WAP LabsProject atlas

Evidence before claims

Green has three meanings.

WAP Labs separates code regression confidence, cross-layer integration confidence, and standards evidence. Each level needs its own proof; none silently upgrades into the next.

Confidence vocabulary

Say exactly what is green.

01

Regression-green

The required checks for this change passed: repository hygiene, the path-selected layer suites, security review, and CodeQL.

Does not mean: It does not mean skipped layers ran, that a real gateway was exercised, or that a standards profile is conformant.

02

Integration-green

The relevant seams passed together: native/WASM boundaries, generated contracts, fixtures or replays, host stories, and—when the claim needs it—the real Kannel stack.

Does not mean: It proves only the exercised routes and environments. Deterministic browser adapters are not native Tauri, and Kannel smoke is not broad interoperability.

03

Conformance-green

A named selected profile or clause set has authoritative provenance, Class C/SCR selection, clause mappings, implementation evidence, and synchronized Atlas/graph projections.

Does not mean: This is profile- and clause-scoped. The repository does not claim full WAP 1.2.1 conformance or certification.

Traceability chain

From authority to auditable evidence.

Build-time values come from validated Atlas inputs.

  1. Specification provenance

    97 release members in the validated source manifest

  2. Effective specification

    35 base, amendment, SIN, and historical-family resolutions

  3. Class C + SCR selection

    198 selected SCR parent rows at build time

  4. Normative clauses

    762 selected clauses; status remains clause-specific

  5. Requirements + work

    82 program work items mapped from the active compliance plan

  6. Implementation

    Layer-owned Rust, WASM boundary, Tauri host, and frontend code

  7. Executable evidence

    Unit, fixture, contract, story, replay, smoke, and E2E results

  8. Projection drift

    Schema, ledger, knowledge-graph, and Atlas build verification

Executable-evidence rule: implementation plus a passing, reproducible evidence command may support a claim. Prose, graph edges, an example without a flow, or a ticket status can describe intent and traceability, but never substitutes for execution.

Canonical local commands

Choose scope without hiding exclusions.

Local verification contract ↗
Fastpnpm verify:fast

Runs the verification-orchestrator tests, Git whitespace check, and managed release-version check.

Changepnpm verify · pnpm verify:change

Runs strict common checks plus every deterministic lane selected by committed, staged, unstaged, and untracked paths relative to origin/main.

Fullpnpm verify:full

Runs every deterministic offline lane: compliance/status and graph drift; native and WASM engine, contracts, and stories; transport; browser host, frontend, and rendered accessibility; Atlas; marketing; and Go WML origin checks.

Extendedpnpm verify:extended

Runs Full, then requires the already-running Kannel/WML stack. The repeated browser baseline is reported as advisory, not a release budget.

Result vocabulary

Missing tools never become a silent success.

Full is the strict offline pre-PR profile. Live Kannel is an intentional exclusion there and becomes required only in Extended; fuzzing, GitHub-hosted security/coverage, deploys, releases, and native OS packaging remain separate environments.

PASS
Every required command in the selected lane passed.
INTENTIONAL EXCLUSION
The profile or changed paths deliberately did not select the lane.
UNAVAILABLE PREREQUISITE
A selected required tool or dependency is missing; the command fails with remediation.
ADVISORY
The lane is intentionally non-blocking whether its evidence passes or fails.
FAILURE
A selected required command failed and the overall command exits nonzero.

Current claim boundary

Partial profiles stay partial.

Atlas renders the current compliance program as written. Families and clauses can be selected, planned, partial, or assessed independently. “Conformance-green” is valid only for a named selected slice whose complete evidence chain is green.

Implementation claim
pre-conformance
Certification claim
none
Assessed selected clauses
275 / 762
Inspect the selected profile →

Lane catalog

What runs, and what it proves.

requiredpath scopedscheduledadvisoryon demandmanual

Merge gate and change selection

requiredpath scoped

Detect Changed Areas selects layer jobs for ordinary pull requests. Repo Hygiene always runs; CI Required Gate and Extended Quality Required Gate reject failed or cancelled selected prerequisites and accept intentional path skips. Compliance-affecting paths also select WAP Compliance and Status Drift.

Proves
The required repository-wide checks and both aggregate gates ran, and every layer selected for the diff completed successfully.
Does not prove
A skipped layer was retested. Pushes to main, manual CI, and repository-owned Dependabot pull requests deliberately run the full matrix.
Run locallypnpm verify

Native WaveNav engine

requiredpath scoped

Rust parser, runtime, navigation, focus, scripting, layout, render, fixture, and failure-path tests run under the engine coverage gate when engine paths change. The Extended Quality aggregate also selects zero-warning Clippy for engine changes.

Proves
Native engine behavior is deterministic for the tested inputs and meets the configured line and function coverage floors.
Does not prove
The WASM binding, browser host, transport path, or an unselected normative clause behaves correctly.
Run locallycd engine-wasm/engine && cargo test

Native/WASM boundary and executable stories

requiredpath scoped

wasm-pack boundary tests, Rust-derived DTO drift checks, story-schema tests, and Playwright flows for the host sample and real Waves frontend.

Proves
Selected parity-critical state, render, trace, script, and host-session behavior survives the WASM boundary and works through production-built web surfaces.
Does not prove
Every native API has a live differential twin. Waves stories use a deterministic in-memory fetch adapter, not native Tauri transport or Kannel.
Run locallypnpm test:story all

Transport codecs, fixtures, and replay

requiredpath scoped

Lowband unit and integration tests cover WSP/WBXML codecs, deterministic mapped fixtures, constrained WDP delivery, WCMP behavior, and byte-exact interop replay seeds.

Proves
The selected synthetic and source-mapped packets produce fixed outcomes through transport-owned decode, mapping, reassembly, and replay paths.
Does not prove
All bearers, live network timing, general WSP/WTP activation, or full transport conformance. Conditional replay seeds remain scaffolding where the active profile says so.
Run locallymake test-rust-transport && make test-transport-fixtures

Tauri host and browser frontend

requiredpath scoped

Tauri Rust library coverage exercises commands, engine flow, wrappers, and fetch adapters. Local Vitest covers frontend state and presentation; GitHub CI owns the platform-sensitive coverage threshold. Type, lint, format, capability, permission, and command-schema checks guard the host boundary.

Proves
The tested native command adapters and frontend behavior agree with generated contracts and configured coverage floors.
Does not prove
A packaged desktop window, platform accessibility bridge, real remote gateway, or every operating-system integration was exercised.
Run locallypnpm --dir browser run tauri:generated:check && pnpm --dir browser/frontend test

Contracts, schemas, ledgers, and Atlas drift

requiredpath scoped

Rust-owned TypeScript projections, Tauri schemas, story manifests, Atlas JSON Schemas, transport evidence references, requirement/status rollups, and the WAP knowledge graph are regenerated or validated against committed inputs. CI exposes a path-aware WAP Compliance and Status Drift job.

Proves
Consumers and projections match their canonical active sources, references resolve, ordering is stable, and generated views have not silently drifted.
Does not prove
A graph edge, passing schema, ticket status, or prose acceptance statement is executable implementation evidence.
Run locallypnpm wap-compliance:check && pnpm --dir docs-portal run test:data

Kannel real-stack smoke

on demand

Extended requires an already-running Kannel/WML stack, then exercises transport and browser-host smoke paths against it. The same real-stack lane is available through a manual GitHub workflow.

Proves
One real gateway path can fetch, hand off, load, render, and navigate the smoke scenario across process and protocol boundaries.
Does not prove
Broad gateway interoperability, production reliability, every transport profile, or a required pull-request gate.
Run locallypnpm verify:extended

Engine fuzzing

scheduledon demand

A weekly and manually configurable cargo-fuzz lane sends bounded arbitrary WML input to the engine target and retains crash artifacts.

Proves
The executed corpus and mutations did not expose a crash, hang beyond the configured timeout, or sanitizer-detected failure.
Does not prove
Exhaustive safety, semantic correctness, or WAP/WML conformance.
Run locallycd engine-wasm/engine && cargo +nightly fuzz run engine_wml_fuzzer

Rendered accessibility

requiredpath scoped

The Full and selected Change profiles run production-built Chromium checks for axe, target geometry, visible focus, overflow, and 200 percent layouts. GitHub repeats the gate for browser frontend and its engine, contract, and build inputs.

Proves
The production-built deterministic browser surface meets the asserted web accessibility behaviors at configured window sizes.
Does not prove
Device compatibility, native macOS announcement timing, platform-drawn chrome quality, or an accessibility certification.
Run locallypnpm --dir browser/frontend run test:accessibility:rendered

Browser stability baseline

scheduledadvisoryon demandmanual

The weekly/manual workflow records startup, input, navigation, window, and keyboard behavior with 20 runs by default. Extended reports a bounded three-run signal as advisory. Packaged macOS VoiceOver remains a separate manual observation.

Proves
Deterministic behavior assertions passed and the run retained reference-environment latency samples and screenshots.
Does not prove
A release performance budget, cross-device timing guarantee, or native accessibility behavior. Recorded latency has no pass/fail threshold.
Run locallyWAVES_BASELINE_RUNS=20 pnpm test:baseline:waves

CodeQL and dependency security

requiredscheduledon demand

Pull requests run JavaScript/TypeScript, Rust, and Go CodeQL plus dependency review and Rust, Node, and Go advisory audits. Code scanning and audits also run weekly and on demand.

Proves
The configured static queries and current advisory databases found no merge-blocking result in the scanned source and dependency graph.
Does not prove
Absence of vulnerabilities, runtime exploit resistance, or security of excluded generated/build paths and unmodeled environments.
Run locallycargo audit && pnpm audit --audit-level high && govulncheck ./...

Builds, deploys, and releases

requiredpath scopedon demand

Selected pull requests build product surfaces. Main-path changes rebuild and deploy the marketing site, simulator, and Atlas; milestone releases manually rebuild and package source and site artifacts.

Proves
The selected static applications and release bundles assemble successfully from pinned manifests and can be published by the configured workflow.
Does not prove
Passing product behavior, standards conformance, deployment availability after the workflow, or approval to promote a planned profile.
Run locallypnpm build:node && pnpm --dir docs-portal run build

Story coverage advisory and manual evidence

advisorymanual

The story-coverage report names examples without adjacent executable flows but never fails the build. Manual checklists cover only gaps that automation cannot observe and must name their environment and scope.

Proves
Known story gaps are visible, and a recorded manual run can support only the observations it explicitly captured.
Does not prove
Prose testing criteria, a ticket marked done, or an example file by itself is executable coverage. An unrecorded manual intention is no evidence at all.
Run locallypnpm --dir engine-wasm/host-sample run examples:story-coverage

Release question

Which claim are we trying to make?

Start with the claim, select the lanes that can actually observe it, preserve their results, and then synchronize the active ledgers and graph. A green check is evidence only within its stated boundary.

Runbook ↗Coverage ledger