Transaction-Science/open-standards

Watch

Fork 0

wai.bearer.receipts: one receipt on every bearer — transmission and reconciliation claims, the per-receiver bound, offline anchors (T2) #402

Closed

dcharlot wants to merge 0 commits from wai/bearers into main

dcharlot commented

2026-10-21 13:18:41 -04:00

Owner

What this is

T2: the same receipt on every bearer (broadcast and multicast). This PR adds extensions/bearer-receipts.md, which registers the record wai.bearer.receipts, and two jwp-receipts claim classes: transmission (§2.4.14) and reconciliation (§2.4.15). They take the two §x.4.x numbers after AG1's consumption.

The defect it closes. unidirectional-delivery §4 had two pieces of spec text with no mechanism behind them:

It said a receipt for a unidirectional bearer "MUST declare the bearer as unidirectional". No field, class or vector existed for that.
It said a sink's later reconciliation is a claim "under a class registered for it in jwp-receipts §2.4.4, which none yet is".

Both are now built, and §4 is rewritten so its MUST is met and checked.

Design decisions, and why

The bearer is declared beside the receipt, not in it. This settles the tension between "the same receipt on every bearer" and "the receipt MUST declare the bearer". The group and object receipts keep their exact bytes on every bearer. The declaration is a transmission claim with these properties:

It is signed by the group's own key (transmission_signer_mismatch otherwise).
It names the group by its link hash (jwp-receipts §3 step 3), so a declaration over another group is refused (transmission_subject_mismatch).
It gives the bearer class (bidirectional / multicast / unidirectional) and an instance URI.
It carries the transmission's energy with its acquisition class, or null.
It carries attests: "transmitted". Any other value is refused (transmission_not_transmitted).

Why the bearer stays out of the group payload (bearer-receipts §3):

A group can be carried on several bearers at once, and carried again later.
A bearer inside the payload would mean one group per bearer, each with its own link hash, and that breaks the track's chain.
Every receipt already issued keeps verifying.

The corpus carries one group, byte for byte, with one declaration of each class. Both verifiers check that its bytes and its object verdicts are identical across the three.

Reconciliation is a bitmap plus a root under the group's own §2.2 tree.

Every object received: the root is the group's root_hash. It is checked against the group receipt alone.
Some objects received: the root is checked against the object receipts at the set positions (inclusion only, no objects needed). A missing receipt gives reconciliation_objects_not_held, which is recoverable and never accepted.
A root over a leaf that is not the group's gives reconciliation_root_mismatch. That covers "a hash not in the group".
The publisher's own key is refused (reconciliation_by_publisher).
attests: "received" is stated in-band, the same way as binding-recovery's "ancestor".
It is never a hop and never in the publisher's chain.

No status is "delivered". A verifier states a group published, transmitted or reconciled (§6.3):

"Delivered to k sinks" holds only when k distinct keys reconciled every object. Otherwise it fails with delivery_not_reconciled or delivery_exceeds_reconciled. This is the "transmitted-only group presented as delivered" negative control.
delivered-verified stays a sink's own verdict over bytes it holds.

Other verdict rules:

Two declarations of one instance that differ are set aside (bearer_contradicted).
A reconciliation is counted nowhere if its instance is undeclared (bearer_not_declared), contradicted (bearer_contradicted), or, for a relying party counting only confirmed keys, its key is not confirmed (sink_not_confirmed).
A key counts once per instance. A second reconciliation from the same key is joined to the first (reconciliation_duplicate_sink).
A sink reports whether the instance it received over was declared. Its object verdicts never change.

Energy per receiver (§7):

The figure is ⌈joules / max(1, distinct keys counted)⌉, stated at the transmission figure's class.
It is labelled as an upper bound on an allocation, never as a measurement (the same reasoning as energy-steering §3.3's "an allocation, not a reading").
It is never 0. An unmetered transmission gets no bound at all.
It tightens as reconciliations are counted.
It is stated as a count of keys, because keys are not receivers. A relying party that needs a per-receiver figure counts only keys it has confirmed.

Offline (§8). A sink with no return path confirms keys only under anchors provisioned in advance. A key log that arrives over the bearer behaves as follows:

It is held, so a revocation sent over the bearer takes effect.
It never anchors an origin (anchor_on_bearer; confirmation stays origin_not_anchored).
A log forged on the bearer is no child of the pinned line, so the forger's key is refused (key_mismatch).

Bearer mappings (§9).

Normative where WAI controls the bytes:
- envelopes are carried whole;
- receipts and claims travel as http-delivery §8.1 receipt files;
- key logs sit at their path and anchor nothing;
- the declaration rides in the same session as the group's receipts.
Informative for the rest. Each standard was fetched and read at its current published edition, and each edition is recorded in the extension's header:
- RFC 6726
- ETSI TS 103 769 V1.2.1 (2024-11)
- ETSI TS 103 770 V1.2.1 (2024-09)
- ATSC A/331:2026-04, A/333:2026-04, A/360:2026-08
- 3GPP TS 26.346 V19.3.0, TS 26.517 V19.3.0, TS 26.502 V19.6.0
- draft-ramadan-moq-multicast-00; no MoQ working-group draft, draft-ietf-moq-transport-22 among them, mentions multicast
- ETSI TS 102 796 V1.8.1 (2026-09; HbbTV 2.0.5), which does add WebAssembly (A.3.28, Annex R)
For each bearer, §9 states what reconciliation path it has. None of their reporting procedures identifies objects with a signature, so a reconciliation travels beside them as a receipt file.

Over HTTP (http-delivery §8.2). A transmission or reconciliation claim listed in a receipt index is now checked at step 6 against the group of an item that passed. Before this, it would have fallen through to "accepted after step 5". A reconciliation naming an object the index does not list gives context_not_held. Both wai-rs and http_receipts.py implement this.

Files

wai/extensions/bearer-receipts.md (new). jwp-receipts.md: §1, §2.4.4, §2.4.14, §2.4.15, §3.1 steps 2/4/6 and the reasons table, §7.5 table and bullets. unidirectional-delivery.md §3–§4. http-delivery.md §8.2.
wai-rs:
- claim_receipt/bearer.rs: bodies, steps 2/4/6.
- claim_receipt.rs and session.rs: the classes wired in; the figure authority covers transmission.
- bearer_receipts.rs and bearer_receipts/corpus.rs: feature bearer_receipts.
- bin/wai_bearer_vectors.rs and tests/bearer_receipts.rs.
- http_binding/receipts.rs and tests_receipts.rs.
- registry row.
Corpus wai/live-conformance/bearers/ (vectors.json, README with a **Provenance.** line), covered by the live-conformance entry in int_kernels_vectors.rs.
Python:
- live-conformance/bearer_verify.py (new).
- claim-conformance/claim_verify.py: the classes, plus a bearer mode.
- signer-conformance/signer_verify.py: the transmission figure's authority.
- http-conformance/http_receipts.py: step 6.
SPEC §5 paragraph, REGISTRY.md, the regenerated registry export (capabilities.json, vocab/v2.ttl), CHANGELOG, a .github/workflows/wai-conformance.yml step and path, and live-conformance/README.md.

Checks

The build host was reached via rb; light checks ran locally.

check	command	result
bearer unit tests	`cargo test --no-default-features --features bearer_receipts --lib bearer`	7 passed
bearer corpus test	`cargo test --no-default-features --features bearer_receipts --test bearer_receipts`	4 passed (regenerates byte for byte; every case gets its stated outcome; §10 lists exactly `CODES`; jwp-receipts §3.1 lists the class codes at their steps)
corpus verify	`wai_bearer_vectors verify ../live-conformance/bearers`	PASS / PASS
claim, key log, JWP	`cargo test --no-default-features --features key_discovery --lib claim_receipt` / `key_log` / `jwp_delivery`	33 / 26 / 41 passed
claim and signer corpora	`wai_claim_vectors verify ../claim-conformance`, `wai_signer_vectors verify ../signer-conformance`	all vectors pass (the claim corpus is unchanged)
HTTP	`cargo test --no-default-features --features http,video_manifest,key_discovery --lib http_binding`	101 passed (includes the new `bearer_claims_are_checked_against_the_group_of_an_item`)
HTTP corpus and differential	`wai_http_vectors verify ../http-conformance`; `wai_http_vectors fuzz … --seed 11/12 --count 400` then `http_verify.py cases …`	1055/1055 cases; 11200/11200 agree (both seeds)
AI usage (shares `claim_receipt`)	`cargo test … --features ai_usage --test ai_usage`, `--lib claim_receipt::consumption::`	4 passed, 2 passed
registry	`cargo test --no-default-features --lib codecs::registry`; `wai registry export --check`	14 passed; up to date
corpus rules	`cargo test --test corpus_provenance`; `int_kernels_vectors every_decoded_output_states_a_sha256`	pass
wasm	`cargo build --lib --target wasm32-unknown-unknown --no-default-features --features receipt_claims,stage_measure`	builds
clippy `--all-targets`	`bearer_receipts`, `http,video_manifest,key_discovery`, `ai_usage`	no new note on any touched line. The one remaining note on these lines, `large_enum_variant` on `ClaimBody`, is on `origin/main` too (checked on a detached `origin/main` worktree)
second implementation	`python3 -I live-conformance/bearer_verify.py live-conformance/bearers`	40 cases + 8 offline cases, 0 failures; 11/11 mutated copies fail; 12/12 weakened verifiers caught
claim steps 1–4	`python3 -I claim-conformance/claim_verify.py bearer live-conformance/bearers/vectors.json`	72 bearer claims, 0 failures
shared-text verifiers	every `live-conformance/*_verify.py` step in the workflow, plus `edge_verify.py`, `claim_verify.py`, `signer_verify.py`, `jwp_verify.py`, `http_verify.py`	all pass
repo checks	`check-tests-in-ci.py`, `check-workflow-concurrency.sh`, `check-spec-refs.py`, `check-wai-section-refs.py`, `check-no-vanity-metrics.sh`, `test-public-text-checks.sh`, `check-comparative-prose.sh`, `check-orphan-sources.py`	all clean

Lock files: no dependency was added, so no Cargo.lock changes. No src/ffi*.rs or cbindgen.toml change, so include/wai.h is unaffected.

Falsifications

Each was run after committing. A single defect was applied inside the build-host snapshot, the guarding check was run, and the file was restored.

defect	guarding check	exit
a reconciliation by the publisher accepted	`--test bearer_receipts`	101
the bound rounds down	`--test bearer_receipts`	101
a key log on the bearer anchors	`--test bearer_receipts`	101
contradicting declarations both stand	`--test bearer_receipts`	101
a bitmap bit past the leaf count passes	`--lib bearer`	101
"delivered" holds with no whole sink	`--test bearer_receipts`	101
HTTP: a transmission claim accepted after step 5	`--lib bearer_claims_are_checked`	101
a row dropped from the extension's §10	`--test bearer_receipts`	101
a class code renamed in jwp-receipts §3.1	`--test bearer_receipts`	101
the committed corpus edited	`--test bearer_receipts`	101
`claim_verify.py` loses the bitmap rule and the `attests` rule	`claim_verify.py bearer`	1 (2 failures)
a bad section reference added to the extension	`check-wai-section-refs.py`	reported

bearer_verify.py runs its own falsification every time:

11 mutated copies of the corpus (a re-rooted reconciliation, an altered bound, status or assertion, a receipt changed in one same-receipt case, a dropped claim, a bearer log relabelled pinned, a duplicate counted, a 0 bound for an unmetered transmission, a sink's bearer changed, a reason removed). Each must fail.
12 weakened verifiers, each dropping one of its own checks (subject, signer, by-publisher, objects held, root, contradiction, undeclared, duplicate, whole, ceiling, delivered, anchor-on-bearer). Each must be caught.

Not done, and open items

Claims on a MoQ track. This revision defines no carriage of claims on a track (§9.1 says so); they travel as receipt files.
HTTP corpus. http-conformance has no vector with a transmission or reconciliation claim. The HTTP step 6 is covered by a wai-rs unit test, and the Python path in http_receipts.py has no corpus case.
Measurement claims about a transmission figure. There is no figure_view for a transmission claim's figure, so no measurement claim can name one.
A gap left by #386 (AI usage), not changed here. Over HTTP, http_receipts.py accepts a consumption claim after step 5, while wai-rs returns context_not_held. No corpus case exercises it.

Owner decisions (not taken):

Any liaison with the bodies whose reporting could carry a reconciliation's link hash: DVB MABR service reporting, ATSC A/333, 3GPP MBMS reception reporting, and the MoQ multicast draft's author.
Whether a deployment's sinks may reconcile without user consent. The spec says SHOULD NOT where the user is identifiable.
No pre-emption authority is registered. That stays out of scope.

🤖 Generated with Claude Code

Closed: Landed in #428 (merge train, merged as aa61ab3b with all 65 checks green).

## What this is **T2: the same receipt on every bearer (broadcast and multicast).** This PR adds `extensions/bearer-receipts.md`, which registers the record `wai.bearer.receipts`, and two jwp-receipts claim classes: `transmission` (§2.4.14) and `reconciliation` (§2.4.15). They take the two §x.4.x numbers after AG1's `consumption`. **The defect it closes.** unidirectional-delivery §4 had two pieces of spec text with no mechanism behind them: - It said a receipt for a unidirectional bearer "MUST declare the bearer as unidirectional". No field, class or vector existed for that. - It said a sink's later reconciliation is a `claim` "under a class registered for it in jwp-receipts §2.4.4, which none yet is". Both are now built, and §4 is rewritten so its MUST is met and checked. ## Design decisions, and why **The bearer is declared beside the receipt, not in it.** This settles the tension between "the same receipt on every bearer" and "the receipt MUST declare the bearer". The group and object receipts keep their exact bytes on every bearer. The declaration is a `transmission` claim with these properties: - It is signed by the group's own key (`transmission_signer_mismatch` otherwise). - It names the group by its link hash (jwp-receipts §3 step 3), so a declaration over another group is refused (`transmission_subject_mismatch`). - It gives the bearer class (`bidirectional` / `multicast` / `unidirectional`) and an instance URI. - It carries the transmission's energy with its acquisition class, or `null`. - It carries `attests: "transmitted"`. Any other value is refused (`transmission_not_transmitted`). Why the bearer stays out of the group payload (bearer-receipts §3): - A group can be carried on several bearers at once, and carried again later. - A bearer inside the payload would mean one group per bearer, each with its own link hash, and that breaks the track's chain. - Every receipt already issued keeps verifying. The corpus carries one group, byte for byte, with one declaration of each class. Both verifiers check that its bytes and its object verdicts are identical across the three. **Reconciliation is a bitmap plus a root under the group's own §2.2 tree.** - Every object received: the root is the group's `root_hash`. It is checked against the group receipt alone. - Some objects received: the root is checked against the object receipts at the set positions (inclusion only, no objects needed). A missing receipt gives `reconciliation_objects_not_held`, which is recoverable and never accepted. - A root over a leaf that is not the group's gives `reconciliation_root_mismatch`. That covers "a hash not in the group". - The publisher's own key is refused (`reconciliation_by_publisher`). - `attests: "received"` is stated in-band, the same way as `binding-recovery`'s `"ancestor"`. - It is never a hop and never in the publisher's chain. **No status is "delivered".** A verifier states a group `published`, `transmitted` or `reconciled` (§6.3): - "Delivered to *k* sinks" holds only when *k* distinct keys reconciled every object. Otherwise it fails with `delivery_not_reconciled` or `delivery_exceeds_reconciled`. This is the "transmitted-only group presented as delivered" negative control. - `delivered-verified` stays a sink's own verdict over bytes it holds. Other verdict rules: - Two declarations of one instance that differ are set aside (`bearer_contradicted`). - A reconciliation is counted nowhere if its instance is undeclared (`bearer_not_declared`), contradicted (`bearer_contradicted`), or, for a relying party counting only confirmed keys, its key is not confirmed (`sink_not_confirmed`). - A key counts once per instance. A second reconciliation from the same key is joined to the first (`reconciliation_duplicate_sink`). - A sink reports whether the instance it received over was declared. Its object verdicts never change. **Energy per receiver (§7):** - The figure is `⌈joules / max(1, distinct keys counted)⌉`, stated at the transmission figure's class. - It is labelled as an upper bound on an allocation, never as a measurement (the same reasoning as energy-steering §3.3's "an allocation, not a reading"). - It is never 0. An unmetered transmission gets no bound at all. - It tightens as reconciliations are counted. - It is stated as a count of keys, because keys are not receivers. A relying party that needs a per-receiver figure counts only keys it has confirmed. **Offline (§8).** A sink with no return path confirms keys only under anchors provisioned in advance. A key log that arrives over the bearer behaves as follows: - It is held, so a revocation sent over the bearer takes effect. - It never anchors an origin (`anchor_on_bearer`; confirmation stays `origin_not_anchored`). - A log forged on the bearer is no child of the pinned line, so the forger's key is refused (`key_mismatch`). **Bearer mappings (§9).** - Normative where WAI controls the bytes: - envelopes are carried whole; - receipts and claims travel as http-delivery §8.1 receipt files; - key logs sit at their path and anchor nothing; - the declaration rides in the same session as the group's receipts. - Informative for the rest. Each standard was fetched and read at its current published edition, and each edition is recorded in the extension's header: - RFC 6726 - ETSI TS 103 769 V1.2.1 (2024-11) - ETSI TS 103 770 V1.2.1 (2024-09) - ATSC A/331:2026-04, A/333:2026-04, A/360:2026-08 - 3GPP TS 26.346 V19.3.0, TS 26.517 V19.3.0, TS 26.502 V19.6.0 - `draft-ramadan-moq-multicast-00`; no MoQ working-group draft, `draft-ietf-moq-transport-22` among them, mentions multicast - ETSI TS 102 796 V1.8.1 (2026-09; HbbTV 2.0.5), which does add WebAssembly (A.3.28, Annex R) - For each bearer, §9 states what reconciliation path it has. None of their reporting procedures identifies objects with a signature, so a reconciliation travels beside them as a receipt file. **Over HTTP (http-delivery §8.2).** A transmission or reconciliation claim listed in a receipt index is now checked at step 6 against the group of an item that passed. Before this, it would have fallen through to "accepted after step 5". A reconciliation naming an object the index does not list gives `context_not_held`. Both `wai-rs` and `http_receipts.py` implement this. ## Files - `wai/extensions/bearer-receipts.md` (new). `jwp-receipts.md`: §1, §2.4.4, §2.4.14, §2.4.15, §3.1 steps 2/4/6 and the reasons table, §7.5 table and bullets. `unidirectional-delivery.md` §3–§4. `http-delivery.md` §8.2. - `wai-rs`: - `claim_receipt/bearer.rs`: bodies, steps 2/4/6. - `claim_receipt.rs` and `session.rs`: the classes wired in; the figure authority covers transmission. - `bearer_receipts.rs` and `bearer_receipts/corpus.rs`: feature `bearer_receipts`. - `bin/wai_bearer_vectors.rs` and `tests/bearer_receipts.rs`. - `http_binding/receipts.rs` and `tests_receipts.rs`. - registry row. - Corpus `wai/live-conformance/bearers/` (`vectors.json`, README with a `**Provenance.**` line), covered by the `live-conformance` entry in `int_kernels_vectors.rs`. - Python: - `live-conformance/bearer_verify.py` (new). - `claim-conformance/claim_verify.py`: the classes, plus a `bearer` mode. - `signer-conformance/signer_verify.py`: the transmission figure's authority. - `http-conformance/http_receipts.py`: step 6. - SPEC §5 paragraph, REGISTRY.md, the regenerated registry export (`capabilities.json`, `vocab/v2.ttl`), CHANGELOG, a `.github/workflows/wai-conformance.yml` step and path, and `live-conformance/README.md`. ## Checks The build host was reached via `rb`; light checks ran locally. | check | command | result | |---|---|---| | bearer unit tests | `cargo test --no-default-features --features bearer_receipts --lib bearer` | 7 passed | | bearer corpus test | `cargo test --no-default-features --features bearer_receipts --test bearer_receipts` | 4 passed (regenerates byte for byte; every case gets its stated outcome; §10 lists exactly `CODES`; jwp-receipts §3.1 lists the class codes at their steps) | | corpus verify | `wai_bearer_vectors verify ../live-conformance/bearers` | PASS / PASS | | claim, key log, JWP | `cargo test --no-default-features --features key_discovery --lib claim_receipt` / `key_log` / `jwp_delivery` | 33 / 26 / 41 passed | | claim and signer corpora | `wai_claim_vectors verify ../claim-conformance`, `wai_signer_vectors verify ../signer-conformance` | all vectors pass (the claim corpus is unchanged) | | HTTP | `cargo test --no-default-features --features http,video_manifest,key_discovery --lib http_binding` | 101 passed (includes the new `bearer_claims_are_checked_against_the_group_of_an_item`) | | HTTP corpus and differential | `wai_http_vectors verify ../http-conformance`; `wai_http_vectors fuzz … --seed 11/12 --count 400` then `http_verify.py cases …` | 1055/1055 cases; 11200/11200 agree (both seeds) | | AI usage (shares `claim_receipt`) | `cargo test … --features ai_usage --test ai_usage`, `--lib claim_receipt::consumption::` | 4 passed, 2 passed | | registry | `cargo test --no-default-features --lib codecs::registry`; `wai registry export --check` | 14 passed; up to date | | corpus rules | `cargo test --test corpus_provenance`; `int_kernels_vectors every_decoded_output_states_a_sha256` | pass | | wasm | `cargo build --lib --target wasm32-unknown-unknown --no-default-features --features receipt_claims,stage_measure` | builds | | clippy `--all-targets` | `bearer_receipts`, `http,video_manifest,key_discovery`, `ai_usage` | no new note on any touched line. The one remaining note on these lines, `large_enum_variant` on `ClaimBody`, is on `origin/main` too (checked on a detached `origin/main` worktree) | | second implementation | `python3 -I live-conformance/bearer_verify.py live-conformance/bearers` | 40 cases + 8 offline cases, 0 failures; 11/11 mutated copies fail; 12/12 weakened verifiers caught | | claim steps 1–4 | `python3 -I claim-conformance/claim_verify.py bearer live-conformance/bearers/vectors.json` | 72 bearer claims, 0 failures | | shared-text verifiers | every `live-conformance/*_verify.py` step in the workflow, plus `edge_verify.py`, `claim_verify.py`, `signer_verify.py`, `jwp_verify.py`, `http_verify.py` | all pass | | repo checks | `check-tests-in-ci.py`, `check-workflow-concurrency.sh`, `check-spec-refs.py`, `check-wai-section-refs.py`, `check-no-vanity-metrics.sh`, `test-public-text-checks.sh`, `check-comparative-prose.sh`, `check-orphan-sources.py` | all clean | Lock files: no dependency was added, so no `Cargo.lock` changes. No `src/ffi*.rs` or `cbindgen.toml` change, so `include/wai.h` is unaffected. ## Falsifications Each was run after committing. A single defect was applied inside the build-host snapshot, the guarding check was run, and the file was restored. | defect | guarding check | exit | |---|---|---| | a reconciliation by the publisher accepted | `--test bearer_receipts` | 101 | | the bound rounds down | `--test bearer_receipts` | 101 | | a key log on the bearer anchors | `--test bearer_receipts` | 101 | | contradicting declarations both stand | `--test bearer_receipts` | 101 | | a bitmap bit past the leaf count passes | `--lib bearer` | 101 | | "delivered" holds with no whole sink | `--test bearer_receipts` | 101 | | HTTP: a transmission claim accepted after step 5 | `--lib bearer_claims_are_checked` | 101 | | a row dropped from the extension's §10 | `--test bearer_receipts` | 101 | | a class code renamed in jwp-receipts §3.1 | `--test bearer_receipts` | 101 | | the committed corpus edited | `--test bearer_receipts` | 101 | | `claim_verify.py` loses the bitmap rule and the `attests` rule | `claim_verify.py bearer` | 1 (2 failures) | | a bad section reference added to the extension | `check-wai-section-refs.py` | reported | `bearer_verify.py` runs its own falsification every time: - 11 mutated copies of the corpus (a re-rooted reconciliation, an altered bound, status or assertion, a receipt changed in one same-receipt case, a dropped claim, a bearer log relabelled pinned, a duplicate counted, a 0 bound for an unmetered transmission, a sink's bearer changed, a reason removed). Each must fail. - 12 weakened verifiers, each dropping one of its own checks (subject, signer, by-publisher, objects held, root, contradiction, undeclared, duplicate, whole, ceiling, delivered, anchor-on-bearer). Each must be caught. ## Not done, and open items - **Claims on a MoQ track.** This revision defines no carriage of claims on a track (§9.1 says so); they travel as receipt files. - **HTTP corpus.** `http-conformance` has no vector with a transmission or reconciliation claim. The HTTP step 6 is covered by a `wai-rs` unit test, and the Python path in `http_receipts.py` has no corpus case. - **Measurement claims about a transmission figure.** There is no `figure_view` for a transmission claim's figure, so no measurement claim can name one. - **A gap left by #386 (AI usage), not changed here.** Over HTTP, `http_receipts.py` accepts a `consumption` claim after step 5, while `wai-rs` returns `context_not_held`. No corpus case exercises it. **Owner decisions (not taken):** - Any liaison with the bodies whose reporting could carry a reconciliation's link hash: DVB MABR service reporting, ATSC A/333, 3GPP MBMS reception reporting, and the MoQ multicast draft's author. - Whether a deployment's sinks may reconcile without user consent. The spec says SHOULD NOT where the user is identifiable. - No pre-emption authority is registered. That stays out of scope. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- **Closed:** Landed in #428 (merge train, merged as aa61ab3b with all 65 checks green).

dcharlot added 8 commits

2026-10-21 13:18:41 -04:00

wai: bearer-receipts — one receipt on every bearer; transmission and reconciliation claim classes (spec text) e111604c92

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai-rs: bearer_receipts — transmission and reconciliation classes, the verdict over a group, the per-receiver bound, offline confirmation (WIP) f518786987

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: bearer receipts corpus, second implementation, HTTP index step 6, registry, SPEC §5, CHANGELOG, CI step 70cc5ee033

Co-Authored-By: Claude Opus 5.5 <[email protected]>

registry export: wai.bearer.receipts 30411237e2

Co-Authored-By: Claude Opus 5.5 <[email protected]>

bearer_receipts corpus: name the declared line's type df840a85f1

Co-Authored-By: Claude Opus 5.5 <[email protected]>

http-delivery §8.2: transmission and reconciliation claims in a receipt index are checked against the item's group (test) 0e2a693d09

Co-Authored-By: Claude Opus 5.5 <[email protected]>

bearer-receipts: claims on a track, unread bearer logs, DVB-I identifiers, the bound's wording 6c23f14185

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge origin/main into wai/bearers

WAI HTTP delivery / WAI HTTP · does this change touch it (pull_request) Has been cancelled

Details

WAI HTTP delivery / HTTP corpus · falsify mutations 0/3 (pull_request) Has been cancelled

Details

WAI HTTP delivery / HTTP corpus · falsify mutations 1/3 (pull_request) Has been cancelled

Details

WAI HTTP delivery / HTTP corpus · falsify mutations 2/3 (pull_request) Has been cancelled

Details

WAI HTTP delivery / HTTP corpus · falsify patches 0/3 (pull_request) Has been cancelled

Details

WAI HTTP delivery / HTTP corpus · falsify patches 1/3 (pull_request) Has been cancelled

Details

WAI HTTP delivery / HTTP corpus · falsify patches 2/3 (pull_request) Has been cancelled

Details

WAI HTTP delivery / HTTP corpus · every patch and mutation in exactly one shard (pull_request) Has been cancelled

Details

WAI HTTP delivery / HTTP corpus · verified both ways, and the differential (pull_request) Has been cancelled

Details

WAI HTTP delivery / cache rules · controls and labelled caches (pull_request) Has been cancelled

Details

WAI neural sink gates / does this change touch it (pull_request) Has been cancelled

Details

WAI neural sink gates / model-free refusals of the neural sink (pull_request) Has been cancelled

Details

wai-ops-gpu integer operators on GPUs / does this change touch it (pull_request) Has been cancelled

Details

wai-ops-gpu integer operators on GPUs / builds · no adapter is not a pass (linux) (pull_request) Has been cancelled

Details

wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Has been cancelled

Details

wai-pack / wai-pack · does this change touch it (pull_request) Has been cancelled

Details

wai-pack / wai-pack · linux (pull_request) Has been cancelled

Details

wai-pack / wai-pack · linux-arm64 (pull_request) Has been cancelled

Details

wai-pack / wai-pack · macos (pull_request) Has been cancelled

Details

wai-pack / wai-pack · independent verifier (Python) (pull_request) Has been cancelled

Details

wai-pack / wai-pack · the floor through a media prober (pull_request) Has been cancelled

Details

wai-pack / wai-pack · dependency licences (pull_request) Has been cancelled

Details

wai-quantum studio and desktop / does this change touch it (pull_request) Has been cancelled

Details

wai-quantum studio and desktop / studio · browser (pull_request) Has been cancelled

Details

wai-quantum studio and desktop / desktop app · macos (pull_request) Has been cancelled

Details

wai-web reach builds / wai-web reach · does this change touch it (pull_request) Has been cancelled

Details

wai-web reach builds / wai-web reach builds · the package of record, every output as recorded (pull_request) Has been cancelled

Details

wai-web reach builds / wai-web reach builds · this tree's wai-web, every rung on its engine line (pull_request) Has been cancelled

Details

wai-web wasm32 / does this change touch it (pull_request) Has been cancelled

Details

wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Has been cancelled

Details

f03eda72bc

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot added 1 commit

2026-10-21 13:27:48 -04:00

bearer-receipts §12: no consent rule of its own; a lawful basis is the distributor's

standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 4m45s

Details

WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Successful in 17s

Details

WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Successful in 11s

Details

WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Successful in 27s

Details

joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Successful in 6m31s

Details

WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Successful in 1m58s

Details

WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Successful in 15m30s

Details

WAI energy receipts / energy receipts · linux-arm64 (pull_request) Successful in 6m57s

Details

WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Successful in 27m40s

Details

WAI HTTP delivery / HTTP corpus · falsify mutations 0/3 (pull_request) Successful in 48m12s

Details

WAI HTTP delivery / HTTP corpus · falsify mutations 1/3 (pull_request) Successful in 47m28s

Details

WAI HTTP delivery / HTTP corpus · falsify patches 0/3 (pull_request) Successful in 5m50s

Details

WAI HTTP delivery / HTTP corpus · falsify patches 1/3 (pull_request) Successful in 7m15s

Details

WAI HTTP delivery / HTTP corpus · every patch and mutation in exactly one shard (pull_request) Successful in 15s

Details

WAI HTTP delivery / HTTP corpus · falsify patches 2/3 (pull_request) Failing after 6m40s

Details

WAI HTTP delivery / cache rules · controls and labelled caches (pull_request) Successful in 1m12s

Details

WAI HTTP delivery / HTTP corpus · verified both ways, and the differential (pull_request) Successful in 2m58s

Details

WAI HTTP delivery / HTTP corpus · falsify mutations 2/3 (pull_request) Successful in 48m45s

Details

wai-pack / wai-pack · the floor through a media prober (pull_request) Successful in 40s

Details

wai-pack / wai-pack · linux-arm64 (pull_request) Successful in 1m14s

Details

wai-pack / wai-pack · dependency licences (pull_request) Successful in 1m15s

Details

wai-pack / wai-pack · independent verifier (Python) (pull_request) Successful in 4m14s

Details

standards workspaces build + test / macOS energy backends (pull_request) Successful in 7m55s

Details

WAI conformance / cargo-class corpora · macos (pull_request) Successful in 13m33s

Details

WAI conformance / cross-arch byte-equality · macos (pull_request) Successful in 22s

Details

WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Successful in 46s

Details

WAI energy receipts / energy receipts · macos (pull_request) Successful in 4m29s

Details

wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Successful in 2m31s

Details

wai-pack / wai-pack · macos (pull_request) Successful in 1m6s

Details

wai-quantum studio and desktop / desktop app · macos (pull_request) Successful in 2m17s

Details

330eef204a

Reconciling is part of the delivery service a distributor operates over WAI.
The section still says what a reconciliation discloses and to whom, keeps the
fresh-key option, and points a distributor that a regime asks for a lawful
basis to the lawful-basis claim (jwp-receipts §2.4.6).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot referenced this pull request

2026-10-21 15:41:22 -04:00

wai.age.assurance: ratings carried through derivations, admission by an age threshold without identity, and the minors' profile (AGE) #409

dcharlot added 1 commit

2026-10-21 19:04:55 -04:00

http falsify: session-accepted re-cut against step6 with the bearer classes beside it

WAI energy receipts / energy receipts · linux (pull_request) Successful in 10m13s

Details

WAI neural sink gates / model-free refusals of the neural sink (pull_request) Successful in 1m20s

Details

WAI conformance / cargo-class corpora · linux (pull_request) Successful in 18m50s

Details

wai-ops-gpu integer operators on GPUs / builds · no adapter is not a pass (linux) (pull_request) Successful in 1m54s

Details

wai-pack / wai-pack · linux (pull_request) Successful in 1m36s

Details

WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Successful in 29m20s

Details

wai-quantum studio and desktop / studio · browser (pull_request) Successful in 2m36s

Details

wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Successful in 4m20s

Details

WAI HTTP delivery / HTTP corpus · falsify mutations 0/3 (pull_request) Successful in 48m58s

Details

WAI HTTP delivery / HTTP corpus · falsify mutations 1/3 (pull_request) Successful in 47m33s

Details

WAI HTTP delivery / HTTP corpus · falsify patches 0/3 (pull_request) Successful in 6m45s

Details

WAI HTTP delivery / HTTP corpus · falsify patches 1/3 (pull_request) Successful in 6m13s

Details

WAI HTTP delivery / HTTP corpus · every patch and mutation in exactly one shard (pull_request) Successful in 4s

Details

WAI HTTP delivery / HTTP corpus · falsify mutations 2/3 (pull_request) Successful in 46m36s

Details

WAI HTTP delivery / HTTP corpus · falsify patches 2/3 (pull_request) Successful in 6m0s

Details

WAI HTTP delivery / HTTP corpus · verified both ways, and the differential (pull_request) Successful in 2m38s

Details

WAI HTTP delivery / cache rules · controls and labelled caches (pull_request) Successful in 1m10s

Details

wai-pack / wai-pack · the floor through a media prober (pull_request) Successful in 22s

Details

wai-pack / wai-pack · linux-arm64 (pull_request) Successful in 1m16s

Details

wai-pack / wai-pack · dependency licences (pull_request) Successful in 1m14s

Details

wai-pack / wai-pack · independent verifier (Python) (pull_request) Successful in 4m12s

Details

joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Successful in 6m23s

Details

wai-quantum studio and desktop / desktop app · macos (pull_request) Has been cancelled

Details

wai-pack / wai-pack · macos (pull_request) Has been cancelled

Details

wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Has been cancelled

Details

WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled

Details

WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled

Details

WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled

Details

WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled

Details

standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled

Details

de88226c00

The transmission and reconciliation arms now follow the reconstruct-session arm
in receipts::step6, so the patch's context no longer matched and the falsify
shard refused it. Same one-line mutation, same case it must fail.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot referenced this pull request from a commit

2026-10-22 03:27:41 -04:00

Merge #402 (bearers) into the train

dcharlot referenced this pull request

2026-10-22 03:27:47 -04:00

wai merge train: eleven slices (#402 #411 #421 #408 #409 #419 #410 #424 #420 #413 #401) #428

dcharlot referenced this pull request from a commit

2026-10-22 11:20:01 -04:00

Merge pull request 'wai merge train: eleven slices (#402 #411 #421 #408 #409 #419 #410 #424 #420 #413 #401)' (#428) from train/wai-2026-10-22 into main

dcharlot closed this pull request

2026-10-22 12:01:56 -04:00

joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Successful in 6s

Details

joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Successful in 4s

Details

wai-web reach builds / wai-web reach · does this change touch it (pull_request) Successful in 5s

Details

wai-web reach builds / wai-web reach builds · the package of record, every output as recorded (pull_request) Successful in 2m58s

Details

wai-web reach builds / wai-web reach builds · this tree's wai-web, every rung on its engine line (pull_request) Successful in 4m43s

Details

standards workspaces build + test / which workspaces this change touches (pull_request) Successful in 7s

Details

WAI conformance / does this change touch it (pull_request) Successful in 6s

Details

WAI energy receipts / does this change touch it (pull_request) Successful in 5s

Details

WAI HTTP delivery / WAI HTTP · does this change touch it (pull_request) Successful in 5s

Details

WAI neural sink gates / does this change touch it (pull_request) Successful in 11s

Details

wai-ops-gpu integer operators on GPUs / does this change touch it (pull_request) Successful in 6s

Details

repository checks / lockfiles, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Successful in 58s

Details

wai-pack / wai-pack · does this change touch it (pull_request) Successful in 7s

Details

wai-quantum studio and desktop / does this change touch it (pull_request) Successful in 16s

Details

wai-web wasm32 / does this change touch it (pull_request) Successful in 28s

Details

joule-moq-room room service / joule-moq-room, every target (pull_request) Successful in 1m17s

Details

standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 3m53s

Details

WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Successful in 18s

Details

WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Successful in 11s

Details

WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Successful in 26s

Details

WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Successful in 2m1s

Details

WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Successful in 2m5s

Details

WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Successful in 16m31s

Details

WAI conformance / cross-arch byte-equality · linux (pull_request) Successful in 26s

Details

WAI energy receipts / energy receipts · linux-arm64 (pull_request) Successful in 7m7s

Details

WAI energy receipts / energy receipts · linux (pull_request) Successful in 10m13s

Details

WAI neural sink gates / model-free refusals of the neural sink (pull_request) Successful in 1m20s

Details

WAI conformance / cargo-class corpora · linux (pull_request) Successful in 18m50s

Details

wai-ops-gpu integer operators on GPUs / builds · no adapter is not a pass (linux) (pull_request) Successful in 1m54s

Details

wai-pack / wai-pack · linux (pull_request) Successful in 1m36s

Details

WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Successful in 29m20s

Details

wai-quantum studio and desktop / studio · browser (pull_request) Successful in 2m36s

Details

wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Successful in 4m20s

Details

WAI HTTP delivery / HTTP corpus · falsify mutations 0/3 (pull_request) Successful in 48m58s

Details

WAI HTTP delivery / HTTP corpus · falsify mutations 1/3 (pull_request) Successful in 47m33s

Details

WAI HTTP delivery / HTTP corpus · falsify patches 0/3 (pull_request) Successful in 6m45s

Details

WAI HTTP delivery / HTTP corpus · falsify patches 1/3 (pull_request) Successful in 6m13s

Details

WAI HTTP delivery / HTTP corpus · every patch and mutation in exactly one shard (pull_request) Successful in 4s

Details

WAI HTTP delivery / HTTP corpus · falsify mutations 2/3 (pull_request) Successful in 46m36s

Details

WAI HTTP delivery / HTTP corpus · falsify patches 2/3 (pull_request) Successful in 6m0s

Details

WAI HTTP delivery / HTTP corpus · verified both ways, and the differential (pull_request) Successful in 2m38s

Details

WAI HTTP delivery / cache rules · controls and labelled caches (pull_request) Successful in 1m10s

Details

wai-pack / wai-pack · the floor through a media prober (pull_request) Successful in 22s

Details

wai-pack / wai-pack · linux-arm64 (pull_request) Successful in 1m16s

Details

wai-pack / wai-pack · dependency licences (pull_request) Successful in 1m14s

Details

wai-pack / wai-pack · independent verifier (Python) (pull_request) Successful in 4m12s

Details

joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Successful in 6m23s

Details

wai-quantum studio and desktop / desktop app · macos (pull_request) Has been cancelled

Details

wai-pack / wai-pack · macos (pull_request) Has been cancelled

Details

wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Has been cancelled

Details

WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled

Details

WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled

Details

WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled

Details

WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled

Details

standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled

Details

Pull request closed

Please reopen this pull request to perform a merge.

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Transaction-Science/open-standards!402

No description provided.

Rows
Columns