route-record: version 3 states what a hop delivered by its count and root, so a hop may deliver any number of objects #563

Merged

dcharlot merged 4 commits from wai/route-outputs into main 2026-11-02 03:22:10 -05:00

Conversation 0 Commits 4 Files changed 15 +2047 -85

dcharlot commented 2026-11-01 09:03:28 -05:00

Owner

Copy link

The bound. Route record version 2 lists the served attempt's outputs, at most 1024 (route-record §5.2), and the list grows with them. A package's run delivers its receipt, its indexes and one object per piece and rung, so a long title's package has thousands of objects. Such a record cannot be stated. seal_delivered does not bound the list, so a router sealed a record that WAI's own verifier then refuses.

Route record version 3 (extensions/route-record.md §3.4, §5.2, §6, §6.1), on a price book of version 2:

• What the record states. The attempt that served states delivered: the count of the objects it delivered, and their commitment, which is the root its hop's receipt already names (oer-receipts §3 Output). A failed attempt states 0 and zeros.
• Size. The record is the same size whatever was delivered, and nothing a hop signs changes.
• Binding. The served hop's receipt is held to the root (receipt_output_mismatch). A record of version 1 rests on a price book of version 1, and one of version 2 or 3 on a price book of version 2 (pricebook_mismatch).
• Older versions. Versions 1 and 2 read and verify exactly as before.

An output's inclusion proof (§6.1): index and siblings, from the leaf up. It is held as jwp-receipts §3 step 5 holds an object:

• the index is below the count;
• there are exactly ⌈log₂ count⌉ siblings;
• the walk from the object's unlabelled leaf ends at the root.

So the last node of an odd level is proved at its own index only.

The receipt ledger (extensions/receipt-ledger.md §5.1, §4.8). Under a route record of version 3, each output of a job source gives proof:

• An output counts as delivered when its proof holds its object to the served attempt's count and root; otherwise output_not_delivered.
• A missing or misshapen proof, or one under a record of version 1 or 2, is malformed.
• A decode of version 5 is held to its places and its count.
• A record of version 3 that no hop served holds its outputs to none.

Reason. The hop's receipt names only the root, so the count is the router's statement, which only the objects check. A count stated larger than the objects lets one object be proved at a second place, but no source bills one object twice, and a decode is held to its places and its count. Every tariff version that reads job sources reads these.

Reference: route_record::seal_committed, output_proof, verify_output_proof, book_version.

Corpora.

• Routes: 109 → 126 vectors. Six are accepted:

  • one output, whose root is its content hash;
  • three outputs;
  • 5,000 outputs, more than a list of version 2 holds, in a record the size of the others;
  • a failover;
  • a late hop;
  • receipts not checked.

  Eleven are controls:

  • a served count of 0;
  • a failed hop with a count, and one with a root;
  • a root in capitals;
  • a count as text;
  • an extra member;
  • outputs listed as version 2 lists them;
  • delivered in a record of version 2;
  • version 3 on a version-1 price book;
  • a receipt moved from another job;
  • a root not the receipt's.

• Ledger: 108 → 120 vectors. One is accepted: an encode whose clip is the second of two objects, a decode of version 5, and a package's run whose receipt is the first of 1,501 objects, each output proved. Eleven are controls:

  • an output without its proof;
  • a proof under a record of version 2;
  • a proof whose index is text;
  • a proof of another place;
  • a proof past the count, whose walk is its own place's;
  • a proof a sibling short;
  • an output its hop did not deliver;
  • one output twice;
  • a decode's animation at another place;
  • a decode with an object past its animation;
  • an output of a job no hop served.

• Unchanged. Every other vector and source of both corpora is unchanged byte for byte, except one acknowledged break: the unknown-version control is now record_version_4.

Checked.

• wai-rs on Linux, with CI's features:

  • --lib route_record:: 9 passed, including an inclusion-proof test over every output of every count to 37;
  • --lib receipt_ledger:: 13 passed, --lib png_still:: 6 passed;
  • --test route_record 7, --test receipt_ledger 7 (both corpora regenerate byte for byte), --test revenue_share 7, --test opportunity_report 6, --test corpus_provenance 2, all passed.

• wai-ledger: release tests 5 passed, and clippy -D warnings is clean.

• route_record_verify.py, sharing no code with wai-rs:

  • all 126 vectors pass;
  • all 717 mutated copies fail;
  • all 47 checks are caught when dropped, delivered-form and receipt-root among them.

• receipt_ledger_verify.py:

  • all 120 vectors pass;
  • all 135 mutated copies fail;
  • all 34 checks are caught when dropped, output-proof among them;
  • its proof check is the route verifier's own inclusion_proof.

• Dependent verifiers: those of the corpora that read the ledger's (revenue share, opportunity report) pass.

• Rust falsification: each rule mutated alone in the reference (16 mutations, scratchpad falsify_rr3.py), each run against a passing baseline and checked by both corpora's verify binaries.

  • Route record (11): version 3 read; delivered required; a served count of at least 1; a failed root of zeros; version 3 resting on a version-2 price book; the receipt naming the root; version 3's candidates being version 2's; and the proof's index below the count, its sibling count, its walk from the leaf, and its bit's side.
  • Ledger (5): the proof required; the proof holding its object; a decode at its place; a decode's count; a job no hop served holding its outputs to none.

  15 of 16 are caught, and the restored tree passes. The one that survives is the exact sibling count. The leaf and node domains already keep a walk of another length from reaching the root (a different length would need a hash collision), so no vector can isolate it. It stays as jwp-receipts §3 step 5 states it, refusing such a proof before anything is hashed, and §6.1 now says so.

Also: a flaky test on main

joule-contrib's a_wrapped_key_unwraps_under_the_passphrase_only checked that encryption under a random key changed the payload's first byte, which stays the same one time in 256. It failed that way on linux-arm64 at this PR's first head. Its own commit (5c4759516) makes it compare the whole payload.

joule-moq-ingest's contribution_at_twenty_megabits_passes_the_door lost two of 120 access units mid-stream on linux-arm64, on a heavily loaded host. Its link ran at a 300 ms window, so a longer stall has the gateway drop a packet as too late. Its own commit (189b9a92f) gives the link 2 s, closes once every packet is acknowledged, and checks the link record for too-late drops before comparing frames.

🤖 Generated with Claude Code

**The bound.** Route record version 2 lists the served attempt's outputs, at most 1024 (route-record §5.2), and the list grows with them. A package's run delivers its receipt, its indexes and one object per piece and rung, so a long title's package has thousands of objects. Such a record cannot be stated. `seal_delivered` does not bound the list, so a router sealed a record that WAI's own verifier then refuses. **Route record version 3** (`extensions/route-record.md` §3.4, §5.2, §6, §6.1), on a price book of version 2: - **What the record states.** The attempt that served states `delivered`: the count of the objects it delivered, and their commitment, which is the root its hop's receipt already names (oer-receipts §3 *Output*). A failed attempt states 0 and zeros. - **Size.** The record is the same size whatever was delivered, and nothing a hop signs changes. - **Binding.** The served hop's receipt is held to the root (`receipt_output_mismatch`). A record of version 1 rests on a price book of version 1, and one of version 2 or 3 on a price book of version 2 (`pricebook_mismatch`). - **Older versions.** Versions 1 and 2 read and verify exactly as before. **An output's inclusion proof** (§6.1): `index` and `siblings`, from the leaf up. It is held as jwp-receipts §3 step 5 holds an object: - the index is below the count; - there are exactly ⌈log₂ count⌉ siblings; - the walk from the object's unlabelled leaf ends at the root. So the last node of an odd level is proved at its own index only. **The receipt ledger** (`extensions/receipt-ledger.md` §5.1, §4.8). Under a route record of version 3, each output of a job source gives `proof`: - An output counts as delivered when its proof holds its object to the served attempt's count and root; otherwise `output_not_delivered`. - A missing or misshapen proof, or one under a record of version 1 or 2, is `malformed`. - A decode of version 5 is held to its places and its count. - A record of version 3 that no hop served holds its outputs to none. **Reason.** The hop's receipt names only the root, so the count is the router's statement, which only the objects check. A count stated larger than the objects lets one object be proved at a second place, but no source bills one object twice, and a decode is held to its places and its count. Every tariff version that reads job sources reads these. **Reference:** `route_record::seal_committed`, `output_proof`, `verify_output_proof`, `book_version`. **Corpora.** - **Routes: 109 → 126 vectors.** Six are accepted: - one output, whose root is its content hash; - three outputs; - 5,000 outputs, more than a list of version 2 holds, in a record the size of the others; - a failover; - a late hop; - receipts not checked. Eleven are controls: - a served count of 0; - a failed hop with a count, and one with a root; - a root in capitals; - a count as text; - an extra member; - outputs listed as version 2 lists them; - `delivered` in a record of version 2; - version 3 on a version-1 price book; - a receipt moved from another job; - a root not the receipt's. - **Ledger: 108 → 120 vectors.** One is accepted: an encode whose clip is the second of two objects, a decode of version 5, and a package's run whose receipt is the first of 1,501 objects, each output proved. Eleven are controls: - an output without its proof; - a proof under a record of version 2; - a proof whose index is text; - a proof of another place; - a proof past the count, whose walk is its own place's; - a proof a sibling short; - an output its hop did not deliver; - one output twice; - a decode's animation at another place; - a decode with an object past its animation; - an output of a job no hop served. - **Unchanged.** Every other vector and source of both corpora is unchanged byte for byte, except one acknowledged break: the unknown-version control is now `record_version_4`. **Checked.** - **wai-rs on Linux, with CI's features:** - `--lib route_record::` 9 passed, including an inclusion-proof test over every output of every count to 37; - `--lib receipt_ledger::` 13 passed, `--lib png_still::` 6 passed; - `--test route_record` 7, `--test receipt_ledger` 7 (both corpora regenerate byte for byte), `--test revenue_share` 7, `--test opportunity_report` 6, `--test corpus_provenance` 2, all passed. - **wai-ledger:** release tests 5 passed, and clippy `-D warnings` is clean. - **`route_record_verify.py`**, sharing no code with wai-rs: - all 126 vectors pass; - all 717 mutated copies fail; - all 47 checks are caught when dropped, `delivered-form` and `receipt-root` among them. - **`receipt_ledger_verify.py`:** - all 120 vectors pass; - all 135 mutated copies fail; - all 34 checks are caught when dropped, `output-proof` among them; - its proof check is the route verifier's own `inclusion_proof`. - **Dependent verifiers:** those of the corpora that read the ledger's (revenue share, opportunity report) pass. - **Rust falsification:** each rule mutated alone in the reference (16 mutations, scratchpad `falsify_rr3.py`), each run against a passing baseline and checked by both corpora's `verify` binaries. - **Route record (11):** version 3 read; `delivered` required; a served count of at least 1; a failed root of zeros; version 3 resting on a version-2 price book; the receipt naming the root; version 3's candidates being version 2's; and the proof's index below the count, its sibling count, its walk from the leaf, and its bit's side. - **Ledger (5):** the proof required; the proof holding its object; a decode at its place; a decode's count; a job no hop served holding its outputs to none. 15 of 16 are caught, and the restored tree passes. The one that survives is the exact sibling count. The leaf and node domains already keep a walk of another length from reaching the root (a different length would need a hash collision), so no vector can isolate it. It stays as jwp-receipts §3 step 5 states it, refusing such a proof before anything is hashed, and §6.1 now says so. ## Also: a flaky test on main `joule-contrib`'s `a_wrapped_key_unwraps_under_the_passphrase_only` checked that encryption under a random key changed the payload's first byte, which stays the same one time in 256. It failed that way on linux-arm64 at this PR's first head. Its own commit (5c4759516) makes it compare the whole payload. `joule-moq-ingest`'s `contribution_at_twenty_megabits_passes_the_door` lost two of 120 access units mid-stream on linux-arm64, on a heavily loaded host. Its link ran at a 300 ms window, so a longer stall has the gateway drop a packet as too late. Its own commit (189b9a92f) gives the link 2 s, closes once every packet is acknowledged, and checks the link record for too-late drops before comparing frames. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dcharlot added 1 commit 2026-11-01 09:03:28 -05:00

route-record: version 3 states what a hop delivered by its count and root ... 11267b7b4b

A record of version 2 lists the served attempt's outputs, at most 1024, and a
package of a long title holds an object per piece and rung, thousands of them:
its record could not be stated, and seal_delivered sealed one WAI's verifier
refuses.

Version 3, on a price book of version 2, states `delivered`: the count of the
objects and their commitment, the root the hop's receipt already names. The
record is the same size whatever was delivered, and the receipt is held to the
root. An object is shown to be one of them by its inclusion proof (§6.1),
held as jwp-receipts holds an object's: the index below the count, exactly
ceil(log2 count) siblings, the walk from its leaf ending at the root.

The receipt ledger reads a job source under a record of version 3: each output
gives `proof`, and is one its hop delivered when the proof holds; a decode of
version 5 is held to its places and its count. Versions 1 and 2 of the record
read and verify as before. Routes 109 to 126 vectors, ledger 108 to 120; both
second implementations read version 3, the ledger's checking every proof with
the route verifier's inclusion_proof.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot added 1 commit 2026-11-01 09:18:55 -05:00

CHANGELOG: route_record::Accepted::delivered, acknowledged as breaking ... 5d8e2f378c

The accepted outcome of a record of version 3 carries what its served hop
delivered, by its count and root; a struct literal or exhaustive pattern of
Accepted outside the crate adds the field.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot referenced this pull request from a commit 2026-11-01 13:31:30 -05:00

joule-contrib: the SRT encryption test checks the whole payload, not its first byte

dcharlot added 1 commit 2026-11-01 13:31:31 -05:00

joule-contrib: the SRT encryption test checks the whole payload, not its first byte ... 5c4759516c

`a_wrapped_key_unwraps_under_the_passphrase_only` encrypted 1316 bytes of 0x47 under
a fresh random key and asserted only that the first byte changed: AES-CTR's keystream
byte is 0 one time in 256, so the test failed that often (linux-arm64, on #563's head).
It now asserts the ciphertext differs from the plaintext as a whole.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot referenced this pull request from a commit 2026-11-01 20:53:48 -05:00

joule-moq-ingest: the 20 Mbit/s SRT test gives its link a window of two seconds

dcharlot added 1 commit 2026-11-01 20:53:49 -05:00

joule-moq-ingest: the 20 Mbit/s SRT test gives its link a window of two seconds ... 189b9a92f7

`contribution_at_twenty_megabits_passes_the_door` is about the relay's door holding
groups of megabytes, but it ran its link at a 300 ms window. On the loaded linux-arm64
runner (#563's head) two of 120 access units went missing mid-stream (the first at 29):
a stall longer than the window has the gateway drop a packet as too late (§4.6), which
corrupts the access unit it carried.

The test now calls with a 2 s window, closes once the gateway has acknowledged every
packet (as the neighbouring test does) rather than after a fixed linger, and checks the
link record before comparing frames: the window is the caller's, and no packet was dropped
as too late, so a recurrence names its cause instead of a missing frame.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot merged commit 26078b99bc into main 2026-11-02 03:22:10 -05:00

dcharlot referenced this pull request from a commit 2026-11-02 03:22:10 -05:00

Merge pull request 'route-record: version 3 states what a hop delivered by its count and root, so a hop may deliver any number of objects' (#563) from wai/route-outputs into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Transaction-Science/open-standards!563

No description provided.