Transaction-Science/open-standards
Watch
1
0
Fork
You've already forked open-standards
 0
Code Issues Pull requests Projects Releases 15 Packages Wiki Activity Actions

wai.live.coperformance: intents, turns and audience co-creation in rooms (CO4) #410

Closed
dcharlot wants to merge 0 commits from wai/co-performance into main
pull from: wai/co-performance
merge into: Transaction-Science:main
Conversation 0 Commits - Files changed -
dcharlot commented 2026-10-21 15:59:52 -04:00
Owner
Copy link

What this is

CO4: live co-performance in rooms. A new extension, wai/extensions/co-performance.md, registers the record wai.live.coperformance: people and AI participants performing together in a room, and an audience joining in.

  • Policy. The room authority signs a co-performance policy, WPP1, chained by the instant it takes effect (shaped like live-moderation's WMP1 and ai-usage's WAU1): the intent horizon, the match window, the tolerances of the pinned rules, and the turn modes a schedule may state.
  • Intents (WPI1, §5). A participant announces the material it will play, ahead of the instant it plays and within a short horizon: an object by the digest of its payload, notes, a text line, or a camera move. The intents ride the participant's events track, so every subscriber gets them before the material plays. A verifier finds what played and compares it under a pinned rule: digests equal, notes with equal pitches and onsets and durations within the tolerance, text equal byte for byte, a camera within the angle tolerance. The result is kept, diverged or missed. A room key's fidelity statement (WPF1) gives each participant's counts, and the verifier recomputes it as of the statement's instant (fidelity_mismatch).
  • Turns (§6). A schedule (WPT1) gives the floor in turns of microseconds or of bars at a stated tempo. Holders take turns in order, solo or as call-and-response pairs, and a handover (WPH1) passes a turn from a given instant. Each schedule states its mode:
    • refuse: the relay does not forward an out-of-turn object (turn_violated);
    • mark: the relay forwards it and the room clock signs a mark (WPM1, turn_unmarked).
    • Latency budgets go into the grant (latency_budget_ms). A late object must be marked before any mix (late_unflagged), and a mark the room's records do not support is mark_unfounded.
  • Audience (§7). A new grant attribute, audience_input, is the audience-input power and the per-window limit. Members send signed inputs (WPA1) to a window (WPW1): a prompt, a sketch or movement sample by digest, or a vote.
    • Once the window closes, the clock commits to the eligible inputs (WPC1): those sent before the close and not restricted by a moderator's decision.
    • A selection (WPS1) is recomputed from the commitment under the window's rule: a plurality vote, the top inputs by reactions, or a draw from a seed committed before any input.
    • Every pick carries a credit: an author credit to the member who sent the input, or a direct credit to an option's voters together, by a digest of their keys. Each credit maps onto a party (audience) and a step (author or direct) of a contribution record, wai.media.contribution. That slot is named, nothing is written into it, and nothing depends on #403's code.
  • Where each rule is enforced (§8): the relay refuses, the clock marks and commits, the authority grants, and sinks never mix a late object unmarked. A verifier (§9) checks all of it afterwards from the room's records and the objects the relay forwarded.

Design decisions, and why

  • Statements are meta payloads, not new event kinds or power bits. live-events refuses an unknown kind (unknown_kind), and live-rooms §3.4 refuses any power above bit 4. A new kind or power would break every current room verifier. A meta payload with a magic prefix is how live-moderation's WMS1 already rides. The audience-input power is therefore a grant attribute, which live-rooms §4.4 signs with the grant and leaves to the extensions that read it, as it does for ai, subject, minor and ai_usage. The direct power (bit 1) authorises schedules, handovers and windows.
  • Refuse or mark, and who does it. Refusal belongs to the relay: it is the one component that sees each object before it fans out, so a refusal there holds the floor for every subscriber at once. Marking belongs to the room clock: it is the key the room trusts to state room time, and a mark is evidence. The room picks the mode per schedule, within the policy's modes.
    • Refuse fits exchanges where the floor is the point, such as timed spoken turns.
    • Mark fits music, where a pickup or a ringing tail overlaps the bar line and dropping it would cut the performance.
  • The floor is judged on arrival, and lateness on arrival minus due. The relay can enforce the first exactly. The objects (with their arrival and due instants) are the caller's statement, as live-moderation §7.1's objects are, taken from a relay's log or DVR window.
  • A schedule carries the room's t0, so that a relay holding no descriptor can put an object on the room clock. A verifier refuses a t0 that is not the descriptor's.
  • The commitment is a hash over the eligible inputs in the merged order, so it scales past the 1024-byte payload bound. The selection names its picks, so a pick sent after the close is caught crisply (input_late), separately from a pick the rule does not give (selection_mismatch).
  • Moderation applies to inputs as written in the text. An input or a reaction is restricted when the last decision on it before the commitment denies or redacts it. Fallback decisions the clock signs count, since they are decisions too.
  • Lawful basis. The text adds no consent step. Where a regime asks the operator for a lawful basis for processing what an audience submits (a movement sample is personal data), it points to the lawful-basis claim class (jwp-receipts §2.4.6).
  • Magics WPP1 WPI1 WPF1 WPT1 WPH1 WPM1 WPW1 WPA1 WPC1 WPS1. None collides with main or with the in-flight wai/* branches (each branch's REGISTRY checked).

Code

  • wai/wai-rs, feature co_performance (= live_events + live_room):
    • src/co_performance.rs: the records, the verifier and unit tests;
    • src/co_performance/corpus.rs: rooms written as scripts of steps; each refused room is a good script with one step changed;
    • src/bin/wai_co_performance_vectors.rs, tests/co_performance.rs.
  • Registry. CAP_LIVE_COPERFORMANCE and the ten magics in src/codecs/registry.rs. The export is regenerated: registry/capabilities.json, vocab/v2.ttl, and REGISTRY.md's table.
  • Corpus wai/live-conformance/coperformance/: vectors.json, plus a README with its Provenance. line. tests/int_kernels_vectors.rs's exclusion reason for live-conformance now names co-performance.
  • Second implementation. wai/live-conformance/co_performance_verify.py is written from the text and shares no code with wai-rs. It verifies each room through live_rooms_verify.py, then mutates the corpus (19 copies, each must fail) and drops each of its own 31 checks in turn (each weakened verifier must be caught).
  • Text and CI. SPEC.md §5 has a new paragraph and the record list; CHANGELOG has an entry; live-conformance/README.md lists the new corpus. .github/workflows/wai-conformance.yml gets the extension in paths: and a step in the independent-verifiers job.
  • Room service joule-moq-room ([co] in its configuration):
    • with audience_input above 0, every viewer's grant carries the power and may send meta and reactions, and the viewers' grants are served with the room (co.audience);
    • with latency_budget_ms above 0, every publisher's grant carries the budget;
    • either way, each room gets an authority-signed WPP1 (co.policy). The default is off.
  • Relay joule-moq-relay, new src/floor.rs and [floor] in its configuration. It reads WPT1/WPH1 from the events tracks it forwards, the same way it already reads moderation decisions, and drops a performer's media object that is out of turn under refuse, counting each drop.
    • Schedules are honoured from room keys (authorities plus the configured floor.room_keys) or from a principal whose proven grant has the direct power.
    • Handovers are honoured from the turn's holder, a director or a room key.
    • Absent [floor], the relay holds no floor.

Checks (all cargo work on the build host through rb)

check command result
module unit tests cargo test --locked --no-default-features --features co_performance --lib co_performance:: 6 passed
corpus test cargo test --locked --no-default-features --features co_performance --test co_performance 3 passed (regenerates byte for byte; every room gets its outcome; §10 equals Reason::ALL)
clippy, wai-rs cargo clippy --locked --no-default-features --features co_performance --all-targets no notes in the new code. One existing unpinned_read dead-code warning in int_payload, not touched here
registry export cargo run --no-default-features --bin wai -- registry export, then registry export --check written; up to date, exit 0
registry tests cargo test --no-default-features --lib codecs::registry 14 passed (SPEC and the registry name the same strings; every wire identifier is in its section)
CI's lib test set cargo test --locked --lib --no-default-features --features world,audio_scene,…,http 842 passed, 1 failed: energy_burst::tests::a_from_rest_burst_counts_only_work_begun_inside_the_window, a timing test under host load. The file is not touched here; 3 of 3 reruns pass
sidecar rule cargo test --features neural_int,video_int,audio_int,world_int,splat_int --test int_kernels_vectors every_decoded_output_states_a_sha256 passed
Python verifier python3 -I live-conformance/co_performance_verify.py live-conformance/coperformance exit 0: 42 rooms, 19 mutated copies fail, 31 weakened verifiers caught (~17 s)
every other live verifier python3 -I <x>_verify.py <dir> for events, rooms, takes, compose, recordings, captions, metering, steering, moderation, ads, e2ee, watermark, c2pa-live, synthesis, usage all exit 0
relay cargo test --locked -p joule-moq-relay --all-targets all pass (lib 37, including 3 floor tests; tests/floor.rs 1)
clippy, relay cargo clippy --locked -p joule-moq-relay --all-targets no notes in the new code. One existing useless_conversion at session.rs:311, not touched here
room service cargo test --locked --all-targets (joule-moq-room) lib 6 passed, including the new co-performance test; tests/room_service.rs 2 passed
clippy, room service cargo clippy --locked --all-targets no notes in the new code. One existing redundant_pattern_matching in an older test
repo checks check-tests-in-ci.py, check-workflow-concurrency.sh, check-spec-refs.py, check-wai-section-refs.py, check-no-vanity-metrics.sh, test-public-text-checks.sh, check-comparative-prose.sh, check-orphan-sources.py all exit 0. check-tests-in-ci.py exited 1 before the CI step was added, which is its own falsification
lock files the room service's Cargo.lock unchanged: only a feature of the path dependency wai changed. Every run used --locked

Falsifications

Each rule below was broken on the build host's snapshot of the committed tree, its test was run, and the file was restored:

rule broken test result
input_late check removed --test co_performance exit 101
a late object needs no mark --test co_performance exit 101
refuse mode not enforced --test co_performance exit 101
missing credits not refused --test co_performance exit 101
fidelity statement not recomputed --test co_performance exit 101
selection rule not recomputed --test co_performance exit 101
a row dropped from §10 the_extension_lists_the_reasons exit 101
relay forwards an out-of-turn object relay --test floor exit 101
relay honours a handover from anyone relay --lib floor:: exit 101
room service drops the viewers' audience power room --lib epoch:: exit 101

On the Python side:

  • One flipped byte in the audience room's last record: co_performance_verify.py exits 1 (bad_signature). The committed corpus exits 0.
  • All 19 corpus mutations fail and all 31 weakened verifiers are caught (see the run above).

What is not done

  • The reference relay does not refuse audience inputs. §7.3 says a relay MUST NOT forward an input the checks refuse (not permitted, unknown window, wrong type, over the limit). The reference relay forwards events-track objects without that check, and the verifier catches such an input afterwards. Closing this needs the relay to read grant attributes and windows, and to rewrite events objects the way events::withhold does.
  • Nothing signs marks yet. Under mark mode, and for late objects, neither the reference relay nor the room service observes objects and signs WPM1. A deployed room whose schedule marks therefore fails verification with turn_unmarked, and one with late objects fails with late_unflagged. Refuse mode is fully enforced.
  • The room service does not sign schedules, windows, commitments, selections or fidelity statements. Those come from a director (direct power) or a room key. The corpus and the room-service unit test sign them; the deployed service has no endpoint for them.
  • Pages. joule-moq-web does not yet read co.policy or co.audience, or render intents, turns or selections.
  • Contribution record. CO1's wai.media.contribution is named as the slot; no record is written, and nothing depends on #403.

Deployment note

Do not deploy before this lands. After it lands, the live room must be redeployed as one unit: the page assets, the relay (joule-moq-relay, new [floor] section) and the room service (joule-moq-room, new [co] section), all built from one commit. Both new sections are off by default. Turning them on is a configuration change that should go with that same redeploy.

🤖 Generated with Claude Code

Closed: Landed in #428 (merge train, merged as aa61ab3b with all 65 checks green).

## What this is CO4: live co-performance in rooms. A new extension, `wai/extensions/co-performance.md`, registers the record `wai.live.coperformance`: people and AI participants performing together in a room, and an audience joining in. - **Policy.** The room authority signs a co-performance policy, `WPP1`, chained by the instant it takes effect (shaped like live-moderation's `WMP1` and ai-usage's `WAU1`): the intent horizon, the match window, the tolerances of the pinned rules, and the turn modes a schedule may state. - **Intents** (`WPI1`, §5). A participant announces the material it will play, ahead of the instant it plays and within a short horizon: an object by the digest of its payload, notes, a text line, or a camera move. The intents ride the participant's events track, so every subscriber gets them before the material plays. A verifier finds what played and compares it under a pinned rule: digests equal, notes with equal pitches and onsets and durations within the tolerance, text equal byte for byte, a camera within the angle tolerance. The result is kept, diverged or missed. A room key's **fidelity statement** (`WPF1`) gives each participant's counts, and the verifier recomputes it as of the statement's instant (`fidelity_mismatch`). - **Turns** (§6). A schedule (`WPT1`) gives the floor in turns of microseconds or of bars at a stated tempo. Holders take turns in order, solo or as call-and-response pairs, and a handover (`WPH1`) passes a turn from a given instant. Each schedule states its mode: - **refuse**: the relay does not forward an out-of-turn object (`turn_violated`); - **mark**: the relay forwards it and the room clock signs a mark (`WPM1`, `turn_unmarked`). - Latency budgets go into the grant (`latency_budget_ms`). A late object must be marked before any mix (`late_unflagged`), and a mark the room's records do not support is `mark_unfounded`. - **Audience** (§7). A new grant attribute, `audience_input`, is the audience-input power and the per-window limit. Members send signed inputs (`WPA1`) to a window (`WPW1`): a prompt, a sketch or movement sample by digest, or a vote. - Once the window closes, the clock commits to the eligible inputs (`WPC1`): those sent before the close and not restricted by a moderator's decision. - A selection (`WPS1`) is recomputed from the commitment under the window's rule: a plurality vote, the top inputs by reactions, or a draw from a seed committed before any input. - Every pick carries a credit: an **author** credit to the member who sent the input, or a **direct** credit to an option's voters together, by a digest of their keys. Each credit maps onto a party (`audience`) and a step (`author` or `direct`) of a contribution record, `wai.media.contribution`. That slot is named, nothing is written into it, and nothing depends on #403's code. - **Where each rule is enforced** (§8): the relay refuses, the clock marks and commits, the authority grants, and sinks never mix a late object unmarked. A verifier (§9) checks all of it afterwards from the room's records and the objects the relay forwarded. ## Design decisions, and why - **Statements are `meta` payloads, not new event kinds or power bits.** live-events refuses an unknown kind (`unknown_kind`), and live-rooms §3.4 refuses any power above bit 4. A new kind or power would break every current room verifier. A `meta` payload with a magic prefix is how live-moderation's `WMS1` already rides. The audience-input power is therefore a grant attribute, which live-rooms §4.4 signs with the grant and leaves to the extensions that read it, as it does for `ai`, `subject`, `minor` and `ai_usage`. The direct power (bit 1) authorises schedules, handovers and windows. - **Refuse or mark, and who does it.** Refusal belongs to the **relay**: it is the one component that sees each object before it fans out, so a refusal there holds the floor for every subscriber at once. Marking belongs to the **room clock**: it is the key the room trusts to state room time, and a mark is evidence. The room picks the mode per schedule, within the policy's `modes`. - Refuse fits exchanges where the floor is the point, such as timed spoken turns. - Mark fits music, where a pickup or a ringing tail overlaps the bar line and dropping it would cut the performance. - **The floor is judged on arrival, and lateness on arrival minus due.** The relay can enforce the first exactly. The objects (with their arrival and due instants) are the caller's statement, as live-moderation §7.1's objects are, taken from a relay's log or DVR window. - **A schedule carries the room's `t0`**, so that a relay holding no descriptor can put an object on the room clock. A verifier refuses a `t0` that is not the descriptor's. - **The commitment is a hash over the eligible inputs in the merged order**, so it scales past the 1024-byte payload bound. The selection names its picks, so a pick sent after the close is caught crisply (`input_late`), separately from a pick the rule does not give (`selection_mismatch`). - **Moderation applies to inputs as written in the text.** An input or a reaction is restricted when the last `decision` on it before the commitment denies or redacts it. Fallback decisions the clock signs count, since they are decisions too. - **Lawful basis.** The text adds no consent step. Where a regime asks the operator for a lawful basis for processing what an audience submits (a movement sample is personal data), it points to the `lawful-basis` claim class (jwp-receipts §2.4.6). - **Magics** `WPP1 WPI1 WPF1 WPT1 WPH1 WPM1 WPW1 WPA1 WPC1 WPS1`. None collides with main or with the in-flight `wai/*` branches (each branch's REGISTRY checked). ## Code - `wai/wai-rs`, feature `co_performance` (= `live_events` + `live_room`): - `src/co_performance.rs`: the records, the verifier and unit tests; - `src/co_performance/corpus.rs`: rooms written as scripts of steps; each refused room is a good script with one step changed; - `src/bin/wai_co_performance_vectors.rs`, `tests/co_performance.rs`. - **Registry.** `CAP_LIVE_COPERFORMANCE` and the ten magics in `src/codecs/registry.rs`. The export is regenerated: `registry/capabilities.json`, `vocab/v2.ttl`, and REGISTRY.md's table. - **Corpus** `wai/live-conformance/coperformance/`: `vectors.json`, plus a README with its **Provenance.** line. `tests/int_kernels_vectors.rs`'s exclusion reason for `live-conformance` now names co-performance. - **Second implementation.** `wai/live-conformance/co_performance_verify.py` is written from the text and shares no code with wai-rs. It verifies each room through `live_rooms_verify.py`, then mutates the corpus (19 copies, each must fail) and drops each of its own 31 checks in turn (each weakened verifier must be caught). - **Text and CI.** SPEC.md §5 has a new paragraph and the record list; CHANGELOG has an entry; `live-conformance/README.md` lists the new corpus. `.github/workflows/wai-conformance.yml` gets the extension in `paths:` and a step in the independent-verifiers job. - **Room service** `joule-moq-room` (`[co]` in its configuration): - with `audience_input` above 0, every viewer's grant carries the power and may send `meta` and reactions, and the viewers' grants are served with the room (`co.audience`); - with `latency_budget_ms` above 0, every publisher's grant carries the budget; - either way, each room gets an authority-signed `WPP1` (`co.policy`). The default is off. - **Relay** `joule-moq-relay`, new `src/floor.rs` and `[floor]` in its configuration. It reads `WPT1`/`WPH1` from the events tracks it forwards, the same way it already reads moderation decisions, and drops a performer's media object that is out of turn under refuse, counting each drop. - Schedules are honoured from room keys (authorities plus the configured `floor.room_keys`) or from a principal whose proven grant has the direct power. - Handovers are honoured from the turn's holder, a director or a room key. - Absent `[floor]`, the relay holds no floor. ## Checks (all cargo work on the build host through `rb`) | check | command | result | |---|---|---| | module unit tests | `cargo test --locked --no-default-features --features co_performance --lib co_performance::` | 6 passed | | corpus test | `cargo test --locked --no-default-features --features co_performance --test co_performance` | 3 passed (regenerates byte for byte; every room gets its outcome; §10 equals `Reason::ALL`) | | clippy, wai-rs | `cargo clippy --locked --no-default-features --features co_performance --all-targets` | no notes in the new code. One existing `unpinned_read` dead-code warning in `int_payload`, not touched here | | registry export | `cargo run --no-default-features --bin wai -- registry export`, then `registry export --check` | written; `up to date`, exit 0 | | registry tests | `cargo test --no-default-features --lib codecs::registry` | 14 passed (SPEC and the registry name the same strings; every wire identifier is in its section) | | CI's lib test set | `cargo test --locked --lib --no-default-features --features world,audio_scene,…,http` | 842 passed, 1 failed: `energy_burst::tests::a_from_rest_burst_counts_only_work_begun_inside_the_window`, a timing test under host load. The file is not touched here; 3 of 3 reruns pass | | sidecar rule | `cargo test --features neural_int,video_int,audio_int,world_int,splat_int --test int_kernels_vectors every_decoded_output_states_a_sha256` | passed | | Python verifier | `python3 -I live-conformance/co_performance_verify.py live-conformance/coperformance` | exit 0: 42 rooms, 19 mutated copies fail, 31 weakened verifiers caught (~17 s) | | every other live verifier | `python3 -I <x>_verify.py <dir>` for events, rooms, takes, compose, recordings, captions, metering, steering, moderation, ads, e2ee, watermark, c2pa-live, synthesis, usage | all exit 0 | | relay | `cargo test --locked -p joule-moq-relay --all-targets` | all pass (lib 37, including 3 floor tests; `tests/floor.rs` 1) | | clippy, relay | `cargo clippy --locked -p joule-moq-relay --all-targets` | no notes in the new code. One existing `useless_conversion` at `session.rs:311`, not touched here | | room service | `cargo test --locked --all-targets` (joule-moq-room) | lib 6 passed, including the new co-performance test; `tests/room_service.rs` 2 passed | | clippy, room service | `cargo clippy --locked --all-targets` | no notes in the new code. One existing `redundant_pattern_matching` in an older test | | repo checks | `check-tests-in-ci.py`, `check-workflow-concurrency.sh`, `check-spec-refs.py`, `check-wai-section-refs.py`, `check-no-vanity-metrics.sh`, `test-public-text-checks.sh`, `check-comparative-prose.sh`, `check-orphan-sources.py` | all exit 0. `check-tests-in-ci.py` exited 1 before the CI step was added, which is its own falsification | | lock files | the room service's `Cargo.lock` | unchanged: only a feature of the path dependency `wai` changed. Every run used `--locked` | ## Falsifications Each rule below was broken on the build host's snapshot of the committed tree, its test was run, and the file was restored: | rule broken | test | result | |---|---|---| | `input_late` check removed | `--test co_performance` | exit 101 | | a late object needs no mark | `--test co_performance` | exit 101 | | refuse mode not enforced | `--test co_performance` | exit 101 | | missing credits not refused | `--test co_performance` | exit 101 | | fidelity statement not recomputed | `--test co_performance` | exit 101 | | selection rule not recomputed | `--test co_performance` | exit 101 | | a row dropped from §10 | `the_extension_lists_the_reasons` | exit 101 | | relay forwards an out-of-turn object | relay `--test floor` | exit 101 | | relay honours a handover from anyone | relay `--lib floor::` | exit 101 | | room service drops the viewers' audience power | room `--lib epoch::` | exit 101 | On the Python side: - One flipped byte in the audience room's last record: `co_performance_verify.py` exits 1 (`bad_signature`). The committed corpus exits 0. - All 19 corpus mutations fail and all 31 weakened verifiers are caught (see the run above). ## What is not done - **The reference relay does not refuse audience inputs.** §7.3 says a relay MUST NOT forward an input the checks refuse (not permitted, unknown window, wrong type, over the limit). The reference relay forwards events-track objects without that check, and the verifier catches such an input afterwards. Closing this needs the relay to read grant attributes and windows, and to rewrite events objects the way `events::withhold` does. - **Nothing signs marks yet.** Under mark mode, and for late objects, neither the reference relay nor the room service observes objects and signs `WPM1`. A deployed room whose schedule marks therefore fails verification with `turn_unmarked`, and one with late objects fails with `late_unflagged`. Refuse mode is fully enforced. - **The room service does not sign schedules, windows, commitments, selections or fidelity statements.** Those come from a director (direct power) or a room key. The corpus and the room-service unit test sign them; the deployed service has no endpoint for them. - **Pages.** `joule-moq-web` does not yet read `co.policy` or `co.audience`, or render intents, turns or selections. - **Contribution record.** CO1's `wai.media.contribution` is named as the slot; no record is written, and nothing depends on #403. ## Deployment note Do not deploy before this lands. After it lands, **the live room must be redeployed as one unit**: the page assets, the relay (`joule-moq-relay`, new `[floor]` section) and the room service (`joule-moq-room`, new `[co]` section), all built from one commit. Both new sections are off by default. Turning them on is a configuration change that should go with that same redeploy. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- **Closed:** Landed in #428 (merge train, merged as aa61ab3b with all 65 checks green). 
The extension text (extensions/co-performance.md), the reference module
(wai-rs feature co_performance) and its corpus generator: the room
authority's WPP1 policy; intents compared with what played under pinned
rules and the clock's fidelity statement recomputed; turn schedules in
microseconds or bars, call-and-response pairs, handovers, the floor,
latency budgets and marks; audience inputs to selection windows, the
commitment, three selection rules and their credits.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Written from extensions/co-performance.md alone: the policy, statements,
intents and their pinned rules, the fidelity statement, schedules,
handovers, the floor, budgets and marks, windows, inputs, commitments,
the three rules and the credits. Each room through live_rooms_verify.py;
mutated copies of the corpus must each fail.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
The verifier is weakened on purpose, one check at a time, and the corpus
must catch each weakened copy. Room verifications are cached by their
inputs, since they do not depend on the checks dropped. The extension
names the window's, the fidelity statement's and the credit's malformed
values explicitly.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
The capability and its ten magics in the reference registry, and the
export regenerated (registry/capabilities.json, vocab/v2.ttl and
REGISTRY.md's table); SPEC §5's paragraph and record list; the corpus's
README with its provenance; the live-conformance index; the sidecar
exclusion's reason for live-conformance; and a step in the independent
verifiers job that runs the module's unit tests, tests/co_performance.rs
and co_performance_verify.py, with the extension in the workflow's paths.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Clippy's type_complexity and too_many_arguments notes, cleared without an
allow.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
A [co] section of the service's configuration: with audience_input above
0, every viewer's grant carries the attribute audience_input and may send
meta events and reactions, and the viewers' grants are served with the
room (co.audience) so a page verifies their inputs; with
latency_budget_ms above 0, every publisher's grant carries it. Either
gives each room a WPP1 policy the authority signs (co.policy). A unit
test checks the grants and the policy, and that two viewers' votes in a
window the clock opens, commits and selects verify as co-performance §9
verifies a room.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
joule-moq-relay: the floor of WAI rooms (co-performance §6)
All checks were successful
joule-moq-room room service / joule-moq-room, every target (pull_request) Successful in 1m1s
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Successful in 2m17s
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Successful in 27s
Details
WAI energy receipts / energy receipts · linux (pull_request) Successful in 10m10s
Details
wai-ops-gpu integer operators on GPUs / builds · no adapter is not a pass (linux) (pull_request) Successful in 1m50s
Details
wai-pack / wai-pack · linux (pull_request) Successful in 1m28s
Details
WAI conformance / cargo-class corpora · linux (pull_request) Successful in 19m19s
Details
wai-quantum studio and desktop / studio · browser (pull_request) Successful in 2m27s
Details
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Successful in 4m12s
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Successful in 8m36s
Details
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 4m4s
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Successful in 31s
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Successful in 1m7s
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Successful in 47s
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Successful in 2m19s
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Successful in 19m36s
Details
wai-pack / wai-pack · linux-arm64 (pull_request) Successful in 2m12s
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Successful in 12m40s
Details
wai-pack / wai-pack · independent verifier (Python) (pull_request) Successful in 9m9s
Details
wai-pack / wai-pack · the floor through a media prober (pull_request) Successful in 29s
Details
wai-pack / wai-pack · dependency licences (pull_request) Successful in 2m14s
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Successful in 37m47s
Details
standards workspaces build + test / macOS energy backends (pull_request) Successful in 7m52s
Details
WAI conformance / cargo-class corpora · macos (pull_request) Successful in 13m30s
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Successful in 19s
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Successful in 46s
Details
WAI energy receipts / energy receipts · macos (pull_request) Successful in 5m49s
Details
wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Successful in 3m28s
Details
wai-pack / wai-pack · macos (pull_request) Successful in 1m9s
Details
wai-quantum studio and desktop / desktop app · macos (pull_request) Successful in 2m19s
Details
c6b3c09944 
With [floor] in its configuration, the relay reads each room's turn
schedules (WPT1) and handovers (WPH1) from the events tracks it already
forwards, as it reads moderation decisions, and holds the floor: a media
object a performer publishes out of turn under a schedule that refuses is
not forwarded and is counted. A schedule is honoured from a room key (the
authorities' and the configured ones) or a principal whose session proved
a grant with the direct power, when it reads, verifies and changes no past;
a handover from the turn's holder, a director or a room key, to a holder
of its segment. Unit tests of the reading and the floor, and
tests/floor.rs through a relay on loopback: the object in turn reaches the
subscriber, the other does not, and a handover passes the floor.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
dcharlot closed this pull request 2026-10-22 12:02:25 -04:00
All checks were successful
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Successful in 5s
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Successful in 5s
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Successful in 3m11s
Details
wai-web reach builds / wai-web reach · does this change touch it (pull_request) Successful in 5s
Details
wai-web reach builds / wai-web reach builds · the package of record, every output as recorded (pull_request) Successful in 2m32s
Details
wai-web reach builds / wai-web reach builds · this tree's wai-web, every rung on its engine line (pull_request) Successful in 4m37s
Details
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Successful in 1m23s
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Successful in 1m52s
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Successful in 5s
Details
WAI conformance / does this change touch it (pull_request) Successful in 4s
Details
WAI energy receipts / does this change touch it (pull_request) Successful in 5s
Details
repository checks / lockfiles, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Successful in 47s
Details
wai-ops-gpu integer operators on GPUs / does this change touch it (pull_request) Successful in 4s
Details
wai-pack / wai-pack · does this change touch it (pull_request) Successful in 4s
Details
wai-quantum studio and desktop / does this change touch it (pull_request) Successful in 4s
Details
wai-web wasm32 / does this change touch it (pull_request) Successful in 5s
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Successful in 1m1s
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Successful in 2m17s
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Successful in 27s
Details
WAI energy receipts / energy receipts · linux (pull_request) Successful in 10m10s
Details
wai-ops-gpu integer operators on GPUs / builds · no adapter is not a pass (linux) (pull_request) Successful in 1m50s
Details
wai-pack / wai-pack · linux (pull_request) Successful in 1m28s
Details
WAI conformance / cargo-class corpora · linux (pull_request) Successful in 19m19s
Details
wai-quantum studio and desktop / studio · browser (pull_request) Successful in 2m27s
Details
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Successful in 4m12s
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Successful in 8m36s
Details
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 4m4s
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Successful in 31s
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Successful in 1m7s
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Successful in 47s
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Successful in 2m19s
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Successful in 19m36s
Details
wai-pack / wai-pack · linux-arm64 (pull_request) Successful in 2m12s
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Successful in 12m40s
Details
wai-pack / wai-pack · independent verifier (Python) (pull_request) Successful in 9m9s
Details
wai-pack / wai-pack · the floor through a media prober (pull_request) Successful in 29s
Details
wai-pack / wai-pack · dependency licences (pull_request) Successful in 2m14s
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Successful in 37m47s
Details
standards workspaces build + test / macOS energy backends (pull_request) Successful in 7m52s
Details
WAI conformance / cargo-class corpora · macos (pull_request) Successful in 13m30s
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Successful in 19s
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Successful in 46s
Details
WAI energy receipts / energy receipts · macos (pull_request) Successful in 5m49s
Details
wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Successful in 3m28s
Details
wai-pack / wai-pack · macos (pull_request) Successful in 1m9s
Details
wai-quantum studio and desktop / desktop app · macos (pull_request) Successful in 2m19s
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
Transaction-Science/open-standards!410
No description provided.