Transaction-Science/open-standards

Watch

Fork 0

wai.media.robustness: robustness evidence anyone recomputes bit for bit, claims held to it, and soft bindings over a span of a track (SOFT) #433

Closed

dcharlot wants to merge 0 commits from wai/soft-binding-evidence into main

dcharlot commented

2026-10-22 04:15:35 -04:00

Owner

What this adds

1. Soft bindings over a span of a track — extensions/jwp-receipts.md §2.6.4, amending §2.4.4, §2.6, §2.6.2, §2.6.3, §3.1, §3.2, §5.6, §6.8 and §7.5.

A new claim class, soft-binding-span: §2.6.2's members and a span of one track — track_alias, the media time start_ms/end_ms (milliseconds from the track's media time 0, both ends included), and, where the publisher states them, first_group/last_group and first_object/last_object. Its subject is the anchor, the span's first object.
New step-4 reasons span_malformed (a half-stated range, objects without groups) and span_inverted; new step-6 reason recovery_outside_span.
Recovery through a span (§3.2): in place of a delivery receipt for the declaration's subject, a verified delivery receipt R for an object within the span (same track and signer; coordinates within the stated objects, else groups; for a span of media time alone, the anchor itself). The recovery attests the span. The spec states what it does not attest: which part of the span the object in hand came from, anything outside the span (a receipt outside is refused, never reported), and, for a span of media time alone, any object but the anchor, because delivery receipts carry no media time.
A binding-recovery record may name a span declaration; its context is then the declaration with R (§2.6.3 check 5).
C2PA mapping: a declaration is one block of a C2PA soft-binding assertion (C2PA 2.4 §18.10): {"scope": {"timespan": {"start", "end"}}, "value"} for a span, the empty scope for a whole object. C2PA states no reading of the range's end; its example's adjacent blocks (end 133016, start 133017) are the reading of both ends included that this class states. Groups and objects stay on the WAI side.
Whole-object bindings are byte-identical: soft-binding is unchanged (a span member on it is unknown_member); all 567 existing claim vectors are an unchanged prefix of the regenerated corpus (checked by comparing JSON vector by vector).
claim_receipt (Span, DeliveredObject, SoftBindingSpanClaim, recover_span, RecoveredSpan, check_span_recovery_against), claim_verify.py, differential.py (a span body-defect family and a random span/receipt family), and http_binding (a recovery record naming a span declaration is checked with a passed delivery item within the span).

2. Robustness evidence — new extensions/robustness-evidence.md, record wai.media.robustness.

Corpus document (wai-robustness-corpus, unsigned): items and negatives, each named by the SHA-256 of its RGB8 samples; the document named by the SHA-256 of its JCS.
Transforms (wai-attack:*, §4): synthesis §7.5.7's battery with its parameters free (int-motion, staged-base, denoise3, scale, aspect, upscale2, half-then-int-motion, crop, mirror, rotate-90, rotate by cos/sin at 2^16, noise, brightness, contrast, local-blur, clip-int-motion, frame-drop, one-frame) plus gamma, computed in integers: the greatest y with y = 0 or (2y − 1)^d·255^n ≤ 2^d·v^n·255^d. Each is an integer function of the frames, its parameters and a seed; parameter ranges are pinned (transform_invalid), clip-only transforms refuse picture corpora (battery_not_applicable).
Robustness record (wai-robustness): algorithm term + definition digest, binding type, media, corpus digest, values, battery (name, transform, params, seed), harness (wai-robustness-harness:1, §6), and per attack trials, survived, wrong, negatives, false_positives with survival, false_positive_rate, balanced_accuracy and tpr_at_1pct_fpr as exact fractions [n, d] in lowest terms. A rate written any other way (a decimal, a string, unreduced, above 1) is rate_not_exact. A verifier holding the corpus reruns the harness and requires the table bit for bit (table_irreproducible) → reproduced; otherwise stated.
Robustness claim (wai-robustness-claim): attacks by media, transform and params, citing records. Holds only where every cited record measuring the attack shows survived = trials, wrong = 0, false_positives = 0: claim_unevidenced, claim_exceeds_evidence, evidence_not_held, evidence_mismatch, and under a policy, evidence_not_reproduced.
WAI's own scheme (§10): records of wai-mark:tent64 over spectral, leaves and clips with synthesis §7.5.7's battery (seeds = index), and a claim that is exactly synthesis §7.5.8's list, which holds over them.
Mapping (§11, informative) onto the proposed robustnessEvidence object, cited as Robustness Evidence for C2PA Soft-Binding Algorithms (it states no version, so the text is pinned by SHA-256 as fetched on 22 October 2026). The mapping runs one way: the object carries decimals and no counts, transforms, digests or signature.
wai-rs module robustness (feature robustness = ["synthesis_mark"], cbindgen-ignored), wai_robustness_vectors gen|verify, tests/robustness.rs, corpus live-conformance/robustness/, second implementation live-conformance/robustness_verify.py; CI step; REGISTRY + export; SPEC §5; CHANGELOG; live-conformance README row.

Design decisions and why

A span is a new class, not an optional member. jwp-receipts §2.4.3: a claim has no optional members, one claim has one canonical form, and a new member is a new registration. A new class keeps every soft-binding claim byte-identical.
Media time is always stated; groups/objects are optional. Every span maps onto C2PA's timespan; groups or objects are what let a recovery reach receipts, because WAI delivery receipts carry no media time. A span of media time alone therefore reaches only the anchor — stated plainly rather than inventing a time mapping.
The battery is reused, not reimplemented. synthesis_mark::battery is already factored (apply, rotate, area); Transform::apply routes through it, and a unit test requires each registered transform to give exactly battery::apply's bytes for every attack of both lists. Only gamma is new code. No change to SYN-2's files, so nothing conflicts with #425.
Rates as [n, d] arrays in lowest terms, one spelling per rate; comparisons are integer equality. TPR at 1% FPR is the survival rate where 100·F ≤ U and null otherwise (a value-or-nothing detector has one operating point), and the text says what a measured 0/U does and does not bound.
Claims by media. A claimed attack names its media, so evidence over clips never stands for pictures (the proposal's review raised scoping by media type).
Records are reproduced or stated, never silently trusted: a record over a corpus the verifier does not hold is checked for arithmetic and signature, and a policy can require reproduced evidence for claims.
tent64s is not covered: #425 is not merged. Its records are one call of the same harness once it lands (§10 says so).
Corpus samples: the conformance corpus holds its three 256 × 256 pictures (≈ 590 KB of .rgb), so the second implementation reruns that battery end to end. The measurement sets (25 MB) are not committed; the tent64 records are reproduced by the generator/test and, for the Python verifier, cross-checked against synthesis-mark/battery.json, which another program wrote.

Checks run (all heavy work through `rb` on the build host)

check	command	result
claim corpus regenerate + verify	`cargo run --no-default-features --features key_discovery --bin wai_claim_vectors -- gen/verify ../claim-conformance`	all vectors pass; first 567 vectors identical to main
claim second implementation	`python3 claim-conformance/claim_verify.py claim-conformance/vectors.json`	615 vectors, 0 failures
claim differential	`python3 claim-conformance/differential.py <wai_claim_vectors> --random 2000 --seed 1`	59214 inputs, 0 differ, 0 crash
robustness unit tests	`cargo test --release --no-default-features --features robustness --lib robustness::`	5 passed
robustness integration	`cargo test --release --no-default-features --features robustness --test robustness`	7 passed (≈41 s)
robustness corpus	`wai_robustness_vectors gen ../live-conformance/robustness` (release)	≈38 s; regenerates byte for byte
robustness second implementation	`python3 -I live-conformance/robustness_verify.py live-conformance/robustness`	43 cases pass; conformance battery rerun end to end bit for bit; tent64 vs battery.json; claim vs §7.5.8; 10 mutations caught; 11 weakened checks caught (≈42 s)
CI lib set	`cargo test --lib --no-default-features --features world,audio_scene,haptic,splat4d,score,provenance,neural_int,film,oer,receipt_claims,key_discovery,staged,video_int,audio_int,splat_int,stage_measure,telemetry,video_package,http`	843 passed
HTTP receipts	`cargo test --no-default-features --features http,receipt_claims --lib http_binding::tests_receipts`	16 passed (new span test included)
dependents	`--test staged_moq`, `--test cli_http`, wasm32 `--features receipt_claims,stage_measure` build	pass
registry	`wai registry export` then `--check`; `--lib codecs::registry`	up to date; 14 passed
clippy	`cargo clippy --no-default-features --features robustness,http,key_discovery --all-targets`	0 notes in touched files
C header	forced cbindgen regeneration	`include/wai.h` identical to main (module is `cbindgen:ignore`)
other verifiers reading shared exports	`http_verify.py`, `staged_verify.py`, `pack_verify.py`, `signer_verify.py`, `ai_usage_verify.py`, `claim_verify.py consumption`	all pass
repo checks	`check-tests-in-ci.py`, `check-workflow-concurrency.sh`, `check-spec-refs.py`, `check-wai-section-refs.py`, `check-no-vanity-metrics.sh`, `test-public-text-checks.sh`, `check-comparative-prose.sh`, `check-orphan-sources.py`	all pass
public names	`check-public-names.sh` on every changed file; commit messages with `grep -E -f`	clean

Falsifications

All committed first; each patch below was applied on the build host, the guarding check run, and the file restored (git checkout). Every one fails:

patch	guarding check	result
`recover_span` without the `recovery_outside_span` check	`wai_claim_vectors verify`	exit 101 (the runner's within-span assertion fires on the outside vectors)
`Span::rules` without `start_ms ≤ end_ms`	`wai_claim_vectors verify`	exit 1, `soft_binding_span_time_inverted` accepted
`soft-binding` admits a `span` member	`wai_claim_vectors verify`	exit 101 (the corpus no longer seals)
HTTP recovery-record path without the span branch	`--lib http_binding::tests_receipts`	exit 101, the new test fails
no rerun comparison (`table_irreproducible`)	`--test robustness`	exit 101, 2 tests fail
a claim above its evidence holds	`--test robustness`	exit 101, 2 tests fail
a rate not in lowest terms reads	`--test robustness`	exit 101, 2 tests fail
corpus digest not compared	`--test robustness`	exit 101, 2 tests fail
tent64 claim claims `crop-10%` in place of `local-blur`	`--test robustness`	exit 101, 2 tests fail
gamma rounds down instead of to nearest	`--lib robustness::`	exit 101, `gamma_is_the_rounded_power` fails

On the Python side, robustness_verify.py mutates copies of the corpus (a count, a seed, a decimal rate, a wrong corpus file, the policy, the samples dropped, a stated status, a refusal's reason, the records reordered, a frame byte) and every copy fails; and it drops each of its own checks in turn (signature, exact rates, parameter ranges, media, counts, rates, values, corpus digest, sample sizes, rerun, survival) and the corpus catches each weakened verifier. The second implementations agree with wai-rs on every case, and differential.py finds no difference between the two claim verifiers on 59214 generated inputs.

Not done

wai-mark:tent64s records (#425 open, stacked); one harness call once it merges.
No fingerprint algorithm is implemented, so the fingerprint branch of the harness (§6) and values_invalid on recomputation are specified but only the watermark path is exercised.
Transforms of audio and text are not registered; a corpus of either has no battery yet (§3).
The photographs of synthesis §7.5.8 have no record (not in the repository).
The span class is not exercised over MoQ catalogs or HTTP indexes beyond the unit test of the recovery-record path.

🤖 Generated with Claude Code

Closed: landed on main through merge train C (#461, e0ac15f5); this PR's head is an ancestor of main.

## What this adds **1. Soft bindings over a span of a track** — `extensions/jwp-receipts.md` §2.6.4, amending §2.4.4, §2.6, §2.6.2, §2.6.3, §3.1, §3.2, §5.6, §6.8 and §7.5. - A new claim class, `soft-binding-span`: §2.6.2's members and a `span` of one track — `track_alias`, the media time `start_ms`/`end_ms` (milliseconds from the track's media time 0, both ends included), and, where the publisher states them, `first_group`/`last_group` and `first_object`/`last_object`. Its subject is the **anchor**, the span's first object. - New step-4 reasons `span_malformed` (a half-stated range, objects without groups) and `span_inverted`; new step-6 reason `recovery_outside_span`. - **Recovery through a span** (§3.2): in place of a delivery receipt for the declaration's subject, a verified delivery receipt *R* for an object **within** the span (same track and signer; coordinates within the stated objects, else groups; for a span of media time alone, the anchor itself). The recovery attests the span. The spec states what it does **not** attest: which part of the span the object in hand came from, anything outside the span (a receipt outside is refused, never reported), and, for a span of media time alone, any object but the anchor, because delivery receipts carry no media time. - A `binding-recovery` record may name a span declaration; its context is then the declaration with *R* (§2.6.3 check 5). - **C2PA mapping**: a declaration is one block of a C2PA soft-binding assertion (C2PA 2.4 §18.10): `{"scope": {"timespan": {"start", "end"}}, "value"}` for a span, the empty scope for a whole object. C2PA states no reading of the range's end; its example's adjacent blocks (end 133016, start 133017) are the reading of both ends included that this class states. Groups and objects stay on the WAI side. - **Whole-object bindings are byte-identical**: `soft-binding` is unchanged (a `span` member on it is `unknown_member`); all 567 existing claim vectors are an unchanged prefix of the regenerated corpus (checked by comparing JSON vector by vector). - `claim_receipt` (`Span`, `DeliveredObject`, `SoftBindingSpanClaim`, `recover_span`, `RecoveredSpan`, `check_span_recovery_against`), `claim_verify.py`, `differential.py` (a span body-defect family and a random span/receipt family), and `http_binding` (a recovery record naming a span declaration is checked with a passed delivery item within the span). **2. Robustness evidence** — new `extensions/robustness-evidence.md`, record `wai.media.robustness`. - **Corpus document** (`wai-robustness-corpus`, unsigned): items and negatives, each named by the SHA-256 of its RGB8 samples; the document named by the SHA-256 of its JCS. - **Transforms** (`wai-attack:*`, §4): synthesis §7.5.7's battery with its parameters free (int-motion, staged-base, denoise3, scale, aspect, upscale2, half-then-int-motion, crop, mirror, rotate-90, rotate by cos/sin at 2^16, noise, brightness, contrast, local-blur, clip-int-motion, frame-drop, one-frame) plus **gamma**, computed in integers: the greatest y with y = 0 or (2y − 1)^d·255^n ≤ 2^d·v^n·255^d. Each is an integer function of the frames, its parameters and a seed; parameter ranges are pinned (`transform_invalid`), clip-only transforms refuse picture corpora (`battery_not_applicable`). - **Robustness record** (`wai-robustness`): algorithm term + definition digest, binding type, media, corpus digest, values, battery (name, transform, params, seed), harness (`wai-robustness-harness:1`, §6), and per attack `trials`, `survived`, `wrong`, `negatives`, `false_positives` with `survival`, `false_positive_rate`, `balanced_accuracy` and `tpr_at_1pct_fpr` as **exact fractions** `[n, d]` in lowest terms. A rate written any other way (a decimal, a string, unreduced, above 1) is `rate_not_exact`. A verifier holding the corpus reruns the harness and requires the table bit for bit (`table_irreproducible`) → **reproduced**; otherwise **stated**. - **Robustness claim** (`wai-robustness-claim`): attacks by media, transform and params, citing records. Holds only where every cited record measuring the attack shows `survived = trials`, `wrong = 0`, `false_positives = 0`: `claim_unevidenced`, `claim_exceeds_evidence`, `evidence_not_held`, `evidence_mismatch`, and under a policy, `evidence_not_reproduced`. - **WAI's own scheme** (§10): records of `wai-mark:tent64` over `spectral`, `leaves` and `clips` with synthesis §7.5.7's battery (seeds = index), and a claim that is exactly synthesis §7.5.8's list, which holds over them. - **Mapping** (§11, informative) onto the proposed `robustnessEvidence` object, cited as *Robustness Evidence for C2PA Soft-Binding Algorithms* (it states no version, so the text is pinned by SHA-256 as fetched on 22 October 2026). The mapping runs one way: the object carries decimals and no counts, transforms, digests or signature. - `wai-rs` module `robustness` (feature `robustness = ["synthesis_mark"]`, cbindgen-ignored), `wai_robustness_vectors gen|verify`, `tests/robustness.rs`, corpus `live-conformance/robustness/`, second implementation `live-conformance/robustness_verify.py`; CI step; REGISTRY + export; SPEC §5; CHANGELOG; live-conformance README row. ## Design decisions and why - **A span is a new class, not an optional member.** jwp-receipts §2.4.3: a claim has no optional members, one claim has one canonical form, and a new member is a new registration. A new class keeps every `soft-binding` claim byte-identical. - **Media time is always stated; groups/objects are optional.** Every span maps onto C2PA's `timespan`; groups or objects are what let a recovery reach receipts, because WAI delivery receipts carry no media time. A span of media time alone therefore reaches only the anchor — stated plainly rather than inventing a time mapping. - **The battery is reused, not reimplemented.** `synthesis_mark::battery` is already factored (`apply`, `rotate`, `area`); `Transform::apply` routes through it, and a unit test requires each registered transform to give exactly `battery::apply`'s bytes for every attack of both lists. Only gamma is new code. No change to SYN-2's files, so nothing conflicts with #425. - **Rates as `[n, d]` arrays in lowest terms**, one spelling per rate; comparisons are integer equality. TPR at 1% FPR is the survival rate where 100·F ≤ U and `null` otherwise (a value-or-nothing detector has one operating point), and the text says what a measured 0/U does and does not bound. - **Claims by media.** A claimed attack names its media, so evidence over clips never stands for pictures (the proposal's review raised scoping by media type). - **Records are reproduced or stated**, never silently trusted: a record over a corpus the verifier does not hold is checked for arithmetic and signature, and a policy can require reproduced evidence for claims. - **tent64s is not covered**: #425 is not merged. Its records are one call of the same harness once it lands (§10 says so). - **Corpus samples**: the conformance corpus holds its three 256 × 256 pictures (≈ 590 KB of `.rgb`), so the second implementation reruns that battery end to end. The measurement sets (25 MB) are not committed; the tent64 records are reproduced by the generator/test and, for the Python verifier, cross-checked against `synthesis-mark/battery.json`, which another program wrote. ## Checks run (all heavy work through `rb` on the build host) | check | command | result | |---|---|---| | claim corpus regenerate + verify | `cargo run --no-default-features --features key_discovery --bin wai_claim_vectors -- gen/verify ../claim-conformance` | all vectors pass; first 567 vectors identical to main | | claim second implementation | `python3 claim-conformance/claim_verify.py claim-conformance/vectors.json` | 615 vectors, 0 failures | | claim differential | `python3 claim-conformance/differential.py <wai_claim_vectors> --random 2000 --seed 1` | 59214 inputs, 0 differ, 0 crash | | robustness unit tests | `cargo test --release --no-default-features --features robustness --lib robustness::` | 5 passed | | robustness integration | `cargo test --release --no-default-features --features robustness --test robustness` | 7 passed (≈41 s) | | robustness corpus | `wai_robustness_vectors gen ../live-conformance/robustness` (release) | ≈38 s; regenerates byte for byte | | robustness second implementation | `python3 -I live-conformance/robustness_verify.py live-conformance/robustness` | 43 cases pass; conformance battery rerun end to end bit for bit; tent64 vs battery.json; claim vs §7.5.8; 10 mutations caught; 11 weakened checks caught (≈42 s) | | CI lib set | `cargo test --lib --no-default-features --features world,audio_scene,haptic,splat4d,score,provenance,neural_int,film,oer,receipt_claims,key_discovery,staged,video_int,audio_int,splat_int,stage_measure,telemetry,video_package,http` | 843 passed | | HTTP receipts | `cargo test --no-default-features --features http,receipt_claims --lib http_binding::tests_receipts` | 16 passed (new span test included) | | dependents | `--test staged_moq`, `--test cli_http`, wasm32 `--features receipt_claims,stage_measure` build | pass | | registry | `wai registry export` then `--check`; `--lib codecs::registry` | up to date; 14 passed | | clippy | `cargo clippy --no-default-features --features robustness,http,key_discovery --all-targets` | 0 notes in touched files | | C header | forced cbindgen regeneration | `include/wai.h` identical to main (module is `cbindgen:ignore`) | | other verifiers reading shared exports | `http_verify.py`, `staged_verify.py`, `pack_verify.py`, `signer_verify.py`, `ai_usage_verify.py`, `claim_verify.py consumption` | all pass | | repo checks | `check-tests-in-ci.py`, `check-workflow-concurrency.sh`, `check-spec-refs.py`, `check-wai-section-refs.py`, `check-no-vanity-metrics.sh`, `test-public-text-checks.sh`, `check-comparative-prose.sh`, `check-orphan-sources.py` | all pass | | public names | `check-public-names.sh` on every changed file; commit messages with `grep -E -f` | clean | ## Falsifications All committed first; each patch below was applied on the build host, the guarding check run, and the file restored (`git checkout`). Every one fails: | patch | guarding check | result | |---|---|---| | `recover_span` without the `recovery_outside_span` check | `wai_claim_vectors verify` | exit 101 (the runner's within-span assertion fires on the outside vectors) | | `Span::rules` without `start_ms ≤ end_ms` | `wai_claim_vectors verify` | exit 1, `soft_binding_span_time_inverted` accepted | | `soft-binding` admits a `span` member | `wai_claim_vectors verify` | exit 101 (the corpus no longer seals) | | HTTP recovery-record path without the span branch | `--lib http_binding::tests_receipts` | exit 101, the new test fails | | no rerun comparison (`table_irreproducible`) | `--test robustness` | exit 101, 2 tests fail | | a claim above its evidence holds | `--test robustness` | exit 101, 2 tests fail | | a rate not in lowest terms reads | `--test robustness` | exit 101, 2 tests fail | | corpus digest not compared | `--test robustness` | exit 101, 2 tests fail | | tent64 claim claims `crop-10%` in place of `local-blur` | `--test robustness` | exit 101, 2 tests fail | | gamma rounds down instead of to nearest | `--lib robustness::` | exit 101, `gamma_is_the_rounded_power` fails | On the Python side, `robustness_verify.py` mutates copies of the corpus (a count, a seed, a decimal rate, a wrong corpus file, the policy, the samples dropped, a stated status, a refusal's reason, the records reordered, a frame byte) and every copy fails; and it drops each of its own checks in turn (signature, exact rates, parameter ranges, media, counts, rates, values, corpus digest, sample sizes, rerun, survival) and the corpus catches each weakened verifier. The second implementations agree with `wai-rs` on every case, and `differential.py` finds no difference between the two claim verifiers on 59214 generated inputs. ## Not done - `wai-mark:tent64s` records (#425 open, stacked); one harness call once it merges. - No fingerprint algorithm is implemented, so the fingerprint branch of the harness (§6) and `values_invalid` on recomputation are specified but only the watermark path is exercised. - Transforms of audio and text are not registered; a corpus of either has no battery yet (§3). - The photographs of synthesis §7.5.8 have no record (not in the repository). - The span class is not exercised over MoQ catalogs or HTTP indexes beyond the unit test of the recovery-record path. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- **Closed:** landed on main through merge train C (#461, e0ac15f5); this PR's head is an ancestor of main.

dcharlot added 5 commits

2026-10-22 04:15:35 -04:00

jwp-receipts §2.6.4: soft bindings over a span of a track, and recovery through a span 4029aa8e7a

A soft-binding-span claim declares a value computed over a span of one track:
its media time (both ends included, C2PA's timespan) and, where stated, the
groups or objects that carry it. Recovery through it needs a verified delivery
receipt within the span and attests the span, never one object of it; a
receipt outside it is recovery_outside_span. Whole-object soft-binding claims
and their vectors are byte-identical. claim_receipt, claim_verify.py and the
differential learn the class; 48 vectors appended to claim-conformance.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai.media.robustness: robustness records anyone recomputes bit for bit, and claims held to them be8585f926

extensions/robustness-evidence.md: a corpus named item by item by the SHA-256
of its samples, the attack battery as registered integer transforms with
parameters and seeds (synthesis §7.5.7's battery with its parameters free, and
gamma), the signed robustness record whose table the harness recomputes and
whose rates are exact fractions, and the robustness claim that holds only
where every item of a cited record's corpus survived the attack and no
negative was read as marked. wai-rs module robustness (feature robustness),
wai_robustness_vectors, the corpus with wai-mark:tent64's records over the
measurement sets and its claim, and robustness_verify.py, which reruns the
conformance battery end to end with _wai_mark.py.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai.media.robustness: CI step, registry entry and export, SPEC §5, CHANGELOG, READMEs 3e4e58b088

Co-Authored-By: Claude Opus 5.5 <[email protected]>

robustness: keep the module out of the C header; include/wai.h as main has it a434dff84e

cbindgen parses every module, and the robustness module's constants and its
reason table reached include/wai.h. The module is cbindgen:ignore, as the live
modules are, and a forced regeneration gives main's header again.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

http_binding: a recovery record naming a span declaration is checked within the span

WAI HTTP delivery / HTTP corpus · falsify patches 0/3 (pull_request) Has been cancelled

Details

WAI HTTP delivery / HTTP corpus · falsify patches 1/3 (pull_request) Has been cancelled

Details

WAI HTTP delivery / HTTP corpus · falsify patches 2/3 (pull_request) Has been cancelled

Details

WAI HTTP delivery / HTTP corpus · every patch and mutation in exactly one shard (pull_request) Has been cancelled

Details

WAI HTTP delivery / HTTP corpus · verified both ways, and the differential (pull_request) Has been cancelled

Details

WAI HTTP delivery / cache rules · controls and labelled caches (pull_request) Has been cancelled

Details

WAI energy receipts / does this change touch it (pull_request) Has been cancelled

Details

WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled

Details

WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled

Details

WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled

Details

WAI conformance / does this change touch it (pull_request) Has been cancelled

Details

WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled

Details

WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled

Details

WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled

Details

WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled

Details

WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled

Details

WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled

Details

WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled

Details

WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled

Details

WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled

Details

WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled

Details

WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled

Details

WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled

Details

standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled

Details

standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled

Details

repository checks / lockfiles, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled

Details

joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Has been cancelled

Details

joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled

Details

joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Has been cancelled

Details

joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled

Details

01579796be

Over HTTP the record is checked with a delivery item that passed and lies within
the span, or, with none, refused recovery_outside_span.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot referenced this pull request

2026-10-24 20:26:12 -04:00

WAI delivery bindings: secure-objects AAD in receipts (MOQT 22/18/16), CMSD read, steering named to CDNs, live C2PA signing #458