Worlds on demand,
called from the console.
When Titan Command Center flips to virtual or mixture mode, this is what it calls: declare a world, spawn real Titan Core OS machines into it, accelerate the clock, gate the results, keep the evidence. The same API drives CI — a regression suite is just a console session nobody watched.
Declare. Spawn. Run.
Gate. Prove.
The lifecycle of a virtual fleet, as function calls. Titan Command Center drives it interactively; CI drives it headlessly; both get the same worlds, the same machines, and the same evidence.
Worlds
Declare a world once; Matrix routes it to the right backend. Mixture worlds start from what the real fleet has sensed.
ScenarioBuilder(...).withOdd().withRoute().inject().build()Terrain, weather, traffic, comms quality, actors, routes, failures — one declarative speclintScenario(spec) → issues[]Catch impossible specs before any compute is spentrouter.route(spec) → CompiledScenarioBackend selection (Isaac · CARLA · gz-sim · Cosmos · MJX) + hash-pinned asset manifestbuildWorldFromFleetData(site, window)Mixture mode: reconstruct a rehearsal world from real fleet sensor historyVirtual Machines
Machines in Matrix are real Titan Core OS instances behind the sim HAL. They enroll with Titan Command Center like any machine — realm: matrix is the only difference.
spawn(profile, world, count) → units[]Boot N virtual machines from deployment profiles; TITAN_OS_HAL=simauto-enrollment → realm: "matrix"Spawned units appear in the same fleet view, run the same missions, raise the same alertssetTimeScale(factor)The clock is a parameter — compute-paced, wall-clock, or anywhere betweenteardown(worldId)Worlds are disposable; evidence survives themRuns & Suites
One scenario or a regression suite — identical seeds, two candidates, gates that decide.
runner.runWithAdapter(compiled, adapter) → RunResultprepare → run → collect → stop; runtimeMode stamped real | shim | mockrunSuite(spec, { baseline, candidate }) → SuiteReportSame scenarios, same seeds, two models — quantitative deltas outRegressionGate.evaluate(baseline, candidate, budget)pass-rate · route-completion · max-cpu · min-sensor-health · event-countexit code 2 on gate failureCI-native: a regression blocks the merge, not the postmortemFailure Injection
Failures are scenario code — declarative, composable, replay-deterministic.
inject({ kind, atSecond, durationSeconds, target, parameters })sensor · actuator · comms · compute · adversarial · impossible-physicscompositionAny combination in one scenario — sensor noise + comms loss + actuator latency, togetherModels
The candidate under test is an artifact, not a code change. The same model hook drives mock, shim, and real backends.
loadModelArtifact(path) → ModelHookBaseline and candidate load from explicit artifact pathsmodel.decide(observation) → commandThe same seam the machine runs in the field — evaluated under physicsEvidence
Every run leaves a verifiable trail — the artifacts a release decision (or a regulator) can stand on.
collect() → { mcapUri, leRobotDatasetUri, manifest }Real MCAP, episode datasets, hash-pinned manifestsverifyReplay(receipt) → bitIdenticalSame seed + assets + model → byte-identical telemetry, provablycoverage.summarize(runs) → CoverageReportODD axes, failure modes, form factors — what was actually testedWhat the API
promises about itself.
A simulation API is only useful if its output can be trusted at release time. These properties are enforced in the contract, not the documentation.
runtimeMode is stamped, never claimed
real | shim | mock rides every result — non-real output cannot masquerade as release evidence, and suite reports warn when either side ran non-real
Determinism is the default
Same scenario, seed, assets, and model produce byte-identical evidence — golden replay is a property, not a feature flag
The console is the only console
Matrix exposes no operator UI; virtual fleets are commanded from Titan Command Center like field fleets
Time never lies in the evidence
Artifacts carry sim time; acceleration changes how long you wait, never what happened
The loop, end to end: an operator drafts a mission in Titan Command Center, rehearses it against a Matrix world at 100× time with the exact release candidate the fleet will run, reads the gate report, and dispatches the real fleet — same console, same API family, three specs (Core OS API · Command Center API · Matrix API) versioned on one policy.