5.6 Certificate, declarations and the build chain (TPS 0.1.1)

Instruction artifact, machine-optimized text: TPS 0.1.1, section 5.6 Certificate, declarations and the build chain. Part of TPS 0.1.1 and the TPM hub. Human-only edit (TPS 5.13). TPS 0.1.0 was declared final at revision 4 on 2026-09-22, a version declaration recorded in the foundations record; the chain begins at TPX's first landing (TPS 5.6.7). Version 0.1.1 changes only the status lines (this lead, the title's version and the header's version line); H-DECL declares it. The text below is this section of the TPS 0.1.1 artifact, verbatim; the whole artifact and its file digest are on The Principia Machina/TPS. Human readers: the contents page is the map.

TPS 5.6  CERTIFICATE, DECLARATIONS AND THE BUILD CHAIN
purpose: the candidate certificate and its landing; the two chain pages
         and their contents; hashes; retirement declared on the
         DECLARATIONS page
governs: 5.6 | version: 0.1.1 | class: instruction artifact
audience: operator

5.6.1  The chain is two pages: the DECLARATIONS page, protected to the
       declaring authority, append-only, carrying the genesis line,
       certificates, UWC STATE (CERTIFIED, RETIRED, RESTORE, FORK),
       admissions and closeouts; and the BUILD CHAIN page, appended by
       TPX, one line per build naming the declaration line it verified
       against. Both carry content digests, never revision IDs, so they
       survive export. [I-063] [I-037]
5.6.2  Chain link hash SHA-256; page hash may be MediaWiki's SHA-1. The
       manifest never contains its own digest. The genesis line is the
       digest and version of TPS itself (see 5.11.2). [I-063] [F2]
       [I-117]
5.6.3  Digests are computed at CAC by TPX, written into the CAC
       certificate that assigns the UUID, and appended as a BUILD CHAIN
       line (see 2.5.1). [I-062]
5.6.4  Certificate flow: TPX computes the digests and writes a candidate
       certificate to staging; the named human declares certification by
       landing it on the DECLARATIONS page. Neither side can do the
       other's part. [I-065]
       OWED: the specification of the candidate certificate's
       computation, executed by TPX; kind: absence; C-09.
5.6.5  A retired container stays in the index in state RETIRED, pages
       protected read-only, the retirement declared on the DECLARATIONS
       page, back-pointers resolve directly (see 5.11.6). [B-10] [I-121]
5.6.6  No agent writes on any page carrying a declaration (see 5.13).
       [I-106]
5.6.7  GENESIS TIMING. The DECLARATIONS page does not exist before its
       genesis line (5.6.2, 5.11.2). It is created by the declaring
       authority's first declaration, which declares TPS, at TPX's
       first landing: TPX computes the genesis digest, since TPX is
       the sole implementation of every digest (5.1, 5.6.3), and no
       hand-transcribed digest ever enters the chain. Before that
       landing there is no chain, and a bootstrap import creates no
       chain page (5.11.2). A declaration made before that landing
       that a version of this artifact is final is a version
       declaration, recorded in the foundations record; it creates no
       chain page and moves no digest. [I-159] [D83.1]