The float wai.neural.mlicpp decodes correctly only while its encoder evaluates
the entropy network bit-identically to the decoder. Its validation run, with the
encoder at the runtime's default thread count and the decoder single-threaded,
put one scale on the other side of a table edge at symbol 416 of 12,288 and
decoded garbage from there. Matching the execution settings fixes that run, but
it stays a convention between two implementations. int_mlicpp makes the
agreement a property of the arithmetic: the hyper-decoder, the entropy network
re-run before each of the 2*K channel-slice x checkerboard passes, and the
synthesis are all integer networks, so every decoder derives the encoder's scale
bucket for every element, on any platform and at any thread count.
- wai-rs/src/int_mlicpp.rs: the decoder (a WIM1 payload; a one-file WMB1 model
bundle, so a prior's SHA-256 pins every network and table), built from
int_hyper_synth's networks, int_entropy's bucketing and the rANS decoder.
- Totality. Before the decode allocates anything, each network's shapes are
derived from its layer geometry (the new int_hyper_synth::net_shape, which
shares its geometry with the checked run), and a header whose shapes the
model does not produce, or on which any network would form a buffer over
Header::MAX_TENSOR (2^26) elements, is refused. Latents go through
int_entropy::dequantize (sym * 2^frac + base, None where i64 cannot hold it;
Kani harness), and every network through int_hyper_synth::run_net_checked
(run_net layer by layer, only while no value can leave its type). So a decode
returns an image or an error for any payload, the same one with and without
overflow checks.
- IntModel::from_bytes, the compact network form every integer neural decoder
loads, is total on damaged bytes: it no longer reserves for the layer count it
reads before checking the bytes hold that many (about 480 GB for 2^32 - 1),
and forms layer sizes and read offsets in checked arithmetic (they overflowed
a 32-bit usize).
- run_net and decode share a per-layer function and to_rgb8; every committed
vector still reproduces its hash.
- Registry: NeuralIntegerExact, Lossy, royalty-free (the decoder is this crate's;
the patent status of the techniques was not examined). A new registry test
records the basis of every NeuralIntegerExact capability.
- The neural dispatch decodes it and re-checks a pinned prior against the exact
bytes it decodes with.
- tools/wai_int_mlicpp_export.py writes the committed vector
tests/vectors/int_mlicpp/. Its weights are synthetic and seeded (no trained
model is available), so the vector shows decode-equivalence and nothing about
compression quality.
- Tests: tests/int_mlicpp.rs (the pinned image, bucket and symbol hashes under
every kernel policy and thread count; one unit in each of four chosen
parameters, one per value path, changes the image; damaged payloads never
panic), tests/int_mlicpp_preflight.rs (a counting global allocator: refusing
a header the model cannot fit, or parsing a damaged network, allocates a few
KB at most; the decoder without the pre-flight fails it, and aborts on a
3.4 PB allocation for a synthesis wider than the cap), a byte-exact-conformance
golden, a neural dispatch test and unit tests. CI runs them on the conformance
matrix in both profiles, on the byte-equality matrix, and in neural-gates.
- Evidence: all of the above pass, and the pinned hashes reproduce, on macOS
arm64 and on wasm32-wasip2 under wasmtime 49.0.1, in dev and release. x86_64
was not measured here (no x86_64 translation layer is installed); the Linux
legs come from the byte-exact matrix, and the Windows runner is offline.
- SPEC 5 and 7, the README, determinism-tiers 3, 5 and 6, and the CHANGELOG
record it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
50667cd2a4