3adb3e92a7
Some checks failed
WAI breaking changes and the conformance runner / WAI breaking · does this change touch WAI (push) Successful in 10s
WAI breaking changes and the conformance runner / WAI breaking · wire, record and API against main · linux (push) Successful in 1m1s
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (push) Failing after 4m20s
WAI breaking changes and the conformance runner / WAI breaking and conform · their tests, and the independent verifiers through wai conform · linux (push) Successful in 4m57s
The WAI site's list of conforming implementations (/conformance/) admits a record only when it verifies, names the pinned commit and toolchain, is admitted against that commit's corpus, is not signed by a published test key and names no local path. CI made no such record: the conformance runner job of wai-breaking.yml wrote its per-suite records to the runner's temporary folder, signed with keys made for their runs and naming the runner's paths, and uploaded none; wai-conformance.yml's independent-verifiers artefact holds whole-corpus records, which §4.1 rule 4 refuses. wai/quickstart/conformance-records.sh runs WAI's own implementations as that job does (the five independent verifiers, the reference packager, the native sink through its module and its C interface, the score renderer, the browser sink, the integer-synthesis decoder, a cache in front of the reference origin, and the reference relay at drafts 22, 18 and 16), each record naming <wai version>+<commit>, signed with the seed in WAI_CONFORMANCE_SEED and admitted by `wai verify --conformant`, and packs the 15 as wai-conformance-<label>.tar.gz (with MANIFEST.json: commit, standard, signer, each record's SHA-256) and its .sha256. The runs are made from a folder holding bin/ and a link to wai/, programs found through PATH's relative `bin`, so a record names bin/<program> and wai/<path>; a record holding a path under /Users/, /Volumes/, /home/, /private/ or /tmp/, or such a python3, stops it. The seed goes to a file only the script reads, removed on exit, and the variable is unset before anything runs. Without the seed: one notice, nothing written, exit 0. A seed that is not one, or a key conform-result-conformance publishes, stops it with nothing written. - wai-breaking.yml, runner job: the three refusals planted on every change; on a push to main the pack at the commit, kept as the artefact wai-conformance-records when the secret is set. - wai-release.yml: job conformance builds the programs at a wai-v* tag, runs and signs them (the seed in that step alone) and attaches wai-conformance-<version>.tar.gz and its .sha256 through publish.sh, to FORGE_API directly. Job setup reports whether WAI_CONFORMANCE_SEED is set, as for WAI_PACKAGES_TOKEN (cc1849097): without it one notice, and the job is skipped. - publish.sh: the release's description names the pack. Checked: PyYAML parses both workflows; check-workflow-concurrency.sh and its selftest, check-tests-in-ci.py and its selftest, check-wai-release-quickstart.py and its selftest, the changelog check, the public-name check with the private list and the other light checks of repo-checks.yml pass under bash. Proved end to end at this change (as f5038ea40, before the rebase onto8da651a54, which touches none of these files), with a throwaway key made on the Framework build host and deleted there: the script, run as the release job runs it, wrote 15 records, every one conformant, admitted against the corpus (areas trust 5, media 2, delivery 2, live 6), path-neutral (bin/<program>, wai/<path>, /usr/bin/python3) and signed by the key, packed with its SHA-256. The WAI site's sync (scripts/sync-conform.mjs, on the M3 Ultra) admitted all 15 as WAI's own by --records with --signer, and the same 15 by --release from a server laid out as the forge's release downloads; the built page held each (check-conform, and the page's e2e: 102 checks). Planted and caught: the script with no seed (one notice, nothing written, exit 0) and with the published test key (exit 1, nothing written); at the sync, a record naming a local path (check f), a record signed by the test key (check e, also with that key named as WAI's) and a pack whose .sha256 does not match (refused by --release). Co-Authored-By: Claude Opus 5.5 <[email protected]>
1.9 KiB
1.9 KiB
WAI's own conformance records, signed with WAI's key, published by CI
wai/quickstart/conformance-records.shruns WAI's own implementations through the conformance runner as wai-breaking.yml's runner job does (the five independent verifiers, the reference packager, the native sink through its module and its C interface, the score renderer, the browser sink, the integer-synthesis decoder, a cache in front of the reference origin, and the reference relay at drafts 22, 18 and 16): one record a run, each naming its version<wai version>+<commit>, signed with the seed inWAI_CONFORMANCE_SEED("key": "supplied") and admitted bywai verify --conformantagainst the checkout's corpus. It packs them aswai-conformance-<label>.tar.gz, with aMANIFEST.jsonnaming the commit, the standard and the signer's public key, and the pack's SHA-256.- The runs are made from a folder holding
bin/and a link towai/, each program found through PATH's relativebin, so a record namesbin/<program>andwai/<path>and no path of the machine that ran it (conformance-results §8). A record that holds a path under/Users/,/Volumes/,/home/,/private/or/tmp/, or apython3found there, stops it. - Without the seed it prints one notice and writes nothing: a key made for a run says nothing of who ran it. A seed that is not one, or the test key conform-result-conformance publishes, stops it with nothing written; the runner job plants all three on every change.
- CI publishes them. A push to main keeps the pack as the run's artefact
wai-conformance-records; awai-v*tag attacheswai-conformance-<version>.tar.gzand its.sha256to the release, uploaded to the forge directly (jobconformanceof wai-release.yml). Both run once the repository secretWAI_CONFORMANCE_SEEDis set; until then each says so in one notice and publishes nothing.