Live broadcast. Signed all the way.
Seventeen Rust crates that publish, relay, adapt, egress, and consume media as a chain of signed receipts. Every object's content hash, every group's Merkle root, every relay hop preserved end-to-end. Click any stage.
Live · production
Real-time group receipts from tv.transaction.science/moq-wai-audio
Pulled in your browser from the prod WAI audio publisher. Each receipt covers a 250 ms group of 5 Matryoshka audio layers, each wrapped in a WAI v1.0 envelope. The Ed25519 group signature is verified locally — open devtools and inspect the network tab.
The pipeline
Six stages. Seventeen crates.
Publish → Relay → Subscribe → Adapt → Egress → Bridge. Every stage forwards JWP receipts unaltered; no node along the chain re-issues a signature or modifies a Merkle root. Per the receipt sub-spec (open-standards/wai/extensions/jwp-receipts.md §4), a conforming relay MUST NOT strip the parent_receipt_hash — so the chain end-to-end stays cryptographically connected from publisher to browser.
Track lifecycle · group lifecycle · joule metering · WAI envelope wrap.
joule-moq-publisher. Manages a publishing identity (Ed25519 signing key + optional TrustOS credential), a track catalog, a group lifecycle (start_group → push_object* → finalize_group), and per-object microjoule accounting. push_object_wai() wraps caller-provided codec bytes in a WAI v1.0 envelope and flips ObjectHeader.wai_envelope = true; content hash + Merkle root cover the envelope bytes.
Anatomy — operational specs
MoQT wire codec + JWP receipt extension + Track/ObjectHeader schema.
inv-moq. Targets draft-ietf-moq-transport draft-08 with custom object-header extensions for Matryoshka layer index (mrl_layer / mrl_total_layers) and the WAI envelope flag (wai_envelope, post-W1). Plus a first-class JWP receipt extension: per-object content hash, per-group Merkle root, Ed25519 group signature with cross-hop preservation guarantees.
Anatomy — operational specs
comms.audio.layered-pcm — 8/16/24/32/48 kHz fidelity ladder, codebook-free.
joule-moq-audio. The Matryoshka audio codec: 5 nested PCM fidelity layers (8 / 16 / 24 / 32 / 48 kHz) where each higher layer is an additive refinement of the lower. Deterministic, bit-exact, no neural prior — registered as comms.audio.layered-pcm (CommunicationOS-internal extension per PLAN D1, NOT a wai.neural.*). publish_audio_clip_wai() emits one MoQT object per layer, all wrapped in WAI envelopes under a shared manifest.
Anatomy — operational specs
Track catalog + naming convention + WebVTT routing.
joule-moq-multi-track. Convention layer over inv-moq's track namespaces: audio.{bcp47} for spoken-language audio tracks, subtitle.{bcp47} for WebVTT subtitle tracks, audio_desc.{bcp47} for descriptive audio. A single closing-call namespace can carry English audio, Spanish audio, Spanish subtitles, and English audio-description as parallel tracks; subscribers select by tag.
Anatomy — operational specs
Fanout · egress joule metering · receipt forwarding without re-signing.
joule-moq-relay. The receipt-preserving relay. Per the JWP receipt sub-spec (open-standards/wai/extensions/jwp-receipts.md §4): a conforming relay MUST forward object bytes and receipts unaltered, MUST NOT re-issue a Merkle root, MUST NOT strip parent_receipt_hash. The relay verifies group signatures before fan-out and tracks egress joules per subscriber. WAI envelope payloads are opaque to the relay; the wai_envelope flag in the ObjectHeader is propagated unchanged.
Anatomy — operational specs
Production relay daemon · QUIC binding · JSON-log audit trail.
joule-moq-relay-server. Production binary that exposes the relay over QUIC on UDP :9220. Caddy does not tunnel raw UDP, so the QUIC port is publicly exposed via firewall passthrough (or Cloudflare Spectrum for global ingress). Currently runs as a launchd service on prod (10.10.10.3) alongside the publisher binaries.
Anatomy — operational specs
Rust subscriber SDK · BLAKE3 + Merkle proof + Ed25519 verification · gap detection.
joule-moq-subscriber. Per-object content-hash verification, Merkle proof verification against the group receipt's signed root, Ed25519 signature verification against the publisher's anchored verifying key. Detects gaps (skipped object_id within a group). Post-W3 will also dispatch WAI envelopes by capability — today still routes raw bytes; W3 lands the dispatch path.
Anatomy — operational specs
Browser subscriber + verifier · wasm-bindgen · zero-trust client.
joule-moq-wasm. Browser-native subscriber that runs the same receipt verification as the Rust subscriber, in WebAssembly. Pulls publisher key + group receipts from the HTTP companion endpoints, verifies inclusion proofs in-browser, decodes payloads with joule-codec-av1-mrl + joule-codec-neural-mrl. W3 adds WAI envelope dispatch: sniff WAI1 magic, parse manifest, route to per-capability decoder.
Anatomy — operational specs
Swift wrapper · URLSessionWebSocketTask · MoQT message frames.
joule-compose-mobile/swift-moq. Native iOS / macOS subscriber that speaks MoQT over WebSocket against the ws-bridge. Exposes a JouleMoQ Swift Package (still pre-registry) that compose-mobile apps embed. Same wire format as joule-moq-wasm; same verifier path; same receipt schema. Not yet on Swift Package Index — W8 in PLAN.md ships the /sdk/swift page that registers it.
Anatomy — operational specs
Adaptive bitrate · BOLA / buffer-based / MPC / throughput · pure math.
joule-moq-abr. Four published adaptive-bitrate algorithms: BOLA (buffer-occupancy Lyapunov), buffer-based heuristic, MPC (model-predictive control), and throughput-based. Pure math, no I/O, side-effect-free. Enforced at the relay as a layer-cap policy: when a subscriber's bandwidth or buffer occupancy drops, the relay stops forwarding higher-mrl_layer objects to that subscriber. Per-object receipts remain unchanged.
Anatomy — operational specs
Quality-of-experience recorder · rebuffer · join time · bitrate trace.
joule-moq-qoe. Per-session QoE recorder: time-to-first-frame, rebuffer count + duration, average bitrate, layer-cap history, video startup failures. Exports a Conviva-compatible JSON envelope for ingestion by upstream telemetry systems. The QoE record IS a receipt — signed by the publisher's verifying key alongside the group receipts.
Anatomy — operational specs
Graphics overlay dispatch · lower-thirds · scoring · subtitles.
joule-moq-overlay. Compositor that layers graphics over the base video track: lower-thirds, score bugs, breaking-news supers, subtitle rendering. Each overlay is its own MoQT track in the same namespace; the compositor consumes the base + overlay tracks and produces a single composed output. Policy layer decides which overlays to apply per subscriber (e.g. parental controls hide ratings).
Anatomy — operational specs
HLS playlist generation · segment chunking · MoQT object → CMAF segment.
joule-moq-hls-egress. Bridges MoQT to HLS for legacy clients that don't speak MoQT directly (still ~80% of installed base in 2026). Buckets MoQT objects into HLS segments (default 6s), generates m3u8 playlists with EXT-X-MEDIA, EXT-X-INDEPENDENT-SEGMENTS, EXT-X-MAP. Serves via axum. Per-segment provenance: each segment file's filename is content-hashed so a CDN can serve it forever.
Anatomy — operational specs
Replay window · retention policy · cold storage handoff.
joule-moq-dvr. The replayer. Tail of MoQT groups buffered for the configured replay window (default 4h live, 30d archival). Two backends: fs (filesystem, prod-grade) and mem (in-memory, test-only). Gap-detection on insert: rejects out-of-order group_ids unless explicitly tolerated. Per-object inclusion proofs survive across the DVR boundary — receipts are stored alongside the payloads so the chain re-verifies after replay.
Anatomy — operational specs
Server-side ad insertion · SCTE-35 splice · VAST 4.2.
joule-moq-ssai. Server-side ad insertion: splice MoQT tracks at SCTE-35 cue boundaries (CUE-OUT / CUE-IN), substitute ad-pod tracks during the break, splice back when the cue-in lands. VAST 4.2 ad selection runs upstream and yields a typed ad-pod descriptor. The break is a per-subscriber concept — different subscribers see different ad-pods on the same source feed.
Anatomy — operational specs
In-process MoQT bridge · SIP-call → MoQT · WebRTC → MoQT.
joule-moq-bridge. Lifts an inbound non-MoQT source (a SIP call's RTP stream, a WebRTC track) into a MoQT track on the local publisher SDK. The translator is responsible for the codec mapping (PCMU → opus → comms.audio.layered-pcm) and for synthesising per-frame joule estimates from the source's RTCP feedback. Receipts emit identically to a native MoQT-source publisher.
Anatomy — operational specs
WS upgrade · subscribe / publisher-key / group-receipts / track-info endpoints.
joule-moq-ws-bridge. The HTTP-and-WebSocket surface that browser subscribers use. Caddy routes /moq/* and /moq-wai-*/* into the ws-bridge; the bridge exposes /publisher-key (32-byte hex for trust pinning), /track-info, /group-receipts (ring buffer of last 64 receipts as JSON), and the WebSocket upgrade for streaming objects. The bridge IS the boundary between QUIC-speaking relays and TCP-only browser clients.
Anatomy — operational specs
What the chain proves
Every byte you receive came from a named publisher.
The publisher's Ed25519 verifying key is pinned at the subscriber. The group receipt is signed by that key. The Merkle root in the receipt covers every object hash. Every object hash covers the bytes you actually receive — envelope and all. Verifying the chain is a 4-line BLAKE3 + Merkle-proof + Ed25519 check; you can re-run it on any object after the fact and the answer is bit-deterministic.