An OTT session that proves what it delivered.

A streaming session is personalised at the manifest layer: ads spliced into the breaks, blackouts applied, geo enforced. WAI renders that manifest as a pure function of the session class — content, entitlement, geo, blackout set, ad pod, time window — rather than of the viewer, and seals it in an Ed25519 receipt that binds the grant it ran under, the composition, the stitched ads and the policy applied.

Two consequences you can exercise below, in this tab, with the same Rust a native packager runs, compiled to wasm32. First, the manifest is the receipt's subject: manifest_hash is recomputed here from the composition, so substituting a creative makes the receipt fail to verify. Second, because the manifest depends on the class and not the viewer, one generation serves every viewer in that class. The receipt signs the number of sessions the generation served, so the per-viewer figure is stated and attributable. That count is declared by the signer; a verifier does not recompute it.

1 — compose & attest

—

segments—

stitched ads—

session_class_hash — the dedup key

—

manifest_hash — sealed in the receipt

—

the manifest the player receives

—

2 — one generation, a whole class

Every viewer whose session resolves to the same class receives byte-identical bytes, so one generation serves them all. Move the slider to change the count the receipt signs as viewers_served. With a metered generation, the per-viewer figure is that generation's energy divided by the signed count, carried with its acquisition class. This demo meters nothing, so it seals the receipt unmetered and shows no energy number.

One manifest per class also lets an edge cache hold a single copy per class and serve it to every viewer in that class.

viewers served by this class: 1

viewers_served (declared by the signer)—

generation energy—

per viewer—

3 — spend checked against the grant

The ad decision is deterministic, and the verifier recomputes billable spend from the impressions the receipt records. A grant carries a funds ceiling; this verifier rejects a break whose recomputed spend exceeds it. Lower the ceiling below the spend and verification fails.

grant funds ceiling (µ): 100000

—

billable impressions—

billable spend—

filled slots — slot, creative, price, quartile

—

Everything above runs client-side: the composition, the signature, the recomputation. These two capabilities are part of WAI's OTT workflow, which also covers packaging with an attested segment map (wai.video.package), content-key release (wai.video.keys) and linear channel assembly whose program-as-run is recomputable per window (wai.video.channel). The reference engine is Apache-2.0 in the open-standards repository.