open-standards/wai/changes/2026-11-10-one-command-small-folds.md

One command for the rest of the toolchain: audit, serve, quantum, cmcd, receipt create, and every record kind in wai verify

• Folds, each the program it folds, run as itself: what it prints and its exit status are the program's, for the same arguments. wai audit report|check|verify (audit.create, audit.check, audit.verify) is the stream audit's collector, wai-audit report|check|verify; --owner is the WAI_AUDIT_OWNER it reads. wai serve <role> [--config <file>] [--check] (service.start) starts a role's program, wai-<role>: relay, room, ingest and key-release from the file --config names, and audit, fleet, ledger and quantum-service from their environment. wai quantum run|plan|lint|verify|methods (quantum.run, quantum.inspect, quantum.check, quantum.verify, quantum.list) is wai-quantum with that verb; no other verb of it is reached through wai (exit 5, operation-not-found). Each program is its flag (--audit, --bin, --quantum), its WAI_<NAME>_BIN variable, the program beside wai, or on PATH; one that is not there is exit 5, program-not-found, naming where it was looked for.
• --check on the daemons: wai-relay --config <file> --check, wai-room --config <file> --check (the keys the file names read too), wai-ingest --config <file> --check and wai-key-release serve <proxy.json> --check read the configuration as each starts from it, say so, and start nothing; one that does not read is refused, exit 1, with the reason.
• wai-key-release: the key-release proxy is installed under the name every daemon of the toolchain has, wai-<role>; wai-key-proxy, its earlier name, is the same program and answers as before, and wai serve key-release finds it when the new name is not there.
• wai cmcd encode|decode|verify (cmcd.encode, cmcd.decode, cmcd.verify; the feature telemetry, now in full) is the delivery-telemetry corpus's CMCD tool, the code wai_telemetry runs compiled into wai.
• wai receipt create <file>... [--from <input>]... [--key <name>] (receipt.create) signs, for files made outside the toolchain, the operation receipt its own writes leave: its lineage is the project, each --from file read and each file named, every step its content hash. wai verify reads it as it reads any operation receipt.
• wai verify reads every record by its kind: by its name where its name says, and a JSON record by what it holds: a delivery receipt (kind group or object) and a claim receipt (kind claim) as wai mcp's receipt_verify verifies them, a live-room session as wai session show gives it, a stream audit bundle as wai-audit verify verifies it (--owner or WAI_AUDIT_OWNER, and --channel), and a WAI media playlist with its manifest receipt mr/<its BLAKE3>.json beside it, as wai http check-playlist checks it. A file named that is no record is refused, exit 2, unknown-record, never read as another kind.
• The quantum toolset of wai mcp: quantum_run, quantum_inspect, quantum_check, quantum_verify and quantum_list, each answered by the quantum command line's own server, wai-quantum mcp, which wai mcp --toolset quantum starts (--quantum-bin, WAI_QUANTUM_BIN, beside wai, or on PATH): each tool is listed with the schemas that server states for it, and each call's answer is that server's, unchanged. wai-quantum mcp serves the same tools under its own names.
• wai media score build|render answer as wai score build|render do.