open-standards/joule-code/CHANGELOG.md

Changelog

All notable changes to the Joule Code standard are recorded here. The format follows the spirit of Keep a Changelog; the standard versions independently of its siblings (tags joule-code-vX.Y.Z).

[Unreleased]

Added — joule-moq-relay: relay-to-relay cascading

• [[upstream]]: relays this one dials, over native QUIC (moqt://), WebTransport (https://) or the WebSocket binding (wss://, or ws:// on a trusted path), each trusting a CA file, a pinned certificate's SHA-256 or the platform's roots, presenting a token read from a file and named by its SHA-256, and routing the namespace prefixes it lists. A link redials after its session ends, backing off to 30 seconds.
• Routing: a SUBSCRIBE, FETCH or TRACK_STATUS for a track no session of the relay publishes goes upstream once, on the first link of the configuration's order whose session is open; the subscription it makes is the relay's own, cached and fanned out to every local subscriber; a link that refuses or does not answer is passed over for the next, and when none answers the request is refused TIMEOUT with no_upstream. Namespaces published to the relay, by PUBLISH_NAMESPACE or by a track's PUBLISH, are published on every link that routes them, and a SUBSCRIBE_NAMESPACE is forwarded on every link it overlaps, the upstream's NAMESPACE and NAMESPACE_DONE merged with the relay's own.
• Loops: both ends of a link declare the Setup Option RELAY_ID (0x3A4F, the relay's summary key), the dialer proving it over the listener's challenge; every request between relays then carries RELAY_PATH (0x3A51, negotiated so, -22 §9.20), and no relay forwards a request back where it came from, to a relay on its path, or past limits.max_relay_hops; one that receives its own id is refused relay_loop.
• GOAWAY from an upstream moves the link's subscriptions to a session to the URI it names (else the link's own) and closes the old one; it is never passed on downstream. The relay's own GOAWAY on a session it dialed names no URI.
• WAI evidence at every hop: the door of every relay checks what a peer forwards; each relay's per-hop record counts a link in its track entries and not as a subscriber session or in its ledger; the floor and audience inputs are decided at the relay the performer or the author publishes to, and read for their statements alone over a link; a FETCH or a fill of a track the relay knows nothing of learns its live edge upstream first, so the seek power is held at the viewer's relay.
• joule-moq: Parameter::RelayPath and RELAY_ID_OPTION; the bridges refuse the parameter by name.
• tests/cascade.rs: two relays over each transport, a chain of three with a per-hop record at each hop, a door refusing a tampered object another relay forwarded, a loop, failover and no_upstream, GOAWAY, a DVR window fetched through an edge, and co-performance votes and the floor across relays.

Added — joule-moq: WAI envelopes on LOC objects

• joule-moq: module loc (WAI extensions/loc-carriage.md). An envelope whose payload is one WebCodecs chunk (wai.audio.opus.packet, wai.video.avc, wai.video.hevc, wai.audio.aac) is written as one object of a track of packaging loc (draft-ietf-moq-loc-04): its payload as the LOC Payload, and in the Immutable Properties the LOC properties, the manifest as WAI_MANIFEST (0x3A61) and the WAI_RECEIPT property. from_loc reads an object back into the envelope, byte for byte, refusing with the extension's codes. examples/loc_vectors.rs writes WAI's corpus live-conformance/loc/ and tests/loc_vectors.rs regenerates and checks it; WAI's loc_verify.py is its second implementation.

Added — joule-moq: draft-ietf-moq-transport-18 and -16 beside -22, and runs against other implementations' relays

• joule-moq: codec modules draft18 and draft16 (control messages, parameters, Key-Value-Pairs, subgroup, fetch and padding streams, datagrams), and draft::Draft, which chooses a session's draft before its first MOQT byte by ALPN moqt-NN or the WT-Available-Protocols value, preferring -22, then -18, then -16; -22 stays the default. draft18::bridge and draft16::bridge map every message and object to and from the -22 model and name what one draft can say and the other cannot (refused with REQUEST_ERROR, or left out and noted). The README tables each difference. Each draft has a vector corpus (tests/vectors/draft-18, tests/vectors/draft-16) that the crate regenerates and checks, and that a decoder written from that draft's text reads (moqt18_check.py, moqt16_check.py, run in CI); the drafts' own examples are among them.
• joule-moq-relay: sessions at -18 and -16 run behind transport::bridge, which presents them to the relay as -22 sessions: at -18 stream by stream, at -16 by giving each request on the control stream a stream of its own (Request IDs renumbered, MAX_REQUEST_ID granted, cancelled streams become -16's cancel messages). The client takes a draft, and the WebTransport client a TLS configuration. tests/drafts.rs runs the relay's scenario at each draft and across drafts, and sessions written from the -18 and -16 messages themselves.
• joule-moq-interop, new: the interoperability runner's test cases at -22, -18 or -16 against any relay, through the runner's test-client interface (TAP 14), and wai-receipts, which publishes a WAI track, its receipts track and a catalog through a relay and verifies every object at a second session against its receipt (inclusion, the receipts chain, the properties carried in the object), with --tamper to show the check refuses altered payloads, receipts or objects in flight. scripts/public.py runs it against the relays the runner's registry lists, scripts/clients.sh runs other implementations' test clients against joule-moq-relay, and scripts/local.sh runs both on loopback. The runs that reach the public internet are not part of CI; the results of 2026-10-21 are in joule-moq's README.

Fixed — joule-moq-relay, found by those runs

• A PUBLISH_DONE that arrives before the streams it counts no longer cuts them: the relay waits until it has read as many of the publisher's data streams as the Stream Count says, or three seconds (-22 §9.9; the request stream and data streams are not ordered).
• A track published again after TRACK_ENDED is a new instance: the ended one's cache, Largest Location and subgroup owners go, so the new publisher's objects are not dropped as duplicates (a DVR-kept track is kept whole).
• A publisher that closes its control stream as it leaves (a protocol violation) loses no object or PUBLISH_DONE it sent: the session closes once its publishing has ended, or after three seconds; the end of its session ends its tracks with the PUBLISH_DONE status already read, not GOING_AWAY.
• At -18 a requester's FIN on PUBLISH_NAMESPACE, SUBSCRIBE_NAMESPACE or SUBSCRIBE_TRACKS cancels it (-18 §6.1, §6.2), where at -22 it does not (§6.4.2.2).
• At -16 a Request ID ahead of one in flight on another stream (SUBSCRIBE_NAMESPACE rides its own) is admitted; a repeated one still closes the session.

Added — end-to-end encrypted rooms in the browser (L10b): joule-moq-web's e2ee build, the room service's log

• joule-moq-mls: a member behind a carrier that orders the room's MLS messages. stage_create and stage_commit hold the member's GroupInfo or commit until the carrier returns it (receive applies it then, checked as every member checks it); another's commit first, or a refusal, withdraws it (withdraw). Before its Welcome a principal follows the group from its handshake messages, sharing the clock's code; a Welcome for another and a GroupInfo of a group it holds are ignored. Clock::key_package_if keeps a KeyPackage only from a principal the room admitted. Feature js builds the crate for wasm32-unknown-unknown: randomness and the clock from the page's own APIs, for the MLS library and for its crypto provider's generator.
• joule-moq: a keyring holds the locations it opened by epoch, and drops them with the epoch's keys.
• joule-moq-web, feature e2ee, built as a second wasm, joule_moq_web_e2ee, under a new workspace profile wasm (release, link-time optimisation, one codegen unit, size): the member (E2eeMember: KeyPackage, lifecycle events, the log's messages in order, staged create and commit, seal and open with the reason or the epoch to wait for), the record's check, TrackSigner.signSealed (the receipt over the sealed bytes, no WAI_RECEIPT), and UniItem.properties. The room page in such a room checks the record, loads that build, leaves a KeyPackage, follows the room's log (web/room/e2ee.js), seals each frame before it is signed and published, opens each object before it is decoded, shows its epoch and roster, and offers no watching and no seeking back. e2e/room.e2e.mjs gains the e2ee scenario.
• joule-moq-room: [room] e2ee = true gives each room a WRE1 record and a clock that is the MLS group's external sender, and the room's log: GET /mls, POST /mls/key-package, POST /mls/post; GET /room carries the record.

Changed — joule-moq-relay: a session over WebTransport closes with its code and reason

• The relay closes a WebTransport session, not the QUIC connection under it (draft-ietf-moq-transport-22 §6.6): a WT_CLOSE_SESSION capsule on the CONNECT stream carries the MOQT session termination code as the session's 32-bit application error code, unmapped, and the reason (draft-ietf-webtrans-http3-16 §6); the QUIC connection closes after the peer has closed its side of that stream, or two seconds on. A page now reads the relay's code and reason over WebTransport as it does over the WebSocket binding: a grant presented without its proof, for one, is UNAUTHORIZED (2) with its live-rooms §10.5 reason, where the page saw only that the session was lost.
• Nothing of the session overtakes its close. A stream the relay lets go once a WebTransport session is closing is held until the QUIC connection has closed, so no FIN or STOP_SENDING reaches the page ahead of the capsule (a page whose stream was stopped just before the close was seen to lose its renderer); a stream the relay refuses before SETUP is kept until then too.
• A peer's close is read the same way. closed() over WebTransport gives the code and reason of the peer's WT_CLOSE_SESSION (by_peer: true), so a page's close code reaches the session's signed summary; a QUIC connection closed with the session still open gives no MOQT code (its code is HTTP/3's).
• wtransport 0.7.2 is vendored (joule-code-rs/vendor/wtransport, MIT OR Apache-2.0, patched in for the joule-code workspace and joule-moq-room), because the release reads WT_CLOSE_SESSION but cannot send it. The change gives it Connection::close_session and ConnectionError::SessionClosed, and makes closed() report the session's end; VENDORED.md lists every change and why. Its unit tests, the capsule's bytes against the draft's layout among them, run in the relay's CI job.
• Tests. tests/webtransport_close.rs: the relay refusing a grant without its proof, refusing a stream that breaks a rule before SETUP (with no STOP_SENDING ahead of the close), refusing a session past its session count, and ending one at its time limit, each read by the client as the exact code and reason; and a client's own close, recorded as the peer's in the relay's summary. The browser end-to-end check of a bare grant now requires code 2 and the reason over WebTransport too.

Added — DVR on the relay (L7b): joule-moq-relay's DVR store, the seek power, the room page's Seek back

• joule-moq-relay keeps a DVR window on disk ([dvr], [[dvr.window]]; WAI live-recording §8): every track under a window's prefix, with its receipts, a group stored once the cache holds it whole, appended to the track's current segment file (a new one every ten seconds or 16 MiB) and synced at least once a second. A window by age (at most 24 hours) and by bytes, evicted lowest group first by whole group, each media group with its receipts group, so a track's window is always one run of groups. On start every object is checked again (its own check, then its receipt, or each event record's signature): one that does not verify is dropped, counted, written out of its file, and never served. A FETCH the cache does not cover is answered from the cache and the store together where they cover it, read as the fetch stream drains; what was evicted is an End of Unknown Range. TRACK_STATUS and FETCH answer from the store once a publisher is gone.
• The seek power at the relay (WAI live-rooms §10.6): a FETCH or fill below the live edge needs an authority's grant whose powers hold bit 4, or a rule with seek = true; otherwise UNAUTHORIZED, seek_not_granted. [[auth.grants]] rules gain seek (default false).
• Moderation in the store: the relay reads decision events from the events tracks it forwards, honours a room key's (dvr.room_keys, the authorities' keys) or a moderator grant's, and withholds what deny or redact target from every FETCH and fill, erasing a redacted object from disk; the decisions are kept in decisions.wdl across a restart.
• A sealed room is never kept (WAI confidentiality §9, live-recording §8.2). The store knows the room by its first object carrying a secure-objects Key ID. That object's group is never written. The store then deletes what it held of the room (its events and receipts, in the clear) and drops the room's decisions from the log. It writes nothing more of the room, and sealed.wdl keeps it so across a restart.
• WMH1 version 2 from a relay with a store, with its DVR figures; the session summary's tracks gain dvr_objects and dvr_bytes.
• The cache, for every relay: a media group and its receipts group leave the cache together, and evicting one moves the other's mark, so a FETCH never serves media from the cache without its receipts.
• joule-moq: GrantHead reads a grant's powers (moderates, seeks); receipt::verify_strict is public.
• joule-moq-room: every role, and so every grant, holds the seek power, so a late joiner's FETCH of earlier groups is served by a relay that checks it.
• joule-moq-ingest reads roles and grants with the seek power.
• joule-moq-web: the room page's Seek back control fetches a participant's last seconds from the relay's window, verifies every object against its receipt, plays the video from its first key frame in a view of its own, and returns to live; the browser end-to-end test's dvr scenario covers it in a real browser against a relay whose cache is far smaller than the span sought back.

Added

• §5.1 Grant-gated consultation (OPTIONAL) — the JCP binding: tier as granted action (l0…l4), energy class as chained budget debit, denial as fallthrough, every consultation sealed as a chained JCR-1 receipt. Reference binding: the joule-code-jcp crate (JcpGate::wrap over any Stage); no l4 in the chain → no remote frontier agent, structurally. Conformance gains class C5 with a published vector file (gated_cascade_vectors.json, fixed fixture identities, deterministic end to end) run by the harness against the real jcp runtime alongside C1–C4.

• joule-code-cascade ships a reference L0 (Cache) stage: a content-addressed cache of resolved coding operations keyed by (prior, intent). A hit closes the request at L0 (picojoule class) without consulting any higher tier — the first concrete cascade stage, making stop-at-first-close demonstrable in the reference library. A third party may use it or substitute its own.

• joule-code-cascade ships a generic FnStage: any tier (L1 Lawful, L2 Embed, L3 Model) can be expressed by supplying a resolver closure, so a consumer binds the JouleClaw agent schema — or any other runtime/model — to the cascade without this crate depending on it. (A test wires an L3 model stage behind an empty L0 and confirms it closes at L3.)

• examples/l3-jouleclaw/ — a consumer binding showing JouleClaw's L3 (Model) tier wired into the cascade: a jouleclaw_llm_cheap::LlmBackend behind a FnStage(L3) that generates a CodingOp + joules-class receipt. Three backends share the slot: EchoBackend (model-free, for the unit tests); JouleclawRuntimeBackend, which runs a GGUF model in-process on JouleClaw's own from-scratch tensor runtime (jouleclaw-runtime over jouleclaw-loader-gguf and the reference/Apple kernel backends — no llama.cpp, no FFI); and LlamaCompletionBackend, which shells out to llama.cpp. The run binary generates with a local model (in-process runtime by default; JOULE_CODE_L3_ENGINE=llama for the shell-out), content-addresses the result as a CodingOp, and meters host energy over the inference for the receipt (honest provenance: HwShunt on RAPL/NVML, Estimator on Apple). Verified live: the llama.cpp path against a local 350M GGUF, and the in-process from-scratch runtime against ternary-bonsai-1.7b-q2_0 (qwen3, Q2_0) — real text, a real op_id, the cascade closing at L3 (tests/runtime_l3.rs, opt-in via --ignored). Standalone workspace, so the standard's lib stays free of a JouleClaw dependency; jouleclaw_dispatch::ModelBank selects the cheapest capable backend in production.

• joule-code-collab (Research) lands the federated-collaboration interface (Collab trait: submit / committed / membership), a single-node reference cluster (LocalCluster), and the BFT consensus core (LockstepCluster): a multi-node lockstep deterministic simulation with BFT supermajority commit — an op commits only when ≥2f+1 of n=3f+1 honest nodes independently validate it, and committed ops are op_id-ordered so every honest node derives a byte-identical log. Tested: commits with honest agreement, tolerates f Byzantine nodes (safety), loses liveness only beyond f, rejects non-members despite quorum, deterministic round ordering. It also adds protected — FROST threshold authorization of protected operations: a t-of-n FROST (Ed25519) aggregate signature over an op's op_id, verifiable against the cluster's single group key (no member holds the whole key; fewer than t cannot authorize). Tested: a 2-of-3 threshold authorizes and binds exactly one op_id; below threshold cannot. And MLS group keying (RFC 9420, via openmls, tests/mls_keying.rs): the cluster members form an MLS group and derive a shared group key with no central server — verified that members agree on the exported secret, that adding a member advances the epoch, and that a member an epoch behind derives a different (forward-secret) key. (SPEC §7, spec/collab.md.)

• examples/transport-moqt/ — the CommunicationOS (MoQT) transport binding, the last of the four federation layers. A consumer binding that carries a collaboration's committed (consensus-ordered) coding operations over inv-moq — CommunicationOS's MoQT (Media over QUIC Transport) protocol with its JWP receipt extension. The end-to-end test wires the whole stack in-process: LockstepCluster commits ops → each is published as a MoQT object → every object carries a real Ed25519/BLAKE3 signed receipt → a subscriber receives all ops, verifies the receipts against the publisher key, and recovers the original SignedOp intact; a second test shows a receipt-requiring subscriber rejecting an untrusted publisher's group (ownerless authenticity). Driven through inv-moq's MockFabric (real signatures + BLAKE3 merkle receipts, no QUIC; the quic feature is the real-wire path behind the same trait surface). Standalone workspace, so the reference library stays free of a joulesperbit dependency. The four federation layers — consensus, threshold authorization, group keying, transport — are now all implemented and tested. (SPEC §7, spec/collab.md.)

Changed

• §6 / spec/receipt.md §2 — a vendor counter is a hardware reading only while it is demonstrably live. A reading from a vendor energy counter (RAPL, NVML, Apple SMC/IOReport) MAY be tagged HwShunt, and supply measured_uj, only while the counter has been observed advancing under load for the domain the figure claims (for IOReport: the CPU energy rail itself, in at least 5 sample intervals, at least 4 of every 5, over at least 300 ms of CPU burn). A counter that is present but not live — frozen, or republished in lumps — MUST NOT produce either; the reading falls back to the estimator. A figure MUST NOT claim coverage of a domain its counter does not read. No wire or conformance-vector change.

Added — the public room (L5c-2): joule-moq-room, room authorities at the relay

• joule-moq-room, a room service (a workspace of its own, on wai-rs's room, event and composition records): it holds a room's authority and clock keys (a 0600 file it refuses to read otherwise), signs short-lived WRG1 grants for keys pages make (POST /grant, a publisher's or a viewer's, bounded per client address, overall and per room), authors join, publish and leave on the clock's events track from what the relay carries (its clock watches each publisher's video track), and serves the signed descriptor and grants (GET /room). A new room starts when the last publisher has left.
• joule-moq-relay: [[auth.authorities]] honours every grant an authority's key signs, beside its proof, within its window, mapped as live-rooms §10.2 maps it (joule-moq's GrantHead reads it); a field * in a rule's prefix; a door rule's trust_field; limits.max_session_ms, max_ingress_kbps and max_resident_mb; a rule's unlimited; a session ends when its authority grant expires; SIGTERM stops it as Ctrl-C does.
• joule-moq-relay fixes found on the deployed room: the WebSocket binding's multiplexer dropped the half of a stream that arrived after its session closed while it held its state's lock, which that half's Drop takes, and the relay's runtime deadlocked (any session the relay closed while its peer still opened streams could do it); and a FETCH not yet covered only because groups are still arriving now waits for them, briefly, rather than going to a publisher that takes no requests.
• joule-moq-web: the room page's service mode (its own key, a grant from the service, the WebSocket binding, Join, Watch, Leave and a typed caption), Room.setGrants in wai-live-web, grantProofBy and clientSetupWithProof for a test's proof by another key, and the service end-to-end scenario, which also runs against a deployment (--base).

Changed — joule-moq, joule-moq-relay and joule-moq-web: L5 hardening

• ReceiptChains: a join's fill from group 0. A group fetched into the gap below a join's anchor, with a null parent, is held as history and admitted when the group above it links back to it (WAI jwp-receipts §3 step 3), where it was refused chain_break. A null parent outside that gap, and a fork, are still chain_break.
• Receipts in WAI's binary form (jwp-receipts §2.7). GroupReceipt::to_binary / from_binary (the canonical bytes, and a legacy group's parent), ObjectReceipt:: to_binary / from_binary / body_binary, read_receipts, link_hash_of, Malformed, RECEIPTS_MAGIC. ReceiptBundle::to_payload and from_payload keep their signatures and now write and read WJR1; ReceiptBundle::read also gives the link hash over the bytes received. The JWP_OBJECT_RECEIPT property carries an object receipt standing alone in that form. The JSON payload is not read any more. Serde derives on the receipt types stay, for callers' own use; nothing on the wire uses them.
• Proof of possession of a room grant (WAI live-rooms §10.5). joule-moq::grant_proof: the WRP1 record (GrantProof::sign, read, to_bytes), check_proof (§10.5.4, the grant's digest and principal from the caller's own reader), grant_digest_and_principal (for a verifier with none), the Setup Options SETUP_OPTION_GRANT_CHALLENGE (0x3A47) and SETUP_OPTION_GRANT_PROOF (0x3A49) with add_challenge, challenge_of, add_grant, proofs_of, proof_for, the HTTP header names, context and base64url. New dependency: sha2 0.10 (already in the lockfile).
• joule-moq-relay. The relay sends its SETUP first, with a fresh challenge and the receipt extension declared whatever the client says. A grant rule with proof = true names a room grant's record: a SETUP that presents it without a proof that passes is closed UNAUTHORIZED (§12.2), and a request resting on it is refused unless its session proved it. The transports give the session the target the client addressed (WebTransport :authority and :path, the WebSocket upgrade's Host and path; native QUIC's AUTHORITY and PATH). Authorizer::allows takes the proven set; Authorizer::requires_proof; ClientOptions gains grants, target and sign_challenge. receipts_track_suffix defaults to _receipts, live-rooms §6.1's.
• joule-moq-web. A participant presents its grant with a proof signed in wasm (clientSetupWithGrant), the per-participant secret gone; the receipts tracks are 0_receipts; the verifier measures each receipts object, and the same receipts as JSON.

Changed — joule-moq 0.3.0: draft-ietf-moq-transport-22

joule-moq speaks draft-ietf-moq-transport-22 (1 October 2026), negotiated by the ALPN moqt-22, in place of its draft-08-style codec. No byte of the old wire form survives: -22 changed the varint, the control streams, every message and the object framing. The crate's version moves to 0.3.0 because its public API changes:

• draft22: the codec of -22, a module of its own selected through draft::Draft, so another draft can be added beside it. Every control message and parameter, Key-Value-Pairs, Properties, Setup Options, the Authorization Token, Request IDs and request-stream rules, subgroup streams, datagrams, fetch streams and padding, and the status and error codes. Every refusal is a typed WireError carrying the draft's consequence; MoqError::Wire wraps it.
• MOQT_DRAFT_VERSION is 0xff000016. transport_quic::ALPN_MOQT is moqt-22.
• messages re-exports -22's control messages. SetupMessage, AnnounceMessage, SubscribeMessage, SubscribeFilter and the draft-08 ControlMessage are gone. SUBSCRIBE's max_mrl_layer is an OBJECT_PROPERTY_FILTER on the MRL_LAYER property (messages::mrl_cap_filter); require_receipts is the subscriber's own policy, met by subscribing to a track's receipts track.
• carriage (new): the crate's objects ride -22 subgroup objects, with the object receipt, the WAI_RECEIPT property of WAI extensions/moq-streaming-format.md §5 and the layer fields as properties in an application range; a group's receipts ride its receipts track (§4.1). ReceiptBundle moved here from mock, which re-exports it.
• session: the draft by ALPN (MoqSession::select_alpn); SETUP carries options and no version or role, and build_setup takes no label; Request IDs by end.
• transport_quic: a pair of unidirectional control streams opened by SETUP, a request stream per request, subgroup, fetch and padding streams, and datagrams. ControlStream, write_object_to_uni, read_object_from_uni, write_group_receipt_to_uni and read_group_receipt_from_uni are replaced by QuicSession::{open_control, accept_control, open_request, accept_request, open_subgroup, open_fetch, accept_data}, send_object, send_receipt_bundle and DataReceiver.
• wire::encode_varint and decode_varint are -22's integer; every u64 encodes.
• mock: objects, receipt bundles and requests cross the -22 codec; the relay reads an object's delivery timeout from its OBJECT_DELIVERY_TIMEOUT property.
• tests/vectors/draft-22/: a corpus of -22 vectors, good and negative, generated by tests/draft22_vectors.rs, and an independent decoder that checks it in CI.

Added — joule-moq-ingest 0.1.0: WHIP into a room's MoQ tracks, WHEP out of them

A new crate, library and binary, between WebRTC and the MoQ tracks of a WAI room, on joule-moq's codec and joule-moq-relay's client. The mapping is WAI's extensions/live-ingest.md.

• WHIP (RFC 9725). POST an offer for the answer, Location and ETag; PATCH for trickle ICE and ICE restarts, with If-Match (428, 412); DELETE. The bearer token is a WAI room grant, checked against the room's signed descriptor; a grant without the publish power for a media kind of the offer is 403 with insufficient_scope (RFC 6750 §3.1). Every request that carries a grant also proves possession of its key (WAI-Room-Proof over a single-use WAI-Room-Challenge, WAI live-rooms §10.5.3), on the session's PATCH, DELETE, GET and HEAD as on the POST.
• Into MoQ. str0m depacketises H.264, VP8, VP9, AV1 and Opus into frames; each frame is one WAI1 envelope in its capability's framing, video grouped at keyframes and audio in fixed windows, with the frame's room-clock time (anchored at the first frame's arrival, re-anchored past max_skew_ms) and, on each group's first object, the grant reference. The gateway publishes the tracks and a signed catalog at the relay as their publisher and signs every group's receipts as the first hop, chained per session.
• WHEP (draft-ietf-wish-whep-05). A player POSTs an offer for an owner's tracks; the gateway reads the owner's catalog once its receipt verifies (409 with Retry-After until then), joins each track at its latest group, verifies every object against its receipt before it packetises the frame back to RTP, and drops and counts what fails.
• Bounds. Sessions, tracks per session, bitrate (stated as b=AS), frame size and the queue to the relay, each a configuration field; gateway.example.toml holds no secret.
• A signed record per session, in the shape of live metering's per-hop record: the seam a WMH1 writer plugs into.
• The WebRTC stack is str0m 0.24.1 (MIT OR Apache-2.0), pinned, with its pure-Rust crypto backend; the HTTP resources are hyper 1.11.1 (MIT). Every crate new to the lockfile is MIT, Apache-2.0 or ISC.
• Tests, on loopback: WHIP to a relay subscriber with every receipt verified and the bytes equal, DELETE ending the tracks; WHEP playback from the joined group; VP8, VP9 and AV1 end to end; the refusals; trickle ICE and an ICE restart with media across it; the room reader against WAI's live-rooms corpus. A CI job runs every target on linux-arm64.

Added — joule-moq-relay: the per-hop session record of a WAI room

The relay signs WAI's per-hop session record, WMH1 (wai/extensions/live-metering.md §3), of a room from its session summaries (metering::hop_record, Relay::hop_record): for each track of the room its sessions carried, the objects and bytes in and out, the objects dropped for their delivery timeout or still queued at the end with those whose receipts it forwarded, the objects refused at the door and deduplicated; its subscriber sessions' time by layer class, from the subscriptions each held; the events it delivered (objects of Object ID above 0 on the room's events tracks); and a ledger of the room grants its sessions ran under, by the token each presented in SETUP ([[metering.grants]] in the configuration). Its own energy is the unmetered marker. The record holds nothing per object or per viewer: media tracks are counted one by one, events tracks and every other track of the room together, subscribers by layer class.

• The session summary carries what the record is made from, and its format is joule-moq-relay/session-summary/2: per track, as a publisher, objects and bytes received, refused at the door and deduplicated; per track, as a subscriber, fetched bytes, objects still queued at the end and objects of Object ID above 0; the session's layer spans per room; and the room grant its SETUP token maps to. A datagram's bytes are now counted among a publisher's bytes received.
• tests/room_metering.rs: two publishers and three subscribers of one room, one subscriber slow, over QUIC and WebTransport; the record verifies under the relay's key and every count in it is the sum of the summaries' counts. Run with WAI_METERING_FIXTURE_DIR, the test writes the record and its ledger, which WAI's metering corpus holds as recorded.

Added — joule-moq-relay 0.1.0: a draft-ietf-moq-transport-22 relay

A new crate, library and binary, on joule-moq's codec. Publishers send it tracks, subscribers ask it for them, and it fans each object out to every subscription in the order -22's priorities give (§5.1.2), dropping what passes a subscriber's delivery timeout at this hop (§5.2). Whatever it drops, the object's receipts still reach the subscriber: a track's receipts track is never given a delivery timeout.

• Three transports, one draft: native QUIC (ALPN moqt-22) and WebTransport over HTTP/3 (WT-Available-Protocols / WT-Protocol, draft-ietf-webtrans-http3-16) on one UDP endpoint, and a WebSocket fallback that carries draft-ietf-webtrans-http2-15 capsules, one per binary message, under the subprotocol moqt-22. The fallback is a non-normative binding, written out in the crate's README with example bytes.
• The relay protocol: session setup; namespace publish and subscribe routing; PUBLISH; SUBSCRIBE served from an upstream the relay holds or opens; FETCH and fills from its cache or forwarded upstream; TRACK_STATUS; REQUEST_UPDATE; GOAWAY on shutdown; Request-ID parity and duplicate checks; the authorization-token alias cache; several publishers of one track, deduplicated by (group, subgroup).
• What the cache covers is worked out from the groups it holds whole, each time it is asked, so a group whose streams finish after a later group's is still served from the cache once it is whole; a group never seen is a gap it does not answer across.
• A signed session summary per session. The relay's own energy is the unmetered marker, since no meter backs it.
• Not yet: SUBSCRIBE_TRACKS and Range Filters, WebTransport over HTTP/2, 0-RTT, the relay moving its own upstream subscriptions, and finding a receipts track from the catalog rather than by its name; the README lists each.

Changed — joule-moq 0.2.0: WAI's labelled JWP forms, and a strict verifier

joule-moq reads and writes the forms of WAI's extensions/jwp-receipts.md that sign an object's energy figure, its class and its origin, and a group total's class. Every receipt in the legacy forms keeps its bytes and verifies as before; a verifier that predates the labelled forms refuses them. The crate's version moves to 0.2.0 because its public API changes:

• ObjectReceipt gains energy_class: Option<Vec<u8>> (the class in WAI energy-measurement §2.7's signed encoding). Present, the object's leaf is BLAKE3("moq-jwp:merkle-leaf\x02" ‖ content_hash ‖ u64_be(joules_micro) ‖ class ‖ u32_be(len(origin)) ‖ origin); absent, the legacy leaf. New: ObjectReceipt::leaf, ObjectReceipt::check_label, ReceiptBuilder::add_labelled_object, ReceiptBuilder::class_for.
• GroupReceipt gains energy_class, energy_coverage and parent_receipt_hash. With a class, the group is signed under moq-jwp:group-sign\x02, which covers the class, the coverage and the parent link. energy_coverage is written only when it is non-zero, and a legacy group carrying a non-zero coverage is refused: its signature does not cover one. New: ReceiptBuilder::finalize_labelled, GroupReceipt::link_hash and compose_group_class, the rule a labelled group's class is composed by.
• ReceiptVerifier::verify_group returns a VerifiedGroup (the root with the group's leaf count and coordinates) instead of the bare root, and verify_object and verify_payload take &VerifiedGroup. An object is accepted only at the position its proof walks: its coordinates are the group's, object_id is its leaf index, the proof has the group's depth and its direction bits are the index's.
• MerkleProof::verify is replaced by MerkleProof::verify_leaf, which takes the leaf in its form and the group's leaf count, and MerkleProof::walks_its_position.
• verify_group holds the key and the signature to WAI jwp-receipts §3.1 step 3's rule: the publisher key must be the canonical encoding of a point not of small order (a y coordinate ≥ p is refused), S must be below L (checked by the crate as well as by verify_strict), R must not be of small order, and the cofactorless equation must hold.
• JWP_MOQ_EXTENSION_VERSION is 2.
• tests/wai_jwp_corpus.rs runs every leaf, group and object vector of wai/jwp-conformance/vectors.json through the crate.

External JWP implementations need the same update to verify labelled leaves and groups, and to refuse what this verifier refuses.

[0.2.0] — draft

Changed

• Receipts now seal as JCR-1 envelopes. The receipt's signed form is the family-shared JCR-1 wire format — canonical det-CBOR (RFC 8949 §4.2.1, length-first key order) inside a COSE_Sign1 envelope (RFC 9052, EdDSA alg = -8), as the joule-code/1 profile. This replaces v0.1's bespoke estimated_uj ‖ sequence ‖ nonce preimage. A Joule Code receipt now verifies under the family's existing JCR-1 tooling and its cross-language (Python/Go) reference verifiers. (SPEC §6.1.)
• joule-code-receipt gains a jcr1 module (canonical CBOR + COSE_Sign1, vendored from the JCR-1 reference, no JouleClaw dependency) and Receipt::to_jcr1_wire / seal / verify_envelope; the bespoke sign/verify are removed.
• Conformance C3 vectors regenerated as JCR-1 COSE_Sign1 envelopes; the harness verifies the envelope and that its payload is the receipt's canonical core. A byte-equality test pins the canonical encoder against a published JCR-1 vector.

[0.1.0] — draft

Initial draft standard.

Added

• SPEC.md — normative specification: the cascade requirement (L0–L4, stop-at-first-close), the receipt requirement (measured + estimated, Provenance), and the no-capture requirement.
• The coding-operation cargo: content-addressed (BLAKE3-256), signed (Ed25519, prior-state-bound) transitions over a source tree; deterministic CBOR canonical form.
• The receipt schema in Joule Wire Protocol form, energy-signed.
• The cascade interface and the agent-schema binding to JouleClaw; the L4 binding to remote frontier agents over ACP.
• The federated-collaboration binding, specified at interface level and classified Research.
• joule-code-rs/ reference library: joule-code-schema, joule-code-cargo, joule-code-receipt, joule-code-cascade, joule-code-conformance.
• conformance/v1/ reference vector pack (C1–C4), internally consistent pending regeneration against the reference library.