### `wai breaking` and `wai conform`: the compatibility gate, and conformance anyone can run

- **`wai breaking --against <git-ref>`** (operation `compat.check`) reports what the working
  tree breaks against a ref, in three cumulative categories, strictest by default: **wire** (the
  registry export: capabilities and their classes, deterministic identifiers, wire identifiers;
  the media and delivery corpora), **record** (the domain-separation prefixes, magics and
  versions records are built from; the corpora of signed records and their verdicts; the
  published JSON Schemas) and **API** (the Rust public API of `wai` and `wai-quantum`, read from
  the compiler's rustdoc JSON; the C header `wai-rs/include/wai.h`; the room service's OpenAPI
  document). It compares against the merge base of the ref and `HEAD`. Each finding names its
  item, its category, what changed and why that breaks; additions are listed as compatible.
- **An intended break passes only when this file names it**: a line the change adds here, in
  an entry that says **Breaking**, with the finding's id (as `wai breaking` prints it, such as
  api:c:wai_envelope_pack) in backticks. Otherwise the run exits 1.
- **`.github/workflows/wai-breaking.yml`** runs it on every pull request that touches WAI,
  against main. WAI's libraries go to public registries behind this gate.
- **`wai conform <kind> --suite <suite> --impl <command or URL>`** (operation
  `conformance.run`) runs one of WAI's corpora against another implementation: verifiers
  (`claim`, `jwp`, `signer`), a decoder (`score`), a packager (`policy`) and an origin
  (`http`). A command-line adapter gives each case as a file (`{case}`, `{in}`), the corpus
  whole (`{corpus}`), or standard input, and reads the answer from standard output or `{out}`;
  an HTTP adapter posts each case to a URL, or, for an origin, fetches from it. Every
  expectation is the corpus's own.
- **The result is a signed record**, `conform-result/1` (`*.wai-conform.json`): the corpus
  digest, the implementation (its command and the SHA-256 of each file it names, or its URL),
  each case's outcome, the summary and the standard's version, signed with Ed25519 by a key
  made for the run or one given with `--key`. **`wai verify`** checks its signature and that its
  summary and verdict are what its cases say. CI runs the corpora's independent Python
  verifiers and the reference packager through it.
- **[conformance-results](extensions/conformance-results.md)** specifies the record: its
  members (§2) and corpus digest (§2.1), its signing input (the domain `wai:conform-result` and
  `0x01`, then the record without `sig` in RFC 8785 form) and Ed25519 signature under SPEC §7's
  strict rule (§3), what a verifier checks and in what order (§4) and the codes it refuses with
  (§5). `conform-result/1` is registered as a document kind. The reference is the `wai-rs`
  module `conform_result` (feature `conform_result`, which `quickstart` includes); the corpus,
  [`conform-result-conformance/`](conform-result-conformance/), holds accepted records and
  refused ones (a case flipped, the corpus digest changed, the summary alone changed, a bad
  signature, `S` past L, a key of small order, a summary or verdict that disagrees with its
  cases though signed, an unknown version, members missing, added or named twice, a count with
  a fraction, a digest out of form, bytes that are not JSON), generated by
  `wai_conform_result_vectors`; its second implementation is `conform_result_verify.py`.
- **Measurements are not compared**: `wai breaking` leaves out the corpus files it lists as
  records of a measured run (the external decodes of the format probes, the relay's recorded
  metering run), each with its reason; the vectors built from them are still compared.
- Both follow the toolchain's agent rules: the JSON envelope `envelope/1` with `--json`, one
  exit status for each outcome (0 held, 1 a check failed, 2 usage, 4 a record would be replaced
  without `--yes`, 5 not found, 6 the implementation does not answer, 7 internal), and
  `wai conform --dry-run`.

