# live-conformance/ledger — the receipt ledger

The corpus of [`extensions/receipt-ledger.md`](../../extensions/receipt-ledger.md) §11, in one
file, `vectors.json`:

- `sources`: the sources the vectors bill from, by name, each a source document of §5.1;
- `vectors`: verification documents (§7.1), each a `tariff`, an `invoice`, the `previous`
  invoice or `null`, and the names of its `sources` in order, with the `outcome` §7.3 gives it;
- `keys`: the seller's, the buyers' and the two delivering parties' public keys.

**Ledger equivalence.** For each vector, a conforming verifier given its tariff, its invoice, its
previous invoice and its sources, resolved by name, reaches the outcome the vector states:

- `refuse`: the `reason` and where, `at`: `["tariff"]`, `["tariff", "seller"]` or `["tariff",
  "buyer"]`, `["invoice"]`, `["previous"]`, `["source", k]` for source `k`, or `["source", k, …]`
  followed by the place the source's own extension gives (live-metering §5.1, settlement §8.2,
  packaging §9, live-ads §9.2);
- `accept`: the invoice's `digest`, its `tariff`, `currency`, `start` and `end`, the number of
  `records`, each line (its source kind, source, unit, quantity, price, amount and the records it
  `cites`, each `[kind, identity]`), each energy row (scope, class, figures, joules and
  `max_ppm`), the `unmetered` figures and `coverage` of each scope, the `amount`, and the
  `reports` of §8: `ads`, one per ads source, and `delivery`, the parties and their overlaps.

The accepted vectors:

- `a_day`: one day's invoice over a lesson room, two delivering parties (one viewer acknowledges
  part of one object from both, in windows that overlap; one party serves a fetch free; the other
  declares delivery to viewers with no key), a viewer that forwarded sealed objects and states no
  tariff of its own, a package, ads under a policy that requires presentation claims and under one
  that does not;
- `the_next_invoice`: the next invoice of the chain, over a relay's session whose hop is
  unmetered (its room energy is partial) and a second package;
- `room_hops_of_three_classes`: a room whose hops are a model, a counter and an estimate, under a
  tariff of its own: one row each;
- `streams_stitched_by_others`: presentations of ads another party stitched, from three vectors
  of [`stitched/`](../stitched/) (`hls_stitched`; `form1_prefetch`, whose form-1 receipt states
  its own quartiles and spend beside the presented ones; and `squeezeback`, a shared break whose
  sessions' own claims are not all presented), under a tariff whose ad scope is the stitchers
  that corpus accepts; its report is stitched-presentation §7.5's statement, unchanged;
- `jobs_routed_and_served` (version 2, §4.5): a month of media jobs routed by the route corpus's
  router, beside a package, under a tariff of version 2 that prices `wai.video.int_motion` per job
  and per subpixel and `wai.video.av1` per job: the served `int_motion` jobs are billed from their
  billed hop and their output's decode receipt (`work_pixel_ops`); the failover is billed at the
  fallback's price; the job served past its deadline and the one every allowed hop failed bill
  nothing; the jobs' energy is the serving hops' figures, a counter row and a model row, and the
  job whose serving hop was unmetered is counted unmetered (coverage partial);
- `jobs_priced_per_operation` (version 3, §4.6): the same jobs under a tariff of version 3, which
  prices each job by its serving capability and its operation, with a decode of
  `wai.video.int_motion` beside the encodes: the encodes and the decode are billed per job and per
  subpixel at their own prices, and the failover at the fallback's encode price;
- `a_rerun_billed` (version 3, §6.9): the next invoice of that chain bills `job-0001` run again
  two days later, a new route record and a new hop receipt, its output the decode receipt the first
  invoice already lists: the work is billed once, and the output is the evidence, cited again;
- `one_output_under_two_hops` (version 3): `job-0001` and its re-run in one invoice: both billed,
  the output receipt they share cited once and its subpixels billed for each hop;
- `an_operation_the_tariff_does_not_price` (version 3): a tariff that prices `int_motion`'s encode
  and not its decode: the decode bills nothing, and its hop's energy is stated;
- `version_2_routes_under_version_3` (version 3, §5.1): jobs routed under the route record's
  version 2, its price book pricing each operation apart with measured failures and each served
  hop stating its outputs: an encode, a failover whose failed hop was metered, billed at the
  endpoint that served, a decode, a hop past the deadline and three that failed, which bill
  nothing, and a failover whose failed hop's figure states no class, which version 3 does not
  read; each output receipt is of the clip its hop states it delivered;
- `version_4_by_the_byte_and_the_work` (version 4, §4.7): the lesson room's receipt of version 2
  ([`metering/`](../metering/)'s `bytes_out_priced`) billed by its bytes out beside its time, a
  package listed, no storage yet, and the run of `package.build` that made it (`package_run`)
  billed per run and per work unit of the package, its receipt cited, and those jobs at their own
  prices, with every hop's energy: the billed hops' in `jobs`, the failed and late hops' in
  `unbilled_hops`, one of them unmetered;
- `version_4_storage_held_through_a_period` (version 4): the next invoice of that chain bills the
  package the first holds for the byte-days of its own period, and the same package made again by
  a new run (`package_run_again`), its work billed again and its receipt cited again, beside a
  second package listed;
- `version_5_a_decode_held_to_its_frames` (version 5, §4.8): an `int_motion` decode
  (`job_v5_decode`) whose served hop states it delivered one animated PNG of the clip's frames,
  its receipt re-derived from the codestream it read and each frame's samples hashing to the
  receipt's frame, billed at the decode's prices beside an encode held to its codestream as in
  version 4. The animation is written here by `png_still::encode_animation` from the clip the
  decode reads, and each refused animation is that one with one rule broken, its chunks
  rewritten with good CRCs.
- `route_record_3_outputs_proved_among_what_was_delivered` (route-record §3.4, §6.1; §5.1
  here): jobs routed here under the route record's version 3, whose served hops state what they
  delivered by its count and root, each output giving its inclusion proof: an encode
  (`job_v3r_encode`) whose clip is the second of two objects, a decode of version 5
  (`job_v3r_decode`) whose animation is its one object, and a package's run
  (`package_run_v3r`) whose receipt is the first of 1,501 objects, the rest standing for the
  package's own; billed under the tariff of version 5.

Every other vector is refused, a control of one defect: each reason of §10, the reused codes, and a
refusal of each source kind by its own extension.

**Provenance.** Generated here: `wai_receipt_ledger_vectors gen` writes `vectors.json` from fixed
seeds (the seller, the buyers, the two delivering parties, their viewers and objects) and from
sources taken unchanged from the corpora of the extensions the ledger reads: rooms and their
receipts from [`metering/`](../metering/) (`lesson`, `mixed_classes`, `receipt_bad_signature`,
`relay_recorded`, `bytes_out_priced`), the forwarding viewer's statement and the room its hop records name from
[`settlement/`](../settlement/), ad rooms from [`ads/`](../ads/) (`live_break`, `gap`) and
[`presentation/`](../presentation/) (`video_rule`, `ceiling_exceeded_by_presented`), streams
stitched by others from [`stitched/`](../stitched/) (`hls_stitched`, `form1_prefetch`,
`squeezeback`, with the
manifests, responses and receipts they name, by their bytes), media jobs from
[`routes/`](../routes/) (`served_first_try`, `failover_after_a_server_error`,
`served_after_the_deadline`, `served_by_an_unmetered_hop`, `every_allowed_survivor_failed`,
`served_by_a_hop_whose_figure_states_no_class`, `a_failed_hop_billed`,
`an_unknown_energy_ranks_last`), each `int_motion` job's output a decode receipt sealed here over
`wai-rs/tests/vectors/int_video/int_video_bitstream.wiv1`; the version-3 jobs (`job_decode`,
`job_rerun`, `job_rerun_replays_its_hop`, `job_claims_another_hop`) routed here by that corpus's
router under its price book and policy, their hop receipts sealed under its hop key, the replayed
and the claimed one being `served_first_try`'s own; the jobs of version 2 (`job_v2_*`) routed
here by that router under the route corpus's price book of version 2, and the runs of
`package.build` (`package_run*`) under a price book of version 2 of its own; and the
packages `video-base-01` and `video-staged-01` of
[`pack-conformance/packs/`](../../pack-conformance/packs/). When one of those corpora is
regenerated, so is this one. Nothing here was fetched from outside the repository.

Regenerate and check:

    cd wai/wai-rs
    cargo run -q --no-default-features --features receipt_ledger --bin wai_receipt_ledger_vectors -- gen ../live-conformance/ledger
    cargo run -q --no-default-features --features receipt_ledger --bin wai_receipt_ledger_vectors -- verify ../live-conformance/ledger
    cargo test -q --no-default-features --features receipt_ledger --test receipt_ledger
    python3 -I ../live-conformance/receipt_ledger_verify.py ../live-conformance/ledger

The second implementation, `receipt_ledger_verify.py`, shares no code with `wai-rs`. It verifies
each source with the second implementation of that source's own corpus, recomputes every line,
citation, row and report, requires every mutated copy of the corpus to fail, and requires the corpus
to catch it with each of its own checks dropped.