WorldLine

Carries the mechanism to systems it has never seen.
Replays one history as hundreds of worlds.
Replays one history as hundreds of worlds

Inspiration

Every serious software failure produces knowledge, yet remarkably little of that knowledge survives beyond the system in which it was discovered. What usually remains is a correction, a regression test, and perhaps an incident report, all closely tied to the implementation where the defect first appeared. Another system may contain the same underlying weakness, yet its engineers must rediscover the conditions that expose it because the original discovery was never represented in a form that could be transferred. As autonomous agents accelerate software development, this limitation becomes increasingly consequential: we are gaining the ability to produce and modify software at extraordinary speed without developing an equivalent ability to accumulate and reuse what engineering failures teach us.

WorldLine began with a more ambitious question than how to make agents write better code. What if software could systematically investigate the realities in which it fails, isolate the causes, and use those discoveries to challenge other systems? Answering that question meant moving beyond conventional agent orchestration toward a computational platform where execution, causal investigation, autonomous engineering, and independent verification form one continuous process.

What it does

WorldLine is a counterfactual software engineering platform that explores alternative execution realities, discovers transferable failure mechanisms, and governs autonomous software releases through independently verifiable evidence.

The platform begins by reconstructing a system's behavior within a deterministic simulation. It maintains separate representations of underlying truth, the information available to individual participants, and the conclusions produced by the evaluator, while a virtual clock preserves the distinction between when events occur and when information becomes available. WorldLine then creates alternative execution histories by introducing controlled changes such as delayed messages, dropped reports, duplicated events, corrupted information, revoked permissions, and clock skew. Each resulting world is evaluated against explicit behavioral invariants, producing a reproducible witness whenever a guarantee is violated.

Discovering a failing execution is only the beginning. WorldLine applies causal minimization to determine which interventions are actually necessary for the failure, then converts the resulting explanation into a Failure Genome, an executable representation of the mechanism that caused the system to break. Rather than storing the original event identifiers, a genome describes structural conditions and causal relationships that can be instantiated in another scenario.

Our flagship demonstration begins with a synthetic port security incident where a delayed correction causes an officer to make an escalation decision inconsistent with the simulated truth. WorldLine reduces the failure to the critical information delay, extracts its mechanism, and transfers that mechanism into a separate logistics scenario. There, delaying a retraction causes an operations center to reroute a convoy that should have continued. A deliberately resistant version of the logistics scenario does not reproduce the failure, showing that the genome distinguishes vulnerable behavior from superficially compatible conditions.

GitLab Duo connects these discoveries to autonomous engineering through specialized Investigator, Repairer, and Skeptic agents. Their work is constrained by an independent evidence kernel that recomputes reported results, verifies cryptographically sealed evidence, and authorizes releases only when the required guarantees are supported for the exact source revision. WorldLine therefore connects the discovery of failures to the engineering decisions that follow, without allowing an agent's confidence to substitute for verified execution.

How we built it

We developed WorldLine as a deterministic computing engine rather than an AI interface surrounding conventional tests. Its Python 3.12 core implements virtual clocks, reproducible event histories, controlled fault injection, seeded exploration, three valued invariant evaluation, causal minimization, and structural failure extraction. Every simulated participant receives only the information available to its role, while decision rules execute through a restricted predicate language rather than arbitrary generated code. This separation is essential because the platform must detect information failures without accidentally giving simulated participants access to the truth they are supposed to lack.

The exploration engine compares guided fault selection against a random baseline, using declared scenario structure and decision rules to prioritize potentially consequential interventions. When a failure occurs, delta debugging reduces its intervention schedule and independently verifies that removing any remaining intervention eliminates the target violation. Failure Genome extraction then replaces scenario specific identifiers with structural selectors, allowing the mechanism to be challenged against a second scenario and a negative control.

We integrated three custom GitLab Duo agents and three corresponding flows through GitLab's AI Catalog. The Investigator executes experiments and produces reproducible findings, the Repairer proposes implementation changes through actual merge requests, and the Skeptic challenges whether those changes genuinely resolve the underlying defect. These agents operate within a GitLab CI/CD lifecycle that includes automated testing, exploration, evidence verification, security scanning, release authorization, and deployment.

The independent kernel uses hash chained records and Ed25519 signatures to protect evidence integrity. It distinguishes results established through empirical execution from stronger forms of assurance and refuses unsupported claims, while GitLab Releases distribute the signed evidence and authorization records. We also built an interactive React and TypeScript interface that exposes alternative worlds, information timelines, causal differences, extracted mechanisms, and release evidence. The platform is available through GitLab Pages, with an independent verification service deployed on Google Cloud Run.

Challenges we ran into

The hardest architectural problem was preserving the distinction between what actually happened and what a software component could legitimately know. If a simulated decision maker receives future information, or if the evaluator silently treats missing observations as evidence of correct behavior, the entire counterfactual experiment becomes misleading. We addressed this through explicit information stores, independent temporal semantics, and invariant results that distinguish PASS, FAIL, and UNKNOWN, ensuring that missing evidence is represented rather than concealed.

Causal transfer introduced a different challenge because a useful failure mechanism must be abstract enough to operate outside its originating scenario while remaining specific enough to avoid false positives. Simply replaying the same event identifiers would not constitute transferable knowledge, whereas an overly broad description could make unrelated failures appear equivalent. Structural selectors, explicit preconditions, and a resistant negative control became essential to determining whether WorldLine had extracted a meaningful causal mechanism.

The autonomous engineering workflow exposed an equally important problem. A proposed correction can satisfy regression tests by preventing the problematic behavior from occurring at all, even when that behavior remains necessary for legitimate operation. During our GitLab Duo experiment, a repair proposal encountered exactly this criticism: GitLab Code Review identified the weakness, and subsequent skeptical evaluation rejected the correction for sidestepping the fault rather than properly tolerating it. We retained the unresolved merge request because it demonstrates why engineering autonomy requires independent judgment rather than automatic acceptance of plausible changes.

Accomplishments that we're proud of

WorldLine now demonstrates a complete sequence from counterfactual discovery to causal transfer and independently governed release, with executable results at each stage. In the recorded seed 42 experiment, guided exploration examined 69 alternative worlds and identified 23 failures, while random exploration examined 66 worlds and identified 20. WorldLine then reduced a failing schedule containing three interventions to a single critical delay, requiring three oracle calls and independently confirming that the resulting intervention was minimal.

The extracted Failure Genome successfully reproduced the corresponding decision failure in the separate logistics scenario, while the resistant control remained unaffected. Across five benchmark seeds, guided exploration discovered 44.5 failing worlds per 100 branches compared with 30.5 for random exploration, and identified the first target decision failure at an average branch index of 3.4 instead of 14.0. These results establish a measurable advantage within the documented synthetic benchmark and provide a reproducible foundation for expanding the research.

We are equally proud of the independent verification infrastructure. The demonstration produced 31 evidence records, including 16 independently attested records, and successfully authorized the exact source revision after verifying its requirements. Modifying a single evidence record caused authorization to be denied, while the GitLab release pipeline published a signed evidence bundle and authorization decision that can be inspected through the public Google Cloud Run verifier.

Perhaps the most important accomplishment is that WorldLine demonstrates meaningful refusal alongside successful automation. The verification system rejects manipulated evidence, release authorization rejects unsupported claims, and the agent review process can reject a repair even when its tests appear successful. Those are not simulated examples of how the platform might eventually behave; they are observed outcomes of the implemented system.

What we learned

Building WorldLine changed how we approached the relationship between testing, causal understanding, and software assurance. A failing test establishes that something went wrong under particular conditions, but it does not necessarily identify which condition was responsible or explain whether that weakness exists elsewhere. By combining reproducible execution with causal minimization and structural abstraction, we learned how to turn a local failure into a mechanism that can be tested beyond its original context.

We also discovered that independent verification is most valuable when it preserves the limits of what has actually been established. Cryptographic integrity can show that evidence has not been modified, but it cannot establish that an incomplete behavioral requirement is sufficient; similarly, passing tests cannot establish that a repair preserves all intended behavior. WorldLine addresses these distinctions through explicit evidence types, reproducible witnesses, resistant controls, and independent agent review, allowing its conclusions to remain connected to the experiments that support them.

What's next for WorldLine

The next major objective is to take Failure Genomes beyond scenarios sharing one simulation substrate and apply them to independently implemented software services. This would allow WorldLine to extract a failure mechanism from one system, identify corresponding vulnerable behavior in an unfamiliar application, reproduce the defect through its actual interfaces, and guide GitLab Duo toward a correction whose effectiveness is independently verified.

We also intend to expand the engine with symbolic exploration, more efficient reasoning over concurrent execution histories, and relational invariants capable of identifying information leaks and contradictions between individually correct components. A larger collection of previously unseen scenarios will make it possible to measure whether extracted genomes consistently identify genuine weaknesses without generating unacceptable false positives.

Our ambition is to make verified engineering knowledge cumulative. WorldLine already demonstrates how a failure discovered in one scenario can become an executable challenge to another, and how autonomous software engineering can remain accountable to independent evidence. The larger opportunity is a development infrastructure in which every understood failure becomes a reusable contribution to the reliability of systems that have not yet encountered it.

Built for GitLab Transcend 2026: Life After Code

WorldLine was developed for GitLab Transcend 2026, exploring what autonomous software engineering becomes when AI agents can discover failures, transfer causal knowledge across systems, and independently verify the evidence required for release.