CI: wai-conformance's independent verifiers compile wai-rs once per profile #477

Merged

dcharlot merged 3 commits from ci/compile-once into main 2026-10-26 08:58:08 -04:00

Conversation 0 Commits 3 Files changed 1 +205 -96

dcharlot commented 2026-10-26 00:50:59 -04:00

Owner

Copy link

CI: wai-conformance's independent verifiers compile wai-rs once per profile

CI only. This PR's own run is the measurement.

What it changes

wai-conformance.yml, the independent verifiers job. Each wai-rs step used to run cargo test --no-default-features --features <one feature> --lib <mod>:: or --test <name> with a feature list of its own, so each step rebuilt the crate from scratch. On Train C (head e77b92f7) that was 79 compiles of wai: 29 cargo-minutes of a 64-minute job.

The job now declares three feature lists, and each step uses one of them:

list	holds	why
WAI_FEATURES	the union of every step's features, except the hybrid signatures'	one test build serves every other step
WAI_PQ_FEATURES	synthesis,pq_signatures	pq_signatures changes what a build without it refuses (pq-signatures §6.3: such a build reads a hybrid member as an unknown one, in claim_receipt, key_log and jwp_delivery). So it stays out of the union, and every other step keeps testing a build without it
WAI_RELEASE_FEATURES	dred_exact,synthesis_mark,robustness	the three steps that run with --release share one release build

Each step runs the same selection it ran before: --lib <module>:: or --test <name>, with its filters. Only the feature list is new.

Builds that overwrite each other. Two builds of the library that differ in features, or in their dependencies' features, write the same file. Each switch between them rebuilds the library and relinks every integration test built before the switch. There are two such pairs:

• cargo build and cargo test: the dev-dependencies turn on wai-ops' oracle and serde_json's preserve_order;
• two feature lists.

The first commit left both switches in place. In its CI run, one rebuild of about a minute came back at every switch, plus a relink of about 5 s per integration test. So the first step now runs in this order:

1. It builds the programs the steps run as cargo build builds them, the same kind of build the steps' cargo build and cargo run made before. The steps run these copies:
   • into $RUNNER_TEMP/wai-bins/union, with WAI_FEATURES: wai_http_vectors, wai_stage_measure, wai_browser_sink_vectors, wai_claim_vectors, wai_jwp_vectors and wai_signer_vectors;
   • into $RUNNER_TEMP/wai-bins/pq, with WAI_PQ_FEATURES: wai_pq_vectors, wai_claim_vectors, wai_jwp_vectors and wai_signer_vectors.
2. It builds the union's tests last, so every later cargo command of the job is a cargo test that finds its build fresh.

The release build has a directory of its own. The hybrid signatures step builds its own tests, the job's one other test build.

wai-live-web's browser tests now run once, with int_video. Its tests are a superset of the default build's, and the feature gates nothing off: wai-live-web has no cfg(not(feature)), and wai's browser_sink has no feature gates.

New job: features-alone (linux-arm64: it only checks, so any architecture serves, and that label has free slots). It keeps the isolation the old steps gave. Each of the 41 feature lists that a step used to build alone is checked alone with cargo check --no-default-features --features <list> --tests. That checks the library (also as its unit tests see it), its binaries and the integration tests the list enables. wai-live-web is checked without int_video the same way. It costs a check, not a test build.

Compiles and minutes

job	head	Compiling wai lines	cargo minutes	job minutes (/actions/tasks)
independent verifiers	main (Train C e77b92f7)	79	29.0 (test 23.6, release 4.0, dev 1.4)	64.0 and 61.3
independent verifiers	7b933d94f (first commit)	41	12.6 (test 8.9, dev 1.9, release 1.8)	49.0
independent verifiers	781c201bc	7: four in the first step, two in the hybrid signatures step, one as wai-live-web's dependency	6.9 (test 3.5, release 2.0, dev 1.4)	41.1
independent verifiers	d0b23afcb (this head; the differentials run twice)	7	7.3 (test 3.8, dev 1.6, release 1.9)	49.5
features-alone (new)	d0b23afcb	n/a (checks)		7.9 (linux-arm64, all 41 lists and wai-live-web)

On the build host, from a cold target, this head's job prints Compiling wai in only three places:

• the first step: four invocations, namely the tools' cargo build for the union and for the hybrid list, the union's test build and the release build;
• the hybrid signatures step: its lib-test and integration-test invocations of the one hybrid build;
• the browser sink step: wai-live-web, its own workspace.

Every other wai-rs step prints Finished … in 0.0Xs.

CI shows the same 7 lines. Running the differentials against both builds adds about 8 minutes (41.1 to 49.5). The job's other ~42 minutes are test and verifier run time, which compile-once does not touch. Main spent about 35 minutes that way too: 64 minutes less 29 of cargo.

Test lists, before and after (cd/compare.py)

The whole job ran twice on the build host from the same tree, with cold target directories: main's steps, then this head's. Every test result was collected by step, crate, profile, target and name.

• Before: 526 results, all ok. These are 524 distinct tests plus the two wai-live-web browser tests, which ran twice, once per build.
• After: 526 results, all ok, 526 distinct. None lost, none failed. In every step, the after list contains the before list.
• Two more tests, because the union lets a step's filter reach them:
  • http_binding::tests_receipts::bearer_claims_are_checked_against_the_group_of_an_item, in the bearer step;
  • synthesis::mark::sync::tests::a_crop_and_a_rotation_are_found_again, in the synthesis step.
• wai-live-web: its default-feature run and its int_video run are now one run. The default run's tests are all in it.
• The build host's before list equals CI's before list (Train C's job log): the same 526 lines, compared as multisets. CI's lists for both commits have the same 526 results by name and result, with the same two differences, and no failure.

Feature interaction

• The union: no test fails under it, and no test passes only alone.
• pq_signatures is the one feature whose tests behave differently beside others. It changes the verdicts of code the other steps test, so it keeps its own build, as described above.
• Found while doing this, and fixed: on main, the last step's differentials (differential.py, chain_differential.py, chain_gap_differential.py, signer_verify.py verdicts) ran target/debug/wai_claim_vectors, wai_jwp_vectors and wai_signer_vectors.
  • What main tested: each cargo test --test … rewrites those copies, because cargo builds every binary for integration tests. So the build under test was whichever wrote last: the hybrid signatures step's pq_signatures build, not the key_discovery build that the first step made and the step's comment names.
  • Now: the first step builds the three tools twice, with the union (key_discovery, no pq_signatures) and with the hybrid list, and copies them. The last step runs every differential against both copies, each in its own labelled log group ("the differentials against the union build", then "the pq build").
  • Both pass on the build host, cold: each build gives the same verdict counts (59282 inputs), 0 differ, 0 crash for the claims, 0 differ, 0 error for each chain and gap run, and an empty diff of the signer verdicts. So no build order is assumed, and neither build loses coverage. The step takes about twice as long.

Falsification (committed first, then broken, run, restored)

Three breaks went into one run on the build host: the first step, the two broken steps, and features-alone.

• The age assurance step (union build): src/age_assurance.rs a_challenge_reads_exactly asserted is_none(). Exit 101: age_assurance::tests::a_challenge_reads_exactly ... FAILED, with 8 passed, 1 failed and 1057 filtered out. The step's filter still selects the test under the union, and the step ran from the first step's build, in 0 s.
• The robustness step (release list): tests/robustness.rs asserted !REASONS.contains(&Reason::TableIrreproducible). Exit 101: the_extension_lists_exactly_the_references_reasons_and_the_corpus_refuses_each ... FAILED, panicking at tests/robustness.rs:112.
• features-alone: src/live_events.rs gained a function that reads crate::live_room::DESCRIPTOR_MAGIC. With it present, the first step's union build passed (exit 0). features-alone failed at live_events with exit 101: cannot find live_room in crate. The union hides such a break, and features-alone catches it.

All three files were restored with git checkout, and git diff --quiet is clean.

Checks

• ruby -ryaml -e 'ARGV.each{|f| YAML.load_file(f)}' .github/workflows/*.yml: parses.
• python3 ~/kani-logs/wfsteps.py HEAD origin/main: in wai-conformance.yml, 43 findings, each an intended change. Each is "body matches no source" for a rewritten independent-verifiers step (now including the differential step), or "name in no source" for the new build step and the features-alone job's steps. Two more findings are in standards-build.yml and wai-web-wasm.yml. Both are main's own changes since this branch's base (#476 and #478); against the merge base, only the 43 remain.
• The cross-wire check for this rewrite, stepcheck.py origin/main HEAD, applies one rule to every step of the job on main: replace the feature list, drop wai-live-web's default-feature line, and replace each tool's cargo build or cargo run with its copy. The result must equal the step of the same name and position at HEAD. For the differential step, the set of commands must be equal, with the loop over both copies read as one copy. It must also find no other job changed and no top-level key changed. Result: 52 steps, 0 problems. It fails with exit 1 on each of three planted defects: a cross-wire (the takedown step running --test influence), a dropped gap differential, and the pq tool read from the union's copies.
• Repo checks, run locally, all exit 0: check-tests-in-ci.py (every --test NAME is still literal in the steps), check-workflow-concurrency.sh, check-spec-refs.py, check-wai-section-refs.py, check-no-vanity-metrics.sh, test-public-text-checks.sh, check-comparative-prose.sh and check-orphan-sources.py.
• features-alone on the build host, cold: all 41 lists and wai-live-web pass, in 6 minutes on 32 threads.
• Public-name check on the workflow, the commit messages and this body: clean.

CI runs

• First commit 7b933d94f (run 10890): the independent-verifiers job finished in 49.0 min, success. Pushing the second commit then superseded the run through the concurrency group. Four of its jobs, all queued on linux and none started, were cancelled: cargo-class linux, quantum wasip2, byte-equality linux and features-alone.
• 781c201bc (run 11100): independent verifiers finished in 41.1 min, success, along with every linux-arm64 and macos job and repo-checks. Its four linux jobs were still queued when the next commit superseded it.
• This head d0b23afcb (run 11108): the differentials run against both builds, and features-alone moved to linux-arm64. Results: independent verifiers 49.5 min, success, with both builds' groups reporting every differential agrees; features-alone 7.9 min, success. The test list matches the earlier heads': 526 results, the same two extra tests, the second wai-live-web run folded in, no failure.

Not done

• The other workflows' jobs are unchanged. Their before figures, from /actions/tasks, are listed with the reasons:
  • cargo-class corpora (14–21 min on 3 legs): its feature sets are deliberate isolations (a no-feature build, ffi alone, cli_http with and without cli_tls). About 4.7 of its cargo-minutes are dev and test compiles, against 2.9 for its single release build.
  • codec wrappers (0.9 min) and C2PA emission (1.7 min): one or two compiles each.
  • wai-ops-gpu checks (3 min), wai-jpegai-e2e (7 min) and wai-neural-gates (1.7 min, which includes a test that exists only without video_int).
  • wai-http's falsify mutation shards (46–49 min, the longest left): Python only, no compile.
• sccache, when the shared server is live.

🤖 Generated with Claude Code

## CI: wai-conformance's independent verifiers compile wai-rs once per profile CI only. This PR's own run is the measurement. ### What it changes `wai-conformance.yml`, the **independent verifiers** job. Each wai-rs step used to run `cargo test --no-default-features --features <one feature> --lib <mod>::` or `--test <name>` with a feature list of its own, so each step rebuilt the crate from scratch. On Train C (head `e77b92f7`) that was 79 compiles of `wai`: 29 cargo-minutes of a 64-minute job. The job now declares three feature lists, and each step uses one of them: | list | holds | why | |---|---|---| | `WAI_FEATURES` | the union of every step's features, except the hybrid signatures' | one test build serves every other step | | `WAI_PQ_FEATURES` | `synthesis,pq_signatures` | `pq_signatures` changes what a build without it refuses (pq-signatures §6.3: such a build reads a hybrid member as an unknown one, in `claim_receipt`, `key_log` and `jwp_delivery`). So it stays out of the union, and every other step keeps testing a build without it | | `WAI_RELEASE_FEATURES` | `dred_exact,synthesis_mark,robustness` | the three steps that run with `--release` share one release build | Each step runs the same selection it ran before: `--lib <module>::` or `--test <name>`, with its filters. Only the feature list is new. **Builds that overwrite each other.** Two builds of the library that differ in features, or in their dependencies' features, write the same file. Each switch between them rebuilds the library and relinks every integration test built before the switch. There are two such pairs: - `cargo build` and `cargo test`: the dev-dependencies turn on wai-ops' `oracle` and serde_json's `preserve_order`; - two feature lists. The first commit left both switches in place. In its CI run, one rebuild of about a minute came back at every switch, plus a relink of about 5 s per integration test. So the first step now runs in this order: 1. It builds the programs the steps run as `cargo build` builds them, the same kind of build the steps' `cargo build` and `cargo run` made before. The steps run these copies: - into `$RUNNER_TEMP/wai-bins/union`, with `WAI_FEATURES`: `wai_http_vectors`, `wai_stage_measure`, `wai_browser_sink_vectors`, `wai_claim_vectors`, `wai_jwp_vectors` and `wai_signer_vectors`; - into `$RUNNER_TEMP/wai-bins/pq`, with `WAI_PQ_FEATURES`: `wai_pq_vectors`, `wai_claim_vectors`, `wai_jwp_vectors` and `wai_signer_vectors`. 2. It builds the union's tests last, so every later cargo command of the job is a `cargo test` that finds its build fresh. The release build has a directory of its own. The hybrid signatures step builds its own tests, the job's one other test build. wai-live-web's browser tests now run once, with `int_video`. Its tests are a superset of the default build's, and the feature gates nothing off: wai-live-web has no `cfg(not(feature))`, and wai's `browser_sink` has no feature gates. **New job: features-alone** (`linux-arm64`: it only checks, so any architecture serves, and that label has free slots). It keeps the isolation the old steps gave. Each of the 41 feature lists that a step used to build alone is checked alone with `cargo check --no-default-features --features <list> --tests`. That checks the library (also as its unit tests see it), its binaries and the integration tests the list enables. wai-live-web is checked without `int_video` the same way. It costs a check, not a test build. ### Compiles and minutes | job | head | `Compiling wai` lines | cargo minutes | job minutes (`/actions/tasks`) | |---|---|---|---|---| | independent verifiers | main (Train C `e77b92f7`) | 79 | 29.0 (test 23.6, release 4.0, dev 1.4) | 64.0 and 61.3 | | independent verifiers | `7b933d94f` (first commit) | 41 | 12.6 (test 8.9, dev 1.9, release 1.8) | 49.0 | | independent verifiers | `781c201bc` | 7: four in the first step, two in the hybrid signatures step, one as wai-live-web's dependency | 6.9 (test 3.5, release 2.0, dev 1.4) | 41.1 | | independent verifiers | `d0b23afcb` (this head; the differentials run twice) | 7 | 7.3 (test 3.8, dev 1.6, release 1.9) | 49.5 | | features-alone (new) | `d0b23afcb` | n/a (checks) | | 7.9 (`linux-arm64`, all 41 lists and wai-live-web) | On the build host, from a cold target, this head's job prints `Compiling wai` in only three places: - the first step: four invocations, namely the tools' `cargo build` for the union and for the hybrid list, the union's test build and the release build; - the hybrid signatures step: its lib-test and integration-test invocations of the one hybrid build; - the browser sink step: wai-live-web, its own workspace. Every other wai-rs step prints `Finished … in 0.0Xs`. CI shows the same 7 lines. Running the differentials against both builds adds about 8 minutes (41.1 to 49.5). The job's other ~42 minutes are test and verifier run time, which compile-once does not touch. Main spent about 35 minutes that way too: 64 minutes less 29 of cargo. ### Test lists, before and after (`cd/compare.py`) The whole job ran twice on the build host from the same tree, with cold target directories: main's steps, then this head's. Every test result was collected by step, crate, profile, target and name. - **Before:** 526 results, all `ok`. These are 524 distinct tests plus the two wai-live-web browser tests, which ran twice, once per build. - **After:** 526 results, all `ok`, 526 distinct. **None lost, none failed.** In every step, the after list contains the before list. - **Two more tests**, because the union lets a step's filter reach them: - `http_binding::tests_receipts::bearer_claims_are_checked_against_the_group_of_an_item`, in the bearer step; - `synthesis::mark::sync::tests::a_crop_and_a_rotation_are_found_again`, in the synthesis step. - **wai-live-web:** its default-feature run and its `int_video` run are now one run. The default run's tests are all in it. - **The build host's before list equals CI's before list** (Train C's job log): the same 526 lines, compared as multisets. CI's lists for both commits have the same 526 results by name and result, with the same two differences, and no failure. ### Feature interaction - **The union:** no test fails under it, and no test passes only alone. - **`pq_signatures`** is the one feature whose tests behave differently beside others. It changes the verdicts of code the other steps test, so it keeps its own build, as described above. - **Found while doing this, and fixed:** on main, the last step's differentials (`differential.py`, `chain_differential.py`, `chain_gap_differential.py`, `signer_verify.py verdicts`) ran `target/debug/wai_claim_vectors`, `wai_jwp_vectors` and `wai_signer_vectors`. - **What main tested:** each `cargo test --test …` rewrites those copies, because cargo builds every binary for integration tests. So the build under test was whichever wrote last: the hybrid signatures step's `pq_signatures` build, not the `key_discovery` build that the first step made and the step's comment names. - **Now:** the first step builds the three tools twice, with the union (key_discovery, no pq_signatures) and with the hybrid list, and copies them. The last step runs every differential against both copies, each in its own labelled log group ("the differentials against the union build", then "the pq build"). - **Both pass on the build host, cold:** each build gives the same verdict counts (59282 inputs), `0 differ, 0 crash` for the claims, `0 differ, 0 error` for each chain and gap run, and an empty `diff` of the signer verdicts. So no build order is assumed, and neither build loses coverage. The step takes about twice as long. ### Falsification (committed first, then broken, run, restored) Three breaks went into one run on the build host: the first step, the two broken steps, and features-alone. - **The age assurance step (union build):** `src/age_assurance.rs` `a_challenge_reads_exactly` asserted `is_none()`. Exit 101: `age_assurance::tests::a_challenge_reads_exactly ... FAILED`, with 8 passed, 1 failed and 1057 filtered out. The step's filter still selects the test under the union, and the step ran from the first step's build, in 0 s. - **The robustness step (release list):** `tests/robustness.rs` asserted `!REASONS.contains(&Reason::TableIrreproducible)`. Exit 101: `the_extension_lists_exactly_the_references_reasons_and_the_corpus_refuses_each ... FAILED`, panicking at `tests/robustness.rs:112`. - **features-alone:** `src/live_events.rs` gained a function that reads `crate::live_room::DESCRIPTOR_MAGIC`. With it present, the first step's union build passed (exit 0). features-alone failed at `live_events` with exit 101: `cannot find live_room in crate`. The union hides such a break, and features-alone catches it. All three files were restored with `git checkout`, and `git diff --quiet` is clean. ### Checks - `ruby -ryaml -e 'ARGV.each{|f| YAML.load_file(f)}' .github/workflows/*.yml`: parses. - `python3 ~/kani-logs/wfsteps.py HEAD origin/main`: in `wai-conformance.yml`, 43 findings, each an intended change. Each is "body matches no source" for a rewritten independent-verifiers step (now including the differential step), or "name in no source" for the new build step and the features-alone job's steps. Two more findings are in `standards-build.yml` and `wai-web-wasm.yml`. Both are main's own changes since this branch's base (#476 and #478); against the merge base, only the 43 remain. - The cross-wire check for this rewrite, `stepcheck.py origin/main HEAD`, applies one rule to every step of the job on main: replace the feature list, drop wai-live-web's default-feature line, and replace each tool's `cargo build` or `cargo run` with its copy. The result must equal the step of the same name and position at HEAD. For the differential step, the set of commands must be equal, with the loop over both copies read as one copy. It must also find no other job changed and no top-level key changed. Result: 52 steps, 0 problems. It fails with exit 1 on each of three planted defects: a cross-wire (the takedown step running `--test influence`), a dropped gap differential, and the pq tool read from the union's copies. - Repo checks, run locally, all exit 0: `check-tests-in-ci.py` (every `--test NAME` is still literal in the steps), `check-workflow-concurrency.sh`, `check-spec-refs.py`, `check-wai-section-refs.py`, `check-no-vanity-metrics.sh`, `test-public-text-checks.sh`, `check-comparative-prose.sh` and `check-orphan-sources.py`. - features-alone on the build host, cold: all 41 lists and wai-live-web pass, in 6 minutes on 32 threads. - Public-name check on the workflow, the commit messages and this body: clean. ### CI runs - **First commit `7b933d94f`** (run 10890): the independent-verifiers job finished in 49.0 min, success. Pushing the second commit then superseded the run through the concurrency group. Four of its jobs, all queued on `linux` and none started, were cancelled: cargo-class linux, quantum wasip2, byte-equality linux and features-alone. - **`781c201bc`** (run 11100): independent verifiers finished in 41.1 min, success, along with every `linux-arm64` and `macos` job and repo-checks. Its four `linux` jobs were still queued when the next commit superseded it. - **This head `d0b23afcb`** (run 11108): the differentials run against both builds, and features-alone moved to `linux-arm64`. Results: independent verifiers 49.5 min, success, with both builds' groups reporting `every differential agrees`; features-alone 7.9 min, success. The test list matches the earlier heads': 526 results, the same two extra tests, the second wai-live-web run folded in, no failure. ### Not done - The other workflows' jobs are unchanged. Their before figures, from `/actions/tasks`, are listed with the reasons: - `cargo-class corpora` (14–21 min on 3 legs): its feature sets are deliberate isolations (a no-feature build, `ffi` alone, `cli_http` with and without `cli_tls`). About 4.7 of its cargo-minutes are dev and test compiles, against 2.9 for its single release build. - `codec wrappers` (0.9 min) and `C2PA emission` (1.7 min): one or two compiles each. - `wai-ops-gpu` checks (3 min), `wai-jpegai-e2e` (7 min) and `wai-neural-gates` (1.7 min, which includes a test that exists only without `video_int`). - `wai-http`'s falsify mutation shards (46–49 min, the longest left): Python only, no compile. - sccache, when the shared server is live. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dcharlot added 1 commit 2026-10-26 00:50:59 -04:00

wai-conformance: the independent verifiers build wai-rs once per profile ... 7b933d94f6

Every wai-rs step of the independent-verifiers job ran `cargo test` with its own
one-feature list, so each step rebuilt the crate from scratch: 79 compiles of `wai`
in one run, 28 of its 64 minutes.

The job now declares three feature lists and every step uses one of them, so the
first step builds each target once and every later step finds it fresh:

- WAI_FEATURES: the union of the steps' features, except the hybrid signatures';
- WAI_PQ_FEATURES: the hybrid signatures step. `pq_signatures` changes what a build
  without it refuses (pq-signatures §6.3), so it stays out of the union and every other
  step keeps testing a build without it;
- WAI_RELEASE_FEATURES: the steps that run their tests with `--release`.

Each step selects its tests exactly as before (`--lib <module>::` or `--test <name>`,
with its filters). wai-live-web's browser tests run once, with `int_video`: its tests
are a superset of the default build's, and the feature gates nothing off.

A new job, features-alone, keeps the isolation the old steps gave: each feature list a
step used to build alone is checked alone (`cargo check --tests`), and wai-live-web
without `int_video`.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot added 1 commit 2026-10-26 03:59:28 -04:00

wai-conformance: the independent verifiers' one build is not undone by the next ... 781c201bc9

Builds of wai-rs that differ in features, or in their dependencies' features, write the
same library file, so each switch between two of them rebuilds the library and relinks
every integration test built before the switch. In the job as restructured, two such
switches remained. On the build host they printed `Compiling wai` in each of the job's
wai-rs steps:

- `cargo build` and `cargo test`: the dev-dependencies turn on wai-ops' `oracle` and
  serde_json's `preserve_order`, so the steps' `cargo build` and `cargo run` of the corpus
  tools rebuilt the library each time, and the next `cargo test` rebuilt it back;
- the hybrid signatures' feature list, which the first step built after the union's.

The first step now builds the four programs the steps run (wai_http_vectors,
wai_stage_measure, wai_browser_sink_vectors and wai_pq_vectors) as `cargo build` builds
them, and copies them to $RUNNER_TEMP/wai-bins. The union's test build comes last. The
steps run those copies, so every later cargo command is a `cargo test`. The hybrid
signatures step builds its own tests, the one other build of the test profile.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot added 1 commit 2026-10-26 07:05:25 -04:00

wai-conformance: the differentials run against both builds; features-alone on linux-arm64 ... d0b23afcba

The last step of the independent verifiers ran differential.py, the chain and gap
differentials and `signer_verify.py verdicts` against target/debug's wai_claim_vectors,
wai_jwp_vectors and wai_signer_vectors. Each `cargo test --test` writes those copies
again (cargo builds every binary for integration tests), so the build those
differentials tested was whichever wrote last: on main, the hybrid signatures step's
`pq_signatures` build. The step's comment names the key-discovery build.

Now neither depends on build order. The first step builds the three explicitly twice:
once with the union's features (key_discovery, no pq_signatures) and once with the
hybrid signatures' features. It copies them to $RUNNER_TEMP/wai-bins/union and
$RUNNER_TEMP/wai-bins/pq, beside the other tools the steps run. The last step runs
each differential against both copies, each in its own labelled group of the log.

features-alone is a set of `cargo check` runs, so any architecture serves. It moves
from `linux`, which has a long queue, to `linux-arm64`, and stays a job of its own.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot merged commit cd708e1200 into main 2026-10-26 08:58:08 -04:00

dcharlot referenced this pull request from a commit 2026-10-26 08:58:10 -04:00

Merge pull request 'CI: wai-conformance's independent verifiers compile wai-rs once per profile' (#477) from ci/compile-once into main

dcharlot referenced this pull request 2026-10-26 17:15:43 -04:00

wai merge train E: twenty-five PRs onto main, the relay's upstream window bounded, and three fixes the merged tree needed #499

dcharlot referenced this pull request from a commit 2026-10-26 20:23:54 -04:00

Merge origin/main (cd708e120): #477, the independent verifiers build wai-rs once per profile

dcharlot referenced this pull request from a commit 2026-10-26 20:23:54 -04:00

Merge #490 (wai/remote-input-seal @e8c747ec): sealed input in remote rooms

dcharlot referenced this pull request from a commit 2026-10-26 20:23:54 -04:00

Merge #493 (wai/messaging-calls @01f3aac1): wai.live.message and wai.live.call, conversations and calls on live rooms

dcharlot referenced this pull request from a commit 2026-10-26 20:23:54 -04:00

wai-conformance: features-alone checks live_messaging alone (#493)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Transaction-Science/open-standards!477

No description provided.