50667cd2a4
The float wai.neural.mlicpp decodes correctly only while its encoder evaluates the entropy network bit-identically to the decoder. Its validation run, with the encoder at the runtime's default thread count and the decoder single-threaded, put one scale on the other side of a table edge at symbol 416 of 12,288 and decoded garbage from there. Matching the execution settings fixes that run, but it stays a convention between two implementations. int_mlicpp makes the agreement a property of the arithmetic: the hyper-decoder, the entropy network re-run before each of the 2*K channel-slice x checkerboard passes, and the synthesis are all integer networks, so every decoder derives the encoder's scale bucket for every element, on any platform and at any thread count. - wai-rs/src/int_mlicpp.rs: the decoder (a WIM1 payload; a one-file WMB1 model bundle, so a prior's SHA-256 pins every network and table), built from int_hyper_synth's networks, int_entropy's bucketing and the rANS decoder. - Totality. Before the decode allocates anything, each network's shapes are derived from its layer geometry (the new int_hyper_synth::net_shape, which shares its geometry with the checked run), and a header whose shapes the model does not produce, or on which any network would form a buffer over Header::MAX_TENSOR (2^26) elements, is refused. Latents go through int_entropy::dequantize (sym * 2^frac + base, None where i64 cannot hold it; Kani harness), and every network through int_hyper_synth::run_net_checked (run_net layer by layer, only while no value can leave its type). So a decode returns an image or an error for any payload, the same one with and without overflow checks. - IntModel::from_bytes, the compact network form every integer neural decoder loads, is total on damaged bytes: it no longer reserves for the layer count it reads before checking the bytes hold that many (about 480 GB for 2^32 - 1), and forms layer sizes and read offsets in checked arithmetic (they overflowed a 32-bit usize). - run_net and decode share a per-layer function and to_rgb8; every committed vector still reproduces its hash. - Registry: NeuralIntegerExact, Lossy, royalty-free (the decoder is this crate's; the patent status of the techniques was not examined). A new registry test records the basis of every NeuralIntegerExact capability. - The neural dispatch decodes it and re-checks a pinned prior against the exact bytes it decodes with. - tools/wai_int_mlicpp_export.py writes the committed vector tests/vectors/int_mlicpp/. Its weights are synthetic and seeded (no trained model is available), so the vector shows decode-equivalence and nothing about compression quality. - Tests: tests/int_mlicpp.rs (the pinned image, bucket and symbol hashes under every kernel policy and thread count; one unit in each of four chosen parameters, one per value path, changes the image; damaged payloads never panic), tests/int_mlicpp_preflight.rs (a counting global allocator: refusing a header the model cannot fit, or parsing a damaged network, allocates a few KB at most; the decoder without the pre-flight fails it, and aborts on a 3.4 PB allocation for a synthesis wider than the cap), a byte-exact-conformance golden, a neural dispatch test and unit tests. CI runs them on the conformance matrix in both profiles, on the byte-equality matrix, and in neural-gates. - Evidence: all of the above pass, and the pinned hashes reproduce, on macOS arm64 and on wasm32-wasip2 under wasmtime 49.0.1, in dev and release. x86_64 was not measured here (no x86_64 translation layer is installed); the Linux legs come from the byte-exact matrix, and the Windows runner is offline. - SPEC 5 and 7, the README, determinism-tiers 3, 5 and 6, and the CHANGELOG record it. Co-Authored-By: Claude Opus 5.5 <[email protected]>
859 B
859 B