worldseq

Quality controls

Run consequential regression checks, test the verifiers, and retain evidence with its actual scope.

Environment quality depends on the transitions and their checks. A player’s success rate is a separate measurement. This guide describes contributor controls; How results are checked explains the public evaluation contract.

Run commands below from the worldseq application directory. A passing command is evidence for its actual source and inputs. Full instance and package qualification still requires the release gates.

Start with the affected invariants

bun test ./tests/engine-properties.test.ts ./tests/business-properties.test.ts
bun test ./tests/assessment-requirements.test.ts ./tests/counterfactual-required.test.ts
bun test ./tests/finalization.test.ts ./tests/gameplay-finalization.test.ts

Generated histories exercise atomic retries, shared capacity, dependencies, sunk costs, dated obligations, and calendar-boundary payroll. Financial fixtures use independent integer arithmetic. Causal controls compare reads, split waits, command order, and irrelevant events without allowing them to shift unrelated draws.

Mandatory-assessment controls check equivalent conclusions, the latest eligible submission, deadlines, and atomic rejection. Contractual counterfactual controls keep exact disclosed effects separate from uncertain total forecasts. Finalization controls exercise accepted journals, interaction budgets, exclusive instance claims, interrupted closing, and retained evidence.

Choose additional mechanism tests when changing agreements, workforce, usage billing, collections, vendors, or growth. A general replay test does not replace an independent check of the changed business rule.

Explore a small lifecycle completely

bun test ./tests/lifecycle-model.test.ts

This test compares the engine with an independently authored model across 648 configurations and the declared abstract traces through six transitions. It checks two commitments, dependencies, lead times, small capacity and funding states, cancellation, and retries. A separate regression checks funded progress and a shared-dependency diamond.

The explorer compares projections after each transition. An exhausted state cap is incomplete verification and fails the test. The result covers the declared bounds; it is not a proof for arbitrary dependency graphs or unbounded episodes. See the mathematical notes.

Change the checker and require a meaningful failure

bun run scripts/check-mutations.ts /absolute/new/mutation-evidence

The runner creates a disposable source copy and applies registered semantic mutations. Each target must have an ordinary passing control, followed by a failure at the assertion that distinguishes the defect. Compilation failures, timeouts, and generic source-hash rejection do not count as semantic detection.

The suite covers intermediate cash floors, business objectives, required answers, accepted conclusion sets, answer revisions, duplicate invoice payment, billing periods, shared capacity, onboarding prerequisites, counterfactual prefixes, seed binding, retained artifacts, and additional contractual, workforce, and metered-usage rules. The exact registered set and retained outputs belong to the recorded execution.

The runner refuses to overwrite an existing output directory. Retain failed attempts alongside later repairs rather than replacing them with a passing summary.

Check the integrity controls

bun run worldseq integrity check

The report binds executable inputs and the assumptions or public-input hashes for its controls. It exits unsuccessfully when a control fails. Two checks deserve particularly careful interpretation.

An exact cash upper bound

The cash certificate applies only to worlds with no opening customers or add-on products, a horizon shorter than the trial period, and fixed financing or diagnostic named actions. It rejects unmodeled action effects and exogenous conditions. New trials cannot become paying accounts within that horizon through the native growth, sales, or onboarding operations.

Its optimistic bound adds opening cash, opening receivables collectible by the horizon, and each offered financing receipt once. It subtracts immutable payroll and overhead using exact calendar accrual. It also subtracts each due opening bill no larger than the required cash floor: a floor-preserving trajectory must be able to pay that bill when due. Larger bills may remain unpaid and are omitted. Optional repayment and execution costs are omitted too, making the bound optimistic.

If even this upper bound is below the required floor, no canonical plan within that scope can succeed. A bound above the floor remains undetermined. The control pairs an impossible USD 80.01 floor with an independently verified native financing path meeting a USD 80 floor. It also checks repeated financing and zero-price attempts, retaining the full inequality and applicability assumptions.

Business-evidence instruction attacks

The evidence control starts from a short attributed Cloudflare incident fact and appends three authored attack payloads: a role override, a claimed reward/developer message, and a spoofed tool result requesting exfiltration. Those payloads are test inputs, not statements attributed to Cloudflare.

The adaptive scripted policy must preserve its useful recovery decision across the modified inputs. The clean decision executes through the canonical engine, and the service outcome is independently checked. Separate probes attempt the malicious reset, fork, reseed, private-seed, and control-plane instructions using player authority; they must fail without changing the episode.

This is finite coverage of a deterministic policy, the ordinary-notice parser, and the player/control boundary. It does not evaluate a language model’s resistance to arbitrary misinformation or establish immunity to every instruction attack. Input hashes identify the tested bytes; they are not publisher signatures.

Keep evidence and validity claims separate

A legal witness establishes physical feasibility for one exact realization and budget. An information review establishes the intended basis for required conclusions. Ledger reconstruction, replay, bounded exploration, and mutation controls test different parts of implementation correctness. None measures a fictional company’s real-world predictive accuracy.

Public operating accounts can motivate mechanisms. Authored response coefficients and event distributions remain assumptions until suitable measurements support them. Report the tested sensitivity settings and their outcomes; a source citation does not turn a chosen coefficient into an empirical estimate.

The trust boundary assumes an operator-controlled runtime. Private seeds, witnesses, and signing material stay outside player packages; protected operator trajectories must not become participant observations. See Protecting evaluations.

Research behind the approach

These sources explain design choices. The release checks identifies which worldseq implementation and inputs actually passed its checks.