wai/CHANGELOG.md

@@ -6,6 +6,19 @@ wire format may change and such changes are recorded here.
 
 ## v0.4.0 — current
 
+### Determinism tiers — naming the reproducibility spectrum for neural decode
+
+- New [`extensions/determinism-tiers.md`]: names the two guarantees a neural
+  capability can make, so a manifest can declare which it satisfies and a verifier
+  knows what it may check. `entropy-consistency` — the entropy decode reproduces
+  across devices (integer entropy arithmetic or explicit parameter transmission),
+  the guarantee the base learned-codec standards make (JPEG AI's normative
+  conformance point is the entropy-decoder output) and the mainstream cross-platform
+  fix; the floor for a sound neural `replicate`. `decode-equivalence` — the whole
+  decode to the final medium reproduces, so the rendered result has a portable hash,
+  the tier WAI adds on top and the precondition for a hard reconstruction binding.
+  Referenced from SPEC §7 (Replicate-soundness); framed self-referentially.
+
 ### Reproducible-reconstruction binding — a C2PA/JPEG-Trust hard binding over pixels
 
 - New `wai.*` provenance capability: `reconstruction_binding` (feature

wai/SPEC.md

@@ -485,6 +485,16 @@ implicit: a neural codec that is *integer all the way down* is the only one that
 can put a reconstruction in a receipt and have it verify on someone else's
 machine.
 
+Reproducibility is a **spectrum**, not a single point, and the `ReplicateClass`
+values above span it. See [`extensions/determinism-tiers.md`](extensions/determinism-tiers.md),
+which names the two tiers a neural capability can satisfy:
+**`entropy-consistency`** — the entropy decode reproduces across devices (integer
+entropy arithmetic or explicit parameter transmission), the guarantee the base
+learned-codec standards make and the floor for a sound neural `replicate`; and
+**`decode-equivalence`** — the whole decode to the final medium reproduces, so the
+rendered result has a portable hash, the tier WAI adds on top and the precondition
+for a hard [reconstruction binding](extensions/reconstruction-binding.md).
+
 ---
 
 ## 7.1. Multi-rendition envelope (v1.1 extension)

wai/extensions/determinism-tiers.md

@@ -0,0 +1,96 @@
+# WAI Extension: Determinism Tiers for Neural Decode
+
+> Status: Draft. Names the **spectrum** of reproducibility guarantees a neural
+> capability can make, so a manifest can declare which one it satisfies and a
+> verifier knows what it may check. Positions WAI's byte-exact reconstruction
+> (`decode-equivalence`) as the strongest tier above the entropy-stage guarantee
+> the base learned-codec field provides. No new wire format; a vocabulary +
+> conformance framing over §7.
+> Keywords **MUST**, **MUST NOT**, **SHOULD**, **MAY** are RFC 2119/8174.
+
+## 1. Why tiers
+
+Neural decode reproducibility is not binary. A float neural decode is *not*
+reproducible at all — round-off diverges across hardware, and one diverging bit
+corrupts a learned entropy decode. In response the field has converged on making
+the **entropy stage** reproducible while leaving reconstruction to pixels
+implementation-defined. Two facts make this concrete:
+
+- **The base standard.** JPEG AI (ISO/IEC 6048) defines its normative bit-exact
+  conformance point at the **output of the entropy decoder**, not at
+  reconstruction to pixels; its entropy pipeline is integer so that stage
+  replicates across devices, while post-entropy processes MAY diverge. One
+  codestream may legally reconstruct through up to three synthesis transforms.
+- **The learned-codec field.** The mainstream cross-platform fix is **explicit
+  parameter transmission** — carrying the entropy/scale parameters in the
+  codestream so the entropy decode is consistent across devices *without* requiring
+  bit-exact arithmetic. Same target: a reproducible entropy stage, a
+  reconstruction that may vary.
+
+WAI supports that guarantee **and a stronger one**. Naming both lets a capability
+be honest about which it makes, and lets a receipt or a provenance binding
+(§[reconstruction-binding](reconstruction-binding.md)) demand the tier it needs.
+
+## 2. The tiers
+
+### `entropy-consistency`
+
+The **entropy decode** reproduces byte-for-byte across devices — the decoded
+symbols / quantized latent have a portable hash — but the reconstruction to the
+final medium (pixels, samples) MAY differ between conforming sinks. A sink
+achieves this either by **integer entropy arithmetic** (deriving the coding
+parameters with fixed-point ops, as WAI's integer decoders and JPEG AI's entropy
+pipeline do) or by **explicit parameter transmission** (the codestream carries the
+parameters, so no bit-exact derivation is required).
+
+- Conformance criterion: *entropy-equivalence* — a verifier decodes the entropy
+  stage and compares the symbols / quantized latent, NOT the pixels.
+- This is the guarantee the base learned-codec standard and the mainstream
+  cross-platform techniques provide. It is the **floor** for a sound neural
+  `replicate` under §7: enough that the decode does not catastrophically desync,
+  not enough to hash the rendered result.
+
+### `decode-equivalence`
+
+The **whole decode to the final medium** reproduces byte-for-byte across devices —
+the reconstructed pixels (or samples, or attributes) have a portable hash. The
+sink pins **one** reconstruction and runs it in integer / fixed-order arithmetic
+end to end, entropy *and* synthesis. Where the base codec admits several
+conformant reconstructions, this tier fixes one.
+
+- Conformance criterion: the medium's `*-equivalence` (e.g. *decode-equivalence*
+  for `wai.image.jpegai`, *sample-equivalence* for `wai.audio.int_codec`,
+  *splat-equivalence* for `wai.splat.int_codec`).
+- This is WAI's contribution above the field's baseline: it is a determinism
+  guarantee **beyond what the base standard requires**, and it is the precondition
+  for a hard provenance binding over the *rendered* content — a decoded-pixel hash
+  is only portable when the reconstruction is pinned.
+
+A capability satisfying `decode-equivalence` satisfies `entropy-consistency` by
+construction; the reverse does not hold.
+
+## 3. Declaring and using a tier
+
+- A capability's registration (§5) states its tier via its `*-equivalence`
+  criterion; the WAI capabilities that decode a learned image/audio/3D latent to
+  bytes (`wai.image.jpegai`, `wai.neural.int_*`, `wai.audio.int_codec`,
+  `wai.splat.int_codec`) are `decode-equivalence`. A capability MAY instead
+  declare `entropy-consistency` when it only guarantees the entropy stage.
+- **`replicate`-soundness (§7).** An envelope with `intent = replicate` MUST pin a
+  prior that meets at least `entropy-consistency`; a float neural decode meets
+  neither tier and MUST NOT claim `replicate`. A receipt that carries a
+  reproducible decoded-medium hash MUST come from a `decode-equivalence`
+  capability.
+- **Provenance.** The [reproducible-reconstruction binding](reconstruction-binding.md)
+  — a C2PA / JPEG-Trust hard binding over decoded pixels — requires
+  `decode-equivalence`; over an `entropy-consistency` capability only the
+  entropy-stage output is bindable, not the rendered result.
+
+## 4. Framing
+
+WAI spans the spectrum rather than competing on one point of it. The
+`entropy-consistency` tier is the base learned-codec floor — the guarantee the
+field and the underlying standards already make — and WAI supports it directly.
+`decode-equivalence` is the tier WAI adds on top: pinning one full reconstruction
+so the rendered result, not only the entropy stream, is reproducible and
+hashable. Both are stated as capabilities of the standard, not as comparisons.

wai/extensions/reconstruction-binding.md

@@ -69,7 +69,7 @@ A binding is a hash plus the descriptor that makes the decode reproducible:
   `decoderId`, `profile`, and `level` before hashing, or the comparison is
   meaningless. The descriptor pins the one reconstruction the hash is over.
 
-Conformance criterion: **decode-equivalence** — a verifier that decodes the
+Conformance criterion: **decode-equivalence** (see [determinism-tiers](determinism-tiers.md)) — a verifier that decodes the
 codestream with a WAI decoder under the binding's descriptor, hashes the canonical
 `RGB8` buffer, and compares MUST obtain the recorded `hash`.