Verification and Hardening Architecture for Deterministic Web-Based Simulation Platforms: A Case Study on Simulation Earth

Full report

On this page

The deployment of deterministic, browser-based simulation platforms into high-stakes environments necessitates an uncompromising separation of state authority, rendering projection, and external augmentation. For the Simulation Earth application hosted on IARPA.org, the technical foundation—comprising plain PHP, vanilla JavaScript, static JSON, WebGL, and a Web Worker—presents a rigorous verification challenge. Without reliance on third-party runtime frameworks or centralized database state, the architecture relies exclusively on client-side determinism verified through canonical cryptographic hashing. The primary assurance axiom is that the browser Web Worker is the sole authoritative owner of deterministic state. The main thread, encompassing the WebGL renderer, 2D fallback, and DOM interface, functions strictly as a read-only projection of the Worker's state. Furthermore, the optional-AI component operates as an ephemeral, replaceable explanation layer. It possesses zero mutation authority over the simulation's state, chronology, legal framework, or operational targeting. The verification strategy outlined herein establishes a black-box-compatible testing and release architecture that mathematically proves, rather than merely asserts, the immutability of factual records and the absolute containment of fictional or predictive elements.

Authority Invariants and Trust-Boundary Modeling

The security and integrity of Simulation Earth depend on rigid trust boundaries. Contamination across these boundaries—such as fictional what-if scenarios polluting historical archives, or optional-AI hallucinations mutating authoritative coordinate data—constitutes a critical failure. The system is modeled across four distinct trust domains, characterized by strictly unidirectional state authority.

Trust Boundary and Authority Diagram

========================================================================================== TRUST BOUNDARY AND AUTHORITY DIAGRAM

\[DOMAIN 1: ABSOLUTE TRUTH\] (Immutable / Append-Only)

|-- Factual Statistics |-- Historical Source Playback |-- Read-Only Nuclear Archive | | (Unidirectional Load) v

\[DOMAIN 2: DETERMINISTIC ENGINE\] (Authoritative State Owner) |-- Browser Web Worker |-- State Transition Logic (Play, Step, Rewind, Forward, Jump) |-- PRNG & Deterministic Resolution (48 Synthetic Cells) |-- Canonical Hashing (RFC 8785\) | | (Strict Versioned Message Protocol & Transferable ArrayBuffers) | \+------------------------------------------------------------------+

| | v (Read-Only Projection) ^ (Action Requests)

\[DOMAIN 3: PROJECTION & USER INTERFACE\] (Zero State Authority)

|-- Main Thread (Vanilla JS) |-- WebGL Globe & 2D Canvas Fallback |-- Scenario Command Center & Event Studio |-- Accessibility Shadow DOM (NVDA, JAWS, WebXR) | | (Derived Read-Only Envelope) | v |

\[DOMAIN 4: AUGMENTATION LAYER\] (Untrusted / Replaceable)

|-- Same-Origin PHP JSON Endpoint (No-Store, Rate-Limited) |-- External LLM Provider |-- Returns: Deterministic Fallback or Localized Narrative Text |-- Mutation Capabilities: NONE

The architecture enforces absolute boundary invariants. The Main Thread may only request actions via message passing. The Worker evaluates these requests, advances the deterministic simulation, and returns a new state snapshot. Any state snapshot exported from the Worker must be serializable into Canonical JSON conforming to RFC 8785, which ensures deterministic property sorting and ECMAScript-compatible number serialization1. The Optional-AI PHP endpoint accepts only a derived, read-only envelope of the state. The response from the AI must never be parsed as executable logic or numerical authority, acting strictly as a localized text overlay.

Versioned Worker-Message Protocol Specification

To guarantee that the Main Thread and the Web Worker interact deterministically, the message protocol must be strictly typed, versioned, and resilient to tab suspension, worker restarts, and the structural limitations of the browser's structured clone algorithm3. All communication between the Main Thread and the Web Worker occurs via a unified message envelope. To prevent garbage collection pauses and structural cloning overhead during state synchronization, large numerical arrays representing the 48 synthetic cells and normalized indicators must be passed using Transferable Objects5. The structured clone algorithm natively strips functions, DOM nodes, and getter/setter descriptors3. Therefore, the protocol relies exclusively on serializable primitives.

Protocol Request Schema (v1.0.0)

The incoming message format from the Main Thread to the Worker dictates the boundaries of user and projection interaction.

JSON { "$schema": "http://json-schema.org/draft-07/schema\#", "title": "SimulationEarth\_WorkerRequest", "type": "object", "properties": { "protocol\_version": { "type": "string", "const": "1.0.0" }, "request\_id": { "type": "string", "pattern": "^\[a-fA-F0-9\]{64}$" }, "action": { "type": "string", "enum": \[ "INIT", "PLAY", "PAUSE", "SPEED", "STEP", "REWIND", "FORWARD", "SCENARIO", "JUMP", "RESET", "BRANCH", "INTERVENE", "CONTEXT\_EVENT", "CRISIS\_TRIGGER", "RESPONSE", "SAVE", "EXPORT", "IMPORT" \] }, "payload": { "type": "object" }, "timestamp\_seq": { "type": "integer", "minimum": 0 } }, "required": \["protocol\_version", "request\_id", "action", "timestamp\_seq"\], "additionalProperties": false }

Protocol Response and Error Schemas (v1.0.0)

The Worker responds to every valid request with a state acknowledgment or a designated error. The canonical\_state\_hash serves as the cryptographic proof of the simulation's current temporal posture.

JSON { "$schema": "http://json-schema.org/draft-07/schema\#", "title": "SimulationEarth\_WorkerResponse", "type": "object", "properties": { "request\_id": { "type": "string", "pattern": "^\[a-fA-F0-9\]{64}$" }, "status": { "type": "string", "enum": \["ACK", "STATE\_UPDATED"\] }, "canonical\_state\_hash": { "type": "string", "pattern": "^\[a-f0-9\]{64}$" }, "tick": { "type": "integer", "minimum": 0 }, "payload": { "type": "object" } }, "required": \["request\_id", "status", "canonical\_state\_hash", "tick"\], "additionalProperties": false }

When a protocol violation occurs, the Worker emits a standard error schema, halting progression but maintaining the integrity of the previous state hash.

JSON { "$schema": "http://json-schema.org/draft-07/schema\#", "title": "SimulationEarth\_WorkerError", "type": "object", "properties": { "request\_id": { "type": "string" }, "status": { "type": "string", "const": "ERROR" }, "error\_code": { "type": "string", "enum": \[ "INVALID\_SCHEMA", "UNKNOWN\_ACTION", "BACKPRESSURE\_LIMIT", "OUT\_OF\_ORDER\_SEQ", "UNSERIALIZABLE\_PAYLOAD", "CHRONOLOGY\_VIOLATION" \] }, "message": { "type": "string" }, "canonical\_state\_hash": { "type": "string" } }, "required": \["request\_id", "status", "error\_code", "canonical\_state\_hash"\] }

Concurrency, Idempotence, and Lifecycle Management

The protocol must address native browser behaviors to prevent state corruption. The timestamp\_seq attribute acts as a monotonic clock, ensuring idempotence and duplicate delivery rejection. If the Worker receives an out-of-order or duplicate request\_id, it must discard the message and re-emit the ACK for the highest processed state. Browsers frequently suspend inactive tabs to preserve battery and memory. The Main Thread must ping the Worker via a lightweight status check. If the Worker terminates due to memory pressure or tab suspension, the Main Thread instantiates a new Worker using the last verified canonical\_state\_hash and its corresponding local state blob. Furthermore, if the Main Thread requests state mutations faster than the Worker can compute, the Worker queues operations up to a strict limit, beyond which it rejects requests with a BACKPRESSURE\_LIMIT error to maintain UI responsiveness and prevent heap overflow.

Deterministic Architecture and Cross-Browser Tolerances

Achieving bit-exact determinism across varied JavaScript engines—such as Chrome's V8, Firefox's SpiderMonkey, and Safari's JavaScriptCore—is the most mathematically demanding requirement of the simulation8.

Floating-Point Stability and Seeded Randomness

JavaScript mandates 64-bit floating-point arithmetic following the IEEE 754 standard1. However, transcendental mathematical functions such as Math.sin(), Math.cos(), and Math.pow() are implemented differently across browser engines, leading to micro-divergences in the least significant bits of floating-point outputs10. Over thousands of simulation steps, a difference in the 16th decimal place will avalanche, causing wildly diverging state hashes across different devices. To guarantee cross-browser determinism, the Worker must strictly avoid native transcendentals for any operation that mutates state9. Geographic coordinates, vectors, and numerical indicators for the 48 synthetic cells must be processed using scaled integer arithmetic or a custom deterministic mathematics library relying on lookup tables or Taylor series expansions13. Native Math.random() is inherently non-deterministic and highly engine-dependent15. The Worker must utilize a deterministic pseudo-random number generator (PRNG), such as a 64-bit SplitMix or XorShift algorithm15, initialized with a strict seed contained in the INIT or IMPORT payload17. Furthermore, Object.keys() iteration order is not guaranteed to be identical across all engine versions. The simulation must rely on sorted arrays for iteration, ensuring that event processing occurs in a strictly predictable sequence.

Deterministic Replay and Cross-Browser Comparison Protocol

Verification of the simulation's determinism requires an automated cross-browser replay protocol that eliminates hardware and OS-level variability.

Canonical JSON (RFC 8785\) is mandatory because standard JSON.stringify() produces non-deterministic outputs based on insertion order and varying whitespace rules2. By enforcing lexicographical sorting of keys and precise ECMA-262 number serialization, RFC 8785 guarantees that logically equivalent states yield identical byte arrays for hashing1.

Exhaustive Verification Test Catalog

The architecture requires an implementation-ready testing specification spanning 200 explicitly named tests. These tests are categorized across ten distinct assurance layers to ensure comprehensive coverage of determinism, protocol bounds, security, rendering, and AI containment.

1. Core Determinism & Playback Verification (T001 - T020)

This layer proves that the underlying mathematical engine generates identical outcomes regardless of the execution environment. The tests ensure that locale data, wall-clock time, and hardware architectures cannot leak into the simulation state.

2. Chronology & Boundary Constraints (T021 - T040)

Simulation Earth relies on precise chronological logic spanning thousands of years. These tests verify the robustness of date calculations, the handling of calendar anomalies, and the strict segregation between factual historical data and fictional projections.

3. Worker Concurrency & Protocol Adherence (T041 - T060)

The Web Worker must operate as an impregnable state machine. These tests validate the JSON schemas, memory management, and the worker's ability to survive chaotic or hostile message passing from the Main Thread.

4. Save, Export & Migration Integrity (T061 - T080)

State persistence in a browser environment relies on LocalStorage and JSON file exports. These tests guarantee that files cannot inject malicious code, corrupt the state, or bypass chronological constraints upon import.

5. Metamorphic & State Equivalence (T081 - T100)

Metamorphic testing proves that functionally equivalent user operations result in mathematically identical state hashes. If two distinct paths logically arrive at the same scenario, their resulting canonical states must match flawlessly.

6. Rendering Correctness, WebGL & Context Loss (T101 - T120)

Because the UI is a read-only projection, rendering anomalies must not crash the underlying simulation. These tests ensure the WebGL globe and 2D fallbacks handle extreme edge cases—such as pole singularities and context loss—gracefully24.

7. Accessibility (A11y), WebXR & Automated Evidence (T121 - T140)

To meet public inclusion mandates, the visual canvas must be fully translated into an accessible shadow DOM. Furthermore, WebXR immersive sessions must strictly map controllers to the standard UI paradigms without collecting invasive biometric telemetry26.

8. Security, Privacy & Threat Mitigation (T141 - T160)

Simulation Earth faces distinct threats stemming from its deployment architecture. These tests enforce strict Content Security Policies (CSP), mitigate XSS vectors, and mathematically verify that no Personally Identifiable Information (PII) or Illinois biometric data (BIPA/PIPA) is logged29.

9. Optional-AI Containment & Fallback (T161 - T180)

The AI component acts purely as a replaceable explanation layer. These tests prove that adversarial prompt injection, provider drift, or hallucinated logic cannot penetrate the Worker's deterministic state envelope.

10. Release Evidence, Integrity & Observability (T181 - T200)

Final deployment onto IARPA.org requires cryptographic proof that the release artifact has not been tampered with. These tests ensure the build pipeline creates identical outputs and strips internal evidence from the public payload.

Privacy Engineering and Threat Model (STRIDE)

Simulation Earth processes sensitive, though fictional, geopolitical data. The threat model utilizes the STRIDE methodology to systematically identify and mitigate risks associated with the deployment architecture. A critical component of this threat model is strict adherence to the Illinois Biometric Information Privacy Act (BIPA) and the Personal Information Protection Act (PIPA)29. Legal precedents surrounding XR applications clearly identify gaze tracking, spatial mapping, and headset telemetry as protected biometric identifiers29. Consequently, the simulation's WebXR implementation must explicitly refuse any hooks that request spatial mapping or eye-tracking data, isolating controller input to pure non-biometric raycasting. Because the application requires no database, it stores no personal data, entirely circumventing PIPA breach reporting liabilities30.

AI Containment and Fuzzing-Corpus Design

The optional AI operates in a fundamentally untrusted capacity. To ensure it cannot destabilize the system, it is subjected to an exhaustive Fuzzing-Corpus and a strict Admission/Fallback Matrix.

Fuzzing-Corpus Generation Strategy

1. Saves & Templates: Generate 100,000 malformed JSON save files utilizing bit-flipping, deeply nested arrays2, duplicated UUIDs, and boundary-exceeding integers (e.g., overriding a 0.0 to 1.0 normalization to 999.9). Feed these into the headless IMPORT pipeline to ensure the Worker rejects them gracefully without heap exhaustion.

2. Worker Messages: Blast the Web Worker with out-of-order, structurally invalid, and conceptually impossible message sequences (e.g., sending INTERVENE before INIT). The Worker must remain responsive, returning standardized ERROR schemas without stalling the UI.

3. Consequence Envelopes & Provider Responses: Inject adversarial text, null bytes, and excessively large strings into the localized event text fields. Mock the LLM provider to return malformed JSON, infinite streaming loops, sudden connection drops, and inappropriate content. The PHP proxy must consistently trap these errors and return the deterministic fallback. Ensure all fuzzing strictly excludes real targeting instructions, weapon parameters, or cyber exploits, conforming to the non-negotiable safety rules.

Optional-AI Admission, Drift, and Fallback Matrix

Production Acceptance and Release Evidence

Prior to deploying to IARPA.org, the release-assurance lead must verify cryptographic and functional integrity. No evidence may be simulated or fabricated. Production-Evidence Checklist:

• \[ \] Local Automation: 200/200 tests pass in the headless CI pipeline without retry flakiness.
• \[ \] Browser Automation: Tests pass across Playwright/Puppeteer instances for Chromium, Firefox, and WebKit37.
• \[ \] Native Device Testing: Manual sign-off on iOS Safari, Android Chrome, and Meta Quest Browser.
• \[ \] Assistive Technology: Manual verification of screen reader compatibility using NVDA (Windows), JAWS (Windows), VoiceOver (macOS/iOS), and TalkBack (Android).
• \[ \] Live-Provider Canary: One explicitly authorized integration test against the production LLM endpoint confirms standard connectivity, ensuring the provider has not unexpectedly rotated authentication headers.
• \[ \] Public-Host Evidence: Staging deployment on a segregated IARPA sub-domain passes all TLS 1.3, DNSSEC, and CSP header validations.
• \[ \] Signed Artifacts: The final release package is hashed (SHA-256) and signed using the architect's private key, which remains strictly isolated from the build server.

Triage Plan for Regression Pressure Areas

Historical regression points in simulation platforms require strict oversight and predefined rollback criteria.

Prioritized Backlog

• SAFE-NOW: Implement canonical JSON hashing (RFC 8785\)2. Isolate Web Worker messaging with strict schemas. Set up Playwright cross-browser harness for testing27.
• PROTOTYPE: WebXR immersive-vr integration for the 48 synthetic cells, restricted strictly to non-biometric controller raycasting to satisfy BIPA constraints26.
• REVIEW-REQUIRED: Custom deterministic Mathematics library for Web Worker execution to completely eliminate floating-point drift across V8 and SpiderMonkey engines9.
• REJECT: Any proposal to store user interaction logs, IP addresses, or AI prompt histories on the PHP server. Any proposal to utilize standard Math.random()15. Any proposal to provide the AI component with exact geographical coordinates or targeting parameters.

This architecture establishes a rigorously verified, fail-closed environment for Simulation Earth. By strictly isolating the Web Worker as the sole deterministic authority and relegating the UI and optional AI to pure read-only projections, the system guarantees that factual records remain unpolluted and that simulations are mathematically reproducible across all platforms. The integration of canonical hashing, stringent privacy-by-design principles, and zero-trust AI containment ensures that the simulation operates securely, without risk of state corruption, biometric data leakage, or narrative hallucination altering objective data.

Works cited

1. RFC 8785 \- JSON Canonicalization Scheme (JCS) \- IETF Datatracker, https://datatracker.ietf.org/doc/rfc8785/

2. json-canon: A Strict RFC 8785 Implementation in Go for Deterministic JSON, https://dev.to/lenny321/json-canon-a-strict-rfc-8785-implementation-in-go-for-deterministic-json-3mfg

3. The structured clone algorithm \- Web APIs | MDN, https://developer.mozilla.org/en-US/docs/Web/API/Web\_Workers\_API/Structured\_clone\_algorithm

4. Deep-copying in JavaScript using structuredClone | Articles \- web.dev, https://web.dev/articles/structured-clone

5. Transferable objects \- Web APIs | MDN, https://developer.mozilla.org/en-US/docs/Web/API/Web\_Workers\_API/Transferable\_objects

6. Transferable objects \- Lightning fast | Blog \- Chrome for Developers, https://developer.chrome.com/blog/transferable-objects-lightning-fast

7. Surviving the Structured Clone algorithm | by Andrea Giammarchi \- Medium, https://webreflection.medium.com/surviving-the-structured-clone-algorithm-130608b69f47

8. Working with Smart Filters \- MultiChain, https://www.multichain.com/developers/smart-filters/

9. multiplayer-guide.md \- NewKrok/nape-js \- GitHub, https://github.com/NewKrok/nape-js/blob/master/docs/guides/multiplayer-guide.md

10. Show HN: A 2D Physics Simulator in JavaScript \- Hacker News, https://news.ycombinator.com/item?id=14865184

11. Determinism \- Rapier.rs, https://rapier.rs/docs/user\_guides/templates\_injected/determinism/

12. Floating point determinism in Unity: Intel vs AMD, https://discussions.unity.com/t/floating-point-determinism-in-unity-intel-vs-amd/813566

13. Electronics, Volume 15, Issue 5 (March-1 2026\) – 232 articles \- MDPI, https://www.mdpi.com/2079-9292/15/5

14. Discovering JavaScript's Hidden Secrets: Understanding Numerical Algorithms., https://dev.to/davidevlops/discovering-javascripts-hidden-secrets-understanding-numerical-algorithms-40a9

15. Webots documentation: Procedural PROTO Nodes, https://www.cyberbotics.com/doc/reference/javascript-procedural-proto?version=omichel:master

16. Algorithms — list of Rust libraries/crates // Lib.rs, https://lib.rs/algorithms

17. Multiplayer Game Programming: Architecting Networked Games, http://sspczundal.com/assets/upload/ck-images/Multiplayer%20Game%20Programming%20Architecting%20Networked%20Games.pdf

18. Insights from Game AI Experts | PDF | Acceleration | Artificial Intelligence \- Scribd, https://www.scribd.com/document/865519580/Game-AI-Uncovered-Volume-Two-Paul-Roberts-Z-Library

19. draft-rundgren-json-canonicalization-scheme-17 \- IETF Datatracker, https://datatracker.ietf.org/doc/draft-rundgren-json-canonicalization-scheme/17/

20. The JSON Canonicalisation Scheme (RFC 8785\) in action and how to secure JSON objects with HMAC \- Connect2id, https://connect2id.com/blog/how-to-secure-json-objects-with-hmac

21. Jackson Tips: sorting JSON using JsonNode \- Medium, https://cowtowncoder.medium.com/jackson-tips-sorting-json-using-jsonnode-ce4476e37aee

22. RFC 8785: JSON Canonicalisation Scheme · nlohmann json · Discussion \#2612 \- GitHub, https://github.com/nlohmann/json/discussions/2612

23. Making browser games more secure with Elm, Part 2 \- Show and Tell, https://discourse.elm-lang.org/t/making-browser-games-more-secure-with-elm-part-2/7764

24. Testing the Invisible: Why Traditional E2E Fails for WebGL | CodeWithMMAK, https://www.codewithmmak.com/blog/testing-the-invisible-why-traditional-e2e-fails-for-webgl

25. Improve handling of webgl context loss · Issue \#120393 · microsoft/vscode \- GitHub, https://github.com/microsoft/vscode/issues/120393

26. WebXR Browser Support in 2026: What Works, What Breaks \- TestMu AI, https://www.testmuai.com/learning-hub/webxr-compatible-browsers/

27. JavaScript and Web Development InfoQ Trends Report 2020, https://www.infoq.com/articles/javascript-web-development-trends-2020/

28. TestMu AI vs Steel.dev: Browser Infrastructure for AI Agents Compared (2026), https://www.testmuai.com/blog/testmuai-vs-steeldev/

29. Extended Reality, Body-Based Data, and Biometric Privacy Regulations: Lessons for Policymakers by Jameson Spivack1 \- AWS, https://fsi9-prod.s3.us-west-1.amazonaws.com/s3fs-public/2024-10/Spivack%20-%20individual%20monograph%20(1).pdf

30. Illinois Privacy Law Compliance: What You Need to Know \- Varonis, https://www.varonis.com/blog/illinois-privacy-law

31. US Illinois Personal Information Protection Act (PIPA) \- SmartSuite, https://www.smartsuite.com/framework/illinois-personal-information-protection-act-815-ilcs-530

32. Personal Information Protection Act (PIPA) \- SSN \- University of Illinois System, https://www.ssn.uillinois.edu/personal\_information\_protection\_act\_pipa

33. What is the Illinois Data Breach Reporting Law? \- Compliancy Group, https://compliancy-group.com/illinois-data-breach-reporting-law/

34. Augmented Reality in E-Commerce and Virtual Shopping Experiences \- IJFMR, https://www.ijfmr.com/papers/2025/4/54346.pdf

35. EXISTING LAW AND EXTENDED REALITY \- AWS, https://fsi9-prod.s3.us-west-1.amazonaws.com/s3fs-public/2024-10/Existing%20Law%20and%20Extended%20Reality%20Volume.pdf

36. BUSINESS TRANSACTIONS (815 ILCS 530/) Personal Information Protection Act. \- Illinois Compiled Statutes, https://www.ilga.gov/Legislation/ILCS/Articles?ActID=2702\&ChapterID=67

37. Npms.io, https://npms.io/search?q=firefox-headless

38. Firefox \- InfoQ, https://www.infoq.com/firefox/

39. rfc8785 \- Hex.pm, https://hex.pm/packages/rfc8785