TRVM is a term-rewriting virtual machine on the interaction calculus — the model of computation where every step is a local graph rewrite and the result is provably independent of the schedule. That one property is a seed. Everything below — perfect replay, identity for programs, merging without locks, caching by meaning — falls out of it. A machine for turning computation into durable evidence.
The calculus is pure and confluent. These six capabilities aren't features that were added — they're consequences that couldn't be prevented. Each one is something conventional runtimes bolt on, approximate, or can't do at all.
Every run produces a film — a byte-exact receipt. Replay it on the same sealed runtime — any machine, any year — and get the same bytes. If two worlds could ever diverge, their films already differ (that's a law, not a feature flag).
Terminating programs that mean the same thing — same canonical normal form — get the same address, however they're spelled. Rename every variable, restructure the source: the hash doesn't move. Non-normalizing terms fall back to structural identity — a stated boundary, not a hidden one.
Replicas exchange facts and take the set union — that's the whole protocol. No leader, no locks, no vector clocks, no conflict resolution, because canonical, append-only facts can't conflict. Things you can spend or revise are a different animal — the economics section draws that line. Machine-checked CvRDT laws.
The store is a cache keyed by meaning, not spelling. Once a verified result is in the reachable store, equivalent work becomes a lookup, not another reduction — for every replica that can reach it. ~18% of all work eliminated at toy scale. Measured, not modeled.
Untrusted workers can't lie their way in: every imported evaluation is re-executed, every derived record is receiver-computed. Twenty forgery and omission attack classes — injection, suppression, impersonation — rejected by battery.
The whole machine is 9,883 bytes of WebAssembly with four exports and zero dependencies. Browser, phone, edge worker, air-gapped laptop. You're not reading about that capability — this page is it.
This button instantiates four fresh, fully isolated copies of the runtime — four separate WebAssembly instances with four separate linear memories, sharing nothing. Each normalizes the same term independently. Then the results are merged the only way this system ever merges anything: by union. Watch what there is to reconcile.
Honest print: these are isolated instances scheduled by one page — the repo's swarm battery does the same across real OS worker threads, and the physical multi-machine run is designed, not yet done. The claim demonstrated is the one that matters: no shared state, no coordination, byte-identical results.
Program A is Church-two applied to g and z. Program B is just (g (g z)), written by hand. Different sources, different shapes — same meaning, so same address. Then edit either one and compare again: the moment the meaning moves, the address moves. This is the SemanticDiff primitive the Forge bench is built on — IDENTICAL vs MOVED, decided by the machine, not by eyeballing diffs.
demo address = FNV-1a-64 over the canonical normal form (the repo uses SHA-256 · same principle, shorter hex)
| body | what it is | measured |
|---|---|---|
| spec/ | The calculus, the packed 32-bit word format, and cross-validated conformance vectors — only terms where reference and native already agree are admitted. | language-agnostic |
| ic_ref | The Python reference reducer — the executable spec and the oracle everything else is checked against. | the oracle |
| ic32 | The native C runtime: packed words, free-list heap, iterative deep paths. | 22–34M interactions/s · 13/13 · 500k-deep stress |
| ic32.wasm | The same machine compiled to WebAssembly — the one running all three demos on this page. | 9,883 bytes · bit-identical |
| swarm | Coordination-free reduction across isolated OS workers: any worker count, any merge order, same answer. | correctness proven · speedup not claimed |
You just used verbs 1–2 in the identity demo, and verb 3 in the race. Replicas that have never spoken converge by exchanging facts in any order — the merge can't conflict, because the objects it merges are canonical.
WRL is a spatial actor language for authoring worlds on TRVM. The text below and the canvas beside it are the same object — both are projections of one canonical semantic graph. Edit either; the identity is computed from the graph, never from the spelling. This is the real demo world shipped in the bench, verbatim:
The normative rule of the whole language — surface syntax is never lowered directly; everything passes through the canonical graph — is what makes formatting, naming, and whitespace wash out of the identity. Frozen core in WRL_CORE_0.1; the wider design is tiered Core / Experimental / Proposed and says which is which.
The Spinner Bench is Forge's authoring environment for WRL worlds — a local, single-file-launch app (./forge-bench) with two workspace views over one state. Author is where you build. Evidence is the view most tools don't have: the film, the identity, the semantic diff, and native-vs-oracle parity for the world you just ran. Toggle them:
Release discipline, because an IDE is a claim too: built from an explicit allowlist (42 files, SHA-256 manifest), read-only installation as a tested law — first launch writes no bytecode and compiles nothing into the install directory (battery RD1–RD15) — and a first-run guided rail that never blocks and never touches a sealed id (PA1–PA20).
Each card is a 2026 trend colliding with a primitive you just watched run. The industry is building workarounds; the substrate makes the workaround unnecessary.
2026 is the year of parallel agent fleets — every major tool now runs sub-agents at once, isolated in git worktrees so they don't stomp each other, and one flagship platform (Replit's Agent 4) advertises auto-resolving ~90% of merge conflicts. Isolation is a workaround; 90% is a coin with a bad side. Canonical identity makes result-level conflict structurally impossible — merge is union of facts, dedup is free, and two agents who did the same work produce one fact. Agents can still disagree on intent; that's a governance problem, not a merge problem.
The EU AI Act phases in: transparency duties from August 2026, AI-content transparency by December 2026, standalone high-risk rules December 2027, product-embedded August 2028 — and the asks are constant throughout: automatic event records, tamper-evident, reconstructable after the fact. A film doesn't merely meet that bar; it exceeds it by construction — the log is the run, verification is replay-plus-hash-equality, and Law 6 guarantees two worlds that could diverge already have different bytes. Not a logging feature. A property of the machine.
Local-first went mainstream — dedicated conference tracks, sync engines everywhere, CRDTs under every collaborative app. But today's CRDTs merge data. TRVM's store is a CRDT whose elements are computations: offline agents do real work on a plane, land, and union their results — derivations, evaluations, proofs — with nothing to reconcile.
Deterministic simulation testing became the reliability movement of the decade for one reason: heisenbugs are schedule bugs. On a substrate where the schedule cannot change the answer, the scheduler-induced flaky class is empty at the root — and the film of any failing run is a repro case that works forever, on any machine, byte-for-byte.
Rollback netcode, replays, and cheat detection all rest on one fragile prayer: every client computes the identical frame. For everything kept inside the deterministic envelope — simulation, inputs, seeds, versions — that prayer becomes a theorem. A 9,883-byte machine in every client, replays as byte-exact films, and divergence detectable as a hash mismatch. Desync closed by physics, not patches, for the envelope you commit to it.
Decentralized compute keeps re-learning the same lesson: the hard part isn't distribution, it's believing the results. TRVM's admission layer assumes workers lie — every import re-verified, every derived record receiver-computed, twenty forgery and omission attacks rejected by battery. Honest print: today that's secure acceptance, not yet cheap outsourcing — accepted work totals ~2.31× what workers submit (verification alone ~1.31×) — and the path down is stated, not hidden.
Content-addressed build caches already run at planet scale — keyed by syntactic hashes, so a refactor, a rename, or a reformat is a cache miss. Semantic addressing keys the cache by what code means: the spelling washes out, the hit rate survives the refactor, and "already computed" becomes true across teams that never met.
The machine is smaller than this paragraph's image would be. It runs in browsers, phones, and routers; nodes can be slow, mismatched, and unreliable, because churn can't conflict with or corrupt facts that already replicated — closing the tab loses nothing anyone else already holds, though work that never synced can still be lost and progress can still slow.
Honest print: none of these are shipped products. All of them are the same primitives you watched run in demos 1–3 — which is what "substrate" means. Scale limits live in slot 0x0B.
Major derivatives exchanges have announced compute futures to list alongside power and natural gas. GPUs collateralize billion-dollar credit facilities. Agent-payment rails are clearing machine-to-machine micropayments at real scale, and their own post-mortems name the missing layer: trustworthy offchain metering and usage receipts. Every market needs three things — a unit both sides accept, an invoice neither side can fake, and a rule for what actually needs a ledger. This machine has unusually sharp answers to all three. None of them is a token.
Computations, evaluations, derivations, receipts-as-facts, dedup. These only ever grow — so they merge by set union, coordination-free, on any topology, with no chain, no consensus, and no one to ask. This half of the economy is what the demos above run.
Spending, ownership, exclusivity — anything that can be used at most once. The repo's first distributed rule says it plainly: claim facts merge by union; receipts do not blindly merge. This half needs consensus, and it's where a floor like box-and-box's closed, double-entry resource rung belongs.
TRVM doesn't ship a coin. It ships the boundary — the exact line where an economy stops being coordination-free. Most projects in this space sell you a ledger for everything; the mathematics says half of everything never needed one.
Honest print: nothing here is for sale — no token, no chain, no yield. The affine half is future work with named mechanisms; verification asymmetry is an open problem stated in slot 0x0B.
TRVM's invariants are documented failures converted into permanent rules, indexed in LAWS.md and enforced by tools/laws_check.py — citing an undefined or reserved law fails the build. 7 canonical laws. 4 reserved IDs whose original text was lost: held, unciteable, never machine-reconstructed.
No parallel speedup has been demonstrated. The swarm proves coordination-free correctness; at toy scale, worker startup dominates. Speedup is the open runtime problem, said out loud on every run.
Semantic identity exists exactly where reduction terminates. Non-normalizing terms fall back to structural identity — a stated tier boundary, not a hidden one.
Distribution results so far are one host — simulated networks, real OS processes, real isolated WASM workers. Separate physical machines: designed, not done.
Two conformance sections have honestly uncovered gaps (§6.4, §6.5), printed at every run rather than rounded away.
WRL beyond the frozen core slice is design, not implementation. The 0.1 core is grounded and sealed; the wider language document tiers itself Core / Experimental / Proposed and means it. The bench is an alpha.
Cold clone to full verification in about two minutes. Requirements: gcc, python3, node. No package manager, no network, no accounts.
An un-weakenable governance floor — u ⊗ 0̲ = 0̲, a forbidden action annihilates — only stays un-weakenable if the machine beneath it gives the same verdict under every schedule. Annihilation is order-independent; TRVM is the substrate where order doesn't exist. box-and-box decides. TRVM makes the decision the same everywhere.