Transaction Science
48eaa9a587
ci: every Python install pinned by SHA-256; verifiers run with -I ...
Six workflow steps installed whatever PyPI served that day: cryptography
(wai-conformance, wai-http twice, wai-web-wasm), the RDF tools' dependencies
(wai-conformance), PyYAML (standards-build, aac-rs), the ML stack of
wai-neural-e2e, and pip itself (wai-neural-e2e, wai-sota-vectors). A
compromised release would have run on the runners. Each now installs a
hashed requirements file with --require-hashes, the way wai-pack.yml
already does:
- cryptography: wai/pack-conformance/requirements-verify.txt (the same file);
- RDF tools: wai/vocab/requirements-shapes.txt, from requirements-shapes.in;
- PyYAML: aac/aac-rs/tools/pagesets/requirements-ci.txt, from requirements-ci.in;
- wai-neural-e2e: wai/tools/requirements-neural-e2e.txt, from
requirements-neural-e2e.in;
- wai-sota-vectors: wai/tools/requirements-sota-int-hashes.txt, from
requirements-sota-int.txt.
Each generated file's header holds the uv command that regenerates it. The
two ML locks take torch and torchvision from the CPU wheel index through
wai/tools/torch-cpu-overrides.txt (2.14.0+cpu on Linux, 2.14.0 on macOS),
with no CUDA packages. The new lock files are added to the path filters of
the workflows that install them.
pillow goes from 12.3.0 to 13.0.0 in requirements-sota-int.txt: 12.x has
heap overflows in the TIFF writer and the JPEG decoder and an argument
injection into Ghostscript (GHSA-332p-7hrc-92wf, GHSA-8g5g-8vmr-9782,
GHSA-w889-685w-c8fh); 13.0.0 is the first fixed release.
The 26 verifier and differential calls that ran without -I now run with it,
so neither the working directory nor PYTHON* variables can put a module in
front of the standard library: pin, int_payload, staged, http (4), measure,
sim, sim_diff, claim, differential, jwp, chain and chain-gap differentials,
signer (2), check_shapes, smart-byte verify_v1, pack_verify and the five pack
differentials (7). Each script already puts its own directory on sys.path.
Co-Authored-By: Claude Opus 5.5 <[email protected] >
2026-10-22 13:56:02 -04:00
ci: every Python install pinned by SHA-256; verifiers run with -I
2026-10-22 13:56:02 -04:00
ci: run the new platform-gated meter tests where their platform is
2026-10-10 18:11:22 -04:00
Merge T1 #401 (MOQT drafts -18 and -16, interoperability) into train/live-room
2026-10-22 03:46:09 -04:00
WAI_RATING as a wire identifier, the CHANGELOG, SPEC §5, the READMEs, the example configuration and CI's path filters
2026-10-21 19:27:22 -04:00
Merge B1 #413 (the browser sink and contentBinding) into train/live-room
2026-10-22 03:45:27 -04:00
jouleclaw-omni: read mmap'd GGUF bytes without assuming their alignment
2026-10-20 17:09:37 -04:00
ci: one run per branch at a time — no workflow declared a concurrency group
2026-10-05 12:01:57 -04:00
ci: gate on cargo-audit, so an advisory has to be read rather than accumulated
2026-10-22 12:49:04 -04:00
ci: every Python install pinned by SHA-256; verifiers run with -I
2026-10-22 13:56:02 -04:00
int_mlicpp gate 2: the bundle decodes through wmb1/1 to its goldens
2026-10-15 21:44:10 -04:00
ci: every Python install pinned by SHA-256; verifiers run with -I
2026-10-22 13:56:02 -04:00
ci: run each suite for what can affect it; re-runs after a merge become nightly
2026-10-19 02:49:11 -04:00
WIV1 and WIR1 gate 7 (WIP, committed before running): the direct predictors and step leave production
2026-10-17 12:04:26 -04:00
wai: coverage-guided fuzzing of the reader, and the container reservations it found
2026-10-14 10:58:29 -04:00
ci: every Python install pinned by SHA-256; verifiers run with -I
2026-10-22 13:56:02 -04:00
ci: run each suite for what can affect it; re-runs after a merge become nightly
2026-10-19 02:49:11 -04:00
ci: every Python install pinned by SHA-256; verifiers run with -I
2026-10-22 13:56:02 -04:00
ci: run each suite for what can affect it; re-runs after a merge become nightly
2026-10-19 02:49:11 -04:00
wai: D2c M7b gate 4: the networks against the direct networks, on random networks
2026-10-18 01:07:07 -04:00
wai: exact upscale — GPU equality test, CI steps, integer-operators §13.7, determinism-tiers, CHANGELOG
2026-10-21 14:49:03 -04:00
ci: thirteen WAI workflows run only when the pull request's own diff touches them
2026-10-14 03:41:49 -04:00
ci: every Python install pinned by SHA-256; verifiers run with -I
2026-10-22 13:56:02 -04:00
wai-quantum-cli release: link the Linux binaries static, not static-pie
2026-10-20 22:24:10 -04:00
wai-quantum-cli: the command line on the job service's engine, installable
2026-10-20 17:34:16 -04:00
ci: run each suite for what can affect it; re-runs after a merge become nightly
2026-10-19 02:49:11 -04:00
ci: run each suite for what can affect it; re-runs after a merge become nightly
2026-10-19 02:49:11 -04:00
ci: run each suite for what can affect it; re-runs after a merge become nightly
2026-10-19 02:49:11 -04:00
ci: run each suite for what can affect it; re-runs after a merge become nightly
2026-10-19 02:49:11 -04:00
ci: run each suite for what can affect it; re-runs after a merge become nightly
2026-10-19 02:49:11 -04:00
ci: run each suite for what can affect it; re-runs after a merge become nightly
2026-10-19 02:49:11 -04:00
ci: run each suite for what can affect it; re-runs after a merge become nightly
2026-10-19 02:49:11 -04:00
ci: run each suite for what can affect it; re-runs after a merge become nightly
2026-10-19 02:49:11 -04:00
ci: run each suite for what can affect it; re-runs after a merge become nightly
2026-10-19 02:49:11 -04:00
ci: run each suite for what can affect it; re-runs after a merge become nightly
2026-10-19 02:49:11 -04:00
ci: run each suite for what can affect it; re-runs after a merge become nightly
2026-10-19 02:49:11 -04:00
wai-quantum: the cut-rank table on the GPU, and the engine's cutrank_single method
2026-10-20 17:34:17 -04:00
ci: run each suite for what can affect it; re-runs after a merge become nightly
2026-10-19 02:49:11 -04:00
Quantum Studio: one interface for the browser and the desktop app, on the job service's engine
2026-10-20 17:34:16 -04:00
ci: run each suite for what can affect it; re-runs after a merge become nightly
2026-10-19 02:49:11 -04:00
ci: run each suite for what can affect it; re-runs after a merge become nightly
2026-10-19 02:49:11 -04:00
ci: run each suite for what can affect it; re-runs after a merge become nightly
2026-10-19 02:49:11 -04:00
ci: run each suite for what can affect it; re-runs after a merge become nightly
2026-10-19 02:49:11 -04:00
ci: every Python install pinned by SHA-256; verifiers run with -I
2026-10-22 13:56:02 -04:00
ci: thirteen WAI workflows run only when the pull request's own diff touches them
2026-10-14 03:41:49 -04:00
ci: run each suite for what can affect it; re-runs after a merge become nightly
2026-10-19 02:49:11 -04:00
ci: every Python install pinned by SHA-256; verifiers run with -I
2026-10-22 13:56:02 -04:00
48eaa9a587