wai.ai.usage: AI usage preferences bound to the bytes, and the agent's consumption claim (AG1) #386

Merged

dcharlot merged 9 commits from wai/ai-usage into main 2026-10-21 11:20:57 -04:00

Conversation 0 Commits 9 Files changed 28 +7370 -29

dcharlot commented 2026-10-21 05:44:47 -04:00

Owner

Copy link

What this is

wai.ai.usage (AG1): AI usage preferences for media, bound to the bytes they govern, and the signed statement of an agent that consumed media.

• Extension wai/extensions/ai-usage.md. A usage statement carries three published vocabularies verbatim, each in its own member, with no WAI category and no mapping between them:

  • aipref: a statement of preference of draft-ietf-aipref-vocab-08 in its Structured Field form (train-ai, ai-use, search);
  • tdmrep: the TDM Reservation Protocol's tdm-reservation and tdm-policy (Final Community Group Report, 10 May 2024, the latest);
  • cawg: the entries of a cawg.training-mining assertion (Training and Data Mining Assertion 1.1, ratified 16 May 2025, current).

• Carriage.

  • Envelope: the manifest member ai_usage. The receipt's content hash covers it, so the group receipt signs it with the content; a stripped or altered statement fails the receipt (usage_unbound).
  • Room: a room usage record WAU1, signed by the authority and chained by effective instant (live-rooms §3.8).
  • Grant: the attribute ai_usage holds one principal's terms (live-rooms §4.4).
  • HTTP: http-delivery §5.6 writes draft-ietf-aipref-attach-05's Content-Usage and the TDMRep fields from the signed statement.
  • MoQ: the catalog field wai_ai_usage (moq-streaming-format §4).

• One precedence rule (§5). A grant's terms decide first. Then the signed statements, the most restrictive governing (the vocabulary's own §5.1 combining rule). Unsigned statements count only where nothing is signed. A field or catalog that contradicts the signed statement is refused (header_conflicts, catalog_conflicts), and the signed statement governs.

• Consumption claim (§6). This is the jwp-receipts claim class consumption (§2.4.13, its step 4 and step 6 reasons in §3.1, its authority in §7.5). The agent signs it under its did:key, and it names:

  • the objects, by content hash;
  • the term it acted under in each vocabulary (or null for a use outside it);
  • the statements it saw;
  • the grant it held.

  It is checked against the objects, their statements and the room. A use the statements disallow is refused usage_disallowed; that refusal is of the use, never of the signature.

• Gate (§7). A relay or gateway MAY require claims before serving an agent. It has two policy knobs:

  • window: 0 means claim before fetch (HTTP); n means claim within n groups (MOQT);
  • require_allowed.

  The proposed request field WAI-Usage-Claim carries a claim over HTTP.

• Reference:

  • wai-rs feature ai_usage: src/ai_usage.rs, with RFC 9651's Dictionary parser written in src/ai_usage/sf.rs;
  • the class body and rules: src/claim_receipt/consumption.rs;
  • http_binding::receipts step 6 refuses a consumption claim served beside an object (context_not_held), because its context is the whole set of objects.

• Corpus wai/live-conformance/usage/vectors.json (generator wai_ai_usage_vectors, test tests/ai_usage.rs). It covers:

  • statements, each vocabulary and the Dictionary's edges;
  • receipted envelopes (a WAI2 among them);
  • a room with chained records and agent grants;
  • HTTP responses and catalogs;
  • claims;
  • gates.

  Every reason of §9 appears. The negative controls asked for, with their codes:

  • stripped statement: feature_stripped, usage_unbound;
  • header contradicting the signed field: aipref_contradicts, tdm_contradicts, tdm_policy_contradicts, all header_conflicts;
  • claim for a forbidden category:
    • training_forbidden, mining_constrained and room_training_unlicensed, all usage_disallowed;
    • room_own_and_room, own statement allows and room disallows, usage_disallowed;
  • claim over wrong digests: wrong_digests, consumption_object_unknown;
  • bad signature: bad_signature, signature_verify_failed at step 3.

• Second implementation wai/live-conformance/ai_usage_verify.py. It is written from the text and shares no code with wai-rs:

  • it writes its own RFC 9651 parser, canonical form, legacy group receipt and Merkle check, and claim steps 1 to 6;
  • it reads rooms through live_rooms_verify.py;
  • it uses strict Ed25519 and BLAKE3 from claim-conformance;
  • it runs -I, standard library only.

  claim-conformance/claim_verify.py also learns the class, steps 1 to 4, with a consumption mode run in CI.

• Registry: wai.ai.usage, WAU1, wai_ai_usage, WAI-Usage-Claim (proposed). Export regenerated. Also SPEC §5 paragraph, CHANGELOG, CI step and path trigger.

Decisions the reviewer should know

1. Vocabularies verified at the datatracker / their publishers on 2026-10-21:
   • draft-ietf-aipref-vocab-08 (14 Sep 2026) and draft-ietf-aipref-attach-05 (19 Aug 2026): both WG documents, intended Proposed Standard, IESG state "I-D Exists", so not yet submitted. The vocab marks its §3 and §4 as without consensus.
   • Each member names the revision it is read at. Any other revision is refused usage_revision_unknown, failing closed; a later revision of this extension adds revisions.
2. The room descriptor's layout is unchanged. WRD1 has no extension point. Its readers include joule-moq-ingest and every live verifier, so a version bump would have rippled across them. The room's preference is a separate authority-signed record bound to the room id and chained like live-moderation's review policy. That also lets the preference change at an instant without reaching earlier objects (draft-ietf-aipref-attach-05 §3.3's rule). live-rooms §3.8 says this.
3. No cross-vocabulary mapping. A claim must answer every vocabulary the governing statements carry (usage_unanswered), each in its own terms. The most restrictive answer governs. This closes picking the most permissive vocabulary without inventing an equivalence table.
4. A value that does not parse is refused, not read as all-unknown. The vocabulary reads it as unknown (§6.5.1). A signed statement that silently means nothing is what binding would preserve. The Byte Sequence checks RFC 9651 leaves to parsers are fixed in §3.3.
5. CAWG constrained reads as disallow absent a grant, per the assertion's §3.1. The CDDL member is constraint_info; the assertion's prose spells it constraints_info, and §3.4 notes it.
6. http_binding/receipts.rs changed, which fires wai-http's falsify shards. The new arm sits so that every committed *.patch still applies (git apply --check over all of them: 0 fail).

Checks

All cargo runs went through rb on the build host.

check	command	result
module tests	cargo test --locked --no-default-features --features ai_usage --lib ai_usage::	7 passed
claim tests (incl. pinned claim corpus)	cargo test --locked --no-default-features --features ai_usage --lib claim_receipt::	30 passed
corpus test	cargo test --locked --no-default-features --features ai_usage --test ai_usage	4 passed
lib, CI's cargo-class feature set (incl. http_binding, codecs::registry, staged::moq)	cargo test --locked --lib --no-default-features --features world,audio_scene,haptic,splat4d,score,provenance,neural_int,film,oer,receipt_claims,key_discovery,staged,video_int,audio_int,splat_int,stage_measure,telemetry,video_package,http	841 passed
conformance dirs	cargo test --locked --no-default-features --features neural_int,video_int,audio_int,world_int,splat_int --test int_kernels_vectors every_decoded_output	1 passed
registry	cargo test --locked --no-default-features --lib codecs::registry; wai registry export --check	14 passed; up to date
corpus regenerates	wai_ai_usage_vectors verify ../live-conformance/usage	PASS, PASS
clippy	cargo clippy --locked --no-default-features --features ai_usage,http --all-targets	no note in any new file
second implementation	python3 -I live-conformance/ai_usage_verify.py live-conformance/usage	all cases; 17 mutations caught; 26 weakened verifiers caught
claim_verify, class steps 1–4	python3 -I claim-conformance/claim_verify.py consumption live-conformance/usage/vectors.json	27 claims, 0 failures
claim_verify, its own corpus	python3 -I claim-conformance/claim_verify.py	567 vectors, 0 failures
neighbouring verifiers	live_rooms_verify.py rooms, live_moderation_verify.py moderation, live_ads_verify.py ads, jwp_verify.py, http_verify.py http-conformance	all PASS (1055/1055 HTTP cases)
repo checks	check-tests-in-ci.py, check-workflow-concurrency.sh, check-spec-refs.py, check-wai-section-refs.py, check-no-vanity-metrics.sh, test-public-text-checks.sh, check-comparative-prose.sh, check-orphan-sources.py	all exit 0
falsify patches	git apply --check over every committed *.patch	0 fail

check-public-names.sh was not run: its pattern list is a CI secret.

Falsifications

Each was applied uncommitted, run, then restored, with a clean tree after.

• Rust, through cargo test --test ai_usage every_case. Every one fails, naming these cases:
  • most-restrictive rule dropped: training_forbidden, mining_constrained, room_training_unlicensed, room_own_and_room, gates claim_ahead_disallowed, room_agent_disallowed;
  • content-hash check dropped: feature_stripped, feature_altered, wrong_digests;
  • did:key rule dropped: signer_not_principal;
  • header compared by parse only: aipref_contradicts, aipref_drops_a_label;
  • grant terms ignored: room_terms_lift, room_untimed, room_licensed_training;
  • Dictionary trailing comma accepted: aipref_trailing_comma.
• §9 table row removed:
  • the_extension_lists_the_reasons fails;
  • ai_usage_verify.py exits 1 (§9 read from the extension: 20 reasons).
• claim_verify.py with its seen-order rule removed: consumption mode fails on seen_unordered.
• ai_usage_verify.py applies 17 corpus mutations and drops each of 26 of its own checks in turn. Each is caught by the corpus in the same run.

Not done

• The optional MCP-over-MOQT profile (draft-jennings-agentproto-mcp-over-moqt-00, 6 Jul 2026, individual, verified at the datatracker) is not in this PR. §1 lists the agent protocols as out of scope for this revision.
• No MOQT carriage for a claim is defined (§7.3). A relay gating over MOQT holds claims given over HTTP.
• Claim vectors live in the AI usage corpus, not in claim-conformance/. claim_verify.py reads them through its new consumption mode.
• The aipref vocabulary is still a WG draft without consensus on §3–§4. When it moves, a new revision string and corpus refresh are needed.
• Not measured: bytes or joules per agent view, and a claim's round trip through a settlement record.

🤖 Generated with Claude Code

## What this is `wai.ai.usage` (AG1): AI usage preferences for media, bound to the bytes they govern, and the signed statement of an agent that consumed media. - **Extension** `wai/extensions/ai-usage.md`. A *usage statement* carries three published vocabularies verbatim, each in its own member, with no WAI category and no mapping between them: - `aipref`: a statement of preference of `draft-ietf-aipref-vocab-08` in its Structured Field form (`train-ai`, `ai-use`, `search`); - `tdmrep`: the TDM Reservation Protocol's `tdm-reservation` and `tdm-policy` (Final Community Group Report, 10 May 2024, the latest); - `cawg`: the entries of a `cawg.training-mining` assertion (Training and Data Mining Assertion 1.1, ratified 16 May 2025, current). - **Carriage.** - Envelope: the manifest member `ai_usage`. The receipt's content hash covers it, so the group receipt signs it with the content; a stripped or altered statement fails the receipt (`usage_unbound`). - Room: a room usage record `WAU1`, signed by the authority and chained by effective instant (live-rooms §3.8). - Grant: the attribute `ai_usage` holds one principal's terms (live-rooms §4.4). - HTTP: http-delivery §5.6 writes `draft-ietf-aipref-attach-05`'s `Content-Usage` and the TDMRep fields from the signed statement. - MoQ: the catalog field `wai_ai_usage` (moq-streaming-format §4). - **One precedence rule (§5).** A grant's terms decide first. Then the signed statements, the most restrictive governing (the vocabulary's own §5.1 combining rule). Unsigned statements count only where nothing is signed. A field or catalog that contradicts the signed statement is refused (`header_conflicts`, `catalog_conflicts`), and the signed statement governs. - **Consumption claim (§6).** This is the jwp-receipts claim class `consumption` (§2.4.13, its step 4 and step 6 reasons in §3.1, its authority in §7.5). The agent signs it under its `did:key`, and it names: - the objects, by content hash; - the term it acted under in each vocabulary (or `null` for a use outside it); - the statements it saw; - the grant it held. It is checked against the objects, their statements and the room. A use the statements disallow is refused `usage_disallowed`; that refusal is of the use, never of the signature. - **Gate (§7).** A relay or gateway MAY require claims before serving an agent. It has two policy knobs: - `window`: 0 means claim before fetch (HTTP); *n* means claim within *n* groups (MOQT); - `require_allowed`. The proposed request field `WAI-Usage-Claim` carries a claim over HTTP. - **Reference:** - `wai-rs` feature `ai_usage`: `src/ai_usage.rs`, with RFC 9651's Dictionary parser written in `src/ai_usage/sf.rs`; - the class body and rules: `src/claim_receipt/consumption.rs`; - `http_binding::receipts` step 6 refuses a consumption claim served beside an object (`context_not_held`), because its context is the whole set of objects. - **Corpus** `wai/live-conformance/usage/vectors.json` (generator `wai_ai_usage_vectors`, test `tests/ai_usage.rs`). It covers: - statements, each vocabulary and the Dictionary's edges; - receipted envelopes (a `WAI2` among them); - a room with chained records and agent grants; - HTTP responses and catalogs; - claims; - gates. Every reason of §9 appears. The negative controls asked for, with their codes: - stripped statement: `feature_stripped`, `usage_unbound`; - header contradicting the signed field: `aipref_contradicts`, `tdm_contradicts`, `tdm_policy_contradicts`, all `header_conflicts`; - claim for a forbidden category: - `training_forbidden`, `mining_constrained` and `room_training_unlicensed`, all `usage_disallowed`; - `room_own_and_room`, own statement allows and room disallows, `usage_disallowed`; - claim over wrong digests: `wrong_digests`, `consumption_object_unknown`; - bad signature: `bad_signature`, `signature_verify_failed` at step 3. - **Second implementation** `wai/live-conformance/ai_usage_verify.py`. It is written from the text and shares no code with `wai-rs`: - it writes its own RFC 9651 parser, canonical form, legacy group receipt and Merkle check, and claim steps 1 to 6; - it reads rooms through `live_rooms_verify.py`; - it uses strict Ed25519 and BLAKE3 from `claim-conformance`; - it runs `-I`, standard library only. `claim-conformance/claim_verify.py` also learns the class, steps 1 to 4, with a `consumption` mode run in CI. - Registry: `wai.ai.usage`, `WAU1`, `wai_ai_usage`, `WAI-Usage-Claim` (proposed). Export regenerated. Also SPEC §5 paragraph, CHANGELOG, CI step and path trigger. ## Decisions the reviewer should know 1. **Vocabularies verified at the datatracker / their publishers on 2026-10-21:** - `draft-ietf-aipref-vocab-08` (14 Sep 2026) and `draft-ietf-aipref-attach-05` (19 Aug 2026): both WG documents, intended Proposed Standard, IESG state "I-D Exists", so not yet submitted. The vocab marks its §3 and §4 as without consensus. - Each member names the revision it is read at. Any other revision is refused `usage_revision_unknown`, failing closed; a later revision of this extension adds revisions. 2. **The room descriptor's layout is unchanged.** `WRD1` has no extension point. Its readers include `joule-moq-ingest` and every live verifier, so a version bump would have rippled across them. The room's preference is a separate authority-signed record bound to the room id and chained like live-moderation's review policy. That also lets the preference change at an instant without reaching earlier objects (`draft-ietf-aipref-attach-05` §3.3's rule). live-rooms §3.8 says this. 3. **No cross-vocabulary mapping.** A claim must answer every vocabulary the governing statements carry (`usage_unanswered`), each in its own terms. The most restrictive answer governs. This closes picking the most permissive vocabulary without inventing an equivalence table. 4. **A value that does not parse is refused, not read as all-unknown.** The vocabulary reads it as unknown (§6.5.1). A signed statement that silently means nothing is what binding would preserve. The Byte Sequence checks RFC 9651 leaves to parsers are fixed in §3.3. 5. **CAWG `constrained` reads as disallow** absent a grant, per the assertion's §3.1. The CDDL member is `constraint_info`; the assertion's prose spells it `constraints_info`, and §3.4 notes it. 6. `http_binding/receipts.rs` changed, which fires `wai-http`'s falsify shards. The new arm sits so that every committed `*.patch` still applies (`git apply --check` over all of them: 0 fail). ## Checks All cargo runs went through `rb` on the build host. | check | command | result | |---|---|---| | module tests | `cargo test --locked --no-default-features --features ai_usage --lib ai_usage::` | 7 passed | | claim tests (incl. pinned claim corpus) | `cargo test --locked --no-default-features --features ai_usage --lib claim_receipt::` | 30 passed | | corpus test | `cargo test --locked --no-default-features --features ai_usage --test ai_usage` | 4 passed | | lib, CI's cargo-class feature set (incl. `http_binding`, `codecs::registry`, `staged::moq`) | `cargo test --locked --lib --no-default-features --features world,audio_scene,haptic,splat4d,score,provenance,neural_int,film,oer,receipt_claims,key_discovery,staged,video_int,audio_int,splat_int,stage_measure,telemetry,video_package,http` | 841 passed | | conformance dirs | `cargo test --locked --no-default-features --features neural_int,video_int,audio_int,world_int,splat_int --test int_kernels_vectors every_decoded_output` | 1 passed | | registry | `cargo test --locked --no-default-features --lib codecs::registry`; `wai registry export --check` | 14 passed; up to date | | corpus regenerates | `wai_ai_usage_vectors verify ../live-conformance/usage` | PASS, PASS | | clippy | `cargo clippy --locked --no-default-features --features ai_usage,http --all-targets` | no note in any new file | | second implementation | `python3 -I live-conformance/ai_usage_verify.py live-conformance/usage` | all cases; 17 mutations caught; 26 weakened verifiers caught | | claim_verify, class steps 1–4 | `python3 -I claim-conformance/claim_verify.py consumption live-conformance/usage/vectors.json` | 27 claims, 0 failures | | claim_verify, its own corpus | `python3 -I claim-conformance/claim_verify.py` | 567 vectors, 0 failures | | neighbouring verifiers | `live_rooms_verify.py rooms`, `live_moderation_verify.py moderation`, `live_ads_verify.py ads`, `jwp_verify.py`, `http_verify.py http-conformance` | all PASS (1055/1055 HTTP cases) | | repo checks | `check-tests-in-ci.py`, `check-workflow-concurrency.sh`, `check-spec-refs.py`, `check-wai-section-refs.py`, `check-no-vanity-metrics.sh`, `test-public-text-checks.sh`, `check-comparative-prose.sh`, `check-orphan-sources.py` | all exit 0 | | falsify patches | `git apply --check` over every committed `*.patch` | 0 fail | `check-public-names.sh` was not run: its pattern list is a CI secret. ## Falsifications Each was applied uncommitted, run, then restored, with a clean tree after. - **Rust**, through `cargo test --test ai_usage every_case`. Every one fails, naming these cases: - most-restrictive rule dropped: `training_forbidden`, `mining_constrained`, `room_training_unlicensed`, `room_own_and_room`, gates `claim_ahead_disallowed`, `room_agent_disallowed`; - content-hash check dropped: `feature_stripped`, `feature_altered`, `wrong_digests`; - `did:key` rule dropped: `signer_not_principal`; - header compared by parse only: `aipref_contradicts`, `aipref_drops_a_label`; - grant terms ignored: `room_terms_lift`, `room_untimed`, `room_licensed_training`; - Dictionary trailing comma accepted: `aipref_trailing_comma`. - **§9 table row removed:** - `the_extension_lists_the_reasons` fails; - `ai_usage_verify.py` exits 1 (`§9 read from the extension: 20 reasons`). - **claim_verify.py with its seen-order rule removed:** `consumption` mode fails on `seen_unordered`. - **ai_usage_verify.py** applies 17 corpus mutations and drops each of 26 of its own checks in turn. Each is caught by the corpus in the same run. ## Not done - The optional MCP-over-MOQT profile (`draft-jennings-agentproto-mcp-over-moqt-00`, 6 Jul 2026, individual, verified at the datatracker) is not in this PR. §1 lists the agent protocols as out of scope for this revision. - No MOQT carriage for a claim is defined (§7.3). A relay gating over MOQT holds claims given over HTTP. - Claim vectors live in the AI usage corpus, not in `claim-conformance/`. `claim_verify.py` reads them through its new `consumption` mode. - The aipref vocabulary is still a WG draft without consensus on §3–§4. When it moves, a new revision string and corpus refresh are needed. - Not measured: bytes or joules per agent view, and a claim's round trip through a settlement record. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dcharlot added 6 commits 2026-10-21 05:44:47 -04:00

wai.ai.usage: AI usage statements bound to the bytes, the consumption claim class, and its corpus ... 9d8e806438

The usage statement carries draft-ietf-aipref-vocab-08's Structured Field
value, the TDM Reservation Protocol's properties and the Training and Data
Mining Assertion 1.1's entries verbatim. It rides in an envelope's manifest
(signed by the object's receipt), a room's WAU1 record and a grant's terms;
HTTP fields and a MoQ catalog field are checked against it. One precedence
rule: a grant's terms, then the signed statements, most restrictive first.
The jwp-receipts claim class consumption carries an agent's statement of
what it consumed, under which term, having seen which statements; a gate
can require claims before serving an agent.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai.ai.usage: the class in jwp-receipts, the room and HTTP and MoQ bindings, registry, CI and the second implementation ... d1a1fdb6b1

jwp-receipts registers the consumption class (§2.4.13) with its step 4 and
step 6 reasons and its authority; live-rooms gains §3.8 and the ai_usage
grant attribute; http-delivery §5.6 maps the signed statement onto the
Content-Usage and TDMRep fields; moq-streaming-format §4 adds the
wai_ai_usage catalog field. The registry export lists wai.ai.usage, WAU1,
wai_ai_usage and the proposed WAI-Usage-Claim field. ai_usage_verify.py is
the corpus's second implementation, and claim_verify.py reads the class's
steps 1 to 4.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai.ai.usage: changelog, the live-conformance directory description, and plain wording for the gate's window ... 79f54b9dcd

Co-Authored-By: Claude Opus 5.5 <[email protected]>

http-delivery receipts: a consumption claim served beside an object is refused for want of its context, placed so every falsify patch still applies ... d05ecc7d33

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai.ai.usage: let-chains, a boxed claim in a refusal, and type aliases, for a clippy-clean module ... 5f94737784

Co-Authored-By: Claude Opus 5.5 <[email protected]>

ai-usage §4.1: a manifest that does not read holds no statement that can be read ... a7157f691e

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot added 2 commits 2026-10-21 07:52:01 -04:00

Merge origin/main into wai/ai-usage ... 659b1bee9f

Co-Authored-By: Claude Opus 5.5 <[email protected]>

registry export: regenerated after merging main (live provenance + AI usage) ... bbe32a287a

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot added 1 commit 2026-10-21 11:20:37 -04:00

Merge origin/main into wai/ai-usage (synthesis, deriving edge) ... 76261b9295

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot merged commit 8b79b519b7 into main 2026-10-21 11:20:57 -04:00

dcharlot referenced this pull request from a commit 2026-10-21 11:20:58 -04:00

Merge pull request 'wai.ai.usage: AI usage preferences bound to the bytes, and the agent's consumption claim (AG1)' (#386) from wai/ai-usage into main

dcharlot referenced this pull request 2026-10-21 13:18:41 -04:00

wai.bearer.receipts: one receipt on every bearer — transmission and reconciliation claims, the per-receiver bound, offline anchors (T2) #402

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Transaction-Science/open-standards!386

No description provided.