC sequence start as STREAMINFO alone, and a coded-frames
packet of no bytes at the end: both now read, the latter not carried. The corpus
gains a session for each.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The registry row and its export; the verifiers' mutation self-tests; a step for both
verifiers in wai-conformance, and joule-code-conformance's path filters for the
corpora and texts its tests read.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
live-worlds.md registers the record wai.live.world: the room authority's
world statement (WLW1), the world track each actor publishes in a room
([room, principal, world], op batches one per group, receipted as a media
track is, receipt alias 4), the grant attribute world = act and the scope
it maps onto at a relay, the clock's lifecycle for an actor, catching up
by FETCH from group 0, private worlds sealed as confidentiality seals a
media track with carries into each epoch, verification and the session
hash, and metering under the room's other tracks.

wai-rs gains the live_world module (feature live_world): the statement,
a participant's incremental copy of the world, the carry, the session
hash and the verifier of section 9; and the corpus
live-conformance/worlds/ written from fixed seeds by
wai_live_world_vectors gen, every refusal of section 9.2 and 3.4 among
its negative controls.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
joule-moq-room: its lockfile gains tokio-rustls and two edges, nothing else re-resolved
Some checks failed
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Has been cancelled
Details
43c87c8c07 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai/extensions/live-contribution.md profiles SRT and RIST onto a room's tracks
through the ingest gateway: the one-time session resource, the listener's
checks and codes, the gateway calling, RIST's port, CNAME and PSK; the
transports as the gateway runs them; the transport stream onto the tracks;
and the link record WCL1, its account, parts and chain, how a part and a
series are verified, the size bound, the refusals, and the RIST texts' patent
notices.

live-conformance/live_contribution_verify.py is written from that text alone,
standard library only, with mutation runs and dropped-check runs. The corpus
gains vectors that isolate each check the verifier found uncovered.

Interop with the reference tools, run locally as test peers (ignored unless
named by environment variables): their SRT caller and listener and RIST sender
and receiver of both profiles against joule-contrib, and their SRT caller and
RIST sender into the gateway with an encoder's H.264, HEVC and AAC, through
lossy paths. Two fixes they found: an SRT recovery margin is held to the
window, and no part is cut before the first sequence number resolves.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
The extension text (wai/extensions/remote-desktop.md); the remote_desktop module of wai-rs behind
its own feature: the statements WDS1, WDI1, WDO1, WDF1 and WDL1, the grant attributes
remote_host and remote_control, the host's rules of §5.3 (decide), the floor in effect, latency
legs, and the verifier over a room the live-rooms verifier replays. The corpus
live-conformance/remote/ written by wai_remote_desktop_vectors from fixed seeds: a floor session,
an open session whose control passes by grant exchange, a gap, and refused vectors giving every
reason of both tables of §12. Its second implementation, remote_desktop_verify.py, written from
the text and sharing no code with wai-rs, agrees on every vector, fails every mutated copy and
catches each of its 32 checks dropped.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
live_worlds_verify.py is the corpus's second implementation, written from
the extension's text and the sections it cites, sharing no code with
wai-rs; it agrees with the reference on every vector.

Writing it found readings the text left open, now closed: a CausalOp's
integers are little-endian and its signature is over the domain then the
preceding bytes (interactive-worlds 5.1); a world track's receipts are a
track's, not interactive-worlds 8's session receipts; the order of the
descriptor, grant and statement checks; the group total is checked; a
private world's first opened object above group 0 starts its chain; the
session hash chains each op with its signature; the outcome lists the
actors whose ops were admitted. The corpus gains a group-total refusal,
and section 12 states which codes it covers.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-conformance.yml runs the native sink's module tests, tests/native_sink.rs and
native_sink_verify.py; wai-audit.yml has the page replay the native sink corpus's
page-parity case; wai-sink-swift.yml builds every slice of the package's binary target
and runs the package's tests on the desktop and in the phone and television simulators,
and builds the device slices. scripts/test-simulator.sh builds the test bundle for a
simulator and runs it there through simctl; on a host whose simulator service is older
than its Xcode's, it says so and fails, since a run that did not happen is not a pass.
The simulator slice of the phone SDK holds both architectures. packaging is cited by its
section heading. The corpus is listed in live-conformance/README.md.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
The room service's [world] configuration: each room's authority signs its
world statement, served with the room; a publisher's grant is an actor's
(the attribute world = act, no media); the clock watches each actor's
world track and signs its join when it appears and its leave when it
ends, with no publish; with e2ee the world is private, every actor a
member of the room's group. relay-lines prints the world door and the
window that keeps the room's world tracks, commented. A world room is not
also a watch room, a room with co-performance or one admitted by age.

The relay maps a grant whose attribute world is act onto PUBLISH of
[R, P, world] (live-worlds 5.2): its own world track and nothing else. A
three-line change in auth.rs, with a unit test.

joule-moq-web's signer can sign objects that are not WAI envelopes
(setEnvelope(false)): a world track's op batches carry no envelope flag.

tests/world_room.rs: two actors publish through a relay that holds world
tracks to their owners' keys, the clock records them, a late actor
fetches both tracks from group 0 and its copy, every receipt and op
checked by wai-rs, holds the actors' session hash; a viewer publishes no
world track, an actor no other's and no media; the door drops a group
receipted by another key; a departed actor's track is still fetched; and
a private world room keys its actors.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
An agent that reads the screen, or a test harness, states the instant it held the frame verified
against its receipt; no photon is involved, and the record measures the path to the viewer alone.
wai-rs and remote_desktop_verify.py read source 1 to 3.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
What a per-process energy reader (energy-measurement §9.2, macos-task) reads one hop
of: fixed seeds, loopback listeners, a stream key per line of input.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
worldStatement checks a room's world statement against its descriptor;
worldAction signs an action of wai.world.model; World is a participant's
copy of the world (wai-rs live_world), to which a page offers each object
its transport client verified against its receipt: each op's signature,
owner, kind, Lamport rule and equivocation, the session hash, the merged
log and a private world's carry. A host test runs the corpus's accepted
world through the page's path.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
CHANGELOG: the native sink's and stream audit's entries above main's new ones under v0.4.0.
Cargo.toml: getrandom beside main's new optional dependencies. Cargo.lock: main's, with wai's
getrandom added by cargo metadata.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Merge origin/main into wai/ingest-ertmp-scte104
Some checks failed
wai-pack / wai-pack · independent verifier (Python) (pull_request) Has been cancelled
Details
wai-pack / wai-pack · the floor through a media prober (pull_request) Has been cancelled
Details
wai-pack / wai-pack · dependency licences (pull_request) Has been cancelled
Details
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Has been cancelled
Details
c90c4d5479 
Conflicts in wai/CHANGELOG.md, wai/SPEC.md and wai-rs's registry table, each two
additions at one place: both kept (main's registrations and §5 paragraphs before
wai.live.injection; this branch's changelog entry first, as the newest).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
joule-contrib-bench measures one link on loopback, both ends in one process,
and contrib_bench (ignored) the gateway path with the sender in a process of
its own: the payload rate, CPU time, and energy by the counter's profile,
class and scope: macos-task (the process's own account), or linux-rapl as a
bracket, the run's package reading less an idle reading of the same length,
across a wrap of the counter. The transport tests send a tail past what they
count: a receiver cannot know of a packet lost after the last it receives.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
web/world/world.js is a participant in a room's shared world (WAI
live-worlds): it checks the room's world statement, takes an actor's grant
for a key it makes, publishes its world track (op batches, each group
signed into its receipt chain under receipt alias 4, no envelope flag),
follows the clock's lifecycle, subscribes to every actor's world track and
in a public world fetches each from group 0, verifies every object against
its receipt with the relay door's verifier, and offers it in group order
to wai-live-web's World. In a private world it is a member of the room's
group: it seals before it signs, opens before it offers, and carries what
it holds into each epoch it reaches. web/world/index.html is its page.

room.e2e.mjs gains the world and privateworld scenarios: two pages
converge through the relay, a late page catches up, a viewer acts in
nothing, the relay refuses what a grant does not allow, the door drops a
group receipted by another key, a departed actor's track is still fetched;
and in a private world, carries bring later members the world, a page
outside the group opens nothing, and a member removed opens nothing after.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-audit: its lockfile follows wai-quantum 0.6.15 from main
Some checks failed
WAI neural sink gates / model-free refusals of the neural sink (pull_request) Has been cancelled
Details
WAI JPEG-AI whole decode (pinned inputs, required) / does this change touch it (pull_request) Has been cancelled
Details
WAI JPEG-AI whole decode (pinned inputs, required) / fetch pinned JPEG-AI inputs → whole decode + pixel hash, required (pull_request) Has been cancelled
Details
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
wai-audit collector and player integration / does this change touch it (pull_request) Has been cancelled
Details
wai-audit collector and player integration / collector · linux (pull_request) Has been cancelled
Details
wai-audit collector and player integration / collector, player integration and the browser end to end · macos (pull_request) Has been cancelled
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
05fb22cc17 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The host is its room's clock and its screen's publisher: it makes a room (descriptor and grants,
the host marked remote_host, each participant's control classes in remote_control) and the lines
a relay's configuration takes for it; signs each participant's join when its events track
appears; publishes the screen as the room's screen track, one frame a group with its receipts,
and a screen statement naming the encoder; decides every input by wai-rs's rules at its place in
room-clock order (gate.rs) and injects what they accept on a thread that captures after it
injects, so the outcome it signs names the first frame that can show the input; and passes the
floor on request or when told.

Behind small traits: capture (a pattern source; the macOS display stream; X11 on Linux), encode
(an H.264 encoder with every macroblock I_PCM, a pure function every decoder decodes; the macOS
media framework's hardware encoder, AVC or HEVC, read back as Annex B), and input (a recorder;
the macOS event services; the Linux kernel's input device). Platform API names are in the
adapter files, each line marked for the public-name check.

tests/loopback.rs: a session over a relay that requires grants with their proofs, three viewers,
floor handover, refusals for no control power, no floor and a paused screen, latency records,
and the session's chains verified whole by wai-rs; run with the pure-function encoder, and on
macOS again with the hardware encoder. A workflow runs it on linux-arm64 and macos.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A door holds each object of a group until the group's receipts arrive, and
it holds the object while reading its stream; the receipts follow the
group's last object. A group larger than the stream's receive window (QUIC's
default, about 1.25 MB) therefore stops its stream: the publisher cannot
finish the group, its receipts never come, and the door refuses it after its
hold. Contribution at 20 Mbit/s with a one-second GOP sends groups of 2.5 MB.
limits.quic_stream_window_bytes sets the window, 16 MiB by default (64 Mbit/s
for two seconds). contrib_srt's test of a 4.5 MB group shows it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
web/room/remote.js: input statements, floor statements and latency records written byte for byte,
every statement read, the host's rules and the floor replayed over a room's records, the table
from keyboard codes to HID usages; and RemoteViewer, which draws the host's screen (the page's
WebCodecs decoder, AVC or HEVC in Annex B, every frame verified against its receipt first), shows
what the host captures and who holds the floor, batches pointer, keys, composed text and pasted
text into input statements under the grant's classes, asks for and gives back the floor, and signs
a latency record of each applied input's frame at the display refresh that showed it.
remote.test.mjs checks it against wai/live-conformance/remote/, the host agent's key table among
it. The page draws a room with no composition descriptor, and names a screen track by its
namespace.

e2e: the remote scenario runs wai-remote-host with a pattern source (the platform's hardware
encoder on macOS), two pages, the floor asked for and given, a click and a key applied with their
latency records, an input with no control power refused, and the session the host records
verified by remote_desktop_verify.py.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
A participant that joins late fetches what the clock and the host said before it came (live-rooms
§10.6), the host's screen statement among it. `room` writes participant-<name>.page.json, the room
page's test-room file; `run --record` writes the session as a verifier takes it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
The change to joule-moq-relay's stream window (650ed3365) is reverted: its
test passed with QUIC's default window as well, and the gateway bench's
refusals that prompted it came back neither with nor without it once the
shared host was quiet. contrib_srt keeps two regressions: four seconds at
20 Mbit/s with 2.6 MB video groups through the relay's door, with a
subscriber and with none, every group released.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai.live.world is registered (codecs/registry.rs, and the export of
REGISTRY.md, registry/capabilities.json and vocab/v2.ttl); SPEC 5 gains its
paragraph and the changelog its entry; live-rooms 4.4, 6.1 and 10.2 and
confidentiality 1 name the world track. wai-conformance.yml runs the
module, its corpus test and live_worlds_verify.py; joule-moq-web.yml reads
the worlds corpus its wai-live-web test uses.

world.js: an actor that has left has no live track, so a page entering
after it fetches the track without a live subscription. The privateworld
scenario lets something be sealed after the viewer enters before it looks.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
81273dfc5 reverted 650ed3365 on a falsification that did not remove the
change: the build host's run checks out a snapshot commit whose parent is
the branch's head, so "HEAD~1" there was 650ed3365 itself, and both runs
"with QUIC's default window" ran with the window in place. Run again with
the change taken out (git apply -R), contrib_srt's two tests at 20 Mbit/s
fail (no PUBLISH_DONE, no session record: the door refuses each 2.6 MB
group after its hold), and the gateway bench refuses at the door at 4, 6
and 10 seconds; with the window both pass.

The door holds each object while its stream goes unread, and a group's
receipts follow its last object, so the whole group must fit the stream's
window. limits.quic_stream_window_bytes, 16 MiB by default; the relay's
README says so beside the door.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
- wai.live.contribution registered (registry.rs; REGISTRY.md, capabilities.json and
  v2.ttl regenerated); SPEC §5, CHANGELOG and live-ingest point to the extension.
- joule-code-conformance runs joule-contrib with and without rist, joule-moq-ingest
  with rist, and checks the link corpus regenerates; wai-conformance runs
  live_contribution_verify.py over live-conformance/links and fires on the extension.
- A RIST link's rate is bounded by its 16-bit sequence space: fewer than 32 768
  packets within the buffer (§8), refused as bitrate_exceeded above it.
- READMEs for joule-contrib and the link corpus.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Five files both sides appended to: wai-conformance.yml (main's QoE
aggregation, exact tone mapping and exact splats steps kept whole, then the
live worlds step), the changelog (this entry on top), the corpus index,
the registry tables and lib.rs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai.live.remote: a corpus member's type named, for clippy's type_complexity
Some checks failed
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
joule-moq-remote host agent / joule-moq-remote · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-remote host agent / joule-moq-remote, every target (linux-arm64) (pull_request) Has been cancelled
Details
joule-moq-remote host agent / joule-moq-remote, every target (macos) (pull_request) Has been cancelled
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Has been cancelled
Details
5458920846 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
live_world corpus: a group receipt's new hybrid half, none
Some checks failed
wai-ops-gpu integer operators on GPUs / does this change touch it (pull_request) Has been cancelled
Details
wai-ops-gpu integer operators on GPUs / builds · no adapter is not a pass (linux) (pull_request) Has been cancelled
Details
wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Has been cancelled
Details
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Has been cancelled
Details
6745bf6cdb 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
rate_bound_kbps gives a session's bound: the configured one, and for RIST at
most what keeps its buffer under 32 768 packets of 1 316 bytes
(live-contribution §8: 344 981 kbit/s with a buffer of 1 000 ms).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Conflicts in wai/CHANGELOG.md and wai/live-conformance/README.md, each
resolved by keeping both sides.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
joule-moq-ingest: interop states the link's account before comparing frames
Some checks failed
wai-pack / wai-pack · independent verifier (Python) (pull_request) Has been cancelled
Details
wai-pack / wai-pack · the floor through a media prober (pull_request) Has been cancelled
Details
wai-pack / wai-pack · dependency licences (pull_request) Has been cancelled
Details
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Has been cancelled
Details
27a666cff5 
A frame missing at the subscriber is either a packet the link dropped or a
loss outside the link (the datagrams into the reference tool). The check now
reads the link record's series first, prints its account (delivered, at the
first try, dropped, outstanding, bytes against the input's) and requires
nothing dropped, before it compares the frames.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
encode corpus: a stream with no picture parameter set, which only the every-parameter-set rule refuses
Some checks failed
WAI HTTP delivery / HTTP corpus · falsify patches 0/3 (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · falsify patches 1/3 (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · falsify patches 2/3 (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · every patch and mutation in exactly one shard (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · verified both ways, and the differential (pull_request) Has been cancelled
Details
WAI HTTP delivery / cache rules · controls and labelled caches (pull_request) Has been cancelled
Details
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
b41b566be1 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
joule-moq-relay: bound a session's unread bytes by a connection window
Some checks failed
wai-pack / wai-pack · independent verifier (Python) (pull_request) Has been cancelled
Details
wai-pack / wai-pack · the floor through a media prober (pull_request) Has been cancelled
Details
wai-pack / wai-pack · dependency licences (pull_request) Has been cancelled
Details
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Has been cancelled
Details
b54dc94c1d 
transport_config set each stream's receive window but not the connection's,
and QUIC's default connection window is unbounded. A session could therefore
leave max_uni_streams (1024) streams each a stream window full unread: about
1.25 GiB with QUIC's default stream window, 16 GiB with 16 MiB. One publisher
that opens streams and finishes no group could push the relay past
max_resident_mb, and the relay exits for every room on it.

limits.quic_connection_window_bytes sets the session's window over all its
streams. The default is 64 MiB, the budget websocket_buffer_bytes gives a
WebSocket session and four stream windows: a group a door holds whole, the
next group's start, its receipts and the session's other tracks. The relay
never sets it below the stream window. The doc comment, the example and the
README say that this window bounds a session's unread bytes, not the
stream's.

tests/connection_window.rs: a publisher with a 1 MiB stream window and a
4 MiB connection window opens 32 streams, each a group whose first object
waits at the door and whose stream is then not read. It stalls having sent
4 190 208 bytes, and the streams it opens after that carry nothing.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
#484's in-package rungs need it, and #463 carries #452's original history,
which #465 replaces with one squash. Merged first so every later PR meets the
packaging train it will meet on main.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Conflicts, both sides kept:
- determinism-tiers §5: #465's GPU paragraph and #440's NPU bullet; §6: #465's
  GPU row and #440's NPU row; the cross-architecture paragraph keeps #465's
  forge-run sentence and adds #440's neural-processor sentence.
- CHANGELOG: #440's entry above #465's.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Conflicts, both sides kept:
- wai-conformance.yml: main's robustness-evidence step, then #445's prior-forms
  and scene-carriage steps.
- wai-rs Cargo.toml features, registry.rs document constants, REGISTRY.md's
  wire-identifier rows and its list of extensions: both sides' entries.
- codecs/mod.rs: the lossless arm holds main's gain-map and ST 2094-50
  companions and #445's tensor-file prior forms.
- CHANGELOG: #445's entry above the train's earlier ones.
- registry/capabilities.json: regenerated (wai registry export, then --check).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Conflicts, both sides kept:
- codecs/mod.rs: main's gain-map and ST 2094-50 companions and DRED strings with
  #446's projection descriptor, JPEG XS, MV-HEVC and IEEE 1857.11 in every list
  (companion-only, video companions, lossless, lossy, patent pool, unclassified,
  the registered list and the tests).
- codecs/registry.rs: both sides' registrations, wire kinds (glTF extension and
  telemetry key; WireKind::all() is now 17, which neither side's 16 compiled
  with), document constants and wire identifiers.
- SPEC §5: main's HDR rows and paragraph, then #446's projection row; the
  companion-only paragraph names both sides' strings.
- REGISTRY.md's list of extensions and kinds of wire names; delivery-telemetry
  keeps main's §9.4 and adds #446's §10; Cargo.toml features and [[test]]s,
  glossary_check, the live-conformance README rows and wai-conformance.yml's
  paths: both sides.
- CHANGELOG: #446's entry on top.
- capabilities.json, capabilities.schema.json, v2.ttl, v2.shapes.ttl and
  REGISTRY.md's table: regenerated (wai registry export, then --check).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Conflicts, both sides kept:
- codecs/mod.rs and registry.rs: main's DRED feature decoder (dred-int/1) and
  #448's face generator (face-int/1) in the ops members, the one-file
  parameter sets, the class match (with #445's tensor-file priors) and the
  registry tests' expected lists.
- lib.rs: main's robustness module and #448's avatar_face module.
- determinism-tiers §5: #448's avatar sentence after the GPU paragraph, before
  #440's NPU bullet; §6: #448's row after the GPU and NPU rows.
- wai-ops-gpu.yml: main's DRED and splat paths, build line and steps, and
  #448's avatar paths, build line and GPU step (the build line goes into the
  build step's run block, not after the DRED step).
- wai-conformance.yml, Cargo.toml, live-conformance README: both sides.
- CHANGELOG: #448's entry on top. The registry export is unchanged by the
  merge (export --check up to date).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Conflicts, both sides kept: wai-conformance.yml's paths (#453's
determinism-cost record and verifier after the train's); CHANGELOG, #453's
entry on top.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
No conflicts (stacked on #453).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Conflicts, both sides kept:
- the room page (app.js): main's endpoint check and co-watch snapshot with
  #457's termination module and snapshot.
- e2e: room.e2e.mjs keeps main's ageco, cowatch and origin scenarios and adds
  #457's termination scenario (in the default list, the --only list and the
  runner's table); lib.mjs keeps main's writeWav and adds #457's rawBrowser;
  run.sh's module tests run main's cowatch, markup and endpoint tests and
  #457's termination test.
- joule-moq-web.yml's scenario list, the crate README, wai-conformance.yml's
  paths and steps, Cargo.toml's [[bin]]s and [[test]]s, registry.rs, the
  live-conformance README, REGISTRY.md's list of extensions: both sides.
- CHANGELOG: #457's entry on top. capabilities.json regenerated (registry
  export, then --check).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Conflicts, both sides kept: SPEC §5 (#457's termination paragraph, then #460's
sink-energy paragraph), Cargo.toml features, registry.rs capabilities; CHANGELOG,
#460's entry on top. The registry export is up to date after the merge.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai::platform_decode: the query a sink makes of Media Capabilities and
WebCodecs for an entry, read from its payload (AV1: the AV1-ISOBMFF codec
string from the sequence header, full where the stream is not 4:2:0
BT.709 studio range; HEVC: the Annex E.3 string, cropped and coded sizes
and bit depth from the SPS); the answers; the energy budget as read from
energy-measurement (OnChipCounter, measured, on a reference sink); and the
default order, a SPEC §7.1 deployer policy: power-efficient classical
decode and budgeted learned decode first, then smooth, then other
classical, then learned without a budget, manifest order within a rank.
select() runs §7.1 in that order; advertise_for_envelope() is the WAI1
rule. Pure logic, no feature, no dependency.

platform-decode-conformance: order.json (every rule, and the WAI1 cases)
and queries.json (packaging-corpus floors, and an SPS a hardware encoder
wrote whose level is not the one it declared). The tests also derive
every corpus floor to its HLS master's codec string and size, reproduce
the AV1-ISOBMFF examples, read SPSs with sub-layers and emulation
prevention, and catch each rule turned off.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit 6ad92e2e85)
A new extension, from Media Capabilities (WD 18 October 2026), WebCodecs
(WD 19 October 2026) and its AV1 and HEVC registrations: the query a sink
forms from the payload, never from what an encoder declared; supported:
false making the capability unsupported for that object; smooth and
powerEfficient ordering only, never written as energy; prefer-hardware a
hint, not evidence of hardware; the default order and the WAI1 advertising
rule; the energy budget read from energy-measurement. SPEC §4 and §7.1
point to it. §6 records a browser run on an arm64 desktop.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit 8695bc75f5)
platformQuery and platformOrder bind wai::platform_decode behind the
platform_decode feature, built as its own bundle, so the main bundle is
unchanged. demo/platform_decode.html queries and decodes every AV1 floor
object of the packaging corpus through WebCodecs with the derived
configuration, asks about the same family at 1920x1080, encodes HEVC with
the platform's own encoder and decodes it back with the codec string read
from the stream, and orders a learned entry and an AV1 entry from the
answers; verify_platform_decode.mjs drives it in a headless browser.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit fed8694f43)
energy-measurement §2.6, New profiles: the profiles that could have sealed
HwShunt keep their acceptance, listed by name; a profile, record, claim,
table or registration member defined since refuses it from every producer
and reads it as no other class. A RAPL or system-management-unit package
counter is OnChipCounter. wai-rs: energy_class::check_new_profile
(AcquisitionError::LegacyInNewProfile), with its test.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit df5ea962f9)
SPEC §4, §7.1 step 2: a sink tries an envelope's capabilities in the energy
order unless its deployer configures another: a decode the platform answers
supported and power-efficient first, a learned capability (NeuralIntegerExact,
NeuralEntropyExact, NeuralFloat, Behavioral) with no energy budget after every
other, the envelope's order within each. The order changes which capability
decodes, never a reason. An energy budget is a decode figure measured on a
named reference sink under OnChipCounter or CalibratedInstrument, in a record
named by its digest; no registration states one yet (REGISTRY, Energy budgets;
the export's optional energy_budget, schema only).

wai-rs: energy_order (DispatchPolicy, Budgets, EnergyBudget, is_learned);
Wai::dispatch_verified and WaiMulti::pick apply it, dispatch_with and pick_with
take another order, the HTTP client's default order and the C ABI's
wai_envelope_select follow it. Tests that are about pins state the manifest
order they run in.

browser-sink §4.7: objects sharing a choice are alternatives; the page decodes
the first in the energy order that routes (no_alternative otherwise).
browser_sink::choose_report, the page's chooseReport (wai-live-web, binding.js),
a choices section in live-conformance/browser (existing sections unchanged),
checked by wai-rs, the page's corpus run and browser_sink_verify.py (34 of 34
mutations caught).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit 11b2556827)
A sampler reads a counter every 100 ms while the relay runs: on macOS the
relay process's own CPU energy (ri_energy_nj, unprivileged; scope task), on a
Linux host the operator states runs the relay alone the CPU packages' RAPL
energy (scope package). A room's WMH1 record carries the advance over its span
as OnChipCounter (tag 4, filtering Unknown, window the span, a declared
uncertainty: interpolation and counter lag at each end, the vendor's filtering
noise for a package counter, the rounding) where the counter was live across
the span (energy-measurement §3.1) and the relay served that room alone; the
unmetered marker otherwise, logged with why. A session summary stays
unmetered: sessions share one process. [metering] energy = auto|off and
dedicated_host. The corpus test's record keeps its bytes with the meter off.

Tests: src/energy.rs (arithmetic, liveness, uncertainty, a made powercap tree),
metering's tag-4 round trip and refusals, tests/relay_energy.rs (a measured
record on a host with a counter, the marker beside another room's session and
with the meter off; SKIPPED where the host has no counter, failing under
JOULE_MOQ_RELAY_ENERGY_REQUIRE). CI: a macos job requires the measured figure.
live-metering §8 and §4.6 say what the relay signs, and that the allocation of a
hop's joules by bytes is an accounting convention. joule-moq: the mock relay's
figure is documented as carrying no class.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit ff069acc24)
energy_order reorders only the entries SPEC §7.1 step 2 may pick, each into one
of their table places; a companion or refinement keeps its own, so where
nothing selectable moves the walk is table order. SPEC §7.1 says so.

HTTP (http-delivery §7 step 4): the client's select and fetch default to the
energy order. O2's pin cases walk the table's order, stated in each case as a
deployer policy; select_O2_default and fetch_O2_default are the default, which
picks AVIF before the learned int_mlicpp. http_verify.py's default order is the
energy order too (1057 of 1057 cases; the mutation shard 79 of 79).

The pin corpus's selection cases are about pins, so its runner walks the table's
order, a deployer policy (pin-conformance/README.md). wai-web's pick tests
follow the default order.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit 244a715b35)
- The C settlement kernel graded every receipt measured, from hardware, by
  hardware_meter, whatever its meter; it now writes the grade and device the
  meter states. Its host harness's figures are constants: projected, from a
  simulation, by model_estimated (oer-receipts §2: an Estimator figure is
  projected). The Zephyr skeleton states projected and no longer seals a
  compute figure of 0. firmware_vectors.json is regenerated; both verifiers
  pass it.
- wai-web: the world demo seals the page's estimate labelled Estimator and says
  so on screen (label_page_figure, tested); the quantum demos seal the unmetered
  marker instead of invented constants, and their getters say a 0 is unmetered.
- The quantum studio shows a figure with its class, coverage and uncertainty;
  the quantum CLI prints the unmetered marker as unmetered (tested); the
  metering tools head a bracket as a bracket and print the marker on stdout when
  they seal it; a provenance total names the class it reads at (tested).
- energy-measurement §2.8 and §6 record which demos still seal an illustrative
  figure the page passes in.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit 2a8d45aa0d)
Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit a203eae233)
energy-steering §5.5: the steering figure is the hops' own energy averaged over
their delivery, not the network's, which is largely flat against traffic.
live-rooms' joules_ceiling is held against an attribution by bytes. The
research taxonomy's compression lever claims cost and a mobile radio's draw,
not network energy. CHANGELOG: the slice's entry.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit 9b6e4badab)
#452's rule demoted a learned capability without a budget only for a
power-efficient fallback, so a smooth or a software classical fallback stayed
below it, while §4.2 ranks every classical decode the sink can make above it
in a WAI2. §4.3 now applies §4.2's order to the two capabilities: step 5 first
when the fallback ranks above, step 3 only if step 5 does not decode, so the
rule never leaves inert an envelope the capability could decode.
advertise_for_envelope follows; the vector learned-capability-fallback-not-
power-efficient now decodes the fallback, and learned-capability-classical-
fallback-no-platform is added. The extension also says SPEC now applies its
order by default.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit 1ffceb5081)
Built on #452 instead of beside it: energy_order ranks with
platform_decode::rank (first, smooth, classical, learned-without-budget) and
reads platform answers as platform_decode::Answers; its own mapping and ranks
are gone. SPEC §4's energy order is platform-decode §4's order applied by
default to cap and fb; §7.1 step 2's default walk is the same over the entries
that may be picked, the others keeping their places.

energy-measurement §2.10 defines the budget record platform-decode §5 reads
(class OnChipCounter, joules_micro, per frame|picture|second, relative_ppm,
window_us, reference_sink) with filtering, resolution and the record's digest,
and its refusals; energy_order::BudgetRecord reads and checks it and gives
platform-decode its view. The registry schema and REGISTRY follow.

browser-sink §4.7 ranks alternatives by platform-decode §4.2 from the user
agent's answer (a route of none last, with no rank); the choice table states
each rank. The corpus's choices are regenerated (one order changes: an
alternative routed none now comes last; one case added), and
browser_sink_verify.py ranks the same way (37 of 37 mutations caught).
http_verify.py ranks learned capabilities as platform-decode §4.1 does. The C
header is regenerated over the merged tree.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit 6c03ba72c4)
The review of #452 (M4–M9) found its platform-decode part at odds with
browser-sink on main. Reworked inside EN-C:

- Kept: the query read from the payload (AV1-ISOBMFF codec string from the
  sequence header, Annex E.3 from an HEVC SPS) with queries.json; the rule that
  powerEfficient and prefer-hardware are hints, never energy and never evidence
  of hardware.
- Reworked: the answers enter browser-sink §3's report, one shape
  (report_answer): supported from isConfigSupported() alone, smooth and
  power_efficient from decodingInfo() only once WebCodecs said supported, so a
  Media Capabilities supported:false overrides nothing (http-delivery §12.2).
  The extension defines no order and no second meaning of advertising: the order
  is SPEC §4's energy order inside browser-sink §4.7, where an answer counts only
  for an object routed ua (AV1's user-agent tier is none; a decode-equivalence
  need with no probe run routes elsewhere).
- Dropped: rank/order/select, advertise_for_envelope (a second advertising
  definition that could make a decodable WAI1 inert), the EnergyBudget and its
  ceiling, and order.json. A learned entry's measurement is browser-sink §6's
  energy entry.
- wai-web: the platform bundle binds platformQuery, platformAnswer and
  platformChoose (browser-sink §4.7) on the browser_sink feature; the demo builds
  every query from a payload (the hand-written 1920x1080 query is gone), asks
  Media Capabilities after WebCodecs, and marks its one figure synthetic. The
  wording calls the HEVC source the platform's encoder configured with
  prefer-hardware. wai-web-wasm.yml builds the bundle.
- int_kernels_vectors: the two new corpora's sidecar exclusions (review M1).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit ce38948dad)
SPEC §4's energy order is an order over what a sink advertises, never a reason
to advertise: first (classical decode the platform answers supported, smooth
and power-efficient; in a page only for an object routed ua), smooth,
classical (any other classical decode, and a learned capability whose decode
the sink holds a qualifying measurement of), learned-without-budget. The
measurement is a sink-metered figure in browser-sink §6's shape; it qualifies
with OnChipCounter or CalibratedInstrument and coverage Whole, and its value is
never read, so a figure still changes no route (§6). A deployer may compare it
with a ceiling per decode as its own policy. The module-authorisation sentence
naming a second place advertising is decided is gone.

energy_order owns the ranks and browser-sink §6's measurement reader, which the
page's energy entry now shares. browser-sink §4.7 ranks alternatives inside the
routing, a WAI1's capability and fallback among them; the corpus adds a host-
routed decode the user agent called power-efficient, and learned alternatives
with counter, calibrated, partial and modelled figures, all marked synthetic
(39 of 39 mutations caught by browser_sink_verify.py). energy-measurement §2.10,
REGISTRY's energy budgets, the registry's energy_budget and BudgetRecord are
removed. http_verify.py and the container's tests follow; the C header is
regenerated.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit 1ca5931244)
The meters sampled the processor power a non-privileged reader reports and
sealed it OnChipCounter, but they never read the channel it comes from: on
macOS 27 the processor channels of IOReport's Energy Model group read zero for
an unprivileged reader, and the reader takes its power from another report it
selects. The liveness rule (energy-measurement §3.1) passed on the reported
samples, which move, while no counter was ever put to it.

energy_burst::PowerSource says what a reader's samples are. A Counter's
differences can seal OnChipCounter under §3.1, §4 and §2.3; a Reported power
is refused as OnChipCounter whatever its brackets show (Bracket::on_chip_figure,
on_chip_refusal) and seals ModelBased under the same bracket rules
(Bracket::figure). wai_meter, wai_video_meter, wai_world_meter,
wai_quantum_meter, wai_prov and wai_stage_measure --energy macmon now seal
ModelBased, naming the reader as the method; rapl:<domain> stays a counter.

energy-measurement §3.1 (the test is run on the counter), §2.9 and §7 say so,
and the extensions that described the meters' figures as on-chip readings are
corrected. No committed record changes class: the provenance vector's figures
are unlabelled and keep their bytes.

Also: the relay's powercap tests module after its impl, and platform-decode's
test helper uses is_multiple_of.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit 507f4cd9e1)
pick reached the energy order through pick_with, which left pick_where used
only under the neural feature and dead in every other build.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit c953377397)
cbindgen sees the public constant and writes PowerSource as an opaque type.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit 13964c9448)
#463's head carries #452's original history, and with it #438's first
research note (docs/research/wai-cross-fabric.md), which names fleet hosts and
addresses; #465 replaces that history with one squash so the note never enters
main's. So #463 is not merged by its head: its own commits are replayed with
cherry-pick -x onto the train's #465 merge (767d2aa7a), the second parent here:

- #452's platform-decode commits, which the review's split gave to EN-C and
  #465 left out: 6ad92e2e8, 8695bc75f, fed8694f4;
- EN-C's fourteen: df5ea962f 11b255682 ff069acc2 244a715b3 2a8d45aa0 a203eae23
  9b6e4bada 1ffceb508 6c03ba72c ce38948da 1ca593124 507f4cd9e c95337739
  13964c944.

#463's merges of main and of #452 are not replayed; their conflict
resolutions (SPEC §7.1 step 2, the CHANGELOG) are reached by the later commits.
Checked: the replay's tree equals a three-way merge of #463's head onto the
replay's platform-decode commits with #452's head merged into main 1a465f23 as
the base, file for file, except the two files that merge conflicts on
(int_kernels_vectors.rs: #465's wgsl line and EN-C's platform-decode line, both
kept), and its CHANGELOG is #465's with #463's energy-honesty entry exactly.
No address of the fleet appears in the replayed commits.

Merging the replay here: CHANGELOG only, #463's entry on top. The registry
export is up to date after the merge.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Conflicts: CHANGELOG only, #470's entry on top. The registry export is up to
date after the merge.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
No conflicts (it contains #470, merged just before).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Conflicts, both sides kept: SPEC §5 (the train's paragraphs, then #471's
key-release paragraph), REGISTRY.md's wire rows (in name order), registry.rs
document constants and wire identifiers, the live-conformance README; CHANGELOG,
#471's entry on top. capabilities.json and REGISTRY.md's table regenerated
(registry export, then --check).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Conflicts, both sides kept: #473's receipt ledger and #474's stream audit side
by side in Cargo.toml (feature, [[bin]], [[test]]), lib.rs, registry.rs, SPEC
§5, REGISTRY.md and wai-conformance.yml (paths and steps); CHANGELOG, #474's
entry on top. capabilities.json, v2.ttl and REGISTRY.md's table regenerated
(registry export, then --check).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
It contains #474, merged just before, and main's cd35b8ff9; the CHANGELOG's
recursive base produced nested markers, so it is #474's train CHANGELOG with
#480's one new entry on top (no other entry of #480's differs from the train's).
include/wai.h: #463's PowerSource and #480's wai_sink_t, both; the header is
regenerated from build.rs at the train's head.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Conflicts, both sides kept:
- joule-moq-relay metering.rs's module text and live-metering §8: #463's
  self-metered relay (its counter, OnChipCounter or the unmetered marker) and
  #475's hop links (counted in the track entries, neither subscriber sessions
  nor in the ledger), and both tests' account of the corpus record.
- joule-code and wai CHANGELOGs: #475's entries on top.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Conflicts, both sides kept: joule-code-conformance.yml keeps #463's
moq-relay-energy job and takes #479's account of the ingest job; registry.rs's
capabilities; CHANGELOG, #479's entry on top. The registry export is up to date
after the merge.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
The room service keeps every room as one host's screen shared into it (WAI
remote-desktop): it grants the host (remote_host), a controller (the control
power, by the allow rule) and a viewer, takes the host by its key or by an
invitation its authority signed, hands control over by the host's grant
exchange (its grant and a proof over the service's challenge), watches the
host's screen track and every principal's events, and takes each record in its
chain's order, removing a principal whose record is out of it.

The host agent runs in a room a service keeps (run --room): it asks for its
grant, follows the service's clock, and orders participants' records by the
same rules. The desk (wai-remote-host room) stays, without page files that
carry keys.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
#479 (Enhanced RTMP, SCTE 104) and #483 (SRT, RIST) both extend
joule-moq-ingest; both ingests are kept whole, on one set of types:
- frame.rs: one Codec with both sides' codecs (HEVC, VVC, AAC, FLAC; ALL is
  nine), #479's WEBRTC constant and Option-returning to_str0m, #483's webrtc()
  and aac_header; one Header whose audio rate is #479's `rate` (#483 called it
  `samplerate`; its uses are renamed); unframe keeps #483's whole-ADTS check
  for AAC; the module text names both ingests' codecs.
- package.rs: one packager. HEVC and VVC take an Enhanced RTMP track's hint, and
  from a transport stream (no hint) the header or a default, as #483 did; AAC's
  first header is its ADTS header where there is no hint (#483) and the hint's
  otherwise (#479).
- catalog.rs: #479's (name per entry; the rate as above); contrib.rs's catalog
  entry now names its layer, as #479 made every entry do.
- config.rs, gateway.rs (routes, the Gateway's fields and methods, the server's
  listeners, srt_task and shutdown), rtc.rs, lib.rs, gateway.example.toml, the
  README and live-ingest's status, header and test account: both sides.
- tests/common: watch_kinds -> watch_layers (#479) -> watch_tracks (#483),
  one subscriber; Watched.layer is the track name where it is a number.
  tests/ertmp.rs imports common::rtmp::adts by name, since common now has
  #483's adts too.
- joule-code-conformance.yml's paths, the live-conformance README; CHANGELOG,
  #483's entry on top.
cargo check --locked --all-targets of joule-moq-ingest (with rist),
joule-contrib (with rist), joule-moq-relay and joule-moq passes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
tests/remote_room.rs: the host agent enters by an invitation (a second key
refused), two viewers make their keys, the host hands control over by a grant
exchange with its grant and proof (no proof, another key's proof, and a non-host
refused), a click under the floor applied, a viewer refused input_not_permitted,
the floor handed to a second controller, a record out of its chain's order cut
and its author removed by the clock and by the host, and the session verified by
wai-rs as the clock holds it and as the host holds it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Conflicts, both sides kept: the room e2e (#457's termination scenario and
rawBrowser import with #481's remote scenario, its spawn import and its
--remote argument: remote runs by default when the host agent is given),
run.sh's scenario list and the page's module tests (cowatch, remote, markup,
endpoint, termination), joule-moq-web.yml's scenario account, Cargo.toml's
[[test]]s, the live-conformance README; CHANGELOG, #481's entry on top. The
registry export is up to date after the merge.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Conflicts, both sides kept: the room e2e (termination and remote with #482's
world and privateworld scenarios: the default list, the runner's table, the
usage), run.sh, joule-moq-web.yml (scenario account and paths),
wai-conformance.yml's steps, SPEC §5, wai-live-web's wai features
(stream_termination and live_world), wai-rs Cargo.toml's [[bin]]s and
[[test]]s, registry.rs, lib.rs (remote_desktop and live_world), the
live-conformance README; CHANGELOG, #482's entry on top. The registry export is
up to date after the merge.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
#465 is in the train (merged first), so #484 meets the packaging train here.
Conflicts, both sides kept: wai-pack's Cargo.toml (#484's platform_encode
feature and its account, #465's optional wai-pack-gpu), its lib.rs module
account (fabric, files and rendition), wai-pack.yml's test-count floors
(#484's encode_rung with #465's counts), packaging §7.5 (#465's hardware
device and driver, then #484's encoded rendition); CHANGELOG, #484's entry on
top. The registry export is up to date after the merge.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
remote.js no longer reads a key file: RemoteViewer takes the grant the room
service issued for the key the page made, reads its control power from that
grant and from each exchange of it the clock signs, and sends nothing without a
grant, before the clock records it joining, or of a class its grant in effect
does not give. app.js enters a remote room through the service (#join asks to
control, #watch to view) and reads the room's grants again on an exchange. The
browser scenario runs against the room service: the host agent by invitation, a
controller's page and a viewer's, and the sessions the host and the clock hold
verified by remote_desktop_verify.py.

Also the room service's README, example and workflows for [remote].

Co-Authored-By: Claude Opus 5.5 <[email protected]>
scripts/check-lockfiles.sh on the train found three:
- joule-code/joule-code-rs/crates/joule-moq-remote (#481), a workspace of its
  own on joule-moq-relay: the merged relay (#475's cascading) depends on
  tokio-rustls 0.26.6 and rustls-native-certs, which the joule-code workspace's
  lock already holds. Resolving it also moves a few platform-only edges onto
  windows-sys 0.61.2 and getrandom 0.4.3, which the lock already held. No other
  package version changes.
- wai/wai-key-proxy (#471) and wai/wai-ledger (#473): main's wai-quantum is
  0.6.15 (#478), which both branches predate.

Each refreshed with `cargo metadata --format-version 1` (resolve only), then
check-lockfiles.sh on all three: current.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The relay's own links to its upstreams (#475's cascading) dialed native QUIC
with a transport configuration of their own that set no receive windows, and
WebTransport with quinn's defaults: on both, the connection's receive window
was unbounded, so an upstream could leave the relay holding up to the stream
windows of every stream it opened. #483 bounded the sessions the relay
accepts with limits.quic_stream_window_bytes and
limits.quic_connection_window_bytes; now one transport configuration
(server::transport_config) serves the listener and both kinds of upstream
link, and webtransport::connect_draft_tls_with takes it.

tests/upstream_window.rs: an upstream of the test's own (native QUIC, and
WebTransport) opens data streams before its SETUP, which the relay parks after
reading each one's header, and writes until flow control stops it: it stalls at
the link's connection window (2 MiB here, with 1 MiB stream windows over 16
streams).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
#465 is the train's first merge, so it brings only its merge commit. #486
(check-advisories.py) and #485 (Quantum Studio) merge cleanly.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
#467 (PERF1) made int_kernels::Isa a public type the C surface reaches, and the
header its branch carried predates it, so a build rewrote the header and left
the tree dirty (the HTTP falsify shards require a clean tree). This is the
header build.rs writes at the train's head: the opaque Isa typedef and two
blank lines of cbindgen's cfg handling. A second build, with no features and
with the falsify shards' (http, video_manifest, key_discovery), leaves it
unchanged.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
The native sink corpus is staged into the test target's resources by
scripts/build-xcframework.sh (not committed), and the tests read it from Bundle.module,
else from the repository. Each test prints a summary line (WAI-SINK …): the corpus's cases
and calls through the C interface, the relay's verdicts per fragment, the refused
requests of a fragment changed at the origin and their statuses, and the end-to-end and
hidden sessions' outcomes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
An AAR for phones, tablets and televisions whose applications are written in
Kotlin (extensions/native-sink.md): a JNI layer over wai_sink_* (every status
carried to Kotlin with libwai's message, strings passed as UTF-8 bytes, a NUL
inside one refused); libwai and that layer built by cargo and the pinned NDK
(29.0.14206865) for arm64-v8a, armeabi-v7a and x86_64, linked for 16 KiB pages
and checked for it and for every exported method; the wrapper, the loopback
relay (128-bit path token, 502 for anything refused, ranges from what verified,
content codings removed), the observation loop, the collector client; the player
session over the platform's media player library and the attention signals from
the activity's lifecycle, the window's and display's state, the view's place in
its window and the window's input.

The platform-free half also compiles for the host JVM, so its unit tests drive
the JNI layer over a host build of libwai: the corpus live-conformance/native-sink
(every case, every refused configuration, the page-parity bundle byte for byte),
the relay over the reference floor, and the loop's hidden and idle endings. The
instrumented tests run in a headless emulator: the corpus and the relay on the
device, the floor played through the sink to its end, a changed fragment refused
on every retry, a session nobody can see ended hidden, and the attention signals
from a real activity. Pinned: AGP 8.13.0, Gradle 8.13 (by SHA-256), Kotlin
2.3.21, JDK 17, compileSdk 36, minSdk 24, the media player library 1.11.1.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
linux-arm64 builds libwai and the JNI layer for the runner and runs the unit
tests on the host JVM, requiring every test class to have run and none to fail
or skip; no Android SDK is used there. macos, where the platform SDK, its NDK
and its emulator are installed, builds every ABI and the AAR, checks the AAR
holds both libraries for each ABI, and runs the instrumented tests in a
headless emulator, failing unless at least one ran and all passed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Two statements the Kotlin integration needed. §6.2: a window the platform shows
without the input focus (a split screen, a picture-in-picture window, one under
a translucent window) is shown, so a host does not end as hidden a session the
viewer watches. §11: where the platform refuses unencrypted HTTP by default, the
host's exception for its loopback server covers 127.0.0.1 alone. The header
names the Kotlin library; CHANGELOG entry.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
The viewer's control power is its grant in effect's while that grant is good,
from its nbf to before its exp (live-rooms §4.3): a page whose grant has ended
holds none and sends nothing. readGrant reads the grant's window.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
One conflict, at the end of the independent verifiers job: #477's last step runs
each differential against both builds, and the train's three steps that follow
it (header probes, cmsd_read_verify.py, loc_verify.py) come after it; #477's
new features-alone job follows the job.

The train's fifteen wai-rs steps in that job (#453's determinism cost, #460,
#471, #470, #445's two, #448, #473, #474, #480, #484, #481, #457, #482, #446)
still built with feature lists of their own, and each switch between a list and
#477's union rebuilds the library and relinks every test built before it. They
now follow #477's rule:
- WAI_FEATURES gains sink_energy, key_release, stitched_presentation,
  prior_wire, scene_map, avatar_face, receipt_ledger, stream_audit,
  native_sink, platform_encode, remote_desktop, stream_termination, live_world
  and format_probe (neural_int was in it); WAI_RELEASE_FEATURES gains
  avatar_face, whose corpus test runs optimised. None of them, nor what they
  imply (audio_scene, ffi, video_keys, video_package, world_model), is a
  feature any code tests for by its absence (the only cfg(not(feature)) gates
  are pq_signatures, neural_int, staged and the int media features, already
  in or out of the union as before).
- The first step builds the four corpus programs those steps ran with cargo
  run (wai_sink_energy_vectors, wai_stitched_presentation,
  wai_stream_termination_vectors, wai_format_probe) with the union's tools and
  the steps run the copies; its test build names the fifteen steps' test
  targets, and the release build avatar_face's.
- Each step selects the same tests as before; only the feature list changed.
  The termination step's wai-live-web tests run with int_video, the one build
  of wai-live-web the browser sink step makes.
- features-alone checks each of the train's feature lists alone.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-sink-android: a missing refusal fails the status test by name
Some checks failed
WAI neural sink gates / does this change touch it (pull_request) Has been cancelled
Details
WAI neural sink gates / model-free refusals of the neural sink (pull_request) Has been cancelled
Details
WAI JPEG-AI whole decode (pinned inputs, required) / does this change touch it (pull_request) Has been cancelled
Details
WAI JPEG-AI whole decode (pinned inputs, required) / fetch pinned JPEG-AI inputs → whole decode + pixel hash, required (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
wai-audit collector and player integration / collector · linux (pull_request) Has been cancelled
Details
wai-audit collector and player integration / collector, player integration and the browser end to end · macos (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
WAI conformance / does this change touch it (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
cf93ad7a3a 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
every_decoded_output_states_a_sha256 holds every *-conformance directory to a
sha256.json of its decoded outputs, or to an entry naming why it has none. #446
and #484 each added a corpus with neither, so the test failed on each branch's
own head (the conformance workflow's fast-kernel steps run it); neither corpus
decodes a payload. Each now has its entry.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
tests/corpus_provenance.rs requires every corpus README to state its provenance
on a **Provenance.** line; encode-conformance's said it in its table only. The
line restates the table: what is generated, what an encoder made once and is
kept, and which generator writes the rest.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Stacked on #480 (which this train merged earlier, with #474); it arrived after
the train's later merges, so it is merged here, at the head. No conflicts: a new
directory (wai/wai-sink-android), a new workflow (wai-sink-android.yml), two
statements in native-sink §6.2 and §11, and a bullet in #480's CHANGELOG entry.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
joule-moq-room: GET /remote/room bounded per client, as /remote/state is
Some checks failed
wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Has been cancelled
Details
wai-ops-gpu integer operators on GPUs / does this change touch it (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
joule-moq-remote host agent / joule-moq-remote · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-remote host agent / joule-moq-remote, every target (linux-arm64) (pull_request) Has been cancelled
Details
joule-moq-remote host agent / joule-moq-remote, every target (macos) (pull_request) Has been cancelled
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Has been cancelled
Details
74cab2ccac 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
remote-desktop §7.2/§7.3: a floor statement its rules refuse is recorded, stated
with its reason and changes nothing; a verifier computes the floor without it and
a host gives it no effect, so a release crossing the host's take leaves a room
that verifies. §12 moves floor_not_permitted, floor_not_eligible and
floor_not_holder to a third table of stated reasons; §11.3 states each refused
floor statement.

wai-rs: FloorRefusal and the shared rule remote_desktop::floor_rule; the verifier
states floor_refused. The corpus regenerated: 33 of the 39 earlier vectors are
byte for byte as they were; the six refused-floor vectors keep their rooms and
are now accepted with floor_refused; three whole floor sessions are appended (a
give by a non-holder, a release by a non-holder, a late release).
remote_desktop_verify.py follows the text: states and does not apply a refused
floor statement, reads §12's three tables. remote.js's replay applies §7.2.

joule-moq-room: the clock computes the floor by floor_rule and cuts no one for a
floor statement; GET /remote/room and /remote/state answer only a grant this room
issued with its proof (401 otherwise, 403 for another room's grant). The host's
gate uses floor_rule. The browser scenario reads the session with the host's
grant and proof.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
joule-moq-room: name the floor replay's types; the reader check's refusal boxed
Some checks failed
wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
joule-moq-remote host agent / joule-moq-remote · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-remote host agent / joule-moq-remote, every target (linux-arm64) (pull_request) Has been cancelled
Details
joule-moq-remote host agent / joule-moq-remote, every target (macos) (pull_request) Has been cancelled
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Has been cancelled
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
d1e8965f70 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Stacked on #481; merged at the head, after #482 and #488. #489 changes #481's
corpus (live-conformance/remote/: six vectors move from refusal to acceptance,
three are appended), and the merge takes #489's, as neither is on main.

Conflicts, both sides kept:
- joule-moq-room's wai features: #482's live_world and #489's remote_desktop.
- joule-moq-web.yml's scenario account and room.e2e.mjs's usage: #457's
  termination, #489's account of the remote scenario, #482's world and
  privateworld; the default list runs remote when both the host agent and the
  room service are given (#489), beside #482's world scenarios.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
With #482 and #489 in one tree, the room service could be configured with both
[remote] and [world]. The two modes do not combine: a world room's actors join
with no media and the clock watches their world tracks, where a remote room's
host publishes a screen and the clock watches events. remote::service now
refuses the combination when the configuration is read, as it refuses a remote
room beside the other modes it does not keep; the README and the example
configuration say so for both modes.

a_remote_room_is_not_also_a_world_room: each mode alone is read, both together
are refused with the reason named.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
A device runs no tool-hosted test bundle, so the package's tests run on one hosted in
TestHost/: a minimal application (an empty window) and an Xcode project whose unit-test
target compiles the same test files against this package by its path, with the corpus in
its resources and local networking allowed for the loopback origin and relay. The package
itself is unchanged for consumers. The tests import WaiSink plainly (they use only its
public interface) and read the corpus from Bundle.module in the package, from their own
bundle in the host.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
extensions/live-messaging.md: a conversation is an end-to-end encrypted room
with a conversation statement (WMC1); each member's messages track carries
sealed message records (WMG1: text, reply in a thread, reaction, edit,
retraction, each target named by its link hash) signed into the member's
receipt chain; the clock's epoch statements (WME1) name each epoch's roster;
acknowledgements (WMA1); a history store's contract; calls (WCT1, WCI1, WCA1).

wai-rs feature live_messaging: every record, sealing and opening per
confidentiality §4, the conversation verifier a store uses for its checks,
what a principal is owed, the call verifier, and the corpus generator
(live-conformance/messaging/vectors.json).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
A host states a sealing key (an X25519 public key) as its screen statement's last field. A
controller seals every key, text and clipboard action to it: a sealed action (type 8) keeps in the
clear the type it seals, its dt_us, a clipboard text's length and a salted commitment binding its
fields, its order and its author; the statement ends with one HPKE seal (RFC 9180 base mode,
DHKEM(X25519, HKDF-SHA256), HKDF-SHA256, AES-128-GCM) of the actions' openings. Pointer, wheel and
touch actions stay in the clear. §5.3 gains rule 8 (input_unsealed) and rule 9 (input_bad_seal),
§12 a fourth table (seal_no_key, seal_not_opened, seal_unreadable, seal_commitment), §11.4 the two
verification levels.

wai-rs: Input::seal, Input::open, commitment, decide_opened, verify_opened; HPKE moves to a crate
module behind its own feature (hpke), which telemetry_aggregate and remote_desktop both use. The
corpus keeps its 42 vectors byte for byte and appends ten sealed ones, each stating the opened
level; remote_desktop_verify.py checks both levels.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
remote.js writes and reads sealed actions and seals (remote-desktop §5.5) with WebCrypto's X25519,
HMAC and AES-GCM: HPKE base mode (checked against RFC 9180 A.1.1), the openings and their
commitments. The viewer seals every key, text and clipboard action to the sealing key of the
host's screen in effect and sends none in the clear: to a host that states no sealing key it
sends no key, text or clipboard action. A composed text longer than a text action carries goes as
several. In a remote room the page follows every present principal's events, and shows that a
controller is typing or pasting, never what. Its tests seal every corpus input that opens again,
byte for byte, from what the corpus's opened level states.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
The host makes an X25519 sealing key for each session and states it in its screen statement; the
gate decides every input by all nine rules of remote-desktop §5.3 (wai-rs's decide_opened),
opening a sealed input with the session's opening key, and the host injects what it seals. The
opening key stays in the session unless --opening-key writes it (mode 0600, never over a file)
for a verifier. The headless viewer seals its key, text and clipboard actions to the screen's
sealing key, keeps the records it receives, and follows another principal's events when told.

The agent reaches the room service over https:// and the relay over wss://: rustls with ring,
the system's roots and any certificate a PEM file names (--ca), every chain and name verified.
tls::front is a TLS front for a plain backend. Lock files gain tokio-rustls and the new edges
alone.

tests/tls.rs: the service and the relay through a TLS front, trusted by a PEM file; refused under
the system's roots alone, and for a certificate that names another host. tests/loopback.rs:
alice's typing sealed, injected as typed, absent from what bob receives; her text in the clear
refused input_unsealed; the session verified at the opened level.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
[remote] max_records (100000 by default, 16 to 10000000): the clock holds at most that many of
a session's principals' records. When a record would pass the bound it holds none past it and
ends the session: every present principal's leave (reason 2) signed after its last record taken,
the host's last; GET /room's remote states ended "max_records", the records held and those over
the bound; the session it holds stays whole and verifies, and the next host starts a new room.
Ending rather than refusing inputs past the bound: a record the clock did not hold would leave a
hole in its author's chain, the host would decide inputs the clock never held, and an input's
refusal is the host's to state. The host agent stops at its own leave.

tests/remote_room.rs: the host reaches the service and the relay through TLS fronts; alice's
typing goes sealed, is injected as typed, and is absent from what bob receives and from the
session the service serves to a viewer's grant; the session verifies at the commitment and the
opened levels; and a session at a bound of 40 records ends, whole and verified.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Alice's page types a string, composes a text and pastes one; each goes sealed to the host's
sealing key. Bob's page, a viewer's that follows her events, shows that she is typing and holds
no trace of what in the records it received, which a positive control finds for a text alice's
page is made to send in the clear, which the host refuses input_unsealed. The host writes its
opening key (--opening-key) and, from its recorder, digests of what it injected
(--record-injected): the keys, the text and the clipboard text alice typed. The sessions the host
and the clock hold verify by remote_desktop_verify.py as a viewer verifies them and under the
opening key, every seal opened to what alice typed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
live_messaging_verify.py reads descriptors with live_rooms_verify.py, Key IDs,
keys, AES-GCM and plaintexts with e2ee_verify.py, and implements the rest:
every record, the receipts-track object of jwp-receipts' binary form, a
conversation entry by entry, what a principal is owed, and calls. It agrees
with wai-rs on every vector, fails every mutated copy of the corpus, and
catches each of its own checks dropped. The corpus gains receipt-level and
plaintext-level controls, a conversation under AES_256_GCM_SHA512_128, and
history requests that state whether the requester is admitted (§9.3).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
CommitRule::AnyMember (WAI live-messaging §7.2) beside the room's lowest-leaf
rule (confidentiality §5.5, the default): RoomMember and Clock check commits by
the rule their model holds, and a page's E2eeMember opts in with
anyMemberCommits(). A model test holds both rules.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
[messaging]: the service keeps one conversation, an end-to-end encrypted room,
in a history store on disk (conversation.json and an append-only journal, each
append on stable storage before the answer, a torn tail dropped). Members join
by a proof of their key, key through the service's log with any member
committing, post sealed messages and acknowledgements that wai-rs's
Conversation checks before they are taken, and read the log as live-messaging
§9.3 owes it. A restart replays the journal and checks every regenerated
proposal and epoch statement against it.

[call]: a call descriptor the authority signs, invitations the caller signs held
in each callee's inbox, answers checked by wai-rs's Call, the clock's missed
call at each deadline, and grants for the caller and each callee that accepts.

tests/messaging_room.rs and tests/call_room.rs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A seal takes WebCrypto's time, so a send that seals could finish after a later one that does not:
a key's release could reach the host before its press. The viewer's sends now run one after
another; what arrives while one is sent goes at the next refresh with its actions' instants as
they were (the batch is no longer re-stamped). A test holds the order while a slow seal is made.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Bob now enters before alice types, and what alice's page shows above the canvas grows when he
joins: the click is made where the canvas is on screen.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
joule-moq-remote: the opening key in a type no Debug writes out
Some checks failed
wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Has been cancelled
Details
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
wai-web reach builds / wai-web reach builds · this tree's wai-web, every rung on its engine line (pull_request) Has been cancelled
Details
wai-web reach builds / wai-web reach builds · the package of record, every output as recorded (pull_request) Has been cancelled
Details
WAI conformance / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
joule-moq-remote host agent / joule-moq-remote, every target (linux-arm64) (pull_request) Has been cancelled
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
Details
joule-moq-remote host agent / joule-moq-remote, every target (macos) (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Has been cancelled
Details
f96389a387 
Config and Report derive Debug; the session's opening key is held as OpeningKey, whose Debug is
OpeningKey(..).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
web/room/messages.html: a member of a conversation in a page. It joins with a
proof of its own key, keys through the service's log with joule_moq_web_e2ee's
member (any member commits), seals each message before it is signed into its
receipt chain and posted, opens and verifies every message (wai_live_web's
Messages, live-messaging §11), shows threads, reactions, edits and
retractions, and acknowledges what it read.

web/room/call.html: a page's inbox, each invitation checked with its call
before it rings (callCheck); placing a call, ringing, accepting, declining and
cancelling; the call's media through the room page in a frame, which now takes
a grant handed to it (enter(role, { seed, answer })).

wai-live-web: the messaging records, receipts, acknowledgements, invitations
and answers a page signs, and Messages, verified against the corpus in its
tests. joule-moq-web: keyProofHttp, a proof naming no grant.

e2e/messaging.e2e.mjs (run by e2e/run.sh): the messaging scenario and the call
scenario.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai.live.message and wai.live.call registered as records, their seven magics as
wire identifiers, and the export regenerated. SPEC §5 says what each is;
confidentiality §5.5 names the conversation's commit rule. wai-conformance runs
tests/live_messaging.rs and live_messaging_verify.py; joule-moq-web's job
requires the messaging and call scenarios to pass. joule-moq-room's README and
example configuration describe [messaging] and [call].

Co-Authored-By: Claude Opus 5.5 <[email protected]>
[remote] max_records_per_principal (100000 by default): the clock holds the records of seq 0 up to
the bound of each principal but the host. When a record past it comes, the clock takes the
principal's records up to the bound, cuts it there (max_records_per_principal, by the cut path a
record out of order takes) and removes it (leave reason 2); the session goes on for everyone
else and verifies. The host agent reads the bound from GET /room and its gate cuts the principal
at the same record, so the two hold the same records. The host has no bound of its own: its
outcomes answer the others' inputs.

max_records stays as the safety net on the whole session and rises to 1000000, ten times the
bound per principal: a host and four controllers each at its bound hold 800000. The default per
principal: a two-hour session at ten input statements a second is 72000 records; a flood at the
policy's 120 events a second reaches the bound in about 14 minutes. remote-desktop §10 says a
service bounds per principal first, which bites first and why; the configuration docs say the
same.

tests/remote_room.rs: bob, a viewer, floods input statements the host refuses past a bound of
24; he is cut at seq 24 and removed by the clock and by the host, alice's input after the cut is
applied, the session's total is not reached, and the sessions the clock and the host hold verify
at both levels. gate::tests: a participant cut at its bound.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
joule-moq-room tests: the flood test states whether the session ended when bob is not cut
Some checks failed
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
wai-ops-gpu integer operators on GPUs / builds · no adapter is not a pass (linux) (pull_request) Has been cancelled
Details
wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Has been cancelled
Details
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
wai-pack / wai-pack · does this change touch it (pull_request) Has been cancelled
Details
wai-pack / wai-pack · linux (pull_request) Has been cancelled
Details
wai-pack / wai-pack · linux-arm64 (pull_request) Has been cancelled
Details
wai-pack / wai-pack · macos (pull_request) Has been cancelled
Details
wai-pack / wai-pack · independent verifier (Python) (pull_request) Has been cancelled
Details
wai-pack / wai-pack · the floor through a media prober (pull_request) Has been cancelled
Details
wai-pack / wai-pack · dependency licences (pull_request) Has been cancelled
Details
wai-quantum studio and desktop / studio · browser (pull_request) Has been cancelled
Details
wai-quantum studio and desktop / desktop app · macos (pull_request) Has been cancelled
Details
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Has been cancelled
Details
wai-quantum studio and desktop / does this change touch it (pull_request) Has been cancelled
Details
wai-ops-gpu integer operators on GPUs / does this change touch it (pull_request) Has been cancelled
Details
wai-web reach builds / wai-web reach builds · this tree's wai-web, every rung on its engine line (pull_request) Has been cancelled
Details
wai-web wasm32 / does this change touch it (pull_request) Has been cancelled
Details
wai-web reach builds / wai-web reach builds · the package of record, every output as recorded (pull_request) Has been cancelled
Details
e8c747ec83 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
SPEC §7.1 rule 2, as the train's SPEC states it: an HDR descriptor or a
projection descriptor applies to a rendition whose payload is video. #446 taught
wai-rs (codecs::companion_applies) and not the independent Python reading that
claim_verify.py and http_verify.py share, so a WAI2 with a projection companion
over a video base was a conforming table to wai-rs and a broken one to Python.
On the train, claim-conformance/differential.py --random 2000 --seed 1 drew such
a table (31135_session_roles_companion_wai.meta.projection): wai-rs accepted it
and claim_verify.py refused it, session_layer_not_applicable.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Stacked on #489; merged at the head. Its corpus (live-conformance/remote/: #489's
42 vectors unchanged, then 10 sealed vectors) is taken whole. The train's
[remote]+[world] refusal, made before #490 arrived, is kept.

Conflicts, both sides kept:
- wai-rs Cargo.toml: #490's telemetry_aggregate on the new hpke feature, and
  hpke itself, beside #446's format_probe. Every build with telemetry_aggregate
  or remote_desktop gets hpke through the feature, the independent verifiers'
  union among them.
- wai-conformance.yml's remote desktop step: #477's union feature list with
  #490's test filter (remote_desktop:: and hpke::).
- joule-moq-room's README: #490's account of the record bounds and of sealed
  input, ending with the train's list of the modes a remote room is not also
  (now with the world room).
- room.e2e.mjs's account of the remote scenario (#490's) beside #482's world
  scenarios; CHANGELOG, #490's entry on top.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
live messaging: regenerate the corpus, a removed member's held-back message
Some checks failed
wai-ops-gpu integer operators on GPUs / does this change touch it (pull_request) Has been cancelled
Details
wai-ops-gpu integer operators on GPUs / builds · no adapter is not a pass (linux) (pull_request) Has been cancelled
Details
wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Has been cancelled
Details
wai-web reach builds / wai-web reach builds · this tree's wai-web, every rung on its engine line (pull_request) Has been cancelled
Details
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / each feature of the independent verifiers' steps compiles alone (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Has been cancelled
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Has been cancelled
Details
01f3aac11f 
The corpus is regenerated from its seeds since history entries name whether
the principal was admitted. The room test now has a removed member post a
message it sealed before its removal: the service refuses it (not_a_member)
and a verifier refuses it (sender_not_member). The crate README names the
messages and call pages and their e2e scenarios. Clippy notes in the slice's
files are resolved.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Merged last, as asked. Conflicts, all adjacent additions, both sides kept:
- joule-moq-room: Cargo.toml's wai features (live_world, remote_desktop and
  live_messaging); lib.rs's modules (messaging, msgstore, remote), Config's
  remote, messaging and call, Service's remote, messaging and calls, the epoch
  through remote::epoch with the conversation and calls opened beside it, and
  settings()'s refusals (#482's world room, #493's conversation and call); the
  README's world, conversation and call sections.
- joule-moq-web: app.js asks a remote room's grant as #489 does and takes a
  given grant as #493 does (a remote page's fallback to viewer only when it
  asked); run.sh runs room.e2e.mjs (now with --remote) and messaging.e2e.mjs,
  each its own --only scenarios; the usage names every scenario.
- workflows: joule-moq-room.yml's and joule-moq-web.yml's accounts;
  wai-conformance.yml's WAI_FEATURES gains live_messaging (#477's union) and
  the first step's test build names live_messaging beside the train's targets.
- wai-live-web's wai features (stream_termination, live_world, live_messaging),
  wai-rs lib.rs's modules, registry.rs's capability list, REGISTRY.md's rows;
  CHANGELOG, #493's entry on top.
- capabilities.json and v2.ttl regenerated (registry export, then --check).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
With #482, #489 and #493 in one tree, settings() refused a conversation beside a
watch room, co-performance, admission by age, [room] e2ee or a call, and a call
beside the first three, but took either beside [world] or [remote]: a
conversation is the service's whole room, a call room's grants come with its
call, and a world room's and a remote desktop room's grants, tracks and clocks
are their own. Both refusals now count the shared world and the remote desktop
room among the modes they do not share a service with (remote::service already
refuses [remote] with [world]). The README and the example configuration say so.

a_conversation_or_a_call_is_not_also_a_world_or_a_remote_room: each of the four
modes alone is read and its settings made; each of the four pairs is refused
with its reason named.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
#493's independent-verifier step builds with #477's union; under #477's rule its
feature list is still checked alone in features-alone.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
No conflicts.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
joule-moq-remote is a workspace of its own, which #492 (on main) could not see;
through joule-moq it reaches the zstd crates #492 moved for RUSTSEC-2026-0391,
-0398, -0403 and -0410. Resolved with cargo metadata (resolve only): zstd
0.14.3, zstd-safe 8.2.0, zstd-sys 2.1.2, and nothing else. check-lockfiles.sh:
53 lockfiles, all current.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-sink-swift TestHost: adopt the scene life cycle
Some checks failed
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Successful in 15s
Details
WAI neural sink gates / does this change touch it (pull_request) Has been cancelled
Details
WAI neural sink gates / model-free refusals of the neural sink (pull_request) Has been cancelled
Details
WAI JPEG-AI whole decode (pinned inputs, required) / fetch pinned JPEG-AI inputs → whole decode + pixel hash, required (pull_request) Has been cancelled
Details
wai-audit collector and player integration / does this change touch it (pull_request) Successful in 9s
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
wai-audit collector and player integration / collector · linux (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · DX12 and Vulkan (cbio-windows) (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
wai-audit collector and player integration / collector, player integration and the browser end to end · macos (pull_request) Has been cancelled
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
Details
WAI JPEG-AI whole decode (pinned inputs, required) / does this change touch it (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
59bfbbfd9b 
The platform now refuses to launch an application without the scene life cycle ("UIScene
life cycle is required"), so the test host quit before its tests connected. It is a
scene-based application now: an App with one WindowGroup, and the generated Info.plist
carries its scene manifest.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Three commits on top of 05fb22cc, which the train merged earlier: the tests read
the corpus from their own bundle, a TestHost app they run inside on a phone or
tablet, and its scene life cycle. They touch only wai/wai-sink-swift/; no
conflict.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
The page asked the relay for a 10 s rendezvous on each world and room track
and waited 10 s for the answer. With no publisher, the relay answers when the
rendezvous ends, so the two timers raced: on a loaded host the page gave up
("SUBSCRIBE: no answer in 10000 ms") as the refusal was sent, and world.js,
which follows a departed actor's track on that refusal, never saw it. The
world scenario's "dave catches up after alice left" failed so on the train's
Studio run.

request() takes how long to wait for its answer; subscribe() waits a step
past the rendezvous it asks for. session.test.mjs holds the three cases with
the clock mocked; without the change its first case fails with the e2e's
error.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Clean: wai-web-wasm.yml (main's engine test count beside #463's platform
bundle step), the CHANGELOG (main's entry in main's quantum section) and
quantum-studio's main.js (#463's measured-figure rule beside main's rules).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-sink-swift: simulator tests hosted in TestHost, in a fresh simulator, every step bounded
Some checks failed
WAI neural sink gates / model-free refusals of the neural sink (pull_request) Has been cancelled
Details
WAI JPEG-AI whole decode (pinned inputs, required) / does this change touch it (pull_request) Has been cancelled
Details
WAI JPEG-AI whole decode (pinned inputs, required) / fetch pinned JPEG-AI inputs → whole decode + pixel hash, required (pull_request) Has been cancelled
Details
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
wai-audit collector and player integration / collector · linux (pull_request) Has been cancelled
Details
wai-audit collector and player integration / collector, player integration and the browser end to end · macos (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
wai-audit collector and player integration / does this change touch it (pull_request) Has been cancelled
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
850eeefe64 
scripts/test-simulator.sh no longer spawns the XCTest agent through simctl, which hangs
once the host's simulator service is current. It runs the tests the way a device does:
it creates a fresh simulator (the newest installed runtime of the platform, the first
device type of its family), boots it, builds the test host for it (build-for-testing)
and runs the tests hosted in it (test-without-building), then shuts the simulator down
and deletes it however the run ends. Each step has a hard limit (boot 300 s, build 900 s,
tests 600 s by default) and fails, naming the step, when it passes it. TestHost now
builds for phones, tablets and televisions, so the television simulator runs the same
tests. wai-sink-swift.yml bounds each step as well.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
One commit on 59bfbbfd, merged above: test-simulator.sh runs the tests in
TestHost through xcodebuild on a fresh simulator it creates and deletes, with
a hard limit on every step, and the workflow's simulator steps have a
30-minute timeout. Clean.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Clean: wai-web-wasm.yml (main's engine test count beside #463's platform
bundle step), the CHANGELOG (main's entry in main's quantum section) and
quantum-studio's main.js.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
#463 added world::tests::the_pages_figure_is_sealed_as_an_estimator to
wai-web's library and left the step's count at 35, so the step fails on the
train's tree ("36 passed" read where "35 passed" is required; seen on the
Studio). #463's own run of this job was cancelled, so it never showed. The
count is now 36, and the comment names the test.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Merge origin/main (907c46889): #497, a person's taste in wai-quantum
Some checks failed
wai-quantum command line / command line · macos (pull_request) Successful in 39s
Details
wai formal verification (integer core) / kani (rans64-t2) (pull_request) Successful in 16m48s
Details
wai-quantum studio and desktop / desktop app · macos (pull_request) Successful in 2m36s
Details
wai-quantum WebGPU member / member · Metal (macos) (pull_request) Successful in 2m36s
Details
wai formal verification (integer core) / kani (stage-long) (pull_request) Successful in 21m5s
Details
wai-quantum WebGPU member / member · browser WebGPU (macos) (pull_request) Successful in 1m46s
Details
WAI HTTP delivery / HTTP corpus · falsify patches 0/3 (pull_request) Successful in 5m45s
Details
joule-moq-remote host agent / joule-moq-remote, every target (macos) (pull_request) Successful in 54s
Details
wai-sink-android native sink library / every ABI, the AAR, and the instrumented tests in a headless emulator · macos (pull_request) Failing after 6m12s
Details
WAI HTTP delivery / HTTP corpus · falsify patches 1/3 (pull_request) Successful in 6m54s
Details
WAI HTTP delivery / HTTP corpus · falsify mutations 0/3 (pull_request) Successful in 34m3s
Details
WAI HTTP delivery / HTTP corpus · every patch and mutation in exactly one shard (pull_request) Successful in 4s
Details
WAI HTTP delivery / HTTP corpus · verified both ways, and the differential (pull_request) Successful in 2m9s
Details
WAI HTTP delivery / cache rules · controls and labelled caches (pull_request) Successful in 1m14s
Details
wai-ops-npu integer operators on neural processors / builds · no device is not a pass (linux-arm64) (pull_request) Successful in 16s
Details
WAI HTTP delivery / HTTP corpus · falsify patches 2/3 (pull_request) Successful in 6m10s
Details
wai-pack / wai-pack · linux-arm64 (pull_request) Successful in 1m44s
Details
wai-pack / wai-pack · the floor through a media prober (pull_request) Successful in 25s
Details
WAI HTTP delivery / HTTP corpus · falsify mutations 1/3 (pull_request) Successful in 32m30s
Details
wai-sink-swift native sink package / libwai slices, desktop tests, simulator tests · macos (pull_request) Successful in 15m58s
Details
WAI HTTP delivery / HTTP corpus · falsify mutations 2/3 (pull_request) Successful in 32m40s
Details
wai-pack / wai-pack · dependency licences (pull_request) Successful in 1m28s
Details
wai-ops integer operators / linux-aarch64 (pull_request) Successful in 1m16s
Details
joule-moq-remote host agent / joule-moq-remote, every target (linux-arm64) (pull_request) Successful in 1m46s
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Failing after 17m35s
Details
wai-sink-android native sink library / the JNI layer and the platform-free half on the host JVM · linux-arm64 (pull_request) Successful in 3m53s
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Successful in 2m54s
Details
wai formal verification (integer core) / kani (isqrt512) (pull_request) Successful in 50m57s
Details
wai-pack / wai-pack · independent verifier (Python) (pull_request) Successful in 7m39s
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Successful in 59m25s
Details
5b79d1550d 
Clean: wai-web-wasm.yml (main's engine test count, 11, beside the train's
platform bundle step and native count), the CHANGELOG (main's entry in main's
quantum section) and quantum-studio's main.js.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
`wai mcp` (the feature `mcp`) is a Model Context Protocol server (2025-06-18) on
standard input and output. Its tools, in one table (src/bin/wai_cli/mcp/tools.rs):
inspect an envelope or a package; list and describe registered capabilities; verify a
delivery receipt, a claim with the context the tool takes, a live-room session and a
stream audit bundle, each answering with the verifier's verdict and reason code;
package a media file under `wai wrap`'s rules, inside the project directory only; list
and run a conformance corpus's independent verifier; search the specification; and,
marked development only, drive a development room on loopback (`joule-moq-room dev`):
start it, mint grants for test principals (any service whose address is not a loopback
address is refused before a connection is made), join and publish as them, read the
session, stop it. Each tool carries safety hints; `--read-only` offers only those that
read or run a verifier.

`wai setup-agent` writes AGENTS.md and CLAUDE.md (which imports it) and registers the
server in the project's MCP configuration files by their documented formats. A file
that exists is changed only after its diff is shown and confirmed (asked on a terminal,
or --confirm; otherwise exit 4 with every diff and the confirming command), --dry-run
writes nothing, nothing outside the project directory is written, and its output is
JSON off a terminal.

Both are reached through one table of verbs in wai.rs, so a name is one line. `wrap`
returns its printed lines and its facts, which the packaging tool reads.

tests/cli_mcp.rs drives the binary with an MCP client: every tool, and the verifiers
agreeing vector by vector with jwp-conformance, claim-conformance,
live-conformance/rooms and live-conformance/audit. tests/cli_setup_agent.rs runs the
command in scratch projects, fresh and with files that exist.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
`joule-moq-room dev` (src/dev.rs) runs the relay and the room service in one process
on loopback, with keys made at start and kept only in memory, media held to no
receipts and rate limits open, and says on standard error that it is for development
only. It answers JSON control lines: join (a test principal enters with its grant and
a proof, publishes audio and video, and the answer waits for the clock's join and
publishes), leave, session (the room as live-rooms §9 gives it to a verifier) and
stop. Its log goes to standard error. tokio's io-std feature, for its standard input
and output.

openapi.json describes every route of the service in each of its modes: requests,
answers and statuses. tests/openapi_contract.rs holds it to the code: the routes the
routers match are exactly its operations; each status it lists for an operation is one
the operation's handlers return, and each status they return is listed; and the
service, run beside a relay in each mode (a plain room, end-to-end encryption,
admission by age, co-performance, a watch room, a remote desktop room, a conversation,
calls, and without its relay), answers every operation with a status it lists.

tests/mcp_dev_room.rs builds `wai` with the feature `mcp` in a target directory of its
own and drives `wai mcp` with an MCP client: a development room started, two test
principals granted, joined and publishing, the session verified, a changed record
refused, a leave verified, and a grant from a service off the machine refused.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
CI and docs: the commands for coding agents
Some checks failed
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / each feature of the independent verifiers' steps compiles alone (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
wai cross-architecture byte-equality / does this change touch it (pull_request) Has been cancelled
Details
wai cross-architecture byte-equality / linux-aarch64 (pull_request) Has been cancelled
Details
wai cross-architecture byte-equality / linux-x86_64 (pull_request) Has been cancelled
Details
wai cross-architecture byte-equality / macos-arm64 (reference) (pull_request) Has been cancelled
Details
wai-audit collector and player integration / does this change touch it (pull_request) Has been cancelled
Details
wai-audit collector and player integration / collector · linux (pull_request) Has been cancelled
Details
wai-audit collector and player integration / collector, player integration and the browser end to end · macos (pull_request) Has been cancelled
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
joule-moq-remote host agent / joule-moq-remote, every target (linux-arm64) (pull_request) Has been cancelled
Details
joule-moq-remote host agent / joule-moq-remote, every target (macos) (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Has been cancelled
Details
energy meters on real hardware / sink decode table · RAPL on jetson-hub (NVML surveyed) (pull_request) Has been cancelled
Details
energy meters on real hardware / sink decode table · per-task energy and the GPU rail on macOS (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-relay, its own energy on a counter (macos) (pull_request) Has been cancelled
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Has been cancelled
Details
energy meters on real hardware / RAPL and NVML on jetson-hub (pull_request) Has been cancelled
Details
2b09b960e0 
wai-conformance runs tests/cli_mcp.rs and tests/cli_setup_agent.rs, with the binary's
unit tests, under the feature `mcp` on each leg. The room service's workflow runs every
target, and now says what tests/openapi_contract.rs and tests/mcp_dev_room.rs hold.
wai/README.md says how a project is set up for a coding agent and what `wai mcp`
offers; CHANGELOG records both commands and the API description.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
dcharlot closed this pull request 2026-10-27 04:53:21 -04:00
Some checks failed
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Successful in 5s
Details
wai-web reach builds / wai-web reach · does this change touch it (pull_request) Successful in 6s
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Successful in 9s
Details
joule-moq-remote host agent / joule-moq-remote · does this change touch it (pull_request) Successful in 9s
Details
wai-web wasm32 / does this change touch it (pull_request) Has been cancelled
Details
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Has been cancelled
Details
WAI mbt2018_mean integer decode (regenerated vectors) / does this change touch it (pull_request) Has been cancelled
Details
WAI mbt2018_mean integer decode (regenerated vectors) / regenerate mbt2018_mean integer vectors → Rust decode, required (pull_request) Has been cancelled
Details
wai-sink-swift native sink package / does this change touch it (pull_request) Has been cancelled
Details
wai-sink-swift native sink package / libwai slices, desktop tests, simulator tests · macos (pull_request) Has been cancelled
Details
wai-web reach builds / wai-web reach builds · the package of record, every output as recorded (pull_request) Has been cancelled
Details
wai-web reach builds / wai-web reach builds · this tree's wai-web, every rung on its engine line (pull_request) Has been cancelled
Details
wai-sink-android native sink library / does this change touch it (pull_request) Has been cancelled
Details
wai-sink-android native sink library / the JNI layer and the platform-free half on the host JVM · linux-arm64 (pull_request) Has been cancelled
Details
wai-sink-android native sink library / every ABI, the AAR, and the instrumented tests in a headless emulator · macos (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / does this change touch it (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / shader checks · browser build · wasip2 inertness · MSRV (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · software Vulkan (linux) (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · Metal (macos) (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · discrete GPU, Vulkan (jetson-hub) (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · integrated GPU, Vulkan (framework-128gb) (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · browser WebGPU (macos) (pull_request) Has been cancelled
Details
wai-quantum studio and desktop / does this change touch it (pull_request) Has been cancelled
Details
wai-quantum studio and desktop / studio · browser (pull_request) Has been cancelled
Details
wai-quantum studio and desktop / desktop app · macos (pull_request) Has been cancelled
Details
wai-quantum command line / does this change touch it (pull_request) Has been cancelled
Details
wai-quantum command line / command line · linux (pull_request) Has been cancelled
Details
wai-quantum command line / command line · macos (pull_request) Has been cancelled
Details
wai-pack / wai-pack · does this change touch it (pull_request) Has been cancelled
Details
wai-pack / wai-pack · linux (pull_request) Has been cancelled
Details
wai-pack / wai-pack · linux-arm64 (pull_request) Has been cancelled
Details
wai-pack / wai-pack · macos (pull_request) Has been cancelled
Details
wai-pack / wai-pack · independent verifier (Python) (pull_request) Has been cancelled
Details
wai-pack / wai-pack · the floor through a media prober (pull_request) Has been cancelled
Details
wai-pack / wai-pack · dependency licences (pull_request) Has been cancelled
Details
wai-ops integer operators / does this change touch it (pull_request) Has been cancelled
Details
wai-ops integer operators / linux-aarch64 (pull_request) Has been cancelled
Details
wai-ops integer operators / linux-x86_64 (pull_request) Has been cancelled
Details
wai-ops integer operators / macos-arm64 (pull_request) Has been cancelled
Details
wai-ops integer operators / wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
wai-ops integer operators / wasm32 under Node (pull_request) Has been cancelled
Details
wai-ops integer operators / independent checker (Python) (pull_request) Has been cancelled
Details
wai-ops-npu integer operators on neural processors / does this change touch it (pull_request) Has been cancelled
Details
wai-ops-npu integer operators on neural processors / neural processor (framework-128gb silicon) (pull_request) Has been cancelled
Details
wai-ops-npu integer operators on neural processors / builds · no device is not a pass (linux-arm64) (pull_request) Has been cancelled
Details
wai-ops-gpu integer operators on GPUs / does this change touch it (pull_request) Has been cancelled
Details
wai-ops-gpu integer operators on GPUs / builds · no adapter is not a pass (linux) (pull_request) Has been cancelled
Details
wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · DX12 and Vulkan (cbio-windows) (pull_request) Has been cancelled
Details
WAI neural sink gates / does this change touch it (pull_request) Has been cancelled
Details
WAI neural sink gates / model-free refusals of the neural sink (pull_request) Has been cancelled
Details
wai-ledger service / does this change touch it (pull_request) Has been cancelled
Details
wai-ledger service / service · linux (pull_request) Has been cancelled
Details
wai-ledger service / service · macos (pull_request) Has been cancelled
Details
wai-key-proxy / does this change touch it (pull_request) Has been cancelled
Details
wai-key-proxy / proxy · linux (pull_request) Has been cancelled
Details
WAI JPEG-AI whole decode (pinned inputs, required) / does this change touch it (pull_request) Has been cancelled
Details
WAI JPEG-AI whole decode (pinned inputs, required) / fetch pinned JPEG-AI inputs → whole decode + pixel hash, required (pull_request) Has been cancelled
Details
WAI HTTP delivery / WAI HTTP · does this change touch it (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · falsify mutations 0/3 (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · falsify mutations 1/3 (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · falsify mutations 2/3 (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · falsify patches 0/3 (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · falsify patches 1/3 (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · falsify patches 2/3 (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · every patch and mutation in exactly one shard (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · verified both ways, and the differential (pull_request) Has been cancelled
Details
WAI HTTP delivery / cache rules · controls and labelled caches (pull_request) Has been cancelled
Details
wai formal verification (integer core) / does this change touch it (pull_request) Has been cancelled
Details
wai formal verification (integer core) / every harness in one shard (pull_request) Has been cancelled
Details
wai formal verification (integer core) / kani (arith) (pull_request) Has been cancelled
Details
wai formal verification (integer core) / kani (isqrt512) (pull_request) Has been cancelled
Details
wai formal verification (integer core) / kani (plan) (pull_request) Has been cancelled
Details
wai formal verification (integer core) / kani (sound) (pull_request) Has been cancelled
Details
wai formal verification (integer core) / kani (stage) (pull_request) Has been cancelled
Details
wai formal verification (integer core) / kani (rans64-t2) (pull_request) Has been cancelled
Details
wai formal verification (integer core) / kani (stage-long) (pull_request) Has been cancelled
Details
wai formal verification (integer core) / kani (integer-core) (pull_request) Has been cancelled
Details
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
Details
WAI conformance / does this change touch it (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
Details
WAI conformance / fast integer kernels, every x86_64 kernel set (AVX-512 silicon) (pull_request) Has been cancelled
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / faces from keypoints under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI conformance / each feature of the independent verifiers' steps compiles alone (pull_request) Has been cancelled
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
Details
wai cross-architecture byte-equality / does this change touch it (pull_request) Has been cancelled
Details
wai cross-architecture byte-equality / linux-aarch64 (pull_request) Has been cancelled
Details
wai cross-architecture byte-equality / linux-x86_64 (pull_request) Has been cancelled
Details
wai cross-architecture byte-equality / macos-arm64 (reference) (pull_request) Has been cancelled
Details
wai-audit collector and player integration / does this change touch it (pull_request) Has been cancelled
Details
wai-audit collector and player integration / collector · linux (pull_request) Has been cancelled
Details
wai-audit collector and player integration / collector, player integration and the browser end to end · macos (pull_request) Has been cancelled
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
Details
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
Details
joule-moq-remote host agent / joule-moq-remote, every target (linux-arm64) (pull_request) Has been cancelled
Details
joule-moq-remote host agent / joule-moq-remote, every target (macos) (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Has been cancelled
Details
energy meters on real hardware / sink decode table · RAPL on jetson-hub (NVML surveyed) (pull_request) Has been cancelled
Details
energy meters on real hardware / sink decode table · per-task energy and the GPU rail on macOS (pull_request) Has been cancelled
Details
joule-code conformance gate / joule-moq-relay, its own energy on a counter (macos) (pull_request) Has been cancelled
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Has been cancelled
Details
energy meters on real hardware / RAPL and NVML on jetson-hub (pull_request) Has been cancelled
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
Transaction-Science/open-standards!500
No description provided.