wai: wai.capture.take — a device's master recording bound to a live room (L4) #289

Merged

dcharlot merged 21 commits from wai/capture-take into main 2026-10-17 09:22:42 -04:00

Conversation 0 Commits 21 Files changed 37 +24256 -10

dcharlot commented 2026-10-17 04:43:10 -04:00

Owner

Copy link

Slice L4 of WAI's live and interactive work: wai.capture.take, which binds a device's full-quality master recording to a live room. It is for a lesson or an audition, where the live call is low quality and the master is made on the performer's own device and uploaded afterwards. While the device captures, it publishes rolling hash commitments of its master into the room's event track, where the room clock stamps them and the relay and every other participant hold them. After the session, the upload is checked against those commitments, so it can prove it is one continuous, unedited take committed while it was being captured. The take also carries each subject's consent, with a guardian's for a minor.

Stacked. This PR is stacked on #284 (L2, wai.live.room, branch wai/live-rooms), which is stacked on #279 (L1, wai.live.events). Its base is main, so until those two merge, its diff includes theirs. The commits of this slice are the ones after 440f7dae. Not merged; for review.

What it adds

wai/extensions/capture-binding.md. The extension text, in the house style (status header, the texts read, RFC 2119 keywords, a reasons table, conformance, and security and privacy).

• Take (§3). A take is one continuous capture on one device, answering one record_start addressed to that device.
  • The take id is derived, not chosen: SHA-256("wai:capture-take\x01" ‖ room ‖ device ‖ digest of the record_start).
  • The device's room grant binds it to the principal it captures for, through the grant attribute subject, so a per-room device key can capture for a known principal. The attribute minor lets the room authority mark that principal a minor.
  • The stop is the first record_stop to the device after the start.
• Chunks and the take tree (§4).
  • Each chunk is a 64-byte descriptor: index, device-clock capture range, length and SHA-256.
  • Where the master is CMAF, chunk 0 carries the CMAF header with the first segment. That commits the header's edit lists.
  • The tree reuses staged-measurement Appendix C's output tree: RFC 6962's Merkle tree hash and its node SHA-256("wai:out-node\x01" ‖ l ‖ r), over leaves of the take's own domain (wai:take-leaf\x01).
  • Append-only is shown with RFC 9162 §2.1.4 consistency proofs. output_tree.rs gains tree_hash, a public node, consistency_proof and verify_consistency. These are additive; the output tree's own bytes do not change.
• Commitments (§5). This defines the take_commit payload that L1 reserved.
  • Fields: take id, n, phase (open, running, close), prev (the previous commitment's event digest), the chunk range added, the running root, the device's offset to the room clock, and the consistency proof.
  • A 126-byte fixed part plus 32 bytes per proof node, so up to 28 nodes fit the default 1024-byte payload.
  • The opening commitment answers the record_start; the closing one comes after the record_stop.
  • A relay or participant holding only the previous commitment can check, live, that the device never rewrites its history.
• Upload (§6). The master is uploaded resumably, content-addressed by chunk hash.
  • The store signs WUR1 receipts of its state machine: open, progress, resume, sealed.
  • When the room names an origin, the store must be listed in that origin's key log under a new authority, capture/store (registered in jwp-receipts §7.5).
  • Receipts must stay within the room's region pin.
• Take manifest (§7, WTM1). Signed by the device. It lists the chunks, the final root, every take_commit digest, the subjects with their consent digests, and the claims and purposes it makes.
• Consent (§8, WCN1).
  • Fields: the subject, purposes (live, record, distribute, train), the room it is for, a window, an optional guardian, and a nonce.
  • It is signed by the guardian when there is one, otherwise by the subject.
  • It is revoked by adding its digest to the room key log's revoked_modules (jwp-receipts §7.6 updated).
• Verification (§9).
  • Refusals, each a named reason: the room's own; then the manifest, the take in the room, the store, the receipts and the consents.
  • Then a verdict for each claim:
    • single-take, in order:
      • a listed commitment not delivered (delivery_gap, L1's code);
      • the commitment chain broken;
      • a root that does not extend its predecessor;
      • the take not closed;
      • the manifest's chunks not the committed ones;
      • the clock mapping unstable;
      • the capture discontinuous;
      • a chunk longer than the commit interval;
      • a commitment before its chunk's capture ended, or before the start or stop;
      • a commitment later than interval + jitter after its chunk ended;
      • an uploaded part that is extra, reordered or altered.
    • aligned: chunk 0's mapped start is within the jitter of the count-in instant.
    • complete: every committed chunk was uploaded, and the store sealed the upload.
    • publishable{purpose}, per subject: consent missing, guardian missing for a minor, consent revoked, consent expired, or purpose not consented.
  • A missing chunk fails complete, not single-take (§9.4 says so). The spec also says that a party promised an unedited single take needs both claims, because single-take alone holds for a partial upload.
  • The derived bound: every byte was committed within 2 × interval + jitter of its capture.
• Dual-tier binding (§10). A room-clock instant maps to a chunk and an offset in the master, so a marker set on the live call lands in the master. The bound is the jitter, wherever single-take and aligned hold.
• C2PA live video (§11), against C2PA Technical Specification 2.4 §19, both methods:
  • per-segment manifests: c2pa.livevideo.segment with sequenceNumber, streamId, continuityMethod and previousManifestId;
  • Verifiable Segment Info: an emsg with urn:c2pa:verifiable-segment-info / fseg, a COSE_Sign1 over sequenceNumber, bmffHash and manifestId, and the device key as an Ed25519 session key in c2pa.session-keys, bound by signerBinding;
  • an optional science.transaction.wai.take assertion that points a C2PA validator at the room's commitments;
  • c2pa.ai-disclosure, mapped from a caption's origin and model digest;
  • c2pa.environmental-sustainability, only from a measured figure, under energy-binding's rules.
• Reasons (§12): 31 new codes.

wai/wai-rs/src/capture_take.rs (feature capture_take = ["live_room"], cbindgen:ignore). It implements everything above:

• building chunks, commitments, receipts, manifests and consents;
• verify_take over live_room::verify_room, with every claim and the consent checks;
• position (§10) and stream_id (§11.1).

Its unit tests cover the tree and its consistency proofs, the commitment payload, consent signing, the stream id, the position mapping and distinct reason codes. It adds no dependency. include/wai.h is unchanged (see Runs).

wai/live-conformance/takes/: 38 vectors from fixed seeds (wai_capture_take_vectors gen), with a README carrying the provenance line tests/corpus_provenance.rs requires.

• Good: lesson (the director's remote record_start with a count-in, ten chunks, commitments every 2 s, two markers mapped into the master, record_stop, the upload sealed in DE within the DE/FR pin, the performer's consent), resumed_upload (open, progress, resume, progress, sealed; chunk 3 sent twice) and minor_guardian. All three stand. publishable{train} fails purpose_not_consented because the performer did not consent to it.
• The negatives the brief lists, each with its reason:
  • commit_gap: delivery_gap;
  • spliced_chunk: chunk_altered;
  • reordered_chunk: chunk_reordered;
  • extra_chunk: chunk_extra;
  • missing_chunk: complete fails chunk_missing, and single-take holds;
  • late_commit: commit_late;
  • root_not_extending;
  • misaligned;
  • consent_missing, consent_expired, consent_revoked;
  • minor_without_guardian: guardian_missing;
  • device_not_bound.
• One vector for every other reason of §12, plus a manifest of another room, bad manifest and consent signatures, and a room that refuses the device's first commitment.

wai/live-conformance/capture_take_verify.py. Independent and standard library only:

• strict Ed25519 through _ed25519.py;
• the room through live_rooms_verify.py, which uses live_events_verify.py for the events;
• its own RFC 6962 hash and RFC 9162 consistency check.

It agrees on every vector, reason, place, verdict, digest and marker position. It then mutates copies of the corpus (18 defects: bytes of parts, signatures, descriptors and consents, a dropped part, seal or commitment, a later evaluation instant, and changed stated roots, ids, positions, verdicts, places and reasons) and requires every copy to fail. All 18 do.

Changes to L2 (wai.live.room). The brief says the commit interval is "set by the room's recording policy", and L2's policy had no such field, so the descriptor's recording policy gains commit_interval_ms and jitter_ms:

• both are 0 when mode is 0;
• otherwise the interval is above 0 (2 000 by default) and the jitter is at most the interval (500 by default);
• the change touches live-rooms §3.1 and §3.7, live_room.rs, live_rooms_verify.py, and a new descriptor vector descriptor_recording_jitter;
• the rooms corpus is regenerated, so every room id changes;
• live-rooms §4.4 names the attributes capture binding reads (subject, minor).

L1's §4.12 now points at the payload defined here.

CI and registry.

• A capture take step in the independent-verifiers job of wai-conformance.yml runs:
  • the unit tests of capture_take:: and output_tree::;
  • tests/capture_take.rs;
  • capture_take_verify.py.
• The spec is on both path lists.
• SPEC §5 has a new paragraph, and REGISTRY lists the record and its magics WTM1, WUR1 and WCN1 as wire identifiers.
• wai registry export was re-run on the build host (registry/capabilities.json, vocab/v2.ttl).
• CHANGELOG has an entry.

C2PA mapping: specified, not implemented

The mapping is specified, and its implementation deferred, except for the stream id (an RFC 9562 version-8 UUID of the take id), which is implemented and stated in the corpus.

• wai-rs has no CBOR or COSE encoder.
• The C2PA signer that c2pa_emit uses writes whole-asset manifests and fragmented-BMFF manifests (one manifest in the initialization segment and a Merkle tree over the fragments). It has no live-video segment assertion, no c2pa.session-keys and no Verifiable Segment Info.
• Implementing §19 would need a COSE/CBOR dependency, which the brief rules out.

Deferred

• The C2PA live-video emitter itself: per-segment manifests, Verifiable Segment Info, session keys and the science.transaction.wai.take assertion. It needs CBOR and COSE.
• Witnessing a commitment's arrival time through per-hop relay receipts (a later slice). Here a commitment's t is its author's claim, bounded by the room's merged order and the timing rules.
• Merkle inclusion proofs for provable clips of a take (L7).
• Energy figures for a take, and so its c2pa.environmental-sustainability (L9).
• Consent revocation in a room with no origin, which is impossible by design. The spec says a room that records subjects SHOULD name an origin.

Runs

All cargo work ran on the build host through ~/kani-logs/remote/rb <worktree> -- '<command>', under memguard, with output written to logs on the host and grepped there. Nothing was compiled or tested on the dev Mac.

1. rb --pull with these three commands. rb exited 1 because the unit tests failed; the two corpus generators exited 0.
   • cargo test --no-default-features --features capture_take --lib -- capture_take:: output_tree:: live_room::: two tests failed, both on wrong expectations in the tests themselves:
     • the position test had the offset's sign reversed;
     • the consistency test asserted that a proof fixes the second tree's size. It does not, just as an audit path does not.
       Both tests are fixed, and §4.3 now states that a commitment carries its size.
   • wai_live_room_vectors gen and wai_capture_take_vectors gen: exit 0. Every take vector reached the outcome it was written for.
2. rb --pull: exit 0. Each command below exited 0:
   • wai registry export
   • touch cbindgen.toml && cargo build --no-default-features --features capture_take --lib, then git diff --quiet -- include/wai.h: the header is identical
   • cargo test --no-default-features --features capture_take --lib -- capture_take:: output_tree:: live_room:: live_events::: 30 passed
   • cargo test --no-default-features --features capture_take --test capture_take --test live_room --test live_events: 4 + 4 + 4 passed
   • wai_capture_take_vectors verify ../live-conformance/takes and wai_live_room_vectors verify ../live-conformance/rooms: both regenerate byte for byte, and every vector gets its stated outcome
   • cargo test --no-default-features --lib -- codecs::: 53 passed, including the wire-identifier and section tests
   • cargo test --no-default-features --test carriage --test manifest_builders --test cli_wrap_intent --test cli_registry --test corpus_provenance: all passed, including registry export --check and the provenance line
   • cargo clippy --no-default-features --features capture_take --lib --tests --bins: no warning in any file this PR adds or changes. The single warning on output_tree.rs is at line 310, in that module's existing proof_roundtrip test.
3. rb: cargo test --no-default-features --features neural_int,video_int,audio_int,world_int,splat_int,generate,score,staged,stage_measure,legacy_int --test int_kernels_vectors (the coordinator's addition): exit 0, 8 passed.

Locally (light scripts, standard library):

• python3 -I live-conformance/live_events_verify.py live-conformance/events: PASS, 45 vectors.
• python3 -I live-conformance/live_rooms_verify.py live-conformance/rooms: PASS, 64 vectors, with the regenerated rooms.
• python3 -I live-conformance/capture_take_verify.py live-conformance/takes: PASS, 38 vectors; all 18 mutated copies fail.
• The repo script checks all exit 0:
  • check-lockfiles and its self-test;
  • check-tests-in-ci and its self-test;
  • check-workflow-concurrency and its self-test;
  • the pr-touches-paths self-test;
  • check-spec-refs and its self-test;
  • check-wai-section-refs;
  • check-no-vanity-metrics;
  • check-comparative-prose.
• check-public-names was not run, because WAI_NAME_DENYLIST is not set here. Instead the diff was searched for third-party names, and none were found.

Merge: wai/live-rooms at 440f7dae was merged into this branch first (merge, not rebase), so it carries L2's fix for int_kernels_vectors (the live-conformance exclusion, which covers takes/).

🤖 Generated with Claude Code

Slice L4 of WAI's live and interactive work: `wai.capture.take`, which binds a device's full-quality master recording to a live room. It is for a lesson or an audition, where the live call is low quality and the master is made on the performer's own device and uploaded afterwards. While the device captures, it publishes rolling hash commitments of its master into the room's event track, where the room clock stamps them and the relay and every other participant hold them. After the session, the upload is checked against those commitments, so it can prove it is one continuous, unedited take committed while it was being captured. The take also carries each subject's consent, with a guardian's for a minor. **Stacked.** This PR is stacked on #284 (L2, `wai.live.room`, branch `wai/live-rooms`), which is stacked on #279 (L1, `wai.live.events`). Its base is `main`, so until those two merge, its diff includes theirs. The commits of this slice are the ones after `440f7dae`. Not merged; for review. ## What it adds **`wai/extensions/capture-binding.md`.** The extension text, in the house style (status header, the texts read, RFC 2119 keywords, a reasons table, conformance, and security and privacy). - **Take** (§3). A take is one continuous capture on one device, answering one `record_start` addressed to that device. - The take id is derived, not chosen: `SHA-256("wai:capture-take\x01" ‖ room ‖ device ‖ digest of the record_start)`. - The device's room grant binds it to the principal it captures for, through the grant attribute `subject`, so a per-room device key can capture for a known principal. The attribute `minor` lets the room authority mark that principal a minor. - The stop is the first `record_stop` to the device after the start. - **Chunks and the take tree** (§4). - Each chunk is a 64-byte descriptor: index, device-clock capture range, length and SHA-256. - Where the master is CMAF, chunk 0 carries the CMAF header with the first segment. That commits the header's edit lists. - The tree **reuses staged-measurement Appendix C's output tree**: RFC 6962's Merkle tree hash and its node `SHA-256("wai:out-node\x01" ‖ l ‖ r)`, over leaves of the take's own domain (`wai:take-leaf\x01`). - Append-only is shown with RFC 9162 §2.1.4 consistency proofs. `output_tree.rs` gains `tree_hash`, a public `node`, `consistency_proof` and `verify_consistency`. These are additive; the output tree's own bytes do not change. - **Commitments** (§5). This defines the `take_commit` payload that L1 reserved. - Fields: take id, `n`, phase (open, running, close), `prev` (the previous commitment's event digest), the chunk range added, the running root, the device's offset to the room clock, and the consistency proof. - A 126-byte fixed part plus 32 bytes per proof node, so up to 28 nodes fit the default 1024-byte payload. - The opening commitment answers the `record_start`; the closing one comes after the `record_stop`. - A relay or participant holding only the previous commitment can check, live, that the device never rewrites its history. - **Upload** (§6). The master is uploaded resumably, content-addressed by chunk hash. - The store signs `WUR1` receipts of its state machine: open, progress, resume, sealed. - When the room names an origin, the store must be listed in that origin's key log under a new authority, `capture/store` (registered in jwp-receipts §7.5). - Receipts must stay within the room's region pin. - **Take manifest** (§7, `WTM1`). Signed by the device. It lists the chunks, the final root, every `take_commit` digest, the subjects with their consent digests, and the claims and purposes it makes. - **Consent** (§8, `WCN1`). - Fields: the subject, purposes (`live`, `record`, `distribute`, `train`), the room it is for, a window, an optional guardian, and a nonce. - It is signed by the guardian when there is one, otherwise by the subject. - It is revoked by adding its digest to the room key log's `revoked_modules` (jwp-receipts §7.6 updated). - **Verification** (§9). - Refusals, each a named reason: the room's own; then the manifest, the take in the room, the store, the receipts and the consents. - Then a verdict for each claim: - **`single-take`**, in order: - a listed commitment not delivered (`delivery_gap`, L1's code); - the commitment chain broken; - a root that does not extend its predecessor; - the take not closed; - the manifest's chunks not the committed ones; - the clock mapping unstable; - the capture discontinuous; - a chunk longer than the commit interval; - a commitment before its chunk's capture ended, or before the start or stop; - a commitment later than interval + jitter after its chunk ended; - an uploaded part that is extra, reordered or altered. - **`aligned`**: chunk 0's mapped start is within the jitter of the count-in instant. - **`complete`**: every committed chunk was uploaded, and the store sealed the upload. - **`publishable{purpose}`**, per subject: consent missing, guardian missing for a minor, consent revoked, consent expired, or purpose not consented. - **A missing chunk fails `complete`, not `single-take`** (§9.4 says so). The spec also says that a party promised an unedited single take needs both claims, because `single-take` alone holds for a partial upload. - The derived bound: every byte was committed within 2 × interval + jitter of its capture. - **Dual-tier binding** (§10). A room-clock instant maps to a chunk and an offset in the master, so a marker set on the live call lands in the master. The bound is the jitter, wherever `single-take` and `aligned` hold. - **C2PA live video** (§11), against C2PA Technical Specification 2.4 §19, both methods: - per-segment manifests: `c2pa.livevideo.segment` with `sequenceNumber`, `streamId`, `continuityMethod` and `previousManifestId`; - Verifiable Segment Info: an `emsg` with `urn:c2pa:verifiable-segment-info` / `fseg`, a COSE_Sign1 over `sequenceNumber`, `bmffHash` and `manifestId`, and the device key as an Ed25519 session key in `c2pa.session-keys`, bound by `signerBinding`; - an optional `science.transaction.wai.take` assertion that points a C2PA validator at the room's commitments; - `c2pa.ai-disclosure`, mapped from a caption's `origin` and model digest; - `c2pa.environmental-sustainability`, only from a measured figure, under energy-binding's rules. - **Reasons** (§12): 31 new codes. **`wai/wai-rs/src/capture_take.rs`** (feature `capture_take = ["live_room"]`, `cbindgen:ignore`). It implements everything above: - building chunks, commitments, receipts, manifests and consents; - `verify_take` over `live_room::verify_room`, with every claim and the consent checks; - `position` (§10) and `stream_id` (§11.1). Its unit tests cover the tree and its consistency proofs, the commitment payload, consent signing, the stream id, the position mapping and distinct reason codes. It adds no dependency. `include/wai.h` is unchanged (see Runs). **`wai/live-conformance/takes/`**: 38 vectors from fixed seeds (`wai_capture_take_vectors gen`), with a README carrying the provenance line `tests/corpus_provenance.rs` requires. - Good: `lesson` (the director's remote `record_start` with a count-in, ten chunks, commitments every 2 s, two markers mapped into the master, `record_stop`, the upload sealed in DE within the DE/FR pin, the performer's consent), `resumed_upload` (open, progress, resume, progress, sealed; chunk 3 sent twice) and `minor_guardian`. All three stand. `publishable{train}` fails `purpose_not_consented` because the performer did not consent to it. - The negatives the brief lists, each with its reason: - `commit_gap`: `delivery_gap`; - `spliced_chunk`: `chunk_altered`; - `reordered_chunk`: `chunk_reordered`; - `extra_chunk`: `chunk_extra`; - `missing_chunk`: `complete` fails `chunk_missing`, and `single-take` holds; - `late_commit`: `commit_late`; - `root_not_extending`; - `misaligned`; - `consent_missing`, `consent_expired`, `consent_revoked`; - `minor_without_guardian`: `guardian_missing`; - `device_not_bound`. - One vector for every other reason of §12, plus a manifest of another room, bad manifest and consent signatures, and a room that refuses the device's first commitment. **`wai/live-conformance/capture_take_verify.py`**. Independent and standard library only: - strict Ed25519 through `_ed25519.py`; - the room through `live_rooms_verify.py`, which uses `live_events_verify.py` for the events; - its own RFC 6962 hash and RFC 9162 consistency check. It agrees on every vector, reason, place, verdict, digest and marker position. It then mutates copies of the corpus (18 defects: bytes of parts, signatures, descriptors and consents, a dropped part, seal or commitment, a later evaluation instant, and changed stated roots, ids, positions, verdicts, places and reasons) and requires every copy to fail. All 18 do. **Changes to L2 (`wai.live.room`).** The brief says the commit interval is "set by the room's recording policy", and L2's policy had no such field, so the descriptor's recording policy gains `commit_interval_ms` and `jitter_ms`: - both are 0 when `mode` is 0; - otherwise the interval is above 0 (2 000 by default) and the jitter is at most the interval (500 by default); - the change touches live-rooms §3.1 and §3.7, `live_room.rs`, `live_rooms_verify.py`, and a new descriptor vector `descriptor_recording_jitter`; - the rooms corpus is regenerated, so every room id changes; - live-rooms §4.4 names the attributes capture binding reads (`subject`, `minor`). L1's §4.12 now points at the payload defined here. **CI and registry.** - A `capture take` step in the independent-verifiers job of `wai-conformance.yml` runs: - the unit tests of `capture_take::` and `output_tree::`; - `tests/capture_take.rs`; - `capture_take_verify.py`. - The spec is on both path lists. - SPEC §5 has a new paragraph, and REGISTRY lists the record and its magics `WTM1`, `WUR1` and `WCN1` as wire identifiers. - `wai registry export` was re-run on the build host (`registry/capabilities.json`, `vocab/v2.ttl`). - CHANGELOG has an entry. ## C2PA mapping: specified, not implemented The mapping is **specified, and its implementation deferred**, except for the stream id (an RFC 9562 version-8 UUID of the take id), which is implemented and stated in the corpus. - `wai-rs` has no CBOR or COSE encoder. - The C2PA signer that `c2pa_emit` uses writes whole-asset manifests and fragmented-BMFF manifests (one manifest in the initialization segment and a Merkle tree over the fragments). It has no live-video segment assertion, no `c2pa.session-keys` and no Verifiable Segment Info. - Implementing §19 would need a COSE/CBOR dependency, which the brief rules out. ## Deferred - The C2PA live-video emitter itself: per-segment manifests, Verifiable Segment Info, session keys and the `science.transaction.wai.take` assertion. It needs CBOR and COSE. - Witnessing a commitment's arrival time through per-hop relay receipts (a later slice). Here a commitment's `t` is its author's claim, bounded by the room's merged order and the timing rules. - Merkle inclusion proofs for provable clips of a take (L7). - Energy figures for a take, and so its `c2pa.environmental-sustainability` (L9). - Consent revocation in a room with no origin, which is impossible by design. The spec says a room that records subjects SHOULD name an origin. ## Runs All cargo work ran on the build host through `~/kani-logs/remote/rb <worktree> -- '<command>'`, under memguard, with output written to logs on the host and grepped there. Nothing was compiled or tested on the dev Mac. 1. `rb --pull` with these three commands. rb exited 1 because the unit tests failed; the two corpus generators exited 0. - `cargo test --no-default-features --features capture_take --lib -- capture_take:: output_tree:: live_room::`: two tests failed, both on wrong expectations in the tests themselves: - the position test had the offset's sign reversed; - the consistency test asserted that a proof fixes the second tree's size. It does not, just as an audit path does not. Both tests are fixed, and §4.3 now states that a commitment carries its size. - `wai_live_room_vectors gen` and `wai_capture_take_vectors gen`: exit 0. Every take vector reached the outcome it was written for. 2. `rb --pull`: **exit 0.** Each command below exited 0: - `wai registry export` - `touch cbindgen.toml && cargo build --no-default-features --features capture_take --lib`, then `git diff --quiet -- include/wai.h`: **the header is identical** - `cargo test --no-default-features --features capture_take --lib -- capture_take:: output_tree:: live_room:: live_events::`: 30 passed - `cargo test --no-default-features --features capture_take --test capture_take --test live_room --test live_events`: 4 + 4 + 4 passed - `wai_capture_take_vectors verify ../live-conformance/takes` and `wai_live_room_vectors verify ../live-conformance/rooms`: both regenerate byte for byte, and every vector gets its stated outcome - `cargo test --no-default-features --lib -- codecs::`: 53 passed, including the wire-identifier and section tests - `cargo test --no-default-features --test carriage --test manifest_builders --test cli_wrap_intent --test cli_registry --test corpus_provenance`: all passed, including `registry export --check` and the provenance line - `cargo clippy --no-default-features --features capture_take --lib --tests --bins`: no warning in any file this PR adds or changes. The single warning on `output_tree.rs` is at line 310, in that module's existing `proof_roundtrip` test. 3. `rb`: `cargo test --no-default-features --features neural_int,video_int,audio_int,world_int,splat_int,generate,score,staged,stage_measure,legacy_int --test int_kernels_vectors` (the coordinator's addition): **exit 0**, 8 passed. Locally (light scripts, standard library): - `python3 -I live-conformance/live_events_verify.py live-conformance/events`: PASS, 45 vectors. - `python3 -I live-conformance/live_rooms_verify.py live-conformance/rooms`: PASS, 64 vectors, with the regenerated rooms. - `python3 -I live-conformance/capture_take_verify.py live-conformance/takes`: PASS, 38 vectors; all 18 mutated copies fail. - The repo script checks all exit 0: - `check-lockfiles` and its self-test; - `check-tests-in-ci` and its self-test; - `check-workflow-concurrency` and its self-test; - the `pr-touches-paths` self-test; - `check-spec-refs` and its self-test; - `check-wai-section-refs`; - `check-no-vanity-metrics`; - `check-comparative-prose`. - `check-public-names` was not run, because `WAI_NAME_DENYLIST` is not set here. Instead the diff was searched for third-party names, and none were found. Merge: `wai/live-rooms` at `440f7dae` was merged into this branch first (merge, not rebase), so it carries L2's fix for `int_kernels_vectors` (the `live-conformance` exclusion, which covers `takes/`). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dcharlot added 21 commits 2026-10-17 04:43:11 -04:00

wai: live_events reference module (WIP): WEV1 record, payloads, WEP1 policy, chain verification, poll tallies, bindings ... 7b505492b0

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: live_events corpus generator, wai_live_events_vectors, tests/live_events.rs, feature live_events ... 9b1b8b73d6

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: live-conformance/events/vectors.json generated from fixed seeds; wai.h regenerated ... db391a34d3

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: extensions/live-events.md and live_events_verify.py, the corpus's independent verifier ... 1f7f64b4d3

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: register wai.live.events (SPEC §5, registry rows and wire identifiers), CHANGELOG, corpus README, CI step and path gate ... af286613cd

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: registry export and wai.h regenerated for wai.live.events ... 1139e2ef76

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: live_events clippy style (struct update syntax, is_multiple_of, a type alias) ... 9b0a9dbf60

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge origin/main into wai/live-events ... 2835defa56

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: live-conformance/README.md, with the corpus's provenance ... 8a58f94bb6

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: live_events stays out of include/wai.h ... defa48c0b5

Its constants (VERSION, IN, OUT, BREAK, CHAT and the rest) are Rust-only. As bare
macros they would collide in any C program that includes wai.h beside a platform
header or a build-wide -DVERSION. The module is cbindgen:ignore; the header is
regenerated and is back to main's.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: live_room, the room descriptor, grant and room verifier (WIP) ... a39151dad8

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: live-conformance/rooms, the corpus from fixed seeds (WIP) ... 066b7e56c0

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: live-rooms.md, its corpus README, live_rooms_verify.py, registry and CI ... 368bb2bc98

The extension text, the second implementation of the room verifier, the registry entries
for wai.live.room (WRD1, WRG1), the live/room key-log authority and grant revocation in
jwp-receipts §7, the CHANGELOG entry, and the CI step beside live events.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: registry export for wai.live.room ... 667a1be6bf

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: live_room, clippy's type and multiple-of lints ... b5ac792e2e

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: live-rooms.md, once, viewer scope, iss and the moqt media name made exact ... 6ec91d6c5a

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge origin/main into wai/live-rooms; live-conformance declares it has no decoded output ... 440f7dae29

The cargo-class corpora job's every_decoded_output_states_a_sha256 requires each
*-conformance directory to carry a sha256.json or be excluded with a reason.
live-conformance (L1's events, L2's rooms, L4's takes to come) holds signed
records, commitments and verdicts, never a decoded output, so it joins the
exclusions beside the claim, JWP and signer corpora. CHANGELOG: both sides'
entries kept.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: capture_take, the take manifest, commitments, receipts, consent and verifier (WIP) ... 6538c563b0

capture-binding.md drafts wai.capture.take. The room's recording policy gains
commit_interval_ms and jitter_ms (live-rooms §3.7), and the output tree exposes its
RFC 6962 hash and RFC 9162 consistency proofs for the take tree to reuse.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: live-conformance/takes from fixed seeds, capture_take_verify.py, and the rooms corpus with the recording policy's timing ... e7052640f0

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: capture-binding.md, its corpus README, registry, SPEC §5, CI and CHANGELOG ... c479eeba16

live-events §4.12 points at the payload capture binding defines; jwp-receipts §7.5
registers capture/store and §7.6 consent withdrawal through revoked_modules.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: registry export for wai.capture.take; the rooms README names its recording-policy control ... d13cc335c7

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot merged commit 13360b4e0e into main 2026-10-17 09:22:42 -04:00

dcharlot referenced this pull request from a commit 2026-10-17 09:22:43 -04:00

Merge pull request 'wai: wai.capture.take — a device's master recording bound to a live room (L4)' (#289) from wai/capture-take into main

dcharlot referenced this pull request 2026-10-17 09:23:25 -04:00

wai: live-rooms (Draft) — wai.live.room: room descriptor, room grants, exchange and revocation, slots, publish profiles, room verifier (stacked on #279) #284

dcharlot referenced this pull request 2026-10-17 09:23:30 -04:00

wai: live-events (Draft) — wai.live.events, a signed, timeline-bound event track (WEV1), with its policy, verifier, poll tallies as feed state, MSF/DATERANGE/emsg bindings, corpus and independent verifier #279

dcharlot referenced this pull request 2026-10-17 09:49:40 -04:00

wai: live-compose, a room's composition as an integer function (L3) #296

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Transaction-Science/open-standards!289

No description provided.