wai: the revenue share — share contract and statement, recomputable from the ledger's invoices and the channel's program-as-run (wai.delivery.revenue_share) #539

Merged

dcharlot merged 5 commits from wai/fast-revenue-share into main 2026-10-29 19:35:16 -04:00

Conversation 0 Commits 5 Files changed 25 +9923 -7

dcharlot commented 2026-10-29 17:34:20 -04:00

Owner

Copy link

What this is

wai.delivery.revenue_share: what each content owner of a linear channel is owed from the ads sold in the channel's breaks, as a statement any party holding the public records recomputes. It joins the two halves of evidence WAI already signs, the program-as-run (wai.video.channel) and the impressions (wai.live.ads break-form receipts with ad-presentation claims, and wai.video.stitched_presentation claims), through the invoices of wai.delivery.ledger, and splits the revenue by a contract every owner signed.

• Text: wai/extensions/revenue-share.md, §1–§13, with a reasons table (§11).
• Records:
  • the share contract WRC1: operator, period, currency, channel id and the channel signer's key, the carriers (rooms of live-ads by room id; stitchers by key), owners, splits (an operator share plus owner shares, integer millionths, summing to 10^6), the asset → split map, the rule for an impression in an entry that is not a programme (preceding, following, between) and the between split. Signed by the operator; countersigned by each owner (64 zero bytes = not yet countersigned). In force only when every owner has countersigned.
  • the statement WRS1: contract digest, party (an owner or the operator), period, currency, the invoice digests and run identities it rests on, one 67-byte line per (split, class) the party shares in (impressions, revenue, the party's ppm, its amount, cited count, citation digest), and the total. Signed by the operator.
  • the JSON carriage of a wai.video.channel receipt (§4): its signed bytes, identity and verification written out for a verifier that is not wai-rs. ChannelReceipt gains to_json/from_json/payload; its signed format and every existing receipt are unchanged.
• Module: wai-rs/src/revenue_share.rs (feature revenue_share = receipt_ledger + video_channel), its corpus generator src/revenue_share/corpus.rs, bin wai_revenue_share_vectors, test tests/revenue_share.rs.
• Operations (naming rule N3, agent rules): contract.create (wai contract create), contract.update (wai contract accept, an owner's countersignature), statement.create (wai statement create, --dry-run), statement.verify (wai statement verify). Placement local (they read and write files on this machine), so Studio binds none; actions.generated.js regenerated.
• Corpus: wai/live-conformance/share/ (vectors.json + README), generated from fixed seeds and the ledger corpus's sources. Second implementation: wai/live-conformance/revenue_share_verify.py (python3 -I), from the text only.
• REGISTRY.md entry + registry export, SPEC §5 paragraph, CHANGELOG entry, CI step in wai-conformance.yml, and cli_ops with quickstart,revenue_share in wai-catalogue.yml.

How attribution works (§5, §6)

1. A statement's impressions are those of the ads and stitched sources of accepted ledger documents (receipt-ledger §7.1), from the contract's carriers only (an invoice may bill several channels). Classes: presented (counted under a claims policy, or a stitched presentation with a time), beacons (billable under a policy without claims), unplaced (a stitched presentation whose marker states no time: DASH carriage 3, or a START-DATE outside the stated form). Price = the invoice's tariff ads price for the unit that billed it (presented_impressions or billable_impressions). Classes are never summed together.
2. Instant: a break-form impression is at its room's t0 + the break's t (the whole break is attributed by its start); a stitched presentation is at its marker's START-DATE (RFC 3339 §5.6 date-time in capitals, Z or ±hh:mm, up to 9 fraction digits truncated to µs).
3. Run and entry: the run whose window holds the instant (runs of the contract's channel and signer, non-overlapping), then the schedule entry whose span holds it; neither → outside_window.
4. Asset: a programme gives its own asset (a mid-roll inside a programme is that programme's); an ad/filler entry gives, by the rule, the last programme before it, the first after it, or none (between); none → the between split. Unplaced impressions go to the between split too, in their own class. An asset the contract does not map → asset_unmapped.

How rounding works (§7.3)

Per (split, class), once over the statement's period, never per impression: revenue R is divided among the split's parties (its owners in listed order, then the operator if its share is above 0) by the largest-remainder rule: quota = R × ppm, base = ⌊quota / 10^6⌋, leftover = R − Σ base (< number of parties), the parties with the largest remainders get one more each, ties to the earlier party. Parts are integers and sum to R exactly; the operator's and each owner's statements state the same revenue for a split and class, and their parts sum to it. The verifier's outcome states each line's full division.

Refusals (§11)

Added: contract_invalid, split_not_whole (shares that do not sum), not_countersigned, contract_overlap (two contracts sharing a channel or a carrier in an overlapping period), share_statement_invalid, contract_mismatch, outside_contract, run_invalid (a program-as-run that does not verify), run_foreign, run_overlap, invoice_foreign, impression_duplicate (one impression billed by two invoices of a statement, e.g. under two tariffs), outside_window (an impression outside any aired window), asset_unmapped, share_statement_mismatch. Reused with the meaning the text gives: truncated, malformed, unknown_version, bad_key, bad_signature, outside_period, line_unsourced (a line with no source), citation_mismatch; and every receipt-ledger code at a ledger document, at its place. Codes that already meant something else in other extensions (statement_invalid, statement_mismatch, ledger_mismatch, shares_not_whole, share_invalid) were avoided.

Composition with the receipt ledger (§9)

The statement's sources are ledger sources, verified by the ledger; its prices are the tariff's; its records are the invoice's, and it cites the invoice. It adds only the instant of each impression on the program-as-run and the split the contract gives. The ledger document a statement is given is the one the ledger service keeps with each invoice (GET /v1/invoices/{digest}), unchanged. No ledger record or source kind changes.

Decisions

• One registered string for both records (wai.delivery.revenue_share), as wai.delivery.ledger names its tariff and invoice. File name revenue-share.md.
• Evidence enters only through accepted ledger documents (not raw sources + tariff): an owner's revenue is then a part of what a buyer was invoiced, never a figure the operator states; the operator must be the invoices' seller.
• Countersignatures inline in the contract (zero = pending), so one file is offered, filled and verified.
• A between split is always named; rules preceding/following fall back to it when no such programme exists, and unplaced presentations go to it in their own class.
• contracts in the verification document: overlap is checked against the contracts the verifier holds; a verifier holding fewer than the operator signed cannot see an overlap with the ones it lacks (§13 says so).
• The ChannelReceipt JSON carriage is new text describing existing bytes; the carriage refuses the legacy HwShunt label, as stitched-presentation's form-1 carriage does.

Checks

check	command	host	result
module unit tests	cargo test --locked --no-default-features --features revenue_share --lib revenue_share::	Framework box	6 passed
channel receipt tests (incl. carriage round trip)	… --lib wai_video_channel::	Framework box	8 passed
corpus + worked example + CLI test	… --features revenue_share --test revenue_share	Framework box	7 passed
corpus regenerates / every vector	wai_revenue_share_vectors verify ../live-conformance/share	Framework box	PASS, PASS
CI step with the workflow's full WAI_FEATURES	the three cargo lines of the new step	Framework box	6 / 8 / 7 passed
feature alone	cargo check --locked --no-default-features --features revenue_share --tests	Framework box	ok
catalogue rules	cargo test --locked --no-default-features --lib catalogue	Framework box	6 passed
registry tests (SPEC ↔ table, wire identifiers in their sections)	cargo test --locked --no-default-features --lib codecs::	Framework box	53 passed
CLI doors with the feature	cargo test --locked --no-default-features --features quickstart,revenue_share --bin wai --test cli_ops	Framework box	47 + 10 passed
CLI doors, archive build	… --features quickstart --bin wai --test cli_ops	Framework box	47 + 10 passed
clippy --all-targets (quickstart,revenue_share), filtered to touched files	cargo clippy … --message-format short | grep <touched files>	Framework box	0 notes
registry export	wai registry export then --check	Framework box	up to date
catalogue export	wai ops export --out ../catalogue/ops.json then --check	Framework box	up to date
compatibility gate	wai breaking --against 564a42df8	Framework box	no unacknowledged breaking change
Python verifier	python3 -I live-conformance/revenue_share_verify.py live-conformance/share	Framework box	42/42 PASS; 61 mutated copies fail; 21 dropped checks caught
Studio actions	node scripts/actions.mjs --check	local (light)	holds to the catalogue, 100 ops
ops doors	python3 -I scripts/check-wai-ops-doors.py	local	0 findings
repo checks	check-tests-in-ci.py, check-workflow-concurrency.sh, check-spec-refs.py, check-wai-section-refs.py, check-no-vanity-metrics.sh, test-public-text-checks.sh, check-comparative-prose.sh, check-orphan-sources.py	local	all exit 0
workflow YAML	ruby -ryaml -e 'ARGV.each{…}' .github/workflows/*.yml	local	all parse
public names	check-public-names.sh on the 25 changed files; commit messages and this body against the same patterns	local	clean

No Cargo.lock changes: no dependency added (the --locked runs above pass). No src/ffi*.rs/cbindgen.toml change, so include/wai.h is untouched.

Falsifications

All after committing, on the Framework box, each mutation an exact one-match edit of src/revenue_share.rs inside the rb snapshot, the corpus test every_vector_gets_its_stated_outcome run, then the file restored with git checkout -- and touched; the baseline passes before and after (fastb-falsify.sh).

rule broken in the reference module	caught by	outcome under the mutant	test exit
contract overlap check dropped	contract_overlap	accept	101
zero countersignature accepted	contract_offered	bad_signature (not not_countersigned)	101
split sums unchecked	contract_split_short	contract_mismatch	101
operator signature unchecked	contract_operator_key_small_order	bad_signature at the owner	101
statement signature unchecked	statement_signature	accept	101
run verification dropped	run_aired_misstated	citation_mismatch	101
run overlap dropped	runs_overlapping	share_statement_mismatch	101
invoice seller unchecked	invoice_of_another_seller	impression_duplicate	101
duplicate impressions across invoices unchecked	impression_billed_twice	citation_mismatch	101
impression period unchecked	impression_outside_the_period	line_unsourced	101
rule following read as preceding	owner_b_following	line_unsourced	101
unplaced presentations counted as presented	owner_a_october	line_unsourced	101
ties to the later party	owner_a_october	share_statement_mismatch	101
no leftover distributed (floor only)	owner_a_october	share_statement_mismatch	101
the run not cited	owner_a_october	citation_mismatch	101
line_unsourced check dropped	line_impressions_raised	share_statement_mismatch	101
beacons priced as presented	owner_a_october	share_statement_mismatch	101
vectors.json edited (a total raised by 1)	the_committed_corpus_regenerates…; and revenue_share_verify.py	regeneration differs; Python FAIL owner_a_october	101; 1

The Python verifier falsifies itself on every run: 61 mutated copies of the corpus (statement bytes flipped at six offsets per accepted vector, a run or a ledger document dropped, a stated total, division or attribution changed, contract bytes flipped, a run renamed or its signature flipped, a refusal's reason changed) all fail, and each of its 21 checks dropped in turn is caught by the corpus.

Not in this PR

Payouts, accounts, an owner invoicing the operator (no ledger source kind for it; adding one would need a new tariff version), invoicing a buyer, currency conversion, the hosted service, the feed import and guide (FAST-A), any deploy. Placing a DASH (carriage 3) presentation in time: its marker names no date, so such presentations are kept in the class unplaced. A per-owner count of impressions that aired in its breaks but did not count (claims absent) is not stated: the ledger's ad report already states each verdict.

For the lead

• revenue_share is not in quickstart (the archive build), so the released wai reports the four operations as not built; the catalogue job runs cli_ops with quickstart,revenue_share. Adding it to the archive build pulls in receipt_ledger's feature set.
• FAST-A touches the same shared files: my additions are in their own blocks (CHANGELOG subsection, SPEC paragraph after the ledger's, catalogue block before "the catalogue itself", conformance step after the ledger step). The single-line WAI_FEATURES list, the --test prebuild list and the per-feature loop get revenue_share appended at the end; ops.json, actions.generated.js, REGISTRY.md, registry/capabilities.json and vocab/v2.ttl are generated, so after merging both, regenerate them rather than hand-merge.

🤖 Generated with Claude Code

## What this is `wai.delivery.revenue_share`: what each content owner of a linear channel is owed from the ads sold in the channel's breaks, as a statement any party holding the public records recomputes. It joins the two halves of evidence WAI already signs, the program-as-run (`wai.video.channel`) and the impressions (`wai.live.ads` break-form receipts with ad-presentation claims, and `wai.video.stitched_presentation` claims), through the invoices of `wai.delivery.ledger`, and splits the revenue by a contract every owner signed. - **Text**: `wai/extensions/revenue-share.md`, §1–§13, with a reasons table (§11). - **Records**: - the **share contract** `WRC1`: operator, period, currency, channel id and the channel signer's key, the carriers (rooms of live-ads by room id; stitchers by key), owners, splits (an operator share plus owner shares, integer millionths, summing to 10^6), the asset → split map, the rule for an impression in an entry that is not a programme (`preceding`, `following`, `between`) and the between split. Signed by the operator; countersigned by each owner (64 zero bytes = not yet countersigned). In force only when every owner has countersigned. - the **statement** `WRS1`: contract digest, party (an owner or the operator), period, currency, the invoice digests and run identities it rests on, one 67-byte line per (split, class) the party shares in (impressions, revenue, the party's ppm, its amount, cited count, citation digest), and the total. Signed by the operator. - the **JSON carriage of a `wai.video.channel` receipt** (§4): its signed bytes, identity and verification written out for a verifier that is not `wai-rs`. `ChannelReceipt` gains `to_json`/`from_json`/`payload`; its signed format and every existing receipt are unchanged. - **Module**: `wai-rs/src/revenue_share.rs` (feature `revenue_share` = `receipt_ledger` + `video_channel`), its corpus generator `src/revenue_share/corpus.rs`, bin `wai_revenue_share_vectors`, test `tests/revenue_share.rs`. - **Operations** (naming rule N3, agent rules): `contract.create` (`wai contract create`), `contract.update` (`wai contract accept`, an owner's countersignature), `statement.create` (`wai statement create`, `--dry-run`), `statement.verify` (`wai statement verify`). Placement `local` (they read and write files on this machine), so Studio binds none; `actions.generated.js` regenerated. - **Corpus**: `wai/live-conformance/share/` (vectors.json + README), generated from fixed seeds and the ledger corpus's sources. **Second implementation**: `wai/live-conformance/revenue_share_verify.py` (`python3 -I`), from the text only. - `REGISTRY.md` entry + registry export, SPEC §5 paragraph, CHANGELOG entry, CI step in `wai-conformance.yml`, and `cli_ops` with `quickstart,revenue_share` in `wai-catalogue.yml`. ## How attribution works (§5, §6) 1. A statement's impressions are those of the `ads` and `stitched` sources of **accepted ledger documents** (receipt-ledger §7.1), from the contract's carriers only (an invoice may bill several channels). Classes: **presented** (counted under a claims policy, or a stitched presentation with a time), **beacons** (billable under a policy without claims), **unplaced** (a stitched presentation whose marker states no time: DASH carriage 3, or a `START-DATE` outside the stated form). Price = the invoice's tariff `ads` price for the unit that billed it (`presented_impressions` or `billable_impressions`). Classes are never summed together. 2. **Instant**: a break-form impression is at its room's `t0` + the break's `t` (the whole break is attributed by its start); a stitched presentation is at its marker's `START-DATE` (RFC 3339 §5.6 date-time in capitals, `Z` or `±hh:mm`, up to 9 fraction digits truncated to µs). 3. **Run and entry**: the run whose window holds the instant (runs of the contract's channel and signer, non-overlapping), then the schedule entry whose span holds it; neither → `outside_window`. 4. **Asset**: a programme gives its own asset (a mid-roll inside a programme is that programme's); an `ad`/`filler` entry gives, by the rule, the last programme before it, the first after it, or none (`between`); none → the between split. Unplaced impressions go to the between split too, in their own class. An asset the contract does not map → `asset_unmapped`. ## How rounding works (§7.3) Per (split, class), once over the statement's period, never per impression: revenue R is divided among the split's parties (its owners in listed order, then the operator if its share is above 0) by the **largest-remainder rule**: quota = R × ppm, base = ⌊quota / 10^6⌋, leftover = R − Σ base (< number of parties), the parties with the largest remainders get one more each, ties to the earlier party. Parts are integers and sum to R exactly; the operator's and each owner's statements state the same revenue for a split and class, and their parts sum to it. The verifier's outcome states each line's full **division**. ## Refusals (§11) Added: `contract_invalid`, `split_not_whole` (shares that do not sum), `not_countersigned`, `contract_overlap` (two contracts sharing a channel or a carrier in an overlapping period), `share_statement_invalid`, `contract_mismatch`, `outside_contract`, `run_invalid` (a program-as-run that does not verify), `run_foreign`, `run_overlap`, `invoice_foreign`, `impression_duplicate` (one impression billed by two invoices of a statement, e.g. under two tariffs), `outside_window` (an impression outside any aired window), `asset_unmapped`, `share_statement_mismatch`. Reused with the meaning the text gives: `truncated`, `malformed`, `unknown_version`, `bad_key`, `bad_signature`, `outside_period`, `line_unsourced` (a line with no source), `citation_mismatch`; and every receipt-ledger code at a ledger document, at its place. Codes that already meant something else in other extensions (`statement_invalid`, `statement_mismatch`, `ledger_mismatch`, `shares_not_whole`, `share_invalid`) were avoided. ## Composition with the receipt ledger (§9) The statement's sources **are** ledger sources, verified by the ledger; its prices **are** the tariff's; its records **are** the invoice's, and it cites the invoice. It adds only the instant of each impression on the program-as-run and the split the contract gives. The ledger document a statement is given is the one the ledger service keeps with each invoice (`GET /v1/invoices/{digest}`), unchanged. No ledger record or source kind changes. ## Decisions - One registered string for both records (`wai.delivery.revenue_share`), as `wai.delivery.ledger` names its tariff and invoice. File name `revenue-share.md`. - Evidence enters only through accepted ledger documents (not raw sources + tariff): an owner's revenue is then a part of what a buyer was invoiced, never a figure the operator states; the operator must be the invoices' seller. - Countersignatures inline in the contract (zero = pending), so one file is offered, filled and verified. - A between split is always named; rules `preceding`/`following` fall back to it when no such programme exists, and unplaced presentations go to it in their own class. - `contracts` in the verification document: overlap is checked against the contracts the verifier holds; a verifier holding fewer than the operator signed cannot see an overlap with the ones it lacks (§13 says so). - The `ChannelReceipt` JSON carriage is new text describing existing bytes; the carriage refuses the legacy `HwShunt` label, as stitched-presentation's form-1 carriage does. ## Checks | check | command | host | result | |---|---|---|---| | module unit tests | `cargo test --locked --no-default-features --features revenue_share --lib revenue_share::` | Framework box | 6 passed | | channel receipt tests (incl. carriage round trip) | `… --lib wai_video_channel::` | Framework box | 8 passed | | corpus + worked example + CLI test | `… --features revenue_share --test revenue_share` | Framework box | 7 passed | | corpus regenerates / every vector | `wai_revenue_share_vectors verify ../live-conformance/share` | Framework box | PASS, PASS | | CI step with the workflow's full `WAI_FEATURES` | the three cargo lines of the new step | Framework box | 6 / 8 / 7 passed | | feature alone | `cargo check --locked --no-default-features --features revenue_share --tests` | Framework box | ok | | catalogue rules | `cargo test --locked --no-default-features --lib catalogue` | Framework box | 6 passed | | registry tests (SPEC ↔ table, wire identifiers in their sections) | `cargo test --locked --no-default-features --lib codecs::` | Framework box | 53 passed | | CLI doors with the feature | `cargo test --locked --no-default-features --features quickstart,revenue_share --bin wai --test cli_ops` | Framework box | 47 + 10 passed | | CLI doors, archive build | `… --features quickstart --bin wai --test cli_ops` | Framework box | 47 + 10 passed | | clippy `--all-targets` (quickstart,revenue_share), filtered to touched files | `cargo clippy … --message-format short \| grep <touched files>` | Framework box | 0 notes | | registry export | `wai registry export` then `--check` | Framework box | up to date | | catalogue export | `wai ops export --out ../catalogue/ops.json` then `--check` | Framework box | up to date | | compatibility gate | `wai breaking --against 564a42df8` | Framework box | no unacknowledged breaking change | | Python verifier | `python3 -I live-conformance/revenue_share_verify.py live-conformance/share` | Framework box | 42/42 PASS; 61 mutated copies fail; 21 dropped checks caught | | Studio actions | `node scripts/actions.mjs --check` | local (light) | holds to the catalogue, 100 ops | | ops doors | `python3 -I scripts/check-wai-ops-doors.py` | local | 0 findings | | repo checks | `check-tests-in-ci.py`, `check-workflow-concurrency.sh`, `check-spec-refs.py`, `check-wai-section-refs.py`, `check-no-vanity-metrics.sh`, `test-public-text-checks.sh`, `check-comparative-prose.sh`, `check-orphan-sources.py` | local | all exit 0 | | workflow YAML | `ruby -ryaml -e 'ARGV.each{…}' .github/workflows/*.yml` | local | all parse | | public names | `check-public-names.sh` on the 25 changed files; commit messages and this body against the same patterns | local | clean | No `Cargo.lock` changes: no dependency added (the `--locked` runs above pass). No `src/ffi*.rs`/`cbindgen.toml` change, so `include/wai.h` is untouched. ## Falsifications All after committing, on the Framework box, each mutation an exact one-match edit of `src/revenue_share.rs` inside the rb snapshot, the corpus test `every_vector_gets_its_stated_outcome` run, then the file restored with `git checkout --` and touched; the baseline passes before and after (`fastb-falsify.sh`). | rule broken in the reference module | caught by | outcome under the mutant | test exit | |---|---|---|---| | contract overlap check dropped | `contract_overlap` | accept | 101 | | zero countersignature accepted | `contract_offered` | bad_signature (not `not_countersigned`) | 101 | | split sums unchecked | `contract_split_short` | contract_mismatch | 101 | | operator signature unchecked | `contract_operator_key_small_order` | bad_signature at the owner | 101 | | statement signature unchecked | `statement_signature` | accept | 101 | | run verification dropped | `run_aired_misstated` | citation_mismatch | 101 | | run overlap dropped | `runs_overlapping` | share_statement_mismatch | 101 | | invoice seller unchecked | `invoice_of_another_seller` | impression_duplicate | 101 | | duplicate impressions across invoices unchecked | `impression_billed_twice` | citation_mismatch | 101 | | impression period unchecked | `impression_outside_the_period` | line_unsourced | 101 | | rule `following` read as preceding | `owner_b_following` | line_unsourced | 101 | | unplaced presentations counted as presented | `owner_a_october` | line_unsourced | 101 | | ties to the later party | `owner_a_october` | share_statement_mismatch | 101 | | no leftover distributed (floor only) | `owner_a_october` | share_statement_mismatch | 101 | | the run not cited | `owner_a_october` | citation_mismatch | 101 | | `line_unsourced` check dropped | `line_impressions_raised` | share_statement_mismatch | 101 | | beacons priced as presented | `owner_a_october` | share_statement_mismatch | 101 | | `vectors.json` edited (a total raised by 1) | `the_committed_corpus_regenerates…`; and `revenue_share_verify.py` | regeneration differs; Python `FAIL owner_a_october` | 101; 1 | The Python verifier falsifies itself on every run: 61 mutated copies of the corpus (statement bytes flipped at six offsets per accepted vector, a run or a ledger document dropped, a stated total, division or attribution changed, contract bytes flipped, a run renamed or its signature flipped, a refusal's reason changed) all fail, and each of its 21 checks dropped in turn is caught by the corpus. ## Not in this PR Payouts, accounts, an owner invoicing the operator (no ledger source kind for it; adding one would need a new tariff version), invoicing a buyer, currency conversion, the hosted service, the feed import and guide (FAST-A), any deploy. Placing a DASH (carriage 3) presentation in time: its marker names no date, so such presentations are kept in the class `unplaced`. A per-owner count of impressions that aired in its breaks but did not count (claims absent) is not stated: the ledger's ad report already states each verdict. ## For the lead - `revenue_share` is not in `quickstart` (the archive build), so the released `wai` reports the four operations as not built; the catalogue job runs `cli_ops` with `quickstart,revenue_share`. Adding it to the archive build pulls in `receipt_ledger`'s feature set. - FAST-A touches the same shared files: my additions are in their own blocks (CHANGELOG subsection, SPEC paragraph after the ledger's, catalogue block before "the catalogue itself", conformance step after the ledger step). The single-line `WAI_FEATURES` list, the `--test` prebuild list and the per-feature loop get `revenue_share` appended at the end; `ops.json`, `actions.generated.js`, `REGISTRY.md`, `registry/capabilities.json` and `vocab/v2.ttl` are generated, so after merging both, regenerate them rather than hand-merge. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dcharlot added 4 commits 2026-10-29 17:34:21 -04:00

wai: the revenue share (wai.delivery.revenue_share): share contract, statement, corpus ... c093d812ca

extensions/revenue-share.md: the share contract (WRC1) an operator and every
owner it names sign, mapping a channel's assets to splits of integer millionths
with a rule for breaks between programmes; the program-as-run's JSON carriage,
writing out the wai.video.channel receipt's signed bytes unchanged; impressions
from the receipt ledger's verified invoices, placed by their instants and
attributed to the programme on air; the statement (WRS1) of one party and one
period, divided by the largest-remainder rule and citing its records.

wai-rs: the revenue_share module (feature revenue_share), ChannelReceipt's JSON
carriage, the corpus generator and tests/revenue_share.rs with the worked
example. live-conformance/share/: the corpus, from fixed seeds and the ledger
corpus's sources.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: revenue_share_verify.py, the revenue share's second implementation ... 2108af0587

Written from extensions/revenue-share.md, sharing no code with wai-rs: reads
every contract, run, marker and statement itself, verifies each ledger document
with receipt_ledger_verify.py, recomputes every attribution, line, division and
citation, and requires every mutated copy of the corpus and every weakened
verifier to fail. The text states the aired test of a run exactly; the module's
complex types are named.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: the revenue share's operations, registry entry, SPEC paragraph and CI ... 7bdca09d9f

contract.create (wai contract create), contract.update (wai contract accept),
statement.create (wai statement create) and statement.verify (wai statement
verify), under the agent rules, with --dry-run samples in tests/cli_ops.rs and
an end-to-end test in tests/revenue_share.rs. wai.delivery.revenue_share and its
magics WRC1 and WRS1 in the registry, with the export regenerated; the catalogue
export and Studio's generated actions regenerated; a SPEC §5 paragraph and a
CHANGELOG entry. CI: the conformance step (module tests, the corpus test and
revenue_share_verify.py), the feature in the feature lists, and cli_ops with
quickstart,revenue_share in the catalogue job.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai catalogue: the feature revenue_share, so its operations are available in a build that has it ... 5d0fc19cb1

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot added 1 commit 2026-10-29 18:04:23 -04:00

wai_video_channel: the receipt's JSON carriage is the one JSON form ... 879e94957a

ChannelReceipt::to_json and from_json are the JSON form any record or tool that carries a
channel receipt uses, so the channel family has one carriage, not one per extension.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot referenced this pull request from a commit 2026-10-29 18:49:25 -04:00

Merge #539's branch (wai/fast-revenue-share) into wai/fast-statement-check

dcharlot referenced this pull request 2026-10-29 18:50:23 -04:00

wai: the opportunity report and the statement check (wai.delivery.opportunity) #541

dcharlot merged commit 7473e6d7ec into main 2026-10-29 19:35:16 -04:00

dcharlot referenced this pull request from a commit 2026-10-29 19:35:18 -04:00

Merge pull request 'wai: the revenue share — share contract and statement, recomputable from the ledger's invoices and the channel's program-as-run (wai.delivery.revenue_share)' (#539) from wai/fast-revenue-share into main

dcharlot referenced this pull request from a commit 2026-10-29 19:45:18 -04:00

Merge origin/main into wai/routed-jobs

dcharlot referenced this pull request from a commit 2026-10-29 20:19:52 -04:00

Merge origin/main (#539, the revenue share) into wai/fast-channel-guide

dcharlot referenced this pull request 2026-10-29 20:20:19 -04:00

wai: channel lineup and guide — a linear channel's feeds imported, signed (wai.video.lineup), and its guide checkable #540

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Transaction-Science/open-standards!539

No description provided.