D2c M5: wai.neural.int_mlicpp decodes through wai-ops/1 (wmb1/1), goldens unchanged; the direct guard leaves production #273
2026-10-15
Merge remote-tracking branch 'origin/main' into wai/d2c-m5
All checks were successful
WAI HTTP delivery / HTTP corpus · falsify patches 0/3 (pull_request) Successful in 6m13s
WAI HTTP delivery / HTTP corpus · every patch and mutation in exactly one shard (pull_request) Successful in 4s
wai formal verification (integer core) / kani (plan) (pull_request) Successful in 6m38s
WAI HTTP delivery / HTTP corpus · verified both ways, and the differential (pull_request) Successful in 3m4s
WAI HTTP delivery / HTTP corpus · falsify patches 1/3 (pull_request) Successful in 7m23s
WAI HTTP delivery / cache rules · controls and labelled caches (pull_request) Successful in 1m18s
WAI HTTP delivery / HTTP corpus · falsify patches 2/3 (pull_request) Successful in 6m46s
wai-ops integer operators / linux-aarch64 (pull_request) Successful in 1m4s
wai-pack / wai-pack · the floor through a media prober (pull_request) Successful in 20s
wai-pack / wai-pack · linux-arm64 (pull_request) Successful in 1m28s
wai-pack / wai-pack · dependency licences (pull_request) Successful in 1m17s
wai-pack / wai-pack · independent verifier (Python) (pull_request) Successful in 4m16s
wai formal verification (integer core) / kani (sound) (pull_request) Successful in 11m19s
wai formal verification (integer core) / kani (stage) (pull_request) Successful in 2m57s
wai formal verification (integer core) / kani (isqrt512) (pull_request) Successful in 43m27s
wai formal verification (integer core) / kani (integer-core) (pull_request) Successful in 4m54s
WAI JPEG-AI whole decode (pinned inputs, required) / fetch pinned JPEG-AI inputs → whole decode + pixel hash, required (pull_request) Successful in 1m27s
WAI neural sink gates / model-free refusals of the neural sink (pull_request) Successful in 1m18s
wai formal verification (integer core) / kani (stage-long) (pull_request) Successful in 21m42s
wai-ops integer operators / wasm32-wasip2 (wasmtime) (pull_request) Successful in 29s
wai-ops integer operators / linux-x86_64 (pull_request) Successful in 49s
wai-ops integer operators / independent checker (Python) (pull_request) Successful in 13s
wai-ops integer operators / wasm32 under Node (pull_request) Successful in 20s
wai-pack / wai-pack · linux (pull_request) Successful in 1m26s
wai-quantum WebGPU member / shader checks · browser build · wasip2 inertness · MSRV (pull_request) Successful in 3m15s
wai-quantum WebGPU member / member · software Vulkan (linux) (pull_request) Successful in 2m4s
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Successful in 3m6s
WAI mbt2018_mean integer decode (regenerated vectors) / regenerate mbt2018_mean integer vectors → Rust decode, required (pull_request) Successful in 5m43s
wai-web reach builds / wai-web reach builds · the package of record, every output as recorded (pull_request) Successful in 2m51s
wai-web reach builds / wai-web reach builds · this tree's wai-web, every rung on its engine line (pull_request) Successful in 4m8s
main now has #270 (sandbox only); nothing under wai/ changes. #271, which this branch is stacked on, is not yet merged. Co-Authored-By: Claude Opus 5.5 <[email protected]>
int_mlicpp gate 7: the splat direct decode's doc names the guard's new path
Co-Authored-By: Claude Opus 5.5 <[email protected]>
int_mlicpp gate 7 (WIP: committed before running): the direct guard goes from production
int_mlicpp was run_net_checked's last production caller. run_net_checked, check_layer, igdn_check and the values' failure constructor move into the test-only int_hyper_synth::legacy (cfg(any(test, feature = "legacy_int"))), beside the direct decodes that call them; the direct decodes of splat, audio and int_mlicpp, the guard's own unit tests and the integration tests that hold the guard and the check ranges to each other import them from there. Production docs that named the guard now name net_shape or the lowering. run_net and decode (the world renderer's) stay for M6. The export tool's note now names the check ranges. CHANGELOG. Co-Authored-By: Claude Opus 5.5 <[email protected]>
int_mlicpp gate 6 (WIP: committed before running): the switch
int_mlicpp::decode and decode_traced = ops::decode(_traced); int_mlicpp::legacy (the direct decode) behind cfg(any(test, feature = "legacy_int")), and run_net_checked and to_rgb8 imported only there. int_payload::decode_int's WIM1 branch: the bundle parsed, ops::check, the three networks from the store of loaded sets (key: capability, wmb1/1, acc64, the SHA-256 of model.wmb's listing) or ops::load, ops::fit, ops::decode_loaded. int_ops::WMB1; Resident for int_mlicpp::ops::Nets. Tests: int_mlicpp_ops the_new_load_rules_affect_no_committed_set_or_payload (every committed bundle meets the rules and loads; every committed WIM1 payload, in any file, plans, decodes or is refused alike); int_payload_cost (now also legacy_int): with its networks loaded the decode holds no more than the direct decode; through the sink the decode that finds the bundle held holds less than the one that loads it, and keeps nothing more; int_set_cache: the vector is kept and hit, one byte apart never shares an entry, a refused bundle is never kept. Text: integer-payloads §14 (the decode through wmb1/1, step 1's checks, and the codes the decoder reports: payload_malformed for the payload, its streams and its values, model_mismatch for a bundle that breaks its rules or does not fit); integer-operators §4, the status note and §15.3 item 3; SPEC §8 planned breaks; CHANGELOG. Co-Authored-By: Claude Opus 5.5 <[email protected]>
int_mlicpp gate 5 (WIP: committed before running): the fast kernels behind the interpreter, held to it
int_ops::equivalence::the_mlicpp_networks_run_on_the_fast_kernels: the committed vector through wmb1/1 under every fast policy runs every convolution and transposed convolution of its three graphs, each time it runs (the entropy network before each of the 2K passes), and g_s's inverse GDNs on the fast kernels (counted), with the interpreter's buckets, symbols and bytes. tests/int_mlicpp_ops.rs every_kernel_policy_...: reference and fast(1|2|5|0) alike on both envelopes, a y stream cut short, and hyper-latent channel 0 at h_s's range and one past it. Co-Authored-By: Claude Opus 5.5 <[email protected]>
int_mlicpp gate 4: the generator keeps more values inside the networks' ranges
Second run (3000 cases): 170 decoded, no disagreement. The refusals were mostly hyper-latents placed at h_s's range, extreme medians and values past the entropy network's range. Now: a channel at h_s's range one case in eight, medians at an extreme one in sixteen, header shifts 12 to 23, and the entropy layers' weights, multipliers and extreme biases drawn smaller or rarer. The shared layer generators are unchanged. Co-Authored-By: Claude Opus 5.5 <[email protected]>
int_mlicpp gate 4: the generator perturbs less often, so more cases decode
The first run (3000 cases, seed 3372) found no disagreement, but only 94 cases decoded: the bundle, header and shape perturbations each refused a share of cases alike before any stream. They are now one in 32 or 64, and the entropy network's optional layers all keep the size. Co-Authored-By: Claude Opus 5.5 <[email protected]>
int_mlicpp gate 4 (WIP: committed before running): the differential's int_mlicpp half
tests/int_ops_differential.rs: random WMB1 bundles (h_s, an entropy network that keeps the size, g_s, the tables) and WIM1 payloads whose y stream is coded in the decode's order against the buckets the direct networks give; each case through int_mlicpp::ops and int_mlicpp::legacy: outside the planned breaks the same y symbols and the same image, or the same code at the same check; under a planned break the decode through the operator set refuses (model_mismatch). The classifier reads the bundle and the payload's header: the other WHM1 decoders' breaks (load_break), and the rules the direct decode makes only when a network runs (a layer that does not fit the channels before it, a shift or gf of 128 or more that a layer uses, a leaky shift of 64 or more, a network whose input is not the payload's channel count), and a convolution's padded side past 2^26, which the operator set's run-time plan caps. Each break is shown on a hand-made bundle. The bounds-pass oracle test also covers the three networks. The nightly workflow names the decoder. Co-Authored-By: Claude Opus 5.5 <[email protected]>
int_mlicpp gate 3: the entropy fixture gives 4 channels; the end-rule test cuts the y stream at every length
The committed entropy network's first convolution already gives 2·Cy channels, so the fixture that dropped its last layer still fit; it now ends with a 1x1 convolution to 4. Co-Authored-By: Claude Opus 5.5 <[email protected]>
int_mlicpp gate 3 (WIP: committed before running): refusal parity, the ops member, SPEC citations
tests/int_mlicpp_ops.rs:
(b) 21 fixtures, one per refusal the direct decode makes in integer-payloads §14's
order, each one change from the committed bundle or payload (the header; the
bundle against it: z tables, each network's shape, the cap; each stream: too
short, a value past i64, run out; each network's ranges); both decodes refuse
each with the same code and read the same symbols before it; then the sink's
codes for a payload that is not one (payload_malformed) and a bundle that is not
one (model_mismatch);
the end rule final_only: the y stream cut short by 4 to 64 bytes is decoded alike
both ways; where it runs out, every symbol after is still decoded and fed to the
passes after it, and the refusal comes at the end; the z stream likewise;
(c) the edge of every check range of the committed h_s, entropy and g_s (ten
layers; a ReLU reads none): at +-X_l both run alike, at +-(X_l + 1) both refuse.
codecs::capability_ops: wai.neural.int_mlicpp = {acc64, full, wmb1/1, rans64
t2/lenient/final_only, bucket ceil}; the registry test lists six capabilities. SPEC
§5's row cites integer-payloads §14 and integer-operators §13.4; SPEC §7 names it.
CHANGELOG section started.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
int_mlicpp gate 2: the bundle decodes through wmb1/1 to its goldens
The decode's stage steps (int_mlicpp::check, hyper_latent, latent: the header and the networks' geometry, the z stream, the y stream's slices and passes with y 0 where not yet decoded, t2/lenient/final_only) are shared by two decodes: int_mlicpp::legacy, the direct decode (run_net_checked per network, to_rgb8), unchanged, and int_mlicpp::ops, through the integer operator set: check, then the three networks lowered and loaded (load), then each graph's run-time plan on the payload's shapes (fit), then decode_loaded (h_s's graph; the entropy graph before every pass, its output split into sigma and mu by the driver; g_s's graph with the RGB8 step). int_mlicpp::decode still calls the direct decode (the switch is gate 6). Goldens: tests/int_mlicpp_ops.rs, the committed vector (both envelopes) through the lowering equals the direct decode, bucket for bucket, symbol for symbol and byte for byte, and every digest in expected.json; byte-exact-conformance int_mlicpp_through_its_lowering_is_golden, under the reference and the fast kernels. Co-Authored-By: Claude Opus 5.5 <[email protected]>
int_mlicpp gate 1: the bundle's lowering and certificates, as wai-rs loads them
int_mlicpp::ops::{lower, load, Nets}: the three WHM1 networks of a WMB1 bundle lowered by
whm1/1 (h_s, entropy, then g_s with the RGB8 step; wmb1/1, integer-operators §13.4) from
the networks this crate parses (int_ops::whm1_net), and loaded under acc64 with
whm1_net_loaded. tests/int_mlicpp_ops.rs: every committed set lowers to its committed
graphs from its bytes and from the parsed networks, the certificate is those graphs',
and the load gives its verdict (acc64, not acc32; first acc32 failure h_s's input
range, 47 bits for the vector's set as Appendix C predicts, 54 for the synthetic one).
Named in both fast-kernel steps of wai-conformance.yml.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Merge remote-tracking branch 'origin/main' into wai/bounds-pass-speed
Some checks failed
wai formal verification (integer core) / kani (plan) (pull_request) Has been cancelled
wai formal verification (integer core) / kani (sound) (pull_request) Has been cancelled
wai formal verification (integer core) / kani (stage) (pull_request) Has been cancelled
wai formal verification (integer core) / kani (rans64-t2) (pull_request) Has been cancelled
wai formal verification (integer core) / kani (stage-long) (pull_request) Has been cancelled
wai formal verification (integer core) / kani (integer-core) (pull_request) Has been cancelled
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
WAI conformance / does this change touch it (pull_request) Has been cancelled
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
wai cross-architecture byte-equality / does this change touch it (pull_request) Has been cancelled
wai cross-architecture byte-equality / linux-aarch64 (pull_request) Has been cancelled
wai cross-architecture byte-equality / linux-x86_64 (pull_request) Has been cancelled
wai cross-architecture byte-equality / macos-arm64 (reference) (pull_request) Has been cancelled
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
repository checks / lockfiles, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
main now has #269 (openpay only); nothing under wai/ changes. Co-Authored-By: Claude Opus 5.5 <[email protected]>
Merge remote-tracking branch 'origin/main' into wai/bounds-pass-speed
main now has wai-quantum 0.6.0 (#266). CHANGELOG: both sides kept, this branch's section first. The lockfiles merged with sha2-asm as their only difference from main. Co-Authored-By: Claude Opus 5.5 <[email protected]>
Merge remote-tracking branch 'origin/main' into wai/bounds-pass-speed
main is #268 merged (f5dd8113), this branch's base; the tree does not change.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: integer-operators §8.2 informative note on the closed form; CHANGELOG
§8.6's note no longer says the bounds pass can cost more than a decode: the lowering and the load read the whole set again, which is what a kept set saves. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: lockfiles of the seven workspaces that build wai-rs take sha2-asm 0.6.4
cargo update --workspace in each: sha2-asm added, nothing else moves. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-rs: SHA-256 through the Arm SHA-2 instructions on 64-bit Arm (sha2 asm, not Windows, not wasm32)
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-ops: the writer stores each value as one array; test tidying
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-ops: i64 sums where a bound shows they fit, one scan for a node's weight range, byte stores in the writer
The closed forms accumulate a tap set's sums in i64 when n·max|w| ≤ 2^63 − 1 (every partial sum then lies in i64), and in i128 otherwise. The pass finds a node's weight range once, for w_bits and for the acc32 width condition (a list fits i32 exactly when its least and greatest do). The WHG1 writer adds an integer list's bytes at once and stores each byte, where a copy of a few bytes is a call on wasm32. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-rs: the random-set differential holds load step 8 to its oracle
Every graph the int_synth, splat, audio and int_hyper generators lower is passed by wai_ops::bounds and by wai_ops::bounds_oracle (a dev-dependency with the oracle feature): equal passes or the same refusal, and the same first failure under each profile; every verdict is reached. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-ops, wai-rs: a lowered network loads without a second write and parse of its graph
Builder::finish already writes the graph's bytes, parses them back to an equal graph and plans it; it now returns that parsed graph, the one graph::load of those bytes holds. graph::load_lowered (crate-only) makes load steps 7 and 8 on it, so whm1_net_loaded and wam1_net_loaded give load's result, refusal for refusal, without writing and parsing the bytes a second time. The WHM1 and WAM1 lowerings move each layer's lists into the graph instead of cloning them (whm1_net and wam1_net, which borrow, clone the network once). The int_hyper, splat and audio drivers load through them. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-ops: the lowering's largest magnitude in u64, and the WHG1 writer in place
maxabs finds the largest |x| over u64 and widens it once, rather than forming an I512 per weight. The writer reserves each integer list and writes the usual widths as the unsigned integer of that width (the same low bytes), and writes each operator's parameters in place after their length, rather than into a second vector copied after. Same bytes; a unit test holds each width to the low bytes it wrote before. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-ops: the oracle test's floor on committed vector graphs is the 81 that parse and plan
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-ops: the bounds pass in closed form for conv, conv_transpose and igdn (WIP, committed before the first build)
Each convolution's term hull and partial-sum interval come from four sums per output channel (least and greatest weight, sum of the positive and of the negative weights; per residue for conv_transpose), and each igdn row folds in i128, wherever no operation of the rule's fold can saturate; elsewhere the rule folds tap by tap as before. The pass before this change is kept, test-only (feature `oracle` for other crates), as bounds_oracle, with a differential over the committed graphs, the pretrained set when present, and random and adversarial operators and graphs. Co-Authored-By: Claude Opus 5.5 <[email protected]>