wai: add wai.neural.int_mlicpp, the MLIC++ entropy topology integer end to end #111

Merged

dcharlot merged 6 commits from wai/land-09-int-mlicpp into main 2026-09-30 19:52:34 -04:00

Conversation 0 Commits 6 Files changed 82 +9753 -974

2026-09-30

Transaction Science

Merge wai/land-08-energy-classes into wai/land-09-int-mlicpp

1ff33b7fe6

• View at this point in history

2026-09-30 07:39:13 -04:00

Transaction Science

wai: square the deviations in the energy statistics without powi ...

The linux-arm64 leg of wai-conformance failed from this link on: the JPEG AI
decoder's symbol guard (tests/jpegai_decode_symbols.rs) found __powidf2, the
compiler builtin behind f64::powi, defined in its executable. Nothing calls
it there: in the executable built in the runner's own image, no instruction
branches to it, no relocation refers to it and no address is formed for it.
It is the case the test's documentation describes for floor on x86_64 Linux:
GNU ld keeps a compiler-builtin definition that a removed section referred
to. The references were the two sample-variance loops this link added,
energy_class::bracket_relative_uncertainty and energy_burst::sample_sd,
which squared with powi(2).

They now multiply the deviation by itself. For an exponent of 2, __powidf2
returns exactly d * d, so every figure is unchanged. In the runner's image
(catthehacker/ubuntu:act-22.04, arm64, rustc 1.98.0) the guard fails before
this change and passes after it, with no __powidf2 in the executable. On macOS
arm64: the guard, and wai-energy-receipts' three suites with --locked, pass.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

e709627da3

• View at this point in history

2026-09-30 07:39:05 -04:00

Transaction Science

wai-web: refresh Cargo.lock for wai-quantum 0.3.21 ...

main's wai-web/Cargo.lock still records the path dependency wai-quantum at
0.3.18; its Cargo.toml has said 0.3.21 since f0591f1b, so any --locked build
of wai-web refuses to start. The refresh changes only that version line.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

df0c0dfb29

• View at this point in history

2026-09-30 01:40:16 -04:00

Transaction Science

wai: add wai.neural.int_mlicpp, the MLIC++ entropy topology integer end to end ...

The float wai.neural.mlicpp decodes correctly only while its encoder evaluates
the entropy network bit-identically to the decoder. Its validation run, with the
encoder at the runtime's default thread count and the decoder single-threaded,
put one scale on the other side of a table edge at symbol 416 of 12,288 and
decoded garbage from there. Matching the execution settings fixes that run, but
it stays a convention between two implementations. int_mlicpp makes the
agreement a property of the arithmetic: the hyper-decoder, the entropy network
re-run before each of the 2*K channel-slice x checkerboard passes, and the
synthesis are all integer networks, so every decoder derives the encoder's scale
bucket for every element, on any platform and at any thread count.

- wai-rs/src/int_mlicpp.rs: the decoder (a WIM1 payload; a one-file WMB1 model
  bundle, so a prior's SHA-256 pins every network and table), built from
  int_hyper_synth's networks, int_entropy's bucketing and the rANS decoder.
- Totality. Before the decode allocates anything, each network's shapes are
  derived from its layer geometry (the new int_hyper_synth::net_shape, which
  shares its geometry with the checked run), and a header whose shapes the
  model does not produce, or on which any network would form a buffer over
  Header::MAX_TENSOR (2^26) elements, is refused. Latents go through
  int_entropy::dequantize (sym * 2^frac + base, None where i64 cannot hold it;
  Kani harness), and every network through int_hyper_synth::run_net_checked
  (run_net layer by layer, only while no value can leave its type). So a decode
  returns an image or an error for any payload, the same one with and without
  overflow checks.
- IntModel::from_bytes, the compact network form every integer neural decoder
  loads, is total on damaged bytes: it no longer reserves for the layer count it
  reads before checking the bytes hold that many (about 480 GB for 2^32 - 1),
  and forms layer sizes and read offsets in checked arithmetic (they overflowed
  a 32-bit usize).
- run_net and decode share a per-layer function and to_rgb8; every committed
  vector still reproduces its hash.
- Registry: NeuralIntegerExact, Lossy, royalty-free (the decoder is this crate's;
  the patent status of the techniques was not examined). A new registry test
  records the basis of every NeuralIntegerExact capability.
- The neural dispatch decodes it and re-checks a pinned prior against the exact
  bytes it decodes with.
- tools/wai_int_mlicpp_export.py writes the committed vector
  tests/vectors/int_mlicpp/. Its weights are synthetic and seeded (no trained
  model is available), so the vector shows decode-equivalence and nothing about
  compression quality.
- Tests: tests/int_mlicpp.rs (the pinned image, bucket and symbol hashes under
  every kernel policy and thread count; one unit in each of four chosen
  parameters, one per value path, changes the image; damaged payloads never
  panic), tests/int_mlicpp_preflight.rs (a counting global allocator: refusing
  a header the model cannot fit, or parsing a damaged network, allocates a few
  KB at most; the decoder without the pre-flight fails it, and aborts on a
  3.4 PB allocation for a synthesis wider than the cap), a byte-exact-conformance
  golden, a neural dispatch test and unit tests. CI runs them on the conformance
  matrix in both profiles, on the byte-equality matrix, and in neural-gates.
- Evidence: all of the above pass, and the pinned hashes reproduce, on macOS
  arm64 and on wasm32-wasip2 under wasmtime 49.0.1, in dev and release. x86_64
  was not measured here (no x86_64 translation layer is installed); the Linux
  legs come from the byte-exact matrix, and the Windows runner is offline.
- SPEC 5 and 7, the README, determinism-tiers 3, 5 and 6, and the CHANGELOG
  record it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

50667cd2a4

• View at this point in history

2026-09-30 01:39:56 -04:00

2026-09-29

Transaction Science

Merge wai/land-07-int-decode-kernels into wai/land-08-energy-classes ...

Brings in, through the refreshed previous link, main's OER differential fuzzer (54e89b56) and its audit of the OER extension against both verifiers (860ead8c, documentation only), so this link is checked against current main.

The OER extension now carries both main's audit and this link's statement that an OER/2 receipt carries an evidential grade and no acquisition class; the two edits touch different sections.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

16e6bde20c

• View at this point in history

2026-09-29 10:21:34 -04:00

Transaction Science

wai: on-chip counters and calibrated instruments are separate energy classes, and every joule-carrying receipt can say which ...

The single `HwShunt` acquisition class covered both an on-chip vendor
counter (RAPL, NVML, SMC, IOReport) and an external calibrated shunt. They
are different evidence: a calibrated instrument's uncertainty is traceable to
a calibration, while a counter is a vendor's reading whose error the vendor
states (RAPL readings are deliberately noised when SGX or TDX is enabled,
per security advisory INTEL-SA-00389).

- extensions/energy-measurement.md §2 splits hardware evidence into
  `OnChipCounter` and `CalibratedInstrument`, each with a required declared
  uncertainty (relative error and integration window). IOReport is an
  on-chip counter, like RAPL and NVML. `HwShunt` stays readable as the legacy
  class, ranked below both, and is not sealed into a new WAI receipt.
- Every receipt family that carries joules — video, world, film, reel,
  haptic, score, splat4d, audio scene, ternary, provenance and the wai-quantum
  receipts — can carry its class. The label is additive: every committed
  signed vector still verifies, and the signed bytes of unlabelled and
  legacy-labelled receipts are pinned by tests. A sealed figure declares its
  1 µJ resolution, and the floor is stated as the rule verified (0.5/√3 µJ).
- The acquisition rules are scoped to the receipt profiles WAI defines, and
  the text says what enforces each one.
- Meters open their window from rest, report an all-zero power reader as
  unusable rather than clean, and state the running-window count model as
  conservative.
- oer-receipts.md maps OER's evidential grade onto the refined classes. The
  rule that a producer must not grade `measured` a figure whose class is
  `Estimator` is kept as settled on main.
- wai-quantum verifies a receipt in either form on every in-tree verify
  path, including wai-quantum-serve's POST /verify.
- CI: wai-energy-receipts.yml runs the energy-class, label and legacy-pin
  tests for wai-rs, wai-quantum and wai-quantum-serve, which no workflow
  enabled before.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

d009db9087

• View at this point in history

2026-09-29 01:27:37 -04:00