The Principia Machina/Testing/M3 TPX, the smallest server

The Principia Machina: map
Reading the diagrams Structure key Process key Definition of terms Roles
Reading by audience Start here: the walk through The operator's guide Tutorial: create a UUID Workspace Container (UWC) Public Recorder inputs Sponsors: your first agent
The specification Contents: parts, tables, diagrams TPS 0.5.0 (declared 2026-10-03, revision 8; machine-optimized text) Decisions (the foundations record, one line each)

Phase M3 of Testing the Principia Machina. State: ACCEPTED WITH OBLIGATIONS 2026-10-05, with M1 and M2, as Step A. TPX 0.4.0 went live on 2026-10-04 (the A1 deploy, accepted the same day) and 0.5.0 on 2026-10-05 (A2). The first UWC on the live wiki, SPR, was declared on 2026-10-04. Two of the plan's criteria were unmet at the acceptance and are the obligations O-4 and O-5 on Obligations; O-4 was discharged on 2026-10-08 (session 1's UWC replayed on RP1), and the phase becomes PASSED when O-5 is.

Objective

The plan (tpm_third_party_plan 0.2.0, section 4) states M3 as TPX, the smallest server that does what the sandbox does: first the host's upgrade to PHP 8.4 and MediaWiki 1.46, then a TPX skeleton – the new-UWC form, the declaration form, the landing API – whose logic is the sandbox's ported to PHP over the server's calculator, and nothing else from the full build list.

The plan's test is a DIFFERENTIAL: every sandbox command the earlier sessions ran is replayed against both the sandbox and TPX; digests and grades must be byte-identical; the tester adds scenarios. Accept when the replayed scenarios agree byte for byte and the tester's new scenarios find no S1.

The plan put M3 on a rehearsal wiki. Decision D238.1 (2026-10-03) put it on the live wiki instead, with the three declarations before the first landing and the first landing writing the genesis of the chains.

Prerequisites

• MediaWiki 1.46.2 and PHP 8.4.26, live on 2026-10-03 (1.46.1 was tried and rejected: it broke page saves).
• OB3, the import-behaviour test, re-run on 2026-10-03 at 23:31 UTC against the new version, on throwaway test pages that stay: of four hypotheses, H1 (a duplicate revision is skipped) failed, as it had on 1.45.4, and is covered by the rule that a completed import is never re-run; H2 (an older revision enters history only), H3 (a move saves a null revision and leaves redirects) and H4 (every import adds a null revision) held. The build constraint for imports stands: move, then stamp every revision later than the target's latest, then import.
• The three declarations of 2026-10-03, in order: TPS 0.5.0 declared final at revision 8; TPC-PY 0.3.0 declared, conformed to TPS 0.5.0, after its Windows check passed; the project instruction set 0.16.0 installed. None created a chain page; the genesis was written by TPX at the first landing.
• TPX part 1, the gate (versions 0.1.0 to 0.3.0, live from 2026-10-01): Special:TpmCheck and the operation CHECK, tested in the M0 sessions.
• The server address set to https on 2026-10-05 (D207, step 1).

What was built

TPX grew in four live versions. The gate's code (Gate::VERSION 0.3.0) is unchanged through all of them.

Version	Live (UTC)	What it carries
0.1.0 to 0.3.0	2026-10-01	Part 1, the gate: Special:TpmCheck and op CHECK; the TFK template box; the sign-up question and the account mails; the groups tpm-sponsored and tpm-certified
0.4.0 (A1)	2026-10-04	Part 2, the landing API: the Recorder (the sandbox's new, declare and push ported to PHP), the store (TPX writes as the system user TPX; the DECLARATIONS as the declaring account), the operations NEWUWC, PETITION, POLL, HEARTBEAT, RELEASE, PUSH, RETURN, STATUS and TPCRUN; Special:TpmNewUwc and Special:TpmDeclare; instantiation (MASTER, gaps, Register Volume 1, control panel, lock, collaboration, access list, library, manifest, badge last); the genesis, the three declaration lines and the first build-chain line at the first declaration
0.5.0 (A2)	2026-10-05 01:42	The register duties of M1: the screen, strikes and gaps, audit blocks, withdrawals, promotion, verification, the reading views

Each deploy is one command on the operator's computer, tpx_deploy.py, which verifies the release tree's digest, checks the site's versions, moves the previous TPX aside (nothing is deleted), copies the new one, and runs its live tests T0 to T10 (eight counted): the site answers; Special:TpmCheck answers; a sound draft passes the gate with the expected D(TFK); a draft with mistakes is refused; text that is not JSON is unreadable; the template box; the template passes; the sign-up question is asked. Both Step A deploys printed 8 of 8.

How it was tested

The differential, in the workspace. Before each deploy the Recorder was run in a workspace against the real server calculator and compared, field by field, with the sandbox's register for the same inputs (the spring example): the candidate certificate's D(TFK) equal to the sandbox's and, after the declaration, to the live SPR's; A1's gate 21 of 21 (rebuilt 27 of 27 after its workspace was lost; 25 of 25 with the A2 flag); A2's gates 123 of 123, with a parity run of 648 cases in which TPC-PY re-derived every strike, grade and digest TPX had produced.

The first UWC on the live wiki. On 2026-10-04 the operator pasted the spring draft into Special:TpmNewUwc (prefix SPR, ACCESS POLICY OPEN; the gate answered CANDIDATE, structurally regular, D(TFK) 46db0af2...) and declared it at Special:TpmDeclare at 19:39 UTC. That one act wrote the MASTER record SPR-1, Register Volume 1, the control pages, the genesis line (TPS 0.5.0 and its D(TPS)), the three declaration lines and the first build-chain line. The gate had already passed this draft in M0; the same D(TFK) came out of the sandbox, the workspace and the live server.

The three tests of A1 (2026-10-04): the operator's script, written by the builder (sign in; STATUS; a push with a bad identifier refused; push_1 lands SPR-2, SPR-3 and SPR-4 as PROVISIONAL; the four records read back with their envelope; four digests recomputed through TPCRUN; STATUS after) – PASS; the outside AI (Gemini, read-only, 21:24 UTC): the state, the four records, four digests recomputed, the versions and D(IS), the genesis and the declaration lines with their links intact – PASS, clean; and the operator's word, "A1 accepted".

The three tests of A2 (2026-10-05): on M1 and Step A.

Results against the plan

Plan item	Where it stands
The upgrade first	Done on the live wiki (D238.1 put it there rather than on a rehearsal install): MediaWiki 1.46.2, OB3 re-run.
The new-UWC form, the declaration form, the landing API	Live since 2026-10-04 (TPX 0.4.0); the register duties since 2026-10-05 (0.5.0).
Digests and grades byte-identical with the sandbox	Held for the spring example in the workspace gates and on the live wiki (the same D(TFK) from all three). Wording SUPERSEDED by the plan's version 0.3.0: a record's DIGEST covers LANDED, a server time, so two landings of one record can never digest alike; the criterion is read as the REPLAY DIGEST, the digest recomputed with BLOCK, AUTHOR, LANDED_BY, LANDED, VETTED_IN, TPS and D_IS set to fixed values in both copies, with the grades and the author-written fields compared as written.
Replay of every sandbox command the M0 sessions ran	Obligation O-4, DISCHARGED 2026-10-08. On 2026-10-07 the operator declared RP1 from session 1's PEN draft and the A3 closeout runner replayed that UWC on it: D(TFK) equal (dfec1dcc...), 2 pushes and 0 withdrawals replayed, 6 of 6 records equal (REPLAY DIGEST, grade and author-written fields), the grades now equal; session 1's 15 gate checks were then replayed against the live gate, equal 15 of 15. The two runs not replayed live are refusals that write nothing: the declaration without its confirmation, and an out-of-sequence push. The plan before the run: not run against the live wiki on 2026-10-05: the M0 session's own UWC was not replayed; the delivered outside checks were read-only. The A3 closeout runner (tpx_a3_closeout.py, --replay) replays the session 1 sandbox UWC: the operator declares a replay UWC from the same draft (prefix RP1; one per distinct D(TFK)), the runner pushes the UWC's blocks in their order and compares each record's REPLAY DIGEST, grade and fields and each TPX-written record with the sandbox's. Discharged when the runner's report shows them equal.
The tester's new scenarios find no S1	Two outside sessions (A1, A2) and the builder's recheck: no S1; the findings filed are cosmetic or display-only. The lock by base-revision edit, the queue and the window (D-LOCK, owed from the same pass) are obligation O-5: built as B1 increment 1 (gated 2026-10-06), discharged by M4's criterion (iii).

Previous: M2. Next: M4. The deploy record: Step A. Back to Testing the Principia Machina.