wai: media jobs in the receipt ledger, and the int_motion receipts written down (stacked on #542) #544

Merged

dcharlot merged 20 commits from wai/routed-jobs-ledger into main 2026-10-30 05:29:26 -04:00

Conversation 0 Commits 20 Files changed 52 +12593 -212

dcharlot commented 2026-10-29 21:18:47 -04:00

Owner

Copy link

Open WAI records for routed media jobs, second half: media jobs billed by the receipt ledger, the receipts of wai.video.int_motion written down, and the encode receipt.

Stacked on #542: this branch holds #542's commits, and both now include main through 2666f8468 (#541, #545). Merge #542 (head bc500a9eb) first; this PR's own commits are the rest.

What is in it

The receipt ledger prices media jobs (extensions/receipt-ledger.md)

• Tariff and invoice version 2. WLT1 and WLI1 with version byte 2. A version-2 tariff carries job prices (§4.5): a capability, a unit, a divisor and a price. The unit is jobs, or subpixels, which is the work_pixel_ops of the job's output receipt. Version 1 reads, verifies and bills as before.

• Job source (§5.1). A route record's verification document (wai.route.record, #542), with its hops' OER/2 receipts and keys, plus outputs: wai.video.int_motion decode receipts, each with its codestream. It is verified as route-record §7 (receipts checked). Each output is read by integer-payloads §15.2 and re-derived from its codestream, or refused output_invalid.

• Billed hop, serving capability, figure (§5.1). The billed hop is the attempt the record bills; the serving capability is its candidate's. The figure is that hop's OER/2 figure: the unmetered marker, or microjoules (exact, a half to the even one) beside its energy.class. A figure with no class is refused job_figure_invalid.

• New kinds.

  • Record kinds: 14 (an OER/2 receipt), 15 (an int_motion decode receipt), 16 (a route record). These were 10 to 12, which collided with main's kinds: 10 and 11 are revenue-share §7.4's, 12 and 13 opportunity-report §7.3's.
  • Scope kind 5 (a router's key).
  • Line source kind 5, whose unit is the index of a job price.
  • Energy scope 5 jobs: the serving hops' figures by class, the unmetered counted apart.

• One registry of record kinds (§5.2).

  • The table now registers every kind a WAI text names a record by. Rows 10 to 13 point to revenue-share §7.4 and opportunity-report §7.3, with their numbers and meanings unchanged, and both texts now say their kinds are registered there.
  • 128 to 255 are reserved for private and provisional use: an implementation's own records (a hosted service's provisional sidecars, say) may use them, and no kind WAI assigns later will collide with them. A WAI record never states one, and an invoice that lists one is refused private_kind, in either version (such an invoice was invoice_invalid before). A version-2 invoice lists kinds 1 to 9 and 14 to 16, never another text's.

• Double-billing rules. One hop and one output belong to one job (record_duplicate). Two records of one router for one job are record_overlap.

• Nothing for unbilled jobs. A failed hop, a hop past the declared deadline, and a job no hop served bill nothing.

• Corpus (live-conformance/ledger/). It reads live-conformance/routes/. It adds one accepted month of jobs beside a package:

  • an int_motion job billed per job and per subpixel;
  • a failover billed at the fallback's price;
  • a late job and an all-failed job, billed nothing;
  • an unmetered serving hop (coverage partial);
  • rows of a counter and a model class.

  It also adds 15 controls: job prices out of order, a router in a v1 scope, a job source under v1, a v1 invoice under a v2 tariff, a record refused by its own extension, an output not re-derived, a figure with no class, a router outside the scope, outside the period, a job given twice, routed twice, an output claimed by two jobs, a job line overstated, a jobs row altered. Three more cover the kinds: a private kind in a version-2 invoice and in a version-1 invoice (private_kind), and another text's kind in an invoice (invoice_invalid). The existing invoice_version control now uses version 3, since version 2 is defined; every other existing vector keeps its outcome.

• Second implementation. receipt_ledger_verify.py verifies each job with route_record_verify.py and each output with the new live-conformance/_int_motion_receipt.py, written from integer-payloads §15.

The int_motion receipts (extensions/integer-payloads.md §15)

• §15.1–§15.2 write down the decode receipt and its JSON form unchanged. Until now only the code defined them: fields, frame and clip commitments, Merkle root, signing payload, class encoding, receipt hash, what makes it consistent and re-derived, and the JSON members with the derived rate's exact spelling.
• §15.3 adds the encode receipt (wai.video.int_motion/encode-receipt). It states the source frames' hashes and their commitment, the parameters (block, search, mv_precision, q), the SSE the payload decodes with against the source, the work, and the encode's energy and class (a new profile: never HwShunt). VideoEncodeReceipt seals it over the reference encoder's payload, re-derives it from the payload and the source, and reads and writes its JSON.

Small

• oer::micro_joules: an OER/2 figure as whole microjoules, exactly.
• The opportunity report's corpus (#541) built a ledger Tariff literal; it now states version: 1 and no job prices, and its bytes and corpus are unchanged.
• The route corpus binds each hop receipt to its job, so no two jobs share a receipt. It gives the jobs the ledger bills distinct ids, and adds two accepted vectors: a hop that served unmetered, and one whose figure states no class.

Design decisions (and why)

• A new tariff version, not new meanings for existing fields. Version 1's bytes, rules and outcomes are unchanged (wai breaking reports no wire break). A job price is only billable under a tariff the buyer signed at version 2.
• A job line's unit is the index of its job price. The 94-byte line has no room for a capability, and keying lines by (router, price index) keeps one line per capability and unit with the format unchanged.
• Billing follows the route record's billed attempt, not the hop receipt alone. The route record already holds the deadline and the failure rules, so the ledger needs no deadline field of its own on the hop receipt.
• Outputs are int_motion decode receipts in this revision. They are what a customer can re-derive from the codestream. Package jobs stay package sources, billed by §4.1's package prices. The encode receipt is defined and tested but not yet a ledger record kind.
• A billed hop's figure must carry a class (or be the unmetered marker), so the jobs' rows never mix a classless figure into a class.

Checks

check	command	result	host
ledger lib tests	cargo test --locked --no-default-features --features receipt_ledger --lib receipt_ledger::	8 passed (2 new: v2 tariff and invoice, with every kind range)	Framework
ledger corpus + tests	wai_receipt_ledger_vectors gen; cargo test --features receipt_ledger --test receipt_ledger	regenerates; 4 passed	Framework
ledger, second implementation	python3 -I live-conformance/receipt_ledger_verify.py live-conformance/ledger	every vector; 18 reasons; 45 mutated copies fail; 23 dropped checks caught (private-kind among them)	local (needs cryptography)
ledger corpus after renumbering	every version-1 vector and every source byte for byte unchanged; the jobs vector cites kinds 5, 14, 15 and 16	pass	local
opportunity report	--test opportunity_report, --lib opportunity_report::; opportunity_report_verify.py	6 + 12 passed; every vector, 115 copies, 32 checks	Framework; local
revenue share (reads the ledger)	--test revenue_share (release); revenue_share_verify.py	7 passed; all pass (61 copies, 21 checks)	Framework; local
ledger service	cd wai/wai-ledger && cargo test --locked	3 passed	Studio
route record	--test route_record; wai_route_record_vectors verify; route_record_verify.py	6 passed; PASS; all pass (371 copies, 34 checks)	Studio; local
OER	--features oer --lib oer:: (incl. micro_joules); wai_oer_vectors verify	18 passed; all pass	Studio
video receipt (incl. encode receipt)	--features video_receipt --test video_receipt	15 passed	Studio
CI feature list	cargo test --no-run --features "$WAI_FEATURES" --lib plus every one of the job's test targets	compiles (this is the check that found the opportunity corpus's literal)	Framework
clippy	--all-targets --features receipt_ledger,revenue_share and video_receipt	no note in a touched file	Studio / Framework
wai breaking --against 2666f8468		no unacknowledged break (ledger API, Reason::PrivateKind and the corpus control acknowledged in the CHANGELOG)	Framework
repo checks	tests-in-CI, workflow concurrency, spec-refs, section-refs, vanity, public-text self-test, orphan sources, ops doors; YAML parse; wfsteps.py on the merge	all 0; 0 problems	local
public names and comparative prose	whole tree, the OER/2 files included (#545); messages and this body	clean	local

Falsifications (committed first, each restored)

• Ledger, wai-rs (wai_receipt_ledger_vectors verify, each exit ≠ 0):
  • a hop or output shared by two jobs admitted (3 fails);
  • a job routed twice admitted (3);
  • an unclassed figure taken as unmetered (3);
  • an output not re-derived from its codestream (3);
  • the invoice's version not bound to the tariff's (3);
  • a router outside the scope billed (3);
  • a served hop billed whatever the record says (5);
  • subpixels not counted (regeneration panics: exit 101);
  • a private kind read as any unassigned kind (4 fails);
  • another text's kind admitted in an invoice (3).
• Ledger, Python. job-figure, output and job-duplicate are among the 22 checks each caught when dropped. Two job mutations (an output dropped, the jobs' coverage stated whole) are among the copies that must fail.
• Encode receipt. The first version of the tests was vacuous: dropping the SSE recomputation, the parameters' match with the header, or the source hashing each still passed, because every control broke the signature. A hidden resign now seals each control over its defect, and each mutant fails the test.

Not in this PR

• The encode receipt as a ledger record kind, and a Python second implementation of the encode receipt (the decode receipt has one).
• A figure profile for wai:video-encode-receipt-id in energy-measurement §6.1, so that energy claims can name encode receipts.
• jwp-receipts §2.4.5's energy claim held to a minor-1 receipt's class.

For the lead / owner

• receipt_ledger now depends on route_record and video_receipt (it builds the int_motion decoder). receipt_ledger_verify.py now needs cryptography through the OER/2 reference verifier, as the CI job already installs.
• Billing rule to confirm: a job is billed only when its record bills an attempt, and at the prices of the capability that hop served (a fallback is billed at the fallback's price).

🤖 Generated with Claude Code

Open WAI records for routed media jobs, second half: media jobs billed by the receipt ledger, the receipts of `wai.video.int_motion` written down, and the encode receipt. **Stacked on #542**: this branch holds #542's commits, and both now include main through `2666f8468` (#541, #545). Merge #542 (head `bc500a9eb`) first; this PR's own commits are the rest. ## What is in it ### The receipt ledger prices media jobs (extensions/receipt-ledger.md) - **Tariff and invoice version 2.** `WLT1` and `WLI1` with version byte 2. A version-2 tariff carries **job prices** (§4.5): a capability, a unit, a divisor and a price. The unit is `jobs`, or `subpixels`, which is the `work_pixel_ops` of the job's output receipt. Version 1 reads, verifies and bills as before. - **Job source** (§5.1). A route record's verification document (`wai.route.record`, #542), with its hops' OER/2 receipts and keys, plus `outputs`: `wai.video.int_motion` decode receipts, each with its codestream. It is verified as route-record §7 (receipts checked). Each output is read by integer-payloads §15.2 and re-derived from its codestream, or refused `output_invalid`. - **Billed hop, serving capability, figure** (§5.1). The billed hop is the attempt the record bills; the serving capability is its candidate's. The figure is that hop's OER/2 figure: the unmetered marker, or microjoules (exact, a half to the even one) beside its `energy.class`. A figure with no class is refused `job_figure_invalid`. - **New kinds.** - Record kinds: 14 (an OER/2 receipt), 15 (an `int_motion` decode receipt), 16 (a route record). These were 10 to 12, which collided with main's kinds: 10 and 11 are revenue-share §7.4's, 12 and 13 opportunity-report §7.3's. - Scope kind 5 (a router's key). - Line source kind 5, whose unit is the index of a job price. - Energy scope 5 `jobs`: the serving hops' figures by class, the unmetered counted apart. - **One registry of record kinds** (§5.2). - The table now registers every kind a WAI text names a record by. Rows 10 to 13 point to revenue-share §7.4 and opportunity-report §7.3, with their numbers and meanings unchanged, and both texts now say their kinds are registered there. - **128 to 255 are reserved for private and provisional use**: an implementation's own records (a hosted service's provisional sidecars, say) may use them, and no kind WAI assigns later will collide with them. A WAI record never states one, and an invoice that lists one is refused **`private_kind`**, in either version (such an invoice was `invoice_invalid` before). A version-2 invoice lists kinds 1 to 9 and 14 to 16, never another text's. - **Double-billing rules.** One hop and one output belong to one job (`record_duplicate`). Two records of one router for one job are `record_overlap`. - **Nothing for unbilled jobs.** A failed hop, a hop past the declared deadline, and a job no hop served bill nothing. - **Corpus** (`live-conformance/ledger/`). It reads `live-conformance/routes/`. It adds one accepted month of jobs beside a package: - an `int_motion` job billed per job and per subpixel; - a failover billed at the fallback's price; - a late job and an all-failed job, billed nothing; - an unmetered serving hop (coverage partial); - rows of a counter and a model class. It also adds 15 controls: job prices out of order, a router in a v1 scope, a job source under v1, a v1 invoice under a v2 tariff, a record refused by its own extension, an output not re-derived, a figure with no class, a router outside the scope, outside the period, a job given twice, routed twice, an output claimed by two jobs, a job line overstated, a jobs row altered. Three more cover the kinds: a private kind in a version-2 invoice and in a version-1 invoice (`private_kind`), and another text's kind in an invoice (`invoice_invalid`). The existing `invoice_version` control now uses version 3, since version 2 is defined; every other existing vector keeps its outcome. - **Second implementation.** `receipt_ledger_verify.py` verifies each job with `route_record_verify.py` and each output with the new `live-conformance/_int_motion_receipt.py`, written from integer-payloads §15. ### The `int_motion` receipts (extensions/integer-payloads.md §15) - **§15.1–§15.2** write down the decode receipt and its JSON form unchanged. Until now only the code defined them: fields, frame and clip commitments, Merkle root, signing payload, class encoding, receipt hash, what makes it consistent and re-derived, and the JSON members with the derived rate's exact spelling. - **§15.3** adds the **encode receipt** (`wai.video.int_motion/encode-receipt`). It states the source frames' hashes and their commitment, the parameters (`block`, `search`, `mv_precision`, `q`), the SSE the payload decodes with against the source, the work, and the encode's energy and class (a new profile: never `HwShunt`). `VideoEncodeReceipt` seals it over the reference encoder's payload, re-derives it from the payload and the source, and reads and writes its JSON. ### Small - `oer::micro_joules`: an OER/2 figure as whole microjoules, exactly. - The opportunity report's corpus (#541) built a ledger `Tariff` literal; it now states `version: 1` and no job prices, and its bytes and corpus are unchanged. - The route corpus binds each hop receipt to its job, so no two jobs share a receipt. It gives the jobs the ledger bills distinct ids, and adds two accepted vectors: a hop that served unmetered, and one whose figure states no class. ## Design decisions (and why) - **A new tariff version, not new meanings for existing fields.** Version 1's bytes, rules and outcomes are unchanged (`wai breaking` reports no wire break). A job price is only billable under a tariff the buyer signed at version 2. - **A job line's unit is the index of its job price.** The 94-byte line has no room for a capability, and keying lines by (router, price index) keeps one line per capability and unit with the format unchanged. - **Billing follows the route record's `billed` attempt, not the hop receipt alone.** The route record already holds the deadline and the failure rules, so the ledger needs no deadline field of its own on the hop receipt. - **Outputs are `int_motion` decode receipts in this revision.** They are what a customer can re-derive from the codestream. Package jobs stay package sources, billed by §4.1's package prices. The encode receipt is defined and tested but not yet a ledger record kind. - **A billed hop's figure must carry a class** (or be the unmetered marker), so the jobs' rows never mix a classless figure into a class. ## Checks | check | command | result | host | |---|---|---|---| | ledger lib tests | `cargo test --locked --no-default-features --features receipt_ledger --lib receipt_ledger::` | 8 passed (2 new: v2 tariff and invoice, with every kind range) | Framework | | ledger corpus + tests | `wai_receipt_ledger_vectors gen`; `cargo test --features receipt_ledger --test receipt_ledger` | regenerates; 4 passed | Framework | | ledger, second implementation | `python3 -I live-conformance/receipt_ledger_verify.py live-conformance/ledger` | every vector; 18 reasons; 45 mutated copies fail; 23 dropped checks caught (`private-kind` among them) | local (needs `cryptography`) | | ledger corpus after renumbering | every version-1 vector and every source byte for byte unchanged; the jobs vector cites kinds 5, 14, 15 and 16 | pass | local | | opportunity report | `--test opportunity_report`, `--lib opportunity_report::`; `opportunity_report_verify.py` | 6 + 12 passed; every vector, 115 copies, 32 checks | Framework; local | | revenue share (reads the ledger) | `--test revenue_share` (release); `revenue_share_verify.py` | 7 passed; all pass (61 copies, 21 checks) | Framework; local | | ledger service | `cd wai/wai-ledger && cargo test --locked` | 3 passed | Studio | | route record | `--test route_record`; `wai_route_record_vectors verify`; `route_record_verify.py` | 6 passed; PASS; all pass (371 copies, 34 checks) | Studio; local | | OER | `--features oer --lib oer::` (incl. `micro_joules`); `wai_oer_vectors verify` | 18 passed; all pass | Studio | | video receipt (incl. encode receipt) | `--features video_receipt --test video_receipt` | 15 passed | Studio | | CI feature list | `cargo test --no-run --features "$WAI_FEATURES" --lib` plus every one of the job's test targets | compiles (this is the check that found the opportunity corpus's literal) | Framework | | clippy | `--all-targets --features receipt_ledger,revenue_share` and `video_receipt` | no note in a touched file | Studio / Framework | | `wai breaking --against 2666f8468` | | no unacknowledged break (ledger API, `Reason::PrivateKind` and the corpus control acknowledged in the CHANGELOG) | Framework | | repo checks | tests-in-CI, workflow concurrency, spec-refs, section-refs, vanity, public-text self-test, orphan sources, ops doors; YAML parse; `wfsteps.py` on the merge | all 0; 0 problems | local | | public names and comparative prose | whole tree, the OER/2 files included (#545); messages and this body | clean | local | ## Falsifications (committed first, each restored) - **Ledger, wai-rs** (`wai_receipt_ledger_vectors verify`, each exit ≠ 0): - a hop or output shared by two jobs admitted (3 fails); - a job routed twice admitted (3); - an unclassed figure taken as unmetered (3); - an output not re-derived from its codestream (3); - the invoice's version not bound to the tariff's (3); - a router outside the scope billed (3); - a served hop billed whatever the record says (5); - subpixels not counted (regeneration panics: exit 101); - a private kind read as any unassigned kind (4 fails); - another text's kind admitted in an invoice (3). - **Ledger, Python.** `job-figure`, `output` and `job-duplicate` are among the 22 checks each caught when dropped. Two job mutations (an output dropped, the jobs' coverage stated whole) are among the copies that must fail. - **Encode receipt.** The first version of the tests was vacuous: dropping the SSE recomputation, the parameters' match with the header, or the source hashing each still passed, because every control broke the signature. A hidden `resign` now seals each control over its defect, and each mutant fails the test. ## Not in this PR - The encode receipt as a ledger record kind, and a Python second implementation of the encode receipt (the decode receipt has one). - A figure profile for `wai:video-encode-receipt-id` in energy-measurement §6.1, so that energy claims can name encode receipts. - `jwp-receipts` §2.4.5's `energy` claim held to a minor-1 receipt's class. ## For the lead / owner - `receipt_ledger` now depends on `route_record` and `video_receipt` (it builds the `int_motion` decoder). `receipt_ledger_verify.py` now needs `cryptography` through the OER/2 reference verifier, as the CI job already installs. - Billing rule to confirm: a job is billed only when its record bills an attempt, and at the prices of the capability that hop served (a fallback is billed at the fallback's price). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dcharlot added 13 commits 2026-10-29 21:18:47 -04:00

oer: minor version 1, the unmetered marker and the acquisition class ... 82473f6bcf

A receipt whose oer is exactly "2.1" may state a null energy.joules_total, the
unmetered marker, reported as unmetered and never as a figure, and energy.class,
the figure's acquisition class with its evidence, held to the grade it supports.
Minor version 0 keeps its members, so no 2.0 receipt reads differently. Three
reasons (unmetered_invalid, class_invalid, class_grade_mismatch), the oer.job.*
namespace for job receipts, a third canonical fixture, job_vectors.json written by
hand-declared generate_job_vectors.py, and the differential fuzzer over both forms.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

video_receipt: from_json, the inverse of to_json ... dba03c7cff

A holder of a wai.video.int_motion receipt's JSON reads it back with WAI's own
code and runs verify and verify_reconstruction_wiv1 on it. The text is read
strictly, holds exactly the members to_json writes for the receipt's class, the
class read by energy_class::label_from_json, and the two derived members
(uj_per_kilopixel_op, receipt_hash) held to the receipt. to_json now writes the
signer id as an escaped JSON string, which changes nothing for an id that needs
no escape (the pinned renderings are unchanged).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

energy_meter, wai-pack: meters that cross threads ... d614abd940

The meters of wai::energy_meter hold Send closures (their read and clock are
bounded + Send), and PackOpts::meter is Option<Box<dyn Meter + Send>>, so a host
that runs a pack on a worker thread hands the packer its meter and the package
receipt states the figure. Tests: a span sampled on a worker thread, and a
metered pack on a worker thread that writes the package this thread writes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

route-record: wai.route.record, a router's account of one media job ... b1b26a796b

The request, the price book and the routing policy are documents pinned by
digest; from them alone the candidates, every hard limit that removes one (an
unknown value counted as the most restrictive), the ranking under the policy's
keys and the request's preferences, the order and the decision are computed,
and a verifier recomputes them. The attempts follow the order, only the last
serves, a failed hop or one past the declared deadline is not billed, and each
is held to its hop's OER/2 job receipt of the record's operation. Extension
text, the route_record module (seal, verify), the corpus written by
wai_route_record_vectors with each control refused at its declared reason and
place, and tests/route_record.rs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

route-record: second implementation, registration, CI; the catalogue's route.verify and package doors ... 179a7e0906

route_record_verify.py, written from the extension's text, verifies the router's
signature with WAI's strict Ed25519 rule and the hop receipts with the OER/2
reference verifier, recomputes every candidate, removal, rank, order, decision
and attempt, gives every vector its outcome, requires every mutated copy of the
corpus to fail and catches each of its own checks dropped. The document kinds
are wai-route-request, -pricebook, -policy and -record, registered as wire
identifiers; wai.route.record is a registered record (SPEC §5, the export
regenerated). CI runs the module's tests, tests/route_record.rs and the
verifier, and checks the feature alone.

The catalogue gains route.verify (wai route verify) and package.build and
package.verify (wai package build|verify), which run the reference packager
wai-pack as itself; wai-pack.yml packs the golden package through the door and
verifies it, and a copy with an edited receipt is refused. CHANGELOG entry,
with the meters' Send bound acknowledged as an API break.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

route-record: vectors a quality order and the policy's own key order decide ... fd6ab58c0e

A sort by quality, and a price tie the policy's second key (quality) decides
against the time to first byte: a verifier that ranked quality low first, or
ignored the policy's order of its keys, passed the corpus before.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

strict_json: as_str and as_obj unused in a build with video_receipt alone ... 06523c0c1c

The reader now compiles for the int_motion receipt's from_json too, which reads
neither; the attribute keeps that build free of a dead-code note.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge origin/main into wai/routed-jobs ... 686adad33e

The revenue share (#539) beside the route record: both features, both records,
both catalogue features and both SPEC paragraphs; the CHANGELOG with this
branch's entry on top. Studio's generated actions regenerated from the merged
catalogue export.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

integer-payloads §15: the int_motion receipts, and the encode receipt ... 58c8efb19c

The decode receipt of wai.video.int_motion was defined by its code alone; §15.1
and §15.2 write down its fields, its frame and clip commitments, its signing
payload, its receipt hash, what makes it consistent and re-derived, and its JSON
form, unchanged. §15.3 adds the encode receipt
(wai.video.int_motion/encode-receipt): the source frames' hashes, the encoder's
parameters, the SSE the payload decodes with against the source, the work and
the encode's energy and class (never the legacy label). VideoEncodeReceipt
seals it over the reference encoder's payload, re-derives it from the payload
and the source, and reads and writes its JSON form.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

video_receipt: each encode-receipt check held by a control signed over its defect ... 66daac8da5

The error, the parameters and the source were each restated without signing
again, so the signature refused the control and dropping the check under test
went unnoticed. VideoEncodeReceipt::resign (hidden) seals a control over its
defect; with it, dropping the SSE recomputation, the parameters' match with the
header or the source frames' hashes each fails the test.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

receipt-ledger: media jobs under a tariff of version 2 ... 45ae4d5dae

A tariff and its invoices of version 2 carry job prices (a capability, the
unit jobs or subpixels, a divisor and a price) and bill a job source: a route
record's verification document with its hops' OER/2 receipts and a decode
receipt of its output with its codestream. A job is billed at its serving
capability's prices from its billed hop alone; its energy is the serving
hop's figure in the scope jobs, by class, the unmetered marker apart. Record
kinds 10 to 12, scope kind 5, line source kind 5, reasons output_invalid and
job_figure_invalid; one hop and one output belong to one job, and two records
of one router for one job overlap. Version 1 reads and bills as before; the
control of an invoice of version 2 now gives version 3.

The corpus bills a month of jobs from the route corpus beside a package, with
a control for each new rule; receipt_ledger_verify.py verifies each job with
route_record_verify.py and its output with _int_motion_receipt.py. The route
corpus binds each hop receipt to its job and adds a hop served unmetered and
one whose figure has no class. oer::micro_joules reads an OER/2 figure as
whole microjoules, a half to the even one.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

receipt_ledger_verify.py: mutated copies of the jobs vector ... a9af359946

A copy whose int_motion job has lost its output receipt, and one that states
the jobs' energy whole, must each fail.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

CHANGELOG: the ledger's API and corpus changes acknowledged ... 495bf8f2d1

Facts::Job, the reasons OutputInvalid and JobFigureInvalid with Reason::ALL,
and the ledger corpus, whose invoice_version control now gives version 3.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot referenced this pull request from a commit 2026-10-29 22:28:59 -04:00

Public-text checks: the OER/2 documents and corpus are checked like any other file

dcharlot referenced this pull request 2026-10-29 22:29:03 -04:00

Public-text checks: the OER/2 documents and corpus are checked like any other file #545

dcharlot added 4 commits 2026-10-30 01:15:01 -04:00

Merge origin/main into wai/routed-jobs ... bc500a9eb9

The opportunity report (#541) beside the route record: both features, records
and SPEC paragraphs, the CHANGELOG with this branch's entry on top; Studio's
generated actions regenerated from the merged catalogue. The OER/2 files are
now under the public-text checks (#545).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge branch 'wai/routed-jobs' into wai/routed-jobs-ledger 19b08b603d

receipt-ledger §5.2: one registry of record kinds; the job kinds are 14 to 16 ... ba9c439cf9

Kinds 10 to 13 were already revenue-share §7.4's run and invoice and
opportunity-report §7.3's cue event and room policy; the job source's OER/2
receipt, int_motion decode receipt and route record took 10 to 12 and so meant
two things. They are now 14, 15 and 16. §5.2's table registers every kind a
WAI text names a record by, 10 to 13 pointing to the texts that define them,
unchanged, and those texts say so. Kinds 128 to 255 are reserved for private
and provisional use: a WAI record never states one, and an invoice that lists
one is refused private_kind, in either version. A version-2 invoice lists kinds
1 to 9 and 14 to 16, never another text's. Three controls; the corpus and both
implementations follow.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

opportunity_report corpus: its ledger tariff states version 1 and no job prices ... dcd0a60dab

The tariff the opportunity corpus bills its day under is a struct literal, so the
tariff's two new fields broke its build; its bytes and the corpus are unchanged.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot added 2 commits 2026-10-30 03:20:16 -04:00

Merge origin/main into wai/routed-jobs ... 920a037c6a

Takes #540's channel lineup beside the route record: the conformance
workflow's feature list, test list and per-feature check name both
(channel_lineup, route_record); the catalogue keeps channel.import,
channel.guide, channel.verify and route.verify; strict_json is built
for video_receipt or channel_lineup. ops.json and Studio's actions are
regenerated from the merged table; the registry export is up to date.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge commit '920a037c6a' into wai/routed-jobs-ledger 4ddccca11b

dcharlot added 1 commit 2026-10-30 04:26:09 -04:00

wai-rs: the receipt_ledger feature's comment names its media-job sources (kinds 14 to 16) ... f544828ba7

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot merged commit 20f9d95c01 into main 2026-10-30 05:29:26 -04:00

dcharlot referenced this pull request from a commit 2026-10-30 05:29:28 -04:00

Merge pull request 'wai: media jobs in the receipt ledger, and the int_motion receipts written down (stacked on #542)' (#544) from wai/routed-jobs-ledger into main

dcharlot referenced this pull request 2026-10-30 05:30:42 -04:00

wai: the route record, OER/2 minor version 1, and the operations a routed job names #542

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Transaction-Science/open-standards!544

No description provided.