Build on Living Worlds.

Correct a model's answers with a small real sample (prediction-powered inference, PPI++): an estimate and interval that stay valid however wrong the model is, beside the real-sample-only answer, and the effective sample size the model adds. Per cell and poststratified with cells and shares. Nothing is stored.

Body

Where to spend the next real answers: labels per cell, more where the model is hardest to correct, every cell at least 2, summing to the budget.

Body

Intervals that keep their coverage (conformal): split; by subgroup, so no cell is covered only on average; or weighted to recent years, so a change of regime widens them instead of hiding.

Body

Regions forecast as the nation plus an offset that fades (AR(1)), so a region inherits a national stall instead of its own old slope; gains that taper as life expectancy rises, fitted over many populations; and a score against the truth.

Body

Expected siblings (older, younger, alive) from fertility and survival alone, with their variance, per cell; beside a simulation's counts and a survey's, it says whether the rates or the simulation's linking of births to parents is at fault.

Body

Subgroups held to the truth: multicalibration over overlapping groups (patches learned and applied to new units), small cells smoothed across ordered age bands, or each cell checked against its own sampling-noise floor.

Body

A running world corrected by what it observes (ensemble Kalman filter), or parameter space ruled out before expensive runs (history matching on Gaussian-process emulators). Seeded: the same body gives the same answer.

Body

This project's universe: its laws (the weakest gate any self here may run), its kinds of world, and how many worlds and residents it has.

Set the laws. The floor may be raised; it is never looser than the core's own.

Body

Declare a kind of world as data: what it is made of, where selves work in it, the checks that can fail there (none makes it belief-only), a stricter local gate, and what an arriving self must re-earn. A kind worlds were made under cannot be changed.

Body

The selves who live in this world.

Make a world in this project's universe. With no pack it is a place selves live in (kind optional: its seed is the world's first state). With a pack it also holds a living population: members drawn from a pack go on over simulated time (households, ties, circles, followers, life events from event_process dimensions, word of mouth, fatigue, bounded memory). Created paused at tick 0; the reply carries the plan (see /worlds/:id/plan).

Body

Worlds, newest first: status (paused|running|done|failed), tick, parent and branch tick.

Query

One world: spec, clock (tick, sim time, target), run (scale and whether it was capped), interventions, pending voiced members.

Delete a world with its member states and log. Its branches stay (they no longer name a parent).

Run the world in real time at its scale, capped to what the model and the arithmetic sustain (the reply says so). At most 3 running per tenant (429).

Body

Pause a running world; idempotent.

Advance a paused world by ticks (default 1) as fast as the arithmetic goes; voiced members still answer.

Body

Advance a paused world to a later time.

Body

Branch at a tick the world has reached (default now): the new world shares everything before it (re-simulated, with the recorded voices, no model calls) and goes on with its own interventions. The parent is untouched.

Body

Feasibility: the requested and effective (capped) scale, what limits it (model or arithmetic), model calls per second needed, estimated real time to the horizon, model calls to the horizon, and a plain sentence.

Query

The world's log, tick by tick: aggregates (have_it, aware, opinion, new adopters, exposures, life events, daily circle tiles), up to 25 sampled events per tick, group leanings.

Query

Members, paged, at the current or an earlier tick: public traits (aggregate-only dimensions withheld), household, circle, awareness, opinion.

Query

One member: as in the list, plus ties and memory (private life events withheld).

Query

The world's interventions.

Add an intervention while paused, at or after the current time (409 otherwise).

Body

A world of lives (made with POST /worlds {lives: {count, hazards, seed?, places?, year?}}): advance it {months: 1..1200} by its hazard table. Returns the world in aggregate: lives held and alive, the year, births, deaths and partnerships so far, and which hazards are measured and which are placeholders.

Body

Meet a life in a world of lives: its own record as it knows it (age, partner and for how long, children and their ages, whether it lives with its mother) and the same in its own words.

A met life's voiced decision, written back. decision: birth (a woman, the next months, default 12). The life answers through this tenant's model with its story as memory; the world host anchors the answer to the population's hazard (a voice moves one life around the level, never sets it) and draws the outcome as a real event. An answer with no chance in it is did-not-run and changes nothing.

Body

Save a world of lives to object storage, so it outlives the host's memory and comes back exactly.

Change an intervention that has not happened yet, while paused.

Remove an intervention that has not happened yet, while paused.

Start a simulation run: a population drawn from a pack (or a selection of personas), a stimulus, measures, a voiced tier (free text rated by SSR, with collapse checks) and dynamics (adoption over mixing groups, or opinion over an explicit graph). Runs as `simulate-voice` then `simulate` jobs; watch sim.progress / sim.done in /events. At most 3 queued or running per tenant (429).

Body

Simulation runs, newest first, with status, progress and the design (and version) each was made from.

Query

One run: spec, progress {phase, voiced, voice_of, seed, seeds, step, steps, pct}, and when done its aggregate results (represented vs simulated, reactions per measure with distribution, divides, would_act and collapse checks, adoption curves with the seed spread, opinion) and results.trust (version 1): fidelity tier mix, seed spread, reliability (test-retest), collapse warnings, calibration state with raw/debiased/calibrated signals, and the design's backtest skill against naive baselines. Special-category dimensions only in groups of 10+.

A run's sampled members, a page at a time by stable index: segment, weight, public traits (special-category values never), and the persona's handle when members are personas.

Query

External per-member observations: values of the pack's dimensions keyed by member index, before the run starts (a held run) or between its steps. They replace drawn values in profiles, rates and breakdowns. release: true starts a held run.

Body

Two finished runs side by side (an A/B of stimuli or designs): per measure means, would-act and JSD between distributions, adoption at the end, and whether they ran on the same seeds.

Query

Stop a queued, running or paused run for good (409 once finished).

Pause a running run: status pausing until its next chunk boundary (a voiced batch in flight finishes first), then paused. A paused run holds no worker and survives restarts; idempotent.

Continue a paused run from its checkpoint: resuming, then running. Results equal an uninterrupted run with the same seed. 429 when the tenant already has its maximum active runs.

Delete a run with its observations and results, for good (404 when not the tenant's). Event sim.deleted.

Delete many runs at once; those not found come back under missing.

Body

Archive (archived: true, the default) or bring back (false) a run. Archived runs leave lists unless ?archived=1 (only archived) or all.

Body

Archive or bring back many runs at once.

Body

The tenant's selves with counts of what they hold.

Query

Give birth to a self. Fails if the handle exists.

Body

Declare a self: born if absent; otherwise what a person sets (name, charter, persona, routine, interests) is brought in line. Identity and history are never overwritten.

Body

A self in full: identity, lessons as the core holds them, its procedure and trials, the faults it carries, what is true now, recent episodes, proposals, usage, jobs, outcomes, record integrity.

Change what a person sets.

Body

How this self does the work: the adopted text, every candidate on trial with the gate's reading of it, and every version with the diff and the items that decided it.

Write the procedure yourself. Ends any trial; recorded as authority, never as evidence.

Body

Go back to an earlier procedure.

Body

What a self with a character takes in: news, posts, conversations, literature, media, experiences, meals, purchases. Moves its stances, tastes, temperament, affect and capacities as its personality lets it; never how it works.

Body

The world settled something a stance bears on: the stance is pulled toward it and sources that pushed the other way lose trust. Grounding, kept apart from drift.

Body

A life event moves temperament directly, scaled by the self's sensitivity; part of it fades back toward its set point.

Body

A person sets or removes one identity row directly.

Body

The self's context for one call on one surface, and a ticket for its work and outcome.

Body

Queue a routine step now.

Body

Identity, lessons and the whole hash-chained record, without authority.

The self's record, in order, a page at a time: every episode and decision as a hash-chained entry.

Query

Record something that happened to a self in your product, in your own type (a session kept, a lived day, a sale). It reflects on it like anything else.

Body

Move a self into a world: its first arrival, or a crossing. Its record goes with it untouched, a running trial stays behind, and the destination kind's quarantine applies. Refused if its gate is looser than the laws.

Body

Where a self lives, every border it crossed, and whether its record shows it arrived whole each time.

Which tenant tools a self may call during work (its charter's authority.tools) and whether it may use tools with effects.

Body

The tenant's personas (current versions), filtered by any dimension of a pack. Special-category values are withheld and cannot be filtered on here.

Query

Create a persona: values validated against its pack's dimensions.

Body

Counts per group of a category, set or mixing-group dimension, with mean/min/max of a scalar measure. When a special-category dimension is involved, groups under 10 are suppressed.

Query

Export a pack's personas as JSON or CSV text (special-category values withheld).

Query

Import personas from CSV (header: handle, grounding?, dimension keys; sets as a|b, JSON cells allowed) or JSON (a list). Good rows are written, bad rows reported per row with their faults; dryRun writes nothing.

Body

A persona at a version (?version=, default current) and its versions. Special-category values are withheld.

Write a persona's next version (re-validated against its pack's latest version). merge keeps values not named; self links (or null unlinks) the self that voices it.

Body

Retire a persona. Its versions stay readable.

What this person of yours has said is true of them, in the scope you ask for. General memories (no scope) come back everywhere.

Query

Keep something this person said. A restatement of something already held writes nothing and names what it matched.

Body

Forget one. The row is removed, not flagged, and what was removed comes back.

The tenant's swarms: its designs whose members are selves, with members, process, protocol and last run.

Declare a swarm and its members (replaces membership): the next version of the design of selves called :id, keeping its process and protocol.

Body

A swarm (its design's latest version), its members and recent runs, each with its round.

Put one question to every member: a run of the swarm's design. Rounds (delphi, debate, critique-revise) follow on by themselves.

Body

A run: answers so far, tally (combined by the design's protocol), status, each answer's ticket, and the chain of rounds it belongs to.

The principal picks: every member that chose is rated on whether its calls match the principal's. Moves belief, never practice.

Body

What the world chose, measured by a registered checker: one check per member that chose, on the run as the item (the only settlement that reaches a member's practice), and an outcome for the lessons its ticket served.

Body

Standing work: each schedule, its cadence, when it runs next, and its last run.

Query

Give a self standing work. A task answers its instructions; research reads the web for its topics (one per line) into the self's memory. Times are the tenant's timezone.

Body

Change a schedule. A new cadence counts from its last run.

Body

Remove a schedule. Its items stay.

Run it now, unless an item of it is already queued or running. Its cadence is untouched.

Body

Ask a self for one piece of work. It is run as a `work` job; watch for work.done in /events.

Body

Items newest first, a page at a time, with counts per local day and status.

Query

One item, its output {text, sources, summary}, and its schedule.

Put a failed item back in the queue, as it was asked.

Record what your product did with a finished item's output on one channel (the core delivers nowhere itself). Replaces that channel's record.

Body

Decide an item that waited for review.

Body

What was done with a context.

Body

How it went, credited to the lessons served on the ticket. A person's verdict is a signal; what the world later did is happened. Both move belief, never practice. A check sent here is read as an outcome: only a registered checker, at POST /checks, can move how a self works.

Body

Begin a run, and say so before doing any of it. The row exists from this moment, which is what makes a run that is still happening — or one whose process died holding it — something you can see.

Body

Append a step. Send the frame you are already streaming: its type, its step name and its rawEvent. The same rows are what a watcher reads and what an auditor reads.

Body

End a run. Appends the closing step and stops the heartbeat mattering.

Body

Runs that are still open, oldest sign of life first. A run whose process died is one that is still open with a heartbeat that stopped — which is the thing a span cannot tell you.

Query

One run, everything it started, and its steps from the beginning. The same rows a live watcher is reading.

Steps after a sequence number. Watching live is asking with the last seq you saw; replaying is asking with 0.

Query

The instruments registered in this project: the only things that can mint a check.

Register an instrument. Its key is shown once; verdicts sent with it are minted as checks, the only evidence that can change how a self works.

Body

Revoke an instrument's key. Checks it already minted stand in the record.

Report a checker's verdicts on items known to be bad. One pass on a bad item suspends it, and every adoption it helped decide is named for review.

Body

A checker's verdicts on a self's work, with the checker's own key. They close one episode: belief and the fault ledger read them, and a trial's gate when they are for one of its arms.

Body

Suggested changes.

Query

Accept or decline a suggested change.

Body

A person doubts a lesson; it returns to being a hunch.

Body

Push what happened in your own systems. It is read as from inside the organisation.

Body

Recent observations, quarantined ones marked.

Query

The tenant's sources and their last read.

Declare a source.

Body

What happened, in order, after an id.

Query

Register a forecast BEFORE the moment it is for (409 once target_at has passed): value and 10–90% band, how it was made, an inputs hash (or inputs to hash), and the naive baselines' values for skill.

Body

Registered forecasts, by target date, each with its outcome once scored.

Query

Remove a registered forecast and its outcome.

Post actuals; every open forecast for that subject and day, made before it, is scored at once (absolute and percentage error, sMAPE, pinball, within band, error of each baseline).

Body

Pull actuals from one of the tenant's read-only tools (called with {subject, ...args}, answering {actuals: [{at, value}]}) and score them.

Body

The accuracy ledger: per method, design or the whole tenant: scored count, MAE, MAPE, sMAPE, pinball, band coverage, skill against each baseline (1 - MAE/MAE baseline), month by month; per design also its backtests' skill.

Query

Backtest: fit the release of a design, a run or an inline release on a measured series BEFORE the cut and forecast after it; scored only out of sample at each horizon (MAPE, sMAPE, MAE, pinball, cumulative error) beside naive baselines (last period carried forward, no further change, seasonal-naive when the cadence has a season), with a plain verdict on whether the model beat each. A signal and an outcome make it a calibration pair. All faults come back at once in faults [{path, message}].

Body

Backtests, newest first, with their verdicts.

Query

One backtest: the series, the fitted parameters (with an in-sample error that is never judged), per-horizon scores and skill against each baseline, the verdict, and the forecast with its 10–90% band beside the actuals and baselines.

Delete a backtest and its calibration pair, for good (404 when not the tenant's). Event backtest.deleted.

Delete many backtests at once; those not found come back under missing.

Body

Archive (archived: true, the default) or bring back (false) a backtest. Archived backtests leave lists unless ?archived=1 (only archived) or all.

Body

Archive or bring back many backtests at once.

Body

The tenant's calibration maps, per design and signal metric: isotonic (5+ backtests) or bounded linear (3+) from the swarm signal to the observed outcome, with the leave-one-out error; uncalibrated below 3. Runs show raw, debiased and calibrated values in results.trust.

Query

Swarm designs: the platform's templates (read-only: audience-test, ab-test, panel-delphi, diffusion) and the tenant's own, latest version of each.

Query

A design at a version (?version=, default latest), its versions and its recent runs.

Save a design's next version (unchanged writes nothing), validated against its pack or its selves. Template keys are refused: start from one with from.

Body

Run a design. Selves: a swarm run (any key). Population or personas: a simulation run in /sim/runs (admin key), or one per variant on the same seeds with a compare link.

Body

Bulk ask: one question to n members in one call. Selves: a weighted sample, each answer weighted by what it stands for. Population or personas (admin key): n voiced members, evenly or a weighted stratum sample, rated against the choices; partial results stream in the run's progress and sim.progress events.

Body

Delete every version of the tenant's own design (templates are never touched; runs keep their results), for good (404 when not the tenant's). Event design.deleted.

Delete many designs at once; those not found come back under missing.

Body

Archive (archived: true, the default) or bring back (false) a design. Archived designs leave lists unless ?archived=1 (only archived) or all.

Body

Archive or bring back many designs at once.

Body

Persona packs this tenant can use: the platform's (standard; read-only) and its own, latest version of each, with what each extends.

Declare a pack of the tenant's own, or write its next version. It may extend a platform pack or one of its own (pinned to that pack's latest version). A platform pack key is refused (403): platform packs are read-only.

Body

A pack at a version (?version=, default latest), its versions, and every dimension it carries: its own over those it inherits, each at the pinned version.

Declared persona dimensions, latest version of each, platform and own; ?pack= narrows to one pack.

Declare a dimension in one of the tenant's packs: its next version (an unchanged declaration writes nothing) and the pack's next version pinning it. Validated per type; every fault comes back at once in faults [{path, message}] (400). A dimension that plausibly duplicates an inherited one (the same key stem, e.g. age and age_band, or spec.refines naming it) is refused (409, faults at inherited.<key>) until the caller chooses: inherited: {<key>: {derive: fn}} makes the inherited dimension the pack's own, DERIVED from this one (never drawn, so members never contradict themselves), or {<key>: "keep"} keeps drawing both (recorded in spec.keeps). Examples per type: scalar {range: {min: 18, max: 90}, distribution: {kind: "normal", params: {mean: 40, sd: 12}}}; category {categories: [{label: "north", share: 0.4}, {label: "south", share: 0.6}]}; derived category {categories: ["under 30", "30+"], derived: {from: ["age"], fn: {kind: "band", of: "age", edges: [30], labels: ["under 30", "30+"]}}}; embedding {dims: 512}; set {items: ["vinyl", "streaming"], max_items: 2}; timeseries {of: "number", dynamics: {kind: "drift", rate: 0.01}}; edge {relation: "friend", structure: "mixing_group", homophily: ["region", "age_band"]}; event_process {process: "poisson", rate: {mean: 2, per: "month"}}.

Body

One dimension at a version (?version=, default latest) and its versions.

Tenant settings.

Body

The tenant's own tools: its endpoint setting (the credential never shown; auth.via env|file) and the tools it lists, each with effects (bool) and the selves allowed it. ?refresh=1 skips the cache.

This tenant: name, timezone, settings (a webhook secret never), what its model calls resolve to, and its members.

Who may manage this tenant: the owner of record, admins and members, by account id with the email beside it.

Recent and pending jobs, and the model slot's state.

The same capabilities as MCP tools, for agents. Streamable HTTP, both protocol eras.

405. The GET stream was removed in MCP 2026-07-28; named here so the refusal is contractual rather than a gap.

405. Sessions were removed in MCP 2026-07-28; there is nothing to delete.

This contract.