name: wai cross-architecture byte-equality

# The `replicate` determinism contract, checked on real silicon. WAI claims its
# integer-exact decode paths (rANS entropy coder, integer fixed-point synthesis)
# produce BYTE-IDENTICAL output on every machine. This matrix proves it: every
# OS/arch leg of the matrix below decodes the same fixtures and asserts the same golden
# bytes — rANS streams produced by CompressAI's upstream encoder, and an
# int_synth output hash produced on the reference machine (macOS arm64). One
# diverging byte anywhere fails the suite.
#
# Coverage is still-image AND temporal, classical AND learned: the rANS coder,
# integer fixed-point synthesis, the JPEG-AI entropy stage, the inter-frame video
# decoder (`wai.video.int_motion`), and the neural-keyframe variant
# (`wai.video.int_hyper`) whose I-frame comes out of a learned conditional codec,
# and the MLIC++-topology codec (`wai.neural.int_mlicpp`), whose entropy network runs
# before every checkerboard pass and must give every platform the encoder's scale
# bucket for every element. The binary payloads SPEC §5 pins (WIV1, WIH1) are parsed
# with the wire parser a sink runs and decoded to the same digests, and the staged-delivery
# residual layers (WIR1) of the staged corpus are applied stage by stage to pinned digests.
# Video is the strictest leg — inter-frame decode is a
# feedback loop, so one divergent half-pel rounding does not stay one byte, it
# predicts the next frame and compounds for the rest of the clip.
#
# The conformance crate (`wai/byte-exact-conformance`) #[path]-includes the
# pure-integer sources from wai-rs — no system codec libraries, no ONNX runtime
# — so every leg runs in about a minute.

# One run per branch at a time. A push supersedes the run before it.
#
# There is one `macos` runner and it is the dev Mac, so every macOS job in this
# repo queues on it. With no concurrency group, a session pushing four versions
# of a branch queued four complete sets of runs and every one of them had to
# drain: on 2026-10-05 a PR's 21 contexts settled none in 70 minutes behind a
# backlog of 25 runs, and the queue grew faster than it cleared. Only the newest
# commit's verdict is wanted, so the older runs are cancelled.
#
# Verified on this forge (Forgejo 16.0.5) in `ci-test` before being added here:
# the key parses, and a newer push moves an older run to `cancelled` even while
# it is still queued, which is the case that matters.
#
# `cancel-in-progress: true` also applies to `main`. That is deliberate and
# safe here: main advances by merge commits whose tree contains the commits
# before them, so the newer run covers the older one's changes.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  pull_request:
    paths:
      - 'wai/byte-exact-conformance/**'
      - 'wai/wai-rs/src/neural/int_synth.rs'
      - 'wai/wai-rs/src/neural/jpegai_mans.rs'
      # Every source the crate #[path]-includes must be able to fire this
      # workflow, or a change can break cross-arch equality and merge green.
      - 'wai/wai-rs/src/int_synth.rs'
      - 'wai/wai-rs/src/int_entropy.rs'
      - 'wai/wai-rs/src/jpegai_mans.rs'
      - 'wai/wai-rs/src/rans.rs'
      - 'wai/wai-rs/src/int_video.rs'
      - 'wai/wai-rs/src/int_transform.rs'
      - 'wai/wai-rs/src/int_hyper_synth.rs'
      - 'wai/wai-rs/src/int_mlicpp.rs'
      - 'wai/wai-rs/src/int_payload/wire.rs'
      - 'wai/wai-rs/src/staged/predict.rs'
      - 'wai/wai-rs/src/staged/wir1.rs'
      - 'wai/wai-rs/src/staged/wir1_arith.rs'
      - 'wai/staged-conformance/**'
      # The fast kernels int_synth, int_transform and int_hyper_synth dispatch to
      # by default: the goldens here decode through them.
      - 'wai/wai-rs/src/int_kernels.rs'
      - 'wai/wai-rs/tests/vectors/int_video/**'
      - 'wai/wai-rs/tests/vectors/int_hyper/**'
      - 'wai/wai-rs/tests/vectors/int_mlicpp/**'
      - '.github/workflows/wai-byte-equality.yml'
  push:
    branches:
      - main
    paths:
      - 'wai/byte-exact-conformance/**'
      - 'wai/wai-rs/src/neural/int_synth.rs'
      - 'wai/wai-rs/src/neural/jpegai_mans.rs'
      # Every source the crate #[path]-includes must be able to fire this
      # workflow, or a change can break cross-arch equality and merge green.
      - 'wai/wai-rs/src/int_synth.rs'
      - 'wai/wai-rs/src/int_entropy.rs'
      - 'wai/wai-rs/src/jpegai_mans.rs'
      - 'wai/wai-rs/src/rans.rs'
      - 'wai/wai-rs/src/int_video.rs'
      - 'wai/wai-rs/src/int_transform.rs'
      - 'wai/wai-rs/src/int_hyper_synth.rs'
      - 'wai/wai-rs/src/int_mlicpp.rs'
      - 'wai/wai-rs/src/int_payload/wire.rs'
      - 'wai/wai-rs/src/staged/predict.rs'
      - 'wai/wai-rs/src/staged/wir1.rs'
      - 'wai/wai-rs/src/staged/wir1_arith.rs'
      - 'wai/staged-conformance/**'
      # The fast kernels int_synth, int_transform and int_hyper_synth dispatch to
      # by default: the goldens here decode through them.
      - 'wai/wai-rs/src/int_kernels.rs'
      - 'wai/wai-rs/tests/vectors/int_video/**'
      - 'wai/wai-rs/tests/vectors/int_hyper/**'
      - 'wai/wai-rs/tests/vectors/int_mlicpp/**'
      - '.github/workflows/wai-byte-equality.yml'

jobs:
  byte-equality:
    name: ${{ matrix.label }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        # Self-hosted fleet labels, not hosted images. macos-x86_64 is
        # dropped: no Intel-Mac runner exists in the fleet, and by the same
        # argument the cargo-classes matrix already makes, it adds no arch
        # coverage — x86_64 is held by linux-x86_64, arm64 by linux-aarch64
        # and the macos-arm64 reference.
        # Windows x86_64 leg removed 2026-09-30: runner offline. Restore by
        # re-adding `- { os: windows, label: windows-x86_64 }` here once the
        # runner is back online.
        include:
          - { os: linux,       label: linux-x86_64 }
          - { os: linux-arm64, label: linux-aarch64 }
          - { os: macos,       label: macos-arm64 (reference) }
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # unix: bootstrap rustup (docker image ships no Rust; macOS host has it but
      # launchd's PATH omits ~/.cargo/bin). Windows is a host executor with rustup
      # already present, and must use pwsh — its `bash` is the WSL stub.
      - name: Install Rust 1.98.0 (unix)
        if: matrix.os != 'windows'
        shell: bash
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          command -v rustup >/dev/null 2>&1 || \
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.98.0
          rustup toolchain install 1.98.0 --profile minimal
          rustup default 1.98.0
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      - name: Install Rust 1.98.0 (Windows)
        if: matrix.os == 'windows'
        shell: pwsh
        run: |
          rustup toolchain install 1.98.0 --profile minimal
          rustup default 1.98.0

      - name: Decode fixtures, assert golden bytes
        working-directory: wai/byte-exact-conformance
        run: cargo test --release -- --nocapture