wai: the energy order of dispatch, a self-metered relay, HwShunt closed to new profiles, meters that seal what they read, and what fewer bytes do not save (EN-C) #463
2026-10-25
wai: include/wai.h as build.rs regenerates it (energy_burst's MACMON_SOURCE)
Some checks failed
WAI HTTP delivery / HTTP corpus · verified both ways, and the differential (pull_request) Has been cancelled
WAI HTTP delivery / cache rules · controls and labelled caches (pull_request) Has been cancelled
WAI energy receipts / does this change touch it (pull_request) Has been cancelled
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
WAI conformance / does this change touch it (pull_request) Has been cancelled
WAI conformance / cargo-class corpora · linux (pull_request) Has been cancelled
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Has been cancelled
WAI conformance / cargo-class corpora · macos (pull_request) Has been cancelled
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
standards workspaces build + test / which workspaces this change touches (pull_request) Has been cancelled
standards workspaces build + test / macOS energy backends (pull_request) Has been cancelled
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Has been cancelled
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Has been cancelled
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been cancelled
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Has been cancelled
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been cancelled
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Has been cancelled
joule-code conformance gate / joule-moq-relay, every target (pull_request) Has been cancelled
joule-code conformance gate / joule-moq-relay, its own energy on a counter (macos) (pull_request) Has been cancelled
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Has been cancelled
cbindgen sees the public constant and writes PowerSource as an opaque type. Co-Authored-By: Claude Opus 5.5 <[email protected]>
Merge origin/main (
1a465f23d, train D) into wai/energy-honesty
CHANGELOG: both sides add entries under v0.4.0; EN-C's stays first. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-24
wai: WaiMulti::pick walks the energy order through pick_where, as the neural path does
pick reached the energy order through pick_with, which left pick_where used only under the neural feature and dead in every other build. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: the reference meters seal what their reader is — ModelBased from a reported power, never OnChipCounter
The meters sampled the processor power a non-privileged reader reports and sealed it OnChipCounter, but they never read the channel it comes from: on macOS 27 the processor channels of IOReport's Energy Model group read zero for an unprivileged reader, and the reader takes its power from another report it selects. The liveness rule (energy-measurement §3.1) passed on the reported samples, which move, while no counter was ever put to it. energy_burst::PowerSource says what a reader's samples are. A Counter's differences can seal OnChipCounter under §3.1, §4 and §2.3; a Reported power is refused as OnChipCounter whatever its brackets show (Bracket::on_chip_figure, on_chip_refusal) and seals ModelBased under the same bracket rules (Bracket::figure). wai_meter, wai_video_meter, wai_world_meter, wai_quantum_meter, wai_prov and wai_stage_measure --energy macmon now seal ModelBased, naming the reader as the method; rapl:<domain> stays a counter. energy-measurement §3.1 (the test is run on the counter), §2.9 and §7 say so, and the extensions that described the meters' figures as on-chip readings are corrected. No committed record changes class: the provenance vector's figures are unlabelled and keep their bytes. Also: the relay's powercap tests module after its impl, and platform-decode's test helper uses is_multiple_of. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: the energy order inside browser-sink's routing, gated on a sink-metered figure; no parallel budget
SPEC §4's energy order is an order over what a sink advertises, never a reason to advertise: first (classical decode the platform answers supported, smooth and power-efficient; in a page only for an object routed ua), smooth, classical (any other classical decode, and a learned capability whose decode the sink holds a qualifying measurement of), learned-without-budget. The measurement is a sink-metered figure in browser-sink §6's shape; it qualifies with OnChipCounter or CalibratedInstrument and coverage Whole, and its value is never read, so a figure still changes no route (§6). A deployer may compare it with a ceiling per decode as its own policy. The module-authorisation sentence naming a second place advertising is decided is gone. energy_order owns the ranks and browser-sink §6's measurement reader, which the page's energy entry now shares. browser-sink §4.7 ranks alternatives inside the routing, a WAI1's capability and fallback among them; the corpus adds a host- routed decode the user agent called power-efficient, and learned alternatives with counter, calibrated, partial and modelled figures, all marked synthetic (39 of 39 mutations caught by browser_sink_verify.py). energy-measurement §2.10, REGISTRY's energy budgets, the registry's energy_budget and BudgetRecord are removed. http_verify.py and the container's tests follow; the C header is regenerated. Co-Authored-By: Claude Opus 5.5 <[email protected]>
platform-decode: keep the query, move the order into browser-sink's routing, drop the budget
The review of #452 (M4–M9) found its platform-decode part at odds with browser-sink on main. Reworked inside EN-C: - Kept: the query read from the payload (AV1-ISOBMFF codec string from the sequence header, Annex E.3 from an HEVC SPS) with queries.json; the rule that powerEfficient and prefer-hardware are hints, never energy and never evidence of hardware. - Reworked: the answers enter browser-sink §3's report, one shape (report_answer): supported from isConfigSupported() alone, smooth and power_efficient from decodingInfo() only once WebCodecs said supported, so a Media Capabilities supported:false overrides nothing (http-delivery §12.2). The extension defines no order and no second meaning of advertising: the order is SPEC §4's energy order inside browser-sink §4.7, where an answer counts only for an object routed ua (AV1's user-agent tier is none; a decode-equivalence need with no probe run routes elsewhere). - Dropped: rank/order/select, advertise_for_envelope (a second advertising definition that could make a decodable WAI1 inert), the EnergyBudget and its ceiling, and order.json. A learned entry's measurement is browser-sink §6's energy entry. - wai-web: the platform bundle binds platformQuery, platformAnswer and platformChoose (browser-sink §4.7) on the browser_sink feature; the demo builds every query from a payload (the hand-written 1920x1080 query is gone), asks Media Capabilities after WebCodecs, and marks its one figure synthetic. The wording calls the HEVC source the platform's encoder configured with prefer-hardware. wai-web-wasm.yml builds the bundle. - int_kernels_vectors: the two new corpora's sidecar exclusions (review M1). Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: the energy order is platform-decode's, by default; the budget record in energy-measurement §2.10
Built on #452 instead of beside it: energy_order ranks with platform_decode::rank (first, smooth, classical, learned-without-budget) and reads platform answers as platform_decode::Answers; its own mapping and ranks are gone. SPEC §4's energy order is platform-decode §4's order applied by default to cap and fb; §7.1 step 2's default walk is the same over the entries that may be picked, the others keeping their places. energy-measurement §2.10 defines the budget record platform-decode §5 reads (class OnChipCounter, joules_micro, per frame|picture|second, relative_ppm, window_us, reference_sink) with filtering, resolution and the record's digest, and its refusals; energy_order::BudgetRecord reads and checks it and gives platform-decode its view. The registry schema and REGISTRY follow. browser-sink §4.7 ranks alternatives by platform-decode §4.2 from the user agent's answer (a route of none last, with no rank); the choice table states each rank. The corpus's choices are regenerated (one order changes: an alternative routed none now comes last; one case added), and browser_sink_verify.py ranks the same way (37 of 37 mutations caught). http_verify.py ranks learned capabilities as platform-decode §4.1 does. The C header is regenerated over the merged tree. Co-Authored-By: Claude Opus 5.5 <[email protected]>
platform-decode §4.3: a WAI1's fallback first whenever it ranks above a learned capability without a budget
#452's rule demoted a learned capability without a budget only for a power-efficient fallback, so a smooth or a software classical fallback stayed below it, while §4.2 ranks every classical decode the sink can make above it in a WAI2. §4.3 now applies §4.2's order to the two capabilities: step 5 first when the fallback ranks above, step 3 only if step 5 does not decode, so the rule never leaves inert an envelope the capability could decode. advertise_for_envelope follows; the vector learned-capability-fallback-not- power-efficient now decodes the fallback, and learned-capability-classical- fallback-no-platform is added. The extension also says SPEC now applies its order by default. Co-Authored-By: Claude Opus 5.5 <[email protected]>
Merge #452 (wai/gpu-int-tier, with #438 and #426) into wai/energy-honesty: the energy order builds on platform-decode
EN-C's dispatcher defaults build on #452's Media Capabilities / WebCodecs mapping instead of a second one. SPEC §7.1 step 2 now reads its default order as platform-decode §4's; the CHANGELOG keeps both sides' entries. Co-Authored-By: Claude Opus 5.5 <[email protected]>
Merge origin/main (
b16816671) into wai/energy-honesty
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: say what fewer bytes do not save, and the changelog
energy-steering §5.5: the steering figure is the hops' own energy averaged over their delivery, not the network's, which is largely flat against traffic. live-rooms' joules_ceiling is held against an attribution by bytes. The research taxonomy's compression lever claims cost and a mobile radio's draw, not network energy. CHANGELOG: the slice's entry. Co-Authored-By: Claude Opus 5.5 <[email protected]>
joule-moq-relay: a unit test's microjoule, and the CI grep for a measured line
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: no modelled or zero figure shown as a measurement
- The C settlement kernel graded every receipt measured, from hardware, by hardware_meter, whatever its meter; it now writes the grade and device the meter states. Its host harness's figures are constants: projected, from a simulation, by model_estimated (oer-receipts §2: an Estimator figure is projected). The Zephyr skeleton states projected and no longer seals a compute figure of 0. firmware_vectors.json is regenerated; both verifiers pass it. - wai-web: the world demo seals the page's estimate labelled Estimator and says so on screen (label_page_figure, tested); the quantum demos seal the unmetered marker instead of invented constants, and their getters say a 0 is unmetered. - The quantum studio shows a figure with its class, coverage and uncertainty; the quantum CLI prints the unmetered marker as unmetered (tested); the metering tools head a bracket as a bracket and print the marker on stdout when they seal it; a provenance total names the class it reads at (tested). - energy-measurement §2.8 and §6 record which demos still seal an illustrative figure the page passes in. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: the energy order keeps non-selectable entries in place; the HTTP and pin corpora state their order
energy_order reorders only the entries SPEC §7.1 step 2 may pick, each into one of their table places; a companion or refinement keeps its own, so where nothing selectable moves the walk is table order. SPEC §7.1 says so. HTTP (http-delivery §7 step 4): the client's select and fetch default to the energy order. O2's pin cases walk the table's order, stated in each case as a deployer policy; select_O2_default and fetch_O2_default are the default, which picks AVIF before the learned int_mlicpp. http_verify.py's default order is the energy order too (1057 of 1057 cases; the mutation shard 79 of 79). The pin corpus's selection cases are about pins, so its runner walks the table's order, a deployer policy (pin-conformance/README.md). wai-web's pick tests follow the default order. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-22
wai CHANGELOG: the GPU tier's conditions, and platform decode in dispatch
Some checks failed
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Successful in 7s
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Successful in 6s
wai-web reach builds / wai-web reach · does this change touch it (pull_request) Successful in 10s
joule-moq-room room service / joule-moq-room, every target (pull_request) Successful in 1m1s
wai-quantum WebGPU member / member · discrete GPU, Vulkan (jetson-hub) (pull_request) Successful in 28m19s
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Successful in 27m0s
WAI conformance / cargo-class corpora · linux (pull_request) Failing after 2m20s
WAI conformance / cross-arch byte-equality · linux (pull_request) Successful in 27s
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Successful in 2m5s
wai-ops-gpu integer operators on GPUs / builds · no adapter is not a pass (linux) (pull_request) Successful in 2m29s
wai-pack / wai-pack · linux (pull_request) Successful in 3m6s
wai-quantum studio and desktop / studio · browser (pull_request) Successful in 4m18s
WAI energy receipts / energy receipts · linux (pull_request) Successful in 10m4s
wai-quantum WebGPU member / member · software Vulkan (linux) (pull_request) Successful in 2m12s
wai-quantum WebGPU member / shader checks · browser build · wasip2 inertness · MSRV (pull_request) Successful in 3m14s
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Successful in 4m12s
WAI mbt2018_mean integer decode (regenerated vectors) / regenerate mbt2018_mean integer vectors → Rust decode, required (pull_request) Successful in 5m24s
wai-web reach builds / wai-web reach builds · the package of record, every output as recorded (pull_request) Successful in 2m53s
wai-web reach builds / wai-web reach builds · this tree's wai-web, every rung on its engine line (pull_request) Successful in 4m5s
standards workspaces build + test / macOS energy backends (pull_request) Successful in 7m39s
WAI conformance / cargo-class corpora · macos (pull_request) Failing after 1m37s
WAI conformance / cross-arch byte-equality · macos (pull_request) Successful in 17s
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Successful in 39s
WAI energy receipts / energy receipts · macos (pull_request) Successful in 3m45s
wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Successful in 2m19s
wai-pack / wai-pack · macos (pull_request) Successful in 2m15s
wai-quantum studio and desktop / desktop app · macos (pull_request) Successful in 1m50s
wai-quantum WebGPU member / member · Metal (macos) (pull_request) Successful in 2m13s
wai-quantum WebGPU member / member · browser WebGPU (macos) (pull_request) Successful in 1m29s
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Successful in 5m47s
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-web: the platform_decode bundle, and a page that runs it against the platform
platformQuery and platformOrder bind wai::platform_decode behind the platform_decode feature, built as its own bundle, so the main bundle is unchanged. demo/platform_decode.html queries and decodes every AV1 floor object of the packaging corpus through WebCodecs with the derived configuration, asks about the same family at 1920x1080, encodes HEVC with the platform's own encoder and decodes it back with the codec string read from the stream, and orders a learned entry and an AV1 entry from the answers; verify_platform_decode.mjs drives it in a headless browser. Co-Authored-By: Claude Opus 5.5 <[email protected]>
platform-decode: Media Capabilities and WebCodecs in dispatch
A new extension, from Media Capabilities (WD 18 October 2026), WebCodecs (WD 19 October 2026) and its AV1 and HEVC registrations: the query a sink forms from the payload, never from what an encoder declared; supported: false making the capability unsupported for that object; smooth and powerEfficient ordering only, never written as energy; prefer-hardware a hint, not evidence of hardware; the default order and the WAI1 advertising rule; the energy budget read from energy-measurement. SPEC §4 and §7.1 point to it. §6 records a browser run on an arm64 desktop. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-rs: platform decode capabilities in dispatch (platform-decode)
wai::platform_decode: the query a sink makes of Media Capabilities and WebCodecs for an entry, read from its payload (AV1: the AV1-ISOBMFF codec string from the sequence header, full where the stream is not 4:2:0 BT.709 studio range; HEVC: the Annex E.3 string, cropped and coded sizes and bit depth from the SPS); the answers; the energy budget as read from energy-measurement (OnChipCounter, measured, on a reference sink); and the default order, a SPEC §7.1 deployer policy: power-efficient classical decode and budgeted learned decode first, then smooth, then other classical, then learned without a budget, manifest order within a rank. select() runs §7.1 in that order; advertise_for_envelope() is the WAI1 rule. Pure logic, no feature, no dependency. platform-decode-conformance: order.json (every rule, and the WAI1 cases) and queries.json (packaging-corpus floors, and an SPS a hardware encoder wrote whose level is not the one it declared). The tests also derive every corpus floor to its HLS master's codec string and size, reproduce the AV1-ISOBMFF examples, read SPSs with sub-layers and emulation prevention, and catch each rule turned off. Co-Authored-By: Claude Opus 5.5 <[email protected]>
ci(wai-ops-gpu): the semantics suite and the WGSL rules on every leg
The Metal leg requires the semantics line with every guarded case equal and the edited semantics kernel refused, and counts sixteen tests; the browser step runs the vectors against the wasm32 reference under Node and requires the page's semantics lines; the linux leg's absent-adapter check covers tests/semantics.rs. wgsl-conformance is a trigger path. Co-Authored-By: Claude Opus 5.5 <[email protected]>
determinism-tiers §5: claiming decode-equivalence on a GPU
The conditions under which a decoder may claim the tier for output its GPU computed, from WGSL (CRD 21 October 2026) and naga 30.0.1 as read: integer only, so no reassociation or fusion (WGSL §15.7.5) can change a result; no subgroup or quad operation and no extension (§15.5, §15.6.3); no result that depends on scheduling and no out-of-bounds access (§6.5.7); the translator's integer guards on, and no operation it leaves to the hardware reached; the WGSL integer semantics vectors and the implementation's probe passed first, on that adapter; the claim naming adapter and translator. The GPU bullet lists the adapters on which this revision's kernels passed: Metal, a browser's WebGPU, Vulkan on Linux and Windows, DX12 on Windows, with the capability corpora decoding to the CPU's bytes on each but the browser. The 0x1002 adapter, which passed on the previous kernel text and has not run the suite, is no longer claimed. §6's row records the run. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-ops-gpu browser: the semantics suite through the browser's WGSL compiler
run_semantics holds the committed vectors to the reference compiled to wasm32 in the page and runs them, with SplitMix64 cases, on every adapter the page is offered; semantics_reference.mjs does the first half under Node, with no GPU. run.mjs serves wgsl-conformance and, under WAI_OPS_GPU_REQUIRE, requires both lines. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-ops-gpu: the shipped shaders held to the GPU tier's rules on naga's IR
tests/wgsl_rules.rs parses every shipped module with naga 30.0.1 and validates it with no capability, then holds it to determinism-tiers §5's GPU conditions: bool, i32 and u32 only, a closed list of expressions and integer built-ins, one atomic kind with its result unused, no barrier or workgroup memory, shift amounts masked below 32 and clamp bounds literal and ordered, every integer operation one the semantics suite runs, and naga's guards (naga_div, naga_mod, naga_neg, naga_abs, signed arithmetic through unsigned) in each module's MSL and HLSL. It holds the crate to the checked create_shader_module, and shows nine planted violations each refused by the rule it breaks. naga enters as a native dev-dependency, the release wgpu 30.0.1 already locks. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-ops-gpu: every run-time shift amount masked, the run-time clamps as min(max())
naga 30.0.1 passes a shift amount to MSL, HLSL and SPIR-V without reducing it modulo 32, and writes an integer clamp as MSL's clamp, which leaves bounds out of order undefined. The kernels already handled every shift of 32 or more explicitly and load refuses lo > hi; masking each run-time amount with & 31u and writing the two run-time clamps as min(max(e, lo), hi) gives WGSL's result unchanged and makes the translated code defined on every backend. The clamp mutant follows its text. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-ops-gpu: WGSL's integer semantics on every adapter before it runs a graph
A suite of every integer operation WGSL defines on i32, u32 and their two-component vectors, at the run-time cases MSL, HLSL and SPIR-V leave open: wrapping arithmetic and negation, division and remainder by zero and of the most negative i32 by -1, shift amounts 0..40 and past them, clamp bounds in and out of order, bit fields at and past the word. Each result is written from the WGSL text (semantics::reference), never from a shader. Discovery runs it after the arithmetic probe and refuses an adapter that differs on a guarded case. The cases no kernel reaches (a shift of 32 or more, clamp bounds out of order) are marked unguarded: reported, not deciding. wgsl-conformance/integer.jsonl holds the edge cases, written by wai-wgsl-vectors; tests/semantics.rs holds the file to the reference, runs it and SplitMix64 cases on every adapter, and shows a remainder written by hand refused at discovery. Co-Authored-By: Claude Opus 5.5 <[email protected]>
joule-moq-relay: meter the relay's own energy for real, or sign the unmetered marker
A sampler reads a counter every 100 ms while the relay runs: on macOS the relay process's own CPU energy (ri_energy_nj, unprivileged; scope task), on a Linux host the operator states runs the relay alone the CPU packages' RAPL energy (scope package). A room's WMH1 record carries the advance over its span as OnChipCounter (tag 4, filtering Unknown, window the span, a declared uncertainty: interpolation and counter lag at each end, the vendor's filtering noise for a package counter, the rounding) where the counter was live across the span (energy-measurement §3.1) and the relay served that room alone; the unmetered marker otherwise, logged with why. A session summary stays unmetered: sessions share one process. [metering] energy = auto|off and dedicated_host. The corpus test's record keeps its bytes with the meter off. Tests: src/energy.rs (arithmetic, liveness, uncertainty, a made powercap tree), metering's tag-4 round trip and refusals, tests/relay_energy.rs (a measured record on a host with a counter, the marker beside another room's session and with the meter off; SKIPPED where the host has no counter, failing under JOULE_MOQ_RELAY_ENERGY_REQUIRE). CI: a macos job requires the measured figure. live-metering §8 and §4.6 say what the relay signs, and that the allocation of a hop's joules by bytes is an accounting convention. joule-moq: the mock relay's figure is documented as carrying no class. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: the energy order of dispatch, and the energy budget that lifts a learned capability
SPEC §4, §7.1 step 2: a sink tries an envelope's capabilities in the energy order unless its deployer configures another: a decode the platform answers supported and power-efficient first, a learned capability (NeuralIntegerExact, NeuralEntropyExact, NeuralFloat, Behavioral) with no energy budget after every other, the envelope's order within each. The order changes which capability decodes, never a reason. An energy budget is a decode figure measured on a named reference sink under OnChipCounter or CalibratedInstrument, in a record named by its digest; no registration states one yet (REGISTRY, Energy budgets; the export's optional energy_budget, schema only). wai-rs: energy_order (DispatchPolicy, Budgets, EnergyBudget, is_learned); Wai::dispatch_verified and WaiMulti::pick apply it, dispatch_with and pick_with take another order, the HTTP client's default order and the C ABI's wai_envelope_select follow it. Tests that are about pins state the manifest order they run in. browser-sink §4.7: objects sharing a choice are alternatives; the page decodes the first in the energy order that routes (no_alternative otherwise). browser_sink::choose_report, the page's chooseReport (wai-live-web, binding.js), a choices section in live-conformance/browser (existing sections unchanged), checked by wai-rs, the page's corpus run and browser_sink_verify.py (34 of 34 mutations caught). Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai: HwShunt closed to every profile defined after the hardware class was refined
energy-measurement §2.6, New profiles: the profiles that could have sealed HwShunt keep their acceptance, listed by name; a profile, record, claim, table or registration member defined since refuses it from every producer and reads it as no other class. A RAPL or system-management-unit package counter is OnChipCounter. wai-rs: energy_class::check_new_profile (AcquisitionError::LegacyInNewProfile), with its test. Co-Authored-By: Claude Opus 5.5 <[email protected]>
docs/research: a metered pack sealed with its fabric record
Some checks failed
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Successful in 34s
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Successful in 2m22s
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Successful in 2m18s
WAI conformance / cross-arch byte-equality · linux (pull_request) Successful in 27s
WAI energy receipts / energy receipts · linux (pull_request) Successful in 10m3s
WAI neural sink gates / model-free refusals of the neural sink (pull_request) Successful in 1m21s
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Successful in 11m50s
WAI HTTP delivery / HTTP corpus · every patch and mutation in exactly one shard (pull_request) Successful in 5s
wai-ops-gpu integer operators on GPUs / builds · no adapter is not a pass (linux) (pull_request) Successful in 1m52s
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Successful in 23m42s
WAI HTTP delivery / HTTP corpus · verified both ways, and the differential (pull_request) Successful in 2m12s
WAI conformance / cargo-class corpora · linux (pull_request) Successful in 19m5s
wai-pack / wai-pack · linux (pull_request) Successful in 1m33s
WAI HTTP delivery / cache rules · controls and labelled caches (pull_request) Successful in 1m20s
wai-pack / wai-pack · linux-arm64 (pull_request) Successful in 1m37s
wai-pack / wai-pack · the floor through a media prober (pull_request) Failing after 17s
wai-pack / wai-pack · dependency licences (pull_request) Successful in 1m23s
wai-quantum studio and desktop / studio · browser (pull_request) Successful in 2m40s
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Successful in 4m9s
wai-pack / wai-pack · independent verifier (Python) (pull_request) Successful in 7m15s
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Successful in 35m1s
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Successful in 6m1s
standards workspaces build + test / macOS energy backends (pull_request) Successful in 9m18s
WAI conformance / cargo-class corpora · macos (pull_request) Successful in 13m39s
WAI conformance / cross-arch byte-equality · macos (pull_request) Successful in 19s
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Successful in 55s
WAI energy receipts / energy receipts · macos (pull_request) Successful in 5m17s
wai-pack / wai-pack · macos (pull_request) Successful in 2m50s
wai-quantum studio and desktop / desktop app · macos (pull_request) Successful in 2m28s
wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Successful in 2m35s
The av1-360 pack with --fabric gpu --meter fabric, run when the GPU was otherwise idle: a ModelBased figure of 2,248.4 J divided into the CPU's 475.4 J (task) and the GPU's 1,773.0 J (rail), the claim's steps the search, SSE and hashes on the GPU and the rest on the CPU, accepted by wai-pack verify and by pack_verify.py; and the same pack of run B, refused pack-meter a minute later when the GPU was shared. Co-Authored-By: Claude Opus 5.5 <[email protected]>
docs/research: WAI across fabrics, the research and the measurements
Some checks failed
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
WAI HTTP delivery / WAI HTTP · does this change touch it (pull_request) Has been cancelled
WAI HTTP delivery / HTTP corpus · falsify mutations 0/3 (pull_request) Has been cancelled
WAI HTTP delivery / HTTP corpus · falsify mutations 1/3 (pull_request) Has been cancelled
WAI HTTP delivery / HTTP corpus · falsify mutations 2/3 (pull_request) Has been cancelled
WAI HTTP delivery / HTTP corpus · falsify patches 0/3 (pull_request) Has been cancelled
WAI HTTP delivery / HTTP corpus · falsify patches 1/3 (pull_request) Has been cancelled
WAI HTTP delivery / HTTP corpus · falsify patches 2/3 (pull_request) Has been cancelled
WAI HTTP delivery / HTTP corpus · every patch and mutation in exactly one shard (pull_request) Has been cancelled
WAI HTTP delivery / HTTP corpus · verified both ways, and the differential (pull_request) Has been cancelled
WAI HTTP delivery / cache rules · controls and labelled caches (pull_request) Has been cancelled
WAI neural sink gates / does this change touch it (pull_request) Has been cancelled
WAI neural sink gates / model-free refusals of the neural sink (pull_request) Has been cancelled
wai-ops-gpu integer operators on GPUs / does this change touch it (pull_request) Has been cancelled
wai-ops-gpu integer operators on GPUs / builds · no adapter is not a pass (linux) (pull_request) Has been cancelled
wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Has been cancelled
wai-pack / wai-pack · does this change touch it (pull_request) Has been cancelled
wai-pack / wai-pack · linux (pull_request) Has been cancelled
wai-pack / wai-pack · linux-arm64 (pull_request) Has been cancelled
wai-pack / wai-pack · macos (pull_request) Has been cancelled
wai-pack / wai-pack · independent verifier (Python) (pull_request) Has been cancelled
wai-pack / wai-pack · the floor through a media prober (pull_request) Has been cancelled
wai-pack / wai-pack · dependency licences (pull_request) Has been cancelled
wai-quantum studio and desktop / does this change touch it (pull_request) Has been cancelled
wai-quantum studio and desktop / studio · browser (pull_request) Has been cancelled
wai-quantum studio and desktop / desktop app · macos (pull_request) Has been cancelled
wai-web wasm32 / does this change touch it (pull_request) Has been cancelled
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Has been cancelled
Which fabric can run each step of a WAI pack and verify, on the fleet as probed, through which API, with the primary sources: VideoToolbox and the media engines (AV1 decode from M3; no AV1 encode on any Apple chip through the 2026 launches), WGSL, Metal and CUDA integer semantics, the neural engine (FP16: no exact step), NVENC/NVDEC, QSV, VCN and Vulkan Video; AV1 §7.2's exactness and film grain; hardware encoders' irreproducibility; and energy without root on macOS 27 (only IOReport's GPU rail is live; the kernel's per-task CPU energy; per-client GPU time; the sole-user rule), Linux and Windows. The design choice each finding decided, what was judged unsound, and the big-buck-bunny measurements: packages byte-identical on the GPU, the media engine's pictures dav1d's, and joules per fabric against the CPU baselines. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai CHANGELOG, claim-conformance README: steps on every fabric
The changelog's v0.4.0 entry for packaging §11.6, the measurement claim's fabric record, wai-pack-gpu, wai-pack's fabric dispatch, meter and floor-decode, and their conformance; the claim corpus's README describes the fabric record's vectors. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-pack tests: a share on a fabric no step ran on is refused for itself
The fabric test held a split with a GPU share and no GPU step to pack-measurement-claim, which the claim's own sum rule would also give were the share silently dropped; it now requires the packer's reason, so the refusal in fabric_record is what the test holds. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-pack-gpu: wait for a buffer map itself, not only for its submission
With several threads polling one device, a map's callback can run inside another thread's poll, after this thread's wait for its submission has returned. The read then found no result and handed the call back to the CPU: correct, since the CPU computes the same vectors, but it happened to 15 of 24,930 motion-search calls of a 12-piece pack of big-buck-bunny. The read now waits for the callback, polling without blocking until a deadline, and fails only past it. tests/concurrent.rs: 16 threads share one device, 9,600 calls of the search and of BLAKE3, every one required to complete on the device with the reference's result. With the old wait the test fails. Also clippy's clamp and as_chunks forms. Co-Authored-By: Claude Opus 5.5 <[email protected]>
ci(wai-pack): the GPU steps on the macOS leg, and the fabric test's floor
The macOS leg, whose host has a GPU, runs wai-pack-gpu's clippy, its kernels against their references and its mutants, and wai-pack's fabric differential with the `gpu` feature, with WAI_PACK_GPU_REQUIRE set so that an absent adapter fails rather than skips; each step requires its report lines. The paths include wai/wai-pack-gpu. The test-count floors gain --test=fabric and raise --lib to the target's count. Co-Authored-By: Claude Opus 5.5 <[email protected]>
packaging §11.6: steps and fabrics
The computations of a pack and a verify are named steps, each of which may run on a CPU, a GPU, a media engine or a neural engine. Every step is a function of its inputs, defined in integers (and floor-decode by the AV1 decoding process), and none names a fabric: 1. a packager runs a step only on a backend that has given the reference's output on qualifying inputs, never on one that computes otherwise than the step's definition, and leaves a call a backend does not take to the CPU; so §11.2 holds across fabrics (amended to say so), and only a metered package's claim says where steps ran; 2. a verifier computes a check on another fabric only where the package states the value it compares with, and decides a mismatch again on the reference: a verdict that changes with the fabric is the verifier's fault; 3. no step is computed by a hardware encoder, whose output no rule fixes; a floor encoded on one is a §7.5 floor naming its encoder, version, device and driver; 4. a floor states no decoded-output digest, so no floor verdict comes from a hardware decode; wider hardware formats are read back exactly or refused, never rounded; 5. a metered package's claim may carry the fabric record (jwp-receipts §2.4.8), its steps §11.6's terms (§11.3 step 7); an unmetered package carries none. Terms gain Step and Fabric; §11.4 says what the reference packager places where. Co-Authored-By: Claude Opus 5.5 <[email protected]>
pack-conformance: a metered package's fabric record, and one naming no step
Two package mutations of the metered golden (§9.4): `metered-fabrics`, whose measurement claim carries a fabric record of two steps on the CPU and the figure as its one share, which both verifiers accept; and `metered-fabrics-unknown-step`, a claim that keeps every rule of jwp-receipts §2.4.8 but whose record names a step packaging §11.6 does not define, refused measurement-claim-invalid by wai-pack and pack_verify.py alike. Every other file of the corpus regenerates unchanged. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-pack floor-decode: a package's floors through a conformant AV1 decoder
`wai-pack floor-decode <package> --decoder dav1d|videotoolbox` decodes every floor rung's CMAF files (init.mp4 and the fragments in the floor playlist's order) through ffmpeg, with libdav1d on the CPU (film grain exported, not applied) or VideoToolbox on the media engine (its frames required to be the hardware's: a decoder that fell back to software fails), and prints each piece's SHA-256 of its 4:2:0 pictures at the stream's bit depth. Informative, for comparing decoders and fabrics (packaging §11.6 item 4): nothing refuses a floor for it. The media engine gives AV1 frames as P010 whatever the stream's bit depth. They are read back exactly: a 10-bit sample is the word's high ten bits, an 8-bit one is recovered only from a shift or a bit replication, and a word with low bits set, or a 10-bit value no 8-bit value widens to, fails the picture. ffmpeg's own 16-to-8-bit conversion rounds and dithers, so it is never used. A rung whose sequence header carries film grain is not decoded on the media engine, which applies grain no rule fixes. av1: SequenceHeader::film_grain_params_present reads the bit after color_config(); SequenceHeader::parse does not, so what a packager accepts is unchanged. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-pack: each step placed on a fabric by measured energy (packaging §11.6)
fabric.rs names the steps of a pack and a verify (source-read, segment, base-search, base-code, refine-code, sse, object-hash, digest, floor-read, index, io, ...) and places each call of one on a fabric, the way an energy-aware scheduler places work: a backend is a candidate only once it has given the CPU reference's output on qualifying inputs (seeded frame pairs of every kind the search meets, seeded SSE and BLAKE3 inputs), and among candidates the least `uJ per call + nJ per unit * units` of a measured cost table wins, the CPU on a tie or where nothing was measured. The CPU is the reference and the fallback: a call another fabric does not take runs on the CPU, with the same output. --fabric cpu (the default), gpu, or auto:<costs.json>. With feature `gpu`, base-search, sse and object-hash run on a GPU through wai-pack-gpu. The packer's coder, its floors' object hashes, and the verifier's object hashes go through the placement; the verifier hashes a component's objects in one batch and decides any object-hash refusal again on the CPU, so its verdict is the CPU's. With feature `fabric-meter` (macOS), --meter fabric meters the pack per fabric, without privileges: the CPU's energy as the kernel accounts it to the process (task), and the GPU rail (IOReport "GPU Energy"), read on its republish at each end, where the process held at least 99% of every client's GPU time (rail); a shared GPU gives no figure, and the pack is refused pack-meter, saying why. The claim carries the fabric record (jwp-receipts §2.4.8). `wai-pack fabric list` shows each step's qualified backends, `fabric calibrate` measures the cost table. tests/fabric.rs: placement, the cost table, and the claim's record on every build; with `gpu`, on every GPU, the search against the reference (qualifying frames, seeded noise at every block size and range, every fixture's frame pairs, whole encodes), every golden packed on the GPU byte for byte the committed package, every golden and package and staged mutation given the CPU's verdict with the hashes on the GPU, and an edited kernel refused by qualification and, forced in, moving no verdict. pack_verify.py holds a package's fabric record to the steps of §11.6. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-pack-gpu: the motion search, SSE and BLAKE3 as exact WGSL kernels
A crate of its own, with its own lockfile, as wai-ops-gpu is: WGSL compute kernels through wgpu 30.0.1 (Metal, Vulkan, DX12), in 32-bit words with every intermediate bounded inside its type, so a device that executes WGSL's integer arithmetic gives the CPU's result for every input. - motion.wgsl: one workgroup per block, each thread the least of the candidates it visits by (cost, |dy| + |dx|, index), the workgroup reducing them to the least: the order is total, so the result is the encoder's whichever thread meets which candidate first. Half-pel prediction with integer rounding and clamped coordinates, as integer-payloads §3 defines it. - sse.wgsl: partial sums of at most 4,096 bytes a thread (under 2^32), added on the host in 64 bits. - blake3.wgsl: BLAKE3's chunk function, one thread per chunk of one message; a message of several chunks has its parent nodes merged on the host by the reference crate's subtree functions, in the tree the specification fixes. A size a kernel does not take (a block whose cost can pass 2^32 - 1, a range past 127, a binding past the device's) is refused before anything runs, so the caller computes it on the CPU. A software rasteriser is not opened: it runs on the CPU. tests/kernels.rs holds each kernel to a reference transcribed from the extension text (the BLAKE3 crate for BLAKE3), on frames of noise, near ties, flat fields (every candidate ties), alternating columns (two vectors tie at one length) and hard edges, at sizes that are not whole blocks and both precisions; tests/mutants.rs edits one expression of a kernel at a time (a tie rule, a rounding addend, a clamp bound, a reduction bound, a square, a rotation, a permutation entry, the root flag, the chunk counter, a block length) and requires the cases to catch each, on every adapter. With no adapter the tests print SKIPPED, unless WAI_PACK_GPU_REQUIRE is set. Co-Authored-By: Claude Opus 5.5 <[email protected]>
jwp-receipts §2.4.8: a measurement claim's fabric record
A measurement claim may carry `fabrics` (energy-measurement §6.3): the steps of the work the figure covers, each with every fabric that ran it (cpu, gpu, media, neural) and the backend that did, and the figure divided into one share per fabric, each attributed as `task` (the operating system's account of the work's own energy) or `rail` (the fabric's whole rail, the work its sole user, at least 99% of its busy time). No attribution divides a shared rail by its users' busy time, which does not apportion energy. `fabrics` is the one claim member that is absent rather than null (§2.4), so every claim sealed before it keeps its bytes and link hash. Rule 6 refuses, in order: a fabric or attribution outside §6.3 (measurement_fabric_unknown); no step or no share, or either out of order or repeated (measurement_fabric_order); a step on a fabric with no share (measurement_fabric_unmetered); a share on a fabric no step ran on (measurement_fabric_unused); shares that do not sum to the figure (measurement_fabric_sum). wai-rs: MeasurementClaim::fabrics, its parse, rules and serialisation, and meter_report::emit_with_fabrics. claim_verify.py: the same rules, written from the text. claim-conformance: 14 vectors appended after the 567 before them, which a new test pins by digest (computed from the committed corpus before the change); one accept, four step-2 shape refusals (null among them), the step-4 reasons, and a share attributed by GPU time refused. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-rs: the encoder's motion search and an object's hash may run elsewhere
int_video_enc::encode_with takes the motion search as a MotionSearch, whose rule is the encoder's (every candidate's cost, the least by cost, then by |dy| + |dx|, then the earlier vector): every other step of the encode stays here, so a search that keeps the rule gives encode's payload byte for byte. CpuSearch is the reference, and encode is encode_with over it; a search that gives another number of vectors than the frame's blocks is refused (field_range). stage_index::check_object_hashed is check_object with the content hash handed in, so a verifier can hash a component's objects in one batch on another fabric; check_object is it over the reference hash. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-21
Merge origin/main into wai/pack-efficiency (exploration, ad presentation, access services, sandbox)
Some checks failed
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Successful in 6m42s
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Successful in 2m11s
WAI conformance / cross-arch byte-equality · linux (pull_request) Successful in 29s
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Successful in 29m8s
WAI energy receipts / energy receipts · linux (pull_request) Successful in 11m1s
wai-pack / wai-pack · linux (pull_request) Successful in 1m35s
WAI conformance / cargo-class corpora · linux (pull_request) Successful in 19m52s
wai-quantum studio and desktop / studio · browser (pull_request) Successful in 4m12s
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Successful in 4m18s
WAI HTTP delivery / HTTP corpus · falsify mutations 0/3 (pull_request) Successful in 31m53s
WAI HTTP delivery / HTTP corpus · falsify patches 0/3 (pull_request) Failing after 1m40s
WAI HTTP delivery / HTTP corpus · falsify patches 1/3 (pull_request) Failing after 1m1s
WAI HTTP delivery / HTTP corpus · falsify patches 2/3 (pull_request) Failing after 1m5s
WAI HTTP delivery / HTTP corpus · every patch and mutation in exactly one shard (pull_request) Successful in 4s
WAI HTTP delivery / HTTP corpus · falsify mutations 1/3 (pull_request) Successful in 31m41s
WAI HTTP delivery / HTTP corpus · verified both ways, and the differential (pull_request) Successful in 2m24s
WAI HTTP delivery / cache rules · controls and labelled caches (pull_request) Successful in 1m34s
wai-pack / wai-pack · linux-arm64 (pull_request) Successful in 1m26s
wai-pack / wai-pack · the floor through a media prober (pull_request) Failing after 17s
wai-pack / wai-pack · dependency licences (pull_request) Successful in 1m16s
wai-pack / wai-pack · independent verifier (Python) (pull_request) Successful in 6m31s
WAI HTTP delivery / HTTP corpus · falsify mutations 2/3 (pull_request) Successful in 32m22s
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Successful in 6m19s
standards workspaces build + test / macOS energy backends (pull_request) Successful in 9m13s
WAI conformance / cargo-class corpora · macos (pull_request) Successful in 17m14s
WAI conformance / cross-arch byte-equality · macos (pull_request) Successful in 19s
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Successful in 57s
WAI energy receipts / energy receipts · macos (pull_request) Successful in 7m3s
wai-pack / wai-pack · macos (pull_request) Successful in 1m28s
wai-quantum studio and desktop / desktop app · macos (pull_request) Successful in 2m49s
The changelog's packaging section stays at the top of v0.4.0, above main's entries. Co-Authored-By: Claude Opus 5.5 <[email protected]>
pack-conformance: policy_diff.py generates profile, source and the [floor] table
Some checks failed
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Has been cancelled
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Has been cancelled
WAI conformance / cross-arch byte-equality · linux (pull_request) Has been cancelled
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Has been cancelled
WAI conformance / cross-arch byte-equality · macos (pull_request) Has been cancelled
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Has been cancelled
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Has been cancelled
WAI energy receipts / energy receipts · linux (pull_request) Has been cancelled
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
WAI energy receipts / energy receipts · macos (pull_request) Has been cancelled
WAI HTTP delivery / HTTP corpus · falsify mutations 0/3 (pull_request) Has been cancelled
WAI HTTP delivery / HTTP corpus · falsify mutations 1/3 (pull_request) Has been cancelled
WAI HTTP delivery / HTTP corpus · falsify mutations 2/3 (pull_request) Has been cancelled
WAI HTTP delivery / HTTP corpus · falsify patches 0/3 (pull_request) Has been cancelled
WAI HTTP delivery / HTTP corpus · falsify patches 1/3 (pull_request) Has been cancelled
WAI HTTP delivery / HTTP corpus · falsify patches 2/3 (pull_request) Has been cancelled
WAI HTTP delivery / HTTP corpus · every patch and mutation in exactly one shard (pull_request) Has been cancelled
WAI HTTP delivery / HTTP corpus · verified both ways, and the differential (pull_request) Has been cancelled
WAI HTTP delivery / cache rules · controls and labelled caches (pull_request) Has been cancelled
wai-pack / wai-pack · linux (pull_request) Has been cancelled
wai-pack / wai-pack · linux-arm64 (pull_request) Has been cancelled
wai-pack / wai-pack · macos (pull_request) Has been cancelled
wai-pack / wai-pack · independent verifier (Python) (pull_request) Has been cancelled
wai-pack / wai-pack · the floor through a media prober (pull_request) Has been cancelled
wai-pack / wai-pack · dependency licences (pull_request) Has been cancelled
wai-quantum studio and desktop / studio · browser (pull_request) Has been cancelled
wai-quantum studio and desktop / desktop app · macos (pull_request) Has been cancelled
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Has been cancelled
The seeded policies now carry component.profile (floor-only, or a value it does not take), a source, and floor.supplied_form and extra_keyframes, so the two policy readers are compared on the new members and their refusals (policy-floor-only among them). Co-Authored-By: Claude Opus 5.5 <[email protected]>
ci(wai-pack): the claim verifier and the OER verifier it imports are among the paths
pack_verify.py now reads a metered package's claim with claim-conformance/claim_verify.py, which imports oer-conformance/oer2_verify.py: a change to either runs this workflow. Co-Authored-By: Claude Opus 5.5 <[email protected]>
pack-conformance: the supplied CMAF reader differentially (cmaf_diff.py)
wai-pack's reader of a supplied CMAF floor (wai-pack cmaf-verdict, a conformance aid) against pack_verify.py's, which shares no code with it, on seeded alterations of a media muxer's segments (packs/video-cmaf-01/floor) and of §7.6's writer's: a flipped byte, an overwritten field, a cut, a changed box size, an inserted box, the init's timescale or edit list, a repeated moof/mdat pair. Every verdict, and every accepted segment's samples, must agree, and neither may crash. CI runs it in the independent job. Co-Authored-By: Claude Opus 5.5 <[email protected]>
packaging §7.3: a key-frame sequence header put back is the stream's own
An informative note: a floor taken from an existing ladder needs a sequence header in every unit that starts at a shown key frame; where a ladder's key-frame samples lack one, the header put back must be the stream's own first sequence header OBU, byte for byte, since §7.3 refuses any other bytes. The sample entry's av1C header can differ from the in-band one in its tool flags and is refused; the packager writes its own av1C from the in-band header. A ladder without in-band headers cannot be taken in the CMAF form. tests/refusals.rs holds the rule: the stream stripped of its key-frame headers is refused, its own header put back is the stream, another header's bytes are refused. Co-Authored-By: Claude Opus 5.5 <[email protected]>
pack-conformance: the staged golden itself among staged-mutations (ok)
Verified without its sources, the staged golden's every layer has its prefix digest checked by a decode the verifier runs however it runs it (serially or in pack_verify.py's workers). Without an accepted layered case, layer digests a verifier got wrong still gave the refusals the corpus expects. The README names the metered package cases. Co-Authored-By: Claude Opus 5.5 <[email protected]>
pack_verify.py at scale, and the measurement claim checked (§9.4)
- Each object is hashed once (http_verify keeps each object's content hash, which pack_verify seeds once an object holds to its entry), and http_verify.resolve_uri finds an object under its own content id before any search: the lookup that hashed every object for every URI is gone. - --jobs N: every object's hash, and every base's decode and its layers, piece by piece, run in N worker processes ahead of the checks, which read their results in the serial run's order with the serial run's reasons. - --native-blake3 (opt-in): BLAKE3 from the blake3 module, taken only after it agrees with the pure implementation on the published vectors and on inputs at every chunk boundary; the docstring says what it gives up (that module is the implementation wai-rs links). - --package <dir>: one package verified as §11.3 does, without its sources or its key. - The measurement claim of a metered package is checked: the claim corpus's verifier (claim_verify.py) reads it, then it is held to the receipt (subject, figure profile, joules, class and evidence, signer). The unconditional measurement-claim-invalid is gone. - package-mutations: a metered package (ok), a claim about another figure (measurement-claim-invalid), none (measurement-claim-missing), each made by the generator with fixed members. - CI: pack_verify.py --jobs 2 over the corpus. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-pack tests: the directory pack of a floor-only golden has no source
Co-Authored-By: Claude Opus 5.5 <[email protected]>
packaging: a floor-only profile (§7.8)
A component of profile = "floor-only" is its floor rungs alone: no integer base, no refinement and no source (policy-floor-only otherwise). Its pieces are its first floor rung's media segments (the CMAF form) or shown key frames (the OBU form), each at most max_ms (floor-piece-length); each piece is its floor objects, which present no base and so carry no derived_from, of kind none (stage index kind 6). Every class lists only the floor. It attests delivery: the receipt binds every floor object and the supplied floor's bytes, and the verifier holds them to the AV1 stream's structure and to the CMAF files; it states no decoded output, no fidelity to a source and no primary. - wai-rs stage_index: piece kind 6; a floor carries derived_from exactly when its piece has a base (floor-derived-from). - wai-pack: policy (component.profile; the rule ladder of a floor-only component is its floors), the packer's floor-only path, the verifier's index and floor checks; pack_verify.py mirrors each. - pack-conformance: packs/video-floor-only-01 (CMAF form) and -02 (OBU form), and index cases of a piece of floors alone. - tests/floor_only.rs; wai-rs stage_index test; CI floors and the media probe of the OBU floor-only golden. Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-pack: a re-pack reads its parent's objects one at a time
The parent's objects were held for the whole pack, so a re-pack's memory grew with the title. The parent is still verified whole (§11.3's verifier reads a package whole); after that only its entries are kept, and each piece's objects are read from the parent when the piece is coded, held to the content hashes the verified index names. Co-Authored-By: Claude Opus 5.5 <[email protected]>
packaging: a streaming on-demand pack (§11.4)
wai-pack pack now reads its source from its file a frame at a time (twice: once to cut, once to code) and the supplied floor from its directory a file and a temporal unit at a time, writes each package file into the output directory as it is made (files::DirSink, which removes what it wrote on a refusal), and reads objects back one at a time for the catalogs. What it holds no longer grows with the title's length, but for a record per piece and per entry and a byte per frame per floor. --jobs <n> codes n pieces at once, each alone, so the package is the same for any n. - packaging §11.4: what the packer holds, and that a refusal leaves nothing written. - tests/pack_alloc.rs: a source eight times as long packs in the same peak allocation (a counting allocator), give or take its records; tests/packs.rs: every golden packs byte for byte into a directory on three threads. CI's test-count floors. Co-Authored-By: Claude Opus 5.5 <[email protected]>
packaging: a floor that is the ladder's own CMAF segments (§7.7)
With floor.supplied_form = "cmaf" (absent, the OBU form; existing policy digests are unchanged), a supplied floor is an existing ladder's init.mp4 and media segments, one per piece. The packer reads them box by box (wai-pack cmaf_read): the floor's temporal units are the samples, each with a temporal delimiter before it, held to §7.3 as a stream is. The package's floor files are the ladder's files byte for byte under their SHA-256, not rewritten, and the package carries the supplied floor's listing (floor.listing), whose SHA-256 the policy pins: the receipt binds every byte of the ladder, and a segment of the same samples that is not the supplied one is refused. New refusals: floor-cmaf-malformed, floor-cmaf-timing, floor-cmaf-pieces. wai-pack pack --link-supplied writes the floor's files as hard links to the supplied ones. - pack-conformance: packs/video-cmaf-01 (video-ladder-01's streams muxed by ffmpeg's HLS muxer, -c copy, by supplied_cmaf.py) and cmaf-mutations; pack_verify.py reads the CMAF form with a box reader of its own, field reads bounded by their boxes as wai-pack's are. - tests/cmaf.rs, cmaf_read's unit tests, CI's test-count floor and the media probe of the CMAF golden's floors. Co-Authored-By: Claude Opus 5.5 <[email protected]>
packaging: a re-pack takes its bases from a parent package (§11.5)
A packer may now take every piece's base and refinements from an earlier package instead of coding them, so a title's integer base is coded once and every later package of the same source takes it: wai-pack pack --base-from <package>. Before it writes anything it verifies the parent as §11.3 does (repack-parent-invalid), matches it piece by piece (start, duration, flags, kind, the rungs and parameters of the base and refinements, the deadline; repack-parent-mismatch), and holds each reused prefix to this source by the SSE its entry states (repack-source-mismatch). The receipt names the parent with parent kind re-pack; every other file is a coding pack's. A verifier holding the parent checks a re-pack against it (wai-pack verify --parent; verify::verify_repack). - pack-conformance: packs/video-repack-01, the ladder golden re-packed from video-base-01, and pack_verify.py's check of a re-pack golden against the parent it names. - tests/repack.rs, and CI's test-count floor. Co-Authored-By: Claude Opus 5.5 <[email protected]>
packaging: several floor rungs per package, over one base
A component may now have several floor rungs: each piece has one floor object per floor rung, in ladder order, over one integer base, so one package carries a title's whole AV1 ladder and its base is coded once (packaging §7.1). Each floor rung has a floor name: the component's id when it has one floor rung, so existing packages are unchanged byte for byte, and the rung's id when it has several. The name names the supplied stream, the CMAF files, the floor playlist, the DASH representation and the MoQ track; a name that cannot be a path segment, or two equal in any case, is refused (pack-id). - wai-pack: the packer reads its source and each floor stream as streams and writes each file to a sink as it is made (files.rs, av1::TuReader, floor::check_stream); a source that does not read the same twice is refused (pack-source-changed). The catalogs list every floor; the verifier holds the k-th floor entry of each piece to the k-th floor rung. - wai-rs: the DASH renderer writes a representation's own codecs and size, and an adaptation set's codecs only when shared. - pack-conformance: packs/video-ladder-01 (two floors over the bases of video-base-01, which are the same objects), ladder-mutations, and pack_verify.py's floor and catalog checks per floor rung, in §11.3's order; supplied_floor.py writes one stream per floor rung. - tests/ladder.rs, and CI's test-count floor and media probe of every floor. Co-Authored-By: Claude Opus 5.5 <[email protected]>