Transaction-Science/open-standards
Watch
1
0
Fork
You've already forked open-standards
 0
Code Issues Pull requests Projects Releases 15 Packages Wiki Activity Actions

wai key: signing keys in one keystore, and wai --version, docs search and registry show #656

Closed
dcharlot wants to merge 9 commits from wai/toolchain-keys into main
pull from: wai/toolchain-keys
merge into: Transaction-Science:main
Conversation 0 Commits 9 Files changed 46 +4567 -278
dcharlot commented 2026-11-05 12:21:27 -05:00
Owner
Copy link

wai key: a developer's signing keys in one keystore, used by name across the toolchain. Also wai --version, two more doors onto what wai mcp already answers, and what a version of the toolchain promises.

wai key

create, import, list, show, rotate, revoke and export, in the catalogue, needing the quickstart feature. Every operation takes --json; those that change something take --dry-run; --yes is never implied. Each <name>.json record (wai.key/1) holds public halves only, and no operation prints a secret.

Where the secret goes:

  • macOS: the login keychain, through /usr/bin/security, with the secret on standard input and never in an argument.
  • Elsewhere: a seed file readable only by this account. One that others can read is refused, exit 3, key-file-exposed.
  • Windows: the seed, the record and any keystore directory wai makes get this account as owner and as the only entry, with inheritance off, from the call that creates them, so a keystore in a shared folder gets the same result. Lists are read by SID.

--key <name> now works on enrolment, channel import, contract, statement, opportunity, upscale, tonemap, encode, http seal-playlist and conform. A path that exists is still read as a file first.

Also here

  • wai --version [--json]: version, catalogue and registry digests, the standard's release, envelope formats, build features.
  • wai docs search and wai registry show: each runs the same tool as wai mcp, and a test holds the two doors' answers equal.
  • wai/VERSIONING.md and wai/DEPRECATIONS.md, with a test holding the list to the catalogue both ways. --confirm prints one deprecation line.
  • The help banner reads wai — the .WAI™ toolchain.

Found by running on the real platforms, and fixed

  • security -i exits with the failing command's status; the stand-in always exited 0. add now reports it, with any secret removed.
  • wai conform on Windows handed its command line to cmd with escaped quotes, so every case failed. This was already on main. It now uses raw_arg under /S /C, with a test.
  • wai key create printed "(mode 0600)" on Windows. Output, help, catalogue and changelog now say what is true.

Verified

  • macOS, real keychain: a test drives /usr/bin/security against a scratch keychain, with no production knob and never the login keychain, including the secret never appearing in an argument: 1 passed. Five planted faults were caught; the search list is unchanged after every run. .github/workflows/wai-key-keychain.yml runs it, on macos, only when dx/key.rs or that workflow changes in a pull request.
  • Windows x86_64, by hand: cargo test --no-default-features --features quickstart --bin wai --test cli_key --test cli_toolchain: exit 0 (61, 14, 6). A key in C:\Users\Public holds one entry; widening it with icacls is refused with exit 3 and no output; the command the error names restores signing. Eight planted faults were caught.
  • Linux x86_64 build host: the catalogue, cli_* suites under each feature set, wai breaking, wai ops export --check, the doors check, lockfiles, and public-text checks all pass. Thirteen planted faults on the keystore were caught.

Limits

  • The Windows tests are not in CI; only the decision logic's portable tests run on Linux.
  • Not run: a locked keychain, wai key create end to end against the login keychain, a non-elevated Windows session, a second Windows account actually denied, a non-English Windows.
  • The seed is not encrypted on any system. A keystore directory that already exists keeps its own list; its files are still restricted.
  • wai package build still hands --key to wai-pack, which reads a file, and the other tools keep their own key commands.
  • wai conform's catalogue usage still says <file>, left to avoid #642; a one-line follow-up after it merges.
  • origin_per_peer_limit in cli_http failed once at load about 57 and passed every rerun. This branch doesn't touch the origin code.

The changelog entries are in wai/changes/2026-11-05-*.

🤖 Generated with Claude Code

Closed: Landed as direct commits on main, ending at 23d515131, under the working model of 2026-11-06. 115 of 117 checks passed. The two others, cargo-class corpora on linux-arm64 and independent verifiers, ran on one arm64 runner and their logs stop mid-run with only passing lines, while the forge was refusing runners' results (deadline_exceeded), so neither is proven either way. Both run again on main's nightly schedule. Before landing, on the rebased tree: ops export --check, registry export --check, the doors check, and the catalogue, registry and CLI tests all passed on a build host.

`wai key`: a developer's signing keys in one keystore, used by name across the toolchain. Also `wai --version`, two more doors onto what `wai mcp` already answers, and what a version of the toolchain promises. ## `wai key` `create`, `import`, `list`, `show`, `rotate`, `revoke` and `export`, in the catalogue, needing the `quickstart` feature. Every operation takes `--json`; those that change something take `--dry-run`; `--yes` is never implied. Each `<name>.json` record (`wai.key/1`) holds public halves only, and no operation prints a secret. Where the secret goes: - **macOS:** the login keychain, through `/usr/bin/security`, with the secret on standard input and never in an argument. - **Elsewhere:** a seed file readable only by this account. One that others can read is refused, exit 3, `key-file-exposed`. - **Windows:** the seed, the record and any keystore directory `wai` makes get this account as owner and as the only entry, with inheritance off, from the call that creates them, so a keystore in a shared folder gets the same result. Lists are read by SID. `--key <name>` now works on enrolment, channel import, contract, statement, opportunity, upscale, tonemap, encode, `http seal-playlist` and `conform`. A path that exists is still read as a file first. ## Also here - `wai --version [--json]`: version, catalogue and registry digests, the standard's release, envelope formats, build features. - `wai docs search` and `wai registry show`: each runs the same tool as `wai mcp`, and a test holds the two doors' answers equal. - `wai/VERSIONING.md` and `wai/DEPRECATIONS.md`, with a test holding the list to the catalogue both ways. `--confirm` prints one deprecation line. - The help banner reads `wai — the .WAI™ toolchain.` ## Found by running on the real platforms, and fixed - `security -i` exits with the failing command's status; the stand-in always exited 0. `add` now reports it, with any secret removed. - `wai conform` on Windows handed its command line to `cmd` with escaped quotes, so every case failed. This was already on main. It now uses `raw_arg` under `/S /C`, with a test. - `wai key create` printed "(mode 0600)" on Windows. Output, help, catalogue and changelog now say what is true. ## Verified - **macOS, real keychain:** a test drives `/usr/bin/security` against a scratch keychain, with no production knob and never the login keychain, including the secret never appearing in an argument: 1 passed. Five planted faults were caught; the search list is unchanged after every run. `.github/workflows/wai-key-keychain.yml` runs it, on `macos`, only when `dx/key.rs` or that workflow changes in a pull request. - **Windows x86_64, by hand:** `cargo test --no-default-features --features quickstart --bin wai --test cli_key --test cli_toolchain`: exit 0 (61, 14, 6). A key in `C:\Users\Public` holds one entry; widening it with `icacls` is refused with exit 3 and no output; the command the error names restores signing. Eight planted faults were caught. - **Linux x86_64 build host:** the catalogue, `cli_*` suites under each feature set, `wai breaking`, `wai ops export --check`, the doors check, lockfiles, and public-text checks all pass. Thirteen planted faults on the keystore were caught. ## Limits - The Windows tests are not in CI; only the decision logic's portable tests run on Linux. - Not run: a locked keychain, `wai key create` end to end against the login keychain, a non-elevated Windows session, a second Windows account actually denied, a non-English Windows. - The seed is not encrypted on any system. A keystore directory that already exists keeps its own list; its files are still restricted. - `wai package build` still hands `--key` to `wai-pack`, which reads a file, and the other tools keep their own key commands. - `wai conform`'s catalogue usage still says `<file>`, left to avoid #642; a one-line follow-up after it merges. - `origin_per_peer_limit` in `cli_http` failed once at load about 57 and passed every rerun. This branch doesn't touch the origin code. The changelog entries are in `wai/changes/2026-11-05-*`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- **Closed:** Landed as direct commits on main, ending at 23d515131, under the working model of 2026-11-06. 115 of 117 checks passed. The two others, cargo-class corpora on linux-arm64 and independent verifiers, ran on one arm64 runner and their logs stop mid-run with only passing lines, while the forge was refusing runners' results (deadline_exceeded), so neither is proven either way. Both run again on main's nightly schedule. Before landing, on the rebased tree: ops export --check, registry export --check, the doors check, and the catalogue, registry and CLI tests all passed on a build host. 
key.create, key.list, key.show, key.rotate, key.revoke, key.import and
key.export join the catalogue. One keystore: --keystore, $WAI_KEYSTORE, or
~/.config/wai/keys, mode 0700. Each key is a record of public halves
(wai.key/1), its secret in the login keychain on macOS, through
/usr/bin/security on standard input, or in a seed file of mode 0600
elsewhere. No operation prints a secret.

A version's status is the key log's (jwp-receipts 7.2), rotation follows
7.6, a published test seed is refused on import unless named one (7.8), and
wai key export gives what wai-keys takes.

--key takes a key's name on enrolment create, channel import, contract
create and accept, statement create and check, opportunity create, upscale
run, tonemap run, encode avc and hevc, http seal-playlist and conform. A path
that exists is still read as a key file first.

Not folded: package build, which hands --key to wai-pack, and the other
tools' own key verbs. The keychain path ran against a stand-in for its tool,
not against macOS's: the gates run on Linux.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai --help opens with "wai — the .WAI™ toolchain." The command name, the
crate names and identifiers such as .wai stay ASCII with no mark. No test or
snapshot pins the line.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
toolchain.show is wai --version: this binary's version, the SHA-256 of the
catalogue's export and of the registry, the release of the standard with the
envelope formats it reads, and the build features it holds. A test holds the
crate, the export and the changelog's newest release to one version.

docs.search and registry.show gain a command line, each running the tool wai
mcp serves, and a test holds the two doors' answers equal.

wai/VERSIONING.md and wai/DEPRECATIONS.md state what is public, what holds it
in CI and how a change is announced, and a test holds the list to the
catalogue. --confirm now says it is deprecated, in one line on standard error.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
A macOS test drives /usr/bin/security through Keychain::with_tool and a wrapper
that names a scratch keychain on every command it passes on: an item kept, read
back, replaced through -U and removed, no secret on any process argument, exit
44 read as none. It removes the scratch keychain in every case, a failure
included, and holds the search list and the default keychain to what they were.
It never names the login keychain, and needs no dialog.

What the real tool does that the stand-in did not: security -i exits with the
status of a command that failed in it, where the stand-in always exited 0. add
now reports that status and what the tool said, with any secret removed from
it, rather than reading it as "holds another secret". The stand-in does the same
now.

wai-key-keychain.yml runs this test alone on the macOS runner, for a pull
request whose own diff changes dx/key.rs or the workflow.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
On Windows wai printed "mode 0600" beside a seed file that has no mode. A seed
there is a plain file: wai sets no access list, checks none and encrypts
nothing, so only what the file inherits from its directory protects it. The
command's output, its help, the catalogue and the changelog entry now say so,
and a test holds the output to the system it runs on.

Two tests assumed Unix: the keystore's path written with forward slashes, and a
command line quoted with single quotes, which quote nothing to cmd. The path
test also covers %APPDATA%\wai\keys on Windows.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
The command adapter gave cmd its line through Command::arg, which escapes the
quotes quote() writes, so each placeholder's path reached the implementation
with quotes in it and every case failed. It now goes with raw_arg under /S /C,
so a quoted program first works too. Found running cli_key on Windows; a test
there holds both forms.

Also: with_tool is only compiled for the tests that use it, on Unix.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai key on Windows: a seed for this account alone, and refused when another may read it
Some checks failed
WAI Studio / Studio in Chromium and Firefox · macos (pull_request) Failing after 11m58s
Details
wai-sink-swift native sink package / libwai slices, desktop tests, simulator tests · macos (pull_request) Successful in 18m59s
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Successful in 3m19s
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Successful in 2m18s
Details
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Successful in 4m55s
Details
joule-moq-remote host agent / joule-moq-remote, every target (linux-arm64) (pull_request) Successful in 1m45s
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Successful in 4m11s
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Successful in 19s
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Successful in 16m45s
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Successful in 17s
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Successful in 31s
Details
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 20m15s
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Successful in 1m55s
Details
WAI examples / WAI examples · android-app · linux-arm64 (pull_request) Successful in 5m51s
Details
WAI conformance / each feature of the independent verifiers' steps compiles alone (pull_request) Successful in 12m8s
Details
WAI HTTP delivery / HTTP corpus · falsify mutations 2/3 (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · falsify patches 0/3 (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · falsify patches 1/3 (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · falsify patches 2/3 (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · verified both ways, and the differential (pull_request) Has been cancelled
Details
WAI HTTP delivery / cache rules · controls and labelled caches (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · falsify mutations 1/3 (pull_request) Has been cancelled
Details
WAI HTTP delivery / HTTP corpus · falsify mutations 0/3 (pull_request) Has been cancelled
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Has been cancelled
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
wai-pack / wai-pack · linux-arm64 (pull_request) Has been cancelled
Details
wai-pack / wai-pack · independent verifier (Python) (pull_request) Has been cancelled
Details
wai-pack / wai-pack · the floor through a media prober (pull_request) Has been cancelled
Details
wai-pack / wai-pack · dependency licences (pull_request) Has been cancelled
Details
wai-sink-android native sink library / the JNI layer and the platform-free half on the host JVM · linux-arm64 (pull_request) Has been cancelled
Details
562f424446 
A seed in a shared folder got the folder's list, and wai signed with it. Now the
seed, the record and a keystore wai makes have this account as owner and as their
one entry, with inheritance off, wherever they are. The call that makes the file
carries the list (CreateFileW with its security descriptor), so the secret never
exists on disk under anything wider, and no handle can be held open from a moment
when it did. Unix was already so: open with O_CREAT|O_EXCL and mode 0600. A test
now holds that too.

A seed whose list grants any other account anything, or that another account owns,
is refused with the same exit 3 and key-file-exposed as a wide mode on Unix, naming
the file, the accounts and the icacls command that fixes it. Everything is by SID,
read through the system's calls and never from icacls' output, which is localised.

SYSTEM and Administrators are not listed: a backup or a scanner reads through its
privileges rather than the list, an administrator can still take ownership, and the
account itself reads the file elevated or not.

All the unsafe code is in win_acl.rs, behind cfg(windows). What decides is ordinary
code over plain values, so its tests run on every system. windows-sys 0.61 was
already in all sixteen lockfiles that hold this crate; each gains one line.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
The catalogue gained the key, toolchain and docs operations, and Studio's
src/actions.generated.js has to be regenerated whenever it changes:
node scripts/actions.mjs in wai/wai-studio. CI's check and the Studio unit test
both read it, and both failed.

Changelog: none

Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai dev's test: the stand-in room service listens without a reverse lookup
Some checks failed
wai-sink-swift native sink package / libwai slices, desktop tests, simulator tests · macos (pull_request) Successful in 15m33s
Details
WAI Studio / Studio in Chromium and Firefox · macos (pull_request) Successful in 17m20s
Details
WAI examples / WAI examples · portable · linux (pull_request) Successful in 42m35s
Details
wai-quantum studio and desktop / desktop app · windows (pull_request) Successful in 9m0s
Details
wai-quantum WebGPU member / member · GPU, Vulkan (jetson-hub) (pull_request) Successful in 22m52s
Details
joule-moq-remote host agent / joule-moq-remote, every target (linux-arm64) (pull_request) Successful in 2m15s
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Successful in 9m4s
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Successful in 4m17s
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Successful in 3m14s
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Successful in 1m6s
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Successful in 4m26s
Details
WAI conformance / each feature of the independent verifiers' steps compiles alone (pull_request) Successful in 19m37s
Details
WAI examples / WAI examples · android-app · linux-arm64 (pull_request) Successful in 11m35s
Details
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 18m15s
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Failing after 40m11s
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Successful in 21m21s
Details
WAI HTTP delivery / HTTP corpus · falsify patches 0/3 (pull_request) Successful in 23m19s
Details
WAI HTTP delivery / HTTP corpus · falsify mutations 1/3 (pull_request) Successful in 43m13s
Details
WAI HTTP delivery / HTTP corpus · falsify mutations 0/3 (pull_request) Successful in 43m46s
Details
WAI HTTP delivery / HTTP corpus · falsify mutations 2/3 (pull_request) Successful in 43m21s
Details
WAI HTTP delivery / HTTP corpus · verified both ways, and the differential (pull_request) Successful in 4m10s
Details
WAI HTTP delivery / cache rules · controls and labelled caches (pull_request) Successful in 8m7s
Details
wai-pack / wai-pack · linux-arm64 (pull_request) Successful in 3m37s
Details
wai-sink-android native sink library / the JNI layer and the platform-free half on the host JVM · linux-arm64 (pull_request) Successful in 5m27s
Details
wai-pack / wai-pack · the floor through a media prober (pull_request) Successful in 1m4s
Details
wai-pack / wai-pack · dependency licences (pull_request) Successful in 4m58s
Details
wai-pack / wai-pack · independent verifier (Python) (pull_request) Successful in 10m14s
Details
WAI HTTP delivery / HTTP corpus · falsify patches 1/3 (pull_request) Successful in 26m45s
Details
WAI HTTP delivery / HTTP corpus · falsify patches 2/3 (pull_request) Successful in 25m44s
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Failing after 1h51m4s
Details
6467f3f42e 
tests/cli_studio.rs failed on every run on one macOS runner and passed on
every other runner, 3 of 3 against 19 of 19 on 5 November, with "the room
service's clock on the relay: not within 30 s".

The stand-in room service starts an HTTPServer, whose server_bind calls
socket.getfqdn before the server listens. On that host, under the runner's
Python 3.15.2, getfqdn("127.0.0.1") takes 35 s, past the 30 s wai dev waits, and
a stack dump of the stalled stand-in shows it there. The stand-in relay opens a
plain socket and answers in 0.1 s. Nothing here reads the name, so the fixture
no longer asks for it.

On that host and Python the room stand-in took 35.5 s and now takes 0.12 s. A
socket.getfqdn planted to stall for 40 s fails the test without this change,
with the same message, and passes with it.

Changelog: none

Co-Authored-By: Claude Opus 5.5 <[email protected]>
dcharlot closed this pull request 2026-11-06 17:17:39 -05:00
Some checks failed
joule-code conformance gate / joule-moq-relay, its own energy on a counter (macos) (pull_request) Successful in 29s
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Successful in 9s
Details
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Successful in 11s
Details
wai-app and Create / wai-app · does this change touch it (pull_request) Successful in 9s
Details
joule-moq-remote host agent / joule-moq-remote · does this change touch it (pull_request) Successful in 12s
Details
WAI breaking changes and the conformance runner / WAI breaking · does this change touch WAI (pull_request) Successful in 11s
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Successful in 14s
Details
WAI conformance / does this change touch it (pull_request) Successful in 9s
Details
WAI energy receipts / does this change touch it (pull_request) Successful in 10s
Details
WAI operation catalogue / does this change touch it (pull_request) Successful in 10s
Details
wai-audit collector and player integration / does this change touch it (pull_request) Successful in 14s
Details
WAI examples / WAI examples · does this change touch them (pull_request) Successful in 7s
Details
wai-fleet service / does this change touch it (pull_request) Successful in 8s
Details
WAI HTTP delivery / WAI HTTP · does this change touch it (pull_request) Successful in 8s
Details
WAI JPEG-AI whole decode (pinned inputs, required) / does this change touch it (pull_request) Successful in 6s
Details
wai-ledger service / does this change touch it (pull_request) Successful in 10s
Details
wai-key-proxy / does this change touch it (pull_request) Successful in 12s
Details
WAI neural sink gates / does this change touch it (pull_request) Successful in 12s
Details
wai-quantum for JavaScript / does this change touch it (pull_request) Successful in 12s
Details
wai key · the real keychain / does this change touch it (pull_request) Successful in 16s
Details
wai-quantum WebGPU member / does this change touch it (pull_request) Successful in 11s
Details
wai-ops-gpu integer operators on GPUs / does this change touch it (pull_request) Successful in 15s
Details
wai-sink-android native sink library / does this change touch it (pull_request) Successful in 11s
Details
wai-pack / wai-pack · does this change touch it (pull_request) Successful in 15s
Details
wai-sink-swift native sink package / does this change touch it (pull_request) Successful in 11s
Details
wai-quantum studio and desktop / does this change touch it (pull_request) Successful in 15s
Details
WAI Studio / does this change touch it (pull_request) Successful in 8s
Details
wai-web reach builds / wai-web reach · does this change touch it (pull_request) Successful in 7s
Details
wai-web wasm32 / does this change touch it (pull_request) Successful in 6s
Details
WAI mbt2018_mean integer decode (regenerated vectors) / does this change touch it (pull_request) Successful in 21s
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Successful in 3m18s
Details
wai-quantum WebGPU member / member · DX12 and Vulkan (cbio-windows) (pull_request) Successful in 12m50s
Details
WAI conformance / fast integer kernels, every x86_64 kernel set (AVX-512 silicon) (pull_request) Successful in 2m53s
Details
wai-quantum WebGPU member / member · integrated GPU, Vulkan (framework-128gb) (pull_request) Successful in 7m46s
Details
wai-quantum WebGPU member / member · GPU, Vulkan (thor) (pull_request) Successful in 25m49s
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Successful in 4m10s
Details
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Successful in 6m1s
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Successful in 5m31s
Details
wai-app and Create / wai-app · tests, clippy, the line language's verifier (linux) (pull_request) Successful in 30s
Details
WAI breaking changes and the conformance runner / WAI breaking · wire, record and API against main · linux (pull_request) Successful in 1m22s
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Successful in 59s
Details
joule-moq-remote host agent / joule-moq-remote, every target (macos) (pull_request) Successful in 2m6s
Details
WAI conformance / faces from keypoints under wasm32-wasip2 (wasmtime) (pull_request) Successful in 1m58s
Details
WAI HTTP delivery / HTTP corpus · every patch and mutation in exactly one shard (pull_request) Successful in 5s
Details
WAI breaking changes and the conformance runner / WAI breaking and conform · their tests, and the independent verifiers through wai conform · linux (pull_request) Successful in 3m39s
Details
wai-audit collector and player integration / collector · linux (pull_request) Successful in 2m5s
Details
wai-key-proxy / proxy · linux (pull_request) Successful in 1m16s
Details
WAI neural sink gates / the exact JPEG-AI decoder reports its path (pinned inputs, required) (pull_request) Successful in 2m5s
Details
wai-ledger service / service · linux (pull_request) Successful in 3m43s
Details
WAI neural sink gates / model-free refusals of the neural sink (pull_request) Successful in 3m56s
Details
WAI operation catalogue / the catalogue and every door · linux (pull_request) Successful in 6m8s
Details
wai-pack / wai-pack · linux (pull_request) Successful in 2m4s
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Successful in 30s
Details
WAI Studio / the catalogue's actions, the unit tests and the core · linux (pull_request) Successful in 58s
Details
wai-quantum WebGPU member / shader checks · browser build · wasip2 inertness (pull_request) Successful in 3m24s
Details
standards workspaces build + test / macOS energy backends (pull_request) Successful in 6m4s
Details
wai-quantum WebGPU member / member · software Vulkan (linux) (pull_request) Successful in 3m52s
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Successful in 10m44s
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Successful in 1m39s
Details
wai-ops-gpu integer operators on GPUs / builds · no adapter is not a pass (linux) (pull_request) Successful in 6m19s
Details
WAI JPEG-AI whole decode (pinned inputs, required) / fetch pinned JPEG-AI inputs → whole decode + pixel hash, required (pull_request) Successful in 10m30s
Details
wai-audit collector and player integration / collector, player integration and the browser end to end · macos (pull_request) Successful in 1m56s
Details
wai-fleet service / service · linux (pull_request) Successful in 10m13s
Details
wai-web reach builds / wai-web reach builds · the package of record, every output as recorded (pull_request) Successful in 2m47s
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Successful in 15m27s
Details
wai-fleet service / service · macos (pull_request) Successful in 57s
Details
wai-quantum studio and desktop / studio · browser (pull_request) Successful in 6m0s
Details
wai key · the real keychain / the real keychain · macos (pull_request) Successful in 39s
Details
wai-ledger service / service · macos (pull_request) Successful in 1m2s
Details
wai-quantum studio and desktop / desktop app · linux (pull_request) Successful in 6m7s
Details
wai-app and Create / wai-app · Create, browser end-to-end (macos) (pull_request) Successful in 13m1s
Details
wai-web reach builds / wai-web reach builds · this tree's wai-web, every rung on its engine line (pull_request) Successful in 5m20s
Details
wai-quantum for JavaScript / javascript · linux (pull_request) Successful in 11m10s
Details
WAI energy receipts / energy receipts · linux (pull_request) Successful in 14m6s
Details
wai-quantum WebGPU member / member · Metal (macos) (pull_request) Successful in 2m44s
Details
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Successful in 8m39s
Details
WAI conformance / cargo-class corpora · macos (pull_request) Successful in 14m0s
Details
WAI conformance / cargo-class corpora · linux (pull_request) Successful in 21m13s
Details
WAI Studio / Studio in WebKit · linux (pull_request) Successful in 12m41s
Details
wai-pack / wai-pack · macos (pull_request) Successful in 3m3s
Details
WAI mbt2018_mean integer decode (regenerated vectors) / regenerate mbt2018_mean integer vectors → Rust decode, required (pull_request) Successful in 8m51s
Details
wai-quantum WebGPU member / member · browser WebGPU (macos) (pull_request) Successful in 8m8s
Details
wai-sink-android native sink library / every ABI, the AAR, and the instrumented tests in a headless emulator · macos (pull_request) Successful in 7m3s
Details
wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Successful in 10m53s
Details
wai-quantum studio and desktop / desktop app · macos (pull_request) Successful in 4m31s
Details
WAI examples / WAI examples · the archive, the readiness check, the browser and Apple · macos (pull_request) Successful in 16m49s
Details
WAI energy receipts / energy receipts · macos (pull_request) Successful in 19m53s
Details
wai-sink-swift native sink package / libwai slices, desktop tests, simulator tests · macos (pull_request) Successful in 15m33s
Details
WAI Studio / Studio in Chromium and Firefox · macos (pull_request) Successful in 17m20s
Details
WAI examples / WAI examples · portable · linux (pull_request) Successful in 42m35s
Details
wai-quantum studio and desktop / desktop app · windows (pull_request) Successful in 9m0s
Details
wai-quantum WebGPU member / member · GPU, Vulkan (jetson-hub) (pull_request) Successful in 22m52s
Details
joule-moq-remote host agent / joule-moq-remote, every target (linux-arm64) (pull_request) Successful in 2m15s
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Successful in 9m4s
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Successful in 4m17s
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Successful in 3m14s
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Successful in 1m6s
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Successful in 4m26s
Details
WAI conformance / each feature of the independent verifiers' steps compiles alone (pull_request) Successful in 19m37s
Details
WAI examples / WAI examples · android-app · linux-arm64 (pull_request) Successful in 11m35s
Details
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 18m15s
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Failing after 40m11s
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Successful in 21m21s
Details
WAI HTTP delivery / HTTP corpus · falsify patches 0/3 (pull_request) Successful in 23m19s
Details
WAI HTTP delivery / HTTP corpus · falsify mutations 1/3 (pull_request) Successful in 43m13s
Details
WAI HTTP delivery / HTTP corpus · falsify mutations 0/3 (pull_request) Successful in 43m46s
Details
WAI HTTP delivery / HTTP corpus · falsify mutations 2/3 (pull_request) Successful in 43m21s
Details
WAI HTTP delivery / HTTP corpus · verified both ways, and the differential (pull_request) Successful in 4m10s
Details
WAI HTTP delivery / cache rules · controls and labelled caches (pull_request) Successful in 8m7s
Details
wai-pack / wai-pack · linux-arm64 (pull_request) Successful in 3m37s
Details
wai-sink-android native sink library / the JNI layer and the platform-free half on the host JVM · linux-arm64 (pull_request) Successful in 5m27s
Details
wai-pack / wai-pack · the floor through a media prober (pull_request) Successful in 1m4s
Details
wai-pack / wai-pack · dependency licences (pull_request) Successful in 4m58s
Details
wai-pack / wai-pack · independent verifier (Python) (pull_request) Successful in 10m14s
Details
WAI HTTP delivery / HTTP corpus · falsify patches 1/3 (pull_request) Successful in 26m45s
Details
WAI HTTP delivery / HTTP corpus · falsify patches 2/3 (pull_request) Successful in 25m44s
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Failing after 1h51m4s
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
Transaction-Science/open-standards!656
No description provided.