417847daab
The change of wai/conform-output, on current main, without its wai doctor: main's doctor, its tests, its catalogue entry, its MCP tool and its changelog entry stand as they are, and this change's copies of them are gone, with the lines dev.rs held for them. wai/README.md, which had no line for main's doctor, gains one in its first commands and `toolchain_doctor` in the core tools. - wai conform --format text|json|junit|html, reports made from the signed records. - --independent beside a kind holds the corpus's independent verifier to the same cases; alone, it runs every corpus's verifier, a record each, from one table. - wai-rs/build.rs reads that table from the `# independent:` lines of the step files (.github/wai-conformance/verifiers/), which take the verifiers' command lines out of the steps' bodies. scripts/wai-conformance-lists.py reads and checks the same lines. - wai-conformance.yml runs the union as wai conform --independent --format junit. - wai mcp's conformance tools read the table. - wai-release.yml runs the quickstart from each archive as a new user runs it (clean-machine.sh, its PowerShell twin clean-machine.ps1), held by check-wai-release-quickstart.py. clean-machine.ps1 keeps clean-machine.sh's contents step and its check of WAI Studio. Each leg keeps main's archive_doctor.py check; the step's own wai hello, verify and dev --check are clean-machine.sh's now. - check-wai-ops-doors.py reads VERBS and NEAR_SYNONYMS from catalogue.rs and keeps no list, and the verb-list test reads what that check reads. - The catalogue's export and Studio's actions hold the new operations. Co-Authored-By: Claude Opus 5.5 <[email protected]>
29 lines
2 KiB
Shell
29 lines
2 KiB
Shell
# step: key release · wai-rs and key_release_verify.py
|
|
# order: 240
|
|
# features: key_release
|
|
# paths: wai/extensions/key-release.md
|
|
# independent: key-release live python3 -I live-conformance/key_release_verify.py live-conformance/keys
|
|
#
|
|
# The proxy form of wai.video.keys (extensions/key-release.md): the reference module's unit
|
|
# tests (the commitment list, the entitlement and the ticket round-trip and their rules
|
|
# refuse, each check of the decision in its order, offline licences and renewals, each own
|
|
# rule of the receipt, its strict signature, the CPIX reader and the derivation of a list
|
|
# from a CPIX document), form 1's unit tests (its legacy pin unchanged), and
|
|
# tests/key_release.rs (every file of the committed corpus regenerates byte for byte from
|
|
# its fixed seeds and no other file is there, every log gets its stated outcome, and the
|
|
# extension's tables are the reference's codes); and, in the step of every independent
|
|
# verifier above, the corpus's second implementation,
|
|
# key_release_verify.py, written from the extension's text and sharing no code with wai-rs,
|
|
# which reads the extension's tables, derives every list from its CPIX document with the
|
|
# standard library's XML parser, recomputes every decision of every log, verifies every
|
|
# signature with WAI's strict Ed25519 rule and BLAKE3 from claim-conformance, and requires
|
|
# every mutated copy of the corpus to fail; standard library only, run isolated (-I).
|
|
#
|
|
# The paths this step brings to the workflow's trigger, and why:
|
|
# wai/extensions/key-release.md: tests/key_release.rs requires this extension's §3.1, §3.2, §7.2
|
|
# and §11 tables to be the reference's codes, key_release_verify.py reads those tables and §3.3,
|
|
# and the registry's wire identifiers test reads its sections.
|
|
set -euo pipefail
|
|
(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib key_release::)
|
|
(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib wai_video_keys::)
|
|
(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test key_release)
|