wai: staged delivery in the browser — one base decode, the wasm binding, and its check #152

Merged

dcharlot merged 11 commits from wai/land-18-staged-browser into main 2026-10-06 02:26:54 -04:00

Conversation 0 Commits 11 Files changed 31 +3574 -141

2026-10-05

Transaction Science

wai: the staged sink's linearity test times the thread's CPU, not the wall clock ...

On the shared macOS runner the wall clock counted other jobs' time: a linear offer
measured 64.5× and 183× for 16× the units, against a 64× bound, while its bytes,
allocations and peak stayed at 16×. The offer runs on the calling thread, so the
thread's CPU time is the offer's own work; under a load of 108 on 18 cores it
measures 16–17.6× for every shape.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

0fe755f954

• View at this point in history

2026-10-05 20:59:37 -04:00

Transaction Science

wai: round 3 of the link-18 review — claimed stage0 in the CLI, inert claims, order and limits ...

- wai stage apply: with --stage0 the base is claimed; its step, its units,
  every report of its chain and its final entry say "claimed": true (as the
  browser binding marks a claimed chain). A base the tool cannot decode
  (encrypted, inert, refused by its pin or payload) is its step's error by
  code, and the replay goes on.
- staged::decode_base refuses in a stated order: not-wai1, encrypted (SPEC
  §6.4 before §4), not-offered, then §4; a parameter set's listing is made
  only for a capability that reads a set, so a stray file name is no refusal
  for wai.video.int_motion. The doc states each token's vocabulary, and that
  the cost limit binds a base whose capability declares a cost (int_synth
  and int_mlicpp decode under their formats' caps, as with_cost_limit does).
- wai-web: fromStage0 applies SPEC §4 as decode_base_via does (an inert
  envelope, a refinement-only or companion-only capability, is claimed
  neither through its capability nor its fallback; the capability must be
  dispatchable). StageBase.decode requires its limit argument: left out it
  is refused; null means the format's caps only.
- cli_stage::apply_json_replays_the_corpus also replays the four PNG and FLAC
  cases through --stage0 (claimed marks set aside, and required) and
  budget_partly_applied: 43 cases agree.

Tests: staged::tests::{decode_base_refuses_in_its_stated_order,
decode_base_limit_binds_declared_costs_only}, cli_stage::{apply_stage0_marks_the_base_claimed,
apply_records_a_refused_base_and_goes_on}, the inert cases in
stage::tests::a_claimed_base_cannot_raise_its_facts and in
demo/verify_staged_wasm.mjs, which also requires the limit argument.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

06f7de0a4d

• View at this point in history

2026-10-05 07:23:23 -04:00

Transaction Science

wai: the sidecar rule excludes tests/vectors/staged_bounds, which holds nothing to decode ...

Co-Authored-By: Claude Opus 5.5 <[email protected]>

e0d85900d9

• View at this point in history

2026-10-05 06:52:48 -04:00

Transaction Science

wai: CHANGELOG and demo README for the review round ...

The v0.4.0 subsection states the base rule of staged-delivery §4.5 (a base
past the chain budget is not added; its decode is bounded by the cost limit
first), SPEC §4 for a base with a cost limit and a key log, the claimed base
and the facts a page cannot raise, the routed and traced `wai stage apply`,
the encoder's caps, and the bench's source at the final shape.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

72c96bc880

• View at this point in history

2026-10-05 06:49:59 -04:00

Transaction Science

wai: the bounded-base check never prints a decoded clip when it fails ...

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dfca621c07

• View at this point in history

2026-10-05 06:42:07 -04:00

Transaction Science

wai: tests for the bounded base, the CLI as the corpus's sink, the trace and the bench ...

- wai-rs/tests/vectors/staged_bounds: the review's two bases that declare
  clips just under the 2^30 and 2^26 caps in 3,243 and 415 bytes, and two
  inert envelopes (a refinement-only and a companion-only capability with an
  int_motion fallback), which staged::tests::decode_base_runs_spec_4 builds
  and checks byte for byte.
- tests/staged_resources.rs: with a cost limit, decode_base refuses each
  bounded base (cost_over_limit) holding a few kilobytes at peak (counting
  allocator); a decoded base past the chain budget leaves nothing in the sink.
- wai-web demo/verify_staged_wasm.mjs: the same refusals in wasm32 with linear
  memory growth checked (wasmMemoryBytes); a base past the chain budget; the
  viaFallback setter gone and attested raise-only; the inert envelopes;
  fromStage0's capability, tier and claimed rules; addBase spends its base;
  claimed marks set aside to compare the PNG and FLAC cases; a seeded fuzz of
  every corpus envelope that must not trap.
- cli_stage::apply_json_replays_the_corpus (the review's cli_vs_corpus.py):
  every case the tool's sink can replay gives the case's reports and final
  units; step1_refusals, unreadable_envelopes and base_via_fallback now match.
- cli_stage::apply_holds_layers_for_a_later_base lists stages 0, 1 and 2 for
  each unit a base's arrival takes up in one step.
- cli_stage::stage_bench_takes_the_source_at_the_final_shape and
  stage_base_refuses_overflowing_dims.
- wai-web-wasm.yml: 14 native tests.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

f90367e1aa

• View at this point in history

2026-10-05 06:34:47 -04:00

Transaction Science

wai: bound a base before it is decoded, and decode it by SPEC §4 ...

Review findings 1-10 of PR #152 (link 18).

- staged::decode_base / decode_base_via take a cost limit and a key log.
  The payload's declared cost is checked (int_payload::check_cost) before any
  symbol is decoded or output allocated; cost_over_limit, like
  unsupported_capability and set_incomplete, makes the capability unsupported
  and dispatch moves on to the fallback. The key log runs SPEC §3.1 check 5
  over a pin and over an unpinned set; None skips it (a sink with no key log).
- decode_base runs SPEC §4 through Wai::dispatch_verified: the capability,
  then the fallback, only where is_dispatchable accepts it, so a
  refinement-only or companion-only capability makes the envelope inert
  (missing_capability) and its fallback is never reached. decode_base_via asks
  for one of the two, and refuses any other string (not-offered).
- A capability whose set is one file, pinned with no form, offers every held
  file to the pin, the member it reads first: a README beside model.wam no
  longer breaks the decode.
- StageSink::add_base counts the base's state against the chain budget: a
  base past it is refused chain-over-limit, keeps no chain, and its layers
  stay held. staged-delivery §4.5 (and §4.2, §14) say so; the corpus gains
  base_over_budget, and staged_verify.py implements the rule independently.
- StageSink::set_trace / take_trace record every application, so a batch that
  takes a unit up several stages records each.
- wai stage apply routes by content: refines or a refinement-only capability
  is a layer; any other envelope is a base decoded by SPEC §4. not-wai1 and
  encrypted are a step's error under --json, and the replay goes on. --json
  lists every stage reached (from the trace), stage 0 for a base's step, and
  the units whose frozen flag changed.
- wai_stage_bench takes the source at the units' final shape; a stage whose
  unit has another shape has no quality figure, and the comparator says why
  it does not apply.
- encode_wiv1_zero_motion checks MAX_TENSOR, MAX_FRAMES and MAX_CLIP before
  allocating (too_large); wai stage base multiplies --dims checked.
- wai-web: StageBase.decode takes the page's cost limit; stageLayerInfo returns
  a base's declared decode cost; addBase consumes the StageBase. The
  viaFallback setter is gone and attested only rises. fromStage0 parses the
  envelope, takes only the manifest's capability or its fallback (deriving
  via_fallback), caps the claimed tier at base_tier(capability, None), and
  marks the base claimed: every report, units() entry and stage hash
  (unitSha256 and clipSha256 now return {sha256, claimed}) of its chain says
  claimed.

Tests: staged::tests::{decode_base_runs_spec_4, decode_base_applies_the_cost_limit,
decode_base_runs_check_5, decode_base_one_file_pin_ignores_other_files,
add_base_counts_its_state_against_the_budget}, the extended encoder test, the
new corpus case, and wai-web stage::tests::{a_claimed_base_cannot_raise_its_facts,
limit_reads_its_form}.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

35c53adb9f

• View at this point in history

2026-10-05 06:27:42 -04:00

Transaction Science

wai: CHANGELOG — staged delivery in the browser, a base writer, a trace and a bench ...

Co-Authored-By: Claude Opus 5.5 <[email protected]>

1ad89e0d71

• View at this point in history

2026-10-05 05:31:59 -04:00

Transaction Science

wai: wai_stage_bench, a native measurement of one staged set ...

Stage 0 is every base decoded, stage k every layer k applied, in the order
given. Per stage: the envelopes' bytes split into WAI1 framing, manifest and
payload, and cumulative; PSNR (8-bit) or SNR (16-bit) per unit and over the
clip from the exact integer SSE, with an exact match reported as exact; the
microseconds the stage took, median and quartiles over at least 20 runs; the
direct comparator, one identity layer per base at the stage's step straight
from stage 0; every unit's stage hash. Energy is reported as unmetered and
receipts as absent: the tool reads no meter, and a set on disk has none.

Test: cli_stage::stage_bench_reports_bytes_quality_and_hashes, which builds a
set with wai stage base and refine and checks the report against the files
and the source frames' SHA-256.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

fa40aff3bc

• View at this point in history

2026-10-05 05:30:18 -04:00

Transaction Science

wai-web: the staged-delivery sink in the browser, checked against the corpus ...

- src/stage.rs binds wai::staged::StageSink for JS. StageBase.decode decodes a
  base through staged::decode_base_via (its pin verified against the set held
  in memory; the manifest's capability or its fallback); StageBase.fromStage0
  takes a base decoded elsewhere. StageSink adds bases, offers layers,
  expires holds, removes, attests and forgets bases, and reads back every
  unit's stage, producer, frozen flag, tier, shape, output, stage hash and
  squared error. stageLayerInfo reads a layer's refines, WIR1 header,
  declared cost and byte split before it is offered. Reports and units are in
  the corpus's own form.
- staged::decode_base_via: a base decoded through its manifest's fallback is
  recorded as decoded through a fallback; any other capability is refused
  (not-offered).
- demo/verify_staged_wasm.mjs replays all of staged-conformance/ through the
  wasm32 build: every integer base decoded in wasm32 to its stage0.bin, and
  every report, final unit, stage hash and clip hash equal to the native
  sink's.
- wai-web-wasm.yml runs it, and watches staged-conformance/; the native unit
  test count is 12 (stage::tests adds three, one of which replays the corpus
  through the binding's pure half).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

d532d9dbe2

• View at this point in history

2026-10-05 05:24:28 -04:00

Transaction Science

wai: one base decode for sinks, a keyframe-0 base writer, and a JSON stage trace ...

- staged::decode_base: decode a base envelope for a sink through
  int_payload::decode_int, verifying its pin against the set held in
  memory; the tier counts the pin only where it resolved. The CLI and the
  browser binding both call it, so there is one base path.
- int_payload::encode_wiv1_zero_motion: the reference keyframe-0 WIV1
  encoder (zero motion, one block per frame, closed GOP) moves out of the
  corpus generator into the library. The corpus regenerates byte for byte
  through it.
- wai stage base: writes a wai.video.int_motion base from raw RGB8 frames,
  decoded back before it is written.
- wai stage apply: a StageSink replay. Envelopes are taken in order; a
  later base is decoded and releases the layers held for it. --json prints
  each step's reports in the corpus's form and the units each step changed,
  with their stage hashes, for a sink elsewhere to check against.

Tests: int_payload::tests::encode_wiv1_zero_motion_round_trips,
staged::tests::decode_base_reads_the_pin_and_the_corpus_units,
cli_stage::{base_refine_apply_json_trace, apply_holds_layers_for_a_later_base}.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

ed10bacbcf

• View at this point in history

2026-10-05 05:16:22 -04:00