wai: key discovery, signing authority and module revocation #134

Merged

dcharlot merged 15 commits from wai/land-15-key-discovery into main 2026-10-01 14:54:56 -04:00

Conversation 0 Commits 15 Files changed 44 +12865 -157

dcharlot commented 2026-10-01 09:58:52 -04:00

Owner

Copy link

jwp-receipts §7: a did:web signer names a web origin, which publishes a key log at /.well-known/wai-keys. The log is a chain of revisions signed by a root key that pre-commits to its successor; it lists the origin's keys, the authorities each holds, and whether each is active, retired or revoked. A verifier that has anchored the origin, pinned or fetched, confirms a receipt, claim or module grant against the log offline, and reports the outcome beside the item's own verdict. Hardware-class energy, lawful-basis and pre-emption authorities are confirmed only under a pinned anchor, and revocation refuses every item under a revoked key.

• Modules and parameter sets (§7.9). Decoder and reconstruct modules, and pinned parameter sets, are authorised by SHA-256 digest through signed module grants from the sink's module origins, and revoked by digest in the key log. A revoked module stops within grant_max_s + status_max_age_s, under ceilings of 86400 s and 3600 s. Every failure, offline included, leaves the module not held, and dispatch falls back.
• Enforced by the reference sink. A sink that holds a key log refuses a revoked pinned set at the pin's check, with the reason prior_revoked, on dispatch and on WAI2 selection, which moves on to the next rendition.
• Authorities for the energy classes. Measurement and operating-point claims, and a group's labelled leaves and total, need their class's authority.
• wai-rs. signer_id (ungated) and key_log (feature key_discovery), the wai_signer_vectors and wai-keys binaries, and the signer-conformance corpus with an independent Python verifier that CI runs. The reference meters and the world demo sign under labels.
• Section references. A CI guard checks that every section one WAI text cites in another exists.

Lands after #133, and completes the four.

Checked locally on macOS arm64: the link gate (every conformance corpus, including the signer, claim, JWP and pin corpora through their verifiers), the section-reference guard and the public-text checks. The forge CI runs on this pull request.

🤖 Generated with Claude Code

jwp-receipts §7: a `did:web` signer names a web origin, which publishes a key log at `/.well-known/wai-keys`. The log is a chain of revisions signed by a root key that pre-commits to its successor; it lists the origin's keys, the authorities each holds, and whether each is active, retired or revoked. A verifier that has anchored the origin, pinned or fetched, confirms a receipt, claim or module grant against the log offline, and reports the outcome beside the item's own verdict. Hardware-class energy, lawful-basis and pre-emption authorities are confirmed only under a pinned anchor, and revocation refuses every item under a revoked key. - **Modules and parameter sets (§7.9).** Decoder and reconstruct modules, and pinned parameter sets, are authorised by SHA-256 digest through signed module grants from the sink's module origins, and revoked by digest in the key log. A revoked module stops within `grant_max_s + status_max_age_s`, under ceilings of 86400 s and 3600 s. Every failure, offline included, leaves the module not held, and dispatch falls back. - **Enforced by the reference sink.** A sink that holds a key log refuses a revoked pinned set at the pin's check, with the reason `prior_revoked`, on dispatch and on WAI2 selection, which moves on to the next rendition. - **Authorities for the energy classes.** Measurement and operating-point claims, and a group's labelled leaves and total, need their class's authority. - **wai-rs.** `signer_id` (ungated) and `key_log` (feature `key_discovery`), the `wai_signer_vectors` and `wai-keys` binaries, and the signer-conformance corpus with an independent Python verifier that CI runs. The reference meters and the world demo sign under labels. - **Section references.** A CI guard checks that every section one WAI text cites in another exists. Lands after #133, and completes the four. **Checked locally on macOS arm64:** the link gate (every conformance corpus, including the signer, claim, JWP and pin corpora through their verifiers), the section-reference guard and the public-text checks. The forge CI runs on this pull request. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dcharlot added 37 commits 2026-10-01 09:58:53 -04:00

wai: one registry table, candidate capabilities, public-text checks ... fb103ac5ae

Every registered string now lives in one table (codecs/registry.rs) with
its kind, status, media class, registering SPEC section, edition and
registration date. `wai registry export` writes registry/capabilities.json,
its JSON Schema, the generated table in REGISTRY.md and vocab v2; --check
fails on drift. vocab v1 stays stable.

A candidate capability (a registered string whose payload format no
revision has pinned) must not be emitted. The C packers, the browser
writers and `wai wrap` refuse one, and `codecs::is_dispatchable` is the
single dispatch and selection predicate (SPEC §4): candidates,
companion-only capabilities, records and derivations are not
dispatchable, and an unregistered string is decoded only where the sink
advertises it.

The codec glossary is linked to the registry through a reviewed table and
held to its schema by a library test; `org` becomes `body`, from a closed
allowlist. The SPEC gains §5 sections on kinds and candidates, a §8
edition rule, corrected citations and rewritten appendices. The
quantum-ops vectors are regenerated with neutral device ids.

CI declares the feature-gated test targets with required-features, checks
the registry export, builds wai-web for wasm32, and runs two public-text
checks (comparative prose, and private name patterns) with a self-test.
The specification, extensions, research notes, READMEs, glossary and
source comments are rewritten to name no company or product and to make
no comparisons.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: hold research/content-taxonomy.md to both public-text checks ... f62e7d8557

The content-taxonomy note has been rewritten on main, so the exclusion
both checks carried for it is removed, as their comments said to do once
that change landed. The note now passes both checks: lever 1 names a
registered codec, and the gain, wedge and endgame phrasing is restated as
what each lever applies to.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: the parameter-set pin, component identity, pin-aware selection ... 22928147f3

SPEC §3.1 defines the pin a manifest carries (conditioning.prior, and a
WAI2 rendition's prior): id, sha256, determinism, and the optional form,
tier and supersedes. The digest covers the whole parameter set. A set of
several files is pinned through its listing, the new registered prior
form wai.prior.set. A sink verifies the pin before it decodes, reports a
refusal with one of an ordered set of snake_case reasons, and decodes
only from the set it verified. Tier is a closed vocabulary; supersedes is
informative.

A pin that does not resolve makes its capability unsupported for that
envelope: SPEC §4 dispatch continues at the fallback, §7.1 selection at
the next rendition, and an inert envelope's error names the reasons. A
rendition entry may carry id, sha256 and, on a companion,
companion_of_id. SPEC §7 gains a Digests subsection, and §8 says how a
MINOR revision adds an optional member.

In wai-rs: the manifest types are #[non_exhaustive] with builders; a new
pin module verifies pins in memory and on disk; Wai::dispatch_verified,
WaiMulti::pick and primary check pins and component digests; every
neural decoder reads through ParamSource; a codec-free `ffi` feature
carries the C envelope surface with wai_envelope_select and
wai_neural_decode_ex. wai-web wraps wai::container. New vectors: the
int_mlicpp set-form twin and the pin-conformance corpus with an
independent Python verifier, plus sha256.json sidecars for the vectors
of capabilities that decode against a parameter set.

Squashed from wai/stream-a-parameter-set-identity onto link 12. Conflicts
are resolved to keep both sides; the integration commits that follow
make the two streams agree.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: one dispatch predicate, codecs::is_dispatchable, on every path ... 33abd9ecb6

codecs::dispatchable (not companion-only) is removed. Wai::dispatch_verified
takes a capability or fallback only when is_dispatchable accepts it, and
RenditionMeta::is_selectable already goes through it, so WaiMulti::pick,
primary, the neural sink's decode_multi, the C wai_envelope_select, the
wai-web core module and the CLI's inspect all refuse a candidate, a
record and a derivation as well as a companion-only capability. A string
this revision does not register stays dispatchable when the sink
advertises it, and a pin on it is verified as several files, so it fails
closed.

SPEC §7.1 step 2 takes an entry whose capability is dispatchable (§4),
step 5's not_selectable says the same, and §3.1 notes that an
unregistered string is dispatchable. §5's candidate paragraph names the
pin-aware functions.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: candidate tests on the pin-aware selection API and the C ABI ... ecaae09149

The link-12 candidate tests are ported to link 13's API:
a_candidate_is_never_dispatched_picked_or_emitted builds its envelopes
with Manifest::new and ModelRequirement::new(..).with_fallback(..),
dispatches through dispatch_verified, and picks with
pick(.., no_parameter_sets()) and primary(..), now also checking the
not_selectable reason a candidate entry gets. the_emit_path_refuses_a_candidate
builds the WAI2 envelope through WaiMulti::from_parts, as the C packer
now does. `wai wrap` sets its fallback through the builder.

New candidate cases: in the pin-aware dispatch and selection tests, a
candidate carrying a pin is never dispatched or picked and its pin is
never verified; in tests/ffi_envelope.rs (feature `ffi`, which the C ABI
envelope step runs), wai_envelope_select never picks a candidate and the
WAI2 table marks it not selectable, and envelope_pack_refuses_a_candidate,
which needed the codecs feature before, checks that wai_envelope_pack and
wai_envelope_pack_multi refuse one.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: register wai.prior.set in the registry table and regenerate ... 60d2486c79

wai.prior.set (SPEC §5, Prior artifacts) gets its row in the registry
table: a registered payload, media class binary, registered 2026-09-30,
with the edition left to the registration. It is listed in
GLOSSARY_NO_ENTRY as a WAI-native class. `wai registry export` regenerates
registry/capabilities.json, the table in REGISTRY.md and vocab
v2.{ttl,shapes.ttl}; `wai registry export --check` is clean, and the
registry tests that hold every registered string to one row pass again.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: vocab v2 carries the parameter-set pin, generated from the registry ... 25bcd9b4ef

`wai registry export` now writes the pin terms into v2 as v1 states them:
the ParameterSetPin class, wai:prior and the members pinId, pinSha256,
pinDeterminism, pinForm, pinTier and pinSupersedes in v2.ttl; a scoped
`prior` term in v2.jsonld whose members are the manifest's own names; and
ParameterSetPinShape and SupersedesShape in v2.shapes.ttl, with the tier
list taken from codecs::TIER_TOKENS. v1 keeps its additive pin terms.

vocab_pin_terms_match_prior_members reads v1 and v2 and holds each
scoped term to the pin's serialized members and each shape's tier list
to the registered tokens. check_shapes.py gains pin cases (a full and a
minimal pin, an unregistered tier, an uppercase digest, a missing
determinism, a supersedes with no digest, and a WAI2 component's pin);
against the v2 files before this change, the five non-conforming cases
conform. The vocab README says what each version carries.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: declare link 13's feature-gated tests and say where the C ABI runs ... ec818bca21

Cargo.toml declares the feature-gated integration tests that CI names
with --test, with their features, beside link 12's: generate (generate),
ffi_envelope (ffi), ffi_neural_pin (neural, ffi), neural_native_decode
(neural) and jpegai_e2e_full (neural_int). Naming one without its
features now stops cargo with an error instead of running an empty
binary that reports ok.

The C ABI envelope step's comment says it also checks the candidate
refusal of selection and of the packers, and determinism-tiers §6 no
longer says the C packers build only with the codecs feature: they build
under `ffi`, and tests/ffi_envelope.rs runs in that step.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai/CHANGELOG: the parameter-set pin entry records the assembly ... c0bcb4c432

Stream A's subsection, under link 12's, now records what assembling the
two changes did: one dispatch predicate (codecs::is_dispatchable) on every
selection path, wai.prior.set in the registry table and its exports, the
pin terms and shapes in the generated vocab v2 as well as in v1, and the
C packers' candidate refusal tested under the codec-free `ffi` feature.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: give each CLI registry test its own payload directory ... 05032bfef5

Three tests in tests/cli_registry.rs wrote their payload into one shared
directory, which scratch_dir empties before returning. Run in parallel,
one test removed the directory while another wrote into it, and the write
failed with EINVAL. Each test now names its own payload directory; the
carriage and CLI step passed three runs in a row.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: energy reports, labelled JWP leaves and what signatures cover ... cc371d815a

Two claim classes report on one energy figure without changing the
receipt that seals it. `measurement` carries a bracket's values as
integers with each bracket's liveness facts, the build and the power
reader, and is accepted only against the receipt that carries its
figure. `operating-point` records the requested, committed and
delivered operating points and a prediction. The ratio, verdict and
residual are derived by every reader, never stated.

energy-measurement §6.2 gives the figure and the least declaration a
report's integers support as exact integer formulas; wai-rs
`energy_report` implements them with no floating-point arithmetic.
§3.1 defines a live power reader: a rail must advance in two
consecutive intervals, in at least five and in at least four of every
five, over at least 300 ms. A frozen or held rail is refused rather than
sealed under a hardware class. An unmetered `0` is never a figure of
zero joules.

A JWP object's figure, class and origin are bound into its Merkle leaf
(`\x02`), and a labelled group payload signs the total's class, its
coverage and the parent link. An object must sit at the position its
inclusion proof walks, and group signatures follow the strict Ed25519
rule claims use. `jwp_delivery` and `energy_figure` implement this in
wai-rs; joule-moq 0.2.0 builds and verifies both labelled forms.

New corpus `jwp-conformance/` with `jwp_verify.py`, more claim vectors
with the earlier ones pinned, and a CI job that runs claim_verify.py,
differential.py and jwp_verify.py. Legacy receipts keep their bytes.
External JWP implementations must adopt the `\x02` leaf and the
labelled group payload before verifying objects or groups that use
them.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: name jwp-conformance in the decoded-output sidecar exclusions ... 2904219c9c

every_decoded_output_states_a_sha256 enumerates every wai/*-conformance
directory and requires a sha256.json sidecar or a named exclusion. The
new JWP corpus holds delivery receipts, receipt content with no decoded
output, so it is excluded for the reason the claim and OER corpora are.
Without this, the fast-kernel steps of wai-conformance.yml fail on the
assembled tree.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: key discovery, signing authority and module revocation ... 72e3300752

jwp-receipts §7: a did:web signer_id names a web origin, which publishes
a key log at /.well-known/wai-keys: revisions signed by a root key that
pre-commits to its successor, listing the origin's keys, the authorities
each holds, and whether each is active, retired or revoked. A verifier
that has anchored the origin, pinned or fetched, confirms an accepted
receipt, claim or module grant against the log offline, and reports the
outcome beside the item's own verdict, never in it. Hardware-class
energy, lawful-basis and pre-emption authorities are confirmed only
under a pinned anchor. Revocation refuses every item under a revoked key.

§7.9 authorises decoder and reconstruct modules, and pinned parameter
sets, by SHA-256 digest through signed module grants from the sink's
module origins, revokes them by digest in the key log, and bounds how
long a revoked module keeps running by grant_max_s + status_max_age_s,
under ceilings of 86400 s and 3600 s. Every failure, offline included,
leaves the module not held and dispatch falls back.

wai-rs gains signer_id (ungated) and key_log (feature key_discovery),
the wai_signer_vectors and wai-keys binaries, and the signer-conformance
corpus with an independent Python verifier. The reference meters and
the world demo sign under labels. A section-reference guard checks that
every section SPEC.md or an extension cites in another of them exists.

This commit is the stream as merged onto link 14. The commits after it
reconcile it with the parameter-set pin and the energy reports.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: key-discovery corpus is jwp-receipts §5.8; CI runs signer_verify.py ... f89d8d979d

The JWP corpus took §5.7, so the signer-conformance section is §5.8 and
§7.8's reference to it follows. Its statement about the claim corpus now
covers the measurement and operating-point vectors as well: §7 changes
none of them.

signer_verify.py was run by hand. The independent-verifiers job now runs
it on the linux runner and requires its verdicts to equal
wai_signer_vectors' line for line; the README, the binary's doc and the
CHANGELOG say so.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: measurement and operating-point claims need their class's authority ... bc423721b6

jwp-receipts §7.5 now names the authorities of the two claim classes the
energy reports added: a measurement claim needs `measurement`, an
operating-point claim `operating-point`, and each also needs the energy
authority of the figure it restates, which is pinned-only for a hardware
class. The table names every class whose authority is its name, a bullet
says what confirmation adds to §2.4.8's check that a report's key signed
the figure, and the CHANGELOG's authority list carries both.

signer-conformance gains a revision with a measurement key and an
operating-point key, and five vectors: each class refused without its
own authority, confirmed with it, and a hardware-class report refused
under a fetched anchor. Both verifiers reproduce them; dropping the
class authority from claim_authorities, or from signer_verify.py's,
fails them. claim_authorities_follow_the_table now requires the claim
corpus to hold a confirmable claim of each of energy, lawful-basis,
measurement and operating-point.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: a group's labelled leaves and total need their class's authority ... 3bd6d38cd8

Stream C left these out until the labelled JWP forms existed. With them
on this base:

- jwp-receipts §7.5: a group receipt and the objects under it need
  `delivery` and `energy/<class>` for each class the objects' labelled
  leaves bind (§2.2) and the class a labelled group payload signs for
  the total (§2.3). A group with a hardware-class label is signed by one
  key for delivery and the figures, so `also_delivers` is true there by
  construction. §3 step 6 and confidentiality §6 say what a labelled
  leaf binds.
- key_log: Item::for_group takes those classes again. Item::from_group
  reads them from a group receipt that passes §3 steps 1-2 and objects
  that pass their inclusion check, and Item::from_family from another
  family's receipt through its verified figure view; neither builds an
  item from bytes that did not verify.
- signer-conformance: four group-labelled vectors, regenerated through
  wai_signer_vectors gen and reproduced by signer_verify.py, whose group
  authorities follow the same row. Ignoring the classes in for_group
  fails all four.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: module revocation through the parameter-set pin's check 5 ... 16fa0c5f48

SPEC §3.1 reserved check 5 for a revocation of the pinned set, keyed on
the pin's form and sha256, and jwp-receipts §7.9 authorises and revokes
a pinned set by its digest. They meet here:

- SPEC §3.1 check 5 runs §7.9 over the set a pin names when the sink's
  relying party holds the capability's pinned sets to §7.9: the reason
  is `prior_revoked` where a key log revokes the digest, and
  `prior_not_authorised` for any other failure, offline included. It
  sits before `prior_not_held`, so a revoked set is refused whether or
  not the sink holds it, and refusal names follow §3.1's snake_case
  rule. A sink with no key log skips the check.
- SPEC §4 folds the module-authorisation paragraph into steps 3 and 5,
  and states plainly that a sink configured with no key log does not run
  §7.9, that the reference dispatcher runs check 5 when configured with
  one, and that wai-web and the C ABI take none. jwp-receipts §7.9 cites
  SPEC §3.1, says the pin's digest stands for the bytes' at its check 2
  (checks 6-8 of §3.1 then require the bytes to have it), and says which
  grant's outcome is reported when a sink holds several.
- wai-rs: PinRefusal gains Revoked and NotAuthorised. pin::PinAuthority
  is check 5; pin::verify_bytes_with and verify_with run it before any
  held file is read. key_log::SinkKeyLog implements it from the key log
  a sink holds, through key_log::module_check_digest, and
  neural::ModelRegistry::with_key_log gives one to the neural sink.
- Library tests, run by CI's library step, dispatch WAI1 and WAI2
  envelopes pinning the committed int_mlicpp set: a revoked set goes to
  the fallback, is reported as `prior_revoked` when none remains, and is
  refused before check 6; offline, without a clock, without a grant and
  from another origin the set falls back with `prior_not_authorised`;
  with no key log, or a capability not held to §7.9, it decodes.
  Disabling check 5 in pin.rs fails four of them.
- signer-conformance: a parameter-set verdict carries
  `refusal=prior_revoked` or `refusal=prior_not_authorised`, with two
  vectors added; regenerated through the generator and reproduced by
  signer_verify.py.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: the neural sink refuses a revoked pinned set through its key log ... 055c79c5de

A ModelRegistry given a key log runs SPEC §3.1's check 5 on its decode
path. A test over the committed int_mlicpp set, under neural and
key_discovery, shows neural::decode_envelope refusing the set with
`prior_revoked` once the log revokes its digest and with
`prior_not_authorised` when the sink holds no fresh status, and decoding
it to its committed image while a current grant holds it.

wai-neural-gates.yml runs it as its own step with a count check, and
now also triggers on key_log.rs. The CHANGELOG says so.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai/research: key-discovery status lines name the v0.4.0 change ... 1839af6d34

The two status paragraphs in energy-exposure-mapping that Stream C added
said "after jwp-receipts §7". The other streams' status lines name their
v0.4.0 CHANGELOG entry, so these now name "Key discovery, signing
authority and module revocation" the same way.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: name signer-conformance in the decoded-output sidecar exclusions ... dc9d01ac8f

every_decoded_output_states_a_sha256 enumerates every wai/*-conformance
directory and requires a sha256.json sidecar or a named exclusion. The
key-discovery corpus holds key logs, grants and statuses, signed
documents with no decoded output, so it is excluded for the reason the
claim, JWP and OER corpora are. Without this, the fast-kernel steps of
wai-conformance.yml fail on the assembled tree.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: jwp-receipts §5 names every corpus published in the tree ... 729eef2532

§5's opening keeps its rule for the §5.1-§5.5 cases, and its parenthesis
said only the claim corpus of §5.6 was published here. The JWP corpus
(§5.7) and the key-discovery corpus (§5.8) are published here too, and
it now names all three.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: restate the ranking phrases the retrofit left in research and extensions ... 348a2d9259

The retrofit's commit says the research notes, extensions and source
comments make no comparisons. These lines still ranked or promoted:

- research/cargo-roadmap.md: the sequencing rationale and the phase
  reasons now say what each phase reuses or carries, and the status note
  points to content-taxonomy.md for each class's status.
- research/content-taxonomy.md: the "white space" table is now the
  cargo-roadmap phase table, with each phase marked shipped and its
  capability named, so it no longer contradicts the taxonomy rows above
  it; the closing clause of the spatial-audio row and "That's the whole
  map" are removed.
- extensions/spatial-audio.md and research/spatial-audio-draft.md: the
  appendix says why spatial audio was first without ranking it.
- SPEC.md §5, extensions/ternary-tt.md and the CAP_TERNARY_TT comment:
  wai.ternary.tt is stated by its own measured operating point (13.3 dB
  SNR at 3.8x with six residual layers, the extension's table) and its
  Lossy tier.
- research/2030-transport-landscape.md: three lines restated as what WAI
  specifies; the CHANGELOG entry now says comparative framing in dated
  records is restated in place, as names are redacted.
- wai-rs/src/lib.rs: the quantum_qec comment ends at the metric it carries.

scripts/check-comparative-prose.sh gains five phrases (commercial wedge,
unclaimed, fast win, differentiator, rate-competitive), each with a case
in scripts/test-public-text-checks.sh.

REGISTRY.md and vocab/README.md say that the v2 SHACL shape checks the
capability and fallback against this revision's registry and only the
form of media, and that a violation for an unregistered string means it
is not registered in this revision, not that the envelope fails to
conform or cannot be dispatched (SPEC §4, §8).

The CHANGELOG's candidate-capability bullet states the MINOR rule as a
full sentence.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

ci: give the WAI name list only to the push-to-main run ... 913c994b18

The wai-public-names job set WAI_NAME_DENYLIST at job level, so on a
pull request from a branch of this repository the list reached a script
taken from the pull request's own tree, whose log is public. The secret
is now set on the one step that runs the check, and that step runs only
on a push to main; a pull request shows a failed (continue-on-error) step
saying the check did not run. On a push to main an empty list still fails
the job. wai/CONTRIBUTING.md and the CHANGELOG entry say so.

A correction to the record: the message of the commit that added these
checks says CI declares the feature-gated test targets with
required-features. wai/wai-rs/Cargo.toml declares them with their
required-features, and the conformance workflow names them with their
features.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai/glossary: the codec glossary declares its schema version ... d96739e436

The retrofit renamed each entry's `org` field to `body`, and the file
carried no version, so a reader of the earlier form found no `org` and no
way to tell the two forms apart. codecs.json now carries
`"schema_version": 2`. SCHEMA.md describes the field: version 2 is the
form it documents, a file without the field is the earlier `org` form,
and a change that renames or removes a field, or changes what one means,
raises the version. glossary_links_agree_with_the_registry requires the
value, and glossary_check_names_each_broken_rule has two cases for a
missing and a wrong version. The CHANGELOG's glossary bullet records the
break.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge wai/land-12-registry-and-text into wai/land-13-parameter-set-identity ... f93f7074d8

Brings link 12's three follow-up commits onto link 13: the restated
ranking phrases in the research notes, extensions and source comments,
with five more phrases in the comparative-prose check; the WAI name list
given only to the push-to-main run; and the codec glossary's
schema_version.

One conflict, wai/vocab/README.md: link 13's rows (the prior term in the
JSON-LD context, the parameter-set pin in the shapes) are kept, and link
12's sentence on what a violation for an unregistered string means is
added before the pin sentence. REGISTRY.md's row for the v2 files now
also names the parameter-set pins the shapes check.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai/neural: the strict gate reads only dispatchable capabilities; a pinned model keeps no tensor outside the verified bytes ... e0d16bc14c

decode_envelope_strict chose the capabilities its early replicate refusal
reads by what the sink's registry holds alone. A candidate, companion-only
capability, record or derivation held at the sink could then decide that
refusal, though dispatch never takes one. The gate now reads only
capabilities codecs::is_dispatchable accepts and the sink advertises, so a
held candidate gives the reason an empty registry gives
(strict_gate_ignores_a_held_capability_it_cannot_dispatch).

A pinned decode builds its ONNX session from the verified bytes, but an
ONNX tensor can name another file for its data. Run locally against the
linked ONNX Runtime, a model loaded from memory read such a file from the
process's working directory, outside every pin. neural::onnx_external now
reads the model's protobuf for a tensor stored as external data (graph
initializers, attribute tensors and subgraphs, training graphs, local
functions) and the pinned decode refuses such a model with set_incomplete,
naming the file, before the runtime sees it. Bytes that do not parse are
refused too.

wai-neural-gates.yml adds the new tests to its exact lists and counts.
determinism-tiers.md scopes its forge-run statement to the job as it was
before the pin-aware tests were added; those have no recorded forge run.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: correct public text the parameter-set link left stale or overstated ... 9dee86559c

- CHANGELOG, registry subsection: is_dispatchable is named as the
  predicate of every dispatch and selection function, with
  Wai::dispatch_verified (formerly dispatch_capability), instead of a
  function this release removes. The pin subsection records the strict
  gate's dispatchable filter and the refusal of a pinned ONNX model whose
  tensors live in another file.
- SPEC §3.1: a file a model names for part of its own data is a file the
  decode needs; one the decode cannot take from the verified set is
  refused with set_incomplete.
- SPEC §7.1: staged layers, byte-range and referenced renditions and
  per-rendition tracks are stated as a rule for a later mechanism, not as
  mechanisms that exist.
- SPEC §8: the parse failure of a mistyped defined member is stated as its
  own bullet, the one exception to the 1.x freeze, and says that the
  envelope's wai value does not signal it. §3.1 and the CHANGELOG point
  to it.
- wai-web dispatch_capability and the ffi_neural comment in lib.rs say
  what the code now does: only dispatchable capabilities are taken, and
  the neural C ABI builds with neural and ffi, without a codec library.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai/tests: serialize sha256.json sidecar writes and document their regeneration ... bc06242f9f

Several tests of one binary write entries of the same sidecar (three of
them write tests/vectors/int_video/sha256.json), each by reading the file,
inserting its entry and writing it back. Under parallel test threads two
writes could interleave and drop an entry. Each write now holds a
process-wide lock. The support module documents the command that
regenerates the sidecars under tests/vectors/ and neural-conformance/.
Regenerated with that command locally, every sidecar came out byte for
byte as committed, and the same tests then passed in check mode.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai/neural: the strict-gate test holds a record, which the old gate refused ... 7d01de3dcc

The test added in e0d16bc1 held only a candidate, wai.tensor.nnc. That
candidate's replicate class does not refuse `replicate`, so the old gate
gave the same reason, and the test passed with the dispatchable filter
removed. It now holds a record, wai.video.manifest, too. A record has no
replicate class, so the old gate refused the envelope as naming an
unknown capability. With the filter it gets step 6's missing model, as
from an empty registry and from the non-strict path. Locally, with the
filter removed, the test fails on the record, and with it, it passes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge wai/land-13-parameter-set-identity into wai/land-14-energy-reporting ... 17cca049df

Brings link 13's review fixes and the link 12 commits it had merged: the
strict gate reads only dispatchable capabilities, a pinned ONNX model
that keeps tensors in another file is refused with set_incomplete,
sha256.json sidecar writes are serialized, and the public text the
review found stale or overstated is corrected. The merge needed no
conflict resolution. On the merged tree the registry exports are up to
date, and the conformance workflow's library, integer-kernel, carriage
and C ABI envelope steps and the neural gates workflow's three steps
passed locally.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: state what CI builds, the meters' new feature, and the /verify change ... bc0dffa965

The v0.4.0 energy-report entry said the conformance build builds the
reference meters on every platform. It builds two of them, wai_meter and
wai_world_meter. wai-energy-receipts.yml builds those two, wai_video_meter
and wai_quantum_meter on linux, linux-arm64 and macos. No workflow builds
wai_prov, which needs codecs. The entry now says so, and the conformance
workflow's comment no longer names a Windows leg its matrix does not have.

The entry now records two compatibility changes. Every reference meter bin
requires receipt_claims, and Cargo skips a bin whose required features are
off without an error. POST /verify in wai-quantum-serve renders an unmetered
receipt's joules_micro as null and adds a metered member, so the crate moves
to 0.4.0 and the Wire paragraph names the change.

jwp-receipts §2.4.9 rule 2 reads "A point that is present MUST NOT be
empty", in the form of the other rules. quantum-sim names the meter's other
unmetered paths: a rail that is not live in both brackets (energy-measurement
§3.1), and a §4 ratio or §2.3 uncertainty that cannot support a figure.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge wai/land-14-energy-reporting into wai/land-15-key-discovery ... 07df5a5f9a

Brings in link 14's integration commits: the strict neural gate reads only
dispatchable capabilities, the ONNX reader refuses a pinned model with a tensor
kept outside the verified bytes, sha256.json sidecar writes are serialized, the
public text corrections, and the energy-report entry's account of what CI
builds, the meters' receipt_claims requirement and the /verify response change.

wai-neural-gates.yml: the strict-gate step runs both links' tests, so it now
expects 12 to pass, and the key-log step from this link stays as it was. The
header names both the held-candidate test and the key-log check.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: a key log's revocation refuses a set at every sink that holds one ... 28de796b42

SPEC §3.1's check 5 now has two parts. Revocation runs at every sink
that holds a key log, for every capability a pin applies to: a set whose
digest is in the revoked_modules of the head the sink reaches from any
anchor it holds is refused with prior_revoked. It needs no grant, status
or clock, so it no longer waits on the relying party holding the
capability to jwp-receipts §7.9, and it is reported as prior_revoked
whichever check of §7.9 a grant fails first, offline or with no grant
included. Authorisation is still the relying party's choice per
capability. SPEC §3.1 and §4, jwp-receipts §7.9 and the CHANGELOG say so.

An envelope that pins no set no longer escapes check 5. The neural
registry, given a key log, checks the set an unpinned decode reads under
each digest a pin over it could name (the file's SHA-256 for a one-file
set, and each listing beside it), and dispatch falls back when it is
refused. PinAuthority gains check_unpinned for this.

A family receipt now needs energy/<class> for each class its figures
carry, as Item::from_family already derived: the §7.5 row, the corpus
README, signer_verify.py and the corpus reader now agree. Item::for_group
and Item::for_family are crate-internal, the corpus's builders, and the
docs say that from_family takes signer_id and time from its caller.

signer-conformance gains vectors for a revoked set whose grant fails at
check 4, a revoked set with no grant, a set with no grant, and a family
receipt with two classes, regenerated by wai_signer_vectors gen; both
verifiers reproduce every verdict, and every earlier vector keeps its
declared outcome. The CI library tests cover the revocation part at a
sink that does not hold the capability to §7.9, and the neural key-log
gate covers the unpinned decode.

Docs say that a key log naming the subject's origin holds for one
envelope. ModelRegistry's key_log field is private, which the CHANGELOG
records. The pin corpus README says its cases model a sink with no key
log. The parameter-set entry's refusal list names check 5's two reasons,
and the did:web label test is described by the files it reads.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

ci: the neural key-log gate follows the code it runs; the wasm32 step says what it checks ... 29877f83ff

wai-neural-gates.yml now also triggers on src/key_log/**, signer_id.rs,
claim_receipt.rs and claim_text.rs, which the key-log case of
neural_native_decode runs through. The comment on wai-conformance.yml's
wasm32 step says that key_log has no I/O, clock or threads, so a browser
sink could run it, that none does yet, and that the step checks it
builds for wasm32.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge main into wai/land-14-energy-reporting ... 93d5ce5845

joule-code/CHANGELOG.md: main's entry (a vendor counter is a hardware
reading only while it is demonstrably live) and this link's joule-moq 0.2.0
entry both land under the unreleased section, main's first. The joule-code
workspace builds with --locked and the joule-moq tests pass on the merge.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge wai/land-14-energy-reporting into wai/land-15-key-discovery ... 18ee58f670

Carries main (through link 14's merge of it) into link 15.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai/CHANGELOG: the registry note states the rule for later changes ... 7e402d8de9

The note addressed changes then in flight; they have landed. It now states the
standing rule, and says vocab v1 is stable and only gains terms, as the
vocabulary README does.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot added 2 commits 2026-10-01 14:53:42 -04:00

Merge main into wai/land-14-energy-reporting ... 2934038be9

Main now carries links 12 and 13. This merge makes main the base of the
pull request, so its diff is this link's own change.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge wai/land-14-energy-reporting into wai/land-15-key-discovery ... 8eba9008f6

Carries main, which now holds links 12 and 13, into link 15.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot merged commit a7e96c92d9 into main 2026-10-01 14:54:56 -04:00

dcharlot referenced this pull request from a commit 2026-10-01 14:54:57 -04:00

Merge pull request 'wai: key discovery, signing authority and module revocation' (#134) from wai/land-15-key-discovery into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Transaction-Science/open-standards!134

No description provided.