wai breaking and wai conform: the compatibility gate on every WAI pull request, and conformance runs with signed results #507

Merged

dcharlot merged 11 commits from wai/breaking-conform into main 2026-10-28 05:08:42 -04:00

Conversation 0 Commits 11 Files changed 38 +6380 -15

2026-10-28

Transaction Science

Merge remote-tracking branch 'origin/main' into wai/breaking-conform

0ccd848ca1

• View at this point in history

2026-10-28 03:20:00 -04:00

Transaction Science

Merge remote-tracking branch 'origin/main' into wai/breaking-conform ...

# Conflicts:
#	.github/workflows/wai-conformance.yml
#	wai/CHANGELOG.md
#	wai/wai-rs/Cargo.toml
#	wai/wai-rs/src/bin/wai_cli/dx/mod.rs
#	wai/wai-rs/src/bin/wai_cli/dx/verify.rs
#	wai/wai-rs/src/lib.rs

55e1cf5446

• View at this point in history

2026-10-28 01:53:55 -04:00

2026-10-27

Transaction Science

Merge remote-tracking branch 'origin/main' into wai/breaking-conform

2b1439c4c2

• View at this point in history

2026-10-27 14:33:38 -04:00

Transaction Science

wai breaking: the base holds every standard its crate reaches by path ...

The Rust surface extracted only wai/ from the base. Once wai depended by
path on joule-ui's crates (wai-app), documenting the base failed: the
dependency's directory was missing, and a crate in another workspace also
needs that workspace's root manifest for the fields it inherits. Each
top-level directory in the base crate's path closure is now extracted
whole, once.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

59fa15f254

• View at this point in history

2026-10-27 14:33:37 -04:00

Transaction Science

wai conform: no process-group kill; the sidecar test names the record corpus ...

The runner job died with exit 137 the moment the adapter test's 200 ms timeout fired.
In the CI image (Ubuntu 22.04's procps kill), `kill -KILL -<pgid>` signals the
caller's own process group, not the one named: the test, cargo and the step's shell
were killed, and the timed-out `sh` and `sleep` survived. Reproduced in that image
with a small program; the same call with no such group also killed the caller. It was
not memory: the step, built cold and run in that image under a 16 GB cap, peaks at
4.6 GB. The adapter now kills the shell alone, as before, and reads output for at most
two seconds after it exits, so a child that keeps the output open no longer holds the
run; the command stays in the caller's process group.

tests/int_kernels_vectors.rs walks every wai/*-conformance/ directory and requires a
sha256.json sidecar of decoded outputs, or an exclusion with its reason.
conform-result-conformance holds signed records and no decoded output, so it is listed
with that reason, as the other record corpora are.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

4484518afd

• View at this point in history

2026-10-27 11:17:06 -04:00

Transaction Science

conform-result-conformance: each summary count wrong alone, its other counts right ...

The falsification of the reference found that leaving out the check of summary.cases
alone left the corpus passing: every summary vector had passed and failed wrong too.
Three vectors now carry each count wrong alone.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

f33765a846

• View at this point in history

2026-10-27 11:17:06 -04:00

Transaction Science

conformance-results: conform-result/1 in the standard, its corpus and a second verifier ...

extensions/conformance-results.md specifies the record a conformance run signs: its
members (§2) and corpus digest (§2.1), its signing input (the domain
`wai:conform-result` and 0x01, then the record without `sig` in RFC 8785 form) and
Ed25519 signature under SPEC §7's strict rule (§3), what a verifier checks and in what
order (§4: it reads, its version, its members, its signature, its summary, its verdict)
and the codes of each refusal (§5). conform-result/1 is registered as a document kind
(registry export and REGISTRY.md regenerated); SPEC §7 points to it.

wai-rs gains the module conform_result (feature conform_result, in quickstart): sign,
check and verdict, the corpus digest, and the corpus of §7, whose outcomes are stated
from the text and asserted before anything is written. `wai conform` signs with it and
`wai verify` checks with it. conform-result-conformance/ holds accepted records and
refused ones (a case flipped, the corpus digest changed, the summary alone changed, a
bad signature, S past L, a small-order key, a summary or verdict that disagrees though
signed, an unknown version, members missing, added or named twice, a fractional count,
a digest out of form, bytes that are not JSON); wai_conform_result_vectors generates
and verifies it, and conform_result_verify.py, written from the text and sharing no code
with wai-rs, reaches every outcome and fails the corpus with each check of §4 left out.
`wai conform` gains the verifier suite conform-result.

`wai breaking` leaves out an explicit list of corpus files that record a measured run
(the format probes' external decodes, the relay's recorded metering run), each with
its reason, and says so in a note; the vectors built from them stay compared.

A command `wai conform` runs is put in a process group of its own, so a timed-out
command's children are stopped too.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

4cdae31baf

• View at this point in history

2026-10-27 11:17:05 -04:00

Transaction Science

tests/cli_conform.rs: the origin picks its own port and says which ...

Co-Authored-By: Claude Opus 5.5 <[email protected]>

89c7a2003e

• View at this point in history

2026-10-27 11:16:57 -04:00

Transaction Science

CI: wai breaking reads the checkout as its owner and fetches main's tip into origin/main ...

Co-Authored-By: Claude Opus 5.5 <[email protected]>

cb5b0a2ca4

• View at this point in history

2026-10-27 11:16:57 -04:00

Transaction Science

wai breaking: a registry string reads as itself in a finding; CI builds the tools unoptimised ...

Co-Authored-By: Claude Opus 5.5 <[email protected]>

cd02469682

• View at this point in history

2026-10-27 11:16:57 -04:00

Transaction Science

wai breaking and wai conform: the compatibility gate, and conformance anyone can run ...

`wai breaking --against <git-ref>` (operation compat.check) reports what the working
tree breaks against the merge base of a ref, in three cumulative categories: wire (the
registry export, the media and delivery corpora), record (the signing domains, magics
and versions in the WAI crates' sources, the record corpora, the published JSON
Schemas) and API (the Rust public API of wai and wai-quantum from rustdoc's JSON, the
C header, the room service's OpenAPI document). Each finding names its item, category,
what changed and why it breaks; additions are compatible. A break passes only when a
line the change adds to wai/CHANGELOG.md, in an entry that says Breaking, names its id.

`wai conform <kind> --suite <suite> --impl <command or URL>` (operation
conformance.run) runs a corpus against another implementation through a command-line
or an HTTP adapter: verifiers (claim, jwp, signer), a decoder (score), a packager
(policy) and an origin (http). The result is a signed conform-result/1 record that
`wai verify` checks. Both follow the agent rules: the envelope/1 JSON output, the exit
statuses, --dry-run.

.github/workflows/wai-breaking.yml runs the gate on every pull request that touches
WAI, the tests of both commands, and the corpora's independent Python verifiers and
the reference packager through wai conform.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

47b7c30c96

• View at this point in history

2026-10-27 11:16:57 -04:00