open-standards/wai/live-conformance/ledger/README.md

live-conformance/ledger — the receipt ledger

The corpus of extensions/receipt-ledger.md §11, in one file, vectors.json:

• sources: the sources the vectors bill from, by name, each a source document of §5.1;
• vectors: verification documents (§7.1), each a tariff, an invoice, the previous invoice or null, and the names of its sources in order, with the outcome §7.3 gives it;
• keys: the seller's, the buyers' and the two delivering parties' public keys.

Ledger equivalence. For each vector, a conforming verifier given its tariff, its invoice, its previous invoice and its sources, resolved by name, reaches the outcome the vector states:

• refuse: the reason and where, at: ["tariff"], ["tariff", "seller"] or ["tariff", "buyer"], ["invoice"], ["previous"], ["source", k] for source k, or ["source", k, …] followed by the place the source's own extension gives (live-metering §5.1, settlement §8.2, packaging §9, live-ads §9.2);
• accept: the invoice's digest, its tariff, currency, start and end, the number of records, each line (its source kind, source, unit, quantity, price, amount and the records it cites, each [kind, identity]), each energy row (scope, class, figures, joules and max_ppm), the unmetered figures and coverage of each scope, the amount, and the reports of §8: ads, one per ads source, and delivery, the parties and their overlaps.

The accepted vectors:

• a_day: one day's invoice over a lesson room, two delivering parties (one viewer acknowledges part of one object from both, in windows that overlap; one party serves a fetch free; the other declares delivery to viewers with no key), a viewer that forwarded sealed objects and states no tariff of its own, a package, ads under a policy that requires presentation claims and under one that does not;
• the_next_invoice: the next invoice of the chain, over a relay's session whose hop is unmetered (its room energy is partial) and a second package;
• room_hops_of_three_classes: a room whose hops are a model, a counter and an estimate, under a tariff of its own: one row each;
• streams_stitched_by_others: presentations of ads another party stitched, from three vectors of stitched/ (hls_stitched; form1_prefetch, whose form-1 receipt states its own quartiles and spend beside the presented ones; and squeezeback, a shared break whose sessions' own claims are not all presented), under a tariff whose ad scope is the stitchers that corpus accepts; its report is stitched-presentation §7.5's statement, unchanged;
• jobs_routed_and_served (version 2, §4.5): a month of media jobs routed by the route corpus's router, beside a package, under a tariff of version 2 that prices wai.video.int_motion per job and per subpixel and wai.video.av1 per job: the served int_motion jobs are billed from their billed hop and their output's decode receipt (work_pixel_ops); the failover is billed at the fallback's price; the job served past its deadline and the one every allowed hop failed bill nothing; the jobs' energy is the serving hops' figures, a counter row and a model row, and the job whose serving hop was unmetered is counted unmetered (coverage partial);
• jobs_priced_per_operation (version 3, §4.6): the same jobs under a tariff of version 3, which prices each job by its serving capability and its operation, with a decode of wai.video.int_motion beside the encodes: the encodes and the decode are billed per job and per subpixel at their own prices, and the failover at the fallback's encode price;
• a_rerun_billed (version 3, §6.9): the next invoice of that chain bills job-0001 run again two days later, a new route record and a new hop receipt, its output the decode receipt the first invoice already lists: the work is billed once, and the output is the evidence, cited again;
• one_output_under_two_hops (version 3): job-0001 and its re-run in one invoice: both billed, the output receipt they share cited once and its subpixels billed for each hop;
• an_operation_the_tariff_does_not_price (version 3): a tariff that prices int_motion's encode and not its decode: the decode bills nothing, and its hop's energy is stated;
• version_2_routes_under_version_3 (version 3, §5.1): jobs routed under the route record's version 2, its price book pricing each operation apart with measured failures and each served hop stating its outputs: an encode, a failover whose failed hop was metered, billed at the endpoint that served, a decode, a hop past the deadline and three that failed, which bill nothing, and a failover whose failed hop's figure states no class, which version 3 does not read; each output receipt is of the clip its hop states it delivered;
• version_4_by_the_byte_and_the_work (version 4, §4.7): the lesson room's receipt of version 2 (metering/'s bytes_out_priced) billed by its bytes out beside its time, a package listed, no storage yet, and the run of package.build that made it (package_run) billed per run and per work unit of the package, its receipt cited, and those jobs at their own prices, with every hop's energy: the billed hops' in jobs, the failed and late hops' in unbilled_hops, one of them unmetered;
• version_4_storage_held_through_a_period (version 4): the next invoice of that chain bills the package the first holds for the byte-days of its own period, and the same package made again by a new run (package_run_again), its work billed again and its receipt cited again, beside a second package listed;
• version_5_a_decode_held_to_its_frames (version 5, §4.8): an int_motion decode (job_v5_decode) whose served hop states it delivered one animated PNG of the clip's frames, its receipt re-derived from the codestream it read and each frame's samples hashing to the receipt's frame, billed at the decode's prices beside an encode held to its codestream as in version 4. The animation is written here by png_still::encode_animation from the clip the decode reads, and each refused animation is that one with one rule broken, its chunks rewritten with good CRCs.
• route_record_3_outputs_proved_among_what_was_delivered (route-record §3.4, §6.1; §5.1 here): jobs routed here under the route record's version 3, whose served hops state what they delivered by its count and root, each output giving its inclusion proof: an encode (job_v3r_encode) whose clip is the second of two objects, a decode of version 5 (job_v3r_decode) whose animation is its one object, and a package's run (package_run_v3r) whose receipt is the first of 1,501 objects, the rest standing for the package's own; billed under the tariff of version 5.
• version_6_a_third_partys_usage_per_endpoint (version 6, §4.9): a third party's jobs, each third_party record naming what the provider bills, billed per job and by that usage at its endpoint's price: gen.alpha (job_tp_alpha), gen.beta (job_tp_beta), a failover whose failed hop's billed usage reaches no line (job_tp_failover), a job given no record, billed by the job alone (job_tp_unrecorded), one in another unit at that unit's price (job_tp_images), and one in a unit no price names (job_tp_a_unit_no_price_names).
• version_6_holds_what_version_5_holds: the encode, decode and package run of version 5's route records of version 3, at prices of any endpoint.
• version_6_an_upscale_and_a_tone_mapping: an upscale of two pictures (job_upscale) and two tone mappings, one of whose records states two pictures of one rendering (job_tonemap_two_pictures_of_one_rendering), each re-derived from what it read; and version_6_an_upscale_run_again, the next invoice, billing the upscale's new hop and citing its records again.
• version_6_re_derived_jobs_under_a_list: an upscale and a tone mapping whose route records are of version 2, so that no output gives a proof.

Every other vector is refused, a control of one defect: each reason of §10, the reused codes, and a refusal of each source kind by its own extension.

Provenance. Generated here: wai_receipt_ledger_vectors gen writes vectors.json from fixed seeds (the seller, the buyers, the two delivering parties, their viewers and objects) and from sources taken unchanged from the corpora of the extensions the ledger reads: rooms and their receipts from metering/ (lesson, mixed_classes, receipt_bad_signature, relay_recorded, bytes_out_priced), the forwarding viewer's statement and the room its hop records name from settlement/, ad rooms from ads/ (live_break, gap) and presentation/ (video_rule, ceiling_exceeded_by_presented), streams stitched by others from stitched/ (hls_stitched, form1_prefetch, squeezeback, with the manifests, responses and receipts they name, by their bytes), media jobs from routes/ (served_first_try, failover_after_a_server_error, served_after_the_deadline, served_by_an_unmetered_hop, every_allowed_survivor_failed, served_by_a_hop_whose_figure_states_no_class, a_failed_hop_billed, an_unknown_energy_ranks_last), each int_motion job's output a decode receipt sealed here over wai-rs/tests/vectors/int_video/int_video_bitstream.wiv1; the version-3 jobs (job_decode, job_rerun, job_rerun_replays_its_hop, job_claims_another_hop) routed here by that corpus's router under its price book and policy, their hop receipts sealed under its hop key, the replayed and the claimed one being served_first_try's own; the jobs of version 2 (job_v2_*) routed here by that router under the route corpus's price book of version 2, and the runs of package.build (package_run*) under a price book of version 2 of its own; the third party's jobs (job_tp_*), the upscales (job_upscale*) and the tone mappings (job_tonemap*) routed here by that router, the upscales derived under the prior generic.wsr of live-conformance/upscale/priors/ and the tone mappings' envelopes written by exact-tonemap's corpus encoder; and the packages video-base-01 and video-staged-01 of pack-conformance/packs/. When one of those corpora is regenerated, so is this one. Nothing here was fetched from outside the repository.

Regenerate and check:

cd wai/wai-rs
cargo run -q --release --no-default-features --features receipt_ledger --bin wai_receipt_ledger_vectors -- gen ../live-conformance/ledger
cargo run -q --release --no-default-features --features receipt_ledger --bin wai_receipt_ledger_vectors -- verify ../live-conformance/ledger
cargo test -q --no-default-features --features receipt_ledger --test receipt_ledger
python3 -I ../live-conformance/receipt_ledger_verify.py ../live-conformance/ledger

The second implementation, receipt_ledger_verify.py, shares no code with wai-rs. It verifies each source with the second implementation of that source's own corpus, recomputes every line, citation, row and report, requires every mutated copy of the corpus to fail, and requires the corpus to catch it with each of its own checks dropped.