Web World Models

TL;DR

Language agents need persistent “worlds” to act in, and today you pick a bad extreme: a hand-built web app with a fixed database schema (reliable but small and finite), or a fully generative world model (unlimited but uncontrollable, hallucination-prone, and expensive). The Web World Model (WWM) is the middle ground. It splits the world into a Physics layer — deterministic TypeScript/HTTP code that owns state, rules, and invariants — and an Imagination layer — the LLM, which only generates descriptions, narrative, and structured content conditioned on the code’s state. The headline trick: you never store the world. You hash a coordinate into a seed, freeze the LLM’s sampling on that seed, and the same place regenerates identically every visit (“object permanence” with zero storage). The paper isn’t a benchmark study — it’s a design pattern backed by seven working web demos (an infinite Earth atlas, a procedural galaxy, a Slay-the-Spire-style card game, a falling-sand alchemy sandbox, a 3D solar system, an on-demand Wikipedia, and an infinite book reader). The contribution is the architecture and four engineering principles for building these, not new model training.

Problem & Motivation

The concrete pain: you can’t give an agent a big, persistent, trustworthy world without paying through the nose for one of two things.

• Conventional web app route. State lives in a database; endpoints are hand-written. This is what every production system already does, and it’s great — you get type safety, versioning, debugging, security boundaries. But the world is exactly as big as the schema you wrote in advance. Want a new kind of place, item, or interaction? A developer has to anticipate and code it. The “world” an agent can inhabit is bounded by yesterday’s CREATE TABLE statements.
• Generative world model route. Let a big model dream the environment in its latent space (Ha & Schmidhuber’s original “World Models”, or video/3D generators). In principle: unlimited, any genre. In practice: the world drifts, contradicts itself, is impossible to debug (“why did the model decide the door is now unlocked?”), expensive to run per frame, and offers no structural guarantees a long-running app needs.

So there’s a missing middle: fixed-but-reliable vs. unlimited-but-uncontrollable. Nobody had a clean recipe for “unlimited and controllable.” That’s the gap WWM targets. If you build agentic products, this is your daily tension — clients want open-ended experiences, but you also need the thing to not lie about inventory or money.

What’s New (Core Contribution)

This is a design-pattern / systems paper. The novelty is architectural framing plus a validated set of principles, not a model or a benchmark.

1. The WWM abstraction itself. Before: world state was either DB-backed (finite) or model-latent (opaque). Now: world state S_t is explicitly split S_t = (S_t^φ, S_t^ψ) — a code-defined physics state and a model-defined imagination state — with a strict ordering (code runs first, model conditions on the result). Naming and formalizing this split is the core idea.
2. Typed interfaces as the neuro-symbolic contract. Before: latent state = high-dimensional embedding; you hope the model’s output is usable. Now: the latent state is a TypeScript interface / JSON schema. The LLM must emit valid JSON conforming to it (e.g. interface Planet { biome: string; hazard: string }). The type system becomes a “syntactic filter” that eliminates structural hallucination — the model literally can’t return a shape the engine can’t execute.
3. Infinite worlds via deterministic hashing. Before: persistence = store everything in a DB. Now: hash the coordinate → seed → freeze the LLM’s randomness on that seed. Revisit the same place, get the same world, with zero storage. Object permanence as a pure function.
4. Graceful degradation via a “fidelity slider.” Before: if the model is down/slow, the app breaks. Now: because the code owns physics, the app stays functional — it just drops from LLM-generated content → cached content → pre-authored templates. The world loses richness but never logical continuity.

Honest read on novelty: each ingredient exists somewhere (procedural generation with seeds is decades old in games; JSON-schema-constrained decoding is standard; neuro-symbolic worlds have prior art — Balloch 2023). What’s genuinely new is packaging them as a coherent web-native pattern and showing it generalizes across seven very different domains. It’s a “name the pattern and prove it travels” paper, not a “new algorithm” paper.

How It Works (Technically)

The whole system is one loop with a hard boundary down the middle.

The two layers and the strict ordering

The world state at time t is decomposed into two orthogonal parts:

S_t = (S_t^φ, S_t^ψ)

• S_t^φ — Physics layer (deterministic code). Holds the invariant facts: inventory, coordinates, HP/energy, resource caps, map connectivity, who-is-locked-out-of-what. This is plain TypeScript. It is the source of truth.
• S_t^ψ — Imagination layer (stochastic LLM). Holds the perceptual content: scene descriptions, NPC dialogue, mission lore, aesthetic “vibe.” None of it is allowed to change a physics fact.

A turn proceeds in a strict two-step order. First the code computes the logical next state from the current state and the action a_t:

S_{t+1}^φ = f_code(S_t^φ, a_t)

In plain English: given where things are and what the user just did, run ordinary deterministic code to figure out the new authoritative state. No model involved. If the user tries to walk through a locked door or spend money they don’t have, f_code simply refuses — there’s nothing to hallucinate.

Then, and only then, the LLM π_θ samples the perceptual layer conditioned on the already-decided physics state:

S_{t+1}^ψ ∼ π_θ( · | S_{t+1}^φ)

In plain English: now that the facts are locked, ask the model to describe/narrate them. The conditioning bar | is the whole point — the model is downstream of truth, never upstream. (π_θ is just “the policy / the LLM with weights θ”; the ∼ means “sampled from,” because generation is stochastic.) This is the inversion of a pure generative world model, where the model decides the facts and the description in one shot and can contradict itself.

Typed interface = the firewall

The model doesn’t return prose-blob; it returns JSON matching a schema the engine declares. If a card game defines interface ICard { name; description; cost: int; type: "ATTACK"|"SKILL"|"POWER"; effects: EffectCode[] }, then the LLM’s only freedom is filling those fields with valid values. The engine then executes effects through a fixed vocabulary of effect codes it knows how to run deterministically (e.g. start_combat_strength_1). So “the model invents a new card” becomes safe: it can invent names and flavor and combine known effects, but it cannot invent a new game mechanic the rules engine doesn’t understand. The type contract is the sandbox.

Deterministic hashing = free persistence

You can’t store an infinite universe. So you don’t store it — you make it a pure function of location. When a user arrives at coordinate x:

1. Skip the DB entirely.
2. seed = h(x) — hash the coordinate to an integer seed.
3. Feed seed to the generator (procedural noise for structure, and the seed fixes the LLM’s sampling randomness for content).
4. Output is invariant: same x → same seed → same world.

The guarantee the paper writes formally is just “same place, same state over time”:

S_t^ψ ≡ S_{t+k}^ψ if location(t) = location(t+k)

That’s object permanence with zero storage cost. Leave a planet, come back 100 visits later, it’s identical — because nothing was ever saved; it’s recomputed deterministically.

Graceful degradation = the fidelity slider

Calling an LLM every frame is too slow/expensive. So the system has tiers:

• High fidelity: live LLM generation.
• Medium fidelity: serve cached content (file-backed caches keyed by the procedural seed — note: same seed key that makes hashing work also makes caching trivial).
• Base fidelity: deterministic code renders pre-authored templates.

Because physics is code, the app keeps working at every tier. The model going down degrades aesthetics, not correctness.

Trace one input end-to-end (Infinite Travel Atlas)

1. User clicks a glowing beacon on a 3D globe at some lat/long. → that’s the action a_t.
2. proceduralBeaconService.ts hashes the coordinate to a stable seed and assigns deterministic metadata (this is f_code computing S_{t+1}^φ — the beacon’s identity, location facts, the valid subset of allowed visual themes for that geography). No DB hit.
3. The agent passes that structured metadata to the LLM as typed input.
4. The LLM (π_θ) picks one theme from the allowed subset and writes a structured multi-day itinerary as JSON conforming to the renderer’s interface — S_{t+1}^ψ.
5. Client renders it. Nairobi reliably yields a warm “desert-bloom” theme; Rio a “coastal-drift” blue theme — because geography (code) constrains the theme set before the model ever chooses.

Notice the model never decided where Nairobi is or which themes are legal — code did. The model only chose among legal options and wrote the copy.

Architecture & data flow

flowchart LR
  A[User action a_t] --> B{Physics layer S^phi<br/>deterministic code}
  B -->|hash coord -> seed| C[Compute next state<br/>f_code S^phi, a_t]
  C -->|typed JSON context| D{Imagination layer S^psi<br/>LLM pi_theta}
  D -->|valid JSON only| E[Schema / type validator]
  E -->|pass| F[Render world]
  E -->|fail or LLM down| G[Cached content / templates]
  G --> F
  F -->|loop: new state| A

Schematic of one WWM turn. Toggle the LLM "online/offline" and adjust latency to watch the fidelity slider drop from live generation → cache → template while the physics layer (and thus correctness) stays intact.

Deterministic hashing for object permanence. Click the same tile repeatedly: the hash → seed → world output never changes, so revisiting costs nothing and stores nothing. Click "store-everything DB" to see the cost the WWM avoids.

The algorithm, simplified

# One Web World Model turn. The split IS the contribution:
# code decides facts; the model only describes facts it was handed.

EFFECT_CODES = {"deal_damage", "gain_block", "start_combat_strength_1", "apply_burn"}  # fixed vocabulary

def wwm_turn(phys_state, action):
    # ---- PHYSICS (S^phi): deterministic, authoritative, no model ----
    phys_next = f_code(phys_state, action)          # inventory/HP/coords/legality
    if phys_next is REJECTED:                        # e.g. locked door / no funds
        return phys_state, render_template(phys_state)

    # ---- IMAGINATION (S^psi): model conditioned on the locked facts ----
    seed = h(phys_next.location)                     # hash -> object permanence + cache key
    cached = cache.get(seed)
    if cached:                                        # medium fidelity
        content = cached
    elif llm_online():                               # high fidelity
        content = llm(prompt=phys_next, schema=CARD_SCHEMA, seed=seed)  # JSON only
        if not validates(content, CARD_SCHEMA):      # typed interface = firewall
            content = render_template(phys_next)      # reject bad shapes
        else:
            assert all(e in EFFECT_CODES for e in content.effects)  # no invented mechanics
            cache.set(seed, content)
    else:                                             # base fidelity, model unavailable
        content = render_template(phys_next)

    return phys_next, content                         # facts + flavor, never contradicting

The boring parts (llm, cache, rendering) are stubbed. The exposed part is the ordering and the two guards: schema validation (right shape) and effect-code membership (no new mechanics). That’s the entire safety story.

Built on Prior Work

Lineage in one line: take procedural generation’s seed trick, swap the symbolic layer for web types, put an LLM behind the seed for semantics, and you get WWM.

Results & Evidence

What’s actually here: seven working demonstrations on a unified TypeScript/React/serverless stack, each instantiating the four principles:

• Infinite Travel Atlas — real Earth, any coordinate → themed guide + itinerary, no DB.
• Galaxy Travel Atlas — procedural sci-fi universe; structure computed (noise functions), lore from LLM under interface Planet; agents are “stateless transformation pipelines” treating the LLM as “just another microservice.”
• AI Spire — Slay-the-Spire-style roguelike; Gemini Flash designs cards/relics as schema’d JSON with effect codes; a “Wish” lets users free-text a custom card that the engine compiles to real mechanics.
• AI Alchemy — falling-sand cellular automaton where unknown element collisions trigger an LLM to synthesize a schema-constrained reaction (cached + injected live); an “AI Supervisor” perturbs the sim to prevent one element dominating.
• Cosmic Voyager — WebGL solar system; LLM narrates view-dependent “Cosmic Guide” subtitles every 30s.
• WWMPedia — on-demand Wikipedia: search/open/extract = physics, LLM composes a cited, sectioned page; “explain more” elaborates any section.
• Bookshelf — infinite reader; physics = pagination/style/plot-thread state, LLM = local prose; finding: long-horizon generation is mostly a state-management problem — keep carried state typed and small.

What the evidence establishes: the pattern is implementable and general — it really does span real/fictional, knowledge/interaction, 2D/3D, single/multi-user. Qualitative consistency holds (Nairobi → desert-bloom, Honolulu → urban-pulse; same planet revisits identically).

What it does NOT establish (be honest with clients):

• No quantitative evaluation. No metrics, no user study, no A/B against a generative-only or DB baseline. “Empirical observation confirms…” means screenshots, not numbers.
• No agent-task results. The title promises worlds for agents, but every demo is human-driven. There’s no measurement of an agent learning/planning better inside a WWM.
• Hallucination claims are structural, not semantic. Typed interfaces stop malformed output; they do not stop the model writing confidently wrong content (a plausible-but-false travel fact, a miscited WWMPedia claim). The firewall guards shape, not truth.
• Cost/latency unquantified. “Computationally prohibitive per frame” is asserted; no numbers on the fidelity tiers’ actual savings.

Treat this as a strong, credible engineering blueprint — not a results paper.

How You’d Use It

This pattern is directly sellable, and it maps cleanly onto an AI-services shop.

• Agentic product substrate. If you’re building an agent that needs a persistent environment (a sim, a training ground, a game, an explorable knowledge base), WWM is your reference architecture. Put the rules in code, the prose in the model. Your agent acts against f_code (which can’t be tricked into illegal states) and reads the LLM-generated context as observation.
• Multi-agent orchestration. This is the part your ARC-MAS experience pays off. The “stateless transformation pipeline / LLM-as-microservice” framing means you can fan out content generation across many agents/workers, all keyed by deterministic seeds, with the physics layer as the single shared source of truth. No agent can corrupt global state because only f_code writes it — that’s the coordination guarantee MAS systems usually struggle to enforce.
• Client offering: “infinite, on-brand, controllable experiences.” WWMPedia is the obvious commercial template — an on-demand, cited knowledge site over a client’s domain (the open web or their docs). Bookshelf → infinite branded narrative/marketing content. The atlas pattern → an explorable product/territory/portfolio map. The pitch: unlimited content, but you control the rules, the schema, and the brand — and it degrades gracefully so it never 404s.
• The reliability story sells. “Even if the model is down, the app still works” is a real enterprise objection-killer. The fidelity slider is a feature you can put on a slide.

Where it slots into an existing build: it’s a state-management discipline, not a framework you adopt wholesale. You can retrofit one feature (say, on-demand content) into an existing Next.js app in days.

Build Your Own (Minimal Recipe)

Smallest version that captures ~80% of the value — a single-domain WWM (pick one: an on-demand wiki, or a tiny tile-world):

1. Define the typed contract first. One TypeScript interface / JSON schema for your generated state (interface Place { theme: Theme; blurb: string; items: Item[] }). This is the spine; everything hangs off it.
2. Write f_code. A pure function (state, action) -> state that owns all invariants (legality checks, inventory math, coordinates). No model calls in here, ever.
3. Add deterministic seeding. seed = hash(location); pass it to your generator and as the model’s sampling seed (and as your cache key — same key, two jobs).
4. Wrap the LLM as a typed generator. Use constrained/JSON-schema decoding (OpenAI structured outputs, Gemini responseSchema, or instructor/outlines in Python). Validate every response against the schema; reject and fall back on mismatch.
5. Add the fidelity ladder. cache.get(seed) → live LLM → template. Three lines of control flow (see pseudocode above).

The two genuinely hard parts:

• Designing the effect-code vocabulary / schema so it’s expressive but executable. Too rigid and the model can’t be creative; too loose and you’re back to arbitrary code execution. This is the real design work, and it’s where AI Spire spends its complexity.
• Long-horizon state without bloat (the Bookshelf lesson). Deciding what minimal typed state to carry forward (open plot threads, style anchors) vs. regenerate. Get this wrong and either the world drifts or your context window explodes.

Reach for: TypeScript + Zod (schema validation), Gemini Flash / GPT-4o-mini (cheap structured generation), instructor/outlines if you’re in Python, a noise lib (simplex-noise) for procedural structure, serverless (Vercel/Cloudflare Workers) so infinite worlds need no persistent infra.

How to Improve It

Limitations are the opportunity list:

1. Add a semantic-truth layer to kill content hallucination. Typed interfaces stop bad shapes; nothing stops bad facts. For WWMPedia especially, add a verification pass (cross-check generated claims against the retrieved evidence spans before rendering, à la a self-check or NLI model). This is a concrete, testable add-on and a real client-trust differentiator.
2. Actually put agents in the loop and measure. The biggest gap: run an LLM agent doing tasks inside a WWM vs. inside a DB-app and a generative-only world. Measure task success, consistency violations, cost. That turns this from a pattern paper into an evidence paper.
3. Make f_code itself partly LLM-authored, then frozen. Use the model offline to write and test new rules/effect-codes (expanding the vocabulary), promote them to code only after validation. Best of both: open-ended rule growth without runtime risk. AI Alchemy hints at this; formalize it.
4. Persisted deltas over pure regeneration. Pure hashing gives object permanence but forbids change — a planet can never be mined out, a city never grows. Add a small typed “delta log” keyed by seed so the world can evolve while staying deterministic-by-default. This is the missing piece for genuinely stateful multi-user worlds.
5. Quantify and auto-tune the fidelity slider. Learn (or rules-based control) when to pay for high fidelity vs. serve cache based on user attention/importance, with real latency/cost numbers. Makes the cost story defensible.
6. Multi-agent shared-world consistency under concurrency. The paper is mostly single-user. With many agents writing actions, you need transactional f_code (optimistic locking on the physics state). A natural extension of your MAS work and likely the hardest production problem.

Glossary

• World model — a system an agent can act inside to predict/experience outcomes; classically a learned neural simulator, here mostly code.
• WWM (Web World Model) — the paper’s pattern: world state/rules in web code, content from an LLM on top.
• Physics layer (S^φ) — deterministic code owning authoritative state (inventory, coords, rules, legality).
• Imagination layer (S^ψ) — the LLM’s stochastic output: descriptions, narrative, flavor, conditioned on physics.
• f_code — the pure function that computes the next physics state from the current state and an action.
• π_θ — “policy with parameters θ”; here just the LLM. ∼ π_θ(·|x) means “sample output given input x.”
• Typed interface — a TypeScript interface / JSON schema the model’s output must conform to; acts as a structural firewall.
• Constrained / schema decoding — generating text guaranteed to match a schema (e.g. Gemini responseSchema, instructor, outlines).
• Effect code — a token from a fixed vocabulary the rules engine knows how to execute (e.g. apply_burn); how generated cards stay safe.
• Deterministic hashing / seeding — turning a location into a fixed seed so generation is reproducible: same place → same world.
• Object permanence — a generated thing stays identical across revisits; here achieved for free via seeding, no storage.
• Procedural generation — creating content algorithmically from a seed rather than authoring or storing it.
• Graceful degradation / fidelity slider — falling back live-LLM → cache → template so the app works even when the model doesn’t.
• Neuro-symbolic — combining neural models (the LLM) with symbolic rules/structures (the typed code); WWM is a web-native instance.
• Cellular automaton — a grid where each cell updates by local rules each step (AI Alchemy’s falling-sand engine).
• JIT (Just-In-Time) — here, generating world state on first access instead of precomputing/storing it.