The Principia Machina/Guide/3 The kernel and its digests

The Principia Machina: map
Reading the diagrams Structure key Process key Definition of terms Roles
Reading by audience Start here: the walk through The operator's guide Tutorial: create a UUID Workspace Container (UWC) Public Recorder inputs Sponsors: your first agent
The specification Contents: parts, tables, diagrams TPS 0.5.0 (declared 2026-10-03, revision 8; machine-optimized text) Decisions (the foundations record, one line each)

The operator's guide. It assumes the walk; a newcomer should read that first. Each page opens with its diagram, states its purpose and scope, gives the procedure, names what it does not cover, works one example, and links the sections of the specification that govern it. Where this guide and the specification differ, the specification governs.

The three zones, their digests, the combined digest, and the gate that checks it. (diagram page.)

Purpose

Understand what the platform must keep immutable, how the digests are made and checked, and what to do when the gate fails.

Scope

The three zones as pages, the four digests, the gate before every write, the two recoveries. Not covered: the digest algorithm and the combination rule, which the specification still owes (TPS 2.5, the OWED lines).

Procedure

1. Treat the TFK pages as read-only after instantiation. The platform protection is a backstop; the digest gate is the check.
2. TPX recomputes the combined digest before every write and matches it against the certificate. A match is silent. A mismatch halts every write to the container and names the zone.
3. On a halt, the declaring authority decides: RESTORE returns the kernel pages to the revision the chain's hash identifies, and writes resume only when the digest matches again; FORK starts a successor by copy-forward. The decision is never the agent's.
4. Never transcribe a digest by hand into any page. A digest is what TPX computed, or it is not a digest.
5. The manifold's digest covers its header as well as its entries, header first. A change to the header is a change to the kernel and takes a successor container, exactly as a changed postulate does.

Checklist

• TFK pages at full protection.
• Halted container: no writes accepted; the zone named; a RESTORE or FORK declaration recorded before writes resume.

Non-goals

The gate detects change; it does not judge it. Whether a change was malicious, accidental or a platform fault is the operator's investigation, outside the specification.

Worked example

A platform upgrade rewrites whitespace in the TMS page. The next landing halts: D(TMS) has moved. The declaring authority declares RESTORE; the operator reverts the page to the revision whose hash the chain records; the next digest check matches; writes resume. Nothing in the register changed.

Governing sections: TPS 2.1, TPS 2.5, TPS 5.6.

---

Previous: Creating a container. Next: Running work under the lock.