b912d6faa8
Two seams the tree could not express, both surfaced by the landscape survey.
CAPABILITY CONSTRAINTS. WAI dispatch treats support as binary — a sink either
claims a capability or does not. Real sinks support a codec TO A LEVEL: up to a
resolution, a frame rate, a bit depth, a profile. "This capability, but only to
4K60 10-bit, this profile" is the normal case and was unexpressible, so partial
support failed at DECODE time rather than SELECTION time, and rendition selection
had nothing to evaluate and deferred to a deployer policy the spec never states.
Ingests the constraint-set grammar and register pattern from AMWA's ratified
Receiver/Sender Capabilities work (BCP-004-01 / -02, v1.0.0) — ORed sets of
enum/min/max constraints over register-named parameters. Grammar and pattern
only: not the transport, not the discovery model, and explicitly NOT the
pre-flight negotiation framing, because capability-plus-budget binding before
execution is already owned by JCP and two mechanisms for one job is worse than
none.
The honest limit is stated in §3 rather than hidden: the ratified registers are
broadcast-essence-shaped and cover only WAI's conventional media families. There
are no entries for neural, quantum, world or haptic, and WAI must author those
itself — until it does, those capabilities remain unconstrained, which is the
true state rather than a pretended one.
UNIDIRECTIONAL DELIVERY. Three assumptions quietly presume the sink can talk
back: jwp-receipts assumes relay-chain linkage, targeting presumes the source
learns something about the sink, and pre-emption has no signer class because
nothing in WAI has needed to assert authority over a sink before. Terrestrial
broadcast, satellite and multicast object carriage break all three, and none is
repaired by defining a bearer.
* Sink-evaluated predicates (§2): the object carries a condition the SINK
evaluates against local state the source never learns, under a
predicate-equivalence contract in the shape of state-feeds §3. The
specifiable property is determinism and auditability, NOT enforcement —
every sink receives every byte and can lie about its own state, and this
text says so. The real claim is narrow and worth having: the source learns
nothing, which is the dual of source-side targeting.
* Authority and pre-emption (§3): pre-emption is the highest-authority
instruction a media object can carry — it displaces what a person chose to
watch — and today an object either lacks the field or has one anyone may
set. Requires a sink-held trust anchor provisioned out of band; a trust
anchor delivered over the bearer it authorises is not one. A valid signature
establishes who signed, never that they were entitled to.
* Detached receipts (§4): the deliverable is an honest profile, not a proof.
Such receipts attest WHAT WAS TRANSMITTED, not what was received or
rendered, and MUST declare the bearer unidirectional. No receipt can prove
rendering over a bearer with no return path; what this prevents is the
quieter error of a receipt saying "delivered" because a transmitter
transmitted, on a link that cannot tell it whether anyone was listening.
Generalised from deployed national early-warning systems, which are where a sink
evaluating a condition the source never learns has had to work at scale.
Ingest queue items 10 and 11 (#80 §4.2, §4.3).
Co-Authored-By: Claude Opus 5 <[email protected]>
4.7 KiB
WAI Extension: Unidirectional Delivery
Status: Draft. Covers bearers with no return path — terrestrial broadcast, satellite, and multicast object carriage — where the sink receives and can never answer. Generalised from deployed national early-warning systems, which are the only place these seams are currently exercised at scale. WAI defines no bearer here and none of this requires one. Keywords MUST, MUST NOT, SHOULD, MAY are RFC 2119/8174.
1. What breaks without a return path
Three assumptions in the tree quietly presume the sink can talk back:
jwp-receiptsassumes relay-chain linkage throughout, and a chain implies hops that report.- Targeting presumes the source can learn something about the sink.
- Pre-emption — an object that must displace what is playing — has no signer class, because nothing in WAI has needed to assert authority over a sink before.
None of these is repaired by defining a bearer. Each is a seam that can be specified transport-independently, and each is specified below at the strength it actually holds — which in one case is considerably weaker than it looks.
2. Sink-evaluated predicates
A predicate capability carries, in the object, a condition the sink evaluates against locally-held state the source never learns. The canonical deployed instance is geographic: an object is relevant to a region, the receiver holds its own location, and the source is told nothing.
The determinism contract is predicate-equivalence, in the shape
state-feeds §3 uses: two conforming sinks holding the same
local state MUST reach the same verdict on the same predicate.
- A predicate MUST be a total function of the object and the sink's declared state class. A predicate that can consult anything else is not evaluable twice.
- A predicate MUST NOT be able to cause a request. The moment evaluation emits a signal, the privacy property is gone and this is ordinary targeting.
The specifiable property is determinism and auditability, not enforcement. Every sink on the bearer receives every byte, and a sink can lie about its own state. Nothing here prevents that and nothing here should claim to. The real claim is narrow and worth having: the source learns nothing — which is the dual of source-side targeting, where the source learns everything and the sink is told nothing.
3. Authority and pre-emption
Pre-emption is the highest-authority instruction a media object can carry: it displaces what a person chose to watch. WAI has no signer class for it, so today an object either has no such field or has one anyone may set.
- An object asserting pre-emption MUST carry a priority field and be signed by a key the sink holds in a trust anchor for that assertion.
- The trust anchor MUST be sink-held and provisioned out of band. A trust anchor delivered over the bearer it authorises is not a trust anchor.
- A sink MUST NOT act on pre-emption from an unanchored key, and MUST NOT treat a valid signature alone as authority — signature validity establishes who signed, never that they were entitled to.
- Authority MUST NOT be inferred from position in the delivery chain. The entity that transmits is not thereby entitled to interrupt.
4. Detached receipts
A unidirectional bearer cannot carry a receipt back, so jwp-receipts'
relay-chain model does not apply. The deliverable is an honest profile, not a
proof:
- A publisher MAY emit receipts for objects sent over a unidirectional bearer, and those receipts attest what was transmitted, not what was received and not what was rendered.
- Such a receipt MUST declare the bearer as unidirectional, so a relying party cannot mistake transmission for delivery.
- A sink MAY retain object commitments and reconcile them out of band later.
A reconciliation MUST be reported as a
claimof classbinding-recovery-style provenance, never folded into the publisher's chain as though it had been a hop.
No receipt can prove rendering over a bearer with no return path. This section does not attempt it. What it prevents is the quieter error: a receipt that says "delivered" because the transmitter transmitted, on a link that cannot tell it whether anyone was listening.
5. Framing
These seams are exercised today in national early-warning deployments, which is where a sink evaluating a condition the source never learns has had to be made to work at scale. The mechanisms are worth having for that reason and not only that one: a container that can only describe two-way delivery cannot describe broadcast, and broadcast is not a legacy case.