Model governance was defined, verified and rolled up, and no sink enforced it at decode time.
wai-rs `model_policy::sink` is the one implementation every sink calls. A host gives the sink a
configuration (the operator's policies, each the successor of the one before; its key log; the
device's class and key; its attestation), read as model-governance §8.2's steps 1 to 3 read a
bundle, and refused where no policy places the device in its class. Before a neural decode, at the
sink's instant, `admit_decode` checks the policy in force (`policy_not_yet_valid`,
`policy_expired`, a successor in force from its own start), the device in its class
(`device_not_in_class`, an attestation's span included), the entry for the set the decode reads,
its capability and the role `decode` (`model_not_in_policy`), a path the sink offers at the entry's
tier or above, a path below it not offered (`model_tier_below_policy`), and no identity of the set
revoked at that instant: its digest, a sealed set's `inner`, and every other digest of the bytes
read, as SPEC §3.1 check 5 covers them (`model_revoked`). A refused decode decodes nothing and its
answer names the code; a decoder with no policy decodes as before.
`Runs` keeps each decode that gave its output as model-governance §6.2 states a decode entry (a
refused decode, a payload refused, a decode no path ran, and a float path claiming
decode-equivalence are never kept), and `sign_report` signs `wai-model-run` for a period with the
device key: one policy in force over the period, no overlap with a reported period, no held run
left out, the device in its class throughout. `model_runs_full` refuses a decode while 65 536 runs
are unreported. `model_policy::rollup` is the operator's roll-up.
- sink_decode: `IntDecoder::{hold_policy, set_clock, now, model_state, run_report}`; whole
payloads, envelopes (the pin's digest) and frame-stream objects (the stream's set named once) go
through `governed`, and dispatch runs over the paths the check lets through. The answer adds
`model` (`policy`, `set`, `at`, `kept`). The feature `sink_decode` includes `model_policy`.
- C interface: `wai_int_decoder_policy`, `wai_int_decoder_clock`, `wai_int_decoder_model`,
`wai_int_run_report`, `wai_model_verify` (what `wai model verify` runs); include/wai.h
regenerated.
- Swift and Kotlin (and the JNI layer): `holdPolicy`, `setClock`, `model`, `runReport`,
`verifyModelBundle`, and the decode's `model`.
- wai-web: `model_gate` (bundles `neural_npu`, `neural_webgpu`): `ModelPolicy`, `ModelSet`, the
check (`admit`) a WebNN page asks before it creates a context and `keep` after, and
`IntNeural.holdPolicy`, which checks and keeps each decode itself.
Tests: the shared check's unit tests (the policy in force and its successor, a path below the tier
not offered, runs kept in order and reported once, a float path claiming decode-equivalence never
kept), and wai-web's native test of a page's WebNN path (refused before any context, kept, a
changed ticket keeping nothing, nothing kept for a decode that needs decode-equivalence, the report
accepted in a bundle). The corpus and the wrappers' tests follow in the next commit.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
8584456f5c