D2c M5: wai.neural.int_mlicpp decodes through wai-ops/1 (wmb1/1), goldens unchanged; the direct guard leaves production #273

Merged

dcharlot merged 26 commits from wai/d2c-m5 into main 2026-10-16 02:19:23 -04:00

Conversation 0 Commits 26 Files changed 40 +3628 -380

dcharlot commented 2026-10-15 23:16:43 -04:00

Owner

Copy link

D2c M5: wai.neural.int_mlicpp (the WIM1 payload, the WMB1 bundle) decodes through the integer operator set wai-ops/1, lowered by wmb1/1, with every golden unchanged.

Stacked on #271 (wai/bounds-pass-speed, still open): this branch starts from it and uses its loaded-network path (whm1_net_loaded). Until #271 merges, this PR's diff also shows #271's commits. origin/main (#270, outside wai/) is merged in.

What changes

• The decode. int_mlicpp::decode, and so int_payload::decode_int, the neural sink and every sink that decodes through them, now runs the bundle's three networks through their lowering wmb1/1 (integer-operators §13.4): h_s, entropy, then g_s with the RGB8 step, each by whm1/1, loaded under acc64 with its certificate. The driver keeps integer-payloads §14's order:
  1. the header, the z tables and each network's layer geometry (the direct decode's checks, unchanged);
  2. the three networks lowered and loaded (the store of loaded sets answers this step when it holds the bundle, keyed by the SHA-256 of model.wmb);
  3. each graph planned on the payload's shapes (ops::fit: input channels, caps, output shape);
  4. the z stream, h_s's graph, then for each slice and pass the entropy graph on concat(y, hyper) with y 0 where not yet decoded, the σ/μ split, the bucket and the symbol; then g_s's graph.
• The stage steps are shared by the decode through the lowering and the direct decode (int_mlicpp::check, hyper_latent, latent), and keep t2, lenient and final_only (O7): a symbol decoded after a stream ran out is still decoded and fed to the passes after it, and the refusal comes at the end.
• The direct decode is int_mlicpp::legacy, test-only (legacy_int).
• Gate 7. No production decode calls the direct guard any more. run_net_checked, check_layer and igdn_check move into the test-only int_hyper_synth::legacy, beside the direct decodes that call them. run_net and decode (the world renderer's unchecked path) stay for M6.
• Registry: ops member {acc64, full, wmb1/1, rans64 t2/lenient/final_only, bucket ceil}; registry/capabilities.json regenerated.
• Text:
  • SPEC §5 cites integer-payloads §14 and integer-operators §13.4; SPEC §7 names the capability; SPEC §8 lists its planned breaks.
  • integer-payloads §14 describes the decode through wmb1/1 and states the refusal codes the decoder reports: payload_malformed for the payload, its streams and its values, and model_mismatch for a bundle that breaks its rules or does not fit the payload. The section said every refusal was payload_malformed; the decoder has reported model_mismatch for its bundle since it was registered, and its tests pin that.
  • integer-operators §4, the status note and §15.3 item 3.
  • CHANGELOG.

Planned breaks (integer-operators §15.3 item 3, SPEC §8)

Each is refused model_mismatch before either stream. No committed bundle or payload is affected (the scan below).

• The other WHM1 decoders' rules, now for any of the three networks: a bias of magnitude 2^63 − 1 or more; a check range its producer cannot meet; no layer of tag 0, 1 or 2; a header shift or gf of 128 or more that no layer uses.

• Four checks the direct decode made only when a network ran, now before the streams, with the same code:

  • a layer that does not fit the channels before it;
  • a network that does not read the payload's channel count;
  • a header shift or gf of 128 or more that a layer uses;
  • a leaky ReLU's shift of 64 or more.

  Where a stream or a value was refused first, the bundle now is.

• A convolution whose padded side exceeds 2^26, which the operator set's run-time plan caps (§4, §5.2) and the direct decode's geometry did not.

Gates, each red once and restored

gate	commit	falsification	red
1 lowering and certificates	950cf1c9	entropy lowered with the RGB8 step	int_mlicpp_ops: the lowering differs from the committed entropy.whg1
2 golden equality	8dfaec11	rq floor → half_up in whm1/1	int_mlicpp_ops (graph bytes; "differs from the direct decode"); byte-exact int_mlicpp_through_its_lowering_is_golden. The file-based golden stays green before the switch
2		igdn sums first, then shifts once	the int_mlicpp set survives, under both kernel policies; the audio goldens carry this row, as the test plan predicts
3 refusal parity, ops member	f67f4818, ba9a0b2b, 48286590	X_ℓ + 1 as the check bound	edge test: "h_s layer 0: 45057997248925 runs directly: accumulation could leave i64"; gate 1's bytes
3, the M5 trap		y not yet decoded given one unit in place of 0	tests/int_mlicpp.rs 7 of 9, both byte-exact goldens, the in-crate round trip
4 differential	01753591, eb174546, 3e40a9f7	fit compares the image's sides swapped (only non-square images reach it)	gates 1–3 green; the differential red at seed 10650996203055661144
5 fast kernels	fad44132	channel-0 requantisation on the fast path	7 int_ops equivalence tests, 5 of int_mlicpp_ops
6 the switch	1d6f1488	rq floor → half_up	now also the file-based goldens: tests/int_mlicpp, the conformance vector, both neural-dispatch tests, both byte-exact goldens
6 memory		the decode keeps every pass's σ‖μ	int_payload_cost: "held 341192; the direct decode held 295424"
7 delete	ce755f2f, bad6baa5	the test-only guard ignores its value checks	the production decode stays green; the parity tests and the guard's own unit tests go red

Gate 3's end-rule test cuts the committed y stream at every length. Every cut decodes to the last symbol both ways and is refused at the end.

Differential (tests/int_ops_differential.rs)

There was no disagreement in any run. Under a planned break the decode through the operator set refused every time.

run	cases	decoded alike
per push, debug and release	3,000	454
timed 300 s, seed 20261015, debug	71,885	10,897
timed 300 s, seed 20261015, release	2,901,822	440,415

• Coverage. Every refusal path both decodes share was reached: each network's ranges, both streams, the header, the shapes, and a y value past i64.
• Breaks reached at random: six kinds. The other three (a layer that does not fit the channels before it, a network that does not read the payload's channel count, and the padded side) are shown, with the rest, on hand-made bundles in int_mlicpp_planned_breaks_are_new_refusals.
• The bounds-pass oracle test now also covers the three networks: 3,000 cases, 20,488 graphs, no disagreement.

Memory

WIM1 declares no cost (integer-payloads §7), so the decode is held to the direct decode it replaces (tests/int_payload_cost.rs, reference kernels).

• With the three networks loaded beforehand, the decode through the lowering holds 275,464 bytes. The direct decode holds 295,424.
• Through the sink, the decode with the store off holds 573,084 bytes, and so does the decode that loads the bundle into the store. The decode that finds the bundle held holds 425,848 bytes.
• The store holds 147,236 bytes for the bundle and counts 151,332.

Timings

The timing harness is scratch and not committed. Release builds, host load 52–68, 9 calls per figure, 3 rounds; every call gave the direct decode's image. Times are medians, in ms.

set	load the 3 networks	direct decode	decode_int, store off	decode_int, set held
vector 7ef44f3b, 64×64	0.16–0.49	0.66–1.64	1.11–1.45	0.92–2.23 (min 0.91)
synthetic 07e1835d, 32×32, payload coded by the harness	0.04	0.07–0.13	0.18	0.13

Checks

• gate.sh on the merged head: GREEN.
• Also run: the release fast-kernel step, int_payload_cost in both profiles, the pretrained-set step (no skip banner), neural_native_decode, neural_cost_limit and ffi_neural_pin, registry export --check, cargo check --lib with each integer feature alone, wai-ops in debug and release, wai-verify and vectors verify, wai_ops_check.py, and wai-web native and wasm32 (wasm-bindgen 0.2.127). Under Node: verify_int_payload_wasm, verify_int_synth_wasm, verify_int_hyper_wasm and verify_staged_wasm.
• Local, all exit 0: comparative prose, vanity metrics, public names, section refs, tests in CI, lockfiles (38 current), orphan sources, workflow concurrency, and the PR path self-test.
• No tracked file changed after any build. include/wai.h is untouched.

Left for M6

• run_net and decode, the world renderer's unchecked path (int_world, wai-web's int_world.rs).
• With them, int_hyper_synth::kernel_equivalence and the convolution dispatch run_net uses.

🤖 Generated with Claude Code

D2c M5: `wai.neural.int_mlicpp` (the `WIM1` payload, the `WMB1` bundle) decodes through the integer operator set `wai-ops/1`, lowered by `wmb1/1`, with every golden unchanged. **Stacked on #271** (`wai/bounds-pass-speed`, still open): this branch starts from it and uses its loaded-network path (`whm1_net_loaded`). Until #271 merges, this PR's diff also shows #271's commits. `origin/main` (#270, outside `wai/`) is merged in. ## What changes - **The decode.** `int_mlicpp::decode`, and so `int_payload::decode_int`, the neural sink and every sink that decodes through them, now runs the bundle's three networks through their lowering `wmb1/1` (integer-operators §13.4): `h_s`, `entropy`, then `g_s` with the RGB8 step, each by `whm1/1`, loaded under `acc64` with its certificate. The driver keeps integer-payloads §14's order: 1. the header, the `z` tables and each network's layer geometry (the direct decode's checks, unchanged); 2. the three networks lowered and loaded (the store of loaded sets answers this step when it holds the bundle, keyed by the SHA-256 of `model.wmb`); 3. each graph planned on the payload's shapes (`ops::fit`: input channels, caps, output shape); 4. the `z` stream, `h_s`'s graph, then for each slice and pass the entropy graph on `concat(y, hyper)` with `y` 0 where not yet decoded, the σ/μ split, the bucket and the symbol; then `g_s`'s graph. - **The stage steps are shared** by the decode through the lowering and the direct decode (`int_mlicpp::check`, `hyper_latent`, `latent`), and keep `t2`, `lenient` and `final_only` (O7): a symbol decoded after a stream ran out is still decoded and fed to the passes after it, and the refusal comes at the end. - **The direct decode** is `int_mlicpp::legacy`, test-only (`legacy_int`). - **Gate 7.** No production decode calls the direct guard any more. `run_net_checked`, `check_layer` and `igdn_check` move into the test-only `int_hyper_synth::legacy`, beside the direct decodes that call them. `run_net` and `decode` (the world renderer's unchecked path) stay for M6. - **Registry:** `ops` member `{acc64, full, wmb1/1, rans64 t2/lenient/final_only, bucket ceil}`; `registry/capabilities.json` regenerated. - **Text:** - SPEC §5 cites integer-payloads §14 and integer-operators §13.4; SPEC §7 names the capability; SPEC §8 lists its planned breaks. - integer-payloads §14 describes the decode through `wmb1/1` and states the refusal codes the decoder reports: `payload_malformed` for the payload, its streams and its values, and `model_mismatch` for a bundle that breaks its rules or does not fit the payload. The section said every refusal was `payload_malformed`; the decoder has reported `model_mismatch` for its bundle since it was registered, and its tests pin that. - integer-operators §4, the status note and §15.3 item 3. - CHANGELOG. ## Planned breaks (integer-operators §15.3 item 3, SPEC §8) Each is refused `model_mismatch` before either stream. No committed bundle or payload is affected (the scan below). - **The other `WHM1` decoders' rules, now for any of the three networks:** a bias of magnitude `2^63 − 1` or more; a `check` range its producer cannot meet; no layer of tag 0, 1 or 2; a header `shift` or `gf` of 128 or more that no layer uses. - **Four checks the direct decode made only when a network ran, now before the streams, with the same code:** - a layer that does not fit the channels before it; - a network that does not read the payload's channel count; - a header `shift` or `gf` of 128 or more that a layer uses; - a leaky ReLU's shift of 64 or more. Where a stream or a value was refused first, the bundle now is. - **A convolution whose padded side exceeds `2^26`,** which the operator set's run-time plan caps (§4, §5.2) and the direct decode's geometry did not. ## Gates, each red once and restored | gate | commit | falsification | red | |---|---|---|---| | 1 lowering and certificates | `950cf1c9` | `entropy` lowered with the RGB8 step | `int_mlicpp_ops`: the lowering differs from the committed `entropy.whg1` | | 2 golden equality | `8dfaec11` | `rq` floor → half_up in `whm1/1` | `int_mlicpp_ops` (graph bytes; "differs from the direct decode"); byte-exact `int_mlicpp_through_its_lowering_is_golden`. The file-based golden stays green before the switch | | 2 | | `igdn` sums first, then shifts once | the `int_mlicpp` set survives, under both kernel policies; the audio goldens carry this row, as the test plan predicts | | 3 refusal parity, `ops` member | `f67f4818`, `ba9a0b2b`, `48286590` | `X_ℓ + 1` as the check bound | edge test: "h_s layer 0: 45057997248925 runs directly: accumulation could leave i64"; gate 1's bytes | | 3, the M5 trap | | `y` not yet decoded given one unit in place of 0 | `tests/int_mlicpp.rs` 7 of 9, both byte-exact goldens, the in-crate round trip | | 4 differential | `01753591`, `eb174546`, `3e40a9f7` | `fit` compares the image's sides swapped (only non-square images reach it) | gates 1–3 green; the differential red at seed 10650996203055661144 | | 5 fast kernels | `fad44132` | channel-0 requantisation on the fast path | 7 `int_ops` equivalence tests, 5 of `int_mlicpp_ops` | | 6 the switch | `1d6f1488` | `rq` floor → half_up | now also the file-based goldens: `tests/int_mlicpp`, the conformance vector, both neural-dispatch tests, both byte-exact goldens | | 6 memory | | the decode keeps every pass's σ‖μ | `int_payload_cost`: "held 341192; the direct decode held 295424" | | 7 delete | `ce755f2f`, `bad6baa5` | the test-only guard ignores its value checks | the production decode stays green; the parity tests and the guard's own unit tests go red | Gate 3's end-rule test cuts the committed `y` stream at every length. Every cut decodes to the last symbol both ways and is refused at the end. ## Differential (`tests/int_ops_differential.rs`) There was no disagreement in any run. Under a planned break the decode through the operator set refused every time. | run | cases | decoded alike | |---|---|---| | per push, debug and release | 3,000 | 454 | | timed 300 s, seed 20261015, debug | 71,885 | 10,897 | | timed 300 s, seed 20261015, release | 2,901,822 | 440,415 | - **Coverage.** Every refusal path both decodes share was reached: each network's ranges, both streams, the header, the shapes, and a `y` value past `i64`. - **Breaks reached at random:** six kinds. The other three (a layer that does not fit the channels before it, a network that does not read the payload's channel count, and the padded side) are shown, with the rest, on hand-made bundles in `int_mlicpp_planned_breaks_are_new_refusals`. - **The bounds-pass oracle test** now also covers the three networks: 3,000 cases, 20,488 graphs, no disagreement. ## Memory `WIM1` declares no cost (integer-payloads §7), so the decode is held to the direct decode it replaces (`tests/int_payload_cost.rs`, reference kernels). - **With the three networks loaded beforehand,** the decode through the lowering holds 275,464 bytes. The direct decode holds 295,424. - **Through the sink,** the decode with the store off holds 573,084 bytes, and so does the decode that loads the bundle into the store. The decode that finds the bundle held holds 425,848 bytes. - **The store** holds 147,236 bytes for the bundle and counts 151,332. ## Timings The timing harness is scratch and not committed. Release builds, host load 52–68, 9 calls per figure, 3 rounds; every call gave the direct decode's image. Times are medians, in ms. | set | load the 3 networks | direct decode | decode_int, store off | decode_int, set held | |---|---|---|---|---| | vector `7ef44f3b`, 64×64 | 0.16–0.49 | 0.66–1.64 | 1.11–1.45 | 0.92–2.23 (min 0.91) | | synthetic `07e1835d`, 32×32, payload coded by the harness | 0.04 | 0.07–0.13 | 0.18 | 0.13 | ## Checks - **`gate.sh` on the merged head:** GREEN. - **Also run:** the release fast-kernel step, `int_payload_cost` in both profiles, the pretrained-set step (no skip banner), `neural_native_decode`, `neural_cost_limit` and `ffi_neural_pin`, `registry export --check`, `cargo check --lib` with each integer feature alone, wai-ops in debug and release, `wai-verify` and `vectors verify`, `wai_ops_check.py`, and wai-web native and wasm32 (wasm-bindgen 0.2.127). Under Node: `verify_int_payload_wasm`, `verify_int_synth_wasm`, `verify_int_hyper_wasm` and `verify_staged_wasm`. - **Local, all exit 0:** comparative prose, vanity metrics, public names, section refs, tests in CI, lockfiles (38 current), orphan sources, workflow concurrency, and the PR path self-test. - **No tracked file changed after any build.** `include/wai.h` is untouched. ## Left for M6 - `run_net` and `decode`, the world renderer's unchecked path (`int_world`, wai-web's `int_world.rs`). - With them, `int_hyper_synth::kernel_equivalence` and the convolution dispatch `run_net` uses. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dcharlot added 26 commits 2026-10-15 23:16:44 -04:00

wai-ops: the bounds pass in closed form for conv, conv_transpose and igdn (WIP, committed before the first build) ... 8356268251

Each convolution's term hull and partial-sum interval come from four sums per
output channel (least and greatest weight, sum of the positive and of the
negative weights; per residue for conv_transpose), and each igdn row folds in
i128, wherever no operation of the rule's fold can saturate; elsewhere the
rule folds tap by tap as before. The pass before this change is kept,
test-only (feature `oracle` for other crates), as bounds_oracle, with a
differential over the committed graphs, the pretrained set when present, and
random and adversarial operators and graphs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-ops: the oracle test's floor on committed vector graphs is the 81 that parse and plan ... db3be852c4

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-ops: the lowering's largest magnitude in u64, and the WHG1 writer in place ... e1d08aea0f

maxabs finds the largest |x| over u64 and widens it once, rather than forming
an I512 per weight. The writer reserves each integer list and writes the usual
widths as the unsigned integer of that width (the same low bytes), and writes
each operator's parameters in place after their length, rather than into a
second vector copied after. Same bytes; a unit test holds each width to the
low bytes it wrote before.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-ops, wai-rs: a lowered network loads without a second write and parse of its graph ... aa328ffccb

Builder::finish already writes the graph's bytes, parses them back to an equal
graph and plans it; it now returns that parsed graph, the one graph::load of
those bytes holds. graph::load_lowered (crate-only) makes load steps 7 and 8
on it, so whm1_net_loaded and wam1_net_loaded give load's result, refusal for
refusal, without writing and parsing the bytes a second time. The WHM1 and
WAM1 lowerings move each layer's lists into the graph instead of cloning them
(whm1_net and wam1_net, which borrow, clone the network once). The
int_hyper, splat and audio drivers load through them.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-rs: the random-set differential holds load step 8 to its oracle ... 365a3dfec9

Every graph the int_synth, splat, audio and int_hyper generators lower is
passed by wai_ops::bounds and by wai_ops::bounds_oracle (a dev-dependency with
the oracle feature): equal passes or the same refusal, and the same first
failure under each profile; every verdict is reached.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-ops: i64 sums where a bound shows they fit, one scan for a node's weight range, byte stores in the writer ... 5dba411d2d

The closed forms accumulate a tap set's sums in i64 when n·max|w| ≤ 2^63 − 1
(every partial sum then lies in i64), and in i128 otherwise. The pass finds a
node's weight range once, for w_bits and for the acc32 width condition (a list
fits i32 exactly when its least and greatest do). The WHG1 writer adds an
integer list's bytes at once and stores each byte, where a copy of a few bytes
is a call on wasm32.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-ops: the writer stores each value as one array; test tidying ... 66942062a1

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-rs: SHA-256 through the Arm SHA-2 instructions on 64-bit Arm (sha2 asm, not Windows, not wasm32) ... f56ffbc8f4

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: lockfiles of the seven workspaces that build wai-rs take sha2-asm 0.6.4 ... a95c371688

cargo update --workspace in each: sha2-asm added, nothing else moves.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: integer-operators §8.2 informative note on the closed form; CHANGELOG ... a31c1fd3ab

§8.6's note no longer says the bounds pass can cost more than a decode: the
lowering and the load read the whole set again, which is what a kept set
saves.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge remote-tracking branch 'origin/main' into wai/bounds-pass-speed ... eb6be888cb

main is #268 merged (f5dd8113), this branch's base; the tree does not change.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge remote-tracking branch 'origin/main' into wai/bounds-pass-speed ... cbc3f973f9

main now has wai-quantum 0.6.0 (#266). CHANGELOG: both sides kept, this
branch's section first. The lockfiles merged with sha2-asm as their only
difference from main.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge remote-tracking branch 'origin/main' into wai/bounds-pass-speed ... 2a616ff368

main now has #269 (openpay only); nothing under wai/ changes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_mlicpp gate 1: the bundle's lowering and certificates, as wai-rs loads them ... 950cf1c959

int_mlicpp::ops::{lower, load, Nets}: the three WHM1 networks of a WMB1 bundle lowered by
whm1/1 (h_s, entropy, then g_s with the RGB8 step; wmb1/1, integer-operators §13.4) from
the networks this crate parses (int_ops::whm1_net), and loaded under acc64 with
whm1_net_loaded. tests/int_mlicpp_ops.rs: every committed set lowers to its committed
graphs from its bytes and from the parsed networks, the certificate is those graphs',
and the load gives its verdict (acc64, not acc32; first acc32 failure h_s's input
range, 47 bits for the vector's set as Appendix C predicts, 54 for the synthetic one).
Named in both fast-kernel steps of wai-conformance.yml.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_mlicpp gate 2: the bundle decodes through wmb1/1 to its goldens ... 8dfaec1147

The decode's stage steps (int_mlicpp::check, hyper_latent, latent: the header and the
networks' geometry, the z stream, the y stream's slices and passes with y 0 where not
yet decoded, t2/lenient/final_only) are shared by two decodes: int_mlicpp::legacy, the
direct decode (run_net_checked per network, to_rgb8), unchanged, and int_mlicpp::ops,
through the integer operator set: check, then the three networks lowered and loaded
(load), then each graph's run-time plan on the payload's shapes (fit), then
decode_loaded (h_s's graph; the entropy graph before every pass, its output split into
sigma and mu by the driver; g_s's graph with the RGB8 step). int_mlicpp::decode still
calls the direct decode (the switch is gate 6).

Goldens: tests/int_mlicpp_ops.rs, the committed vector (both envelopes) through the
lowering equals the direct decode, bucket for bucket, symbol for symbol and byte for
byte, and every digest in expected.json; byte-exact-conformance
int_mlicpp_through_its_lowering_is_golden, under the reference and the fast kernels.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_mlicpp gate 3 (WIP: committed before running): refusal parity, the ops member, SPEC citations ... f67f4818b5

tests/int_mlicpp_ops.rs:
  (b) 21 fixtures, one per refusal the direct decode makes in integer-payloads §14's
      order, each one change from the committed bundle or payload (the header; the
      bundle against it: z tables, each network's shape, the cap; each stream: too
      short, a value past i64, run out; each network's ranges); both decodes refuse
      each with the same code and read the same symbols before it; then the sink's
      codes for a payload that is not one (payload_malformed) and a bundle that is not
      one (model_mismatch);
  the end rule final_only: the y stream cut short by 4 to 64 bytes is decoded alike
      both ways; where it runs out, every symbol after is still decoded and fed to the
      passes after it, and the refusal comes at the end; the z stream likewise;
  (c) the edge of every check range of the committed h_s, entropy and g_s (ten
      layers; a ReLU reads none): at +-X_l both run alike, at +-(X_l + 1) both refuse.
codecs::capability_ops: wai.neural.int_mlicpp = {acc64, full, wmb1/1, rans64
t2/lenient/final_only, bucket ceil}; the registry test lists six capabilities. SPEC
§5's row cites integer-payloads §14 and integer-operators §13.4; SPEC §7 names it.
CHANGELOG section started.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_mlicpp gate 3: the registry export ... ba9a0b2b13

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_mlicpp gate 3: the entropy fixture gives 4 channels; the end-rule test cuts the y stream at every length ... 482865908c

The committed entropy network's first convolution already gives 2·Cy channels, so the
fixture that dropped its last layer still fit; it now ends with a 1x1 convolution to 4.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_mlicpp gate 4 (WIP: committed before running): the differential's int_mlicpp half ... 0175359167

tests/int_ops_differential.rs: random WMB1 bundles (h_s, an entropy network that keeps
the size, g_s, the tables) and WIM1 payloads whose y stream is coded in the decode's
order against the buckets the direct networks give; each case through int_mlicpp::ops
and int_mlicpp::legacy: outside the planned breaks the same y symbols and the same
image, or the same code at the same check; under a planned break the decode through
the operator set refuses (model_mismatch). The classifier reads the bundle and the
payload's header: the other WHM1 decoders' breaks (load_break), and the rules the direct
decode makes only when a network runs (a layer that does not fit the channels before
it, a shift or gf of 128 or more that a layer uses, a leaky shift of 64 or more, a
network whose input is not the payload's channel count), and a convolution's padded
side past 2^26, which the operator set's run-time plan caps. Each break is shown on a
hand-made bundle. The bounds-pass oracle test also covers the three networks. The
nightly workflow names the decoder.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_mlicpp gate 4: the generator perturbs less often, so more cases decode ... eb174546ad

The first run (3000 cases, seed 3372) found no disagreement, but only 94 cases decoded:
the bundle, header and shape perturbations each refused a share of cases alike before
any stream. They are now one in 32 or 64, and the entropy network's optional layers
all keep the size.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_mlicpp gate 4: the generator keeps more values inside the networks' ranges ... 3e40a9f799

Second run (3000 cases): 170 decoded, no disagreement. The refusals were mostly
hyper-latents placed at h_s's range, extreme medians and values past the entropy
network's range. Now: a channel at h_s's range one case in eight, medians at an extreme
one in sixteen, header shifts 12 to 23, and the entropy layers' weights, multipliers and
extreme biases drawn smaller or rarer. The shared layer generators are unchanged.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_mlicpp gate 5 (WIP: committed before running): the fast kernels behind the interpreter, held to it ... fad4413269

int_ops::equivalence::the_mlicpp_networks_run_on_the_fast_kernels: the committed vector
through wmb1/1 under every fast policy runs every convolution and transposed convolution
of its three graphs, each time it runs (the entropy network before each of the 2K
passes), and g_s's inverse GDNs on the fast kernels (counted), with the interpreter's
buckets, symbols and bytes. tests/int_mlicpp_ops.rs every_kernel_policy_...: reference
and fast(1|2|5|0) alike on both envelopes, a y stream cut short, and hyper-latent channel
0 at h_s's range and one past it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_mlicpp gate 6 (WIP: committed before running): the switch ... 1d6f14881e

int_mlicpp::decode and decode_traced = ops::decode(_traced); int_mlicpp::legacy (the
direct decode) behind cfg(any(test, feature = "legacy_int")), and run_net_checked and
to_rgb8 imported only there. int_payload::decode_int's WIM1 branch: the bundle parsed,
ops::check, the three networks from the store of loaded sets (key: capability, wmb1/1,
acc64, the SHA-256 of model.wmb's listing) or ops::load, ops::fit, ops::decode_loaded.
int_ops::WMB1; Resident for int_mlicpp::ops::Nets.

Tests: int_mlicpp_ops the_new_load_rules_affect_no_committed_set_or_payload (every
committed bundle meets the rules and loads; every committed WIM1 payload, in any file,
plans, decodes or is refused alike); int_payload_cost (now also legacy_int): with its
networks loaded the decode holds no more than the direct decode; through the sink the
decode that finds the bundle held holds less than the one that loads it, and keeps
nothing more; int_set_cache: the vector is kept and hit, one byte apart never shares an
entry, a refused bundle is never kept.

Text: integer-payloads §14 (the decode through wmb1/1, step 1's checks, and the codes
the decoder reports: payload_malformed for the payload, its streams and its values,
model_mismatch for a bundle that breaks its rules or does not fit); integer-operators
§4, the status note and §15.3 item 3; SPEC §8 planned breaks; CHANGELOG.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_mlicpp gate 7 (WIP: committed before running): the direct guard goes from production ... ce755f2fa9

int_mlicpp was run_net_checked's last production caller. run_net_checked, check_layer,
igdn_check and the values' failure constructor move into the test-only
int_hyper_synth::legacy (cfg(any(test, feature = "legacy_int"))), beside the direct
decodes that call them; the direct decodes of splat, audio and int_mlicpp, the guard's own
unit tests and the integration tests that hold the guard and the check ranges to each
other import them from there. Production docs that named the guard now name net_shape or
the lowering. run_net and decode (the world renderer's) stay for M6. The export tool's
note now names the check ranges. CHANGELOG.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_mlicpp gate 7: the splat direct decode's doc names the guard's new path ... bad6baa59c

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge remote-tracking branch 'origin/main' into wai/d2c-m5 ... 8d25140254

main now has #270 (sandbox only); nothing under wai/ changes. #271, which this branch
is stacked on, is not yet merged.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot merged commit 800350d0f7 into main 2026-10-16 02:19:23 -04:00

dcharlot referenced this pull request from a commit 2026-10-16 02:19:24 -04:00

Merge pull request 'D2c M5: wai.neural.int_mlicpp decodes through wai-ops/1 (wmb1/1), goldens unchanged; the direct guard leaves production' (#273) from wai/d2c-m5 into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Transaction-Science/open-standards!273

No description provided.