# wai-quantum-views

The engine inside WAI Quantum's views for agent hosts. A host that draws
interactive views (the Model Context Protocol's extension
`io.modelcontextprotocol/ui`, version 2026-01-26) draws a tool's answer from a
`ui://wai-quantum/*` resource: one self-contained page, in a sandboxed frame,
with no network (`wai_quantum::engine::views`). The page draws what the
server's engine computed. What it computes itself, the check of the receipt
of what it shows, it computes with this crate: the engine's own
`job::verify`, built for WebAssembly and, from the WebAssembly, translated to
JavaScript, since a host's content-security policy may refuse to compile
WebAssembly (the extension's default policy does) while the page's own script
runs.

The interface has no imports: `wq_alloc` a buffer, write a request (JSON)
into it, `wq_call` it, and read the answer (JSON) at `wq_out`. The requests are
`{"op": "verify", "job": {"request", "result"}}` (the answer `{"valid", "key",
"signer"}`) and `{"op": "version"}`.

## Building the page

```sh norun=ci:wai-quantum-views.yml
cd wai/quantum-studio && npm ci     # binaryen, pinned, and esbuild
bash wai/wai-quantum-views/build.sh # writes wai/wai-quantum/views/
```

`build.sh` builds this crate for `wasm32-unknown-unknown` (paths remapped out
of the binary), optimises it for size and translates it to JavaScript with
binaryen, and runs `wai/quantum-studio/build-views.mjs`, which bundles the
views (`wai/quantum-studio/src/views/`, from the Studio's components) and
writes the page and its `manifest.json`: each part's size and SHA-256, and
every source with its SHA-256. The page is 654 KB: the script 94 KB (the
Studio's English words among it), the styles 50 KB, and the engine, 335 KB as
WebAssembly and 684 KB as JavaScript, each carried raw-deflated (156 KB and
226 KB; 208 KB and 301 KB in base64) and inflated by the page with the
platform's `DecompressionStream`. The JavaScript, which runs only where a host's
policy refuses WebAssembly, is then run as an inline script of the page's own.
Every view is held under 1 MiB.

On x86_64 Linux with Rust 1.98.0 the build gives the same bytes in a clean CI
image. The engine's bytes change when anything in `wai-quantum` changes (its
code is laid out anew), so CI holds the page's script and styles to their
sources and warns of an engine to rebuild; the scripted host
(`wai/quantum-studio/test/views.test.mjs`) holds the committed page's engine,
in both forms, to the receipts the current servers seal.

## Tests

`cargo test --release` here: a sealed job verifies through the three exports,
a changed count or verdict does not, and a compile's certificate verifies.
CI: `.github/workflows/wai-quantum-views.yml`.