evidence-grade environments for evaluating agents · WallRiderLang · TRVM

Write the wall. Run the world.
Keep the proof.

TRAAVIIS provides evidence-grade environments for evaluating agents, and proves what happened inside them. TRVM worlds are its strongest deterministic substrate. Write a world in WallRiderLang, and trvs lowers it to a content-addressed SemanticArtifactID, folds each episode into a replayable film, and verifies that film with every applicable check. Same world, same scenario, same trajectory — same hash, every time.

author the world run the episode record the film verify & replay
trvs — run captured · verbatim CLI output
$ trvs run worlds/alley.wrl
world sem-8ae91fe9cbc5fd086ce4356d587c403211e5c7b2b3ebdd316496367429ecfe4a scenario scen-2be578f63401d0a424be78f069cc81278efcb3469ae405ec66a2a340c26b8842 reducer ic_ref epochs 7 epoch film 1 56a2980eb5530db250848395 2 23c7c0cd5d2e7688f0be1b62 3 b9cd725ac52a876bf754b16c 4 2c2d8ac24faafa9e2492dea2 5 7cf6b32b260e16fba6952cbc 6 fb270e91d8d4ac3f2e3b5bc0 7 8c7bf5edcab3693a81de70ec film 8c7bf5edcab3693a81de70ec

Every terminal on this page is captured output from the real trvs CLI — nothing here is scripted. The world casts fold worlds/alley.wrl over the TRVM engine; the eval, batch and serve casts are recorded sessions over a packed Evidence Residency environment, and each says so on its own bar. TRAAVIIS does not embed, select, or route a model; the shipped world commands call none. The same world always folds to the same identity and the same film; that is the whole point.

$ git clone https://github.com/c-u-l8er/TRAAVIIS && pipx install ./TRAAVIIS · not on PyPI · then trvs doctor · needs the TRVM/forge engine on-path

Or skip the install. As of 2026-08-09 the engine and the verifier ship inside a bootable operating systemT&R, a FreeBSD 15 distribution assembled from pkgbase. Boot an image the build pipeline produced, touch nothing, and trvs is already on the path with the engine wired to it. The native reducer is C, so a binary copied from a Linux workstation would not run at all: the image build compiles it on a FreeBSD builder and ships the result, which is why the guest needs no compiler and no package manager of its own.

trvs — doctor · pristine T&R guest captured · verbatim CLI output
$ trvs doctor
TRAAVIIS 0.1.0 command trvs forge /usr/local/lib/trvm/forge engine API 1 engine v0.7.0-alpha.5 ic_ref ic32 executable oracle available demo id sem-8ae91fe9cbc5fd08 status ready

That guest was created straight from the build pipeline's own image and never touched afterwards, and it derives sem-8ae91fe9cbc5fd08… for worlds/alley.wrl — the same string this page's other captures print on an Arch Linux workstation. What that is not: it is one implementation running on two operating systems, not two implementations agreeing on a semantics. It retires a hand-copying caveat and earns nothing beyond that. Carrying the stack is a build option rather than the default, and it costs the server image 364 MB → 625 MB, because pkgbase ships no interpreter and this is python.

authora WallRiderLang world file
runfold the episode, deterministically
rewardobjective, computed — not asserted
verifyreference · native · oracle
replaycontent-addressed evidence, reproduced

Two researchers should be able to answer four questions and never argue about the answers: did we run the same world, the same scenario, the same trajectory — and did the verifiers agree? That is what a content-addressed environment is for. Reward is a computed number over a proven film, not a claim.

Identity

A world is what it means, hashed.

trvs id lowers the source to its canonical semantic graph and hashes it. Presentation — where a node sits, its colour, the wire curve — never enters the hash; a rotor or a rewire does. Two files that mean the same world print the same SemanticArtifactID; one meaningful edit and the id moves. It is the world's fingerprint.

trvs — id captured · verbatim CLI output
$ trvs id worlds/alley.wrl
sem-8ae91fe9cbc5fd086ce4356d587c403211e5c7b2b3ebdd316496367429ecfe4a

semantic

sem-… — the world's meaning, geometry-independent.

scenario

scen-… — the run inputs, deliberately kept out of identity.

film

the per-epoch evidence the deterministic fold produces.

Verifiable

Prove the film. Show the coverage.

trvs verify folds the world through the pure-Python reference reducer, re-folds it through the compiled native reducer, and cross-checks both against an independent hand-written oracle where that oracle's domain applies. A film is not asserted — it is checked by every applicable verifier, and the coverage is explicit. Golden Spinner agrees 3/3; a verifier that cannot apply is reported not_applicable, never as pass or fail.

trvs — verify captured · verbatim CLI output
$ trvs verify worlds/alley.wrl
world sem-8ae91fe9cbc5fd086ce4356d587c403211e5c7b2b3ebdd316496367429ecfe4a scenario scen-2be578f63401d0a424be78f069cc81278efcb3469ae405ec66a2a340c26b8842 reference native oracle agreement 3/3
certificate · triple fold agreement · exit 0
reducers reference native oracle
filmic_ref = ic32 = oracle — byte-for-byte
exit0 agree · 1 disagree · 2 unavailable
Replayable

Pin a film. Prove it reproduces. Diff two worlds.

A film is content-addressed evidence. trvs replay re-folds a world and, given a pinned --expect id or --film hash, asserts the fold reproduces it — exit 0 when it does, 1 when it drifts. trvs diff folds two worlds and marks the first epoch where their films diverge. This is the replayable-reward substrate an RL loop can gate on.

trvs — replay --expect captured · verbatim CLI output
$ trvs replay worlds/alley.wrl --expect "$(trvs id worlds/alley.wrl)"
world sem-8ae91fe9cbc5fd086ce4356d587c403211e5c7b2b3ebdd316496367429ecfe4a scenario scen-2be578f63401d0a424be78f069cc81278efcb3469ae405ec66a2a340c26b8842 reducer ic_ref epochs 7 epoch label film 1 set rotor = quar 56a2980eb5530db250848395 2 idle pulse tick 23c7c0cd5d2e7688f0be1b62 3 set rotor = 256. b9cd725ac52a876bf754b16c 4 reset orb fault 2c2d8ac24faafa9e2492dea2 5 set rotor = 128. 7cf6b32b260e16fba6952cbc 6 idle pulse tick fb270e91d8d4ac3f2e3b5bc0 7 set rotor = 10.0 8c7bf5edcab3693a81de70ec final film 8c7bf5edcab3693a81de70ec reproduced ✓ yes
trvs — diff captured · demo world vs an n=4 variant
$ trvs diff worlds/alley.wrl worlds/alley_n4.wrl
a sem-8ae91fe9cbc5fd086ce4356d587c403211e5c7b2b3ebdd316496367429ecfe4a (alley.wrl) b sem-24cf1b583f925ed27a4107272064546019a7042dd902f0a415786bc57b0f6113 (alley_n4.wrl) identity ✗ differ epoch a film b film 1 56a2980eb5530db25084 cefc85b866ab3430a66f 2 23c7c0cd5d2e7688f0be 0a18b4ed95946e59b1c4 3 b9cd725ac52a876bf754 52cecf7a5f31f9c731e3 4 2c2d8ac24faafa9e2492 b1258d4f2293c12e9043 5 7cf6b32b260e16fba695 d6e497c2efae09f87bdb 6 fb270e91d8d4ac3f2e3b 5d1fe6a506110328aca9 7 8c7bf5edcab3693a81de 318829a5c9bf543272c6 first divergence epoch 1
Legible

See exactly what you wrote — as the engine sees it.

trvs inspect shows the lowered world: every actor with its resolved static config, every edge with its kind, and any diagnostics. The named rotor quarter_turn_z has already become [181, 0, 0, 181]; the wires carry their semantic kind. Nothing hides between your source and its identity.

trvs — inspect captured · verbatim CLI output
$ trvs inspect worlds/alley.wrl
world sem-8ae91fe9cbc5fd086ce4356d587c403211e5c7b2b3ebdd316496367429ecfe4a profile forge.world.core.v1 actors 6 edges 4 diagnostics 0 actors d0 door ob orb p0 pulser clock=['periodic', 2, 0] p1 pulser clock=['once', 1] r0 relay sp spinner configurable=True n=8 rotor=[181, 0, 0, 181] w=16 graph p0 --SignalWire--> r0 p1 --SignalWire--> d0 r0 --SignalWire--> sp sp --SocketControl--> ob
The terminal

One honest workflow.

trvs is a small, stable surface. Seven commands fold real worlds over the TRVM engine; the rest of the eighteen shipped below are the environment surface that turns a subject into something an agent can be evaluated against. Its beachhead is trvs eval-one — a one-shot evaluation of a single frozen subject. Nothing below embeds, selects, or routes a model.

trvs doctorengine location, versions, verifier availabilityshipped
trvs idthe world's SemanticArtifactID — pure identityshipped
trvs inspectactors, edges, resolved config, diagnosticsshipped
trvs runlower + deterministically fold; per-epoch filmshipped
trvs verifyreference · native · oracle agreement (strict)shipped
trvs replayre-fold a film and assert it reproducesshipped
trvs diffcompare two worlds' identity + per-epoch filmsshipped
trvs eval-oneevaluate one agent run over one frozen subjectshipped
trvs verify-episodere-verify a saved episode with no agent processshipped
trvs initscaffold an environment for a substrate templateshipped
trvs packclose a scaffold into a verified, reopened packageshipped
trvs evalrun an agent over a split, score every episodeshipped
trvs comparerank two closed episodes answering one taskshipped
trvs batchrun several candidates over one split, compare per taskshipped
trvs verify-bundlere-verify a package tree or archive against bundle-…shipped
trvs archive-bundleemit a canonical archive + its transport checksumshipped
trvs serve --orsserve a packed environment as a submission endpointshipped
trvs serve --mcpthe same kernel behind the MCP wire vocabularyshipped

shipped commands are real over the engine today, and every command in this list is one. What is not yet built is named in the roadmap below rather than here — a published roadmap, not a claim.

The environment surface · kernel + ORS + MCP shipped

A neutral kernel. Protocols are adapters.

A tool list tells an agent what it can call. It does not define tasks, splits, rewards, episode completion, or reset. So TRAAVIIS's internal contract is a neutral Episode Kernel — and public protocols are adapters over it, not runtime law. The Open Reward Standard is the first and primary adapter; MCP is a compatibility adapter; a local JSONL surface is for automation and debugging.

startprepare a subject for a task
observedeterministic projection of state
stepone action → advance to next boundary
resetreconstruct initial state (≠ replay)
finalizeseal trace + outputs; pin episode receipt

The kernel carries no substrate semantics; any verb may be unsupported. Evidence Residency v1 is one-shot and implements only start → finalize. For the TRVM profile, observe is a label-free projection and step advances the fold to an epoch boundary.

primary adapter — trvs serve pkg --ors --split all --output episodes/
The Open Reward wire surface — list_tasks · session · call_tool → reward · finished — over the neutral kernel. Over Residency v1 that is exactly one tool, submit_candidate: the client sends a finding and a patch and nothing else, and finished: true is returned only after the episode is staged, replayed, fsynced and published. shipped
compatibility adapter — trvs serve pkg --mcp
The same world as MCP tools / resources / prompts, wrapping the kernel — never the source of truth. It targets revision 2026-07-28, the one that made MCP stateless: no initialize handshake, no protocol-level sessions, and cross-call state carried instead on server-minted handles passed as ordinary tool arguments — which is what the kernel's session-… already was. That mapping was found, not designed. Resources are the content-addressed immutables (trvs://env/…, trvs://task/…, trvs://episode/{id}): reading one twice returns identical bytes, which is what earns the long cache TTL — so a session, being mutable and ephemeral, deliberately has no trvs:// name at all. It speaks stdio, which has no network surface to defend, and --mcp refuses --host / --port / --allow-remote rather than silently ignoring them. There is no idempotency key, on purpose: a key passed as a tool argument is written by a language model, and a key a model invents makes double-execution merely look deduplicated — so a repeat submission is refused, and the refusal carries the episode_id plus a resource link. Navigable, not replayed. It composes the ORS adapter rather than re-reaching the kernel, so exactly one place decides what the server believes a client did; no kernel change was needed. shipped
trvs — serve --ors real output
$ trvs serve pkg --ors --split all --output episodes/ --port 8791
environment env-a38ec4c04532be258a59663588b0b7e678bf7ad31… split all substrate residency.repository.v1 profile traaviis.ors-profile.v1 runner traaviis.ors-submission.v1 listening http://127.0.0.1:8791/ors/v1 episodes /tmp/orsdemo/episodes tools submit_candidate refused by this substrate observe reset step loopback only. ctrl-c to stop.

Verbatim output, ids truncated to fit. The banner is the profile: nothing is advertised that cannot be done, and the three interactive routes exist only so they can refuse in the substrate's words (KERNEL_OPERATION_UNSUPPORTED, HTTP 501) rather than as a 404 — a 404 would claim the endpoint is missing, which is a statement about this server, not about the substrate. Everything is admitted before the socket binds, so there is no arrangement of failures that produces a listening server over a package that did not admit. The default bind is loopback; leaving it takes --allow-remote.

trvs — serve --mcp captured · MCP client session
$ trvs serve pkg --mcp --split all --output episodes-mcp
server/discover supportedVersions ["2026-07-28"] tools/list list_tasks, open_session, submit_candidate, close_session resources/list trvs://env/env-a38ec4c0… trvs://task/task-3b4b2599… prompts/get residency_task "Task task-3b4b2599…" tools/call open_session session-d20f6c46748746cbbfca1f22b40b8234 tools/call submit_candidate isError false status ok validity valid reward 1.0 finished true episode-29690223ea13acab06c04e551ecbb171… (repeat, same handle) isError true ORS_SESSION_FINISHED no reward; points at trvs://episode/episode-29690223… tools/call step isError true KERNEL_OPERATION_UNSUPPORTED tools/call frobnicate -32602 Unknown tool: frobnicate close stdin server exit 0 $ trvs verify-episode episodes-mcp/episode-29690223ea13acab… closure all members bind signals 7/7 replay == receipt reward replayed reward 1.0 vs receipt 1.0 episode-id episode-id closes over the derived receipt verified ✓ closed

The live end-to-end run recorded in the closure memo, ids truncated to fit: a fresh scaffold, no fixtures, over real pipes. An MCP episode and an ORS episode over the same candidate are the same episode-…, because the thing that happened is the same thing — and the last block is that episode replaying offline, with no agent, no server and no protocol, to the same reward. On compatibility, precisely what was run: a client written against the wire for this server (~180 lines, importing nothing from TRAAVIIS). No third-party MCP SDK and no Claude Desktop has connected. Pagination is not implemented — a client that sends a cursor is ignored rather than refused — and the framing is POSIX-tested only.

Strategy: do not compete with hosting catalogs. TRAAVIIS aims to be one of the best ways to author deterministic environments that export to them.

The artifact ladder · planned

One clean question each.

TRAAVIIS separates what a thing means from how it is shipped. The environment contract (env-…) fixes the subject, tasks, rewards, and splits; the outer package (bundle-…) carries presentation and docs and may change without moving env-…. Each layer answers exactly one question, and re-scoring a trace never pretends the behavior changed. The lowest rung is the substrate subject, sealed differently per substrate; everything above it is shared.

substrate subject

same subject? TRVM seals sem-… + scen-…; Residency seals snap-….

rew-… · task-…

a reward rubric, and a task binding subject + prompt + reward + termination.

trace-… · episode-…

the observable record (TRVM's film-… is its exact-trace case), and the receipt.

env-… · bundle-…

the environment contract, and the transport package — identity vs. shipping.

Evaluation before training · shipped

Prove the environment before you train in it.

The first job is not a trainer, and the first interface was not a batch — it was a one-shot trvs eval-one over a single frozen subject. Now that that is boring, trvs eval runs a whole split and emits one episode-… per task. Because every episode is verified and content-addressed, the numbers are reproducible and each trace is re-checkable on its own, with no agent process.

trvs — eval real output
$ trvs eval lab-pkg --split test --output episodes/ --agent python3 agent.py
[1/2] task-082e11c181f3be21aa82e138 ok reward 1 [2/2] task-0cd4992e274e07fc7da0bddd ok reward 1 environment env-aa7df5dde4a4999e4ddedff40a9fc2d0de039… split test (2 tasks) episodes task-082e11c181f3be21aa82e138 ok reward 1 episode-cfef6da48401cdb434c4d05a11715c527f29db19e… task-0cd4992e274e07fc7da0bddd ok reward 1 episode-01bea141effec36b35d4341516051d918d61a07ab… ok 2/2 mean reward 1 episodes kept 2/2 evaluation episodes/evaluation.json

Verbatim output, ids truncated to fit. The package is reopened and every task-/rew-/snap- re-derived from the bytes on disk before the first agent process starts, so a tampered package costs zero episodes. eval mints no new id: the ladder stops at env-…, so its evaluation.json is an index over episodes that are each already content-addressed.

ok and episodes kept are two lines because they answer two questions: what the evaluation found, and whether the evidence you asked for is still on disk. A run can be fully ok and still have failed to retain its own proof — and a score with no retained proof is not a result you can take away. The exit code reads them in precedence: 0 all ok and all kept · 1 ran and disagreed · 2 could not run, or could not keep what was asked for.

Flagship worlds

One proves the mechanism. The next one earns the thesis.

The Spinner is the conformance artifact — exact, tiny, already folding three ways. Evidence Residency is the first end-to-end environment that shows what evidence-grade agent evaluation actually looks like. Two more worlds widen the surface after it lands.

Golden Spinner shipped

The identity, replay and triple-fold tutorial. Installs, verifies, and reproduces byte-for-byte. Proof that the mechanism is real.

Evidence Residency next

An agent inspects a frozen repository, finds one real spec/implementation inconsistency, cites the conflicting evidence, proposes the smallest patch, runs the declared checks — and returns a structured finding plus a re-verifiable receipt. The first evidence-grade evaluation environment.

Courier / Factory planned

Move objects, open gates, route signals, spend energy, obey safety constraints, complete deliveries — spatial state, long-horizon tasks, objective rewards, resets, splits.

WallRider / Graffiti planned

An agent moves through a city and writes executable tags that alter surfaces, routes and permissions. It proposes graph edits; TRVM decides what they mean. The brand demo.

Four properties

One house. Four things you can actually run.

traaviis.com is the evaluation product; three siblings sit beside it on the same domain. They are separate programs with separate repositories — not editions of one another — and the seam between them is the point of the section below.

TRAAVIIS you are here

trvs — evidence-grade environments for evaluating agents. Packs a subject into a content-addressed environment, folds one episode, and returns a receipt that replays with no agent in the loop.

WallRiderLang ↗

The language a TRVM world is written in — actors, edges, world rules. A world's meaning is its hash. wrl.traaviis.com

TRVM ↗

The deterministic execution substrate and its Forge identity pipeline. Same world, same scenario, same trajectory — same hash, every time. trvm.traaviis.com

code ↗

The open-source control plane for coding agents — many workers, each in its own git worktree under its own spending cap, and nothing merges itself. It is the stack's consumer, not one of its layers. code.traaviis.com

Where the seams are

TRAAVIIS is the product. It stands on a stack.

The boundary is frozen on purpose. trvs carries no world semantics — it packages capabilities the layers below already provide, for someone who does not know the internal history of TRVM. Everything in this ladder is something TRAAVIIS stands on; code is deliberately absent from it, because a consumer is not a layer.

TRAAVIISthe product — CLI, environment surface, evaluator, packaging
trvsthe command-line interface
TaskSpecV1the substrate-neutral assignment + evaluation contract
WallRiderLang ↗the language for TRVM worlds, actors and world rules — wrl.traaviis.com
Forgethe compiler, identity and artifact pipeline
TRVM ↗the deterministic execution substrate — trvm.traaviis.com
Spinner Benchthe reference workbench and conformance laboratory
Primitives, not features

What TRAAVIIS is not.

trvs is a thin, honest terminal over an engine that already exists. Its credibility comes from what it refuses to do.

Not a coding agent

trvs builds and proves environments. It writes no code, embeds no model, and is not a chat interface. Dispatching coding agents is code's job — a sibling property, and a consumer of this stack rather than part of it. The seam is the product: the thing being evaluated must not be the thing doing the evaluating.

Not a model router

TRAAVIIS does not embed, select, or route a model. The fold is deterministic; the reward is computed. Evaluation runs an agent command supplied by the user.

Not an RL cloud

Worlds run locally. TRAAVIIS authors environments that export to hosting stacks — it is not the catalog.

Not a game engine

WallRider worlds are deterministic agent environments, not a rendering or physics engine.

Not the language or engine

WallRiderLang defines a world; TRVM/Forge lower and fold it. trvs carries no world semantics.

Not trust-me

Every film is checked by every applicable verifier and content-addressed. Disagreement is exit 1, not a warning.