open-standards/joule-code/CHANGELOG.md

Changelog

All notable changes to the Joule Code standard are recorded here. The format follows the spirit of Keep a Changelog; the standard versions independently of its siblings (tags joule-code-vX.Y.Z).

[Unreleased]

Added — joule-moq-relay closes a window at one cut across relays, hands over its counts by session, and drains its summaries

• One cut across relays (WAI live-metering §3.8, §3.10). A window ends, track by track, at a cut: the first group of the window after it. close on the operator's surface closes the window and answers the relay's own cut (Relay::flush, Relay::cut); the operator joins the cuts of the relays that carry a room (window::Cut::join, the greatest by track) and each seals at the join (Relay::seal_at, Relay::seal_after), refusing a cut below its own (cut_too_early). A group first seen while a closed window waits for its cut is counted under a provisional window, placed at the seal with every count of it. Every relay then counts each group in the same window, their records of each link chain window by window, and an edge rides through a window's end with no GOAWAY to its viewers. flush answers the cut it sealed at, and cut_sha256.
• A window's counts by session. window (Relay::window_statement) answers a sealed window's parts, its cut and its DVR writes, signed with the relay's summary key (joule-moq-relay/window/1, over joule-moq-relay:window\x01), optionally of one room. SignedWindow::check_record holds a room's record over the window to the parts it recomputes from (metering::counts_over), refusing parts that do not give it (parts_mismatch), and window::link_chain holds two relays' statements of their link to each other.
• Summaries drained, and bounded (src/outbox.rs). Each ended session's signed summary is held, numbered, until the operator acknowledges it (summaries, ack; Relay::drain_summaries, Relay::ack_summaries). At most summary.held_max (65536) in memory; past it they are appended to summary.spill_path, synced, read back by the drain and handed over again after a restart unless acknowledged (<spill_path>.acked); with no spill file, or a write that fails, each is held all the same and new sessions are refused summaries_unacknowledged until enough is acknowledged. /metrics adds wai_relay_summaries_held, _spilled, _spill_failed_total, _unreadable and _refusing.
• Changed: a relay past 65536 unacknowledged summaries with no spill file refuses new sessions; Relay::summaries is the summaries not yet acknowledged; relay::Window has a cut; Track::window_of takes the relay's clock; a group arriving after a flush below its cut counts in the window the flush closed.
• tests/window_cuts.rs holds each against a planted fault: parts raised, left out, changed or of another window refused against the record; a core and two edges sealed at one cut chain exactly over their links, an edge sealed at its own cut caught in both windows, a cut below the core's own refused; an edge's viewer sent no GOAWAY across two window ends, a restarted edge's GOAWAY caught; an acknowledged summary freed, an acknowledgement of what was not handed out refused, every summary past the bound held and new sessions refused, and the spill file read back across a restart with nothing acknowledged handed over twice.

Added — the browser sink page as a WAI conformance record

• joule-moq-web/web/binding/sink.html answers each call of WAI's browser-sink corpus (wai/live-conformance/browser) in the page: the normative parts by wai-live-web's wasm, the side table by the page's own web/room/binding.js, each answer one JSON text in RFC 8785 form. e2e/conform_sink.mjs drives it in a browser and is wai conform sink --suite browser's HTTP adapter for it; with --wai it runs the conformance runner itself, signs the record (named for the page and the browser's version) and admits it with wai verify --conformant. --plant turns every frame the page shows as refused into one shown as verified: that run must fail at frames/object_refused, and its record be refused at admission rule 2. e2e/run.sh runs both as its conform step, in the browser the other scenarios use.

Added — the interop client as a relay's conformance runner, and its sessions closed before it exits

• joule-moq-interop is the client wai conform relay --suite moqt holds a relay to the interop cases with: one run a case at the draft given, its TAP version 14 read as the record's cases. Its test names are the corpus's (wai/moqt-conformance/cases.json), in its order.
• Fixed: joule-moq-interop closes every session before its next test and before it exits. A test closed its sessions, but the close was a CONNECTION_CLOSE queued for the QUIC endpoint's driver, and a run of one test (--test, as the interop runner and wai conform run it) exited before the driver sent it. The relay kept the session until its idle timeout, with the namespace it had published, and the next run's subscribe-before-announce and announce-subscribe reached that dead publisher: against wai-relay they failed at drafts 22, 18 and 16 run a test a process. Each test's endpoints are now closed and waited idle (a WebTransport session's close is given 250 ms), and every case passes at each draft over QUIC and WebTransport.

Security — joule-moq-ingest takes str0m 0.25.0: its WebRTC stack holds no crypto-bigint 0.5

• str0m =0.24.1 → =0.25.0 (with str0m-rust-crypto 0.7, str0m-proto 0.8 and dimpl 0.9). 0.24.1's DTLS ran on p256 and p384 0.13 over elliptic-curve 0.13, which holds crypto-bigint at 0.5.5 (RUSTSEC-2026-0387: secret-dependent branches in operations meant to be constant-time), and no 0.5 release is patched. 0.25.0's run on p256 and p384 0.14 over elliptic-curve 0.14 and crypto-bigint 0.7.10, so cargo tree -p joule-moq-ingest -i [email protected] matches nothing. The 0.5.5 copy left in this workspace's lock and in joule-moq-room's comes through openmls (joule-moq-mls, and joule-code-collab's tests), not the gateway.
• The gateway's code is unchanged: none of 0.25.0's breaking changes (the bandwidth estimator's set_bitrate, the removed SDP merge() and video reordering timeout, VP9 picture ids of 64 bits) reaches an API it calls. Every crate new to the lockfiles is MIT or Apache-2.0.
• The README's WebRTC section said the stack links no C library. It builds one, aws-lc, before and after this change: dimpl's certificate feature makes each session's DTLS certificate with rcgen on aws-lc-rs. It now says so.

Fixed — a start refused part way, and a task ended past the shutdown's bound, leave no port bound: joule-moq-ingest, joule-moq-relay, joule-contrib

• GatewayServer::start bound HTTP, spawned the HTTP and SRT accept loops, then bound RTMP, RTMPS and the injector's port. Refused at any of those (the port held, the RTMPS identity, the injector's grant), its ? dropped the loops' handles, which leaves the tasks running: the SRT loop waits for a shutdown that never comes, so the HTTP and SRT ports stayed bound for the life of the process and every later start failed "Address already in use". It now binds every port and makes every check before it spawns anything, and closes the SRT listener (whose task runs from its bind) when the injector, last, is refused.
• RelayServer::start spawned each QUIC endpoint's accept loop before binding the WebSocket listener, and the control surface after; refused at either, it left the endpoint and its UDP socket running (a WebSocket refusal) or told the tasks to go without waiting (a control refusal). Each retry of a start that waits out a port another process holds then failed on the UDP port its own first try kept. A refused start is now shut down as a relay is before its error returns. Control::start refused part way (the socket path) closes the TCP listener it had started.
• A session still dialing the relay at a gateway's shutdown was in no list the shutdown ends, and a dial lasts up to 10 s, past the 5 s the shutdown waits for its tasks: it was ended without its record. The dial now ends at the stop, and the session ends at once and signs its record, gateway_stopped, with nothing published (Publisher::detached).
• A RIST listener held by a task the shutdown ends past its bound was dropped unclosed, which only tells its receiver to go: the shutdown returned with its port bound. rist::RistCloser (from RistListener::closer) closes a listener from outside the task that holds it; the gateway keeps one for each RIST listener its tasks hold (Gateway::hold_rist) and closes them once its tasks have ended. contrib::serve_rist serves a RIST session at its listener, held so; /rist uses it.
• New tests/start_ports.rs (gateway and relay) hold each refused start from a task on a runtime of one worker; two new tests in the gateway's tests/shutdown_ports.rs hold the dialing session and the held listener, and one in joule-contrib's tests/listener_close.rs the closer. Each failed before.
• These tests, and the rest of listener_close, take fixed ports below the range a system hands out for port 0. A port first handed out for port 0 can go to any socket on the host the moment a close lets it go: on a shared Linux host, 5 of 1000 runs of listener_close failed so, the unchanged SRT check among them.

Fixed — a shutdown returns with its ports free: joule-moq-ingest, joule-moq-relay, joule-contrib

• GatewayServer::shutdown aborted its accept tasks (HTTP, RTMP, RTMPS, SRT) and never awaited them, and left its connections and RIST sessions running, so it returned with its ports still bound: a gateway started again at once on the same ports, from a spawned task, failed every time with "Address already in use". It now stops listening, ends every session (each still signs its record, ended deleted), and returns once every task it ran has ended: every listener closed (the injector's too), every connection it accepted, each RIST session's ports, waiting or running. An RTMP connection mid-handshake hears the stop; a session that starts once the shutdown has begun ends at once, gateway_stopped. Gateway::stopping, Gateway::stopped and Gateway::spawn (a task the shutdown waits for) are new.
• RelayServer::shutdown now returns once every session's task has ended, its summary signed, and once its UDP sockets (each of a group), the WebSocket listener and the control listener are closed. Control::close is new; joule_moq_relay::tasks::Tasks holds the tasks a server waits for, and the gateway uses it too.
• srt::Listener::close and rist::RistListener::close return once the listener's sockets are closed (an SRT listener's connection tasks, which hold its socket, ended first, each with its SHUTDOWN sent). A drop still only tells the task to go.
• tests/shutdown_ports.rs (gateway and relay) and joule-contrib's tests/listener_close.rs hold each from a task on a runtime of one worker, many times over; each failed at its first round before.

Added — joule-moq-relay: grants that change while it runs, and records over windows of open sessions

• Grants while it runs. The rules ([auth]), the room authorities and the metered grants ([[metering.grants]]) change while the relay runs: on the operator's surface a new [control] section names (a Unix socket made mode 0600, or a TCP address on loopback, one JSON request a line: show, set, grant, withdraw, authority, drop_authority, revoke, meter, reload, flush, record), from a grants file read at start and again on SIGHUP, and through the library (Relay::set_grants and its kin). A change is checked whole and put in force at once. A session that presented a grant the change withdraws or revokes, or that holds a subscription or a publication its tokens no longer give it, is closed UNAUTHORIZED, its reason beginning grant_revoked; every other session goes on, in every room, with no GOAWAY.
• Revocation lists (WAI live-rooms §5). [[auth.revocations]] holds an authority's revoked grant digests and viewer tags. A grant either names is refused at SETUP before its proof is read, and in any request that presents it; a revocation given while the relay runs ends the sessions that presented the grant. A list only grows, and control.revocations_path keeps it across a restart.
• An authority's grants metered from the grant itself. joule-moq's GrantHead reads a grant's viewer, joules_ceiling, funds_ceiling and currency, with viewer_tag, currency_holds and currency_code, and grant_room reads a record's room. A session that proved an authority's grant runs under it with no metered grant configured, and a session holding grants for several rooms runs in each under that room's (room_grants in its summary). A grant whose funds ceiling and currency break live-rooms §4.3 is refused, grant_invalid.
• Windows of open sessions (WAI live-metering §3.8). Relay::flush closes a window at an instant with no session ended, each track cut at a group boundary; Relay::seal takes every session's counts in it a grace later; Relay::window_record, and the surface's record, sign a room's per-hop record over a sealed window with the relay's own key and meter. A session's windows sum to its summary. control.flush_interval_ms has the relay flush and seal by itself.
• A joule ceiling held at the hop (WAI live-metering §4.6). With control.hold_joule_ceilings the relay, at each seal, shares its own figure for a room it served alone in the window among that room's grants, by the bytes each moved, and ends the sessions of a grant whose shares pass its joules_ceiling, refusing its next SETUP. A funds ceiling is held by the meter that prices the room's records: the relay holds no tariff, states each grant's funds ceiling and currency in the summary and the ledger, and ends a use when the meter withdraws or revokes it.
• tests/live_control.rs holds each of these on loopback, and reads a record signed over open sessions with WAI's live-conformance/live_metering_verify.py.

Added — wai-relay --version and wai-room --version

• Each prints its own crate's version and the WAI toolchain it belongs to, the version of wai/wai-rs/Cargo.toml in the tree it was built from, and with --json the same as an envelope. wai doctor reads that to tell whether these programs and a wai agree. tests/version.rs in each crate holds both forms. Neither form starts a server. The program's other command lines are as they were.

Changed — joule-moq-room: the example's relay_url is the relay's WebSocket port, 4480

• room.example.toml named the relay at ws://127.0.0.1:9681/moq, a port nothing listens on: the relay's example, and wai-relay --dev, listen for WebSocket on 127.0.0.1:4480. The two examples now connect as shipped. relay_url has no default in code, so a deployment's own configuration is unchanged.
• tests/ports.rs holds the local stack's ports in one place: the room example's relay_url is the relay example's WebSocket endpoint and path, the ingest gateway example's [relay] addr is its QUIC endpoint and each listener it names is a row (off until set where it is commented out), the relay example's endpoints are wai-relay --dev's, wai dev's origin is the one the remote desktop template's host reaches, and the defaults of the audit collector, the ledger, the fleet service, the quantum job service, the worlds' relay, the stitched presentation verifier and wai http origin are their sources'; each is a row of the port table in WAI's quickstart README, and no port is two programs'. The room service started from its example opens its clock's session on the relay started from the relay's.
• The gateway's example is read by the gateway's own reader (GatewayConfig::from_toml; joule-moq-ingest is a dev-dependency of joule-moq-room), not as a TOML table matched by text: its relay address and each listener's come from what the gateway reads, a commented-out listener is one it reads as off and, uncommented, at its row's port, and a key the gateway renamed or stopped reading fails the test. The gateway started from its example, its ports moved to free ones and the files it names made, serves HTTP, opens RTMP, and opens none of the listeners the example leaves off.

Changed — joule-moq-ingest: the contribution link record's magic is WLK1

• Wire change. linkrec::MAGIC is WLK1 (WAI extensions/live-contribution.md §6.2), so the link record no longer shares WCL1 with WAI's clip record (live-recording §5.1), which had it first. A part written before this change is refused as malformed; nothing else in the record changes. joule-moq-ingest-link-vectors writes .wlk1 files, and adds clip_record_magic, a part bearing the clip record's magic, refused malformed.

Changed — joule-moq-relay: one object held once, and a socket that keeps what arrives

• limits.quic_socket_buffer_bytes (4 MiB by default, and for the links a relay dials too): the size asked of the kernel for the UDP socket's buffers. Each fan-out's acknowledgements arrive together, and past the buffer the kernel drops them, which reads as loss. The system caps the size (net.core.rmem_max on Linux), and the relay logs a warning when it gets less.
• An object is held once, from when it is read until the last subscriber's QUIC stream has it acknowledged: the cache, each session's queue and each QUIC send buffer share one allocation (SendStream::write_parts, SubgroupCodec::encode_object_head). The fan-out no longer copies a payload per subscriber while it holds the relay's lock. A WebTransport or WebSocket session, and a session bridged to an earlier draft, still has its own copy in its transport.
• A fan-out delivers outside the relay's lock, from a copy-on-write snapshot of its track's subscribers, so a large audience holds up no other track.
• limits.quic_sockets (0, one per core up to 16; Linux, elsewhere one): UDP sockets on the listener's one port, each its own endpoint. The kernel steers each packet by the first byte of its connection ID, and each socket's endpoint issues IDs that come back to it, so a viewer whose address changes keeps its connection, which steering by address would lose.
• examples/fanout_load.rs: one publisher, N subscribers of one track and a bystander on its own, reporting the relay's memory and CPU, what arrived and how late, and the packets the kernel dropped at each end.

Added — joule-moq-relay: relay-to-relay cascading

• [[upstream]]: relays this one dials, over native QUIC (moqt://), WebTransport (https://) or the WebSocket binding (wss://, or ws:// on a trusted path), each trusting a CA file, a pinned certificate's SHA-256 or the platform's roots, presenting a token read from a file and named by its SHA-256, and routing the namespace prefixes it lists. A link redials after its session ends, backing off to 30 seconds.
• Routing: a SUBSCRIBE, FETCH or TRACK_STATUS for a track no session of the relay publishes goes upstream once, on the first link of the configuration's order whose session is open; the subscription it makes is the relay's own, cached and fanned out to every local subscriber; a link that refuses or does not answer is passed over for the next, and when none answers the request is refused TIMEOUT with no_upstream. Namespaces published to the relay, by PUBLISH_NAMESPACE or by a track's PUBLISH, are published on every link that routes them, and a SUBSCRIBE_NAMESPACE is forwarded on every link it overlaps, the upstream's NAMESPACE and NAMESPACE_DONE merged with the relay's own.
• Loops: both ends of a link declare the Setup Option RELAY_ID (0x3A4F, the relay's summary key), the dialer proving it over the listener's challenge; every request between relays then carries RELAY_PATH (0x3A51, negotiated so, -22 §9.20), and no relay forwards a request back where it came from, to a relay on its path, or past limits.max_relay_hops; one that receives its own id is refused relay_loop.
• GOAWAY from an upstream moves the link's subscriptions to a session to the URI it names (else the link's own) and closes the old one; it is never passed on downstream. The relay's own GOAWAY on a session it dialed names no URI.
• WAI evidence at every hop: the door of every relay checks what a peer forwards; each relay's per-hop record counts a link in its track entries and not as a subscriber session or in its ledger; the floor and audience inputs are decided at the relay the performer or the author publishes to, and read for their statements alone over a link; a FETCH or a fill of a track the relay knows nothing of learns its live edge upstream first, so the seek power is held at the viewer's relay.
• joule-moq: Parameter::RelayPath and RELAY_ID_OPTION; the bridges refuse the parameter by name.
• tests/cascade.rs: two relays over each transport, a chain of three with a per-hop record at each hop, a door refusing a tampered object another relay forwarded, a loop, failover and no_upstream, GOAWAY, a DVR window fetched through an edge, and co-performance votes and the floor across relays.

Added — joule-moq: WAI envelopes on LOC objects

• joule-moq: module loc (WAI extensions/loc-carriage.md). An envelope whose payload is one WebCodecs chunk (wai.audio.opus.packet, wai.video.avc, wai.video.hevc, wai.audio.aac) is written as one object of a track of packaging loc (draft-ietf-moq-loc-04): its payload as the LOC Payload, and in the Immutable Properties the LOC properties, the manifest as WAI_MANIFEST (0x3A61) and the WAI_RECEIPT property. from_loc reads an object back into the envelope, byte for byte, refusing with the extension's codes. examples/loc_vectors.rs writes WAI's corpus live-conformance/loc/ and tests/loc_vectors.rs regenerates and checks it; WAI's loc_verify.py is its second implementation.

Added — joule-moq: draft-ietf-moq-transport-18 and -16 beside -22, and runs against other implementations' relays

• joule-moq: codec modules draft18 and draft16 (control messages, parameters, Key-Value-Pairs, subgroup, fetch and padding streams, datagrams), and draft::Draft, which chooses a session's draft before its first MOQT byte by ALPN moqt-NN or the WT-Available-Protocols value, preferring -22, then -18, then -16; -22 stays the default. draft18::bridge and draft16::bridge map every message and object to and from the -22 model and name what one draft can say and the other cannot (refused with REQUEST_ERROR, or left out and noted). The README tables each difference. Each draft has a vector corpus (tests/vectors/draft-18, tests/vectors/draft-16) that the crate regenerates and checks, and that a decoder written from that draft's text reads (moqt18_check.py, moqt16_check.py, run in CI); the drafts' own examples are among them.
• joule-moq-relay: sessions at -18 and -16 run behind transport::bridge, which presents them to the relay as -22 sessions: at -18 stream by stream, at -16 by giving each request on the control stream a stream of its own (Request IDs renumbered, MAX_REQUEST_ID granted, cancelled streams become -16's cancel messages). The client takes a draft, and the WebTransport client a TLS configuration. tests/drafts.rs runs the relay's scenario at each draft and across drafts, and sessions written from the -18 and -16 messages themselves.
• joule-moq-interop, new: the interoperability runner's test cases at -22, -18 or -16 against any relay, through the runner's test-client interface (TAP 14), and wai-receipts, which publishes a WAI track, its receipts track and a catalog through a relay and verifies every object at a second session against its receipt (inclusion, the receipts chain, the properties carried in the object), with --tamper to show the check refuses altered payloads, receipts or objects in flight. scripts/public.py runs it against the relays the runner's registry lists, scripts/clients.sh runs other implementations' test clients against joule-moq-relay, and scripts/local.sh runs both on loopback. The runs that reach the public internet are not part of CI; the results of 2026-10-21 are in joule-moq's README.

Fixed — joule-moq-relay, found by those runs

• A PUBLISH_DONE that arrives before the streams it counts no longer cuts them: the relay waits until it has read as many of the publisher's data streams as the Stream Count says, or three seconds (-22 §9.9; the request stream and data streams are not ordered).
• A track published again after TRACK_ENDED is a new instance: the ended one's cache, Largest Location and subgroup owners go, so the new publisher's objects are not dropped as duplicates (a DVR-kept track is kept whole).
• A publisher that closes its control stream as it leaves (a protocol violation) loses no object or PUBLISH_DONE it sent: the session closes once its publishing has ended, or after three seconds; the end of its session ends its tracks with the PUBLISH_DONE status already read, not GOING_AWAY.
• At -18 a requester's FIN on PUBLISH_NAMESPACE, SUBSCRIBE_NAMESPACE or SUBSCRIBE_TRACKS cancels it (-18 §6.1, §6.2), where at -22 it does not (§6.4.2.2).
• At -16 a Request ID ahead of one in flight on another stream (SUBSCRIBE_NAMESPACE rides its own) is admitted; a repeated one still closes the session.

Added — end-to-end encrypted rooms in the browser (L10b): joule-moq-web's e2ee build, the room service's log

• joule-moq-mls: a member behind a carrier that orders the room's MLS messages. stage_create and stage_commit hold the member's GroupInfo or commit until the carrier returns it (receive applies it then, checked as every member checks it); another's commit first, or a refusal, withdraws it (withdraw). Before its Welcome a principal follows the group from its handshake messages, sharing the clock's code; a Welcome for another and a GroupInfo of a group it holds are ignored. Clock::key_package_if keeps a KeyPackage only from a principal the room admitted. Feature js builds the crate for wasm32-unknown-unknown: randomness and the clock from the page's own APIs, for the MLS library and for its crypto provider's generator.
• joule-moq: a keyring holds the locations it opened by epoch, and drops them with the epoch's keys.
• joule-moq-web, feature e2ee, built as a second wasm, joule_moq_web_e2ee, under a new workspace profile wasm (release, link-time optimisation, one codegen unit, size): the member (E2eeMember: KeyPackage, lifecycle events, the log's messages in order, staged create and commit, seal and open with the reason or the epoch to wait for), the record's check, TrackSigner.signSealed (the receipt over the sealed bytes, no WAI_RECEIPT), and UniItem.properties. The room page in such a room checks the record, loads that build, leaves a KeyPackage, follows the room's log (web/room/e2ee.js), seals each frame before it is signed and published, opens each object before it is decoded, shows its epoch and roster, and offers no watching and no seeking back. e2e/room.e2e.mjs gains the e2ee scenario.
• joule-moq-room: [room] e2ee = true gives each room a WRE1 record and a clock that is the MLS group's external sender, and the room's log: GET /mls, POST /mls/key-package, POST /mls/post; GET /room carries the record.

Changed — joule-moq-relay: a session over WebTransport closes with its code and reason

• The relay closes a WebTransport session, not the QUIC connection under it (draft-ietf-moq-transport-22 §6.6): a WT_CLOSE_SESSION capsule on the CONNECT stream carries the MOQT session termination code as the session's 32-bit application error code, unmapped, and the reason (draft-ietf-webtrans-http3-16 §6); the QUIC connection closes after the peer has closed its side of that stream, or two seconds on. A page now reads the relay's code and reason over WebTransport as it does over the WebSocket binding: a grant presented without its proof, for one, is UNAUTHORIZED (2) with its live-rooms §10.5 reason, where the page saw only that the session was lost.
• Nothing of the session overtakes its close. A stream the relay lets go once a WebTransport session is closing is held until the QUIC connection has closed, so no FIN or STOP_SENDING reaches the page ahead of the capsule (a page whose stream was stopped just before the close was seen to lose its renderer); a stream the relay refuses before SETUP is kept until then too.
• A peer's close is read the same way. closed() over WebTransport gives the code and reason of the peer's WT_CLOSE_SESSION (by_peer: true), so a page's close code reaches the session's signed summary; a QUIC connection closed with the session still open gives no MOQT code (its code is HTTP/3's).
• wtransport 0.7.2 is vendored (joule-code-rs/vendor/wtransport, MIT OR Apache-2.0, patched in for the joule-code workspace and joule-moq-room), because the release reads WT_CLOSE_SESSION but cannot send it. The change gives it Connection::close_session and ConnectionError::SessionClosed, and makes closed() report the session's end; VENDORED.md lists every change and why. Its unit tests, the capsule's bytes against the draft's layout among them, run in the relay's CI job.
• Tests. tests/webtransport_close.rs: the relay refusing a grant without its proof, refusing a stream that breaks a rule before SETUP (with no STOP_SENDING ahead of the close), refusing a session past its session count, and ending one at its time limit, each read by the client as the exact code and reason; and a client's own close, recorded as the peer's in the relay's summary. The browser end-to-end check of a bare grant now requires code 2 and the reason over WebTransport too.

Added — DVR on the relay (L7b): joule-moq-relay's DVR store, the seek power, the room page's Seek back

• joule-moq-relay keeps a DVR window on disk ([dvr], [[dvr.window]]; WAI live-recording §8): every track under a window's prefix, with its receipts, a group stored once the cache holds it whole, appended to the track's current segment file (a new one every ten seconds or 16 MiB) and synced at least once a second. A window by age (at most 24 hours) and by bytes, evicted lowest group first by whole group, each media group with its receipts group, so a track's window is always one run of groups. On start every object is checked again (its own check, then its receipt, or each event record's signature): one that does not verify is dropped, counted, written out of its file, and never served. A FETCH the cache does not cover is answered from the cache and the store together where they cover it, read as the fetch stream drains; what was evicted is an End of Unknown Range. TRACK_STATUS and FETCH answer from the store once a publisher is gone.
• The seek power at the relay (WAI live-rooms §10.6): a FETCH or fill below the live edge needs an authority's grant whose powers hold bit 4, or a rule with seek = true; otherwise UNAUTHORIZED, seek_not_granted. [[auth.grants]] rules gain seek (default false).
• Moderation in the store: the relay reads decision events from the events tracks it forwards, honours a room key's (dvr.room_keys, the authorities' keys) or a moderator grant's, and withholds what deny or redact target from every FETCH and fill, erasing a redacted object from disk; the decisions are kept in decisions.wdl across a restart.
• A sealed room is never kept (WAI confidentiality §9, live-recording §8.2). The store knows the room by its first object carrying a secure-objects Key ID. That object's group is never written. The store then deletes what it held of the room (its events and receipts, in the clear) and drops the room's decisions from the log. It writes nothing more of the room, and sealed.wdl keeps it so across a restart.
• WMH1 version 2 from a relay with a store, with its DVR figures; the session summary's tracks gain dvr_objects and dvr_bytes.
• The cache, for every relay: a media group and its receipts group leave the cache together, and evicting one moves the other's mark, so a FETCH never serves media from the cache without its receipts.
• joule-moq: GrantHead reads a grant's powers (moderates, seeks); receipt::verify_strict is public.
• joule-moq-room: every role, and so every grant, holds the seek power, so a late joiner's FETCH of earlier groups is served by a relay that checks it.
• joule-moq-ingest reads roles and grants with the seek power.
• joule-moq-web: the room page's Seek back control fetches a participant's last seconds from the relay's window, verifies every object against its receipt, plays the video from its first key frame in a view of its own, and returns to live; the browser end-to-end test's dvr scenario covers it in a real browser against a relay whose cache is far smaller than the span sought back.

Added

• §5.1 Grant-gated consultation (OPTIONAL) — the JCP binding: tier as granted action (l0…l4), energy class as chained budget debit, denial as fallthrough, every consultation sealed as a chained JCR-1 receipt. Reference binding: the joule-code-jcp crate (JcpGate::wrap over any Stage); no l4 in the chain → no remote frontier agent, structurally. Conformance gains class C5 with a published vector file (gated_cascade_vectors.json, fixed fixture identities, deterministic end to end) run by the harness against the real jcp runtime alongside C1–C4.

• joule-code-cascade ships a reference L0 (Cache) stage: a content-addressed cache of resolved coding operations keyed by (prior, intent). A hit closes the request at L0 (picojoule class) without consulting any higher tier — the first concrete cascade stage, making stop-at-first-close demonstrable in the reference library. A third party may use it or substitute its own.

• joule-code-cascade ships a generic FnStage: any tier (L1 Lawful, L2 Embed, L3 Model) can be expressed by supplying a resolver closure, so a consumer binds the JouleClaw agent schema — or any other runtime/model — to the cascade without this crate depending on it. (A test wires an L3 model stage behind an empty L0 and confirms it closes at L3.)

• examples/l3-jouleclaw/ — a consumer binding showing JouleClaw's L3 (Model) tier wired into the cascade: a jouleclaw_llm_cheap::LlmBackend behind a FnStage(L3) that generates a CodingOp + joules-class receipt. Three backends share the slot: EchoBackend (model-free, for the unit tests); JouleclawRuntimeBackend, which runs a GGUF model in-process on JouleClaw's own from-scratch tensor runtime (jouleclaw-runtime over jouleclaw-loader-gguf and the reference/Apple kernel backends — no llama.cpp, no FFI); and LlamaCompletionBackend, which shells out to llama.cpp. The run binary generates with a local model (in-process runtime by default; JOULE_CODE_L3_ENGINE=llama for the shell-out), content-addresses the result as a CodingOp, and meters host energy over the inference for the receipt (honest provenance: HwShunt on RAPL/NVML, Estimator on Apple). Verified live: the llama.cpp path against a local 350M GGUF, and the in-process from-scratch runtime against ternary-bonsai-1.7b-q2_0 (qwen3, Q2_0) — real text, a real op_id, the cascade closing at L3 (tests/runtime_l3.rs, opt-in via --ignored). Standalone workspace, so the standard's lib stays free of a JouleClaw dependency; jouleclaw_dispatch::ModelBank selects the cheapest capable backend in production.

• joule-code-collab (Research) lands the federated-collaboration interface (Collab trait: submit / committed / membership), a single-node reference cluster (LocalCluster), and the BFT consensus core (LockstepCluster): a multi-node lockstep deterministic simulation with BFT supermajority commit — an op commits only when ≥2f+1 of n=3f+1 honest nodes independently validate it, and committed ops are op_id-ordered so every honest node derives a byte-identical log. Tested: commits with honest agreement, tolerates f Byzantine nodes (safety), loses liveness only beyond f, rejects non-members despite quorum, deterministic round ordering. It also adds protected — FROST threshold authorization of protected operations: a t-of-n FROST (Ed25519) aggregate signature over an op's op_id, verifiable against the cluster's single group key (no member holds the whole key; fewer than t cannot authorize). Tested: a 2-of-3 threshold authorizes and binds exactly one op_id; below threshold cannot. And MLS group keying (RFC 9420, via openmls, tests/mls_keying.rs): the cluster members form an MLS group and derive a shared group key with no central server — verified that members agree on the exported secret, that adding a member advances the epoch, and that a member an epoch behind derives a different (forward-secret) key. (SPEC §7, spec/collab.md.)

• examples/transport-moqt/ — the MoQT transport binding, the last of the four federation layers. A consumer binding that carries a collaboration's committed (consensus-ordered) coding operations over inv-moq — the MoQT (Media over QUIC Transport) protocol with its JWP receipt extension. The end-to-end test wires the whole stack in-process: LockstepCluster commits ops → each is published as a MoQT object → every object carries a real Ed25519/BLAKE3 signed receipt → a subscriber receives all ops, verifies the receipts against the publisher key, and recovers the original SignedOp intact; a second test shows a receipt-requiring subscriber rejecting an untrusted publisher's group (ownerless authenticity). Driven through inv-moq's MockFabric (real signatures + BLAKE3 merkle receipts, no QUIC; the quic feature is the real-wire path behind the same trait surface). Standalone workspace, so the reference library stays free of a joulesperbit dependency. The four federation layers — consensus, threshold authorization, group keying, transport — are now all implemented and tested. (SPEC §7, spec/collab.md.)

Changed

• §6 / spec/receipt.md §2 — a vendor counter is a hardware reading only while it is demonstrably live. A reading from a vendor energy counter (RAPL, NVML, Apple SMC/IOReport) MAY be tagged HwShunt, and supply measured_uj, only while the counter has been observed advancing under load for the domain the figure claims (for IOReport: the CPU energy rail itself, in at least 5 sample intervals, at least 4 of every 5, over at least 300 ms of CPU burn, counting only intervals, each from one sample in hand to the next, no longer than three of the probe's 25 ms ticks: a longer one counts as nothing, neither among the intervals, nor as an advance, nor towards the 300 ms, which is the summed length of the intervals that count). A counter that is present but not live — frozen, or republished in lumps — MUST NOT produce either; the reading falls back to the estimator. A figure MUST NOT claim coverage of a domain its counter does not read. No wire or conformance-vector change.

Added — the public room (L5c-2): joule-moq-room, room authorities at the relay

• joule-moq-room, a room service (a workspace of its own, on wai-rs's room, event and composition records): it holds a room's authority and clock keys (a 0600 file it refuses to read otherwise), signs short-lived WRG1 grants for keys pages make (POST /grant, a publisher's or a viewer's, bounded per client address, overall and per room), authors join, publish and leave on the clock's events track from what the relay carries (its clock watches each publisher's video track), and serves the signed descriptor and grants (GET /room). A new room starts when the last publisher has left.
• joule-moq-relay: [[auth.authorities]] honours every grant an authority's key signs, beside its proof, within its window, mapped as live-rooms §10.2 maps it (joule-moq's GrantHead reads it); a field * in a rule's prefix; a door rule's trust_field; limits.max_session_ms, max_ingress_kbps and max_resident_mb; a rule's unlimited; a session ends when its authority grant expires; SIGTERM stops it as Ctrl-C does.
• joule-moq-relay fixes found on the deployed room: the WebSocket binding's multiplexer dropped the half of a stream that arrived after its session closed while it held its state's lock, which that half's Drop takes, and the relay's runtime deadlocked (any session the relay closed while its peer still opened streams could do it); and a FETCH not yet covered only because groups are still arriving now waits for them, briefly, rather than going to a publisher that takes no requests.
• joule-moq-web: the room page's service mode (its own key, a grant from the service, the WebSocket binding, Join, Watch, Leave and a typed caption), Room.setGrants in wai-live-web, grantProofBy and clientSetupWithProof for a test's proof by another key, and the service end-to-end scenario, which also runs against a deployment (--base).

Changed — joule-moq, joule-moq-relay and joule-moq-web: L5 hardening

• ReceiptChains: a join's fill from group 0. A group fetched into the gap below a join's anchor, with a null parent, is held as history and admitted when the group above it links back to it (WAI jwp-receipts §3 step 3), where it was refused chain_break. A null parent outside that gap, and a fork, are still chain_break.
• Receipts in WAI's binary form (jwp-receipts §2.7). GroupReceipt::to_binary / from_binary (the canonical bytes, and a legacy group's parent), ObjectReceipt:: to_binary / from_binary / body_binary, read_receipts, link_hash_of, Malformed, RECEIPTS_MAGIC. ReceiptBundle::to_payload and from_payload keep their signatures and now write and read WJR1; ReceiptBundle::read also gives the link hash over the bytes received. The JWP_OBJECT_RECEIPT property carries an object receipt standing alone in that form. The JSON payload is not read any more. Serde derives on the receipt types stay, for callers' own use; nothing on the wire uses them.
• Proof of possession of a room grant (WAI live-rooms §10.5). joule-moq::grant_proof: the WRP1 record (GrantProof::sign, read, to_bytes), check_proof (§10.5.4, the grant's digest and principal from the caller's own reader), grant_digest_and_principal (for a verifier with none), the Setup Options SETUP_OPTION_GRANT_CHALLENGE (0x3A47) and SETUP_OPTION_GRANT_PROOF (0x3A49) with add_challenge, challenge_of, add_grant, proofs_of, proof_for, the HTTP header names, context and base64url. New dependency: sha2 0.10 (already in the lockfile).
• joule-moq-relay. The relay sends its SETUP first, with a fresh challenge and the receipt extension declared whatever the client says. A grant rule with proof = true names a room grant's record: a SETUP that presents it without a proof that passes is closed UNAUTHORIZED (§12.2), and a request resting on it is refused unless its session proved it. The transports give the session the target the client addressed (WebTransport :authority and :path, the WebSocket upgrade's Host and path; native QUIC's AUTHORITY and PATH). Authorizer::allows takes the proven set; Authorizer::requires_proof; ClientOptions gains grants, target and sign_challenge. receipts_track_suffix defaults to _receipts, live-rooms §6.1's.
• joule-moq-web. A participant presents its grant with a proof signed in wasm (clientSetupWithGrant), the per-participant secret gone; the receipts tracks are 0_receipts; the verifier measures each receipts object, and the same receipts as JSON.

Changed — joule-moq 0.3.0: draft-ietf-moq-transport-22

joule-moq speaks draft-ietf-moq-transport-22 (1 October 2026), negotiated by the ALPN moqt-22, in place of its draft-08-style codec. No byte of the old wire form survives: -22 changed the varint, the control streams, every message and the object framing. The crate's version moves to 0.3.0 because its public API changes:

• draft22: the codec of -22, a module of its own selected through draft::Draft, so another draft can be added beside it. Every control message and parameter, Key-Value-Pairs, Properties, Setup Options, the Authorization Token, Request IDs and request-stream rules, subgroup streams, datagrams, fetch streams and padding, and the status and error codes. Every refusal is a typed WireError carrying the draft's consequence; MoqError::Wire wraps it.
• MOQT_DRAFT_VERSION is 0xff000016. transport_quic::ALPN_MOQT is moqt-22.
• messages re-exports -22's control messages. SetupMessage, AnnounceMessage, SubscribeMessage, SubscribeFilter and the draft-08 ControlMessage are gone. SUBSCRIBE's max_mrl_layer is an OBJECT_PROPERTY_FILTER on the MRL_LAYER property (messages::mrl_cap_filter); require_receipts is the subscriber's own policy, met by subscribing to a track's receipts track.
• carriage (new): the crate's objects ride -22 subgroup objects, with the object receipt, the WAI_RECEIPT property of WAI extensions/moq-streaming-format.md §5 and the layer fields as properties in an application range; a group's receipts ride its receipts track (§4.1). ReceiptBundle moved here from mock, which re-exports it.
• session: the draft by ALPN (MoqSession::select_alpn); SETUP carries options and no version or role, and build_setup takes no label; Request IDs by end.
• transport_quic: a pair of unidirectional control streams opened by SETUP, a request stream per request, subgroup, fetch and padding streams, and datagrams. ControlStream, write_object_to_uni, read_object_from_uni, write_group_receipt_to_uni and read_group_receipt_from_uni are replaced by QuicSession::{open_control, accept_control, open_request, accept_request, open_subgroup, open_fetch, accept_data}, send_object, send_receipt_bundle and DataReceiver.
• wire::encode_varint and decode_varint are -22's integer; every u64 encodes.
• mock: objects, receipt bundles and requests cross the -22 codec; the relay reads an object's delivery timeout from its OBJECT_DELIVERY_TIMEOUT property.
• tests/vectors/draft-22/: a corpus of -22 vectors, good and negative, generated by tests/draft22_vectors.rs, and an independent decoder that checks it in CI.

Added — joule-moq-ingest 0.1.0: WHIP into a room's MoQ tracks, WHEP out of them

A new crate, library and binary, between WebRTC and the MoQ tracks of a WAI room, on joule-moq's codec and joule-moq-relay's client. The mapping is WAI's extensions/live-ingest.md.

• WHIP (RFC 9725). POST an offer for the answer, Location and ETag; PATCH for trickle ICE and ICE restarts, with If-Match (428, 412); DELETE. The bearer token is a WAI room grant, checked against the room's signed descriptor; a grant without the publish power for a media kind of the offer is 403 with insufficient_scope (RFC 6750 §3.1). Every request that carries a grant also proves possession of its key (WAI-Room-Proof over a single-use WAI-Room-Challenge, WAI live-rooms §10.5.3), on the session's PATCH, DELETE, GET and HEAD as on the POST.
• Into MoQ. str0m depacketises H.264, VP8, VP9, AV1 and Opus into frames; each frame is one WAI1 envelope in its capability's framing, video grouped at keyframes and audio in fixed windows, with the frame's room-clock time (anchored at the first frame's arrival, re-anchored past max_skew_ms) and, on each group's first object, the grant reference. The gateway publishes the tracks and a signed catalog at the relay as their publisher and signs every group's receipts as the first hop, chained per session.
• WHEP (draft-ietf-wish-whep-05). A player POSTs an offer for an owner's tracks; the gateway reads the owner's catalog once its receipt verifies (409 with Retry-After until then), joins each track at its latest group, verifies every object against its receipt before it packetises the frame back to RTP, and drops and counts what fails.
• Bounds. Sessions, tracks per session, bitrate (stated as b=AS), frame size and the queue to the relay, each a configuration field; gateway.example.toml holds no secret.
• A signed record per session, in the shape of live metering's per-hop record: the seam a WMH1 writer plugs into.
• The WebRTC stack is str0m 0.24.1 (MIT OR Apache-2.0), pinned, with its pure-Rust crypto backend; the HTTP resources are hyper 1.11.1 (MIT). Every crate new to the lockfile is MIT, Apache-2.0 or ISC.
• Tests, on loopback: WHIP to a relay subscriber with every receipt verified and the bytes equal, DELETE ending the tracks; WHEP playback from the joined group; VP8, VP9 and AV1 end to end; the refusals; trickle ICE and an ICE restart with media across it; the room reader against WAI's live-rooms corpus. A CI job runs every target on linux-arm64.

Added — joule-moq-relay: the per-hop session record of a WAI room

The relay signs WAI's per-hop session record, WMH1 (wai/extensions/live-metering.md §3), of a room from its session summaries (metering::hop_record, Relay::hop_record): for each track of the room its sessions carried, the objects and bytes in and out, the objects dropped for their delivery timeout or still queued at the end with those whose receipts it forwarded, the objects refused at the door and deduplicated; its subscriber sessions' time by layer class, from the subscriptions each held; the events it delivered (objects of Object ID above 0 on the room's events tracks); and a ledger of the room grants its sessions ran under, by the token each presented in SETUP ([[metering.grants]] in the configuration). Its own energy is the unmetered marker. The record holds nothing per object or per viewer: media tracks are counted one by one, events tracks and every other track of the room together, subscribers by layer class.

• The session summary carries what the record is made from, and its format is joule-moq-relay/session-summary/2: per track, as a publisher, objects and bytes received, refused at the door and deduplicated; per track, as a subscriber, fetched bytes, objects still queued at the end and objects of Object ID above 0; the session's layer spans per room; and the room grant its SETUP token maps to. A datagram's bytes are now counted among a publisher's bytes received.
• tests/room_metering.rs: two publishers and three subscribers of one room, one subscriber slow, over QUIC and WebTransport; the record verifies under the relay's key and every count in it is the sum of the summaries' counts. Run with WAI_METERING_FIXTURE_DIR, the test writes the record and its ledger, which WAI's metering corpus holds as recorded.

Added — joule-moq-relay 0.1.0: a draft-ietf-moq-transport-22 relay

A new crate, library and binary, on joule-moq's codec. Publishers send it tracks, subscribers ask it for them, and it fans each object out to every subscription in the order -22's priorities give (§5.1.2), dropping what passes a subscriber's delivery timeout at this hop (§5.2). Whatever it drops, the object's receipts still reach the subscriber: a track's receipts track is never given a delivery timeout.

• Three transports, one draft: native QUIC (ALPN moqt-22) and WebTransport over HTTP/3 (WT-Available-Protocols / WT-Protocol, draft-ietf-webtrans-http3-16) on one UDP endpoint, and a WebSocket fallback that carries draft-ietf-webtrans-http2-15 capsules, one per binary message, under the subprotocol moqt-22. The fallback is a non-normative binding, written out in the crate's README with example bytes.
• The relay protocol: session setup; namespace publish and subscribe routing; PUBLISH; SUBSCRIBE served from an upstream the relay holds or opens; FETCH and fills from its cache or forwarded upstream; TRACK_STATUS; REQUEST_UPDATE; GOAWAY on shutdown; Request-ID parity and duplicate checks; the authorization-token alias cache; several publishers of one track, deduplicated by (group, subgroup).
• What the cache covers is worked out from the groups it holds whole, each time it is asked, so a group whose streams finish after a later group's is still served from the cache once it is whole; a group never seen is a gap it does not answer across.
• A signed session summary per session. The relay's own energy is the unmetered marker, since no meter backs it.
• Not yet: SUBSCRIBE_TRACKS and Range Filters, WebTransport over HTTP/2, 0-RTT, the relay moving its own upstream subscriptions, and finding a receipts track from the catalog rather than by its name; the README lists each.

Changed — joule-moq 0.2.0: WAI's labelled JWP forms, and a strict verifier

joule-moq reads and writes the forms of WAI's extensions/jwp-receipts.md that sign an object's energy figure, its class and its origin, and a group total's class. Every receipt in the legacy forms keeps its bytes and verifies as before; a verifier that predates the labelled forms refuses them. The crate's version moves to 0.2.0 because its public API changes:

• ObjectReceipt gains energy_class: Option<Vec<u8>> (the class in WAI energy-measurement §2.7's signed encoding). Present, the object's leaf is BLAKE3("moq-jwp:merkle-leaf\x02" ‖ content_hash ‖ u64_be(joules_micro) ‖ class ‖ u32_be(len(origin)) ‖ origin); absent, the legacy leaf. New: ObjectReceipt::leaf, ObjectReceipt::check_label, ReceiptBuilder::add_labelled_object, ReceiptBuilder::class_for.
• GroupReceipt gains energy_class, energy_coverage and parent_receipt_hash. With a class, the group is signed under moq-jwp:group-sign\x02, which covers the class, the coverage and the parent link. energy_coverage is written only when it is non-zero, and a legacy group carrying a non-zero coverage is refused: its signature does not cover one. New: ReceiptBuilder::finalize_labelled, GroupReceipt::link_hash and compose_group_class, the rule a labelled group's class is composed by.
• ReceiptVerifier::verify_group returns a VerifiedGroup (the root with the group's leaf count and coordinates) instead of the bare root, and verify_object and verify_payload take &VerifiedGroup. An object is accepted only at the position its proof walks: its coordinates are the group's, object_id is its leaf index, the proof has the group's depth and its direction bits are the index's.
• MerkleProof::verify is replaced by MerkleProof::verify_leaf, which takes the leaf in its form and the group's leaf count, and MerkleProof::walks_its_position.
• verify_group holds the key and the signature to WAI jwp-receipts §3.1 step 3's rule: the publisher key must be the canonical encoding of a point not of small order (a y coordinate ≥ p is refused), S must be below L (checked by the crate as well as by verify_strict), R must not be of small order, and the cofactorless equation must hold.
• JWP_MOQ_EXTENSION_VERSION is 2.
• tests/wai_jwp_corpus.rs runs every leaf, group and object vector of wai/jwp-conformance/vectors.json through the crate.

External JWP implementations need the same update to verify labelled leaves and groups, and to refuse what this verifier refuses.

[0.2.0] — draft

Changed

• Receipts now seal as JCR-1 envelopes. The receipt's signed form is the family-shared JCR-1 wire format — canonical det-CBOR (RFC 8949 §4.2.1, length-first key order) inside a COSE_Sign1 envelope (RFC 9052, EdDSA alg = -8), as the joule-code/1 profile. This replaces v0.1's bespoke estimated_uj ‖ sequence ‖ nonce preimage. A Joule Code receipt now verifies under the family's existing JCR-1 tooling and its cross-language (Python/Go) reference verifiers. (SPEC §6.1.)
• joule-code-receipt gains a jcr1 module (canonical CBOR + COSE_Sign1, vendored from the JCR-1 reference, no JouleClaw dependency) and Receipt::to_jcr1_wire / seal / verify_envelope; the bespoke sign/verify are removed.
• Conformance C3 vectors regenerated as JCR-1 COSE_Sign1 envelopes; the harness verifies the envelope and that its payload is the receipt's canonical core. A byte-equality test pins the canonical encoder against a published JCR-1 vector.

[0.1.0] — draft

Initial draft standard.

Added

• SPEC.md — normative specification: the cascade requirement (L0–L4, stop-at-first-close), the receipt requirement (measured + estimated, Provenance), and the no-capture requirement.
• The coding-operation cargo: content-addressed (BLAKE3-256), signed (Ed25519, prior-state-bound) transitions over a source tree; deterministic CBOR canonical form.
• The receipt schema in Joule Wire Protocol form, energy-signed.
• The cascade interface and the agent-schema binding to JouleClaw; the L4 binding to remote frontier agents over ACP.
• The federated-collaboration binding, specified at interface level and classified Research.
• joule-code-rs/ reference library: joule-code-schema, joule-code-cargo, joule-code-receipt, joule-code-cascade, joule-code-conformance.
• conformance/v1/ reference vector pack (C1–C4), internally consistent pending regeneration against the reference library.