wai: key discovery, signing authority and module revocation #134
2026-10-01
Merge wai/land-14-energy-reporting into wai/land-15-key-discovery
Some checks failed
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
wai cross-architecture byte-equality / linux-aarch64 (pull_request) Has been cancelled
wai cross-architecture byte-equality / linux-x86_64 (pull_request) Has been cancelled
wai cross-architecture byte-equality / macos-arm64 (reference) (pull_request) Has been cancelled
standards workspaces build + test / jouleclaw-rs (pull_request) Has been cancelled
standards workspaces build + test / aac-rs (pull_request) Has been cancelled
standards workspaces build + test / arl-rs (pull_request) Has been cancelled
standards workspaces build + test / eoc-rs (pull_request) Has been cancelled
standards workspaces build + test / jcp-rs (pull_request) Has been cancelled
standards workspaces build + test / joule-code-rs (pull_request) Has been cancelled
standards workspaces build + test / joule-ui-rs (pull_request) Has been cancelled
standards workspaces build + test / joulecontract-rs (pull_request) Has been cancelled
standards workspaces build + test / jouledesk-rs (pull_request) Has been cancelled
standards workspaces build + test / joulehook-rs (pull_request) Has been cancelled
standards workspaces build + test / map-rs (pull_request) Has been cancelled
standards workspaces build + test / mesh-rs (pull_request) Has been cancelled
standards workspaces build + test / openpay (pull_request) Has been cancelled
standards workspaces build + test / proof-rs (pull_request) Has been cancelled
standards workspaces build + test / sandbox-rs (pull_request) Has been cancelled
standards workspaces build + test / sense-rs (pull_request) Has been cancelled
standards workspaces build + test / smart-byte-rs (pull_request) Has been cancelled
standards workspaces build + test / macOS energy backend (jcp-energy) (pull_request) Has been cancelled
no-vanity-metrics / Scan committed Markdown for vanity metrics (pull_request) Has been cancelled
no-vanity-metrics / WAI public text names no comparison (pull_request) Has been cancelled
no-vanity-metrics / WAI public text names no company or product (pull_request) Has been cancelled
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Has been cancelled
smart-byte conformance gate / Validate conformance JSON files (pull_request) Has been cancelled
smart-byte conformance gate / Second implementation reproduces every vector (pull_request) Has been cancelled
smart-byte conformance gate / Spec changes require vector-pack updates (pull_request) Has been cancelled
smart-byte conformance gate / VERSIONS.md and README.md must exist (pull_request) Has been cancelled
Carries main, which now holds links 12 and 13, into link 15. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai/CHANGELOG: the registry note states the rule for later changes
Some checks failed
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Successful in 44s
WAI energy receipts / energy receipts · linux (pull_request) Successful in 1m1s
wai formal verification (integer core) / kani (pull_request) Successful in 3m53s
WAI JPEG-AI whole decode (pinned inputs, required) / fetch pinned JPEG-AI inputs → whole decode + pixel hash, required (pull_request) Successful in 59s
WAI neural decoders end-to-end / synthetic fixtures → Rust decode → reference (±4) (pull_request) Successful in 1m4s
WAI neural sink gates / model-free refusals of the neural sink (pull_request) Successful in 46s
WAI section references / cited sections exist (pull_request) Successful in 10s
WAI mbt2018_mean integer decode (regenerated vectors) / regenerate mbt2018_mean integer vectors → Rust decode, required (pull_request) Successful in 3m50s
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Successful in 1m37s
standards workspaces build + test / jouleclaw-rs (pull_request) Successful in 12m8s
standards workspaces build + test / aac-rs (pull_request) Successful in 13m20s
standards workspaces build + test / joule-code-rs (pull_request) Successful in 11m29s
standards workspaces build + test / joulecontract-rs (pull_request) Successful in 2m42s
standards workspaces build + test / map-rs (pull_request) Successful in 2m50s
standards workspaces build + test / mesh-rs (pull_request) Successful in 3m43s
standards workspaces build + test / openpay (pull_request) Successful in 22m17s
wai cross-architecture byte-equality / linux-aarch64 (pull_request) Successful in 57s
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Successful in 6m34s
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Successful in 1m16s
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Successful in 2m11s
standards workspaces build + test / arl-rs (pull_request) Has been cancelled
standards workspaces build + test / joule-ui-rs (pull_request) Has been cancelled
standards workspaces build + test / jouledesk-rs (pull_request) Has been cancelled
standards workspaces build + test / joulehook-rs (pull_request) Has been cancelled
standards workspaces build + test / sense-rs (pull_request) Has been cancelled
standards workspaces build + test / macOS energy backend (jcp-energy) (pull_request) Has been cancelled
wai cross-architecture byte-equality / macos-arm64 (reference) (pull_request) Has been cancelled
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
The note addressed changes then in flight; they have landed. It now states the standing rule, and says vocab v1 is stable and only gains terms, as the vocabulary README does. Co-Authored-By: Claude Opus 5.5 <[email protected]>
Merge wai/land-14-energy-reporting into wai/land-15-key-discovery
Carries main (through link 14's merge of it) into link 15. Co-Authored-By: Claude Opus 5.5 <[email protected]>
ci: the neural key-log gate follows the code it runs; the wasm32 step says what it checks
wai-neural-gates.yml now also triggers on src/key_log/**, signer_id.rs, claim_receipt.rs and claim_text.rs, which the key-log case of neural_native_decode runs through. The comment on wai-conformance.yml's wasm32 step says that key_log has no I/O, clock or threads, so a browser sink could run it, that none does yet, and that the step checks it builds for wasm32. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: a key log's revocation refuses a set at every sink that holds one
SPEC §3.1's check 5 now has two parts. Revocation runs at every sink that holds a key log, for every capability a pin applies to: a set whose digest is in the revoked_modules of the head the sink reaches from any anchor it holds is refused with prior_revoked. It needs no grant, status or clock, so it no longer waits on the relying party holding the capability to jwp-receipts §7.9, and it is reported as prior_revoked whichever check of §7.9 a grant fails first, offline or with no grant included. Authorisation is still the relying party's choice per capability. SPEC §3.1 and §4, jwp-receipts §7.9 and the CHANGELOG say so. An envelope that pins no set no longer escapes check 5. The neural registry, given a key log, checks the set an unpinned decode reads under each digest a pin over it could name (the file's SHA-256 for a one-file set, and each listing beside it), and dispatch falls back when it is refused. PinAuthority gains check_unpinned for this. A family receipt now needs energy/<class> for each class its figures carry, as Item::from_family already derived: the §7.5 row, the corpus README, signer_verify.py and the corpus reader now agree. Item::for_group and Item::for_family are crate-internal, the corpus's builders, and the docs say that from_family takes signer_id and time from its caller. signer-conformance gains vectors for a revoked set whose grant fails at check 4, a revoked set with no grant, a set with no grant, and a family receipt with two classes, regenerated by wai_signer_vectors gen; both verifiers reproduce every verdict, and every earlier vector keeps its declared outcome. The CI library tests cover the revocation part at a sink that does not hold the capability to §7.9, and the neural key-log gate covers the unpinned decode. Docs say that a key log naming the subject's origin holds for one envelope. ModelRegistry's key_log field is private, which the CHANGELOG records. The pin corpus README says its cases model a sink with no key log. The parameter-set entry's refusal list names check 5's two reasons, and the did:web label test is described by the files it reads. Co-Authored-By: Claude Opus 5.5 <[email protected]>
Merge wai/land-14-energy-reporting into wai/land-15-key-discovery
Brings in link 14's integration commits: the strict neural gate reads only dispatchable capabilities, the ONNX reader refuses a pinned model with a tensor kept outside the verified bytes, sha256.json sidecar writes are serialized, the public text corrections, and the energy-report entry's account of what CI builds, the meters' receipt_claims requirement and the /verify response change. wai-neural-gates.yml: the strict-gate step runs both links' tests, so it now expects 12 to pass, and the key-log step from this link stays as it was. The header names both the held-candidate test and the key-log check. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: jwp-receipts §5 names every corpus published in the tree
§5's opening keeps its rule for the §5.1-§5.5 cases, and its parenthesis said only the claim corpus of §5.6 was published here. The JWP corpus (§5.7) and the key-discovery corpus (§5.8) are published here too, and it now names all three. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: name signer-conformance in the decoded-output sidecar exclusions
every_decoded_output_states_a_sha256 enumerates every wai/*-conformance directory and requires a sha256.json sidecar or a named exclusion. The key-discovery corpus holds key logs, grants and statuses, signed documents with no decoded output, so it is excluded for the reason the claim, JWP and OER corpora are. Without this, the fast-kernel steps of wai-conformance.yml fail on the assembled tree. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai/research: key-discovery status lines name the v0.4.0 change
The two status paragraphs in energy-exposure-mapping that Stream C added said "after jwp-receipts §7". The other streams' status lines name their v0.4.0 CHANGELOG entry, so these now name "Key discovery, signing authority and module revocation" the same way. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: the neural sink refuses a revoked pinned set through its key log
A ModelRegistry given a key log runs SPEC §3.1's check 5 on its decode path. A test over the committed int_mlicpp set, under neural and key_discovery, shows neural::decode_envelope refusing the set with `prior_revoked` once the log revokes its digest and with `prior_not_authorised` when the sink holds no fresh status, and decoding it to its committed image while a current grant holds it. wai-neural-gates.yml runs it as its own step with a count check, and now also triggers on key_log.rs. The CHANGELOG says so. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: module revocation through the parameter-set pin's check 5
SPEC §3.1 reserved check 5 for a revocation of the pinned set, keyed on the pin's form and sha256, and jwp-receipts §7.9 authorises and revokes a pinned set by its digest. They meet here: - SPEC §3.1 check 5 runs §7.9 over the set a pin names when the sink's relying party holds the capability's pinned sets to §7.9: the reason is `prior_revoked` where a key log revokes the digest, and `prior_not_authorised` for any other failure, offline included. It sits before `prior_not_held`, so a revoked set is refused whether or not the sink holds it, and refusal names follow §3.1's snake_case rule. A sink with no key log skips the check. - SPEC §4 folds the module-authorisation paragraph into steps 3 and 5, and states plainly that a sink configured with no key log does not run §7.9, that the reference dispatcher runs check 5 when configured with one, and that wai-web and the C ABI take none. jwp-receipts §7.9 cites SPEC §3.1, says the pin's digest stands for the bytes' at its check 2 (checks 6-8 of §3.1 then require the bytes to have it), and says which grant's outcome is reported when a sink holds several. - wai-rs: PinRefusal gains Revoked and NotAuthorised. pin::PinAuthority is check 5; pin::verify_bytes_with and verify_with run it before any held file is read. key_log::SinkKeyLog implements it from the key log a sink holds, through key_log::module_check_digest, and neural::ModelRegistry::with_key_log gives one to the neural sink. - Library tests, run by CI's library step, dispatch WAI1 and WAI2 envelopes pinning the committed int_mlicpp set: a revoked set goes to the fallback, is reported as `prior_revoked` when none remains, and is refused before check 6; offline, without a clock, without a grant and from another origin the set falls back with `prior_not_authorised`; with no key log, or a capability not held to §7.9, it decodes. Disabling check 5 in pin.rs fails four of them. - signer-conformance: a parameter-set verdict carries `refusal=prior_revoked` or `refusal=prior_not_authorised`, with two vectors added; regenerated through the generator and reproduced by signer_verify.py. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: a group's labelled leaves and total need their class's authority
Stream C left these out until the labelled JWP forms existed. With them on this base: - jwp-receipts §7.5: a group receipt and the objects under it need `delivery` and `energy/<class>` for each class the objects' labelled leaves bind (§2.2) and the class a labelled group payload signs for the total (§2.3). A group with a hardware-class label is signed by one key for delivery and the figures, so `also_delivers` is true there by construction. §3 step 6 and confidentiality §6 say what a labelled leaf binds. - key_log: Item::for_group takes those classes again. Item::from_group reads them from a group receipt that passes §3 steps 1-2 and objects that pass their inclusion check, and Item::from_family from another family's receipt through its verified figure view; neither builds an item from bytes that did not verify. - signer-conformance: four group-labelled vectors, regenerated through wai_signer_vectors gen and reproduced by signer_verify.py, whose group authorities follow the same row. Ignoring the classes in for_group fails all four. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: measurement and operating-point claims need their class's authority
jwp-receipts §7.5 now names the authorities of the two claim classes the energy reports added: a measurement claim needs `measurement`, an operating-point claim `operating-point`, and each also needs the energy authority of the figure it restates, which is pinned-only for a hardware class. The table names every class whose authority is its name, a bullet says what confirmation adds to §2.4.8's check that a report's key signed the figure, and the CHANGELOG's authority list carries both. signer-conformance gains a revision with a measurement key and an operating-point key, and five vectors: each class refused without its own authority, confirmed with it, and a hardware-class report refused under a fetched anchor. Both verifiers reproduce them; dropping the class authority from claim_authorities, or from signer_verify.py's, fails them. claim_authorities_follow_the_table now requires the claim corpus to hold a confirmable claim of each of energy, lawful-basis, measurement and operating-point. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: key-discovery corpus is jwp-receipts §5.8; CI runs signer_verify.py
The JWP corpus took §5.7, so the signer-conformance section is §5.8 and §7.8's reference to it follows. Its statement about the claim corpus now covers the measurement and operating-point vectors as well: §7 changes none of them. signer_verify.py was run by hand. The independent-verifiers job now runs it on the linux runner and requires its verdicts to equal wai_signer_vectors' line for line; the README, the binary's doc and the CHANGELOG say so. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: key discovery, signing authority and module revocation
jwp-receipts §7: a did:web signer_id names a web origin, which publishes a key log at /.well-known/wai-keys: revisions signed by a root key that pre-commits to its successor, listing the origin's keys, the authorities each holds, and whether each is active, retired or revoked. A verifier that has anchored the origin, pinned or fetched, confirms an accepted receipt, claim or module grant against the log offline, and reports the outcome beside the item's own verdict, never in it. Hardware-class energy, lawful-basis and pre-emption authorities are confirmed only under a pinned anchor. Revocation refuses every item under a revoked key. §7.9 authorises decoder and reconstruct modules, and pinned parameter sets, by SHA-256 digest through signed module grants from the sink's module origins, revokes them by digest in the key log, and bounds how long a revoked module keeps running by grant_max_s + status_max_age_s, under ceilings of 86400 s and 3600 s. Every failure, offline included, leaves the module not held and dispatch falls back. wai-rs gains signer_id (ungated) and key_log (feature key_discovery), the wai_signer_vectors and wai-keys binaries, and the signer-conformance corpus with an independent Python verifier. The reference meters and the world demo sign under labels. A section-reference guard checks that every section SPEC.md or an extension cites in another of them exists. This commit is the stream as merged onto link 14. The commits after it reconcile it with the parameter-set pin and the energy reports. Co-Authored-By: Claude Opus 5.5 <[email protected]>