31. Simulation

Decision

ShadowWhat-if SimulatorWhat-if Simulator owns the experiment: its simulation IntentRequestRequest, branch lineage, assumptions and unknowns, separation of expansion from review, budgets and stopping conditions, evidence/artifact references, eligibility packages, and cleanup eligibility/receipts. Scheduling, unsafe execution, capability selection, readiness, truth, Persona, consent, live mutation, Memory curation, and training remain outside that office. SpellweaverWorkflow EngineWorkflow Engine, execution, DispatcherTraffic ControllerTraffic Controller, OrchestratorStage ManagerStage Manager, DriftEvaluatorEvaluator, MirrorPersona KeeperPersona Keeper, HitLApproval StepApproval Step, ArchiveLong-term MemoryLong-term Memory, and SoulforgeModel TrainerModel Trainer keep those responsibilities.

A game engine simulating physics, navigation, actors, and gameplay inside an exact local project is Foundry execution, not a ShadowWhat-if Simulator branch. ShadowWhat-if Simulator may compare separate project candidates under pinned bases, but it neither becomes the engine world nor owns the selected game's scene, rules, playtest, or build.

Records and branch law

An immutable Simulation IntentRequestRequest names owner, purpose, exact base state, permitted effects, budgets, stop conditions, and promotion class. It creates stable Branches, each recording parent, generating InvocationJob RequestJob Request, assumptions, required/observed state, unknowns, resource owner, and status. Observations name exact command/tool/predicate, environment, inputs, outputs, artifacts, and error class. A Vision packages one candidate revision, lineage, checks, measurements, uncertainty, hazards, and proposed effect; a Promotion Request adds target, validation, rollback, authority class, and expiry. A Cleanup Receipt records resources, retained evidence, teardown, residue, and terminal state.

Repository, fixture, world, and artifact bases are exact revisions, never “latest.” Branches are either text-only idea branches, isolated material branches, or a promotion candidate packaged as a complete Vision. The latter is not selected, true, or authorized. Branch status is explicit:

open | blocked | failed | ineligible | candidate | retained | reaped | cleanup_incomplete

No branch need win. Exhaustion, contradictory requirements, unavailable state, and UNKNOWN are truthful outcomes.

Open, judge, prune

An experiment may use enumeration, debate, best-of-N, beam/tree search, human candidates, or another provider; no heuristic is constitutional. Dancer receives the common IntentRequestRequest and one declared Lens, then proposes alternatives with provenance, assumptions, required state, and unknowns. It cannot see siblings before the join, rank them, or promote them. Hunter separately reviews a named candidate, returning challenges, evidence requests, boundary findings, withhold recommendations, and uncertainty without inventing a preferred replacement. A join can cluster or deduplicate only while preserving original lineage.

Before material spend, deterministic predicates may make a branch ineligible; witnessed policy violations may block it. Missing evidence is unknown and may justify one bounded inquiry naming question, access, budget, and stop condition; it ends resolved, refuted, or unknown and may not widen itself. Model hesitation proves nothing. DriftEvaluatorEvaluator evaluates reviewer Posture against matched solvable controls. The Dual-Gate combines deterministic checks with attributed, calibrated qualitative judgment before eligibility; no score, confidence, or surviving cheap branch selects reality.

Versioned exploration strategy

A Simulation IntentRequestRequest may pin an executable exploration strategy by revision and digest, with its input/output contract and implementation closure. Given the observations disclosed so far, eligible branches and remaining budget, it proposes where to continue, a bounded batch of attempts, or a stop. Its decisions retain the evidence available at that point. Branch eligibility, independent Hunter review and promotion keep their existing owners; the strategy cannot widen authority, resource ceilings or sibling visibility.

The strategy remains fixed throughout one admitted experiment. A proposed successor is candidate material evaluated by DriftEvaluatorEvaluator and admitted by the receiving owner for later work. Changes to the score or implementation follow Workflow revision law; no strategy update patches a live RunJob RecordJob Record. SpellweaverWorkflow EngineWorkflow Engine coordinates the admitted attempts, DispatcherTraffic ControllerTraffic Controller selects capability, and OrchestratorStage ManagerStage Manager owns physical readiness and resource conflicts.

Retained branch histories may support historical exploration replay. The replay snapshot pins parentage, source revisions, disclosed observations, recorded costs, terminal states and missing continuations. It preserves unsuccessful branches within the admitted retention scope. Search over those records produces a candidate strategy and bounded evidence; fresh trials establish how it behaves beyond the recorded history. This optional mechanism needs no change to model weights and grants no training admission.

Material containment and budgets

A material branch receives an isolated workspace through a replaceable provider. Jujutsu can provide tracked change identity, not an execution sandbox. Its contract pins base and owned paths, mounts/processes/ports/services/network/secrets/effects, evidence locations, leases, reset/snapshot, expiry, teardown, and state-change verification. Effectful tests use an admitted execution boundary: directory deletion cannot end processes, revoke credentials, close ports, undo remote calls, or restore shared state. The designed TombSandboxSandbox proves none of this today.

Intent bounds branch/depth count, tokens, wall time, spend, disk, artifacts, concurrent execution, and review rounds; children consume their parent's reserved envelope. SpellweaverWorkflow EngineWorkflow Engine coordinates fan-out, join, cancellation, and termination; DispatcherTraffic ControllerTraffic Controller chooses capability; OrchestratorStage ManagerStage Manager manages readiness and lease conflict; Workers run jobs. Exhaustion cancels or marks incomplete, then cleans up—it never selects a winner.

Evaluation, reaping, and collapse

An Observation proves only its named predicate. A unit test cannot establish architectural fit, a commit cannot establish shared-state isolation, and a model judge cannot establish an effect. ShadowWhat-if SimulatorWhat-if Simulator sends exact branches, environments, observations, and artifacts to versioned DriftEvaluatorEvaluator Trial SuitesApp BundlesApp Bundles, keeping deterministic receipts distinct from verdicts. MirrorPersona KeeperPersona Keeper may supply Persona-congruence criteria but cannot privately select a Persona. A score is a scoped, versioned, attributable evaluation signal: it may guide pruning, priority, or convergence inside the experiment, but proves and authorizes nothing.

The Branch Reaper

Only after retention settles may Reaper act: commit terminal state; retain required inputs, observations, artifacts, findings, and errors; enumerate jobs, leases, processes, services, ports, and credentials; have workspace/execution owners tear down; reconcile external/shared residue; and write the Cleanup Receipt. TTL is not proof of safe deletion; hold, lease, pending promotion, required evidence, or unknown ownership postpones it. Failure retains its witnessed boundary; neither traces nor success/failure pairs become KarmaLessons LearnedLessons Learned or training examples automatically. Jujutsu cleanup verifies descendants and retained references because abandonment can rewrite revision relationships.

ShadowWhat-if SimulatorWhat-if Simulator emits only a Promotion Request:

Vision → target owner revalidates current state and evidence → rollback/snapshot preparation
→ Ward and HitL/preauthorization decide the exact effect → owner applies and verifies → receipt

The target rechecks base, preconditions, policy, authority, and rollback against current reality. Historical success or preauthorization outside an eligible class cannot merge, publish, purchase, deploy, restore, or otherwise cross the boundary. Archive separately admits memory; SoulforgeModel TrainerModel Trainer separately admits training. This is the Demarcation Law: SpellweaverWorkflow EngineWorkflow Engine coordinates live InvocationsJob RequestsJob Requests; ShadowWhat-if Simulator produces candidate realities.

Consequences

Acceptance evidence

ShadowWhat-if SimulatorWhat-if Simulator remains Designed until one bounded PatternWorkflowWorkflow proves independent Dancer branches, separate Hunter review, base pinning, material ownership, deterministic observations, DriftEvaluatorEvaluator evaluation, budget cancellation, inert Promotion Request, current-state revalidation, and a Cleanup Receipt including incomplete teardown. State of WorkWhat Actually WorksWhat Actually Works records that transition.