wai: staged-delivery measurement — counted bytes, integer quality, a proved stall bound, and delivery telemetry #169
2026-10-06
Merge main (wai-pack merged as #168) into wai/w5-staged-measurement
All checks were successful
no-vanity-metrics / WAI public text names no company or product (pull_request) Successful in 3s
standards workspaces build + test / arl-rs (pull_request) Successful in 1m7s
standards workspaces build + test / eoc-rs (pull_request) Successful in 1m53s
WAI conformance / cargo-class corpora · macos (pull_request) Successful in 9m55s
WAI conformance / cross-arch byte-equality · macos (pull_request) Successful in 34s
standards workspaces build + test / jcp-rs (pull_request) Successful in 1m26s
standards workspaces build + test / joule-ui-rs (pull_request) Successful in 1m8s
standards workspaces build + test / joulehook-rs (pull_request) Successful in 1m9s
WAI energy receipts / energy receipts · macos (pull_request) Successful in 3m17s
standards workspaces build + test / proof-rs (pull_request) Successful in 1m10s
wai-pack / wai-pack · macos (pull_request) Successful in 1m22s
standards workspaces build + test / sandbox-rs (pull_request) Successful in 2m14s
standards workspaces build + test / sense-rs (pull_request) Successful in 1m5s
standards workspaces build + test / smart-byte-rs (pull_request) Successful in 3m38s
WAI conformance / cargo-class corpora · linux (pull_request) Successful in 5m14s
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Successful in 12s
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Successful in 2m16s
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Successful in 7s
WAI conformance / cross-arch byte-equality · linux (pull_request) Successful in 22s
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Successful in 44s
WAI energy receipts / energy receipts · linux (pull_request) Successful in 1m30s
WAI JPEG-AI whole decode (pinned inputs, required) / fetch pinned JPEG-AI inputs → whole decode + pixel hash, required (pull_request) Successful in 1m1s
WAI neural sink gates / model-free refusals of the neural sink (pull_request) Successful in 1m2s
wai-pack / wai-pack · linux (pull_request) Successful in 42s
wai-pack / wai-pack · independent verifier (Python) (pull_request) Successful in 53s
wai-pack / wai-pack · dependency licences (pull_request) Successful in 1m10s
WAI section references / cited sections exist (pull_request) Successful in 9s
WAI mbt2018_mean integer decode (regenerated vectors) / regenerate mbt2018_mean integer vectors → Rust decode, required (pull_request) Successful in 3m59s
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Successful in 1m54s
workflow hygiene / every workflow supersedes its own queue (pull_request) Successful in 3s
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Merge wai-pack (T4, PR #168) into wai/w5-staged-measurement
Co-Authored-By: Claude Opus 5.5 <[email protected]> # Conflicts: # .github/workflows/wai-conformance.yml
Merge main (link 18 merged as #152) into wai/w5-staged-measurement
Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-05
wai sim: a seeded test of draws aimed at the base orders the stall bound needs
The wild-plan test did not fail when the strict-priority key was reverted; only the two review models did. `targeted` draws captures on, just before and after chunk boundaries, repeated and out of order, bases split into two layer-0 objects with their own captures, objects listed in any order, one-byte to datagram-sized chunks, slow links and zero, one-microsecond and chunk-length timeouts, all inside section 10.4's preconditions. bound_holds_on_targeted_plans runs 20,000 seeded draws. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai measure: section 10.4's base order is greedy under subgroup precedence
The proof numbered the bases by their order key and said, in step 1, that an earlier-available object "would have been chosen first". Under `subgroup` a base's layer-0 objects form one subgroup sent in title order, so one listed later but available earlier waits behind its subgroup. The proof now numbers layer-0 objects in the order the sender takes them, greedily under subgroup precedence, shows by induction that the order is the same under the plan and the base-only model (the same objects finished, so the same ones held; a later start only adds objects of larger key), and restates step 1 and step 3 on that order. The induction is unchanged. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai measure: section 13's matrix says "not countable" wherever section 3.2 does
The audio row's FLAC base, the enhancement-layer row (an unchecked companion), and the score, quantum and text rows said their bytes were countable; count_object gives no-format-check for each. Every row is now checked against count_object's behaviour: a class whose staged form or base has no checked format is "not countable in this revision", including the rows whose staged form is not yet registered. A test runs count_object under each such row's capability. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai telemetry: no
?, #, @ or backslash in an object URL; cid privacy is the emitter's
The userinfo check read the authority after `//`, so `https:\\alice:pw@host`, `https:alice:pw@host` and `https:/\alice:pw@host` passed. object.url now refuses any `?`, `#`, `@` or `\`, a path `@` included, so no query, fragment or user information enters an observation however a parser splits the URL. Corpus cases for the three bypasses, a backslash alone and a path `@`; the escaped-URL observation keeps a quote (its backslash moved out with the rule). Section 8.2 also states that no syntax keeps an address, a token or personal data out of `cid`: an emitter MUST NOT put one there, and the charset stays a syntax rule. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai stage, wai_stage_bench: every layer and chain held to the stated limits
`wai stage apply` and `refine` hold each layer to the output, symbols and working bytes of the cost limit (--limit, by default staged::TOOL_DEFAULT_LIMIT) and each chain to staged::TOOL_DEFAULT_CHAIN_BUDGET. wai_stage_bench decodes its bases under the same limit (it passed none), takes --limit, holds layers and chains alike, and names a refusal's code. tests/vectors/staged_bounds gains a 275-byte base and a 587-byte up2 layer declaring 67,092,480 output bytes: with no flag, `wai stage apply` refuses the layer cost-over-limit and the bench refuses it too; the bench refuses the 64 MiB clip cost_over_limit before decoding. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai measure: a title lowers its limits and never raises them
A title's `limits` were taken as given, so a title stating 2^40 lifted the cost limit past the tools' and its bomb would be decoded. Each figure is now the lower of the title's and the tool's (Limits::within; Title::under for a tool's own --limit), in Rust and in measure_verify.py; raising a limit takes the tool's flag. Appendix D states it, and that every reference tool applies the stated limits to bases, layers and chains. A refusal title, clip-1gib-limits-raised, states 2^40 for every figure and is refused cost_over_limit before anything is allocated (counting-allocator test, now serialised so the two tests do not share the counters). Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai telemetry: corpus strings holding a quote and a backslash
Two observations whose strings RFC 9651 escapes: a capability carried in a Request-mode custom key, and a URL in an Event-mode response report. The differential encodes both with the independent library and requires the same bytes. Co-Authored-By: Claude Opus 5.5 <[email protected]>
ci: build, not only check, the stage_measure and telemetry libraries for wasm32
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai measure: every pixel is in a similarity window; B1's bound restated
The windows' offsets per axis are the multiples of 4 up to len - win, then len - win itself when it is not one, so an edge-aligned last window covers the border a stride of 4 left out (for example the last 3 columns of an 11-wide picture). Rust, Python and section 4.2 state the same rule. quality.json, written by generate-goldens and required by both verifiers, holds picture pairs at sizes that place windows every way the rule does; the fixtures (16x16 and 32x32) have no border, and goldens.json regenerates byte-identical. The i128 argument now bounds B1 by 5.33e12 and B2 by 1.34e12 (B1*B2 < 2^83), and the window count by the pixel count. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai measure: an output tree commitment is (root, leaf_count); proofs check under its count
An RFC 9162 audit path does not fix the tree's size: leaf 0's path in a 7-leaf tree also walks to that root when 8 is taken as the size. output_tree::OutputCommitment holds the root with its leaf count, commit() gives it, and verify_proof takes the size from the commitment rather than from the proof's holder. The evaluation holds the commitment; Appendix C and section 12.1 say a record or claim states both. Test: a 7-leaf proof does not verify against the 8-leaf commitment, and the stated-size case that shows why the count is committed. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai telemetry: name the differential's library by what it is; fix stale section refs
delivery-telemetry §9.3 says "an independent open-source CMCD and CMSD library", as the README does. The differential and its package description point at §9.3 and §9, where the conformance section is. The CHANGELOG states the MoQ line as the MUST NOT it now is. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai telemetry: a content id is a hash or a short token; no URL query, fragment or credential
cid is the entry object's content hash (64 lowercase hex) or 1-64 of [A-Za-z0-9._-], so it can hold no address, query or token. object.url is refused, not stripped, when it has a query, a fragment or user information. Section 8 says that neither a URL query nor a signed URL's token enters an observation and that a Request-mode report goes only to the host serving the object; the MoQ property's telemetry line is a MUST NOT. Corpus cases for each refusal. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: sim test — a decode ending past 64 bits is refused
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: sim test — three chunks, so the clock itself passes 64 bits
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: sim test — the link's clock passing 64 bits is refused
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: no overflow in the simulator, the session metrics or a report
The simulator's times and byte sums are checked: a sum past 64 bits is refused (SimError::Overflow), the same in every build, and a model or plan figure past 2^53 - 1 is refused when read; the review's model is a regression test. Session metrics refuse counted bytes or stall time past 64 bits. An observation member a report carries as an RFC 9651 Integer is at most 10^15 - 1, so from_json refuses what cmcd() cannot write; the corpus gains that refusal. CMSD integers take the same bound. Co-Authored-By: Claude Opus 5.5 <[email protected]>
ci(wai): the library tests take video_package; the decode bench is built
The package receipt's dedup tests, which content_dedup feeds, now run in the matrix's library step; wai_decode_bench, which prints its machine line from bench_env, is built in the integer-features step, where nothing built it before. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: SPEC §3.1 check 5's refusals are switch reasons and pin-refused reasons
prior-revoked and prior-not-authorised join PIN_REFUSALS, SWITCH_REASONS and delivery-telemetry §5.1, in the order of SPEC §3.1's checks; the corpus gains a switch and a capable observation that carry them, and the differential agrees. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: stage_measure test — the counting cases hold; the measured objects are the fixtures'
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: a payload counts only where WAI checks its format
§3.2's rule is now the format check alone: the pinned integer formats and WIR1, by the parse a sink runs, for the capability and for a WAI1 fallback with a pinned format. Any other capability, PNG and other classical codestreams and unregistered strings among them, is not countable (no-format-check), and neither is a WAI2 component whose sha256 is not its payload's (sha256-mismatch). The text heuristic is gone. A refusal carries its code. measure_verify.py counts by the same rule, and the corpus's counting.json pins an object for each outcome the review found the two disagreed on: base64, a JSON string, a byte-order mark, a fallback mismatch, a fallback WAI does not check, a digest mismatch, and others. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: a CMCD key shorter than three characters is never a custom key, and no parser panics
is_custom_key sliced past the end of a one-character key, so decoding `q` or `v=2,x="1"` panicked. A test checks the short keys, and another runs every telemetry parser (dictionaries, lists, CMCD reports, observations, CMSD descriptions) on twenty thousand drawn strings and twelve thousand altered JSON documents from a fixed seed: each returns, none panics. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: §10.4 proves the stall bound; the sim corpus isolates each unbounded part
§10.4 now states the bound's preconditions (no base timeout, a bounded link schedule, base-first decode) and proves it: bases go in one order under the plan and its base-only model, each starts at most one chunk (strict priority) or a timeout and one chunk (fifo) later, and its decode at most one refinement's decode later. Appendix B states the base order. sim_verify.py follows it. The corpus gains the two reorder models as regression cases, and the counter-plans now compare with the same plan with the missing part restored: fifo without a timeout against fifo with a short one, fifo decode against base-first decode. Exploratory sweep of the wild generator: 2,000,000 plans, no violation; 2000 are committed. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: the simulator sends and decodes bases in the order they became available
Under strict priority, bases go by (availability, first unit, index); under base-first decode, by the time they became ready. The base-only model then sends and decodes bases in the same order as the plan, which is what §10.4's bound needs. The two models a review found past the bound are regression tests, and the generator now draws groups in any order, captures out of order, objects listed in any order, tiny and large objects, slow links, short and zero timeouts, caps and one to four workers: 2000 such plans hold the bound. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: a layer refused under its title's cost limit, and a test that the case's facts are checked
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: one base decode for the measurement, under stated limits
The measurement's own base decode is gone: stage_measure decodes a base through staged::decode_base_pinned, link 18's sink decode, which now also gives the pin it verified, and checks the case's stage 0, capability, fallback, tier and pin against it; a refusal carries the decode's code. The tools' limits are stated once: staged::TOOL_DEFAULT_LIMIT (four figures, each with its reason) and TOOL_DEFAULT_CHAIN_BUDGET. wai stage apply/base and wai_stage_measure eval take --limit OUT,SYMBOLS,WORKING,MACS. The replay runs under the title's chain budget and the same limit on each layer, and hands each stage over as it is reached instead of keeping every stage of every unit; quality pools units one at a time. The staged generator reads tier, fallback and pin from the sink's decode. Refusal titles: a base past its chain budget, the 64 MiB and 1 GiB declared clips (refused before anything is allocated, shown by a counting allocator) and two inert envelopes; measure_verify.py refuses each by its own checks. goldens.json and sim/results.json regenerate byte for byte. Co-Authored-By: Claude Opus 5.5 <[email protected]>
Merge link 18 (wai/land-18-staged-browser, PR #152) into the W5 measurement branch
Staged delivery in the browser, the bounded base decode (staged::decode_base), a base writer, a trace and wai_stage_bench. Both CHANGELOG sections are kept. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: the sidecar rule names telemetry-conformance, which holds no decoded output
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: the delivery-telemetry extension, its corpus README, the MoQ line and a dated addendum
extensions/delivery-telemetry.md: the observation, its CMCD version 2 mapping and header shards, custom keys carrying Strings, switch reasons, CMSD, session metrics, privacy and conformance. Cohort assignment and capable share stay out of this revision. moq-streaming-format §5 states that telemetry never restates the per-object property's figure; energy-exposure-mapping gains a dated addendum, its text otherwise unchanged. Co-Authored-By: Claude Opus 5.5 <[email protected]>
ci(wai): delivery telemetry in the conformance matrix
The build, library tests and corpus loops take telemetry; it builds alone and for wasm32; the corpus loop verifies telemetry-conformance/ with wai_telemetry; a job runs the differential against the independent CMCD and CMSD library from its lock. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: keep the telemetry integer bound out of the C header
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: wai_telemetry and telemetry-conformance, with a differential against an independent library
The corpus: observations of every event kind with their expected CMCD reports and header shards, observations every reader refuses, CMSD-Static and CMSD-Dynamic descriptions, and session logs with their metrics. wai_telemetry verify reads the inputs from disk, recomputes every expected file and requires it byte for byte. cml/differential.mjs builds each report from the extension's tables, encodes it with an independent open-source CMCD and CMSD library at locked versions, requires the same bytes, reads the expected strings back as dictionary, query and header shards, and validates every report with no error. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: telemetry, delivery observations as CMCD v2 and CMSD
delivery-telemetry §2–§7: an observation read strictly (exact members, null where they do not apply, per-event rules, response keys never on a request), its CMCD version 2 report (Request mode for requests, Event mode otherwise with e=rr for responses, e=ps play states, e=ce custom events), header shards, custom keys under science.transaction.wai- carrying Strings, CMSD-Static and CMSD-Dynamic for a WAI object, and session metrics from one session's log. The RFC 9651 subset the reports use is implemented here, with no dependency. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: staged-measurement §10 and Appendix B; sim_verify.py in CI
§10: simulated figures, delivery timeouts by carriage (a datagram dropped, a subgroup reset with its tail), the layer cap, and the stall bound S_link + S_decode, checked rather than proven, with counter-plans. Appendix B: the model, the plan, the sender boundary by boundary, the sink's workers and deadlines, the outputs and the corpus's claims. The independent-verifiers job runs sim_verify.py. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: a windowed timeout case, where a subgroup reset takes a tail not yet due
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: the simulator corpus, wai_stage_measure sim, and sim_verify.py
staged-measure-conformance/sim/: a synthetic model (three groups of five units, a base and two layers per unit), the fixtures' models, and plans over both carriages, a slow link with timeouts, a layer cap, live playout with late refinements discarded or presented, and a counter-plan for each unbounded part of §10.4's bound. results.json pins every simulated figure; verify checks each case's claim (within the bound, or past a bounded plan's). sim_verify.py is an independent implementation of Appendix B that reproduces every result and requires a counter-case for each unbounded part. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: stage_measure::sim, the staged delivery simulator
staged-measurement §10 and Appendix B: a model of a title's objects (base, layer, units, counted bytes, capture time) and a wai-sim/1 plan (link, sender schedule, carriage, layer cap, delivery timeouts, VOD window; sink workers, decode order and times, playout deadlines). Datagrams not started by their deadline are dropped; a subgroup not fully sent by an object's deadline is reset, its sent bytes abandoned and the rest dropped. Bytes are conserved; capped objects are never sent or offered. The stall bound S_link + S_decode is checked on generated plans, and a counter-plan for each unbounded part shows the stall passing it. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: the staged-measurement extension, the corpus README and the CHANGELOG
extensions/staged-measurement.md §1–§9, §11–§13 and Appendices A, C and D: the byte rule and the formats it counts, integer quality per prefix, first presentable, layering overhead, decode time, energy, deduplication, records, what CI asserts, the media-class matrix, the output tree and measured titles. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: the sidecar rule names staged-measure-conformance's digests
Each fixture's expect.json and goldens.json state the SHA-256 of every unit's output at every stage, so the corpus carries no sha256.json. Co-Authored-By: Claude Opus 5.5 <[email protected]>
ci(wai): staged measurement in the conformance matrix
The build, library tests and corpus loops take stage_measure; the fast-kernel steps (debug and release) run tests/stage_measure.rs; stage_measure builds alone and for wasm32 (the guard that it pulls nothing a browser cannot run); the corpus loop verifies staged-measure-conformance/ with wai_stage_measure, and the independent-verifiers job runs measure_verify.py. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: measure_verify.py, the staged-measure corpus's second implementation
Python standard library only, sharing no code with wai-rs: the byte rule, every layer applied in order from each base's stage 0, the integer quality (luma, SSE, the Q32 structural similarity, PCM and tensor sums), the output tree, prefixes, first presentable, overhead points, dedup and the content identity. It requires its own decode to equal the fixture tool's reconstruction and its evaluation to equal goldens.json. BLAKE3, the WAI1 reader, refines and WIR1 come from the other corpora's verifiers, written from their specifications. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: stage_measure test — base64 and another capability's format are not countable
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: stage_measure, wai_stage_measure and the staged-measure corpus
A title is a staged set over a base the staged-delivery corpus already holds, decoded through its pinned parameter set (int_payload::resolve, pin::verify_bytes), its layers applied by staged::StageSink; title.json adds only the unit duration, capture times, source, single-layer references and the fixture tool's own digests. The evaluation: counted bytes per object, stage and prefix; integer quality per presentation and per prefix, against the source and the final prefix; first presentable; the layering overhead's rate-quality points; dedup; the output tree. wai_stage_measure eval / verify / generate-goldens / gen-fixtures. verify regenerates every fixture in memory, checks each evaluation against the encoder's own reconstruction and requires goldens.json byte for byte. Four fixtures: a picture (up2 then identity), a clip (a layer per frame), audio (a rate layer) and a splat attribute tensor. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: measure_framing, the counted bytes of an object
staged-measurement §3: a WAI1 is 12 + man_len + P and a WAI2 8 + man_len + 2 + 8n + Σ P, the envelope to the byte; trailing bytes are refused. A payload counts only in its capability's registered format: the pinned binary formats (WIV1, WIH1, WIA1, WIS1, WIR1) by the parse a sink runs, which refuses their JSON forms; a JSON text is never counted; an encrypted payload is not countable. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: the output tree, and the stage_measure feature
staged-measurement Appendix C: a leaf per (unit, layers) over SHA-256 with its own domains, RFC 6962's tree hash (no duplicated leaf, so a leaf list has one root), audit paths, and their check as RFC 9162 §2.1.3.2 states it. Roots for 1–9 leaves are an independent reference's. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: bench_env, the machine record a measurement states
The CPU, cores (with performance levels where the OS reports them), OS, arch, build profile, load averages and power source, as the OS reports them; native only. wai_decode_bench's machine and load lines now come from it, unchanged. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: quality, staged-measurement §4 in integers
SSE over RGB and luma, an integer BT.601 luma, a Q32 structural similarity over clipped 8×8 windows at stride 4 (bounded in i128, the bound proved in the module doc), PCM and tensor sums, and pooling over several units. Decibels are display functions, the only float arithmetic in the module (clippy denies the rest). The literals in the tests are computed by an independent Python reference. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: content_dedup, the one dedup computation; the package's figures go through it
staged-measurement §9: objects, distinct contents, referenced and stored bytes, recomputed from the objects. A content hash given two lengths has no accounting. wai_video_package::dedup_stats calls it; a well-formed map seals the same bytes, and a map with one hash at two lengths now fails verify. Co-Authored-By: Claude Opus 5.5 <[email protected]>