MarutAI | The Science of Autonomy

Research

VATS

The model-construction system that turns a growing data foundation into bounded decision-making.

Catalyst determines what the system needs to learn next. VATS uses that knowledge to construct decision models, test them against operational world models and synthetic edge cases, and define the boundaries carried into their agent harnesses.

MarutAI Research

Why Model Construction Matters

When an AI system controls a real operation, it makes a sequence of decisions under uncertainty. It needs a model of how that operation behaves, evidence about where the model is reliable, and clear limits on the actions it may take.

Catalyst supplies the data foundation and identifies where knowledge is incomplete. VATS builds on that foundation with an operational twin, synthetic boundary regimes, candidate policies, and an admissibility layer over the modeled state and action space. The same specifications are used to build the agent harness.

What VATS Produces

VATS is the model-construction and admissibility-specification layer. It couples five components into a pipeline that produces an application-specific decision model, its admissibility envelope, its verification artifacts, and the assumptions that must remain valid during operation.

The VATS System

\mathcal{V} = (\mathcal{T},\; \Sigma,\; \Pi,\; \mathcal{C},\; \mathcal{M})

$\mathcal{T}$ : calibrated operational model

$\Sigma$ : boundary-targeted synthetic regime generator

$\Pi$ : diversified candidate policy family

$\mathcal{C}$ : formal admissibility constraint filter

$\mathcal{M}$ : runtime assumption monitor

The output is an application-specific decision model coupled to a calibrated operational model, a structured scenario generator, a policy family with uncertainty signals, a formal admissibility envelope, an assumption monitor, and the evidence artifacts used to explain the construction and constraint boundary.

What VATS Evaluates

VATS evaluates proposed actions and modeled state transitions against explicitly encoded operational constraints. An admissible result means the action satisfies those constraints within the calibrated operational model and stated assumptions.

The result does not establish general model correctness or safety outside that boundary. It does not cover unmodeled states, missing constraints, or real-world behavior that falls outside the conservative twin abstraction.

The verification boundary is deployment-specific: the current state, candidate action, reachable successor states, unsafe-state definition, fallback policy, and validity assumptions are explicit inputs to the construction process.

The Model-Production Pipeline

VATS is an iterative model-production pipeline with five stages. Each stage produces an artifact that feeds into the next. When runtime monitoring detects assumption drift, the affected action is blocked, a defined fallback or human review path is invoked, and the model enters recalibration and re-verification.

\mathcal{T} \rightarrow \Sigma \rightarrow \Pi \rightarrow \mathcal{C} \rightarrow \mathcal{M} \circlearrowleft

𝒯

Operational Modeling

Use the data curated through Catalyst to calibrate an operational world model. The model captures system dynamics and becomes the foundation for scenario generation, policy evaluation, and formal analysis.

Regime Synthesis

Generate twin-conditioned synthetic trajectories targeting boundary regimes, fault-adjacent states, and recovery regions. Coverage is structured by operational risk, not random augmentation.

Candidate Intelligence

Train diverse candidate policies across the synthesized regime distribution. Policy disagreement provides a structured uncertainty proxy for downstream admissibility decisions.

𝒞

Admissibility Filtering

Restrict the deployable action set to those that preserve stated safety invariants under the twin abstraction. Actions outside the admissible set are blocked from deployment.

ℳ

Assumption Preservation

Monitor at runtime whether the assumptions under which admissibility was established continue to hold. Drift beyond stated assumptions blocks affected action and triggers fallback, escalation, recalibration, and re-verification.

↺

Recalibration

Assumption drift triggers re-entry: updated telemetry recalibrates the twin, reshapes the scenario distribution, and initiates re-verification.

What Gets Deployed

The deployable controller is not the raw ensemble. It is a shielded controller that admits only actions evaluated as admissible under the twin abstraction and stated assumptions.

Controlled Transition System

\mathcal{T} = (S,\; A,\; P,\; \ell)

$S$ : state space

$A$ : action space

$P(s' \mid s, a)$ : transition kernel

$\ell$ : labeling map over operational properties

Let $U \subseteq S$ denote unsafe states. Let $\Pi = \{\pi_1, \ldots, \pi_n\}$ denote an ensemble of candidate controllers. Let $\pi_{\mathrm{ens}}$ be the ensemble proposal rule. The deployable controller is a shielded controller $\pi^\star$ .

Definition 1: Safe Action Set

For any state $s \in S$ , define

A_{\mathrm{safe}}(s) = \{a \in A : \forall s' \in \mathrm{Post}(s, a),\; s' \notin U\}

where $\mathrm{Post}(s, a)$ is the set of successor states reachable from $s$ under action $a$ .

Definition 2: Shielded Controller

\pi^\star(s) = \begin{cases} \pi_{\mathrm{ens}}(s), & \text{if } \pi_{\mathrm{ens}}(s) \in A_{\mathrm{safe}}(s),\\ \mathrm{backup}(s), & \text{otherwise}, \end{cases}

where $\mathrm{backup}(s) \in A_{\mathrm{safe}}(s)$ .

Safety Objective

\mathsf{G}\,\neg U

The system globally avoids unsafe states.

Stated Assumptions

The safety property $\mathsf{G}\,\neg U$ holds under the following explicit assumptions:

The initial state is safe: $s_0 \notin U$
$A_{\mathrm{safe}}(s)$ is nonempty at every reachable state
A trusted backup policy $\mathrm{backup}(s) \in A_{\mathrm{safe}}(s)$ exists and is well-defined
The twin abstraction is conservative: every real successor is contained in the concretization of the abstract post-state

This is a model-relative safety property. The guarantee holds to the extent that the twin abstraction is conservative with respect to the physical system.

Proof Sketch

If $A_{\mathrm{safe}}(s)$ is computed from a conservative twin abstraction and the deployed controller always chooses $a \in A_{\mathrm{safe}}(s)$ , then no one-step transition enters $U$ .

By induction, every trajectory of the deployed controller satisfies $\mathsf{G}\,\neg U$ .

From Construction to Operation

VATS builds the decision model and defines its admissibility specification. Those outputs are used to construct the harnesses that evaluate model and agent actions in the application context.

Manifest deploys and operates the models, harnesses, agents, and workflows. It applies constraint decisions, tool permissions, approvals, monitoring, fallbacks, and escalation behavior in the customer environment.

Trust & Verification Scope →

Construction Outcomes

When the five components operate together, the construction process produces properties that the individual techniques do not provide in isolation.

Twin + Scenario Generator

Targeted Regime Coverage

Training extends into boundary transitions, recovery trajectories, and stress conditions via twin-conditioned scenario synthesis. Coverage is structured by the operational model, not limited to historical log distributions.

Ensemble + Scenario Generator

Structured Uncertainty Proxy

Ensemble disagreement provides a practical, interpretable signal of model uncertainty at each decision point. This signal informs admissibility decisions and can trigger escalation or fallback under stated conditions.

Twin + Formal Shield

Model-Relative Admissibility

Admissible behavior is constrained by a safety envelope defined over the same operational model used for training and evaluation. Guarantees are relative to the twin abstraction and its stated assumptions.

All components

Assumption-Aware Adaptation

New operating data feeds Catalyst, exposing gaps and strengthening the next model cycle. VATS uses that improved foundation to recalibrate the world model, update verification assumptions, and repeat verification.

Scientific Interpretation

VATS follows the structure of a scientific workflow, maintaining a disciplined relationship between model, evidence, competing hypotheses, and admissible action.

Scientific Function	VATS Component
Model of the world	Calibrated twin
Hypothesis stress-testing	Synthetic scenarios
Competing candidate actions	Ensemble policies
Constraint verification	Formal shield and proofs
Continuous validation	Runtime monitoring

The deployable model is the shielded ensemble: $\pi^\star = \mathrm{Shield}(\pi_{\mathrm{ens}},\, \mathcal{T},\, U,\, \mathrm{backup})$ .

Catalyst keeps improving the data foundation. VATS uses that foundation to build the decision models and their agent harnesses. Manifest deploys and operates those models and controls under the assumptions defined for the customer deployment.