An OTT session that proves what it delivered.
A streaming session is personalised at the manifest layer: ads spliced into the breaks, blackouts applied, geo enforced. WAI renders that manifest as a pure function of the session class — content, entitlement, geo, blackout set, ad pod, time window — rather than of the viewer, and seals it in an Ed25519 receipt that binds the grant it ran under, the composition, the stitched ads and the policy applied.
Two consequences you can exercise below, in this tab, with the same Rust a native packager runs, compiled to wasm32. First, the manifest is the receipt's subject: manifest_hash is recomputed here from the composition, so substituting a creative breaks the signature. Second, because the manifest depends on the class and not the viewer, one generation serves every viewer in that class — and the receipt records how many, so the per-viewer energy is amortised and checkable rather than asserted.
—
Every viewer whose session resolves to the same class receives byte-identical bytes, so the generation energy is spent once and divided across them. Move the slider to see the amortised figure. The joule total here is a stand-in labelled ModelBased — a deployment supplies a measured one, and the receipt carries the acquisition class beside the number so the two are never confused.
The ad decision is deterministic, and the receipt recomputes what was spent from the impressions that actually started. A grant carries a funds ceiling; a break whose billable spend exceeds it will not verify. Lower the ceiling below the spend and the receipt refuses.
Everything above runs client-side: the composition, the signature, the recomputation. The capability is registered in the spec alongside the rest of the video workflow — packaging with an attested SegmentMap, content-key release, and linear channel assembly whose program-as-run is recomputable per window.