Spatial World Model Counterfactual Simulation Replay

It asks whether a declared spatial counterfactual row binds a scene, event, and predicted outcome that survive independent recomputation, rather than a shape that merely looks right. Spatial world-model demos are easy to oversell. A plausible video, or a row that simply asserts "the model predicted the next state correctly", can pass for understanding without anything being checked. This component answers one narrow question: does a declared spatial counterfactual row bind a source scene, an event, and a predicted outcome that survive an independent recomputation, or is it only a shape that looks right?

The runtime distrusts the predicted state

The predicted actor count, transition delta, event label, and spawn cells are derived from the inputs, so a stale or hand-edited prediction stops matching and the row blocks.

The result is a metadata-only record of refs, digests, and counts over synthetic metadata, running no robot, no vehicle, and no real map. The result is a metadata-only record: refs, digests, counts, and verdicts, with no video bodies, raw sensor payloads, or location data. It checks synthetic metadata. It does not run a robot, drive a vehicle, or measure a real map.

Purpose

Synthetic robotics and self-driving scenes

The input is synthetic robotics and self-driving scenes, each with an action and a declared next scene, from occluded forklifts to late-turning oncoming vehicles. The input is a set of synthetic scenes drawn from robotics and self-driving settings: a forklift entering an aisle from behind an occlusion, a small pedestrian stepping into a crosswalk, a gust pushing a drone off a corridor, a reflective floor read as free space, a pallet stack sliding into a lane, and an oncoming vehicle accelerating late into a turn. Each scene has an action and a declared next scene.

Scenes force state-difference accounting

A loose check would just accept the declared next scene, so the scenes exist to force state-difference accounting rather than to approximate the real world. A loose check would read the declared next scene and accept it. That is exactly the failure the component avoids, because a declared prediction can be edited to say anything. The scenes exist to force state-difference accounting, not because the gridworld approximates the real world.

How it works

Fixture and bundle entry points

run validates the fixture with eight negative cases and run_simulation_bundle the exported bundle without them, both calling _build_result then _write_receipts. Two entry points drive the same pipeline. run validates the fixture with the eight negative cases included. run_simulation_bundle validates an exported bundle with negatives excluded, and can reuse a prior result when the input digest is unchanged. Both call _build_result, then _write_receipts.

Six inputs through the ordered check stages

_build_result loads six input files, checks the protocol and metadata-only policy, then runs the replay, recomputation, source-module, and private-string stages, passing only when all hold. _build_result loads six input files (a protocol, a replay policy, scene states, counterfactual replays, state transitions, and a source-module manifest). It checks that the protocol selects this component and that the replay policy declares the metadata-only scope limit, tested by _required_policy_ok, which requires metadata_projection_only true and every other ceiling flag false. It runs each replay row through _replay_policy_findings, runs the recomputation in _state_transition_analysis, checks the copied source modules in _source_module_manifest_result, and scans every input and source path for private strings. The run passes only if all of those hold.

Required fields and forbidden payloads per row

_replay_policy_findings requires each row's declared refs and labels and emits a typed error for any forbidden flag, private-video body, raw-sensor payload, or non-public paths. _replay_policy_findings checks one replay row. It requires the declared fields (scene ref, action-trace ref, predicted-state ref, transition-diff ref, oracle-check ref, sensor-packet refs, limitation labels, and the payload boundary). It emits a typed error when a forbidden flag is set to true, for example SPATIAL_PRIVATE_VIDEO_FORBIDDEN or SPATIAL_LIVE_OPERATION_FORBIDDEN, and it rejects any row that carries a private-video body, a raw-sensor payload, or a non-public paths string.

Recomputing the gridworld step

_state_transition_analysis builds an 8 by 8 gridworld from the actor count and steps it with a deterministic event action, computing an input-driven actor-count delta rather than copying the expected row. _state_transition_analysis is the recomputation. For each replay it resolves exactly one matching transition row, builds an 8 by 8 gridworld from the source scene's actor count with _gridworld_initial_state, then steps it with _gridworld_step. The step maps the event label to a deterministic action in EVENT_GRIDWORLD_ACTIONS, computes an actor-count delta with _gridworld_actor_count_delta, and places new actors with _gridworld_spawn_cells. The delta is input-driven, not copied from the expected row:

min(
  base_event_actor_count_delta
  + max(0, sensor_packet_count - max_timestep_lag - base_event_actor_count_delta),
  4,
  free_cell_count
)

Input-derived spawn cells and the comparison

_gridworld_spawn_cells hashes the inputs to place actors, then the analysis compares every declared field against what the gridworld produced, and one mismatch blocks the whole result. Spawn cells are also input-derived. _gridworld_spawn_cells hashes the event, replay id, scene ref, topology ref, sensor-packet refs, consistency budget, limitation labels, and source actor count, then walks the bounded grid from the declared event cell. The analysis then compares the declared predicted actor count, transition delta, event label, spawn cell or cells, and the three refs against what the gridworld actually produced. Any mismatch records SPATIAL_STATE_TRANSITION_SIMULATION_MISMATCH on that row, and one bad row blocks the whole result.

Copied source bodies verified by digest

_source_module_manifest_result verifies each copied module by digest, anchors, and line count, rejecting any manifest that places body text into a result. _source_module_manifest_result handles the copied source bodies the exported bundle may carry. It verifies each module by its sha256 digest, its required text anchors, and its line count against the file on disk. It rejects any manifest that tries to place body text into a result, emitting SPATIAL_SOURCE_BODY_TEXT_IN_RECEIPT_FORBIDDEN or SPATIAL_SOURCE_MODULE_BODY_TEXT_IN_RECEIPT_FORBIDDEN. _source_open_body_import_summary folds the verified modules into a metadata-only summary of refs, digests, and counts.

Records and the compact result card

_write_receipts writes the result, board, validation, and sign-off records, and result_card projects a compact card of status, counts, and command without the bulky payload. _write_receipts writes the result, board, validation, and sign-off records and returns the result with the board attached. result_card projects the result into a compact card that omits the bulky payload keys and keeps the status, counts, and command.

flowchart TD Scene["Scene-state row actor count + topology"] --> Step["Deterministic gridworld step 8x8 bounded recomputation"] Replay["Counterfactual replay row event + sensor refs + budget"] --> Step Step --> Actual["Actual next state actor delta + spawn cells"] Replay --> Declared["Declared predicted state transition diff + oracle check"] Actual --> Compare{"Actual matches declared?"} Declared --> Compare Compare -->|yes| Result record["metadata-only pass record counts + refs + digests"] Compare -->|no| Block["Typed mismatch, blocked"] Replay --> Boundary{"Forbidden payload or claim?"} Boundary -->|yes| Block

Negative cases

Eight rejections each bound to a code

EXPECTED_NEGATIVE_CASES names eight rows that must be rejected with their codes, and a fixture run passes only when every expected code is observed. EXPECTED_NEGATIVE_CASES names eight rows that must be rejected, each bound to its error code: private video export, real-world location claim, live robot or AV operation, raw sensor export, simulator-product claim, generated-video-only authority, geographic-accuracy claim, and benchmark claims without a state diff (SPATIAL_BENCHMARK_SCORE_REQUIRES_STATE_DIFF). A fixture run passes only when every expected code is observed. If a negative row slipped through, its code would be missing from the observed set and the run would block.

Prior Art Grounding

Borrowed from the world-models line

The replay borrows the counterfactual-rollout shape from the World Models line over synthetic metadata, while the gridworld here is a hand-written toy, not a learned model. This replay exercises a spatial world model under counterfactual interventions. It draws on the world-models line of work (Ha and Schmidhuber, World Models), where an agent learns a compressed model of its environment and rolls it forward under hypothetical actions. The component borrows the counterfactual-rollout shape over synthetic metadata. The gridworld here is a hand-written toy, not a learned model.

Validation Result record Path

Run from microcosm-substrate:

What a pass over the fixture proves

A pass means the six predicted states matched the gridworld step, all eight negative codes were observed, the source modules verified by digest, and no input leaked a private string. A pass means the six declared predicted states match the gridworld's actual step, the eight negative codes were all observed, the copied source modules verified by digest, and no input path leaked a private string. These validation result records prove the synthetic replay and source-module import boundary only.