An AI assistant reaches Whathappensify through the Model Context Protocol (MCP), on two endpoints. The agent endpoint carries the ten reasoning operations and lookups; the control endpoint carries the work around them. Together they offer 176 operations.
Build a starting world for a place you name, or from data you supply.
Ask you to add a dataset, terrain or a catalog source to your account.
Write a scenario proposal: the place, the change you want to try, the data and the assumptions.
Propose a variant of an approved scenario that changes only what it lists.
Propose continuing a finished run from where it ended, or from a saved point partway through.
Propose a sweep: the same scenario run several times with different values, listed one by one.
Prepare a search across approved settings, for you to approve.
Propose a watch that reports when a measure crosses a threshold.
Prepare a Perspective for your review.
After you approve, generate the scenario and run it.
Save a finished run's state as a new starting world.
Read simulations other people shared with you.
Pick up a simulation later, where it stopped.
What only you can do
Before a scenario is generated, you review and approve its setup in the browser. Approval applies to that version and scope. Material changes come back for review.
These 15 operations record material instead of acting on it. The row for each in the full reference says what follows.
No operation approves a scenario, variant, continuation, sweep or search: generating or running one needs your approval in the browser. A watch is different: after MONITOR.propose_watch, the assistant can start it with MONITOR.activate_watch.
No operation deletes anything permanently. Permanent deletion is proposed with simulations.propose_deletion, and you confirm it in the browser. Moving a simulation to the trash can be undone.
01
The rule
A result’s claim strength is never chosen by the assistant. It is the minimum of every limit that applies: what the method can support, what the evidence allows, what was asked for, what the computing backend supports, and how well the model fits the place in question. If any limit is missing, the result is a named refusal rather than a number.
OBSObserve: read what a run or a dataset contains, without interpretation
INTInterpret: say what a result means under stated conditions
RSNReason: combine results by a recorded method
ACTAct: a recommendation that could inform a decision
LRNLearn: a value derived from evidence and proposed for later use
Claim strength is ordered from CS0 to CS4. The operation, method and evidence determine what each achieved label supports. A label alone does not mean that an interval was calculated or a prediction validated.
CS0speculative
CS1suggests
CS2indicates
CS3strongly indicates
CS4demonstrates
02
Where each operation sits
Every operation has one ceiling: a grade paired with a claim strength. The dashed arrows show where it falls to when the evidence is thinner. Select an operation to jump to it.
03
The ten operations
For each: what it does for the assistant, its ceiling, and everything its software development kit (SDK) implementation can do, each with its formal name and, after it, what that lets a person find out.
CHECK
Observeceiling CS1falls to CS0
How an assistant reads what is there. CHECK answers a question about a place at a moment: how much of something is in an area, what value a measured quantity takes across it, which way things are moving. It reports; it does not interpret.
Observation source bindingsave a reference to one exact owned, marked tabular dataset versionMCP: sources.bind
Activity densityhow much of something is in an area: people, vehicles, eventsMCP: CHECK.density
Ensemble spreadread a completed ensemble of a stock-and-flow model you own: the stated input distributions with their sources, the members by outcome, the percentiles of each selected output over the members that passed, and a page of member rows, without raising its evidence gradeMCP: CHECK.ensemble
Scalar fieldthe value of a measured quantity across an area, such as water depth, temperature or noiseMCP: CHECK.field
Flow vectorsthe direction and rate of movement across an areaMCP: CHECK.flow
Saved model valuesread saved values, units and assumptions in bounded sections of a completed model result you own, without raising its evidence gradeMCP: CHECK.kernel_output
Saved run measurementsread verified measurements from a saved run and retain the governed readingMCP: CHECK.measurements
Saved mobility feedback roundsread the saved rounds of a completed mobility feedback run you own: the trips each round planned, the travel times its simulated journeys took and the travel-time table it updated for the next round, in bounded sections, without raising its evidence gradeMCP: CHECK.mobility_feedback
Stock-and-flow results through a Perspectiveread the saved result of a stock-and-flow model through a signed Perspective tied to that model, without changing the run or its evidence gradeMCP: CHECK.model_perspective_reading
Saved measurements through a Perspectiveread saved measurements through an explicitly selected Perspective without changing the run or its evidence gradeMCP: CHECK.perspective_reading
Place resolutionturn a place name into one location, with its coordinates and a boundaryMCP: CHECK.location
Place candidatesreturn every candidate place the configured provider finds for the text, so the person can settle any ambiguityMCP: CHECK.location
Model self-testsread the self-test cases a completed stock-and-flow run you own declared: what each case changed, how it ended, the platform's checks and the expectations stated for it, which prepare a review of the model and do not raise its evidence gradeMCP: CHECK.self_tests
Saved source densitycalculate and save density readings from a bound table or a completed run’s placesMCP: CHECK.density
Saved source fieldsave the value of one declared field for each selected row of a bound sourceMCP: CHECK.field
Saved source flow vectorssave vector length and bearing for each selected row of a bound sourceMCP: CHECK.flow
Sweep pointsread a completed sweep of a stock-and-flow model you own: the points it declared, the points by outcome, the smallest and largest value of each selected output with the points tied with them, how many of the declared points meet a stated threshold, and a page of point rows, without raising its evidence gradeMCP: CHECK.sweep
Saved run trajectoryread how one quantity changed over the course of a completed simulation run, from the samples the run savedMCP: CHECK.trajectory
Simulation output read by CHECK is reported as simulation output, never as a field observation.
SEEK
Observeceiling CS1falls to CS0
How an assistant traces movement through a place. SEEK follows paths: between two points, outward from one point, or between whole areas.
Origin-destination flowshow much movement goes from each area to each other areaMCP: SEEK.flows
Saved network reachabilitysave the network nodes reachable from one place within the requested travel-time budgetsMCP: SEEK.reach
Saved network routessave the best routes between two places in one of the person’s own worldsMCP: SEEK.route
Reachability isochroneseverywhere that can be reached from a point within a given time or distanceMCP: SEEK.reach
Recompute a saved route or reachrecompute a saved route or reach result from its original exact network; a changed network is refused, never substitutedMCP: SEEK.recompute
Routingthe path between two points and how long it takesMCP: SEEK.route
Saved origin-destination totalssave flow totals from one exact bound origin-destination sourceMCP: SEEK.flows
Saved measurement timelineretain selected run measurements in run-completion orderMCP: SEEK.timeline
The order in which runs finished is reported as an order, never as a trend or a cause.
MONITOR
Observeceiling CS1falls to CS0
How an assistant watches a run or a place over time. MONITOR keeps standing watches and reports what has changed.
Activate a durable watchactivate one exact inactive watch proposal under the person’s current authorityMCP: MONITOR.activate_watch
Cancel a subscriptionstop a threshold subscriptionMCP: MONITOR.cancel_watch
Cancel a durable watchstop one durable watch owned by the person’s account from being evaluated againMCP: MONITOR.cancel_watch
Context summarythe setting those events happened inMCP: MONITOR.context
Drift detection, CUSUMwhether a model’s behaviour has moved away from what it was checked againstMCP: MONITOR.drift
Drift against saved calibrationdetect changes in retained prediction errors against a saved calibrationMCP: MONITOR.drift
Recent eventswhat has happened since the last lookMCP: MONITOR.events
Stock-and-flow run statusread the state and complete diagnostics of one stock-and-flow model run, without creating a watchMCP: MONITOR.general_status
Active subscriptionssee the threshold subscriptions that are running, optionally for one measure or areaMCP: MONITOR.list
List durable watcheslist the active durable watches owned by the person’s account without evaluating themMCP: MONITOR.list
Running simulation readread one verified recorded moment of a running simulation the person owns, and the vehicle selected in it, without changing the runMCP: MONITOR.live_run
Playback speed readread the playback speed requested for a running simulation the person watches, and whether their run page has applied itMCP: MONITOR.presentation_pace
Propose a durable watchsave an inactive watch proposal for a separate activation decisionMCP: MONITOR.propose_watch
Current statewhat a run or a watched place looks like right nowMCP: MONITOR.watch_state
Saved run statusread one durable run’s state without creating a watchMCP: MONITOR.status
Threshold subscriptiona standing watch that reports when a value crosses a lineMCP: MONITOR.propose_watch
Trend analysis, linear slopethe direction a value is moving and when it would cross a thresholdMCP: MONITOR.trend
Bound observation trendanalyze one declared field of a current bound observation sourceMCP: MONITOR.trend
Durable watch configurationread a watch’s declared configuration without exposing its raw stateMCP: MONITOR.context
Saved watch eventsread one page of the trigger events retained for a durable watchMCP: MONITOR.events
Saved watch stateread a durable watch’s retained state without advancing a simulationMCP: MONITOR.watch_state
A status read is a snapshot. It does not create a watch or stream state; a watch is a separate, named subscription.
IMAGINE
Interpretceiling CS2falls to CS1
How an assistant sets up a hypothetical. IMAGINE describes a scenario that differs from the present in stated ways, and records the conditions it assumes, so that whatever is later computed carries them.
Saved simulated contrastread an exact simulated contrast without creating or running a scenarioMCP: IMAGINE.conditional
Counterfactual scenarioa scenario that differs from the present in stated ways, ready to be proposedMCP: scenarios.propose_variant, scenarios.generate, EXPLORE.start, runs.propose_continuation
Evidence emissionrecord the conditions the scenario assumes, so the result cannot be read without themMCP: the platform records it with every result; resolve.reference reads it
IMAGINE never starts a run. A scenario becomes a run only after the person approves it. Prepared ordinary road-access rules and timed withdrawals remain proposals for browser review. This first policy slice denies ordinary traffic access on known at-grade roads. Inspection reads exact saved moments with current source access; saved policy cursor import and continuation are refused.
EXPLORE
Interpretceiling CS2falls to CS1
How an assistant runs the simulation. EXPLORE advances an approved scenario through time and records the scenario, its inputs and settings, and the results it produced. Each simulation method states whether the same input reproduces the same result.
Cancel a runstop an owned queued or running run, leaving its approval and saved results unchangedMCP: EXPLORE.cancel_run
Resume a runcontinue an owned unfinished run under its original approval, without resetting its deadline or computeMCP: EXPLORE.resume_run
Forward runadvance an approved scenario through time and record its resultsMCP: EXPLORE.start
Set the playback speedask the person's open run page to play a running simulation faster or slower, without changing the simulation or its resultsMCP: EXPLORE.set_presentation_pace
Start an approved runstart a person-approved manifest or retrieve the same durable run on an exact retryMCP: EXPLORE.start
A completed run establishes what the model did under stated conditions. It does not by itself establish how accurate the model is or how uncertain the result is; those are GAUGE’s to establish.
COMPARE
Reasonceiling CS3falls to CS2 or CS1
How an assistant puts results side by side. COMPARE lines up scenarios or states in time, place and units, and says whether they differ.
Content checksumscalculate checksums that identify supplied content; a checksum is not evidence and authorizes nothingMCP: COMPARE.checksum
Comparison under a joint interventioncompare exact saved fields when an approved scenario changed several controls togetherMCP: COMPARE.joint_receipts
Pareto frontierthe options that cannot be improved on one objective without losing on anotherMCP: COMPARE.pareto
Pareto frontier of completed runsthe completed runs that cannot be improved on one objective without losing on anotherMCP: COMPARE.pareto
Verified run comparisoncompare verified receipt measurements and retain the governed comparisonMCP: COMPARE.receipts
Multi-scenario comparisonthe same measurements across several scenarios, aligned so they can be read togetherMCP: COMPARE.receipts
Two-state test, Welch’s t-test and Mann-Whitney Uwhether two sets of results differ by more than chance would explainMCP: COMPARE.receipts
Two points of a sweepcompare two points of a completed sweep of a stock-and-flow model you own: the inputs whose values differ and each selected output at both points, with whether the difference exceeds both points' numerical differences, without raising its evidence gradeMCP: COMPARE.sweep_points
Simulation output and real observations are never compared as if they were the same kind of evidence. A numerical difference is reported as a difference, not as a cause, a preference or a prediction.
EXPLAIN
Reasonceiling CS3falls to CS2 or CS1
How an assistant says why. EXPLAIN assigns a difference to a stated cause, and only when a stated cause map shows that the cause can be separated from everything else that could have produced the difference.
Causal attribution, backdoor identification and adjustment setshow much of a difference is assigned to the stated cause, given the variables the cause map says must be held fixed; if the map cannot separate the cause, EXPLAIN says so and stopsMCP: EXPLAIN.attribute
Saved comparison attributiondescribe one exact metric from a retained qualified comparisonMCP: EXPLAIN.attribute
Shapley coalition attributionallocate a complete retained set of coalition results using exact Shapley valuesMCP: EXPLAIN.coalition
Controlled-model effectretain a qualified effect from a controlled-model comparison under its stated assumptionsMCP: EXPLAIN.controlled_effect
Combined qualified effectscombine compatible retained controlled-model and observational effectsMCP: EXPLAIN.hybrid
Joint controlled-model effectqualify the effect of several controls changed together, without assigning a share to any one of themMCP: EXPLAIN.joint_controlled_effect
Feedback loop dominancefind which feedback loops drove a completed stock-and-flow run you own, and when, from its stored values: the share of each loop over time, the loops that dominated each phase, and the delays a loop passes through, without raising its evidence gradeMCP: EXPLAIN.loop_dominance
Stratified observational effectestimate an effect from aligned retained observation rows under the declared identification assumptionsMCP: EXPLAIN.observational_effect
Declared causal structurecheck a declared causal graph and retain its qualified structural resultMCP: EXPLAIN.structure
Evidence regimes
Simulationthe evidence is simulation output
Observationalthe evidence is real observations
Hybridboth, kept distinct
Identification is checked before any effect is estimated. An explanation that the cause map cannot support is refused rather than weakened.
GAUGE
Reasonceiling CS3falls to CS2 or CS1
How an assistant says how sure. GAUGE attaches an uncertainty statement to a result and enforces how strong that statement may be. The method is chosen from the kind of result; the analysis mode sets a ceiling of its own; the achieved strength is the minimum of every limit that applies.
Uncertainty assessmentattach an uncertainty statement to a result by one of the methods below, bounded by the rule aboveMCP: GAUGE.assess
Saved measurement uncertaintyapply a governed uncertainty method to exact retained run measurementsMCP: GAUGE.assess
Saved prediction calibrationcompare exact retained predictions with exact retained observations to calculate calibration evidence, by any of the three calibration methods: inline calibration, validation active or calibration assessmentMCP: GAUGE.calibrate
Place-aligned field uncertaintycalculate governed uncertainty from retained fields aligned by placeMCP: GAUGE.field
Saved paired-difference uncertaintycalculate uncertainty from ten exact retained comparison pairsMCP: GAUGE.paired_delta
Preserve a qualified effectretain one exact qualified controlled-model effect without adding new evidenceMCP: GAUGE.pass_through
Publish an approved prediction validationrecord one validation the person approved as a governed validation recordMCP: GAUGE.publish_validation
Recompute a saved uncertainty resultrecompute a saved uncertainty result from its exact retained sources under its original recipeMCP: GAUGE.recompute
Request a prediction validationprepare one validation of a run’s prediction against bound observations for the person to approveMCP: GAUGE.request_validation
Simulation support assessmentassess whether declared methods and inputs meet their stated rules, with conditional limits and validity left unknownMCP: GAUGE.simulation_support
Variation among runs or ensemble membersdescribe variation among selected runs or among an authored model's ensemble members, without claiming predictive uncertaintyMCP: GAUGE.spread
Saved prediction validationthe same comparison, limited to the two methods, validation active and calibration assessment, that score each pair against a registered threshold for a named domain and geographyMCP: GAUGE.calibrate
Distributional
Parametric intervalan uncertainty range that assumes the result follows a known distribution shape
Resampling
Block bootstrapresampling in blocks so that patterns over time are preserved
Bootstrap intervala range from resampling the data itself, with no distribution assumed
Re-running the simulation
Monte Carlo ensemblere-running with different random seeds and reading the spread
Paired delta ensemblerunning two scenarios under identical seeds so that only the change between them shows
Parameter perturbationre-running with the inputs nudged to see how far the answer moves
Sensitivity analysischanging one input at a time to find which inputs matter most
Place by place
Spatial bootstrapresampling, reported place by place
Spatial ensemblethe ensemble spread, reported place by place
From real observations
Observational bootstrapresampling real observations rather than simulation output
Observational ensemblean ensemble anchored to real observations; the ceiling rises with how much of the area the observations cover
Against real observations
Calibrationchecking the model against real observations and reporting how well it fits
Inline calibrationthe same check, run inside another analysis
Analysis modes and their ceilings
Audit only, CS0report what was computed and claim nothing about uncertainty
Calibrated predictive, CS3the model has been checked against observations for this use
Decision grade, CS4the strongest ceiling; every other limit still applies
Ensemble active, CS3an ensemble of runs is available to draw on
Internal uncertainty, CS1describe the spread inside the model only
Validation active, CS3observations are available to check the model against
Descriptive spread across runs is reported as spread, never as a confidence interval, unless a method that supports an interval was run.
CHOOSE
Actceiling CS4falls to CS3
How an assistant looks for the best option. CHOOSE searches the allowed values of a decision against stated objectives and hard limits, and ranks what it finds. It is the only operation that can reach decision grade, and it cannot recommend at all until GAUGE has attached an uncertainty to the candidates.
Choose with approved prioritieschoose among verified candidates using the person’s current approved Perspective prioritiesMCP: CHOOSE.approved_perspective
Qualified candidate rankingrank two compared candidates under explicit objective directions and boundsMCP: CHOOSE.rank
Decision searchsearch the allowed values of a decision against the objectives and hard limits, by one of the methods belowMCP: CHOOSE.search
Approved finite searchapply a bounded solver to qualified completed results within a person-approved finite sweepMCP: CHOOSE.search
Search by stated criteriasearch qualified approved results against typed criteria, requirements and preferencesMCP: CHOOSE.criteria_search
Start a durable searchstart, or replay on an exact retry, a durable search of retained candidates within approved limitsMCP: CHOOSE.start_search
Verify a choice setcheck approved candidates and retain their exact criteria, without selecting a winnerMCP: CHOOSE.verify_choice_set
Seal a retained choice setprepare a sealed set of saved candidates for signed Perspective priorities, without selecting a winnerMCP: CHOOSE.verify_retained_choice_set
Search
Bayesian optimizationa search that learns from each trial where to try next
Grid searchtry every combination on a fixed grid
NSGA-IIan evolutionary search for the set of best trade-offs among several objectives
Random searchtry random combinations within the allowed ranges
Robust optimizationprefer options that stay good when the inputs are uncertain
Local minimization, SLSQPsearch from the midpoint of continuous bounds using finite-difference slopes; a stopping test does not establish a minimum or search the rest of the domain
Weighted-sum enumerationscore every option by a weighted total of the objectives
Before a recommendation is made
Constraint evaluationthe hard limits an option must satisfy; options that fail are dropped, not ranked lower
Grade gatea recommendation is withheld unless the attached uncertainty supports the claim strength asked for
Recommendation sensitivitywhether the ranking survives small changes to the inputs; an unstable ranking is not recommended
A ranking is a ranking of the submitted candidates under the stated objectives. It does not establish what the person prefers.
ADAPT
Learnceiling CS3falls to CS2 or CS1
How an assistant proposes to learn. ADAPT derives a proposed change from saved evidence and hands it to the person. Nothing is learned until a person accepts the proposal.
Saved traffic-calibration proposalpropose traffic-kernel parameters from exact retained fields for a separate acceptance decisionMCP: ADAPT.kernel_calibration
Measured-flow traffic calibration proposalfit travel-time parameters for a completed traffic run to bound flow readings, applying nothingMCP: ADAPT.traffic_calibration
Proposal acceptance statusread whether the person accepted, rejected or used an acceptance requestMCP: ADAPT.acceptance_status
Belief-revision proposala proposed change to a value, derived from one exact piece of saved evidence, for the person to accept or notMCP: ADAPT.reconcile
Model recalibration proposala proposed change to a model’s parameters based on observations, for the person to accept or notMCP: ADAPT.kernel_calibration
Saved evidence-value proposalpropose one exact saved evidence value without changing canonical stateMCP: ADAPT.propose_value
Bound observation reconciliationreconcile bound observations with a bound prior and return the result without applying a changeMCP: ADAPT.reconcile
Request acceptance of a proposalask the person to accept one exact proposal in the browser; acceptance authorizes one separately approved scenario and changes no gradeMCP: ADAPT.request_acceptance
Reconciliation calculationcalculate the requested strategy over observations already resolved from committed evidenceMCP: ADAPT.reconcile
A proposal applies no change and does not estimate its own relevance. The person’s acceptance is a separate, recorded act.
Everything else the assistant can do
Besides the ten operation tools, the assistant uses lookup tools on the agent endpoint and control tools on the control endpoint for the work around them: finding operations and contracts, reading saved simulations, worlds and data, preparing proposals and saving records.
control_read (read the person's data, the data catalog and simulation knowledge): 22 operations
control_propose (prepare material for the person to review in the browser): 15 operations
control_write (save records the person owns): 29 operations
Every operation declares an effect, and the permissions it needs, rather than a claim ceiling. The full reference below gives each one.
Built on the software development kit
The software development kit (SDK) is the platform's own code for the ten kinds of reasoning. The MCP tools run that same code, so an assistant and a developer get the same calculation. What differs is the checks on who is asking and what they have approved.
75 SDK functions are reached by an MCP operation of their own, named beside each method in the cards above. The other 32 are reached through related operations: adapt.propose, through ADAPT.reconcile; adapt.propose_kernel_calibration, through ADAPT.kernel_calibration; adapt.resolve_bound_observations, through ADAPT.reconcile; adapt.run_reconciliation, through ADAPT.reconcile; check.density, through CHECK.density; check.field, through CHECK.field; check.flow, through CHECK.flow; check.resolve_location, through CHECK.location; choose.search, through CHOOSE.search; compare.compute_compare_content_digest, through COMPARE.checksum; compare.compute_compare_run_fingerprint, through COMPARE.checksum; compare.pareto, through COMPARE.pareto; compare.scenarios, through COMPARE.receipts; compare.states, through COMPARE.receipts; explain.attribute, through EXPLAIN.attribute; explore.run, through EXPLORE.start; gauge.assess, through GAUGE.assess; gauge.validate, through GAUGE.calibrate; imagine.create, through scenarios.propose_variant, scenarios.generate, EXPLORE.start, runs.propose_continuation; imagine.emit_evidence, whose evidence the platform records with every result and resolve.reference reads; imagine.get_namespace, through resolve.reference; monitor.cancel, through MONITOR.cancel_watch; monitor.context, through MONITOR.context; monitor.drift, through MONITOR.drift; monitor.events, through MONITOR.events; monitor.list_active, through MONITOR.list; monitor.state, through MONITOR.watch_state; monitor.threshold, through MONITOR.propose_watch; monitor.trend, through MONITOR.trend; seek.flows, through SEEK.flows; seek.reach, through SEEK.reach; seek.route, through SEEK.route.
The SDK is broader than the assistant's surface. Developers can build on all of it; an assistant reaches the platform only through MCP.
What every result carries
Each result keeps the inputs, the method and the sources it came from, and states how strong a claim it supports. A simulation result holds under its stated conditions. It is not a measurement of the real world.
Optional Perspectives record what a person cares about and read a result that way, without changing it.
When the service cannot support a claim, it refuses, says why, and suggests what to do instead.
Full reference
Every operation of the MCP service, read from its registered contracts: 107 on the agent endpoint and 69 on the control endpoint. Each row gives the operation, what it does, the permission it needs and the first limit its contract states.
Agent endpoint
CHECK (measure conditions)
Each operation saves a result, world, setup or run that the person owns. Strongest claim: OBS:CS1.
Operation
What it does
Permission
Main limit
CHECK.density
Counts per area, road length or storage in places of a bound table or a completed run.
read and simulate
table: the table's own place labels only, as bound; values are the owner's, their accuracy, method and representativeness not established.
CHECK.ensemble
Read a completed ensemble of one stock-and-flow model: its stated input distributions, its members by outcome, the spread of its outputs and a page of its members.
read and simulate
The spread describes the model's members under the stated distributions and carries no claim.
CHECK.field
One field's values for rows of a saved source.
read and simulate
Owner-supplied values; their accuracy, method and representativeness are not established.
CHECK.flow
Vector length and bearing for rows of a saved source.
read and simulate
Owner-supplied values; their accuracy, method and representativeness are not established.
CHECK.kernel_output
Read exact saved source values, categories, units and assumptions of one registered pure kernel result in bounded sections, preserving conditional or unqualified standing.
read and simulate
OBS/CS0 warrants fidelity to retained source values only; original conditional standing or unqualified no-claim causes are copied separately and never promoted.
CHECK.measurements
Read declared measurements from one selected completed simulation run.
read and simulate
At most ten scalar measurements; intact exploratory numbers carry no claim, and qualified numbers remain conditional on the exact model.
CHECK.mobility_feedback
Read exact saved ordered mobility iterations, measured trip times, skim updates and protected child identities in bounded sections.
read and simulate
OBS/CS0 warrants fidelity to retained source values only; original conditional standing is copied separately and never promoted.
CHECK.model_perspective_reading
Interpret one exact protected model observation through an existing adopted and signed model-bound Perspective.
read and simulate
At most twelve criteria. Perspective interpretation establishes no model review, numerical accuracy, empirical prediction or run governance.
CHECK.perspective_reading
Apply the criteria of one existing Perspective the person can read to one saved measurement result.
read and simulate
At most twelve criteria; a missing measurement is not evaluated, not violated.
CHECK.self_tests
Read the self-tests of one completed stock-and-flow run: each declared case's overrides beside the main run's values, its outcome, the platform's checks and its authored expectations.
read and simulate
Self-test cases prepare a model's review; they give the model no review standing and carry no claim.
CHECK.sweep
Read a completed sweep of one stock-and-flow model: its declared points, the points by outcome, each output's smallest and largest values with the points tied with them, counts against a stated threshold, and a page of point rows.
read and simulate
Describes a sweep's stated points of this model: their outcomes, each output's smallest and largest values and how many points meet a threshold. It carries no claim.
CHECK.trajectory
Read actual retained samples from one protected output of a completed simulation run.
read and simulate
Reads a run's retained series as the model computed them, keeping the run's own standing; it adds no claim.
SEEK (trace movement and change across time and space)
Each operation saves a result, world, setup or run that the person owns. Strongest claim: OBS:CS1.
Operation
What it does
Permission
Main limit
SEEK.flows
Total a saved origin-destination table of your own by pair.
read and simulate
At most 20 labels in each role; the file states no geometry, so selection is by exact label.
SEEK.reach
Save which network nodes one place in your built world reaches within travel-time budgets.
read and simulate
Reads only the caller's own world built with worlds.create; the network is read again and must match its saved source.
SEEK.recompute
Recompute complete route or reach detail from the original exact saved network.
read, write and simulate
The original warrant stays immutable; the replacement keeps the declared-network ceiling.
SEEK.route
Save the quickest or shortest routes between two places in one of your built worlds.
read and simulate
Reads only the caller's own world built with worlds.create; the network is read again and must match its saved source.
SEEK.timeline
Track one declared measurement across selected completed runs in completion order.
read and simulate
Durable UTC run completion order establishes no regular sampling cadence or causal trend; any selected no-claim source keeps the whole sequence no-claim.
MONITOR (follow what is happening)
Each operation reads state and changes nothing. Strongest claim: OBS:CS1.
Operation
What it does
Permission
Main limit
MONITOR.context
Read the declared conditions and limits for one watch owned by the person's account.
read
The result excludes the webhook destination and unrestricted raw simulation state.
MONITOR.drift
Detect whether exact retained model errors have shifted since a saved GAUGE.calibrate result made with the validation-active method.
read
CUSUM and ADWIN identify statistical change; they do not identify a cause or apply recalibration.
MONITOR.events
Read a bounded page of retained trigger events for one watch.
read
The cursor is a position in this watch's retained trigger sequence.
MONITOR.general_status
Read an authored model run's current state, original incomplete cause and actual work, with exact diagnostic sections, and whether its progress counts the points of a sweep or the members of an ensemble.
read
An incomplete or interrupted run produces no successful numerical origin, trajectory or receipt.
MONITOR.list
List the active durable watches owned by the person's account without evaluating them.
read
Only active watches owned by the person's account are listed.
MONITOR.live_run
Read one verified captured tick, the selected vehicle with its departure, route changes and arrival, counts across every followed vehicle including those trapped by deep water, and the flood's road states, with on request the flood's roads by id and end points, from an owned running run, or from a failed run's retained frames for diagnosis.
read and simulate
The captured tick does not report engine progress between frames.
MONITOR.presentation_pace
Read the requested browser playback speed for an owned running watched capture.
read and simulate
Browser frame acknowledgments, physical dt, approval and scientific results are unchanged.
MONITOR.status
Read the current state of one explicitly named simulation run.
read
This status read does not create a standing watch or stream per-tick state.
MONITOR.trend
Fit a linear trend over one field of a current bound observation source.
read
The result is a linear association over one declared field and does not establish causation or predictive accuracy.
MONITOR.watch_state
Read the durable evaluation state of one watch owned by the person's account.
read
The result contains watch state, not unrestricted raw simulation state.
IMAGINE (read results under the conditions that produced them)
Each operation saves a result, world, setup or run that the person owns. Strongest claim: INT:CS2.
Operation
What it does
Permission
Main limit
IMAGINE.conditional
Form a conditional reading from one selected completed simulation comparison.
read and simulate
This operation neither proposes nor generates a scenario and never starts a run.
EXPLORE (run approved simulations)
Each operation saves a result, world, setup or run that the person owns. Strongest claim: INT:CS2.
Operation
What it does
Permission
Main limit
EXPLORE.cancel_run
Cancel an owned queued or running simulation without changing its approval or results.
read and simulate
Cancellation creates no scientific evidence or receipt.
EXPLORE.resume_run
Resume this person's unfinished simulation using current credentials and its original approval.
read and simulate
A live attempt is not replaced. Original deadlines and allocated compute are never reset.
EXPLORE.set_presentation_pace
Request browser playback speed for an owned running watched capture.
read and simulate
Browser frame acknowledgments, physical dt, approval and scientific results are unchanged.
EXPLORE.start
Reserve an approved scenario for durable execution; return its run reference and browser address when linked.
simulate
A run starts only from the worlds built with worlds.create that the approved proposal names, or from none, and records which it used; no other world can be selected.
COMPARE (put results side by side)
Each operation saves a result, world, setup or run that the person owns. Strongest claim: RSN:CS3.
Operation
What it does
Permission
Main limit
COMPARE.joint_receipts
Compare exact outputs under a complete declared intervention across one or several simulation nodes.
read and simulate
The contrast establishes no individual attribution, empirical causality, preference or predictive accuracy.
COMPARE.pareto
Identify non-dominated completed runs from exact retained scalar fields.
read and simulate
Pareto membership does not establish causation, preference, significance, or predictive accuracy.
COMPARE.receipts
Compare selected outputs when retained records establish a controlled simulation contrast.
read and simulate
At most ten scalar metrics may be compared in one call.
COMPARE.sweep_points
Compare two points of one completed stock-and-flow sweep: the inputs whose values differ and each selected output at both points.
read and simulate
Compares two points of one sweep of this model; a difference within the two points' own numerical differences is not resolved, and the comparison carries no claim.
EXPLAIN (look at causes)
Each operation saves a result, world, setup or run that the person owns. Strongest claim: RSN:CS3.
Operation
What it does
Permission
Main limit
EXPLAIN.attribute
Describe one exact metric difference from a retained qualified comparison.
read and simulate
Descriptive attribution does not establish a causal effect, mechanism, or factor contribution.
EXPLAIN.coalition
Allocate a retained model-output change across a complete set of coalition evaluations.
read and simulate
The allocation decomposes model output; it does not establish causal contribution, feature independence or external validity.
EXPLAIN.controlled_effect
Estimate one conditional effect inside a registered deterministic model from a controlled comparison.
read and simulate
The result establishes a conditional registered-model effect, not model truth or empirical real-world causality.
EXPLAIN.hybrid
Pool compatible qualified controlled-model and observational effects with an explicit weight and dependence declaration.
read and simulate
No combined interval or added precision is claimed without qualified uncertainty for both sources.
EXPLAIN.joint_controlled_effect
Estimate the combined conditional model effect of every changed control in a compared intervention.
read and simulate
Joint effect establishes no individual control attribution, empirical causality, external validity or statistical uncertainty.
EXPLAIN.loop_dominance
Find which feedback loops drive a completed stock-and-flow run's behaviour, and when, from its stored values.
read and simulate
No claim: loop scores describe how the model's own feedback structure produced its computed behaviour, not causes in a place, and the reading changes no grade.
EXPLAIN.observational_effect
Estimate a stratified treatment contrast from aligned retained observation rows under declared graph assumptions.
read and simulate
Graph truth, source accuracy, absence of unmeasured confounding and external validity are not established.
EXPLAIN.structure
Check whether a stated cause map contains enough information to analyze one simulated difference.
read and simulate
Structural identification does not establish graph truth or estimate a causal effect.
GAUGE (measure uncertainty)
Each operation saves a result, world, setup or run that the person owns. Strongest claim: RSN:CS3.
Operation
What it does
Permission
Main limit
GAUGE.assess
Calculate typed mean confidence, count-rate confidence, or descriptive ensemble intervals from qualified sources.
read and simulate
Available methods are bootstrap, block bootstrap, parametric interval and Monte Carlo ensemble.
GAUGE.calibrate
Compare exact retained simulation predictions with exact retained observations.
read and simulate
Independence, representativeness, future predictive coverage and causal effect are not established.
GAUGE.field
Calculate place-aligned spatial or observational uncertainty from retained CHECK.field results.
read and simulate
Geometry, spatial independence, representativeness and calibrated coverage are not established.
GAUGE.paired_delta
Calculate a paired-delta interval from ten explicit retained comparisons.
read and simulate
Pair matching, independence, causal effect, and calibrated coverage are not established.
GAUGE.pass_through
Preserve one qualified controlled-model effect without adding evidence or uncertainty.
read and simulate
The operation adds no statistical uncertainty, empirical causality, model truth, or external validity.
GAUGE.recompute
Recompute a saved uncertainty result with its exact retained sources and current methods.
read, simulate and write
Missing historical seeds or unqualified count exposure cannot be guessed.
GAUGE.response
Describe how one output spans a varied execution parameter (central ranges) or fit its linear sensitivity across selected runs, or read an authored stock-and-flow sweep: one output's steps along one input, or a Morris design's elementary effects.
read and simulate
Response analysis does not establish causality, external validity, or calibrated coverage.
GAUGE.simulation_support
Assess declared methodology and compatible input combinations for one exact simulation method and intended use.
read and simulate
Conditional rule satisfaction does not establish predictive accuracy or empirical validation.
GAUGE.spread
Describe how one measurement varies across selected completed runs, or how one output of an authored stock-and-flow ensemble varies across its members.
read and simulate
Descriptive spread is not predictive uncertainty or a confidence interval.
CHOOSE (pick among options against goals the person states)
Each operation saves a result, world, setup or run that the person owns. Strongest claim: ACT:CS4.
Operation
What it does
Permission
Main limit
CHOOSE.approved_perspective
Choose among verified candidates using the person's separately approved signed priorities.
read and simulate
Value preferences change utility and selection, never physical measurements or scientific evidence ceilings.
CHOOSE.criteria_search
Search approved candidates using independent measured objectives, hard requirements and soft preferences.
read and simulate
Results are conditional on the approved finite domain and registered model; preferences establish no empirical truth.
CHOOSE.rank
Rank two compared registered-model outcomes using a matching qualified controlled effect and explicit priorities expressed as criteria.
read and simulate
The result ranks only two submitted candidates and does not establish empirical causality or human preference.
CHOOSE.search
Apply a named bounded search method to executed variants in one approved finite sweep using exact qualified model effects.
read and simulate
A partial result reports only the candidates consumed by the exact attempt budget.
CHOOSE.start_search
Search retained candidates or run prospective candidates under the person’s exact approved search permission.
read and simulate
Ranks only a sealed set of already approved candidates, or runs new candidates only within the limits the person approved in the browser; no submitted plan can change those limits.
CHOOSE.verify_choice_set
Verify approved candidate measurements and retain exact criteria for a person's value decision.
read and simulate
Verification selects no recommendation, promotes no scientific evidence and grants no permission to apply a Perspective.
CHOOSE.verify_retained_choice_set
Prepare a sealed candidate domain for the person's signed Perspective priorities.
read and simulate
Verification selects no winner, promotes no evidence and grants no Perspective or execution permission.
ADAPT (propose updates from evidence)
Each operation saves a result, world, setup or run that the person owns. Strongest claim: LRN:CS3.
Operation
What it does
Permission
Main limit
ADAPT.kernel_calibration
Fit a traffic kernel's BPR parameters from exact fields of retained evidence.
read and simulate
Only the traffic-flow BPR alpha and beta calibration method is supported.
ADAPT.propose_value
Propose a target value copied from one exact field of saved evidence.
read and simulate
The proposal does not apply a change or estimate relevance or posterior uncertainty.
ADAPT.reconcile
Combine bound observations, and an optional prior, into one proposed value and its spread.
read and simulate
At most five observations, all in one declared unit, each uncertainty a standard deviation greater than zero.
ADAPT.traffic_calibration
Fit measured-flow BPR parameters for an actual completed traffic run.
read and simulate
A regularized fit is conditional on its bound data and does not establish empirical validity.
resolve (look things up)
Each operation looks something up and changes nothing.
Operation
What it does
Permission
Main limit
CHECK.location
Return every provider candidate for place text without selecting one.
read
The result reports provider candidates; it does not establish a selected place or real-world accuracy.
COMPARE.checksum
Compute bounded SHA-256 checksums of supplied JSON with the COMPARE identity functions.
read
Nothing is read, executed or published; the named tool is never run.
policies.inspect_prepared
Inspect the exact retained contribution and withdrawal events of an owned prepared road policy, in bounded pages; this applies nothing.
read
This slice supports ordinary access denial on known at-grade edges only; unsupported modes and actions refuse.
policies.read
Read actual retained ordinary-road policy applications, overlapping denials, withdrawals and aligned model/policy annotations at an exact simulation second.
read
This slice supports ordinary access denial on known at-grade edges only; unsupported modes and actions refuse.
resolve.candidate_set
Inspect whole retained candidate membership and its qualified source references in bounded sections.
read
These are verified input identities and decision criteria, not a recommendation or permission to apply a Perspective. Read qualified measurement references for their scientific warrants.
resolve.candidate_uncertainty_design
Inspect exact approved repeats or finite variations before binding uncertainty to a candidate.
read and simulate
A design grants no approval, independence or empirical coverage.
resolve.capability_gates
Read the capability gates a Perspective requires before a step, each with any draft and grant in this simulation.
read
Only the simulation's owner grants a gate, in the browser at the review address. A grant changes no grade, claim ceiling or capability.
resolve.choice_set
Inspect the exact candidates and criteria in a verified decision input.
read
These are verified input identities and decision criteria, not a recommendation or permission to apply a Perspective. Read qualified measurement references for their scientific warrants.
resolve.criteria
Inspect exact retained decision criteria in bounded sections.
read
These are verified input identities and decision criteria, not a recommendation or permission to apply a Perspective. Read qualified measurement references for their scientific warrants.
resolve.operation_help
Read an operation's usage, exact inputs, permissions, limits and example; the full level of detail adds the complete contract.
read
Operation availability does not establish model fitness or data availability.
resolve.operations
Find operations using a few purpose keywords or an exact ID; omit query to enumerate.
read
Operation availability does not establish model fitness or data availability.
resolve.perspective
Inspect one perspective's identity before proposing its next action; its author also sees any pending deliberation and recorded decisions.
read
A perspective's priorities grant no scientific strength or permission to apply it.
resolve.perspective_use
Read the exact current browser-approved perspective and decision scope for CHOOSE.
read
A perspective's priorities grant no scientific strength or permission to apply it.
resolve.reference
Read an authorized saved reference as a concise summary or bounded exact section.
read
This operation does not read worlds; a world reference is refused, and the refusal names session as the tool to use instead.
resolve.result_page
Read complete retained route edges, coordinates or reachable nodes in bounded pages.
read
The page carries the original root's warrant and current validity, never a new claim.
resolve.schema_section
Read an exact schema section and follow its pages to assemble the complete schema.
read
Operation availability does not establish model fitness or data availability.
capabilities (what the platform can compute)
Each operation reads state and changes nothing.
Operation
What it does
Permission
Main limit
capabilities.contract
Read one registered capability's contract, including the input and config schemas a scenario proposal's invocation is checked against.
read
For phenomenon fit, input combinations and intended-use limits, consult the optional simulation_knowledge.read_method and GAUGE.simulation_support.
capabilities.panel
Read one capability contract's kernel panel: the rows a person sees in the browser, their standing and words, and the readouts.
read
A value too large for a page is returned as an exact path to request next. Assign object entries by key, append array entries and string segments in page order, and follow every cursor.
capabilities.summary
List registered computational contracts without loading their full schemas, or search them by the person's words or a kernel domain.
read
Availability covers this deployment's runners and native extension, not the data a particular run needs.
scenarios.authoring_catalog
Read exact authoring methods, their real components, configuration schemas and supported connections.
read
Catalog membership does not establish input readiness or authorize a run.
scenarios.input_mapping_source
Read exact owned percolation graph node/edge identities and selected removals before declaring a surviving-load mapping overlay.
read
Only typed graph identities, selected removal IDs and source digests are exposed; no raw artifact or execution call.
scenarios.prepare_general_model
Prepare an authored model's exact inputs, units, outputs and proposed numerical comparison allowances before proposing its setup.
read
Preparation runs no simulation and grants no approval, scientific standing or numerical success.
scenarios.prepare_input_mapping
Prepare source-bound crowd sound power, crowd queue arrivals, tracked traffic trips' arrivals at a facility node, or induced surviving percolation topology with explicit load declarations, for an ordinary downstream proposal.
read
One-way staged composition, without dynamic feedback or inferred calibration.
session (pick up where things stopped)
Each operation reads state and changes nothing.
Operation
What it does
Permission
Main limit
notifications.list
List this person's notifications, newest first: what other people did that concerns them, and how many are unread.
read
Lists the same newest notifications, at most fifty, as the person's notification area in the browser.
session.candidate_set
Inspect a retained candidate draft or sealed union using bounded group summaries.
read
A draft is unverified preparation. Sealing verifies whole independently approved sweeps and grants no new execution authority.
session.diagnostic_replay
Read the private replay address and verified failed-capture identities, without a completed result or terminal-state claim.
read
Unpublished diagnostic evidence is not a completed run or governed receipt.
session.perspective_proposal
Read whether the person has adopted a prepared perspective and its resulting Perspective.
read
A proposal grants no authorship, publication or permission to apply values. The person acts at the review address in their browser.
session.perspectives
Find saved perspectives and their current source/lifecycle identities.
read
A perspective's priorities grant no scientific strength or permission to apply it.
session.recoverable_runs
Find this person's unfinished or stopped runs and the next action after reconnecting.
read
Admission dates are bounded by the first-page cutoff; each page samples current states. ETA stays unknown.
session.resume
Retrieve one saved run's state, references and browser address when linked.
read
This mode reads one saved run; it does not restart execution or continue a world from a run's final state.
session.search
Read search progress, exact accounting, termination and its qualified result reference.
read
Reads only the person's own searches; the status reports progress counts and a result reference, not candidate measurements.
session.search_plan
Read whether a bounded adaptive search plan is pending, approved, expired or revoked.
read
Preparation grants no execution permission. A person approves exact domains and finite budgets in their browser.
session.searches
Find saved searches after reconnecting and resume their exact result or remaining work.
read
Lists only the person's own searches in one simulation that is not in the trash, at most ten a page.
session.simulation
Resume one explicitly named private simulation: where it stands, what the person must do, and the latest references.
read
The service never selects a current or latest simulation implicitly.
session.simulations
List this person's simulations, active or in the trash, most recently changed first, one page at a time.
read
Lists only the person's own simulations; the service never selects a current or default one.
session.workbench
Read selected displayed workbench information and changes since a revision.
read
Untrusted interface context, never scientific evidence. Read canonical sources before claims.
session.workbench_spatial
Resolve visible screen features, selections or bottom-left flood candidates.
read
Untrusted interface context, never scientific evidence. Read canonical sources before claims.
session.workbenches
Find this person's actively shared workbench tabs.
read
Untrusted interface context, never scientific evidence. Read canonical sources before claims.
session.world
Inspect one world this person built: its setup, data sources and the runs that started from it.
read
A world another person built, a world in another account and a world that does not exist give the same not-found refusal.
session.worlds
List the worlds this person has built, newest first, one page at a time.
read
Lists only the worlds the person built with worlds.create in this account; worlds other people built are not listed.
shared.list
List the simulations other people shared with this person and the person accepted, newest acceptance first.
read
Lists only shares the authenticated person accepted and that were not revoked, and leaves out a share whose simulation is in the owner's trash.
shared.read
Read one shared simulation's question, named runs and graded results, cited setup versions and current setups, record events, and named comparisons.
read
A revoked share, a share another person holds, a share whose simulation is in the owner's trash and a share that does not exist give the same not-found refusal.
worlds.authoring_context
Read a saved world's starting tick, seconds per tick and network identity before authoring timed actors.
read
Authored departure ticks are absolute: the starting tick plus the elapsed seconds divided by the seconds per tick.
Control endpoint
control_resolve (look up control operations)
Each operation looks something up and changes nothing.
Operation
What it does
Permission
Main limit
control_resolve.operation_help
Read an operation's usage, exact inputs, permissions, limits and example; the full level of detail adds the complete contract.
read
Operation availability does not establish model fitness or data availability.
control_resolve.operations
Find operations using a few purpose keywords or an exact ID; omit query to enumerate.
read
Operation availability does not establish model fitness or data availability.
control_resolve.schema_section
Read an exact schema section and follow its pages to assemble the complete schema.
read
Operation availability does not establish model fitness or data availability.
control_read (read the person's data, the data catalog and simulation knowledge)
Each operation reads state and changes nothing.
Operation
What it does
Permission
Main limit
ADAPT.acceptance_status
Read whether the person accepted, rejected or used one ADAPT acceptance request, or let it expire.
read
Acceptance is authorization, never warrant: it changes no grade, claim strength or other evidence label, and the scenario's claim ceiling stays CS0.
catalog.kernel_links
Show which catalog sources can supply each kernel input or check each validation domain in a place.
read
A plain read of pointers the deployment publishes; it carries no grade and makes no claim about the data.
catalog.places
List the places the deployment's catalog covers and its vocabulary of quantities.
read
A plain read of pointers the deployment publishes; it carries no grade and makes no claim about the data.
catalog.prepared_places
List the places this deployment has prepared data files for, and whether each file is on disk.
read
Prepared files are not a judgement of whether a kernel can answer a question.
catalog.read_entry
Read one catalog entry: its downloads, terms, columns and known quirks.
read
A plain read of pointers the deployment publishes; it carries no grade and makes no claim about the data.
catalog.search
Search the deployment's catalog of data sources by words, place, point or quantity.
read
A plain read of pointers the deployment publishes; it carries no grade and makes no claim about the data.
datasets.inspect_source
Inspect source files the person already supplied to their account.
read
Only the authenticated account owner can read these files.
datasets.list_sources
Find private account dataset references and kinds without returning samples.
read
Only the authenticated account owner can read these files.
datasets.read_request
Read how far one of the person's requests to add data has come.
read
A request is pending until the person decides it in the browser.
datasets.read_source
Verify and inspect the original files of one exact private source version.
read
Only the authenticated account owner can read these files.
datasets.read_source_metadata
Read a bounded page of exact source layers, fields, raster bands, or table columns.
read
Only the authenticated account owner can read these files.
datasets.version_correction_status
Read whether the person approved or declined one version correction, its record, and which of the caller's published validations it excludes.
read
Only the account that owns the dataset can withdraw or correct one of its exact versions; the person approves it in the browser.
place_profiles.read
Read a place profile's identity, coverage and catalog links.
read
Profiles and source pointers are operational metadata and confer no scientific evidence grade.
place_profiles.search
Find a durable place profile by name or alias.
read
Profiles and source pointers are operational metadata and confer no scientific evidence grade.
place_profiles.search_catalog
Search a place profile's explicitly associated catalogs.
read
Profiles and source pointers are operational metadata and confer no scientific evidence grade.
simulation_knowledge.read_assertion
Read an attributed scientific relationship with its retained qualifications.
read
Declarations and attributed research do not establish inspected data or predictive validity.
simulation_knowledge.read_assessment
Read a bounded section of retained source facts, rules or evaluations with their original warrant.
read
Changed or revoked private dependencies require a new assessment.
simulation_knowledge.read_method
Read one exact method's qualified knowledge and candidate inputs.
read
Declarations and attributed research do not establish inspected data or predictive validity.
simulation_knowledge.read_recipe
Read sourced input combinations for an exact method and use.
read
Declarations and attributed research do not establish inspected data or predictive validity.
simulation_knowledge.search
Browse exact methods and visible research gaps for a city or phenomenon.
read
Declarations and attributed research do not establish inspected data or predictive validity.
workbenches.read
Read the current or exact saved private workbench without creating a simulation.
read
A map layer is display data, not a calibrated simulation or epistemic result.
worlds.starting_states
List this person's own starting worlds, saved from completed runs or imported, and any authorized trusted starting-state assets.
read
Only the authenticated person's own starting worlds are listed; no other person's world is read.
control_propose (prepare material for the person to review in the browser)
Each operation records material that waits for the person's review in the browser.
Operation
What it does
Permission
Main limit
ADAPT.request_acceptance
Ask the person to accept one exact ADAPT reconciliation proposal so that it may seed one scenario.
read, write and simulate
Acceptance is authorization, never warrant: it changes no grade, claim strength or other evidence label, and the scenario's claim ceiling stays CS0.
GAUGE.request_validation
Request one governed comparison of a run prediction with a later reading from a bound observation source.
read, write and simulate
No observation value, unit, time, source label, independence fact, classification or weight is accepted; the server resolves them from bound source, capability and share records.
MONITOR.propose_watch
Publish one inactive durable-watch specification for explicit activation.
write
The proposal remains inactive until MONITOR.activate_watch succeeds.
catalog.request_import
Ask the person to add a catalog source to their account, from one of its listed downloads.
write
This operation does not approve or fetch anything; the person decides at the review address.
datasets.request_import
Ask the person to add a dataset whose files are at web addresses to their account.
write
This operation does not approve or fetch anything; the person decides at the review address.
datasets.request_terrain
Ask the person to add terrain for an area, from a source this deployment declares.
write
This operation does not approve or fetch anything; the person decides at the review address.
datasets.request_version_correction
Ask the person to record that one exact version of their dataset is withdrawn, or corrected by another version owned by their account.
read, write and simulate
Only the account that owns the dataset can withdraw or correct one of its exact versions; the person approves it in the browser.
perspectives.propose_gate_grant
Prepare draft reasons for one capability gate, for the simulation's owner to read before deciding in the browser.
write
Only the simulation's owner grants a gate, in the browser at the review address. A grant changes no grade, claim ceiling or capability.
runs.propose_continuation
Propose continuing a completed native run from its end state or a retained checkpoint, for the person's browser review.
write
The source run is never changed; each continuation needs its own browser approval.
scenarios.create_lineage
Start an independent scenario proposal edit sequence.
write
A proposal lineage does not approve, generate or run a scenario.
scenarios.propose
Store typed scenario material for a person's browser review.
write
This operation does not approve, generate or run the scenario.
scenarios.propose_variant
Propose a child of an approved scenario with exact typed changes for the person's browser review.
write
The parent is never changed; the child needs its own browser approval, generation and run.
scenarios.revise_setup
Add, remove and configure exact executable methods or optional session components in a reviewed setup.
write
This saves a revised setup. It does not approve or execute it.
simulations.propose_deletion
Propose permanently deleting everything in the person's trash, or one trashed simulation, for the person to confirm in the browser.
write
Nothing is deleted over MCP. The person confirms in the browser at the review address, which shows what deleting removes at that moment, and only that is deleted.
sweeps.propose
Propose a bounded sweep of an approved scenario: every variant's explicit values and the run count, for one browser approval.
write
At most 10 variants, one run each: the most runs SEEK.timeline and GAUGE.spread can each read in one call.
control_write (save records the person owns)
Each operation saves a result, world, setup or run that the person owns.
Operation
What it does
Permission
Main limit
GAUGE.publish_validation
Return the governed comparison already published by the person's approval, or reconcile the same publication on retry.
read, write and simulate
Empirical reliability describes agreement with past observations of one exact model implementation and quantity kind in one geography; it does not transfer to other models and does not change a result's grade or claim strength.
MONITOR.activate_watch
Activate one exact durable-watch proposal owned by the person's account.
write
Activation refuses when the retained state source is unavailable.
MONITOR.cancel_watch
Cancel one durable watch owned by the person's account and stop later evaluation.
write
Cancellation does not retract notifications already delivered.
candidate_sets.append
Append one bounded whole-sweep page to an owned retained candidate draft.
read, write and simulate
A draft is unverified preparation. Sealing verifies whole independently approved sweeps and grants no new execution authority.
candidate_sets.create
Prepare a retained candidate domain from declared whole approved sweeps.
read, write and simulate
A draft is unverified preparation. Sealing verifies whole independently approved sweeps and grants no new execution authority.
candidate_sets.seal
Verify every declared candidate and freeze the exact whole-sweep union.
read, write and simulate
A draft is unverified preparation. Sealing verifies whole independently approved sweeps and grants no new execution authority.
datasets.prepare_thermal_source
Prepare one exact thermal document from an owned original JSON source, validating required companion documents.
write
Preparation does not approve or execute a simulation and grants no scientific fitness or claim ceiling.
perspectives.propose
Prepare a person's perspective or lifecycle change for their browser review.
write
A proposal grants no authorship, publication or permission to apply values. The person acts at the review address in their browser.
perspectives.propose_observation_source
Prepare exact pre-run observation bindings and governing values for browser adoption and source signing. The person prepares the adopted signed source in their browser before optional model readings or publication. Preparation does not scientifically review the model or authorize execution.
write
A proposal grants no authorship, publication or permission to apply values. The person acts at the review address in their browser.
policies.prepare_road_access
Prepare proposed ordinary-road access rules and timed withdrawals from an owned water result for normal browser-approved execution.
write and read
This slice supports ordinary access denial on known at-grade edges only; unsupported modes and actions refuse.
scenarios.authorize_execution
Record the agent authorization and persist the manifest under one exact operator-issued execution permission; performs zero solves.
simulate
The returned fixed EXPLORE.start request is the only permitted logical run.
scenarios.generate
Generate an executable manifest from the person's approved proposal.
write
Generation creates a manifest but does not start a simulation run.
scenarios.model_draft
Retain an exact private model draft and supplied choices, with mechanical findings and unresolved execution gaps.
simulate
A draft is unapproved and unexecuted; static admission supplies no scientific review.
search_plans.propose
Prepare a bounded search across approved settings. Choose variety to keep options varied, robust ranking to favor settings that hold up across the exact repeat seeds the person approves in their browser, or name the person's published Perspective so its priorities rank the results.
read, write and simulate
Preparation grants no execution permission. A person approves exact domains and finite budgets in their browser.
searches.cancel
Cancel an owned search and immediately prevent later result publication.
read and simulate
Cancellation is final: a cancelled search cannot be resumed, and any runs it started are cancelled.
searches.pause
Pause an owned search and immediately stop its running evaluation from saving further results.
read and simulate
Pausing keeps the original deadline; a search whose deadline passes while it is paused cannot be resumed.
searches.resume
Resume a paused search using its original deadline and charged evaluations.
read and simulate
Only a paused search can be resumed, and only before its original deadline passes.
simulations.create
Create a private simulation from a title and the person's concern.
write
Creation does not propose a scenario or start a simulation.
simulations.lifecycle
Move a private simulation to recoverable trash or restore it.
write
This operation never permanently deletes a record.
sources.bind
Bind a person's marked table for density, field or flow readings; a flow declaration binds an origin-destination table for SEEK.flows.
read and simulate
Units and column meanings are the binding request's statements.
workbenches.attach
Add an exact account road-network version to the saved map before a simulation runs.
write
A map layer is display data, not a calibrated simulation or epistemic result.
workbenches.link
Link a saved workbench to an existing owned active simulation without creating setup or runs.
write
A map layer is display data, not a calibrated simulation or epistemic result.
workbenches.remove
Remove a map layer while preserving the original account dataset and every simulation.
write
A map layer is display data, not a calibrated simulation or epistemic result.
workbenches.set_visibility
Save a map layer's display visibility without changing simulation physics.
write
A map layer is display data, not a calibrated simulation or epistemic result.
worlds.create
Create unadvanced road-network state from explicit data for a later scenario proposal.
write
The optional simulation_knowledge.search and GAUGE.simulation_support can help with method choice and input adequacy; missing knowledge entries imply nothing about feasibility.
worlds.create_from_place
Create unadvanced road-network state for one explicitly named place.
write
Network preparation uses OpenStreetMap and can refuse when the selected place or service is unavailable.
worlds.prepare_population
Prepare individual vehicles from an owned modeled journey source, retaining its weights, clock, mapping and provenance.
write
This does not approve or execute a simulation; propose the returned population dataset through the normal run workflow.
worlds.prepare_traffic_scenario
Prepare a declared matched traffic scenario from the person's exact managed inputs for current durable runs.
write
For method choice, missing inputs and intended-use limits, consult the optional simulation_knowledge.search and GAUGE.simulation_support.
worlds.save_from_run
Save verified state from a completed run as a reusable starting world.
write
Only completed native scenario invocations can be saved; a running run cannot be captured.
No operation has the destructive effect: control_destructive has no operations.
Shared rules and limits
Rule
Detail
Transport
HTTP POST to /mcp for both endpoints, or to /mcp/agent or /mcp/control, with JSON responses; or standard input and output with one bounded JSON message per line.
Identity
An API key resolves to the account, the person and their current permissions (read, simulate, write). Tool arguments never carry identity.
Effects
resolve: looks something up and changes nothing; read: reads state and changes nothing; propose: records material that waits for the person's review in the browser; write: saves a result, world, setup or run that the person owns; destructive: permanently removes records.
Retries
Operations that save something take a retry key; an identical retry returns the original result.
Paging
Signed cursors bound to the person, the query and the catalog.
Refusals
A code, an explanation, a safe diagnostic and at most three suggestions. A refusal can name the tool that can take the request instead; following it is a new call with its own permission.
Size limits
One tool definition 8,192 bytes; agent catalog 40,000; control catalog 12,000; combined catalog 52,000; service instructions 2,048; one response 16,384; one request 67,108,864.
