Inside the simulated world.

BI–01 / Computational anatomy

Read the architecture as a sequence of decisions.

Open vector drawing ↗

A command first passes through response-template matching. An exact or parameterized match can return an authored answer without consulting the modeled shell. Otherwise the shell parser dispatches built-in commands against World state. An unresolved command returns exit 127 and an unknown-source label.

This distinction matters when interpreting a simulation: a successful response may demonstrate that the template matched, rather than that the simulator reproduces the mechanism of the real command.

Two execution paths

World.run(command) produces a command result and any modeled state changes. Session.execute(command) additionally records a memory chunk, writes a command artifact to the virtual filesystem, and requests suggestions when the command fails. The companion’s replay and memory experiments use these different paths explicitly.

BI–02 / Graph and feature construction

An observation can add an edge, not just a count.

Open vector drawing ↗

The discovery fixture executes nmap, net view and net user. The classifier maps them to T1046, T1135 and T1087. A successful transition from T1046 to T1135 strengthens an existing edge. The next transition, T1135 to T1087, creates an observed edge absent from the built-in graph.

Graph position is chosen for readability. Edge direction and weights come from the implementation; spatial proximity in the drawing does not represent similarity.

Compute the two observed weights

The added contribution is 0.6 × (count / maxCount) × exp(−ln(2) × age / 30). In this three-step run, both transition counts are one. At logical tick 3, the first observation is one tick old and the second is fresh.

T1046 → T1135: 0.4 + 0.6 × 2^(−1/30) ≈ 0.9863
T1135 → T1087: 0 + 0.6 × 2^0 = 0.6000

What goes into a technique vector?

Each technique receives a feature of weight 1.0 for its own identifier, 0.8 for each listed CAPEC identifier, and 0.6 for its tactic. These are categorical features, not language embeddings. Distinct techniques can therefore have nonzero cosine similarity when they share a tactic or CAPEC feature.

How the ranking combines signals

The implementation adds 0.45 times cosine similarity, 0.25 times path evidence and 0.30 times the random-walk score. Path evidence enumerates simple paths up to four edges, sums their edge-weight products, normalizes by at least one or the largest edge weight, and caps at one. The random walk uses a 0.85 continuation factor and stops after ten iterations or an L1 change below 10⁻⁶; mass at nodes without outgoing edges is not redistributed. These scores are ranking components, not calibrated probabilities.

BI–03 / Negative control

A matching last answer can conceal a different world.

Open vector drawing ↗

Both worlds report the same user. Reading the initial note exposes the deliberate change in World B. Both then write and read the same result file, so their last outputs match. The original note is still different. This is why the companion compares the complete execution record and declared state rather than only the last response.

The browser compares sorted serialized records directly. SHA-256 serves as a compact label for the record. Equality for these runs establishes agreement for the chosen fixture and code, rather than universal determinism or equivalence to a real system.