c2cac5b28a
wai-rs depends on wai-ops (behind neural_int) and gains src/int_ops.rs, the bridge every integer decoder will load its lowered graphs through: from their canonical bytes, under acc64, load steps 1-8 with the bounds certificate. tests/int_synth_ops.rs: every committed int_synth set (the neural-conformance corpus and the ops-conformance set) lowers through int_synth/1 to the committed graph, the committed certificate is that graph's, and loading it gives the certificate's verdict: acc64 for all, acc32 for facade, gradient, bloom and the small set, not for photo, as the design predicted. The browser demo's sets are byte copies of the corpus's. The two falsification sets fail the profile they claim: overflow_acc64 is refused at load step 8, claim_acc32 loads under acc64 and does not meet acc32. The independent checker re-lowers and re-certifies every set byte for byte (wai-ops.yml, unchanged). CI: the fast-kernels steps (both profiles) name the new test; wai-conformance, wai-web-wasm and wai-neural-gates fire on wai-ops changes. wai-pack, wai-rs and wai-web lockfiles gain wai-ops. Co-Authored-By: Claude Opus 5.5 <[email protected]>
229 lines
12 KiB
YAML
229 lines
12 KiB
YAML
name: wai-web wasm32
|
|
|
|
# The browser sink (wai/wai-web) is the same Rust as the native reference,
|
|
# compiled to wasm32-unknown-unknown. This job builds it and runs, under node:
|
|
#
|
|
# - demo/verify_int_synth_wasm.mjs against the committed conformance corpus
|
|
# wai/neural-conformance/ (not the demo's staged copies): the wasm32
|
|
# int_synth decode must hash to the corpus's frozen native hashes;
|
|
# - demo/verify_generate_wasm.mjs against wai/wai-rs/tests/vectors/generate/ and
|
|
# wai/score-conformance/: generateSpectral at every pinned size (sizes.json,
|
|
# instr-v0.json's object and every object it accepts) and ScoreSink over every
|
|
# score vector must give the SHA-256 the native `wai generate` and `wai score
|
|
# render` wrote, so a page checking the browser's output against those pins can;
|
|
# - demo/verify_menu.mjs: every capability the browser sink advertises is
|
|
# registered in wai/registry/capabilities.json as a payload or companion
|
|
# capability, none is a candidate (SPEC §5), and the wasm build's own
|
|
# registry agrees with the export on every candidate;
|
|
# - demo/verify_pack.mjs: the browser writers `pack` and `packMulti` refuse
|
|
# every candidate the export lists, in every place an envelope can name one,
|
|
# and a manifest that names a member twice in one object;
|
|
# - demo/verify_staged_wasm.mjs against the staged-delivery corpus
|
|
# wai/staged-conformance/: every case replayed through the wasm32 StageSink
|
|
# must give the reports, final units and stage hashes the native sink wrote;
|
|
# - demo/verify_measure.sh against the staged-measurement corpus
|
|
# wai/staged-measure-conformance/: every figure of the wasm32 measurement
|
|
# binding equals the corpus and the native tool's byte for byte, and the
|
|
# session claims it seals are verified natively and by the independent
|
|
# Python verifier with the same verdicts;
|
|
# - a byte comparison of the demo's staged int_synth copies with the corpus;
|
|
# - the crate's wasm_tests under wasm-bindgen-test-runner, and its native unit
|
|
# tests on the host.
|
|
#
|
|
# The full-scale int_hyper wasm decode needs vectors regenerated from a
|
|
# pretrained model; wai-sota-vectors.yml runs it after regenerating them.
|
|
|
|
# One run per branch at a time. A push supersedes the run before it.
|
|
#
|
|
# There is one `macos` runner and it is the dev Mac, so every macOS job in this
|
|
# repo queues on it. With no concurrency group, a session pushing four versions
|
|
# of a branch queued four complete sets of runs and every one of them had to
|
|
# drain: on 2026-10-05 a PR's 21 contexts settled none in 70 minutes behind a
|
|
# backlog of 25 runs, and the queue grew faster than it cleared. Only the newest
|
|
# commit's verdict is wanted, so the older runs are cancelled.
|
|
#
|
|
# Verified on this forge (Forgejo 16.0.5) in `ci-test` before being added here:
|
|
# the key parses, and a newer push moves an older run to `cancelled` even while
|
|
# it is still queued, which is the case that matters.
|
|
#
|
|
# `cancel-in-progress: true` also applies to `main`. That is deliberate and
|
|
# safe here: main advances by merge commits whose tree contains the commits
|
|
# before them, so the newer run covers the older one's changes.
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'wai/wai-web/**'
|
|
- 'wai/wai-rs/**'
|
|
# wai-rs's integer decoders depend on the integer operator set.
|
|
- 'wai/wai-ops/**'
|
|
- 'wai/wai-quantum/**'
|
|
# quantum::tests and quantum_toolchain::tests read the quantum corpora.
|
|
- 'wai/quantum-conformance/**'
|
|
- 'wai/neural-conformance/**'
|
|
- 'wai/staged-conformance/**'
|
|
- 'wai/staged-measure-conformance/**'
|
|
- 'wai/int-payload-conformance/**'
|
|
- 'wai/claim-conformance/**'
|
|
- 'wai/score-conformance/**'
|
|
- 'wai/registry/**'
|
|
- '.github/workflows/wai-web-wasm.yml'
|
|
pull_request:
|
|
paths:
|
|
- 'wai/wai-web/**'
|
|
- 'wai/wai-rs/**'
|
|
# wai-rs's integer decoders depend on the integer operator set.
|
|
- 'wai/wai-ops/**'
|
|
- 'wai/wai-quantum/**'
|
|
# quantum::tests and quantum_toolchain::tests read the quantum corpora.
|
|
- 'wai/quantum-conformance/**'
|
|
- 'wai/neural-conformance/**'
|
|
- 'wai/staged-conformance/**'
|
|
- 'wai/staged-measure-conformance/**'
|
|
- 'wai/int-payload-conformance/**'
|
|
- 'wai/claim-conformance/**'
|
|
- 'wai/score-conformance/**'
|
|
- 'wai/registry/**'
|
|
- '.github/workflows/wai-web-wasm.yml'
|
|
|
|
jobs:
|
|
wasm32:
|
|
name: wai-web wasm32 build · corpus, menu and writers
|
|
runs-on: linux
|
|
timeout-minutes: 45
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
# The docker runner image ships no Rust.
|
|
- name: Install Rust 1.98.0 with the wasm32 target
|
|
shell: bash
|
|
run: |
|
|
export PATH="$HOME/.cargo/bin:$PATH"
|
|
command -v rustup >/dev/null 2>&1 || \
|
|
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.98.0
|
|
rustup toolchain install 1.98.0 --profile minimal
|
|
rustup default 1.98.0
|
|
rustup target add wasm32-unknown-unknown
|
|
echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
|
|
# Pinned to the wasm-bindgen version in wai-web/Cargo.lock: the CLI and the
|
|
# crate must match exactly.
|
|
- name: wasm-bindgen CLI 0.2.127
|
|
shell: bash
|
|
run: cargo install --locked wasm-bindgen-cli --version 0.2.127
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '22'
|
|
- name: Build wai-web for wasm32 (node bindings)
|
|
shell: bash
|
|
working-directory: wai/wai-web
|
|
run: |
|
|
set -euo pipefail
|
|
cargo build --locked --release --target wasm32-unknown-unknown
|
|
wasm-bindgen --target nodejs --out-dir demo/pkg-node --out-name wai_web \
|
|
target/wasm32-unknown-unknown/release/wai_web.wasm
|
|
# The JS surface itself (pick, companionsOf, verifyPin, rendition() and
|
|
# companion() refusing what is never presented or does not match its digest,
|
|
# the held-sets conversion, and the WAI2 parse at 32-bit usize) runs only on
|
|
# wasm32 (`mod wasm_tests`). wasm-bindgen-test-runner, installed above at the
|
|
# version Cargo.lock pins, runs it under Node. The count check turns a test
|
|
# that stopped being compiled into a failure instead of a silent "0 passed".
|
|
- name: wai-web JS surface (wasm32 tests under Node)
|
|
shell: bash
|
|
working-directory: wai/wai-web
|
|
run: |
|
|
set -euo pipefail
|
|
CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_RUNNER=wasm-bindgen-test-runner \
|
|
cargo test --locked --target wasm32-unknown-unknown 2>&1 | tee "$RUNNER_TEMP/wai-web-wasm.log"
|
|
grep -q "test result: ok. 4 passed; 0 failed" "$RUNNER_TEMP/wai-web-wasm.log"
|
|
# The crate's native unit tests, run on the host: the pure-Rust halves of the
|
|
# bindings, which wasm_tests does not run. They decode the committed integer
|
|
# payloads to their sidecars' SHA-256 (int_payload::tests) and check that the
|
|
# writers `pack` and `packMulti` refuse a payload that is not the format SPEC §5
|
|
# pins its integer capability to, and a manifest that names a member twice (tests); the
|
|
# staged-delivery binding's pure half replays the staged corpus and reads a layer's
|
|
# header and cost (stage::tests); the measurement binding's pure half evaluates the
|
|
# staged-measurement corpus to its goldens and seals a page-recorded session equal
|
|
# to the native tool's (measure::tests). The quantum sink opens every file of
|
|
# both quantum corpora to their manifests' hashes and capability and refuses
|
|
# every reject file with its listed class (quantum::tests), and the quantum IDE
|
|
# builds its catalog circuits in its gateset to the same manifests, stores no
|
|
# parameter on a gate other than P, and shows no hash for an invalid circuit
|
|
# (quantum_toolchain::tests). The OTT demo seals a figure the page supplies as
|
|
# an estimate, never a reading (video_ott::tests). The count check turns a test that
|
|
# stopped being compiled into a failure instead of a silent "0 passed".
|
|
- name: wai-web native unit tests
|
|
shell: bash
|
|
working-directory: wai/wai-web
|
|
run: |
|
|
set -euo pipefail
|
|
cargo test --locked --lib 2>&1 | tee "$RUNNER_TEMP/wai-web-native.log"
|
|
grep -q "test result: ok. 32 passed; 0 failed" "$RUNNER_TEMP/wai-web-native.log"
|
|
- name: wasm32 int_synth decode equals the frozen native corpus
|
|
shell: bash
|
|
working-directory: wai/wai-web
|
|
run: node demo/verify_int_synth_wasm.mjs ./pkg-node/wai_web.js ../neural-conformance
|
|
# decodeWiv1, decodeWih1, decodeWia1 and decodeWis1 on the committed integer
|
|
# payloads give the SHA-256 their sidecars state, and a JSON form is refused.
|
|
- name: wasm32 integer payload decode equals the native sidecars
|
|
shell: bash
|
|
working-directory: wai/wai-web
|
|
run: node demo/verify_int_payload_wasm.mjs ./pkg-node/wai_web.js ../wai-rs/tests/vectors
|
|
# The generator and the score synth in wasm32 against the native pins: every size
|
|
# sizes.json and instr-v0.json pin (the object's four listed sizes, and the first
|
|
# listed size of each object at a bound of form v0), and every score vector's
|
|
# pcm_sha256, mixdown hash and score hash. Pages that make these pieces in the
|
|
# browser hold their output to such pins, made natively.
|
|
- name: wasm32 generator and score synth equal the native pins
|
|
shell: bash
|
|
working-directory: wai/wai-web
|
|
run: node demo/verify_generate_wasm.mjs ./pkg-node/wai_web.js ../wai-rs/tests/vectors/generate ../score-conformance
|
|
# Every staged-delivery case replayed through the wasm32 StageSink: each integer
|
|
# base decoded in wasm32 to its stage0.bin with its pin, and every report, final
|
|
# unit, stage hash and clip hash equal to what the native sink wrote in case.json.
|
|
# Then the binding's guards: bases that declare huge clips refused under a cost
|
|
# limit with linear memory checked, a base past the chain budget, base facts a
|
|
# page cannot raise (fallback, tier, claimed), addBase spending its base, and a
|
|
# seeded fuzz that must never trap.
|
|
- name: wasm32 staged-delivery sink equals the native corpus
|
|
shell: bash
|
|
working-directory: wai/wai-web
|
|
run: node demo/verify_staged_wasm.mjs ./pkg-node/wai_web.js ../staged-conformance
|
|
# The staged-measurement binding (src/measure.rs) over wai/staged-measure-conformance/:
|
|
# every fixture's evaluation, the refusal titles, the counted objects, the quality
|
|
# pairs and every simulator case equal the corpus, and the evaluations equal the native
|
|
# `wai_stage_measure eval --json` byte for byte; every session the wasm32 build seals
|
|
# is the native tool's claim, commits to the golden output tree, and gets the same
|
|
# verdicts from the wasm32 verifier, `wai_claim_vectors verdicts` and claim_verify.py.
|
|
# It uses the package built above; a missing artifact fails the step.
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: '3.11'
|
|
- name: Install the Ed25519 library (claim_verify.py)
|
|
shell: bash
|
|
run: python -m pip install cryptography
|
|
- name: wasm32 staged measurement equals the native tool and the corpus
|
|
shell: bash
|
|
working-directory: wai/wai-web
|
|
run: bash demo/verify_measure.sh ./demo/pkg-node/wai_web.js
|
|
- name: The browser menu is registered and names no candidate
|
|
shell: bash
|
|
working-directory: wai/wai-web
|
|
run: node demo/verify_menu.mjs ./pkg-node/wai_web.js ../registry/capabilities.json
|
|
- name: The browser writers refuse every candidate
|
|
shell: bash
|
|
working-directory: wai/wai-web
|
|
run: node demo/verify_pack.mjs ./pkg-node/wai_web.js ../registry/capabilities.json
|
|
- name: The demo's staged int_synth vectors are byte copies of the corpus
|
|
shell: bash
|
|
working-directory: wai
|
|
run: |
|
|
set -euo pipefail
|
|
cmp wai-web/demo/int_synth/expected_hashes.json neural-conformance/expected_hashes.json
|
|
for n in gradient bloom facade photo; do
|
|
for f in latent.bin int_synth.json; do
|
|
cmp "wai-web/demo/int_synth/$n/$f" "neural-conformance/vectors/$n/$f"
|
|
done
|
|
done
|