### WAI's own conformance records, signed with WAI's key, published by CI

- **`wai/quickstart/conformance-records.sh`** runs WAI's own implementations through the
  conformance runner as wai-breaking.yml's runner job does (the five independent verifiers, the
  reference packager, the native sink through its module and its C interface, the score
  renderer, the browser sink, the integer-synthesis decoder, a cache in front of the reference
  origin, and the reference relay at drafts 22, 18 and 16): one record a run, each naming its
  version `<wai version>+<commit>`, signed with the seed in `WAI_CONFORMANCE_SEED` (`"key":
  "supplied"`) and admitted by `wai verify --conformant` against the checkout's corpus. It packs
  them as `wai-conformance-<label>.tar.gz`, with a `MANIFEST.json` naming the commit, the standard
  and the signer's public key, and the pack's SHA-256.
- The runs are made from a folder holding `bin/` and a link to `wai/`, each program found through
  PATH's relative `bin`, so a record names `bin/<program>` and `wai/<path>` and no path of the
  machine that ran it (conformance-results §8). A record that holds a path under `/Users/`,
  `/Volumes/`, `/home/`, `/private/` or `/tmp/`, or a `python3` found there, stops it.
- Without the seed it prints one notice and writes nothing: a key made for a run says nothing of
  who ran it. A seed that is not one, or the test key conform-result-conformance publishes,
  stops it with nothing written; the runner job plants all three on every change.
- **CI publishes them.** A push to main keeps the pack as the run's artefact
  `wai-conformance-records`; a `wai-v*` tag attaches `wai-conformance-<version>.tar.gz` and its
  `.sha256` to the release, uploaded to the forge directly (job `conformance` of
  wai-release.yml). Both run once the repository secret `WAI_CONFORMANCE_SEED` is set; until
  then each says so in one notice and publishes nothing.