.github/wai-conformance/README.md

@@ -0,0 +1,34 @@
+# What wai-conformance.yml runs, one file a step
+
+`wai-conformance.yml` keeps no hand list of its verifier steps, corpora or kernel tests. Its
+lists are derived, when it runs, from the files here and from tags in the test files, by
+[`scripts/wai-conformance-lists.py`](../../scripts/wai-conformance-lists.py), whose
+docstring states every key; its gate reads the steps' `paths:` through
+`scripts/pr-touches-paths.py`. A change that adds a verifier, a corpus or a kernel test adds
+a file, or a line to a file of its own, and edits no line of the workflow, unless a step's
+`paths:` names a file under none of the trigger's paths (`check` names it). Its features and
+`[[test]]` entries in `wai/wai-rs/Cargo.toml` stay shared
+([`wai/CONTRIBUTING.md`](../../wai/CONTRIBUTING.md)).
+
+- `verifiers/<name>.sh`: one step of the `independent-verifiers` job. Its body is the step's
+  shell, run in `wai/` (or `working-directory:`) with `bash -eo pipefail`, as a workflow step
+  runs. Its header, the leading `# key: value` lines, gives `step:` (its name), `order:` (steps
+  run in ascending order, a tie by file name), `features:` (each list compiles alone in
+  `features-alone`, and every feature joins `WAI_FEATURES`), and where it needs them `alone:`,
+  `build: pq`, `release-features:`, `bins:`, `pq-bins:`, `paths:` (the extension texts it
+  reads, which the workflow's gate then runs on) and `working-directory:`. Prose comments
+  follow the header, after a `#` line.
+- `corpora/<name>.txt`: one cargo-class corpus, verified by its own tool on every leg of
+  `cargo-classes` (`corpus:`, `order:`, `bin:`, `dir:`).
+- A test file of `wai/wai-rs/tests/` whose first line is `// wai-conformance: int-kernels`
+  runs in the fast integer kernels' steps of both profiles (`int-kernels-release`: the
+  release step only; `int-kernels-amd`: the AVX-512 host too). The steps' features are the
+  tagged tests' `required-features`.
+- `baseline.json`: the lists the workflow kept by hand before they were derived. The
+  repository checks require every derived list to hold every entry of it, and every step it
+  names to run.
+
+To see what the workflow runs: `python3 scripts/wai-conformance-lists.py dry-run` (of another
+commit: `--ref <commit>`; two of them diff line by line). To run one step as CI does:
+`python3 scripts/wai-conformance-lists.py run --only <name>`. To check the files:
+`python3 scripts/wai-conformance-lists.py check`.

.github/wai-conformance/baseline.json

@@ -0,0 +1,908 @@
+{
+ "note": "The lists wai-conformance.yml kept by hand at `commit`, before they were derived from the files of .github/wai-conformance/ and the tags of wai/wai-rs/tests/ (scripts/wai-conformance-lists.py baseline --ref <commit>). `selftest` requires every derived list to hold every entry here and every step named here to run; `selftest --exact` requires the lists equal (with `added`, the entries the change that derived them added on purpose) and the steps' bodies the same, in order. Coverage leaves a list only by an edit of this file.",
+ "commit": "a223c597dae30c57da0804d06b19f5096f016db6",
+ "added": {
+  "paths": [
+   ".github/wai-conformance/**",
+   "scripts/wai-conformance-lists.py"
+  ],
+  "why": "the files that now say what the workflow runs start it, as the workflow file itself does"
+ },
+ "paths": [
+  "wai/wai-rs/**",
+  "wai/examples/**",
+  "wai/wai-quantum/**",
+  "wai/wai-ops/**",
+  "wai/wai-app/**",
+  "joule-ui/joule-ui-rs/crates/joule-ui-core/**",
+  "joule-ui/joule-ui-rs/crates/joule-ui-lang/**",
+  "joule-ui/joule-ui-rs/crates/joule-ui-interaction/**",
+  "wai/*-conformance/**",
+  "wai/byte-exact-conformance/**",
+  "wai/registry/**",
+  "wai/vocab/**",
+  "wai/glossary/**",
+  "wai/SPEC.md",
+  "wai/REGISTRY.md",
+  "wai/extensions/integer-payloads.md",
+  "wai/extensions/staged-delivery.md",
+  "wai/extensions/http-delivery.md",
+  "wai/extensions/moq-streaming-format.md",
+  "wai/extensions/jwp-receipts.md",
+  "wai/extensions/quantum-sim.md",
+  "wai/extensions/live-events.md",
+  "wai/extensions/live-rooms.md",
+  "wai/extensions/capture-binding.md",
+  "wai/extensions/live-compose.md",
+  "wai/extensions/live-recording.md",
+  "wai/extensions/timed-text.md",
+  "wai/extensions/access-services.md",
+  "wai/extensions/live-metering.md",
+  "wai/extensions/energy-steering.md",
+  "wai/extensions/live-moderation.md",
+  "wai/extensions/forensic-watermark.md",
+  "wai/extensions/confidentiality.md",
+  "wai/extensions/live-messaging.md",
+  "wai/extensions/live-ads.md",
+  "wai/extensions/ad-presentation.md",
+  "wai/extensions/key-release.md",
+  "wai/extensions/conformance-results.md",
+  "joule-code/joule-code-rs/crates/joule-moq-web/web/ads/**",
+  "wai/extensions/stitched-presentation.md",
+  "wai/extensions/channel-lineup.md",
+  "wai/extensions/live-provenance.md",
+  "wai/extensions/deriving-edge.md",
+  "wai/extensions/synthesis.md",
+  "wai/extensions/exact-upscale.md",
+  "wai/extensions/prior-carriage.md",
+  "wai/extensions/scene-carriage.md",
+  "wai/extensions/avatars.md",
+  "wai/tools/wai_avatar_face_train.py",
+  "wai/extensions/ai-usage.md",
+  "wai/extensions/contribution.md",
+  "wai/extensions/live-contribution.md",
+  "wai/extensions/settlement.md",
+  "wai/extensions/receipt-ledger.md",
+  "wai/extensions/revenue-share.md",
+  "wai/extensions/opportunity-report.md",
+  "wai/extensions/stream-audit.md",
+  "wai/extensions/fleet.md",
+  "wai/extensions/route-record.md",
+  "wai/extensions/native-sink.md",
+  "wai/extensions/browser-sink.md",
+  "wai/extensions/capability-constraints.md",
+  "wai/extensions/sink-energy.md",
+  "wai/wai-live-web/**",
+  "wai/extensions/takedown.md",
+  "wai/extensions/co-performance.md",
+  "wai/extensions/age-assurance.md",
+  "wai/extensions/influence.md",
+  "wai/extensions/direction.md",
+  "wai/extensions/bearer-receipts.md",
+  "wai/extensions/carousel.md",
+  "wai/extensions/holdings.md",
+  "wai/extensions/exploration.md",
+  "wai/extensions/platform-encode.md",
+  "wai/extensions/co-watch.md",
+  "wai/extensions/live-worlds.md",
+  "joule-code/joule-code-rs/crates/joule-moq-web/web/room/cowatch*",
+  "wai/extensions/remote-desktop.md",
+  "joule-code/joule-code-rs/crates/joule-moq-web/web/room/remote*",
+  "wai/extensions/opus-dred.md",
+  "wai/extensions/telemetry-aggregation.md",
+  "wai/extensions/delivery-telemetry.md",
+  "wai/extensions/exact-tonemap.md",
+  "wai/extensions/robustness-evidence.md",
+  "wai/extensions/splat-exact.md",
+  "wai/extensions/gltf/**",
+  "wai/tools/wai_ops_check.py",
+  "wai/extensions/pq-signatures.md",
+  "wai/extensions/format-probes.md",
+  "wai/extensions/media-identify.md",
+  "wai/extensions/projection.md",
+  "wai/extensions/loc-carriage.md",
+  "wai/research/determinism-cost.md",
+  "wai/research/determinism-cost/**",
+  "wai/tools/wai_determinism_cost_verify.py",
+  "wai/extensions/determinism-tiers.md",
+  "wai/research/catalogue-prior.md",
+  "wai/research/catalogue-prior/**",
+  "wai/tools/wai_catalogue_prior_verify.py",
+  "wai/extensions/stream-termination.md",
+  "wai/wai-web/**",
+  "wai/tools/wai_audio_provenance_check.py",
+  ".github/workflows/wai-conformance.yml"
+ ],
+ "WAI_FEATURES": [
+  "key_discovery",
+  "http",
+  "video_manifest",
+  "stage_measure",
+  "live_events",
+  "live_room",
+  "capture_take",
+  "live_compose",
+  "live_record",
+  "timed_text",
+  "access_services",
+  "live_metering",
+  "energy_steering",
+  "live_moderation",
+  "dred_exact",
+  "live_ads",
+  "live_provenance",
+  "synthesis",
+  "synthesis_mark",
+  "neural_int",
+  "exact_upscale",
+  "robustness",
+  "ai_usage",
+  "contribution",
+  "settlement",
+  "browser_sink",
+  "receipt_claims",
+  "takedown",
+  "influence",
+  "direction",
+  "co_performance",
+  "age_assurance",
+  "bearer_receipts",
+  "exploration",
+  "co_watch",
+  "telemetry_aggregate",
+  "exact_tonemap",
+  "splat_exact",
+  "live_watermark",
+  "derive_edge",
+  "sink_energy",
+  "key_release",
+  "stitched_presentation",
+  "prior_wire",
+  "scene_map",
+  "avatar_face",
+  "receipt_ledger",
+  "stream_audit",
+  "fleet",
+  "native_sink",
+  "platform_encode",
+  "remote_desktop",
+  "stream_termination",
+  "live_world",
+  "format_probe",
+  "identify",
+  "live_messaging",
+  "conform_result",
+  "revenue_share",
+  "opportunity_report",
+  "channel_lineup",
+  "route_record",
+  "carousel",
+  "holdings"
+ ],
+ "WAI_PQ_FEATURES": [
+  "synthesis",
+  "pq_signatures"
+ ],
+ "WAI_RELEASE_FEATURES": [
+  "dred_exact",
+  "synthesis_mark",
+  "robustness",
+  "avatar_face"
+ ],
+ "union_bins": [
+  "wai_http_vectors",
+  "wai_stage_measure",
+  "wai_browser_sink_vectors",
+  "wai_claim_vectors",
+  "wai_jwp_vectors",
+  "wai_signer_vectors",
+  "wai_sink_energy_vectors",
+  "wai_stitched_presentation",
+  "wai_stream_termination_vectors",
+  "wai_format_probe",
+  "wai_identify_vectors",
+  "wai_conform_result_vectors",
+  "wai_channel_lineup_vectors"
+ ],
+ "pq_bins": [
+  "wai_pq_vectors",
+  "wai_claim_vectors",
+  "wai_jwp_vectors",
+  "wai_signer_vectors"
+ ],
+ "union_tests": [
+  "live_events",
+  "live_room",
+  "capture_take",
+  "live_compose",
+  "live_record",
+  "timed_text",
+  "access_services",
+  "live_metering",
+  "energy_steering",
+  "live_moderation",
+  "live_ads",
+  "ad_presentation",
+  "live_provenance",
+  "synthesis",
+  "exact_upscale",
+  "cli_derive",
+  "ai_usage",
+  "contribution",
+  "settlement",
+  "browser_sink",
+  "takedown",
+  "influence",
+  "direction",
+  "co_performance",
+  "age_assurance",
+  "bearer_receipts",
+  "carousel",
+  "holdings",
+  "exploration",
+  "co_watch",
+  "telemetry_aggregate",
+  "exact_tonemap",
+  "splat_exact",
+  "live_watermark",
+  "derive_edge",
+  "det_cost_bin",
+  "sink_energy",
+  "key_release",
+  "stitched_presentation",
+  "prior_wire",
+  "scene_map",
+  "receipt_ledger",
+  "stream_audit",
+  "fleet",
+  "native_sink",
+  "platform_encode",
+  "remote_desktop",
+  "stream_termination",
+  "live_world",
+  "format_probe",
+  "identify",
+  "live_messaging",
+  "conform_result",
+  "revenue_share",
+  "opportunity_report",
+  "channel_lineup",
+  "route_record"
+ ],
+ "release_tests": [
+  "dred_exact",
+  "dred_exact_measure",
+  "synthesis_mark",
+  "robustness",
+  "avatar_face"
+ ],
+ "alone": [
+  "key_discovery",
+  "http,video_manifest,key_discovery",
+  "stage_measure",
+  "live_events",
+  "live_room",
+  "capture_take",
+  "live_compose",
+  "live_record",
+  "timed_text",
+  "access_services",
+  "live_metering",
+  "energy_steering",
+  "live_moderation",
+  "dred_exact",
+  "live_ads",
+  "live_provenance",
+  "synthesis",
+  "synthesis_mark",
+  "neural_int",
+  "exact_upscale",
+  "robustness",
+  "ai_usage",
+  "contribution",
+  "settlement",
+  "browser_sink",
+  "browser_sink,receipt_claims",
+  "takedown",
+  "influence",
+  "direction",
+  "co_performance",
+  "age_assurance",
+  "bearer_receipts",
+  "carousel",
+  "holdings",
+  "exploration",
+  "co_watch",
+  "telemetry_aggregate",
+  "exact_tonemap",
+  "splat_exact",
+  "live_watermark",
+  "derive_edge",
+  "pq_signatures",
+  "synthesis,pq_signatures",
+  "sink_energy",
+  "key_release",
+  "stitched_presentation",
+  "prior_wire",
+  "prior_wire,neural_int",
+  "scene_map",
+  "avatar_face",
+  "receipt_ledger",
+  "stream_audit",
+  "fleet",
+  "native_sink",
+  "platform_encode",
+  "remote_desktop",
+  "stream_termination",
+  "live_world",
+  "format_probe",
+  "live_messaging",
+  "conform_result",
+  "revenue_share",
+  "opportunity_report",
+  "channel_lineup",
+  "route_record"
+ ],
+ "steps": [
+  {
+   "step": "int_payload_verify.py",
+   "wd": "wai",
+   "body": "python3 int-payload-conformance/int_payload_verify.py int-payload-conformance"
+  },
+  {
+   "step": "determinism cost · the record, the text quoting it, and wai_det_cost",
+   "wd": "wai",
+   "body": "set -euo pipefail\npython3 -I tools/wai_determinism_cost_verify.py research/determinism-cost/record.json \\\n  research/determinism-cost.md extensions/determinism-tiers.md\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test det_cost_bin)"
+  },
+  {
+   "step": "catalogue prior · the record and the text quoting it",
+   "wd": "wai",
+   "body": "python3 -I tools/wai_catalogue_prior_verify.py research/catalogue-prior research/catalogue-prior.md"
+  },
+  {
+   "step": "staged_verify.py",
+   "wd": "wai",
+   "body": "python3 staged-conformance/staged_verify.py staged-conformance"
+  },
+  {
+   "step": "http_verify.py",
+   "wd": "wai",
+   "body": "python3 http-conformance/http_verify.py http-conformance"
+  },
+  {
+   "step": "The HTTP differential outside the corpus (wai-rs against http_verify.py)",
+   "wd": "wai",
+   "body": "set -euo pipefail\nfor seed in 11 12; do\n  \"$RUNNER_TEMP/wai-bins/union/wai_http_vectors\" fuzz http-conformance --seed \"$seed\" --count 400 --out \"$RUNNER_TEMP/http-fuzz-$seed.json\"\n  python3 http-conformance/http_verify.py cases \"$RUNNER_TEMP/http-fuzz-$seed.json\" http-conformance\ndone"
+  },
+  {
+   "step": "measure_verify.py",
+   "wd": "wai",
+   "body": "python3 staged-measure-conformance/measure_verify.py staged-measure-conformance"
+  },
+  {
+   "step": "sim_verify.py",
+   "wd": "wai",
+   "body": "python3 staged-measure-conformance/sim_verify.py staged-measure-conformance"
+  },
+  {
+   "step": "sim_diff.py, wai_stage_measure against sim_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\nfor seed in 1 2; do\n  python3 staged-measure-conformance/sim_diff.py \"$RUNNER_TEMP/wai-bins/union/wai_stage_measure\" \"$seed\" 1500\ndone"
+  },
+  {
+   "step": "live events · wai-rs and live_events_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib live_events::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test live_events)\npython3 -I live-conformance/live_events_verify.py live-conformance/events"
+  },
+  {
+   "step": "live rooms · wai-rs and live_rooms_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib live_room::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test live_room)\npython3 -I live-conformance/live_rooms_verify.py live-conformance/rooms"
+  },
+  {
+   "step": "capture take · wai-rs and capture_take_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib -- capture_take:: output_tree::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test capture_take)\npython3 -I live-conformance/capture_take_verify.py live-conformance/takes"
+  },
+  {
+   "step": "live compose · wai-rs and live_compose_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib live_compose::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test live_compose)\npython3 -I live-conformance/live_compose_verify.py live-conformance/compose"
+  },
+  {
+   "step": "live recording · wai-rs and live_record_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib -- live_record:: output_tree::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test live_record)\npython3 -I live-conformance/live_record_verify.py live-conformance/recordings"
+  },
+  {
+   "step": "timed text · wai-rs and timed_text_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib timed_text::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test timed_text)\npython3 -I live-conformance/timed_text_verify.py live-conformance/captions"
+  },
+  {
+   "step": "access services · wai-rs and access_services_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib access_services::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test access_services)\npython3 -I live-conformance/access_services_verify.py live-conformance/access"
+  },
+  {
+   "step": "conformance results · wai-rs and conform_result_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib conform_result::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test conform_result)\n\"$RUNNER_TEMP/wai-bins/union/wai_conform_result_vectors\" verify conform-result-conformance\npython3 -I conform-result-conformance/conform_result_verify.py conform-result-conformance\nfor c in duplicates format members signature summary verdict; do\n  python3 -I conform-result-conformance/conform_result_verify.py --skip \"$c\" conform-result-conformance | tail -1\ndone"
+  },
+  {
+   "step": "live metering · wai-rs and live_metering_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib live_metering::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test live_metering)\npython3 -I live-conformance/live_metering_verify.py live-conformance/metering"
+  },
+  {
+   "step": "energy steering · wai-rs and energy_steering_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib energy_steering::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test energy_steering)\npython3 -I live-conformance/energy_steering_verify.py live-conformance/steering"
+  },
+  {
+   "step": "sink energy · wai-rs and sink_energy_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib sink_energy::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib sink_meter::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test sink_energy)\n(cd wai-rs && \"$RUNNER_TEMP/wai-bins/union/wai_sink_energy_vectors\" verify ../live-conformance/sink-energy)\npython3 -I live-conformance/sink_energy_verify.py live-conformance/sink-energy"
+  },
+  {
+   "step": "live moderation · wai-rs and live_moderation_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib live_moderation::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test live_moderation)\npython3 -I live-conformance/live_moderation_verify.py live-conformance/moderation"
+  },
+  {
+   "step": "opus deep redundancy · wai-rs and dred_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\nd=\"${RUNNER_TEMP:-/tmp}/dred\"\nbash live-conformance/dred/fetch.sh \"$d\" vectors\nw=\"$d/dred_unquantized_weights.bin\"\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib dred_exact::)\n(cd wai-rs && WAI_DRED_WEIGHTS=\"$w\" cargo test --release --no-default-features --features \"$WAI_RELEASE_FEATURES\" --test dred_exact)\n(cd wai-rs && WAI_DRED_WEIGHTS=\"$w\" WAI_DRED_VECTORS=\"$d\" cargo test --release --no-default-features --features \"$WAI_RELEASE_FEATURES\" --test dred_exact_measure)\npython3 -I live-conformance/dred_verify.py live-conformance/dred \"$w\""
+  },
+  {
+   "step": "live ads · wai-rs and live_ads_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib live_ads::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib wai_video_ssai::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test live_ads)\npython3 -I live-conformance/live_ads_verify.py live-conformance/ads"
+  },
+  {
+   "step": "key release · wai-rs and key_release_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib key_release::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib wai_video_keys::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test key_release)\npython3 -I live-conformance/key_release_verify.py live-conformance/keys"
+  },
+  {
+   "step": "ad presentation · wai-rs, ad_presentation_verify.py and the reference producer",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib live_ads::presentation::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test ad_presentation)\npython3 -I live-conformance/ad_presentation_verify.py live-conformance/presentation\nnode --test ../joule-code/joule-code-rs/crates/joule-moq-web/web/ads/presentation.test.mjs"
+  },
+  {
+   "step": "stitched presentation · wai-rs, stitched_presentation_verify.py and the reference producer",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib stitched_presentation::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib live_compose::layout::frame_tests)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test stitched_presentation)\n(cd wai-rs && \"$RUNNER_TEMP/wai-bins/union/wai_stitched_presentation\" vectors verify ../live-conformance/stitched)\npython3 -I live-conformance/stitched_presentation_verify.py live-conformance/stitched\nnode --test ../joule-code/joule-code-rs/crates/joule-moq-web/web/ads/stitched.test.mjs"
+  },
+  {
+   "step": "channel lineup · wai-rs and channel_lineup_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib channel_lineup::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test channel_lineup)\n(cd wai-rs && \"$RUNNER_TEMP/wai-bins/union/wai_channel_lineup_vectors\" verify ../live-conformance/channels)\npython3 -I live-conformance/channel_lineup_verify.py live-conformance/channels"
+  },
+  {
+   "step": "live provenance · wai-rs and c2pa_live_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib live_provenance::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test live_provenance)\npython3 -I live-conformance/c2pa_live_verify.py live-conformance/c2pa-live"
+  },
+  {
+   "step": "synthesis provenance · wai-rs and synthesis_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib synthesis::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test synthesis)\npython3 -I live-conformance/synthesis_verify.py live-conformance/synthesis"
+  },
+  {
+   "step": "synthesis watermark · wai-rs and synthesis_mark_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib -- synthesis::mark synthesis_mark::)\n(cd wai-rs && cargo test --release --no-default-features --features \"$WAI_RELEASE_FEATURES\" --test synthesis_mark)\npython3 -I live-conformance/synthesis_mark_verify.py live-conformance/synthesis-mark"
+  },
+  {
+   "step": "exact upscale · wai-rs and upscale_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib int_sr::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib exact_upscale::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test exact_upscale)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test cli_derive)\npython3 -I live-conformance/upscale_verify.py live-conformance/upscale"
+  },
+  {
+   "step": "robustness evidence · wai-rs and robustness_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib robustness::)\n(cd wai-rs && cargo test --release --no-default-features --features \"$WAI_RELEASE_FEATURES\" --test robustness)\npython3 -I live-conformance/robustness_verify.py live-conformance/robustness"
+  },
+  {
+   "step": "prior forms · wai-rs and prior_forms_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib -- prior_wire:: strict_json:: codecs::prior_form)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test prior_wire)\npython3 -I live-conformance/prior_forms_verify.py live-conformance/prior-forms"
+  },
+  {
+   "step": "scene carriage · wai-rs and scene_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib -- scene_map:: strict_json::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test scene_map)\npython3 -I live-conformance/scene_verify.py live-conformance/scene"
+  },
+  {
+   "step": "faces from keypoints · wai-rs and avatar_face_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib avatar_face::)\n(cd wai-rs && cargo test --release --no-default-features --features \"$WAI_RELEASE_FEATURES\" --test avatar_face)\npython3 -I live-conformance/avatar_face_verify.py live-conformance/avatar-face"
+  },
+  {
+   "step": "AI usage · wai-rs and ai_usage_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib ai_usage::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib claim_receipt::consumption::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test ai_usage)\npython3 -I live-conformance/ai_usage_verify.py live-conformance/usage\npython3 -I claim-conformance/claim_verify.py consumption live-conformance/usage/vectors.json"
+  },
+  {
+   "step": "contribution records · wai-rs and contribution_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib contribution::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test contribution)\npython3 -I live-conformance/contribution_verify.py live-conformance/contribution"
+  },
+  {
+   "step": "live contribution · live_contribution_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\npython3 -I live-conformance/live_contribution_verify.py live-conformance/links"
+  },
+  {
+   "step": "delivery settlement · wai-rs and settlement_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib settlement::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test settlement)\npython3 -I live-conformance/settlement_verify.py live-conformance/settlement"
+  },
+  {
+   "step": "receipt ledger · wai-rs and receipt_ledger_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib receipt_ledger::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test receipt_ledger)\npython3 -I live-conformance/receipt_ledger_verify.py live-conformance/ledger"
+  },
+  {
+   "step": "revenue share · wai-rs and revenue_share_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib revenue_share::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib wai_video_channel::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test revenue_share)\npython3 -I live-conformance/revenue_share_verify.py live-conformance/share"
+  },
+  {
+   "step": "opportunity report · wai-rs and opportunity_report_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib opportunity_report::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test opportunity_report)\npython3 -I live-conformance/opportunity_report_verify.py live-conformance/opportunity"
+  },
+  {
+   "step": "stream audit · wai-rs and stream_audit_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib stream_audit::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test stream_audit)\npython3 -I live-conformance/stream_audit_verify.py live-conformance/audit"
+  },
+  {
+   "step": "fleet · wai-rs and fleet_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib fleet::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test fleet)\npython3 -I live-conformance/fleet_verify.py live-conformance/fleet"
+  },
+  {
+   "step": "route record · wai-rs and route_record_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib route_record::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test route_record)\npython3 -I live-conformance/route_record_verify.py live-conformance/routes"
+  },
+  {
+   "step": "native sink · wai-rs and native_sink_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib native_sink::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test native_sink)\npython3 -I live-conformance/native_sink_verify.py live-conformance/native-sink"
+  },
+  {
+   "step": "browser sink · wai-rs, wai-live-web and browser_sink_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib browser_sink::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test browser_sink)\n(cd wai-rs && \"$RUNNER_TEMP/wai-bins/union/wai_browser_sink_vectors\" verify ../live-conformance/browser)\n(cd wai-live-web && cargo test --locked --features int_video --lib browser_tests)\npython3 -I live-conformance/browser_sink_verify.py live-conformance/browser"
+  },
+  {
+   "step": "takedown · wai-rs and takedown_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib takedown::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test takedown)\npython3 -I live-conformance/takedown_verify.py live-conformance/takedown"
+  },
+  {
+   "step": "influence attribution · wai-rs and influence_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib influence::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test influence)\npython3 -I live-conformance/influence_verify.py live-conformance/influence"
+  },
+  {
+   "step": "direction records · wai-rs and direction_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib direction::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test direction)\npython3 -I live-conformance/direction_verify.py live-conformance/direction"
+  },
+  {
+   "step": "co-performance · wai-rs and co_performance_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib co_performance::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test co_performance)\npython3 -I live-conformance/co_performance_verify.py live-conformance/coperformance"
+  },
+  {
+   "step": "age assurance · wai-rs and age_assurance_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib age_assurance::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test age_assurance)\npython3 -I live-conformance/age_assurance_verify.py live-conformance/age"
+  },
+  {
+   "step": "bearer receipts · wai-rs and bearer_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib bearer)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test bearer_receipts)\npython3 -I live-conformance/bearer_verify.py live-conformance/bearers\npython3 -I claim-conformance/claim_verify.py bearer live-conformance/bearers/vectors.json"
+  },
+  {
+   "step": "carousel schedule · wai-rs and carousel_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib -- carousel:: claim_receipt::schedule::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test carousel)\npython3 -I live-conformance/carousel_verify.py live-conformance/carousel\npython3 -I claim-conformance/claim_verify.py carousel live-conformance/carousel/vectors.json"
+  },
+  {
+   "step": "holdings · wai-rs and holdings_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib -- holdings::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test holdings)\npython3 -I live-conformance/holdings_verify.py live-conformance/holdings"
+  },
+  {
+   "step": "exploration · wai-rs and exploration_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib exploration::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test exploration)\npython3 -I live-conformance/exploration_verify.py live-conformance/exploration"
+  },
+  {
+   "step": "platform-encode · wai-rs and encode_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --locked --no-default-features --features \"$WAI_FEATURES\" --lib platform_encode::)\n(cd wai-rs && cargo test --locked --no-default-features --features \"$WAI_FEATURES\" --test platform_encode)\npython3 -I encode-conformance/encode_verify.py encode-conformance"
+  },
+  {
+   "step": "co-watch · wai-rs, co_watch_verify.py and the page's module",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib co_watch::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test co_watch)\npython3 -I live-conformance/co_watch_verify.py live-conformance/cowatch\nnode --test ../joule-code/joule-code-rs/crates/joule-moq-web/web/room/cowatch.test.mjs"
+  },
+  {
+   "step": "remote desktop · wai-rs, remote_desktop_verify.py and the page's module",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib -- remote_desktop:: hpke::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test remote_desktop)\npython3 -I live-conformance/remote_desktop_verify.py live-conformance/remote\nnode --test ../joule-code/joule-code-rs/crates/joule-moq-web/web/room/remote.test.mjs"
+  },
+  {
+   "step": "QoE aggregation · wai-rs and telemetry_aggregate_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib -- telemetry_aggregate:: telemetry::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test telemetry_aggregate)\npython3 -I live-conformance/telemetry_aggregate_verify.py live-conformance/aggregate"
+  },
+  {
+   "step": "exact tone mapping · wai-rs and tonemap_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib -- exact_tonemap:: png_still::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test exact_tonemap)\npython3 -I live-conformance/tonemap_verify.py live-conformance/tonemap"
+  },
+  {
+   "step": "exact splats · wai-rs and splat_exact_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib splat_exact::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test splat_exact)\npython3 -I live-conformance/splat_exact_verify.py live-conformance/splat"
+  },
+  {
+   "step": "stream termination · wai-rs, wai-live-web and stream_termination_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib stream_termination::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test stream_termination)\n(cd wai-rs && \"$RUNNER_TEMP/wai-bins/union/wai_stream_termination_vectors\" verify ../live-conformance/termination)\n(cd wai-live-web && cargo test --locked --features int_video --lib termination_tests)\npython3 -I live-conformance/stream_termination_verify.py live-conformance/termination"
+  },
+  {
+   "step": "live worlds · wai-rs and live_worlds_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib live_world::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test live_world)\npython3 -I live-conformance/live_worlds_verify.py live-conformance/worlds"
+  },
+  {
+   "step": "end-to-end encrypted rooms · e2ee_verify.py",
+   "wd": "wai",
+   "body": "python3 -I live-conformance/e2ee_verify.py live-conformance/e2ee"
+  },
+  {
+   "step": "live messaging · wai-rs and live_messaging_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test live_messaging)\npython3 -I live-conformance/live_messaging_verify.py live-conformance/messaging"
+  },
+  {
+   "step": "forensic watermark sessions · wai-rs and live_watermark_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib live_watermark::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test live_watermark)\npython3 -I live-conformance/live_watermark_verify.py live-conformance/watermark"
+  },
+  {
+   "step": "deriving edge · wai-rs and edge_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib derive_edge::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib png_still::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test derive_edge)\npython3 -I edge-conformance/edge_verify.py edge-conformance"
+  },
+  {
+   "step": "cue injection and Enhanced RTMP · injection_verify.py and ertmp_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\npython3 -I live-conformance/injection_verify.py --self-test live-conformance/injection\npython3 -I live-conformance/ertmp_verify.py --self-test live-conformance/ertmp"
+  },
+  {
+   "step": "quantum referee.py",
+   "wd": ".",
+   "body": "python3 -I wai/quantum-conformance/tools/referee.py wai/quantum-conformance"
+  },
+  {
+   "step": "hybrid signatures · wai-rs and pq_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_PQ_FEATURES\" --lib pq_sig::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_PQ_FEATURES\" --lib synthesis::pq_tests)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_PQ_FEATURES\" --test pq_signatures)\npython3 -I pq-conformance/pq_verify.py pq-conformance\npython3 -I pq-conformance/pq_verify.py verdicts pq-conformance/vectors.json > \"$RUNNER_TEMP/pq-py.tsv\"\n(cd wai-rs && \"$RUNNER_TEMP/wai-bins/pq/wai_pq_vectors\" verdicts ../pq-conformance/vectors.json) > \"$RUNNER_TEMP/pq-rs.tsv\"\ndiff \"$RUNNER_TEMP/pq-py.tsv\" \"$RUNNER_TEMP/pq-rs.tsv\""
+  },
+  {
+   "step": "claim_verify.py, differential.py, jwp_verify.py, chain_differential.py, chain_gap_differential.py, signer_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\npython3 claim-conformance/claim_verify.py claim-conformance/vectors.json\npython3 jwp-conformance/jwp_verify.py jwp-conformance/vectors.json\npython3 signer-conformance/signer_verify.py signer-conformance/vectors.json\npython3 signer-conformance/signer_verify.py verdicts signer-conformance/vectors.json > \"$RUNNER_TEMP/signer-py.tsv\"\n# Each differential against both builds the first step copied (see its comment).\nfor build in union pq; do\n  bins=\"$RUNNER_TEMP/wai-bins/$build\"\n  if [ \"$build\" = pq ]; then features=$WAI_PQ_FEATURES; else features=$WAI_FEATURES; fi\n  echo \"::group::the differentials against the $build build (features $features)\"\n  python3 claim-conformance/differential.py \"$bins/wai_claim_vectors\" --random 2000 --seed 1\n  for seed in 1 2; do\n    python3 jwp-conformance/chain_differential.py \"$bins/wai_jwp_vectors\" --n 3000 --seed \"$seed\"\n    python3 jwp-conformance/chain_gap_differential.py \"$bins/wai_jwp_vectors\" --n 400 --seed \"$seed\"\n  done\n  \"$bins/wai_signer_vectors\" verdicts signer-conformance/vectors.json > \"$RUNNER_TEMP/signer-rs-$build.tsv\"\n  diff \"$RUNNER_TEMP/signer-py.tsv\" \"$RUNNER_TEMP/signer-rs-$build.tsv\"\n  echo \"the $build build: every differential agrees\"\n  echo \"::endgroup::\"\ndone"
+  },
+  {
+   "step": "header probes · wai-rs, the fetched LCEVC streams and format_probe_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib format_probe::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test format_probe)\nfetched=$(mktemp -d)\nbash format-probe-conformance/fetch.sh \"$fetched\"\n(cd wai-rs && \"$RUNNER_TEMP/wai-bins/union/wai_format_probe\" verify ../format-probe-conformance --fetched \"$fetched\")\npython3 -I format-probe-conformance/format_probe_verify.py format-probe-conformance --fetched \"$fetched\""
+  },
+  {
+   "step": "media identification · wai-rs and identify_verify.py",
+   "wd": "wai",
+   "body": "set -euo pipefail\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --lib identify::)\n(cd wai-rs && cargo test --no-default-features --features \"$WAI_FEATURES\" --test identify)\n(cd wai-rs && \"$RUNNER_TEMP/wai-bins/union/wai_identify_vectors\" verify ../identify-conformance)\npython3 -I identify-conformance/identify_verify.py identify-conformance"
+  },
+  {
+   "step": "cmsd_read_verify.py",
+   "wd": "wai",
+   "body": "python3 -I telemetry-conformance/cmsd_read_verify.py telemetry-conformance"
+  },
+  {
+   "step": "loc_verify.py",
+   "wd": "wai",
+   "body": "python3 -I live-conformance/loc_verify.py live-conformance/loc"
+  }
+ ],
+ "int_kernels_debug_features": [
+  "audio_int",
+  "generate",
+  "i32_forms",
+  "legacy_int",
+  "neural_int",
+  "score",
+  "splat_int",
+  "stage_measure",
+  "staged",
+  "video_int",
+  "world_int"
+ ],
+ "int_kernels_debug_tests": [
+  "cli_generate_score",
+  "cli_stage",
+  "generate",
+  "int_audio",
+  "int_audio_ops",
+  "int_hyper_ops",
+  "int_kernels_geometry",
+  "int_kernels_vectors",
+  "int_mlicpp",
+  "int_mlicpp_ops",
+  "int_mlicpp_preflight",
+  "int_ops_conformance",
+  "int_ops_differential",
+  "int_payload",
+  "int_payload_cost",
+  "int_payload_preflight",
+  "int_set_cache",
+  "int_splat",
+  "int_splat_ops",
+  "int_synth_ops",
+  "int_video",
+  "int_video_enc_memory",
+  "int_video_halfpel",
+  "int_video_keyframe",
+  "int_video_ops",
+  "int_world",
+  "int_world2",
+  "int_world_memory",
+  "int_world_ops",
+  "jpegai_bitstream_calibration",
+  "jpegai_nets_ops",
+  "jpegai_ops",
+  "stage_measure",
+  "stage_measure_bounds",
+  "staged_resources",
+  "wir1_ops"
+ ],
+ "int_kernels_release_features": [
+  "audio_int",
+  "generate",
+  "i32_forms",
+  "legacy_int",
+  "neural_int",
+  "score",
+  "splat_int",
+  "stage_measure",
+  "staged",
+  "video_int",
+  "world_int"
+ ],
+ "int_kernels_release_tests": [
+  "cli_generate_score",
+  "cli_stage",
+  "generate",
+  "int_audio",
+  "int_audio_ops",
+  "int_hyper_ops",
+  "int_kernels_geometry",
+  "int_kernels_vectors",
+  "int_mlicpp",
+  "int_mlicpp_ops",
+  "int_mlicpp_preflight",
+  "int_ops_conformance",
+  "int_ops_differential",
+  "int_payload",
+  "int_payload_cost",
+  "int_payload_preflight",
+  "int_set_cache",
+  "int_splat",
+  "int_splat_ops",
+  "int_synth_ops",
+  "int_video",
+  "int_video_enc_memory",
+  "int_video_halfpel",
+  "int_video_keyframe",
+  "int_video_ops",
+  "int_world",
+  "int_world2",
+  "int_world_memory",
+  "int_world_ops",
+  "jpegai_bitstream_calibration",
+  "jpegai_nets_ops",
+  "jpegai_ops",
+  "manifest_parse_memory",
+  "manifest_reader_equivalence",
+  "stage_measure",
+  "stage_measure_bounds",
+  "staged_resources",
+  "wir1_ops"
+ ],
+ "int_kernels_amd_features": [
+  "audio_int",
+  "generate",
+  "i32_forms",
+  "legacy_int",
+  "neural_int",
+  "score",
+  "splat_int",
+  "stage_measure",
+  "staged",
+  "video_int",
+  "world_int"
+ ],
+ "int_kernels_amd_tests": [
+  "int_audio_ops",
+  "int_hyper_ops",
+  "int_kernels_geometry",
+  "int_kernels_vectors",
+  "int_mlicpp_ops",
+  "int_ops_conformance",
+  "int_splat_ops",
+  "int_synth_ops",
+  "int_video_ops",
+  "int_world_ops",
+  "jpegai_nets_ops",
+  "jpegai_ops",
+  "wir1_ops"
+ ],
+ "corpora_features": [
+  "audio_int",
+  "audio_scene",
+  "film",
+  "haptic",
+  "http",
+  "key_discovery",
+  "neural_int",
+  "oer",
+  "pq_signatures",
+  "provenance",
+  "quantum",
+  "quantum_ops",
+  "receipt_claims",
+  "score",
+  "splat4d",
+  "splat_int",
+  "stage_measure",
+  "staged",
+  "telemetry",
+  "video_int",
+  "video_manifest",
+  "world"
+ ],
+ "corpora": [
+  "worlds wai_world_vectors ../world-conformance",
+  "spatial-audio wai_audio_vectors ../audio-conformance",
+  "haptics wai_haptic_vectors ../haptic-conformance",
+  "state-feeds wai_feed_vectors ../feed-conformance",
+  "avatars wai_avatar_vectors ../avatar-conformance",
+  "volumetric wai_splat4d_vectors ../volumetric-conformance",
+  "score wai_score_vectors ../score-conformance",
+  "int-synth wai_int_synth_vectors ../neural-conformance",
+  "film wai_film_vectors ../film-conformance",
+  "quantum wai_quantum_vectors ../quantum-conformance",
+  "quantum-ops wai_quantum_ops_vectors ../quantum-ops-conformance",
+  "oer wai_oer_vectors ../oer-conformance",
+  "jwp wai_jwp_vectors ../jwp-conformance",
+  "claims wai_claim_vectors ../claim-conformance",
+  "pin wai_pin_vectors ../pin-conformance",
+  "signers wai_signer_vectors ../signer-conformance",
+  "int-payload wai_int_payload_vectors ../int-payload-conformance",
+  "staged wai_staged_vectors ../staged-conformance",
+  "http wai_http_vectors ../http-conformance",
+  "staged-measure wai_stage_measure ../staged-measure-conformance",
+  "telemetry wai_telemetry ../telemetry-conformance",
+  "pq-signatures wai_pq_vectors ../pq-conformance"
+ ]
+}

.github/wai-conformance/corpora/avatars.txt

@@ -0,0 +1,4 @@
+# corpus: avatars
+# order: 50
+# bin: wai_avatar_vectors
+# dir: ../avatar-conformance

.github/wai-conformance/corpora/claims.txt

@@ -0,0 +1,4 @@
+# corpus: claims
+# order: 140
+# bin: wai_claim_vectors
+# dir: ../claim-conformance

.github/wai-conformance/corpora/film.txt

@@ -0,0 +1,4 @@
+# corpus: film
+# order: 90
+# bin: wai_film_vectors
+# dir: ../film-conformance

.github/wai-conformance/corpora/haptics.txt

@@ -0,0 +1,4 @@
+# corpus: haptics
+# order: 30
+# bin: wai_haptic_vectors
+# dir: ../haptic-conformance

.github/wai-conformance/corpora/http.txt

@@ -0,0 +1,4 @@
+# corpus: http
+# order: 190
+# bin: wai_http_vectors
+# dir: ../http-conformance

.github/wai-conformance/corpora/int-payload.txt

@@ -0,0 +1,4 @@
+# corpus: int-payload
+# order: 170
+# bin: wai_int_payload_vectors
+# dir: ../int-payload-conformance

.github/wai-conformance/corpora/int-synth.txt

@@ -0,0 +1,4 @@
+# corpus: int-synth
+# order: 80
+# bin: wai_int_synth_vectors
+# dir: ../neural-conformance

.github/wai-conformance/corpora/jwp.txt

@@ -0,0 +1,4 @@
+# corpus: jwp
+# order: 130
+# bin: wai_jwp_vectors
+# dir: ../jwp-conformance

.github/wai-conformance/corpora/oer.txt

@@ -0,0 +1,4 @@
+# corpus: oer
+# order: 120
+# bin: wai_oer_vectors
+# dir: ../oer-conformance

.github/wai-conformance/corpora/pin.txt

@@ -0,0 +1,4 @@
+# corpus: pin
+# order: 150
+# bin: wai_pin_vectors
+# dir: ../pin-conformance

.github/wai-conformance/corpora/pq-signatures.txt

@@ -0,0 +1,4 @@
+# corpus: pq-signatures
+# order: 220
+# bin: wai_pq_vectors
+# dir: ../pq-conformance

.github/wai-conformance/corpora/quantum-ops.txt

@@ -0,0 +1,4 @@
+# corpus: quantum-ops
+# order: 110
+# bin: wai_quantum_ops_vectors
+# dir: ../quantum-ops-conformance

.github/wai-conformance/corpora/quantum.txt

@@ -0,0 +1,4 @@
+# corpus: quantum
+# order: 100
+# bin: wai_quantum_vectors
+# dir: ../quantum-conformance

.github/wai-conformance/corpora/score.txt

@@ -0,0 +1,4 @@
+# corpus: score
+# order: 70
+# bin: wai_score_vectors
+# dir: ../score-conformance

.github/wai-conformance/corpora/signers.txt

@@ -0,0 +1,4 @@
+# corpus: signers
+# order: 160
+# bin: wai_signer_vectors
+# dir: ../signer-conformance

.github/wai-conformance/corpora/spatial-audio.txt

@@ -0,0 +1,4 @@
+# corpus: spatial-audio
+# order: 20
+# bin: wai_audio_vectors
+# dir: ../audio-conformance

.github/wai-conformance/corpora/staged-measure.txt

@@ -0,0 +1,4 @@
+# corpus: staged-measure
+# order: 200
+# bin: wai_stage_measure
+# dir: ../staged-measure-conformance

.github/wai-conformance/corpora/staged.txt

@@ -0,0 +1,4 @@
+# corpus: staged
+# order: 180
+# bin: wai_staged_vectors
+# dir: ../staged-conformance

.github/wai-conformance/corpora/state-feeds.txt

@@ -0,0 +1,4 @@
+# corpus: state-feeds
+# order: 40
+# bin: wai_feed_vectors
+# dir: ../feed-conformance

.github/wai-conformance/corpora/telemetry.txt

@@ -0,0 +1,4 @@
+# corpus: telemetry
+# order: 210
+# bin: wai_telemetry
+# dir: ../telemetry-conformance

.github/wai-conformance/corpora/volumetric.txt

@@ -0,0 +1,4 @@
+# corpus: volumetric
+# order: 60
+# bin: wai_splat4d_vectors
+# dir: ../volumetric-conformance

.github/wai-conformance/corpora/worlds.txt

@@ -0,0 +1,4 @@
+# corpus: worlds
+# order: 10
+# bin: wai_world_vectors
+# dir: ../world-conformance

.github/wai-conformance/verifiers/access-services.sh

@@ -0,0 +1,25 @@
+# step: access services · wai-rs and access_services_verify.py
+# order: 160
+# features: access_services
+# paths: wai/extensions/access-services.md
+#
+# wai.access.services (extensions/access-services.md): the reference module's unit tests
+# (words, full and prefix alignment with their walk back, signed integers, gains) and
+# tests/access_services.rs (vectors.json and each DAPT document regenerate byte for byte
+# from their fixed seeds and no other file is there, wai-rs gives every vector and
+# document its stated outcome and figures, every reason of §10 refuses a case, and §10
+# lists exactly the reference's codes); then the corpus's second implementation,
+# access_services_verify.py, written from the extension's text and sharing no code with
+# wai-rs, which verifies events and captions with timed_text_verify.py and every record
+# with WAI's strict Ed25519 rule, computes every figure and writes every DAPT document
+# itself, parses each with xml.etree, reads the extension's reason table, and requires
+# every mutated copy of the corpus to fail; standard library only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/access-services.md: tests/access_services.rs requires this extension's §10 to
+#   list the codes the reference reports, access_services_verify.py reads that table, and the
+#   registry's wire identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib access_services::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test access_services)
+python3 -I live-conformance/access_services_verify.py live-conformance/access

.github/wai-conformance/verifiers/ad-presentation.sh

@@ -0,0 +1,28 @@
+# step: ad presentation · wai-rs, ad_presentation_verify.py and the reference producer
+# order: 250
+# features: live_ads
+# paths: wai/extensions/ad-presentation.md
+#
+# wai.live.ad_presentation (extensions/ad-presentation.md): the reference module's unit
+# tests (claims round-trip and their rules refuse, the quartile, the qualifying run, the
+# touched objects, a policy's presentation fields, RFC 9577's TokenChallenge) and
+# tests/ad_presentation.rs (every file of the committed corpus regenerates byte for byte
+# from its fixed seeds and no other file is there, RFC 9578's own token verifies under its
+# key, wai-rs gives every room its outcome and every claim its verdict, and §11 lists
+# exactly the reference's codes); then the corpus's second implementation,
+# ad_presentation_verify.py, written from the extension's text and sharing no code with
+# wai-rs, which verifies each room with live_ads_verify.py, judges every claim and its
+# RSASSA-PSS itself, requires every mutated copy of the corpus to fail and catches each of
+# its own checks dropped; standard library only, run isolated (-I). Last, the browser
+# client's reference producer (joule-moq-web/web/ads), which records observation
+# sequences into spans and writes and signs the corpus's claims from them, byte for byte.
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/ad-presentation.md: tests/ad_presentation.rs requires this extension's §11 to
+#   list the codes the reference reports, ad_presentation_verify.py reads that table, and the
+#   registry's wire identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib live_ads::presentation::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test ad_presentation)
+python3 -I live-conformance/ad_presentation_verify.py live-conformance/presentation
+node --test ../joule-code/joule-code-rs/crates/joule-moq-web/web/ads/presentation.test.mjs

.github/wai-conformance/verifiers/age-assurance.sh

@@ -0,0 +1,27 @@
+# step: age assurance · wai-rs and age_assurance_verify.py
+# order: 520
+# features: age_assurance
+# paths: wai/extensions/age-assurance.md
+#
+# wai.age.assurance (extensions/age-assurance.md): the reference module's unit tests (the
+# pinned AlgorithmIdentifier and RFC 9578's first vector through this module, the
+# TokenChallenge read exactly, the suppression floor, the grant attribute `age`, a span's
+# coverage) and tests/age_assurance.rs (vectors.json regenerates byte for byte from its
+# fixed seeds and no other file is there, wai-rs gives every case its stated outcome, and
+# §11 lists exactly the reference's codes, each of which the corpus gives); then the
+# corpus's second implementation, age_assurance_verify.py, written from the extension's
+# text and sharing no code with wai-rs, which reads every record, writes JCS and verifies
+# every token's RSASSA-PSS itself, reads rooms with live_rooms_verify.py, checks signatures
+# with WAI's strict Ed25519 rule and BLAKE3 from claim-conformance, reads the extension's
+# reason table, requires every mutated copy of the corpus to fail, and drops each of its
+# own checks in turn and requires the corpus to catch the weakened verifier; standard
+# library only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/age-assurance.md: tests/age_assurance.rs requires this extension's §11 to list
+#   the codes the reference reports, age_assurance_verify.py reads that table, and the registry's
+#   wire identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib age_assurance::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test age_assurance)
+python3 -I live-conformance/age_assurance_verify.py live-conformance/age

.github/wai-conformance/verifiers/ai-usage.sh

@@ -0,0 +1,32 @@
+# step: AI usage · wai-rs and ai_usage_verify.py
+# order: 360
+# features: ai_usage
+# paths: wai/extensions/ai-usage.md
+#
+# wai.ai.usage (extensions/ai-usage.md): the reference module's unit tests (RFC 9651's
+# Dictionary parser against the vocabulary's examples and the RFC's edges, statements
+# read and refused in their steps' order, the precedence rule, HTTP fields compared by
+# meaning), the consumption class's body and terms in claim_receipt, and
+# tests/ai_usage.rs (vectors.json regenerates byte for byte from its fixed seeds and no
+# other file is there, wai-rs gives every statement, object, room, response, catalog,
+# claim and gate its stated outcome, §9 lists exactly the reference's codes, each of which
+# the corpus gives, and jwp-receipts §3.1 lists the class rules); then the corpus's second
+# implementation, ai_usage_verify.py, written from the extension's text and sharing no
+# code with wai-rs, which parses Structured Fields, canonical forms, receipts and claims
+# itself, reads rooms with live_rooms_verify.py, checks signatures with WAI's strict
+# Ed25519 rule and BLAKE3 from claim-conformance, reads the extension's reason table,
+# requires every mutated copy of the corpus to fail, and drops each of its own checks in
+# turn and requires the corpus to catch the weakened verifier; standard library only, run
+# isolated (-I). Last, claim-conformance's own verifier reads every consumption claim of
+# the corpus through jwp-receipts §3.1 steps 1 to 4 and requires the stated step and reason.
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/ai-usage.md: tests/ai_usage.rs requires this extension's §9 to list the codes the
+#   reference reports, ai_usage_verify.py reads that table, and the registry's wire identifiers
+#   test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib ai_usage::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib claim_receipt::consumption::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test ai_usage)
+python3 -I live-conformance/ai_usage_verify.py live-conformance/usage
+python3 -I claim-conformance/claim_verify.py consumption live-conformance/usage/vectors.json

.github/wai-conformance/verifiers/avatar-face.sh

@@ -0,0 +1,28 @@
+# step: faces from keypoints · wai-rs and avatar_face_verify.py
+# order: 350
+# features: avatar_face
+# release-features: avatar_face
+# paths: wai/extensions/avatars.md
+#
+# wai.avatar.face (extensions/avatars.md §6 to §13): the module's unit tests (the
+# generator's wai-ops/1 graph against §7.6's arithmetic written out loop by loop; the warp
+# at rest is the reference; the mask's table; the files read and refused in their order),
+# and tests/avatar_face.rs (the committed corpus regenerates byte for byte from its fixed
+# seeds and its pinned inputs, and no other file is there; wai-rs gives every form, frame
+# and case what it states; §10 lists exactly the reference's codes; §7.9's figures are
+# training.json's; the registered generator meets acc64 and not acc32); then the corpus's
+# second implementation, avatar_face_verify.py, written from the extension's text and
+# sharing no code with wai-rs, which runs the driver and the generator's arithmetic in
+# Python's integers, verifies the claims, the log and the label policy with
+# synthesis_verify.py, and requires every mutated copy of the corpus to fail; standard
+# library only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/avatars.md: tests/avatar_face.rs requires this extension's §10 to list the codes
+#   the reference reports and its §7.9 to state the training report's figures,
+#   avatar_face_verify.py reads §10, and the registry's tests read SPEC §5's registration of
+#   wai.avatar.face.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib avatar_face::)
+(cd wai-rs && cargo test --release --no-default-features --features "$WAI_RELEASE_FEATURES" --test avatar_face)
+python3 -I live-conformance/avatar_face_verify.py live-conformance/avatar-face

.github/wai-conformance/verifiers/bearer-receipts.sh

@@ -0,0 +1,31 @@
+# step: bearer receipts · wai-rs and bearer_verify.py
+# order: 530
+# features: bearer_receipts
+# paths: wai/extensions/bearer-receipts.md
+#
+# wai.bearer.receipts (extensions/bearer-receipts.md): the reference module's unit tests
+# (the bound, the bitmap rules, the bearer classes, and the corpus reaching every stated
+# outcome and failing a changed one) and tests/bearer_receipts.rs (vectors.json
+# regenerates byte for byte from its fixed seeds and no other file is there, wai-rs gives
+# every case its stated outcome, the cases that carry one receipt on every bearer class
+# carry the same bytes with the same object verdicts, §10 lists exactly the reference's
+# codes, each of which the corpus gives, and jwp-receipts §3.1 lists the class codes at
+# their steps); then the corpus's second implementation, bearer_verify.py, written from
+# the extension's text and sharing no code with wai-rs, which verifies groups and objects
+# with jwp_verify.py, claims through jwp-receipts §3.1 steps 1-5 with claim_verify.py and
+# confirmations with signer_verify.py (each needs the `cryptography` package installed
+# above), writes the context checks, the verdict, the bound and offline confirmation
+# itself, reads the extension's reason table, requires every mutated copy of the corpus
+# to fail, and drops each of its own checks in turn and requires the corpus to catch the
+# weakened verifier; run isolated (-I). Last, claim-conformance's own verifier reads every
+# transmission and reconciliation claim of the corpus through jwp-receipts §3.1 steps 1
+# to 4 and requires the stated step and reason.
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/bearer-receipts.md: tests/bearer_receipts.rs requires this extension's §10 to
+#   list the codes the reference reports, and bearer_verify.py reads that table.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib bearer)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test bearer_receipts)
+python3 -I live-conformance/bearer_verify.py live-conformance/bearers
+python3 -I claim-conformance/claim_verify.py bearer live-conformance/bearers/vectors.json

.github/wai-conformance/verifiers/browser-sink.sh

@@ -0,0 +1,34 @@
+# step: browser sink · wai-rs, wai-live-web and browser_sink_verify.py
+# order: 470
+# features: browser_sink browser_sink,receipt_claims
+# paths: wai/extensions/browser-sink.md
+#
+# The browser sink (extensions/browser-sink.md): the reference module's unit tests (the
+# registry gate's rows, registered tiers, integers as §5 reads them, a binding's
+# canonical form, an answer for an unregistered codec string never read, powerEfficient
+# never stated off the user agent's route, the side table's ambiguity) and
+# tests/browser_sink.rs (both files of the committed corpus regenerate byte for byte and
+# no other file is there, wai-rs gives every case its stated outcome, every reason of
+# §11 appears in the corpus and §11 lists exactly the reference's codes, and the chain
+# the generator signs by hand verifies under jwp_delivery); wai-live-web's browser
+# functions held to the same corpus natively, and its wasm-route decoder verifying,
+# decoding and binding every chain object to the published frame digests; then the
+# corpus's second implementation, browser_sink_verify.py, written from the extension's
+# text and sharing no code with wai-rs, which reads the registry export for each
+# capability's class, recomputes every route, evaluation, energy entry, binding, chain
+# signature, frame state and side table, changes the answers for unregistered codec
+# strings every way and requires the corpus still to pass, and requires every mutated
+# copy of the corpus to fail; standard library only, run isolated (-I). The browser's
+# own run of it is joule-moq-web.yml's scenario binding.
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/browser-sink.md: tests/browser_sink.rs requires this extension's §11 to list the
+#   codes the reference reports, browser_sink_verify.py reads its §2, §4.1, §4.2 and §11 tables
+#   and capability-constraints' §3.1 register, and the registry's wire identifiers test reads its
+#   sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib browser_sink::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test browser_sink)
+(cd wai-rs && "$RUNNER_TEMP/wai-bins/union/wai_browser_sink_vectors" verify ../live-conformance/browser)
+(cd wai-live-web && cargo test --locked --features int_video --lib browser_tests)
+python3 -I live-conformance/browser_sink_verify.py live-conformance/browser

.github/wai-conformance/verifiers/capture-take.sh

@@ -0,0 +1,23 @@
+# step: capture take · wai-rs and capture_take_verify.py
+# order: 120
+# features: capture_take
+# paths: wai/extensions/capture-binding.md
+#
+# wai.capture.take (extensions/capture-binding.md): the reference module's unit tests,
+# the output tree's (whose RFC 6962 hash and RFC 9162 consistency proofs the take tree
+# reuses), and tests/capture_take.rs (the committed corpus regenerates byte for byte
+# from its fixed seeds, wai-rs gives every vector its stated outcome, every reason of
+# §12 appears in it, and §12 lists exactly the reference's codes); then the corpus's
+# second implementation, capture_take_verify.py, written from the extension's text and
+# sharing no code with wai-rs, which verifies each room with live_rooms_verify.py and
+# every signature with WAI's strict Ed25519 (claim-conformance/_ed25519.py), and
+# requires every mutated copy of the corpus to fail; standard library only, run
+# isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/capture-binding.md: tests/capture_take.rs requires this extension's §12 to list
+#   the codes the reference reports, and the registry's wire identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib -- capture_take:: output_tree::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test capture_take)
+python3 -I live-conformance/capture_take_verify.py live-conformance/takes

.github/wai-conformance/verifiers/carousel.sh

@@ -0,0 +1,29 @@
+# step: carousel schedule · wai-rs and carousel_verify.py
+# order: 540
+# features: carousel
+# paths: wai/extensions/carousel.md
+#
+# wai.bearer.carousel (extensions/carousel.md): the reference module's unit tests (each code's
+# bounds and division into source blocks, K', the passes of advance and repeat, plans, and the
+# corpus reaching every stated outcome and failing a changed one) and tests/carousel.rs
+# (vectors.json regenerates byte for byte from its fixed seeds, wai-rs gives every case its
+# stated outcome, §9 lists exactly the reference's codes, Appendix A is its table of K',
+# jwp-receipts §3.1 lists the class codes at their steps, K' and Partition[] agree with an
+# independent RFC 6330 implementation for every block size, and each RaptorQ object a case
+# holds available decodes with that implementation from what a receiver within the case's
+# loss bound holds); then the corpus's second implementation, carousel_verify.py, written
+# from the extension's text and sharing no code with wai-rs, which verifies groups and
+# objects with jwp_verify.py and claims through steps 1-5 with claim_verify.py, writes the
+# context checks, the availability and the plans itself, reads §9 and Appendix A, requires
+# every mutated copy of the corpus to fail, and drops each of its own checks in turn; run
+# isolated (-I). Last, claim-conformance's own verifier reads every claim of the corpus
+# through jwp-receipts §3.1 steps 1 to 4 and requires the stated outcome.
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/carousel.md: tests/carousel.rs requires §9 to list the reference's codes and
+#   Appendix A to be its table of K', and carousel_verify.py reads both.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib -- carousel:: claim_receipt::schedule::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test carousel)
+python3 -I live-conformance/carousel_verify.py live-conformance/carousel
+python3 -I claim-conformance/claim_verify.py carousel live-conformance/carousel/vectors.json

.github/wai-conformance/verifiers/catalogue-prior.sh

@@ -0,0 +1,11 @@
+# step: catalogue prior · the record and the text quoting it
+# order: 30
+#
+# The catalogue-prior record (research/catalogue-prior.md): each reading checked against
+# the SHA-256 its run.json states; every BD-rate the run stored recomputed from the
+# rate and quality points, and the rate proxy, the recurrence and the decision rule's
+# verdicts from the readings, by a second implementation that shares no code with the
+# scripts that took them (tools/wai_catalogue_prior_verify.py, standard library only,
+# run isolated); and every figure the page quotes checked (each is followed by a `cat`
+# marker naming its value).
+python3 -I tools/wai_catalogue_prior_verify.py research/catalogue-prior research/catalogue-prior.md

.github/wai-conformance/verifiers/channel-lineup.sh

@@ -0,0 +1,26 @@
+# step: channel lineup · wai-rs and channel_lineup_verify.py
+# order: 270
+# features: channel_lineup
+# paths: wai/extensions/channel-lineup.md
+#
+# wai.video.lineup (extensions/channel-lineup.md): the reference module's unit tests (times,
+# the document type declaration, the reasons) and tests/channel_lineup.rs (every file of the
+# committed corpus regenerates byte for byte from its fixed seeds, and no other file is
+# there; wai-rs gives every import and every verification its outcome; §10 lists exactly
+# the reference's codes; §9's commands, run as the text writes them through `wai`, yield
+# the corpus's receipt, lineup, cues and guides, and a refusal is its reason with exit 1);
+# then the corpus's second implementation, channel_lineup_verify.py, written from the
+# extension's text and sharing no code with wai-rs, which reimports every vector, requires
+# every outcome and fact, and requires every mutated copy of the corpus to fail and every
+# check it drops to be caught.
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/channel-lineup.md: tests/channel_lineup.rs requires this extension's §10 to list
+#   the codes the reference adds and runs its §9's commands as the text writes them,
+#   channel_lineup_verify.py reads its §10, and the registry's wire identifiers test reads its
+#   sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib channel_lineup::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test channel_lineup)
+(cd wai-rs && "$RUNNER_TEMP/wai-bins/union/wai_channel_lineup_vectors" verify ../live-conformance/channels)
+python3 -I live-conformance/channel_lineup_verify.py live-conformance/channels

.github/wai-conformance/verifiers/claims-jwp-signers.sh

@@ -0,0 +1,32 @@
+# step: claim_verify.py, differential.py, jwp_verify.py, chain_differential.py, chain_gap_differential.py, signer_verify.py
+# order: 720
+# features: key_discovery
+# bins: wai_claim_vectors wai_jwp_vectors wai_signer_vectors
+# pq-bins: wai_claim_vectors wai_jwp_vectors wai_signer_vectors
+#
+# chain_differential.py signs receipt chains around jwp-receipts §3 step 3 and §6.1
+# (two keys, two tracks, both payloads, replays, forks, gaps, the guard and the
+# freshness bound), and chain_gap_differential.py genuine chains up to 90 groups
+# delivered shuffled, withheld and walked back with rewritten links and forks; both
+# require wai_jwp_vectors and jwp_verify.py to give every chain the same verdict. Two
+# fixed seeds each, so a run is reproducible.
+set -euo pipefail
+python3 claim-conformance/claim_verify.py claim-conformance/vectors.json
+python3 jwp-conformance/jwp_verify.py jwp-conformance/vectors.json
+python3 signer-conformance/signer_verify.py signer-conformance/vectors.json
+python3 signer-conformance/signer_verify.py verdicts signer-conformance/vectors.json > "$RUNNER_TEMP/signer-py.tsv"
+# Each differential against both builds the first step copied (see its comment).
+for build in union pq; do
+  bins="$RUNNER_TEMP/wai-bins/$build"
+  if [ "$build" = pq ]; then features=$WAI_PQ_FEATURES; else features=$WAI_FEATURES; fi
+  echo "::group::the differentials against the $build build (features $features)"
+  python3 claim-conformance/differential.py "$bins/wai_claim_vectors" --random 2000 --seed 1
+  for seed in 1 2; do
+    python3 jwp-conformance/chain_differential.py "$bins/wai_jwp_vectors" --n 3000 --seed "$seed"
+    python3 jwp-conformance/chain_gap_differential.py "$bins/wai_jwp_vectors" --n 400 --seed "$seed"
+  done
+  "$bins/wai_signer_vectors" verdicts signer-conformance/vectors.json > "$RUNNER_TEMP/signer-rs-$build.tsv"
+  diff "$RUNNER_TEMP/signer-py.tsv" "$RUNNER_TEMP/signer-rs-$build.tsv"
+  echo "the $build build: every differential agrees"
+  echo "::endgroup::"
+done

.github/wai-conformance/verifiers/cmsd-read.sh

@@ -0,0 +1,8 @@
+# step: cmsd_read_verify.py
+# order: 750
+#
+# CMSD reading (extensions/delivery-telemetry.md §6.6): the second implementation, written
+# from that text and RFC 9651 with its own field parser, reads every field of
+# telemetry-conformance/cmsd-read/ and every field expected/cmsd.json states, and requires
+# every mutated copy to fail. wai-rs's reading is checked by wai_telemetry verify above.
+python3 -I telemetry-conformance/cmsd_read_verify.py telemetry-conformance

.github/wai-conformance/verifiers/co-performance.sh

@@ -0,0 +1,27 @@
+# step: co-performance · wai-rs and co_performance_verify.py
+# order: 510
+# features: co_performance
+# paths: wai/extensions/co-performance.md
+#
+# wai.live.coperformance (extensions/co-performance.md): the reference module's unit tests
+# (the policy and every statement round-trip and their rules refuse, the attributes'
+# decimal integers, a schedule's turns in bars and microseconds, the symbolic bodies read
+# whole) and tests/co_performance.rs (vectors.json regenerates byte for byte from its fixed
+# seeds and no other file is there, wai-rs gives every room its stated outcome, and §10
+# lists exactly the reference's codes, each of which the corpus gives); then the corpus's
+# second implementation, co_performance_verify.py, written from the extension's text and
+# sharing no code with wai-rs, which verifies each room with live_rooms_verify.py and every
+# signature with WAI's strict Ed25519 rule from claim-conformance, recomputes every intent,
+# fidelity statement, turn, floor, commitment, selection and credit, reads the extension's
+# reason table, requires every mutated copy of the corpus to fail, and drops each of its
+# own checks in turn and requires the corpus to catch the weakened verifier; standard
+# library only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/co-performance.md: tests/co_performance.rs requires this extension's §10 to list
+#   the codes the reference reports, co_performance_verify.py reads that table, and the registry's
+#   wire identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib co_performance::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test co_performance)
+python3 -I live-conformance/co_performance_verify.py live-conformance/coperformance

.github/wai-conformance/verifiers/co-watch.sh

@@ -0,0 +1,30 @@
+# step: co-watch · wai-rs, co_watch_verify.py and the page's module
+# order: 580
+# features: co_watch
+# paths: wai/extensions/co-watch.md
+#
+# wai.live.cowatch (extensions/co-watch.md): the reference module's unit tests (the policy
+# and its rules, statements read back and refused, the controlled position in the order of
+# §5.4, each branch of the catch-up rule, percentiles by nearest rank, the control attribute)
+# and tests/co_watch.rs (vectors.json regenerates byte for byte from its fixed seeds and no
+# other file is there, wai-rs gives every room and catch-up case its stated outcome, and §12
+# lists exactly the reference's codes, each of which the corpus gives); then the corpus's
+# second implementation, co_watch_verify.py, written from the extension's text and sharing
+# no code with wai-rs, which verifies each room with live_rooms_verify.py and every
+# signature with WAI's strict Ed25519 rule, recomputes the controlled position, every
+# sample, percentile and verdict, requires every mutated copy of the corpus to fail and
+# drops each of its own checks in turn and requires the corpus to catch the weakened
+# verifier; standard library only, run isolated (-I). Last, the browser client's co-watch
+# module (joule-moq-web/web/room/cowatch.js), which gives every catch-up case its
+# correction, recomputes each accepted room's controlled position, and writes the corpus's
+# controls and presentation statements byte for byte.
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/co-watch.md: tests/co_watch.rs requires this extension's §12 to list the codes
+#   the reference reports, co_watch_verify.py reads that table, and the registry's wire
+#   identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib co_watch::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test co_watch)
+python3 -I live-conformance/co_watch_verify.py live-conformance/cowatch
+node --test ../joule-code/joule-code-rs/crates/joule-moq-web/web/room/cowatch.test.mjs

.github/wai-conformance/verifiers/conformance-results.sh

@@ -0,0 +1,29 @@
+# step: conformance results · wai-rs and conform_result_verify.py
+# order: 170
+# features: conform_result
+# paths: wai/extensions/conformance-results.md
+#
+# conform-result/1 (extensions/conformance-results.md): the reference module's unit tests
+# (a signed record accepted and every member covered, the strict rule's small-order forgery
+# refused, the date form, a vector for every reason) and tests/conform_result.rs (the
+# committed corpus regenerates byte for byte, wai-rs gives every vector its stated outcome,
+# every reason of §5 refuses a vector, §5 lists exactly the reference's codes, and no leaf
+# of a record survives a change after signing); then wai_conform_result_vectors verify, and
+# the corpus's second implementation, conform_result_verify.py, written from the
+# extension's text and sharing no code with wai-rs (WAI's strict Ed25519 rule from
+# claim-conformance/_ed25519.py), which reads the extension's reason table; and with each
+# check of §4 left out in turn (--skip), the corpus must fail it. Standard library only,
+# run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/conformance-results.md: tests/conform_result.rs requires this extension's §5 to
+#   list the codes the reference reports, conform_result_verify.py reads that table, and the
+#   registry's wire identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib conform_result::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test conform_result)
+"$RUNNER_TEMP/wai-bins/union/wai_conform_result_vectors" verify conform-result-conformance
+python3 -I conform-result-conformance/conform_result_verify.py conform-result-conformance
+for c in duplicates format members signature summary verdict; do
+  python3 -I conform-result-conformance/conform_result_verify.py --skip "$c" conform-result-conformance | tail -1
+done

.github/wai-conformance/verifiers/contribution.sh

@@ -0,0 +1,28 @@
+# step: contribution records · wai-rs and contribution_verify.py
+# order: 370
+# features: contribution
+# paths: wai/extensions/contribution.md
+#
+# wai.media.contribution (extensions/contribution.md): the reference module's unit tests
+# (every proof of the steps' tree walks to its root, the copying operations follow their
+# sample mappings, a map has one encoding) and tests/contribution.rs (the committed corpus
+# regenerates byte for byte from its fixed seeds and no other file is there, wai-rs gives
+# every case its stated outcome and statements, §11 lists exactly the reference's codes,
+# each of which the corpus gives, and the corpus generates with the model file of
+# wai.generate.spectral's conformance vector); then the corpus's second implementation,
+# contribution_verify.py, written from the extension's text and sharing no code with
+# wai-rs, which evaluates every pinned operation, runs the generator in its own arithmetic
+# after checking it against the generator's conformance vector, computes every map, share
+# and C2PA statement itself, reads origin claims with synthesis_verify.py and every record
+# with WAI's strict Ed25519 rule and BLAKE3 from claim-conformance, requires every mutated
+# copy of the corpus to fail, and drops each of its own checks in turn and requires the
+# corpus to catch the weakened verifier; standard library only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/contribution.md: tests/contribution.rs requires this extension's §11 to list the
+#   codes the reference reports, contribution_verify.py reads that table, and the registry's wire
+#   identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib contribution::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test contribution)
+python3 -I live-conformance/contribution_verify.py live-conformance/contribution

.github/wai-conformance/verifiers/cue-injection-ertmp.sh

@@ -0,0 +1,18 @@
+# step: cue injection and Enhanced RTMP · injection_verify.py and ertmp_verify.py
+# order: 690
+#
+# wai.live.injection (extensions/cue-injection.md) and Enhanced RTMP ingest
+# (extensions/live-ingest.md §12): both corpora are generated through joule-moq-ingest,
+# whose tests/conformance_corpus.rs regenerates them byte for byte
+# (joule-code-conformance.yml). Here their second implementations, written from the
+# texts and sharing no code with the reference: injection_verify.py translates every
+# SCTE 104 message to its SCTE 35 sections and cues (the standard's sample among them,
+# byte for byte), requires every refusal's result code and reason, runs the injector's
+# rules over every scenario, verifies every chain with WAI's strict Ed25519 and derives
+# its breaks, and refuses every negative chain at its event; ertmp_verify.py reads every
+# RTMP message of every session and requires every object of every room track and what
+# was not carried. Each then requires every mutated copy of its corpus to fail
+# (--self-test). Standard library only, run isolated (-I).
+set -euo pipefail
+python3 -I live-conformance/injection_verify.py --self-test live-conformance/injection
+python3 -I live-conformance/ertmp_verify.py --self-test live-conformance/ertmp

.github/wai-conformance/verifiers/delivery-sim.sh

@@ -0,0 +1,7 @@
+# step: sim_verify.py
+# order: 80
+#
+# The delivery simulator's second implementation: Appendix B from the text, every case
+# of staged-measure-conformance/sim/ reproduced and its claim checked, with a
+# counter-case required for each part of the stall bound a schedule can lose.
+python3 staged-measure-conformance/sim_verify.py staged-measure-conformance

.github/wai-conformance/verifiers/deriving-edge.sh

@@ -0,0 +1,30 @@
+# step: deriving edge · wai-rs and edge_verify.py
+# order: 680
+# features: derive_edge
+# paths: wai/extensions/deriving-edge.md
+#
+# wai.edge.derivation (extensions/deriving-edge.md): the reference module's unit tests
+# (the operations pixel by pixel, which operations the registry's composition rule makes
+# exact, the check each derivation takes, a record's reading rule by rule, its round trip
+# and signature, the pinned output manifest, provenance items and AI-origin labels, the
+# C2PA stores embedded in a still), the still writer and reader the module
+# shares with wai-pack (png_still), and tests/derive_edge.rs (vectors.json regenerates
+# byte for byte from its fixed seeds and no other file is there, wai-rs gives every vector
+# its stated outcome, §9 lists exactly the reference's codes and §4 its derivations, and
+# the reference edge wai_edge, run twice over a clip, makes a chain of two hops that
+# verifies and is refused once a byte changes); then the corpus's second implementation,
+# edge_verify.py, written from the extension's text and sharing no code with wai-rs,
+# which reads receipts and writes stills itself, re-executes every replicate hop,
+# requires every mutated copy of the corpus to fail, and drops each of its own checks in
+# turn and requires the corpus to catch the weakened verifier; standard library only,
+# run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/deriving-edge.md: tests/derive_edge.rs requires this extension's §9 to list the
+#   codes the reference reports and its §4 the derivations, edge_verify.py reads both tables, and
+#   the registry's wire identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib derive_edge::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib png_still::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test derive_edge)
+python3 -I edge-conformance/edge_verify.py edge-conformance

.github/wai-conformance/verifiers/determinism-cost.sh

@@ -0,0 +1,15 @@
+# step: determinism cost · the record, the text quoting it, and wai_det_cost
+# order: 20
+# features: neural_int
+#
+# The determinism-cost record (research/determinism-cost.md): its summary recomputed
+# from its readings by a second implementation that shares no code with the tool that
+# wrote it (tools/wai_determinism_cost_verify.py, standard library only, run isolated),
+# and every figure the research page and determinism-tiers §7 quote from it checked
+# against it (each is followed by a `det` marker naming its place in the record). Then
+# wai_det_cost, the decoder the record ran, held to the committed int_hyper vector and
+# every WIH1 refusal fixture of int-payload-conformance/.
+set -euo pipefail
+python3 -I tools/wai_determinism_cost_verify.py research/determinism-cost/record.json \
+  research/determinism-cost.md extensions/determinism-tiers.md
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test det_cost_bin)

.github/wai-conformance/verifiers/direction.sh

@@ -0,0 +1,29 @@
+# step: direction records · wai-rs and direction_verify.py
+# order: 500
+# features: direction
+# paths: wai/extensions/direction.md
+#
+# wai.media.direction (extensions/direction.md): the reference module's unit tests (the
+# interpolations reach both keys and stay between them, the framing measure at its bounds,
+# a signed integer's one spelling, the timeline's starts and overlaps, a frame set's one
+# encoding) and tests/direction.rs (the committed corpus regenerates byte for byte from its
+# fixed seeds and no other file is there, wai-rs gives every case its stated outcome and
+# statements, §13 lists exactly the reference's codes, each of which the corpus gives, and
+# the corpus generates with the model file of wai.generate.spectral's conformance vector);
+# then the corpus's second implementation, direction_verify.py, written from the
+# extension's text and sharing no code with wai-rs, which runs the generator in its own
+# arithmetic after checking it against the generator's conformance vector, renders every
+# frame, interpolates every track, measures every box and writes every statement and C2PA
+# statement itself, reads records with synthesis_verify.py's strict JSON reader and every
+# signature with WAI's strict Ed25519 rule and BLAKE3 from claim-conformance, requires every
+# mutated copy of the corpus to fail, and drops each of its own checks in turn and requires
+# the corpus to catch the weakened verifier; standard library only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/direction.md: tests/direction.rs requires this extension's §13 to list the codes
+#   the reference reports, direction_verify.py reads that table, and the registry's wire
+#   identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib direction::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test direction)
+python3 -I live-conformance/direction_verify.py live-conformance/direction

.github/wai-conformance/verifiers/e2ee.sh

@@ -0,0 +1,19 @@
+# step: end-to-end encrypted rooms · e2ee_verify.py
+# order: 650
+# paths: wai/extensions/confidentiality.md
+#
+# wai.live.e2ee (extensions/confidentiality.md): the corpus's second implementation,
+# e2ee_verify.py, written from the extension's text and the documents it reads and
+# sharing no code with the reference (joule-moq's secure_objects and joule-moq-mls,
+# whose own checks run in joule-code-conformance.yml). Standard library only, run
+# isolated (-I): AES, AES-GCM and RFC 9605's counter mode written from their
+# specifications for test vectors only, HKDF and HMAC from the standard library,
+# BLAKE3 and strict Ed25519 from claim-conformance. It checks every vector RFC 9605
+# and draft-ietf-moq-secure-objects-01 publish, every record, key schedule, sealed
+# object and room of vectors.json (taking each epoch's application secret as given,
+# §14), and requires every mutated copy of the corpus to fail.
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/confidentiality.md: e2ee_verify.py reads this extension's §13 table, and the
+#   registry's wire identifiers test reads its sections.
+python3 -I live-conformance/e2ee_verify.py live-conformance/e2ee

.github/wai-conformance/verifiers/energy-steering.sh

@@ -0,0 +1,27 @@
+# step: energy steering · wai-rs and energy_steering_verify.py
+# order: 190
+# features: energy_steering
+# paths: wai/extensions/energy-steering.md
+#
+# wai.live.steering (extensions/energy-steering.md): the reference module's unit tests
+# (policies and decisions round-trip and their rules refuse, the window, the request
+# reader over HLS, DASH and CMCD, the RFC 9651 parser, exact products at their limits,
+# the margin at its boundary, figures compared only within a class, and a pathway with
+# no figure never placed first by its rank while one with a figure is within the
+# limits) and tests/energy_steering.rs (the committed corpus regenerates byte for byte
+# from its fixed seeds, wai-rs gives every request and vector its stated outcome, every
+# reason of §10 refuses a vector, and §10 lists exactly the reference's codes); then the
+# corpus's second implementation, energy_steering_verify.py, written from the
+# extension's text and sharing no code with wai-rs, which reads the room with
+# live_rooms_verify.py and the per-hop records with live_metering_verify.py, parses RFC
+# 9651 itself, recomputes every report, figure, decision and manifest, and requires
+# every mutated copy of the corpus to fail; standard library only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/energy-steering.md: tests/energy_steering.rs requires this extension's §10 to
+#   list the codes the reference reports, energy_steering_verify.py reads that table, and the
+#   registry's wire identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib energy_steering::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test energy_steering)
+python3 -I live-conformance/energy_steering_verify.py live-conformance/steering

.github/wai-conformance/verifiers/exact-splats.sh

@@ -0,0 +1,30 @@
+# step: exact splats · wai-rs and splat_exact_verify.py
+# order: 620
+# features: splat_exact
+# paths: wai/extensions/splat-exact.md wai/extensions/gltf/**
+#
+# wai.splat.exact (extensions/splat-exact.md): the reference module's unit tests
+# (exp_neg_q16 against the exponential, binary32 ranges rounded half up exactly, the
+# signed integers' grammar, the identity set carrying every byte, and tiles that leave a
+# frame unchanged) and tests/splat_exact.rs (live-conformance/splat/ regenerates byte for
+# byte and no other file is there, every case gets its stated outcome, §10 lists exactly the
+# reference's codes, the tiles leave every view of every scene unchanged, and the draft
+# schema names §3.2's members); then the corpus's second implementation,
+# splat_exact_verify.py, written from the extension's text and sharing no code with wai-rs:
+# it reads each glTF asset, decodes each payload with int_payload_verify.py's parser and
+# rANS decoder and tools/wai_ops_check.py's whm1/1 interpreter, renders every view with its
+# own integer renderer, verifies every record with WAI's strict Ed25519 rule and BLAKE3
+# from claim-conformance, reads the extension's reason table, requires every mutated copy
+# of the corpus to fail, drops each of its own checks in turn and changes each rule of its
+# renderer in turn, and requires the corpus to catch every one; standard library only, run
+# isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/splat-exact.md and wai/extensions/gltf/**: tests/splat_exact.rs requires this
+#   extension's §10 to list the codes the reference reports and the draft schema under
+#   extensions/gltf/ to name §3.2's members, splat_exact_verify.py reads §10, and the registry's
+#   wire identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib splat_exact::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test splat_exact)
+python3 -I live-conformance/splat_exact_verify.py live-conformance/splat

.github/wai-conformance/verifiers/exact-tonemap.sh

@@ -0,0 +1,30 @@
+# step: exact tone mapping · wai-rs and tonemap_verify.py
+# order: 610
+# features: exact_tonemap
+# paths: wai/extensions/exact-tonemap.md
+#
+# wai.media.tonemap, wai.meta.gainmap and wai.meta.st2094_50 (extensions/exact-tonemap.md):
+# the reference module's unit tests (the fixed-point log2 and exp2 at known points, the
+# table of K against its rule, the sRGB table, tan through its series, PCHIP slopes of a
+# line, rounding of halves for both signs) and the PNG reader's, then tests/exact_tonemap.rs
+# (the committed corpus regenerates byte for byte, no other file is there, every case and
+# envelope gets its stated outcome, §9 lists exactly the reference's codes, §6 states the
+# corpus's measurement against binary64, and frames.rgb8 is the int_video clip's decode
+# whose digests its sidecar publishes); then the corpus's second implementation,
+# tonemap_verify.py, written from the extension's text and sharing no code with wai-rs,
+# which computes both derivations in integer arithmetic of its own, reads PNG, envelopes
+# (with staged_verify.py) and both companions itself, recomputes §6's measurement, verifies
+# every record with WAI's strict Ed25519 rule and BLAKE3 from claim-conformance, requires
+# every mutated copy of the corpus to fail, and drops each of its own checks in turn and
+# requires the corpus to catch the weakened verifier; standard library only, run isolated
+# (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/exact-tonemap.md: tests/exact_tonemap.rs requires this extension's §9 to list the
+#   codes the reference reports and its §6 to state the corpus's measurement, tonemap_verify.py
+#   reads §3.3's table, §5.4's constant and §9, and the registry's wire identifiers test reads its
+#   sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib -- exact_tonemap:: png_still::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test exact_tonemap)
+python3 -I live-conformance/tonemap_verify.py live-conformance/tonemap

.github/wai-conformance/verifiers/exact-upscale.sh

@@ -0,0 +1,30 @@
+# step: exact upscale · wai-rs and upscale_verify.py
+# order: 310
+# features: exact_upscale neural_int
+# paths: wai/extensions/exact-upscale.md
+#
+# wai.media.upscale (extensions/exact-upscale.md): the integer super-resolution
+# derivations' unit tests (the wai-ops/1 graph against the arithmetic of §3.2 written out
+# loop by loop, on random priors and pictures; a prior with no detail is the pinned
+# upscale; sr4 is sr2 twice; a prior that breaks §3.1 refused in its order; a picture past
+# the caps refused), the module's unit tests (the pixel counts of §6.3, a residual within
+# half its step), and tests/exact_upscale.rs (the committed corpus regenerates byte for
+# byte from its fixed seeds and its two pinned trained priors, and no other file is there;
+# wai-rs gives every case its stated outcome and statements; §8 lists exactly the
+# reference's codes, each of which the corpus gives; sha256.json names every accepted
+# output); then the corpus's second implementation, upscale_verify.py, written from the
+# extension's text and sharing no code with wai-rs, which runs the derivations with
+# _int_sr.py, verifies the claims with synthesis_verify.py and the residuals with
+# staged_verify.py, and requires every mutated copy of the corpus to fail; standard
+# library only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/exact-upscale.md: tests/exact_upscale.rs requires this extension's §8 to list the
+#   codes the reference reports, upscale_verify.py reads that table, and the registry's wire
+#   identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib int_sr::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib exact_upscale::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test exact_upscale)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test cli_derive)
+python3 -I live-conformance/upscale_verify.py live-conformance/upscale

.github/wai-conformance/verifiers/exploration.sh

@@ -0,0 +1,29 @@
+# step: exploration · wai-rs and exploration_verify.py
+# order: 560
+# features: exploration
+# paths: wai/extensions/exploration.md
+#
+# wai.media.exploration (extensions/exploration.md): the reference module's unit tests (the
+# descriptors of flat, single-row and checkerboard pictures, grid bins at both ends, the
+# sample distance's zero, the taste score, derived prompts, and a schedule that replays and
+# keeps the first comer without an objective) and tests/exploration.rs (vectors.json
+# regenerates byte for byte from its fixed seeds and no other file is there, wai-rs gives
+# every generation, descriptor vector and case its stated outcome, §13 lists exactly the
+# reference's codes, each of which the corpus gives, and §3.2 names the reference's
+# descriptors); then the corpus's second implementation, exploration_verify.py, written from
+# the extension's text and sharing no code with wai-rs, which makes every picture with the
+# generator as the extension's Appendix A restates it, computes the descriptors, replays
+# every archive's schedule, reads usage statements with ai_usage_verify.py, verifies every
+# record with WAI's strict Ed25519 rule and BLAKE3 from claim-conformance, reads the
+# extension's reason table, requires every mutated copy of the corpus to fail, and drops each
+# of its own checks in turn and requires the corpus to catch the weakened verifier; standard
+# library only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/exploration.md: tests/exploration.rs requires this extension's §13 to list the
+#   codes the reference reports and its §3.2 table to name the reference's descriptors,
+#   exploration_verify.py reads §13, and the registry's wire identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib exploration::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test exploration)
+python3 -I live-conformance/exploration_verify.py live-conformance/exploration

.github/wai-conformance/verifiers/fleet.sh

@@ -0,0 +1,28 @@
+# step: fleet · wai-rs and fleet_verify.py
+# order: 440
+# features: fleet
+# paths: wai/extensions/fleet.md
+#
+# wai.delivery.fleet (extensions/fleet.md): the reference module's unit tests (the enrolment's
+# rules, a summary line split only in the relay's form, a row summed across classes told from
+# a wrong one, the four coverages) and tests/fleet.rs (vectors.json regenerates byte for byte
+# from its seeds and the metering corpus and no other file is there; wai-rs gives every
+# vector its stated outcome; every reason of §10 and every reused code refuses a vector; the
+# accepted vectors state measured, unmetered and partial energy as §5.4 does; the week's
+# records held as a service holds them sign the corpus's report byte for byte; §10 lists
+# exactly the reference's codes); then the corpus's second implementation, fleet_verify.py,
+# written from the extension's text and sharing no code with wai-rs, which reads per-hop
+# records with live_metering_verify.py, checks every signature with WAI's strict Ed25519
+# rule, recomputes every line, row, unmetered count and citation, requires every mutated
+# copy of the corpus to fail, and drops each of its own checks in turn and requires the
+# corpus to catch the weakened verifier; standard library only, run isolated (-I). The
+# service and its smoke checks over HTTP run in wai-fleet.yml.
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/fleet.md: tests/fleet.rs requires this extension's §10 to list the codes the
+#   reference reports, fleet_verify.py reads that table, and the registry's wire identifiers test
+#   reads its sections. Its corpus is generated from the metering corpus, under the paths above.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib fleet::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test fleet)
+python3 -I live-conformance/fleet_verify.py live-conformance/fleet

.github/wai-conformance/verifiers/forensic-watermark.sh

@@ -0,0 +1,26 @@
+# step: forensic watermark sessions · wai-rs and live_watermark_verify.py
+# order: 670
+# features: live_watermark
+# paths: wai/extensions/forensic-watermark.md
+#
+# wai.live.watermark (extensions/forensic-watermark.md): the reference module's unit tests
+# (the CBOR reader's deterministic-encoding rules, tokens of both COSE structures and
+# every mode read and their rules refuse, a record's rules, big-endian bit addressing,
+# the exact match and the binding) and tests/live_watermark.rs (vectors.json regenerates
+# byte for byte from its fixed seeds and no other file is there, wai-rs gives every
+# token, session list, match and disclosure its stated outcome, and §11 lists exactly the
+# reference's codes, each of which the corpus gives); then the corpus's second
+# implementation, live_watermark_verify.py, written from the extension's text and sharing
+# no code with wai-rs, which reads rooms with live_rooms_verify.py and tokens with a CBOR
+# reader of its own, requires every mutated copy of the corpus to fail, and drops each of
+# its own checks in turn and requires the corpus to catch the weakened verifier; standard
+# library only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/forensic-watermark.md: tests/live_watermark.rs requires this extension's §11 to
+#   list the codes the reference reports, live_watermark_verify.py reads that table, and the
+#   registry's wire identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib live_watermark::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test live_watermark)
+python3 -I live-conformance/live_watermark_verify.py live-conformance/watermark

.github/wai-conformance/verifiers/header-probes.sh

@@ -0,0 +1,29 @@
+# step: header probes · wai-rs, the fetched LCEVC streams and format_probe_verify.py
+# order: 730
+# features: format_probe
+# paths: wai/extensions/format-probes.md
+#
+# Header probes (extensions/format-probes.md, projection.md): the reference module's unit
+# tests (bits, Exp-Golomb and emulation prevention, the codes) and tests/format_probe.rs (the
+# committed corpus regenerates byte for byte from its external vectors and holds no other
+# generated file, every vector, binding and fact gets its stated outcome, and the
+# extensions' tables list exactly the reference's probes and codes); then the five LCEVC
+# streams fetch.sh fetches and checks by SHA-256, each of which wai_format_probe and the
+# second implementation require (a missing one is a failure); then
+# format_probe_verify.py, written from the two texts and sharing no code with wai-rs,
+# which probes every vector itself and requires every mutated copy of the corpus to fail.
+# Standard library only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/format-probes.md: tests/format_probe.rs requires format-probes §2.4 and §12 to
+#   list the reference's probes and codes, and projection.md §4 and §5 to state its codes;
+#   format_probe_verify.py reads format-probes' tables; and the registry's wire identifiers test
+#   reads projection.md, loc-carriage.md and delivery-telemetry.md (whose §6.6 cmsd_read_verify.py
+#   reads).
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib format_probe::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test format_probe)
+fetched=$(mktemp -d)
+bash format-probe-conformance/fetch.sh "$fetched"
+(cd wai-rs && "$RUNNER_TEMP/wai-bins/union/wai_format_probe" verify ../format-probe-conformance --fetched "$fetched")
+python3 -I format-probe-conformance/format_probe_verify.py format-probe-conformance --fetched "$fetched"

.github/wai-conformance/verifiers/holdings.sh

@@ -0,0 +1,22 @@
+# step: holdings · wai-rs and holdings_verify.py
+# order: 550
+# features: holdings
+# paths: wai/extensions/holdings.md
+#
+# wai.delivery.holdings (extensions/holdings.md): the reference module's unit tests (an entry's
+# one form, a record read back and every rule refusing, queries and a plan, and the corpus
+# reaching every stated outcome and failing a changed one) and tests/holdings.rs (vectors.json
+# regenerates byte for byte from its fixed seeds, wai-rs gives every case its stated outcome,
+# and §7 lists exactly the reference's codes); then the corpus's second implementation,
+# holdings_verify.py, written from the extension's text and sharing no code with wai-rs, which
+# verifies group receipts with jwp_verify.py and signatures with the shared _ed25519.py, writes
+# the record, its verdict, queries and plans itself, reads §7, requires every mutated copy of
+# the corpus to fail and drops each of its own checks in turn; run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/holdings.md: tests/holdings.rs requires §7 to list the reference's codes, and
+#   holdings_verify.py reads it.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib -- holdings::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test holdings)
+python3 -I live-conformance/holdings_verify.py live-conformance/holdings

.github/wai-conformance/verifiers/http-differential.sh

@@ -0,0 +1,19 @@
+# step: The HTTP differential outside the corpus (wai-rs against http_verify.py)
+# order: 60
+# features: http,video_manifest,key_discovery
+#
+# Outside the corpus: wai_http_vectors fuzz writes seeded cases (Content-Range values,
+# codecs values, #WAI-LAYER lines, manifests and their member types, encryption,
+# refines, layers declared against their bases, layers over WAI2 components, objects
+# past the first request through a tampering origin; playlists, adjacent pairs,
+# published masters, renderings, adaptation states, the integer log and changed
+# receipt files; receipt files, indexes, grants files and key logs of §8.1–§8.5,
+# whose cases need the `cryptography` package installed above) with wai-rs's
+# outcomes, and
+# http_verify.py must give every one, a refusal by the same code. It prints each
+# family's count of cases and of refusals. Two fixed seeds, so a run is reproducible.
+set -euo pipefail
+for seed in 11 12; do
+  "$RUNNER_TEMP/wai-bins/union/wai_http_vectors" fuzz http-conformance --seed "$seed" --count 400 --out "$RUNNER_TEMP/http-fuzz-$seed.json"
+  python3 http-conformance/http_verify.py cases "$RUNNER_TEMP/http-fuzz-$seed.json" http-conformance
+done

.github/wai-conformance/verifiers/http.sh

@@ -0,0 +1,15 @@
+# step: http_verify.py
+# order: 50
+#
+# The HTTP delivery corpus's second implementation (http-conformance/README): the head,
+# the head proof (every committed proof rebuilt from the text), response checks, plans,
+# selection, the byte-range procedure and its fallback, the codecs union and floor, the
+# playlists (read, rendered, held adjacent, the classical master unchanged), playlist
+# receipts (WAI's strict Ed25519, _ed25519.py) and the live edge, and the adaptation policies,
+# checked first against published BLAKE3 vectors, with the standard library alone;
+# and the receipts, key logs, grants files and parameter sets of §8.1–§8.5, through
+# http_receipts.py and the corpora's own verifiers of jwp-receipts, which need the
+# `cryptography` package installed above (without it those cases fail, never skip).
+# Its mutations and the differential against wai-rs run in wai-http.yml's falsify
+# job.
+python3 http-conformance/http_verify.py http-conformance

.github/wai-conformance/verifiers/hybrid-signatures.sh

@@ -0,0 +1,31 @@
+# step: hybrid signatures · wai-rs and pq_verify.py
+# order: 710
+# build: pq
+# features: pq_signatures synthesis,pq_signatures
+# paths: wai/extensions/pq-signatures.md
+#
+# Hybrid signatures (extensions/pq-signatures.md): the reference module's unit tests (its
+# ML-DSA-65 against FIPS 204's ACVP vectors — keyGen, deterministic sigGen and sigVer —
+# vendored in pq-conformance/acvp and pinned by SHA-256, and the composite against the
+# draft's own vector, before anything is built on them), the synthesis reader's hybrid
+# records, and tests/pq_signatures.rs (vectors.json regenerates byte for byte, every case
+# reaches its verdict, §8 lists exactly the reference's codes, each given); then the
+# corpus's second implementation, pq_verify.py, written from the extension's text and
+# sharing no code with wai-rs, which verifies ML-DSA-65 from FIPS 204's text in pure
+# Python (_mldsa.py), checks every ACVP verification vector and signature and the draft's
+# vector, every case, the sizes §9 states and §8's table, requires every mutated case to be
+# refused and the corpus to catch it with any one of its checks dropped; run isolated (-I).
+# Last, the two give every case the same verdict.
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/pq-signatures.md: tests/pq_signatures.rs requires this extension's §8 to list the
+#   codes the reference reports, pq_verify.py reads that table, and the registry's wire
+#   identifiers test reads its §2.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_PQ_FEATURES" --lib pq_sig::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_PQ_FEATURES" --lib synthesis::pq_tests)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_PQ_FEATURES" --test pq_signatures)
+python3 -I pq-conformance/pq_verify.py pq-conformance
+python3 -I pq-conformance/pq_verify.py verdicts pq-conformance/vectors.json > "$RUNNER_TEMP/pq-py.tsv"
+(cd wai-rs && "$RUNNER_TEMP/wai-bins/pq/wai_pq_vectors" verdicts ../pq-conformance/vectors.json) > "$RUNNER_TEMP/pq-rs.tsv"
+diff "$RUNNER_TEMP/pq-py.tsv" "$RUNNER_TEMP/pq-rs.tsv"

.github/wai-conformance/verifiers/influence.sh

@@ -0,0 +1,28 @@
+# step: influence attribution · wai-rs and influence_verify.py
+# order: 490
+# features: influence
+# paths: wai/extensions/influence.md
+#
+# wai.media.influence (extensions/influence.md): the reference module's unit tests (the
+# blend keeps its base and its references by weight, the makers' split is whole, an
+# estimate mixed into a share is told from another difference) and tests/influence.rs (the
+# committed corpus regenerates byte for byte from its fixed seeds and no other file is
+# there, wai-rs gives every case, statement and report its stated outcome, every reason of
+# §9 and every code it reuses refuses a vector, and §9 lists exactly the reference's codes);
+# then the corpus's second implementation, influence_verify.py, written from the
+# extension's text and sharing no code with wai-rs, which verifies each session with
+# contribution_verify.py, regenerates every conditioned step with that implementation's
+# arithmetic of the generator, reads usage statements with ai_usage_verify.py and
+# statements with settlement_verify.py, computes every step map, share, attribution line
+# and report itself, requires every mutated copy of the corpus to fail, and drops each of
+# its own checks in turn and requires the corpus to catch the weakened verifier; standard
+# library only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/influence.md: tests/influence.rs requires this extension's §9 to list the codes
+#   the reference adds, influence_verify.py reads that table, and the registry's wire identifiers
+#   test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib influence::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test influence)
+python3 -I live-conformance/influence_verify.py live-conformance/influence

.github/wai-conformance/verifiers/int-payload.sh

@@ -0,0 +1,9 @@
+# step: int_payload_verify.py
+# order: 10
+#
+# The integer payload corpus's second implementation (int-payload-conformance/README):
+# it parses every payload with the extension's rules and check order, converts every
+# JSON source independently and requires the committed bytes, decodes the WIV1
+# keyframe-0 payloads in full to their sidecars' SHA-256, and checks every refusal
+# fixture. Standard library only, so it needs nothing installed.
+python3 int-payload-conformance/int_payload_verify.py int-payload-conformance

.github/wai-conformance/verifiers/key-release.sh

@@ -0,0 +1,28 @@
+# step: key release · wai-rs and key_release_verify.py
+# order: 240
+# features: key_release
+# paths: wai/extensions/key-release.md
+#
+# The proxy form of wai.video.keys (extensions/key-release.md): the reference module's unit
+# tests (the commitment list, the entitlement and the ticket round-trip and their rules
+# refuse, each check of the decision in its order, offline licences and renewals, each own
+# rule of the receipt, its strict signature, the CPIX reader and the derivation of a list
+# from a CPIX document), form 1's unit tests (its legacy pin unchanged), and
+# tests/key_release.rs (every file of the committed corpus regenerates byte for byte from
+# its fixed seeds and no other file is there, every log gets its stated outcome, and the
+# extension's tables are the reference's codes); then the corpus's second implementation,
+# key_release_verify.py, written from the extension's text and sharing no code with wai-rs,
+# which reads the extension's tables, derives every list from its CPIX document with the
+# standard library's XML parser, recomputes every decision of every log, verifies every
+# signature with WAI's strict Ed25519 rule and BLAKE3 from claim-conformance, and requires
+# every mutated copy of the corpus to fail; standard library only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/key-release.md: tests/key_release.rs requires this extension's §3.1, §3.2, §7.2
+#   and §11 tables to be the reference's codes, key_release_verify.py reads those tables and §3.3,
+#   and the registry's wire identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib key_release::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib wai_video_keys::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test key_release)
+python3 -I live-conformance/key_release_verify.py live-conformance/keys

.github/wai-conformance/verifiers/live-ads.sh

@@ -0,0 +1,29 @@
+# step: live ads · wai-rs and live_ads_verify.py
+# order: 230
+# features: live_ads
+# paths: wai/extensions/live-ads.md
+#
+# wai.live.ads (extensions/live-ads.md): the reference module's unit tests (policies and
+# annotations round-trip and their rules refuse, a break's identity, tags, events and
+# asset lists written exactly), the break form of wai.video.ssai's receipt (its JSON
+# carriage, each of its rules, its strict signature, the stitched form's legacy pin
+# unchanged), and tests/live_ads.rs (every file of the committed corpus, vectors.json and
+# each room's HLS tags, regenerates byte for byte from its fixed seeds and no other file
+# is there, wai-rs gives every room its stated outcome, and §10 lists exactly the
+# reference's codes, each of which the corpus gives); then the corpus's second
+# implementation, live_ads_verify.py, written from the extension's text and sharing no
+# code with wai-rs, which verifies each room with live_rooms_verify.py, writes every tag,
+# event and asset list byte for byte, verifies every receipt with WAI's strict Ed25519
+# rule and BLAKE3 from claim-conformance, reads the extension's reason table, and
+# requires every mutated copy of the corpus to fail; standard library only, run isolated
+# (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/live-ads.md: tests/live_ads.rs requires this extension's §10 to list the codes
+#   the reference reports, live_ads_verify.py reads that table, and the registry's wire
+#   identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib live_ads::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib wai_video_ssai::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test live_ads)
+python3 -I live-conformance/live_ads_verify.py live-conformance/ads

.github/wai-conformance/verifiers/live-compose.sh

@@ -0,0 +1,25 @@
+# step: live compose · wai-rs and live_compose_verify.py
+# order: 130
+# features: live_compose
+# paths: wai/extensions/live-compose.md
+#
+# wai.live.compose (extensions/live-compose.md): the reference module's unit tests (the
+# layout over every grid of 1 to 64 tiles stays on its canvas with no tile overlapping
+# another, the fill modes, the attributes, the mixer) and tests/live_compose.rs (the
+# committed corpus regenerates byte for byte from its fixed seeds, wai-rs gives every
+# case its stated outcome, every reason of §10 refuses a case, and §10 lists exactly
+# the reference's codes); then the corpus's second implementation,
+# live_compose_verify.py, written from the extension's text and sharing no code with
+# wai-rs, which verifies each room with live_rooms_verify.py, steps through its
+# lifecycle replay to each instant itself, gives every layout, mix, descriptor,
+# composition and receipt the same outcome rectangle for rectangle and sample for
+# sample, and requires every mutated copy of the corpus to fail; standard library
+# only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/live-compose.md: tests/live_compose.rs requires this extension's §10 to list the
+#   codes the reference reports, and the registry's wire identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib live_compose::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test live_compose)
+python3 -I live-conformance/live_compose_verify.py live-conformance/compose

.github/wai-conformance/verifiers/live-contribution.sh

@@ -0,0 +1,19 @@
+# step: live contribution · live_contribution_verify.py
+# order: 380
+# paths: wai/extensions/live-contribution.md
+#
+# wai.live.contribution (extensions/live-contribution.md): the link records' corpus
+# under live-conformance/links/, which joule-moq-ingest's reference generates and its
+# own tests check (joule-code-conformance.yml); here its second implementation,
+# live_contribution_verify.py, written from the extension's text and sharing no code
+# with the reference, reads every part and series itself, checks every signature with
+# WAI's strict Ed25519 rule from claim-conformance, requires each vector's stated outcome
+# and reason and every reason of §7's last list, requires every mutated copy to be
+# refused, and drops each of its own checks in turn and requires the corpus to catch the
+# weakened verifier; standard library only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/live-contribution.md: live_contribution_verify.py reads this extension's §7 list
+#   of the link record's reasons and requires the corpus to raise each one.
+set -euo pipefail
+python3 -I live-conformance/live_contribution_verify.py live-conformance/links

.github/wai-conformance/verifiers/live-events.sh

@@ -0,0 +1,21 @@
+# step: live events · wai-rs and live_events_verify.py
+# order: 100
+# features: live_events
+# paths: wai/extensions/live-events.md
+#
+# wai.live.events (extensions/live-events.md): the reference module's unit tests and
+# tests/live_events.rs (the committed corpus regenerates byte for byte from its fixed
+# seeds, wai-rs gives every vector, policy case and binding case its stated outcome,
+# the corpus covers every kind and reason, and §9 lists exactly the reference's
+# codes); then the corpus's second implementation, live_events_verify.py, written
+# from the extension's text and sharing no code with wai-rs, which verifies the same
+# cases with WAI's strict Ed25519 (claim-conformance/_ed25519.py) and BLAKE3
+# (claim-conformance/_blake3.py), standard library only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/live-events.md: tests/live_events.rs requires this extension's §9 to list the
+#   codes the reference reports, and the registry's wire identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib live_events::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test live_events)
+python3 -I live-conformance/live_events_verify.py live-conformance/events

.github/wai-conformance/verifiers/live-messaging.sh

@@ -0,0 +1,24 @@
+# step: live messaging · wai-rs and live_messaging_verify.py
+# order: 660
+# features: live_messaging
+# paths: wai/extensions/live-messaging.md
+#
+# wai.live.message and wai.live.call (extensions/live-messaging.md): tests/live_messaging.rs
+# (vectors.json regenerates byte for byte from its fixed seeds and no other file is there,
+# wai-rs gives every conversation, history request, call and record its stated outcome, and
+# §12 lists exactly the reference's codes, each of which the corpus gives); then the corpus's
+# second implementation, live_messaging_verify.py, written from the extension's text and
+# sharing no code with wai-rs, which reads descriptors with live_rooms_verify.py and Key IDs,
+# keys, AES-GCM and plaintexts with e2ee_verify.py, implements the receipts' binary form and
+# every rule of the extension itself, verifies every signature with WAI's strict Ed25519
+# rule, requires every mutated copy of the corpus to fail, and drops each of its own checks
+# in turn and requires the corpus to catch the weakened verifier; standard library only, run
+# isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/live-messaging.md: tests/live_messaging.rs requires this extension's §12 to list
+#   the codes the reference reports, live_messaging_verify.py reads that table, and the registry's
+#   wire identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test live_messaging)
+python3 -I live-conformance/live_messaging_verify.py live-conformance/messaging

.github/wai-conformance/verifiers/live-metering.sh

@@ -0,0 +1,27 @@
+# step: live metering · wai-rs and live_metering_verify.py
+# order: 180
+# features: live_metering
+# paths: wai/extensions/live-metering.md
+#
+# wai.live.metering (extensions/live-metering.md): the reference module's unit tests
+# (records and ledgers round-trip, the energy rules, the size bound at its limit, a
+# total of two classes told from a wrong one, funds rounding, the CMCD event-timeline
+# record and the application/cmcd batch, a ledger entry's audit path) and
+# tests/live_metering.rs (the committed corpus regenerates byte for byte from its fixed
+# seeds and the reference relay's recorded record, wai-rs gives every vector its stated
+# outcome, every reason of §9 refuses a vector, the large audience's relay record is the
+# lesson's size, and §9 lists exactly the reference's codes); then the corpus's second
+# implementation, live_metering_verify.py, written from the extension's text and sharing
+# no code with wai-rs, which verifies each room with live_rooms_verify.py, each take with
+# capture_take_verify.py and each composition receipt with live_compose_verify.py,
+# recomputes every unit, total and grant's consumption itself, and requires every
+# mutated copy of the corpus to fail; standard library only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/live-metering.md: tests/live_metering.rs requires this extension's §9 to list the
+#   codes the reference reports, live_metering_verify.py reads that table, and the registry's wire
+#   identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib live_metering::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test live_metering)
+python3 -I live-conformance/live_metering_verify.py live-conformance/metering

.github/wai-conformance/verifiers/live-moderation.sh

@@ -0,0 +1,27 @@
+# step: live moderation · wai-rs and live_moderation_verify.py
+# order: 210
+# features: live_moderation
+# paths: wai/extensions/live-moderation.md
+#
+# wai.live.moderation (extensions/live-moderation.md): the reference module's unit tests
+# (policies, statements and notices round-trip and their rules refuse, the export's
+# strings and dates, the content types, the states that show an item) and
+# tests/live_moderation.rs (every file of the committed corpus, vectors.json and each
+# statement-of-reasons export, regenerates byte for byte from its fixed seeds and no
+# other file is there, wai-rs gives every room, export and clip its stated outcome, and
+# §10 lists exactly the reference's codes, each of which the corpus gives); then the
+# corpus's second implementation, live_moderation_verify.py, written from the
+# extension's text and sharing no code with wai-rs, which verifies each room with
+# live_rooms_verify.py and each clip with live_record_verify.py, writes every export
+# byte for byte, reads the extension's category, content-type and reason tables, and
+# requires every mutated copy of the corpus to fail; standard library only, run
+# isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/live-moderation.md: tests/live_moderation.rs requires this extension's §10 to
+#   list the codes the reference reports, live_moderation_verify.py reads its §9.5, §9.6 and §10
+#   tables, and the registry's wire identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib live_moderation::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test live_moderation)
+python3 -I live-conformance/live_moderation_verify.py live-conformance/moderation

.github/wai-conformance/verifiers/live-provenance.sh

@@ -0,0 +1,27 @@
+# step: live provenance · wai-rs and c2pa_live_verify.py
+# order: 280
+# features: live_provenance
+# paths: wai/extensions/live-provenance.md
+#
+# wai.live.provenance (extensions/live-provenance.md): the reference module's unit tests
+# (boxes, chunks, emsg and the BMFF hash; the JUMBF store; COSE_Sign1 and the OKP key;
+# certificates written and read, their profile and chain; identifiers, track renderings,
+# dates and the compositor's source type) and tests/live_provenance.rs (every file of the
+# committed corpus regenerates byte for byte from its fixed seeds and the packaging
+# corpus's AV1 floor, and no other file is there; wai-rs gives every vector its stated
+# outcome; every reason of §12 refuses a vector; §12 lists exactly the reference's codes
+# with the two C2PA codes it reports); then the corpus's second implementation,
+# c2pa_live_verify.py, written from the extension's text and sharing no code with
+# wai-rs, which reads CBOR, ISO BMFF, JUMBF, COSE and X.509 DER itself, verifies every
+# signature with WAI's strict Ed25519 rule and every receipt with BLAKE3 from
+# claim-conformance, reads the extension's reason table, and requires every mutated copy
+# of a good vector to be refused; standard library only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/live-provenance.md: tests/live_provenance.rs requires this extension's §12 to
+#   list the codes and the C2PA codes the reference reports, c2pa_live_verify.py reads that table,
+#   and the registry's wire identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib live_provenance::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test live_provenance)
+python3 -I live-conformance/c2pa_live_verify.py live-conformance/c2pa-live

.github/wai-conformance/verifiers/live-recording.sh

@@ -0,0 +1,24 @@
+# step: live recording · wai-rs and live_record_verify.py
+# order: 140
+# features: live_record
+# paths: wai/extensions/live-recording.md
+#
+# wai.live.recording (extensions/live-recording.md): the reference module's unit tests,
+# the output tree's (whose range proofs it adds, tested against RFC 9162 §2.1.3.2's
+# check), and tests/live_record.rs (the committed corpus regenerates byte for byte from
+# its fixed seeds, wai-rs gives every recording and clip its stated outcome, every reason
+# of §9 appears in it, every take it says it reuses is capture binding's byte for byte,
+# and §9 lists exactly the reference's codes); then the corpus's second implementation,
+# live_record_verify.py, written from the extension's text and sharing no code with
+# wai-rs, which checks range proofs by the extension's recursion and by RFC 9162
+# §2.1.3.2's own algorithm, verifies each take with capture_take_verify.py and every
+# signature with WAI's strict Ed25519 (claim-conformance/_ed25519.py), and requires every
+# mutated copy of the corpus to fail; standard library only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/live-recording.md: tests/live_record.rs requires this extension's §9 to list the
+#   codes the reference reports, and the registry's wire identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib -- live_record:: output_tree::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test live_record)
+python3 -I live-conformance/live_record_verify.py live-conformance/recordings

.github/wai-conformance/verifiers/live-rooms.sh

@@ -0,0 +1,21 @@
+# step: live rooms · wai-rs and live_rooms_verify.py
+# order: 110
+# features: live_room
+# paths: wai/extensions/live-rooms.md
+#
+# wai.live.room (extensions/live-rooms.md): the reference module's unit tests and
+# tests/live_room.rs (the committed corpus regenerates byte for byte from its fixed
+# seeds, wai-rs gives every vector its stated outcome, every reason of §11 refuses a
+# vector, and §11 lists exactly the reference's codes); then the corpus's second
+# implementation, live_rooms_verify.py, written from the extension's text and sharing
+# no code with wai-rs, which verifies every event with live_events_verify.py and every
+# signature with WAI's strict Ed25519 (claim-conformance/_ed25519.py), standard
+# library only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/live-rooms.md: tests/live_room.rs requires this extension's §11 to list the codes
+#   the reference reports, and the registry's wire identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib live_room::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test live_room)
+python3 -I live-conformance/live_rooms_verify.py live-conformance/rooms

.github/wai-conformance/verifiers/live-worlds.sh

@@ -0,0 +1,22 @@
+# step: live worlds · wai-rs and live_worlds_verify.py
+# order: 640
+# features: live_world
+# paths: wai/extensions/live-worlds.md
+#
+# wai.live.world (extensions/live-worlds.md): the reference module's unit tests (the
+# statement and its rules, the grant attribute) and tests/live_world.rs (vectors.json
+# regenerates byte for byte from its fixed seeds and no other file is there, wai-rs gives
+# every world its stated outcome, and §11 lists exactly the reference's codes, each of which
+# a verifier raises the corpus gives); then the corpus's second implementation,
+# live_worlds_verify.py, written from the extension's text and the sections it cites and
+# sharing no code with wai-rs: the statement, each grant's signature and attributes, each
+# receipt in its binary form under the owner's chain, each op's signature, owner, kind,
+# Lamport rule and equivocation, and the session hash. Standard library only, run isolated.
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/live-worlds.md: tests/live_world.rs requires this extension's §11 to list the
+#   codes the reference reports.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib live_world::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test live_world)
+python3 -I live-conformance/live_worlds_verify.py live-conformance/worlds

.github/wai-conformance/verifiers/loc.sh

@@ -0,0 +1,10 @@
+# step: loc_verify.py
+# order: 760
+#
+# LOC carriage (extensions/loc-carriage.md): the second implementation of joule-moq's loc
+# module (whose tests/loc_vectors.rs runs in joule-code-conformance), written from the text,
+# with its own MOQT -22 property decoder and BLAKE3 (claim-conformance/_blake3.py): it reads
+# every object back to its envelope, writes it again byte for byte, gives every refused
+# object and envelope its code, and requires every mutated copy, and the corpus under a
+# copy of itself with a check dropped, to fail.
+python3 -I live-conformance/loc_verify.py live-conformance/loc

.github/wai-conformance/verifiers/media-identification.sh

@@ -0,0 +1,22 @@
+# step: media identification · wai-rs and identify_verify.py
+# order: 740
+# features: identify
+# alone: -
+# paths: wai/extensions/media-identify.md
+#
+# Media identification (extensions/media-identify.md): wai-rs's unit tests (hostile bytes
+# through every walk, what a file reads as its bytes) and tests/identify.rs (the corpus
+# regenerates byte for byte with every result; the extension's tables; `wai identify`); then
+# identify_verify.py, written from the text and sharing no code with wai-rs but
+# format_probe_verify.py's probes, which gives every file its whole result, holds ext/ to
+# what an independent prober read of it, and requires every mutated copy to fail.
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/media-identify.md: tests/identify.rs requires media-identify §6 and §7 to list
+#   the reference's signatures, and identify_verify.py reads those tables and the capabilities of
+#   its §5.1.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib identify::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test identify)
+(cd wai-rs && "$RUNNER_TEMP/wai-bins/union/wai_identify_vectors" verify ../identify-conformance)
+python3 -I identify-conformance/identify_verify.py identify-conformance

.github/wai-conformance/verifiers/native-sink.sh

@@ -0,0 +1,27 @@
+# step: native sink · wai-rs and native_sink_verify.py
+# order: 460
+# features: native_sink
+# paths: wai/extensions/native-sink.md
+#
+# The native sink (extensions/native-sink.md): the reference module's unit tests (dates,
+# durations and attribute lists read as a player reads them, origins serialized as RFC 6454
+# does, names that state a content hash and names that do not, the acknowledgements
+# rebuilt from hashes alone equal to stream-audit's reference, a bundle that verifies and
+# one refused for another owner or channel) and tests/native_sink.rs (vectors.json
+# regenerates byte for byte from its seeds and no other file is there, every call gets the
+# answer it states, §8 lists exactly the reasons the corpus reaches, and every case run
+# through the C interface's symbols gets the same answers); then the corpus's second
+# implementation, native_sink_verify.py, written from the extension's text and sharing no
+# code with wai-rs, which replays every case, reads playlist receipts and their chain with
+# http_verify.py, holds every bundle to its own session field by field and verifies it with
+# stream_audit_verify.py, requires every mutated copy of the corpus to fail, and drops each
+# of its own checks in turn and requires the corpus to catch the weakened verifier;
+# standard library only, run isolated (-I). The Swift package runs in wai-sink-swift.yml.
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/native-sink.md: tests/native_sink.rs requires this extension's §8 to list exactly
+#   the reasons its corpus reaches, and native_sink_verify.py reads that table.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib native_sink::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test native_sink)
+python3 -I live-conformance/native_sink_verify.py live-conformance/native-sink

.github/wai-conformance/verifiers/opportunity-report.sh

@@ -0,0 +1,30 @@
+# step: opportunity report · wai-rs and opportunity_report_verify.py
+# order: 420
+# features: opportunity_report
+# paths: wai/extensions/opportunity-report.md
+#
+# wai.delivery.opportunity (extensions/opportunity-report.md): the reference module's unit
+# tests (the SCTE 35 subset reader against the standard's sample and damaged sections, the
+# reported statement's JSON and CSV forms and dates, the report's and the check's reading and
+# rules, the ratios); tests/opportunity_report.rs (vectors.json regenerates byte for byte
+# from its fixed seeds and no other file is there; wai-rs gives every vector its stated
+# outcome; every reason of §13 and every reused code refuses a vector; §13 lists exactly the
+# reference's codes; the worked example, a channel's day whose reported statement
+# under-reports one owner's programme, and the check that shows it, recomputed from the
+# public records alone); then the corpus's second implementation, opportunity_report_verify.py,
+# written from the extension's text and sharing no code with wai-rs, which verifies rooms
+# with live_ads_verify.py and contracts, runs and signed statements with
+# revenue_share_verify.py, reads every report, check, section and reported statement itself,
+# recomputes every break, attribution, line, citation and flag, requires every mutated copy
+# of the corpus to fail, and drops each of its own checks in turn and requires the corpus to
+# catch the weakened verifier; standard library only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/opportunity-report.md: tests/opportunity_report.rs requires this extension's §13
+#   to list the codes the reference reports, opportunity_report_verify.py reads that table, and
+#   the registry's wire identifiers test reads its sections. Its corpus is generated from fixed
+#   seeds, under the paths above.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib opportunity_report::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test opportunity_report)
+python3 -I live-conformance/opportunity_report_verify.py live-conformance/opportunity

.github/wai-conformance/verifiers/opus-dred.sh

@@ -0,0 +1,35 @@
+# step: opus deep redundancy · wai-rs and dred_verify.py
+# order: 220
+# features: dred_exact
+# release-features: dred_exact
+# paths: wai/extensions/opus-dred.md
+#
+# wai.audio.opus.dred.int (extensions/opus-dred.md): first the draft's weights file and
+# test vectors, which the corpus names by SHA-256 and does not hold, fetched from the
+# draft's locations and checked against its digests (live-conformance/dred/fetch.sh).
+# Then the reference module's unit tests (the range decoder against its encoder, the
+# extension draft's worked examples, payloads round-trip, weights quantized from their
+# bits, the activation tables, the driver on a synthetic set), tests/dred_exact.rs (the
+# corpus regenerates byte for byte from its seeds and the weights and no other file is
+# there, every payload and case reaches its outcome, §8 lists exactly the module's codes,
+# §4 states its digests), and in release tests/dred_exact_measure.rs (every record of the
+# draft's test vectors decoded through the profile and through the floating-point
+# network: the profile passes the draft's feature test, and §6's table is what it
+# measures). Then the corpus's second implementation, dred_verify.py, written from the
+# extension's text and sharing no code with wai-rs, which recomputes every outcome,
+# digest and row in its own integer arithmetic and requires every mutated copy of the
+# corpus to fail; standard library only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/opus-dred.md: tests/dred_exact.rs requires this extension's §8 to list the codes
+#   the reference reports and its §4 to state the reference's digests, tests/dred_exact_measure.rs
+#   its §6 table, dred_verify.py reads §4 and §8, and the registry's tests read SPEC §5 against
+#   it.
+set -euo pipefail
+d="${RUNNER_TEMP:-/tmp}/dred"
+bash live-conformance/dred/fetch.sh "$d" vectors
+w="$d/dred_unquantized_weights.bin"
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib dred_exact::)
+(cd wai-rs && WAI_DRED_WEIGHTS="$w" cargo test --release --no-default-features --features "$WAI_RELEASE_FEATURES" --test dred_exact)
+(cd wai-rs && WAI_DRED_WEIGHTS="$w" WAI_DRED_VECTORS="$d" cargo test --release --no-default-features --features "$WAI_RELEASE_FEATURES" --test dred_exact_measure)
+python3 -I live-conformance/dred_verify.py live-conformance/dred "$w"

.github/wai-conformance/verifiers/platform-encode.sh

@@ -0,0 +1,26 @@
+# step: platform-encode · wai-rs and encode_verify.py
+# order: 570
+# features: platform_encode
+# paths: wai/extensions/platform-encode.md
+#
+# wai.video.encode (extensions/platform-encode.md): the reference module's unit tests (the
+# Exp-Golomb reader, emulation prevention, NAL splitting, length-prefixed samples, the
+# resampler, the source reader, the strict JSON scan and the date-time) and
+# tests/platform_encode.rs (the fixture streams are the pinned bytes, every generated file
+# regenerates byte for byte, every case gets its outcome, every record reason has a case, and
+# §12 lists exactly the reference's reasons); then the corpus's second implementation,
+# encode_verify.py, written from the extension's text and sharing no code with wai-rs or
+# wai-pack, which reads every Annex B stream, its access units and parameter sets itself,
+# verifies every record with WAI's strict Ed25519 rule and every object with BLAKE3 from
+# claim-conformance, checks the encoded renditions against the base packaging golden,
+# requires every mutated copy of the corpus to fail, and drops each of its own checks in turn
+# and requires the corpus or its mutations to catch the weakened verifier; standard library
+# only, run isolated (-I). The encoders themselves run on the macOS leg (codec-wrappers).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/platform-encode.md: tests/platform_encode.rs requires this extension's §12 to
+#   list the reasons the reference reports, and encode_verify.py reads that table.
+set -euo pipefail
+(cd wai-rs && cargo test --locked --no-default-features --features "$WAI_FEATURES" --lib platform_encode::)
+(cd wai-rs && cargo test --locked --no-default-features --features "$WAI_FEATURES" --test platform_encode)
+python3 -I encode-conformance/encode_verify.py encode-conformance

.github/wai-conformance/verifiers/prior-forms.sh

@@ -0,0 +1,24 @@
+# step: prior forms · wai-rs and prior_forms_verify.py
+# order: 330
+# features: prior_wire prior_wire,neural_int
+# paths: wai/extensions/prior-carriage.md
+#
+# Tensor files as prior forms (extensions/prior-carriage.md §9 to §14): the module's unit
+# tests (each layout read strictly and written canonically, the arithmetic coder's integers
+# round-tripping and a damaged payload caught, the profile's checks in their order, both
+# bindings through every form) and tests/prior_wire.rs (the committed corpus regenerates
+# byte for byte from its pinned native artifacts; §13 lists exactly the reference's codes;
+# every corpus prior in every form loads to its native bytes, and the two trained WSR1
+# priors give the same upscaled picture as their native files); then the corpus's second
+# implementation, prior_forms_verify.py, written from the extension's text and sharing no
+# code with wai-rs, which also requires every byte-flipped copy of an accepted file to be
+# caught; standard library only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/prior-carriage.md: tests/prior_wire.rs requires this extension's §13 to list the
+#   codes the reference reports, prior_forms_verify.py reads that table, and the registry's wire
+#   identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib -- prior_wire:: strict_json:: codecs::prior_form)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test prior_wire)
+python3 -I live-conformance/prior_forms_verify.py live-conformance/prior-forms

.github/wai-conformance/verifiers/qoe-aggregation.sh

@@ -0,0 +1,32 @@
+# step: QoE aggregation · wai-rs and telemetry_aggregate_verify.py
+# order: 600
+# features: telemetry_aggregate
+# paths: wai/extensions/telemetry-aggregation.md
+#
+# wai.telemetry.aggregate (extensions/telemetry-aggregation.md): the reference module's unit
+# tests (the fields against a wide-arithmetic-free product, the generators' orders,
+# TurboSHAKE128 against RFC 9861, HPKE against RFC 9180 A.1.1, the FLP accepting a valid
+# measurement and refusing an invalid one, delivery-telemetry's key classes) and
+# tests/telemetry_aggregate.rs (vectors.json regenerates byte for byte from its fixed seeds and
+# no other file is there, vdaf-22/ is the draft's test vectors as published and wai-rs passes
+# every one, every receipt, cell and delivery-only report gets its stated outcome, every
+# reason of §11 and every reused code refuses a vector, §11 lists exactly the reference's
+# codes, delivery-telemetry §3.4 classes exactly the reference's keys); then the corpus's
+# second implementation, telemetry_aggregate_verify.py, written from the extension's text and
+# the drafts it cites and sharing no code with wai-rs, which evaluates Prio3 itself and passes
+# the draft's vectors, opens every report with its own X25519, HKDF, AES-128-GCM and HPKE,
+# re-runs every flow (both aggregators' verification, the aggregation job byte for byte, the
+# batch buckets, every refusal, the collection), verifies every receipt and cell with WAI's
+# strict Ed25519 rule from claim-conformance, reads the key classes and the reason table from
+# the texts, requires every mutated copy of the corpus to fail, and drops each of its own
+# checks in turn and requires the corpus to catch the weakened verifier; standard library
+# only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/telemetry-aggregation.md: tests/telemetry_aggregate.rs requires this extension's
+#   §11 to list the codes the reference reports, telemetry_aggregate_verify.py reads that table,
+#   and the registry's wire identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib -- telemetry_aggregate:: telemetry::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test telemetry_aggregate)
+python3 -I live-conformance/telemetry_aggregate_verify.py live-conformance/aggregate

.github/wai-conformance/verifiers/quantum-referee.sh

@@ -0,0 +1,15 @@
+# step: quantum referee.py
+# order: 700
+# working-directory: .
+#
+# The quantum corpus's second implementation (quantum-sim extension), integers only:
+# it derives the circuit/1 phase table by its recurrence and the circuit2 table by an
+# interval-certified procedure, and requires both literal tables and their digests,
+# and the extension's Appendix B to state the same;
+# rebuilds every file of both vector trees byte for byte and recomputes every manifest
+# entry with its own reader, simulator, sampler and BLAKE3; refuses every reject file
+# with its listed class and by the rule its name states; and requires dyadic_ladder
+# to see every ±1 change of every P(k) under both tables. Standard library only, run
+# isolated (-I), so no module from the working directory, the environment or the
+# user's site-packages is imported.
+python3 -I wai/quantum-conformance/tools/referee.py wai/quantum-conformance

.github/wai-conformance/verifiers/receipt-ledger.sh

@@ -0,0 +1,34 @@
+# step: receipt ledger · wai-rs and receipt_ledger_verify.py
+# order: 400
+# features: receipt_ledger
+# paths: wai/extensions/receipt-ledger.md
+#
+# wai.delivery.ledger (extensions/receipt-ledger.md): the reference module's unit tests and
+# tests/receipt_ledger.rs (vectors.json regenerates byte for byte from its fixed seeds and
+# from the sources it takes from the metering, settlement, ads, presentation, stitched and
+# routes corpora and the packs of pack-conformance, and no other file is there; wai-rs gives every vector its
+# stated outcome; every reason of §10 and every reused code refuses a vector, and so does
+# each source kind's own extension; §10 lists exactly the reference's codes; under a tariff
+# of version 3, jobs priced per operation and a chain that bills a job's work once, its
+# output's receipt cited again by a re-run, with version 2 billing as before); then the
+# corpus's second implementation, receipt_ledger_verify.py, written from the extension's
+# text and sharing no code with wai-rs, which verifies each source with that corpus's own
+# second implementation (live_metering_verify.py, settlement_verify.py, live_ads_verify.py
+# with ad_presentation_verify.py, stitched_presentation_verify.py, pack_verify.py, and for a
+# media job route_record_verify.py and _int_motion_receipt.py) and
+# reports a stitched stream's statement as that verifier gives it, checks signatures with
+# WAI's strict Ed25519 rule, recomputes every line, citation, energy row and report,
+# requires every mutated copy of the corpus to fail, and drops each of its own checks in turn and requires
+# the corpus to catch the weakened verifier; run isolated (-I), with the `cryptography` package
+# installed above for the OER/2 reference verifier that checks a job's hop receipts.
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/receipt-ledger.md: tests/receipt_ledger.rs requires this extension's §10 to list
+#   the codes the reference reports, receipt_ledger_verify.py reads that table, and the registry's
+#   wire identifiers test reads its sections. Its corpus is generated from the metering,
+#   settlement, ads, presentation and stitched corpora and the packs of pack-conformance, all
+#   under the paths above.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib receipt_ledger::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test receipt_ledger)
+python3 -I live-conformance/receipt_ledger_verify.py live-conformance/ledger

.github/wai-conformance/verifiers/remote-desktop.sh

@@ -0,0 +1,35 @@
+# step: remote desktop · wai-rs, remote_desktop_verify.py and the page's module
+# order: 590
+# features: remote_desktop
+# paths: wai/extensions/remote-desktop.md
+#
+# wai.live.remote (extensions/remote-desktop.md): the reference module's unit tests (every
+# statement read back and refused when a byte is short or over, the screen statement's
+# field rules, the host's rules of §5.3 in their order, the grant attributes, a latency's
+# legs, sealed actions: a seal with no plaintext in it that opens under the host's key
+# alone, the commitment and what it binds, a seal that does not fit its actions, rules 8
+# and 9 after the others) and the crate's HPKE against RFC 9180 A.1.1; tests/remote_desktop.rs
+# (vectors.json regenerates byte for byte from its fixed seeds and no other file is there,
+# wai-rs gives every room its stated outcome at the commitment level and at the opened
+# level, and §12 lists exactly the reference's codes, host refusals, floor refusals and
+# the reasons a seal is not opened, each of which the corpus gives);
+# then the corpus's second implementation, remote_desktop_verify.py, written from the
+# extension's text and sharing no code with wai-rs, which verifies each room with
+# live_rooms_verify.py, every signature with WAI's strict Ed25519 rule and every seal with
+# the aggregation verifier's HPKE, recomputes every outcome from the rules, the floor and
+# every latency's legs at both levels, requires every mutated copy of the corpus to fail and
+# drops each of its own checks in turn and requires the corpus to catch the weakened
+# verifier; standard library only, run isolated (-I). Last, the browser viewer's module
+# (joule-moq-web/web/room/remote.js), which writes the corpus's input statements, floor
+# statements and latency records byte for byte, seals every sealed input that opens again
+# byte for byte, and gives every input the outcome the corpus states.
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/remote-desktop.md: tests/remote_desktop.rs requires this extension's §12 to list
+#   the codes the reference reports, remote_desktop_verify.py reads its four tables, and the
+#   registry's wire identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib -- remote_desktop:: hpke::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test remote_desktop)
+python3 -I live-conformance/remote_desktop_verify.py live-conformance/remote
+node --test ../joule-code/joule-code-rs/crates/joule-moq-web/web/room/remote.test.mjs

.github/wai-conformance/verifiers/revenue-share.sh

@@ -0,0 +1,30 @@
+# step: revenue share · wai-rs and revenue_share_verify.py
+# order: 410
+# features: revenue_share
+# paths: wai/extensions/revenue-share.md
+#
+# wai.delivery.revenue_share (extensions/revenue-share.md): the reference module's unit tests
+# (the largest-remainder division and its ties, the date-time a marker states, the contract's
+# and the statement's reading and rules, contracts that overlap) and the channel receipt's
+# JSON carriage; tests/revenue_share.rs (vectors.json regenerates byte for byte from its fixed
+# seeds and the ledger corpus, and no other file is there; wai-rs gives every vector its
+# stated outcome; every reason of §11 and every reused code refuses a vector; §11 lists exactly
+# the reference's codes; the worked example, three statements of one month computed and then
+# recomputed from the public records alone; the four operations from the command line); then
+# the corpus's second implementation, revenue_share_verify.py, written from the extension's
+# text and sharing no code with wai-rs, which verifies each ledger document with
+# receipt_ledger_verify.py, reads every contract, run, marker and statement itself,
+# recomputes every attribution, line, division and citation, requires every mutated copy of
+# the corpus to fail, and drops each of its own checks in turn and requires the corpus to
+# catch the weakened verifier; standard library only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/revenue-share.md: tests/revenue_share.rs requires this extension's §11 to list
+#   the codes the reference reports, revenue_share_verify.py reads that table, and the registry's
+#   wire identifiers test reads its sections. Its corpus is generated from the ledger corpus,
+#   under the paths above.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib revenue_share::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib wai_video_channel::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test revenue_share)
+python3 -I live-conformance/revenue_share_verify.py live-conformance/share

.github/wai-conformance/verifiers/robustness.sh

@@ -0,0 +1,30 @@
+# step: robustness evidence · wai-rs and robustness_verify.py
+# order: 320
+# features: robustness
+# release-features: robustness
+# paths: wai/extensions/robustness-evidence.md
+#
+# Robustness evidence for soft bindings (extensions/robustness-evidence.md): the
+# reference's unit tests (gamma is the rounded power, rates are exact and reduced, every
+# attack of synthesis §7.5.7's battery is a transform that gives its bytes, parameters
+# outside their ranges are refused), then tests/robustness.rs in release, since
+# regenerating the corpus runs the harness over the measurement sets of synthesis §7.5.8
+# (every file of live-conformance/robustness/ regenerates byte for byte and no other file
+# is there; every case gets what it states; §12 lists exactly the reference's codes and
+# the corpus refuses a case for each; §4 registers exactly the reference's transforms;
+# the tent64 records' tables are the synthesis corpus's battery.json; the tent64 claim is
+# synthesis §7.5.8's list; jwp-receipts §3.1 lists the span reasons); then the second
+# implementation, robustness_verify.py with _wai_mark.py, written from the extension's
+# text and sharing no code with wai-rs, which reruns the conformance record's battery end
+# to end and requires the same table, checks the tent64 records against battery.json and
+# the claim against synthesis §7.5.8, mutates copies of the corpus and weakens its own
+# verifier in turn; standard library only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/robustness-evidence.md: tests/robustness.rs requires this extension's §12 to list
+#   the codes the reference reports and its §4 to register the reference's transforms,
+#   robustness_verify.py reads both, and the registry's wire identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib robustness::)
+(cd wai-rs && cargo test --release --no-default-features --features "$WAI_RELEASE_FEATURES" --test robustness)
+python3 -I live-conformance/robustness_verify.py live-conformance/robustness

.github/wai-conformance/verifiers/route-record.sh

@@ -0,0 +1,30 @@
+# step: route record · wai-rs and route_record_verify.py
+# order: 450
+# features: route_record
+# paths: wai/extensions/route-record.md
+#
+# wai.route.record (extensions/route-record.md): the reference module's unit tests (a
+# document read strictly and held to the subset, §2's encodings, an estimate past the subset
+# unknown, a null ranked last, the expected figures per successful job and when they are
+# unknown, the outputs' commitment, §8 listing exactly the reference's codes) and
+# tests/route_record.rs (vectors.json regenerates byte for byte from its seeds and no other
+# file is there; wai-rs gives every vector its stated outcome; every reason of §8 and every
+# reused code refuses a vector; the accepted vectors are §10's, of version 1 and of version 2,
+# every limit removing a candidate; a record is bound to each of its documents; `wai route
+# verify` prints the outcome and exits by it); then the corpus's second implementation,
+# route_record_verify.py, written from the extension's text and sharing no code with wai-rs,
+# which checks the router's signature with WAI's strict Ed25519 rule and the hop receipts
+# with the OER/2 reference verifier (the `cryptography` package, installed above), computes
+# the outputs' commitment with claim-conformance/_blake3.py, recomputes every candidate,
+# removal, expected figure, rank, order, decision and attempt, requires every mutated copy
+# of the corpus to fail, and drops each of its own checks in turn and requires the corpus to
+# catch the weakened verifier; run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/route-record.md: tests/route_record.rs and the module's tests require this
+#   extension's §8 to list the codes the reference reports, route_record_verify.py reads that
+#   table, and the registry's wire identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib route_record::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test route_record)
+python3 -I live-conformance/route_record_verify.py live-conformance/routes

.github/wai-conformance/verifiers/scene-carriage.sh

@@ -0,0 +1,23 @@
+# step: scene carriage · wai-rs and scene_verify.py
+# order: 340
+# features: scene_map
+# paths: wai/extensions/scene-carriage.md
+#
+# Scene carriage (extensions/scene-carriage.md): the module's unit tests (the conversions
+# and spellings of §3 against fixed values, the containers an import builds equal to the
+# ones wai-rs's world and audio-scene modules write, base64 and the USD subset's reader)
+# and tests/scene_map.rs (the committed corpus regenerates byte for byte: every bundle
+# written as glTF and USD and read back, every refusal reached; §8 lists exactly the
+# reference's codes); then the corpus's second implementation, scene_verify.py, written
+# from the extension's text and sharing no code with wai-rs, which also requires every
+# byte-flipped copy of an exported document to be caught; standard library only, run
+# isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/scene-carriage.md: tests/scene_map.rs requires this extension's §8 to list the
+#   codes the reference reports, scene_verify.py reads that table, and the registry's wire
+#   identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib -- scene_map:: strict_json::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test scene_map)
+python3 -I live-conformance/scene_verify.py live-conformance/scene

.github/wai-conformance/verifiers/settlement.sh

@@ -0,0 +1,29 @@
+# step: delivery settlement · wai-rs and settlement_verify.py
+# order: 390
+# features: settlement
+# paths: wai/extensions/settlement.md
+#
+# wai.delivery.settlement (extensions/settlement.md): the reference module's unit tests
+# (range proofs over every range around every chunk boundary of objects of many lengths
+# against BLAKE3's own root, tampered proofs refused, the group tree of jwp-receipts §2.2,
+# records and item lists read and refused, amounts rounded down per line) and
+# tests/settlement.rs (vectors.json regenerates byte for byte from its fixed seeds and no
+# other file is there, wai-rs gives every statement and range proof its stated outcome, §11
+# lists exactly the reference's codes, each of which the corpus gives, beside every code it
+# reuses); then the corpus's second implementation, settlement_verify.py, written from the
+# extension's text and sharing no code with wai-rs, which verifies range proofs over
+# BLAKE3's chunk tree with claim-conformance's BLAKE3, reads rooms, grants and proofs with
+# live_rooms_verify.py and per-hop records with live_metering_verify.py, checks signatures
+# with WAI's strict Ed25519 rule, recomputes every figure of every statement, reads the
+# extension's reason table, requires every mutated copy of the corpus to fail, and drops
+# each of its own checks in turn and requires the corpus to catch the weakened verifier;
+# standard library only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/settlement.md: tests/settlement.rs requires this extension's §11 to list the
+#   codes the reference reports, settlement_verify.py reads that table, and the registry's wire
+#   identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib settlement::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test settlement)
+python3 -I live-conformance/settlement_verify.py live-conformance/settlement

.github/wai-conformance/verifiers/sim-diff.sh

@@ -0,0 +1,13 @@
+# step: sim_diff.py, wai_stage_measure against sim_verify.py
+# order: 90
+# features: stage_measure
+#
+# The simulator differentially, outside the corpus: seeded random models (a refinement
+# with its own delivery timeout among them) and plans, each simulated by
+# wai_stage_measure sim and by sim_verify.py, the refusal or the whole result, the
+# stall bound and the longest stall equal, and every stall within the bound where it
+# applies. Two fixed seeds, so a run is reproducible.
+set -euo pipefail
+for seed in 1 2; do
+  python3 staged-measure-conformance/sim_diff.py "$RUNNER_TEMP/wai-bins/union/wai_stage_measure" "$seed" 1500
+done

.github/wai-conformance/verifiers/sink-energy.sh

@@ -0,0 +1,31 @@
+# step: sink energy · wai-rs and sink_energy_verify.py
+# order: 200
+# features: sink_energy
+# paths: wai/extensions/sink-energy.md
+#
+# wai.sink.energy (extensions/sink-energy.md): the reference module's unit tests (a
+# bracket summary is its intervals in integers, a round's figure and least declaration
+# are energy-measurement §6.2's — checked against energy_report's reference — a round is
+# refused by its first broken rule, a row seals its median and covers its spread, a
+# segment's bounded window has no count term, the estimators and shares round half up,
+# records sign and their identities cover the signature, §8 lists exactly the codes), the
+# readers' unit tests (a counter is live only as a live rail advances, an advance crosses
+# the wrap; on macOS, the per-process counter reads this process) and
+# tests/sink_energy.rs (the committed corpus regenerates byte for byte from its fixed
+# seeds, every case gets its stated outcome, every reason of §8 refuses a case, and every
+# measured table under tables/ is accepted with its readings and procedure); then the
+# corpus's second implementation, sink_energy_verify.py, written from the extension's text
+# and sharing no code with wai-rs, which recomputes every round, row, segment and split in
+# integers and requires every mutated copy of the corpus to fail; standard library only,
+# run isolated (-I). These are the integer checks; the counters themselves are read by
+# energy-hardware.yml's sink jobs, on the runners that have them.
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/sink-energy.md: sink_energy's unit tests require this extension's §8 to list
+#   exactly the codes the reference reports, and sink_energy_verify.py reads that table.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib sink_energy::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib sink_meter::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test sink_energy)
+(cd wai-rs && "$RUNNER_TEMP/wai-bins/union/wai_sink_energy_vectors" verify ../live-conformance/sink-energy)
+python3 -I live-conformance/sink_energy_verify.py live-conformance/sink-energy

.github/wai-conformance/verifiers/staged-measure.sh

@@ -0,0 +1,9 @@
+# step: measure_verify.py
+# order: 70
+#
+# The staged-measurement corpus's second implementation (staged-measure-conformance/README):
+# it counts every object, applies every layer from its base's stage 0, computes the quality
+# integers, the output tree, the prefixes, the overhead points and the dedup totals itself,
+# and requires its decode to be the fixture tool's and its figures to be goldens.json's.
+# Standard library only.
+python3 staged-measure-conformance/measure_verify.py staged-measure-conformance

.github/wai-conformance/verifiers/staged.sh

@@ -0,0 +1,9 @@
+# step: staged_verify.py
+# order: 40
+#
+# The staged-delivery corpus's second implementation (staged-conformance/README): it
+# replays every case from its stage-0 buffers through its own reading of the
+# extension (refines, WIR1, the sink's steps, holds, batches, conflicts, deadlines,
+# tiers, stage hashes), decodes the WIV1 keyframe-0, PNG and FLAC bases, explodes the
+# WAI2 files, and replays the schedule. Standard library only.
+python3 staged-conformance/staged_verify.py staged-conformance

.github/wai-conformance/verifiers/stitched-presentation.sh

@@ -0,0 +1,33 @@
+# step: stitched presentation · wai-rs, stitched_presentation_verify.py and the reference producer
+# order: 260
+# features: stitched_presentation
+# paths: wai/extensions/stitched-presentation.md
+#
+# wai.video.stitched_presentation (extensions/stitched-presentation.md): the reference
+# module's unit tests (claims and pod-input records round-trip and their rules refuse,
+# markers' bodies, a CPM price scaled to one impression, the XML subset) and the
+# live-compose ad frames' (a squeeze's window and L tile the canvas, a double box's
+# boxes), and tests/stitched_presentation.rs (every file of the committed corpus
+# regenerates byte for byte from its fixed seeds and no other file is there, wai-rs gives
+# every record, claim and ad its stated facts and every vector its spend by currency, and
+# §9 lists exactly the codes the reference adds); then the tool's own check of the corpus
+# through its binary; then the corpus's second implementation,
+# stitched_presentation_verify.py, written from the extension's text and sharing no code
+# with wai-rs, which reads every playlist, asset list, MPD, VAST document, form-1 receipt,
+# record and claim itself, requires every mutated copy of the corpus to fail and catches
+# each of its own checks dropped; standard library only, run isolated (-I). Last, the
+# browser client's stitched producer (joule-moq-web/web/ads/stitched.js), which reads the
+# markers from the corpus's manifests, measures an ad's region, and writes and signs the
+# corpus's claims, byte for byte.
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/stitched-presentation.md: tests/stitched_presentation.rs requires this
+#   extension's §9 to list the codes the reference adds, stitched_presentation_verify.py reads
+#   that table, and the registry's wire identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib stitched_presentation::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib live_compose::layout::frame_tests)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test stitched_presentation)
+(cd wai-rs && "$RUNNER_TEMP/wai-bins/union/wai_stitched_presentation" vectors verify ../live-conformance/stitched)
+python3 -I live-conformance/stitched_presentation_verify.py live-conformance/stitched
+node --test ../joule-code/joule-code-rs/crates/joule-moq-web/web/ads/stitched.test.mjs

.github/wai-conformance/verifiers/stream-audit.sh

@@ -0,0 +1,27 @@
+# step: stream audit · wai-rs and stream_audit_verify.py
+# order: 430
+# features: stream_audit
+# paths: wai/extensions/stream-audit.md
+#
+# wai.delivery.audit (extensions/stream-audit.md): the reference module's unit tests (the
+# acknowledgement windows, chains and repeats of §4.2, the origin rule, the report's bytes,
+# channel names) and tests/stream_audit.rs (vectors.json regenerates byte for byte from its
+# fixed seeds and no other file is there, wai-rs gives every session and report its stated
+# outcome, §14 lists exactly the reference's codes, each of which the corpus gives, beside
+# every code it borrows); then the corpus's second implementation, stream_audit_verify.py,
+# written from the extension's text and sharing no code with wai-rs, which reads
+# acknowledgements with settlement_verify.py, claims with ad_presentation_verify.py and logs
+# and energy classes with live_metering_verify.py, checks every signature with WAI's strict
+# Ed25519 rule, recomputes every report, requires every mutated copy of the corpus to fail,
+# and drops each of its own checks in turn and requires the corpus to catch the weakened
+# verifier; standard library only, run isolated (-I). The collector and the player
+# integration run in wai-audit.yml.
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/stream-audit.md: tests/stream_audit.rs requires this extension's §14 to list the
+#   codes the reference reports, stream_audit_verify.py reads that table, and the registry's wire
+#   identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib stream_audit::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test stream_audit)
+python3 -I live-conformance/stream_audit_verify.py live-conformance/audit

.github/wai-conformance/verifiers/stream-termination.sh

@@ -0,0 +1,30 @@
+# step: stream termination · wai-rs, wai-live-web and stream_termination_verify.py
+# order: 630
+# features: stream_termination
+# paths: wai/extensions/stream-termination.md
+#
+# wai.live.termination (extensions/stream-termination.md) and the display match of
+# capability-constraints §4: the reference module's unit tests (sides without orientation,
+# each exceedance alone, the least rendition alone where none is within, a writer that
+# refuses after its termination) and tests/stream_termination.rs (the committed corpus
+# regenerates byte for byte from its fixed seeds, wai-rs gives every match and log its
+# stated outcome and facts, every reason refuses a log, §7 lists exactly the reference's
+# codes and capability-constraints §4.2 its match bits); wai-live-web's functions for a
+# page held to the same corpus natively, a page's log written through them verified; then
+# the corpus's second implementation, stream_termination_verify.py, written from the two
+# extensions' text and sharing no code with wai-rs, which recomputes every match and every
+# log's outcome and facts and requires every mutated copy of the corpus to fail; standard
+# library only, run isolated (-I). The browser's own run is joule-moq-web.yml's scenario
+# termination.
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/stream-termination.md: tests/stream_termination.rs requires this extension's §7
+#   to list the codes the reference reports and capability-constraints §4.2 to name the match's
+#   bits, stream_termination_verify.py reads both, and the registry's wire identifiers test reads
+#   its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib stream_termination::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test stream_termination)
+(cd wai-rs && "$RUNNER_TEMP/wai-bins/union/wai_stream_termination_vectors" verify ../live-conformance/termination)
+(cd wai-live-web && cargo test --locked --features int_video --lib termination_tests)
+python3 -I live-conformance/stream_termination_verify.py live-conformance/termination

.github/wai-conformance/verifiers/synthesis-mark.sh

@@ -0,0 +1,34 @@
+# step: synthesis watermark · wai-rs and synthesis_mark_verify.py
+# order: 300
+# features: synthesis_mark
+# release-features: synthesis_mark
+# paths: wai/extensions/synthesis.md
+#
+# The registered watermark schemes wai-mark:tent64 and wai-mark:tent64s
+# (extensions/synthesis.md §7.4 to §7.9): the reference's unit tests (the code corrects 29
+# errors and its generator is the definition's, the layouts, the embedding and the
+# detector in every orientation, the tiled detector's exact autocorrelation and its
+# recovery from a crop and a rotation, the battery's resampling, rotation and keyframe),
+# then tests/synthesis_mark.rs in release, since it embeds and attacks every picture of
+# the measurement sets under both schemes (every file of live-conformance/synthesis-mark/
+# regenerates byte for byte, both measurements among them, and no other file is there;
+# every embedding, detection and case gets what it states; the extension's definitions,
+# generator polynomial and shuffles are the reference's; §7.5.8 and §7.9.7 claim only
+# attacks the measurements show survived, and §7.5.6's and §7.9.5's figures are the
+# measurements'); then the second implementation, synthesis_mark_verify.py with
+# _wai_mark.py, written from the extension's text and sharing no code with wai-rs, which
+# embeds, detects and decodes itself, both stages of the tiled detector among them, runs
+# the battery's picture attacks, derives the frames the vectors name, verifies every case
+# with synthesis_verify.py, mutates copies of the corpus and weakens its own verifier in
+# turn; standard library only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/synthesis.md: tests/synthesis.rs requires this extension's §12 to list the codes
+#   the reference reports and its §10.2 table to pin the reference's icons, synthesis_verify.py
+#   reads both, tests/synthesis_mark.rs and synthesis_mark_verify.py read its scheme's definition,
+#   generator, figures, table and claims (§7.4 to §7.5.8), and the registry's wire identifiers
+#   test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib -- synthesis::mark synthesis_mark::)
+(cd wai-rs && cargo test --release --no-default-features --features "$WAI_RELEASE_FEATURES" --test synthesis_mark)
+python3 -I live-conformance/synthesis_mark_verify.py live-conformance/synthesis-mark

.github/wai-conformance/verifiers/synthesis.sh

@@ -0,0 +1,28 @@
+# step: synthesis provenance · wai-rs and synthesis_verify.py
+# order: 290
+# features: synthesis
+# paths: wai/extensions/synthesis.md
+#
+# wai.media.synthesis (extensions/synthesis.md): the reference module's unit tests (the
+# pinned derivations by their rules, the class lattice, a generator's envelope) and
+# tests/synthesis.rs (the committed corpus regenerates byte for byte from its fixed seeds
+# and no other file is there, wai-rs gives every case its stated outcome and statements,
+# §12 lists exactly the reference's codes, each of which the corpus gives, and §10.2's
+# table pins exactly the reference's icons); then the corpus's second implementation,
+# synthesis_verify.py, written from the extension's text and sharing no code with wai-rs,
+# which runs the pinned derivations and writes each digital source type and C2PA
+# statement itself, verifies each room with live_rooms_verify.py and every record with
+# WAI's strict Ed25519 rule and BLAKE3 from claim-conformance, reads the extension's icon
+# and reason tables, and requires every mutated copy of the corpus to fail; standard
+# library only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/synthesis.md: tests/synthesis.rs requires this extension's §12 to list the codes
+#   the reference reports and its §10.2 table to pin the reference's icons, synthesis_verify.py
+#   reads both, tests/synthesis_mark.rs and synthesis_mark_verify.py read its scheme's definition,
+#   generator, figures, table and claims (§7.4 to §7.5.8), and the registry's wire identifiers
+#   test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib synthesis::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test synthesis)
+python3 -I live-conformance/synthesis_verify.py live-conformance/synthesis

.github/wai-conformance/verifiers/takedown.sh

@@ -0,0 +1,30 @@
+# step: takedown · wai-rs and takedown_verify.py
+# order: 480
+# features: takedown
+# paths: wai/extensions/takedown.md
+#
+# wai.media.takedown (extensions/takedown.md): the reference module's unit tests (times,
+# clock identifiers, the published registry, the order of subjects, the lower median) and
+# tests/takedown.rs (the committed corpus regenerates byte for byte from its fixed seeds
+# and no other file is there, wai-rs gives every case its stated outcome and facts and
+# every counts entry its rows, §11 lists exactly the reference's codes, each of which the
+# corpus gives, and the registry the module carries is registry/takedown-clocks.json);
+# then the corpus's second implementation, takedown_verify.py, written from the
+# extension's text and sharing no code with wai-rs, which computes every closure, holder,
+# purge time, clock verdict and counts row itself, reads derivation records and delivery
+# receipts with edge_verify.py, origin claims with synthesis_verify.py, acknowledgements
+# with settlement_verify.py and every record with WAI's strict Ed25519 rule and BLAKE3
+# from claim-conformance, requires every mutated copy of the corpus to fail, and drops
+# each of its own checks in turn and requires the corpus to catch the weakened verifier;
+# run isolated (-I). The reference relay's DVR store honours takedowns (§10.1), tested by
+# joule-moq-relay's tests/dvr.rs in joule-code-conformance.yml.
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/takedown.md: tests/takedown.rs requires this extension's §11 to list the codes
+#   the reference reports, takedown_verify.py reads that table, and the registry's wire
+#   identifiers test reads its sections. The registry of clocks it reads is under wai/registry/
+#   above.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib takedown::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test takedown)
+python3 -I live-conformance/takedown_verify.py live-conformance/takedown

.github/wai-conformance/verifiers/timed-text.sh

@@ -0,0 +1,24 @@
+# step: timed text · wai-rs and timed_text_verify.py
+# order: 150
+# features: timed_text
+# paths: wai/extensions/timed-text.md
+#
+# wai.text.timed (extensions/timed-text.md): the reference module's unit tests (cue model,
+# annotation, WebVTT, IMSC1 and its render-model bound, timelines, disclosure, and the
+# 608 encoder and decoder) and tests/timed_text.rs (every file of the committed corpus,
+# vectors.json and each expected .vtt, .ttml and .608.hex, regenerates byte for byte
+# from its fixed seeds and no other file is there, wai-rs gives every case its stated
+# outcome, the corpus covers every 608 code path, and §12 lists exactly the reference's
+# codes); then the corpus's second implementation, timed_text_verify.py, written from
+# the extension's text and sharing no code with wai-rs, which verifies every event with
+# live_events_verify.py, writes every output byte for byte from the text, parses each
+# IMSC1 document with xml.etree, and requires every mutated copy of the corpus to fail;
+# standard library only, run isolated (-I).
+#
+# The paths this step brings to the workflow's trigger, and why:
+# wai/extensions/timed-text.md: tests/timed_text.rs requires this extension's §12 to list the
+#   codes the reference reports, and the registry's wire identifiers test reads its sections.
+set -euo pipefail
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib timed_text::)
+(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test timed_text)
+python3 -I live-conformance/timed_text_verify.py live-conformance/captions