The surface reads like a route map. The meaning is a hash.
A WallRiderLang program is a network of durable identities connected by textured routes and separated by boundaries. The name is literal: programs are made of riders — identities in motion along routes — and walls — the boundaries that gate, commit, and seal what they do. The whole network is one content address, and every run of it is a film that replays exactly.
--) and the six-phase period cycle — that much
is implemented, property-tested and shipping inside TRVM Forge. Most of the
notation on the rest of this site describes settled meaning that has no
writable surface yet. Every page marks which is which, on three separate
axes. See how to read the badges →; a signal, a rotation, a pose
profile forge.world.core.v1
[pulser:p0](every 2){sig_out}
[relay:r0]{sig_in, sig_out}
[spinner:sp](w=16, n=8, rotor=quarter_turn_z, configurable){sig_in, socket}
[orb:ob]{pose}
[p0] --sig--> [r0]
[r0] --sig--> [sp]
[sp] --socket--> [ob]SemanticArtifactID
sem-67e954cfe311…4050b60ae
; a content hash of the canonical graph.
; whitespace, comment, declaration order
; and sugar spelling are all inert.
; change the rotor and it moves.
; recompile on any machine — same id.Every WRL world has one. That id is the same on your laptop, in CI, and in the archive five years from now. Compute it yourself →
Every kind of thing a program can be, and what it is for.
Most languages give you one universal construct and ask you to encode everything else in it. WRL names ten, freezes the list, and gives each a distinct shape on the surface so you can read a program's architecture before you read its logic.
Functions calculate. Actors persist.
A function is pure and returns. An
actor is a durable identity with state that
survives between periods. The difference is visible in the shape, not
buried in a signature.
Routes communicate. Walls authorize.
A route carries a message from one
identity to another, and its line texture says how it may fail. A
wall is a boundary — nothing crosses it
without being gated, committed, or sealed.
Periods order. Fragments carry code.
A period is the unit of time: one full
turn of the cycle. A fragment is a piece of
code addressed as data, so a program can carry the thing it is about to
run.
Stencils construct. Derives transform.
A stencil builds graphs from a pattern; a
derive transforms a typed graph into another
typed graph. Metaprogramming with a type discipline, not string
splicing.
Films record what occurred, replayably.
A film is the committed record of a run —
an ordered, schema-versioned event ledger sufficient to replay
the run and get the same bytes. It is not a log you enable for
debugging; it is the output.
Hashes identify what was built.
A hash names a thing by its content.
Worlds, scenarios, replay bundles and export bundles each sit on a rung
of one identity ladder.
You can learn to read WRL before you can write it.
The notation is designed to be scanned. Four laws cover nearly all of it, and they hold everywhere in the language.
Shape says what a thing is
[x] is a durable identity.
(x) is state.
{x} is wiring. You never have to guess which
of the three you are looking at.
Line texture says how it moves
--x--> solid,
~~x~~> async,
==x==> verified,
!!x!!> fault. The failure mode is drawn
into the arrow.
The colon introduces, the slash bounds
role:name introduces a thing.
/gate, //commit,
///seal bound it. More slashes, stronger
boundary.
Marks for architecture, words for computation
Punctuation carries structure — #
content, @ place,
? pattern. Words carry the actual work. The
two never compete for the same job.
--x--> is
fully grounded in the current runtime. Async, verified and fault routes are
partial — the notation is frozen, the
execution semantics are not. This site labels every construct with its real
status; nothing here is aspirational without saying so.
See the full tier table →WRL never lowers straight to the runtime.
This is section zero of the frozen spec and the reason the identity story works at all. There is exactly one sanctioned path from surface to execution, and every surface — text, canvas, editor gesture — converges on the same seam.
Because the canonical graph sits in the middle, two things become true that are normally very hard. First, a drawing and a document are the same program — moving a box on a canvas cannot change what a world means, because position never reaches the graph. Second, canonical artifact identity is computable — the graph canonicalizes to bytes, and the bytes hash, in bounded time, on any host.
What that buys you
- Reproducible builds by construction. A world's id is a pure function of its meaning, so two people who wrote the same program in different orders, with different spacing and different sugar, get the same id.
- Backend swaps that are provably inert. Switching a counter from one-hot to binary moves the BackendArtifactID and leaves the SemanticArtifactID untouched. The split makes the claim checkable rather than aspirational.
- Verification without trust. A run ships its film and its ids.
Anyone holding the world source can re-derive the
sem-id from the source alone; re-deriving the film additionally needs the scenario it was run against and a conforming runtime, which is exactly what thereplay-rung of the ladder names.
Six phases, in this order, forever.
Time in WRL is not a wall clock. It is a period: one complete turn of a six-phase cycle. The order is frozen, and the phases are ordered stages of a single period — not six things that happen to six different periods.
| Phase | What happens (§8, normative) | Why it is separate |
|---|---|---|
| OBSERVE | Canonicalize and insert distinct claims. | The only point where the outside gets in — so the input sequence is a nameable, canonical thing. |
| ACCEPT | Create missing receipts under the pinned acceptance policy. | Admission is a policy decision, not an accident of arrival order. Receipts are minted here, and are immutable once minted. |
| MAP | Turn newly-accepted successful operations into controls. | Separating "this was accepted" from "this therefore writes" is what makes a retransmission not re-run an effect. |
| COMMIT | Apply control writes and fault resets to owned cells. | Every write to owned state happens in one phase, before anything reacts to it. |
| REACT | Deterministic within-period token cascade to fixpoint; latch current overflow. | The period settles before it ends. Reaction reads committed cells, so a configuration committed this period is visible to this period's reaction. |
| FILM | Record the entries needed to replay the epoch. | The proof is produced by the cycle, not bolted on afterwards. |
Six rungs, and each one names a different question.
Most systems have one hash and overload it. WRL splits identity by what changed, so that when an id moves you already know which kind of thing moved.
| Prefix | Names | Moves when |
|---|---|---|
| sem- | SemanticArtifactID — the world's meaning | the graph changes: a role, a wire, a rotor, a clock |
| bknd- | BackendArtifactID — meaning + lowering profile | the backend encoding or compiler changes |
| scen- | ScenarioDigest — the run inputs | periods or claim batches change (never the world) |
| replay- | ReplayBundleID — world bound to scenario | either side of the binding moves |
| bundle- | ForgeBundleID — a self-contained export | anything in the exported closure changes |
| env- | Environment id — an evaluation environment | splits or environment definition change |
periods and
[epoch:N] claims are ScenarioV1 — they
never enter a SemanticArtifactID. Writing them in world source is a typed
rejection (WRL_WORLD_SOURCE_HAS_SCENARIO), not a
silent acceptance. That single rule is what lets you re-run one world across
a hundred scenarios and still say honestly that it is the same world.Convenience that cannot fork your identity.
WRL has surface sugar — named rotors, concise clocks, replication, fan-out. It also has an unusually strict rule about it.
[pulser:p0](every 2)
[spinner:sp](w=16, n=8,
rotor=quarter_turn_z)[pulser:p0](mode=periodic, period=2, phase=0)
[spinner:sp](w=16, n=8,
rotor=181.0.0.181)These seal to identical bytes. There is no sugar-specific identity, because desugaring is a source-to-source pre-pass that runs before a graph exists. The sugar is gone by the time anything can be hashed, so no separate id can be minted for the sugared spelling — and none can be added later without breaking the pre-pass.
Note carefully what that does not claim. It does not say a sugar
edit is harmless: changing quarter_turn_z to
identity changes the program and moves the id,
exactly as the explicit spelling would. And because
quarter_turn_z is irrational, its integer
projection depends on the spinner's fractional width — so the same name at a
different n is a different rotor and a different
world. The projection is pinned by a named policy computed in exact integer
arithmetic, never a float.
Six doors, depending on how you like to learn.
WRL in 20 minutes
Build one working world from an empty file, one construct at a time, and watch its identity move when — and only when — the meaning changes.
GUIDEThe complete language guide
Every notation, every construct kind, the memory kinds, the execution model, and the parts of the design that are still ahead of the runtime.
DRAFTThe authored full-language draft
Parts II–VI of the original design — expression notation, boundaries, podiums, effects, supervision, stencils, derives, the seven worked examples — each marked Core, Experimental or Proposed.
REFERENCETables you will actually keep open
Roles, ports, config keys, edge kinds, every typed error code, the sugar forms, the identity ladder, the stability tiers.
PLAYGROUNDSeal a world in your browser
The real identity spine, ported to JavaScript. Parse, desugar, validate, canonicalize and hash — no server, no account, real ids.
DIRECTIONWhat it is for, and what it still has to earn
A deterministic actor foundation for executable topology: five separate ratings, six design pillars, the dependency-ordered ladder, four worked demonstrations — and what would falsify the whole thesis.