OpenSpatials

Spatial Fabric Viewer

Portable spatial worlds, verified before they render.

A spatial fabric packages a scene, its behavior, and referenced assets into one signed object. Spatial Fabric Viewer checks that object, runs its behavior behind a narrow capability boundary, composes the result, and renders it through Google Filament.

Current scope One signed fabric kernel. Not a browser, a trust service, or a complete general-purpose game engine.

A signed spatial fabric represented as connected nodes passing through verification rings into a luminous rendered space.
Package integrity, capability admission, scene composition, and rendering remain distinct layers.

Signed packageScene, behavior, and asset hashes travel together.

Default denyGuest behavior receives only the Scene ABI capabilities it needs.

Host-owned edgesI/O, lighting, avatars, collision, and service access stay outside fabric authority.

How it works

One portable object. Five guarded transitions.

The viewer does not start by drawing whatever it receives. It admits each layer in order and refuses mismatched or unauthorized input before it can shape the scene.

  1. Package

    A compact .msf carries the signed manifest, behavior references, and content hashes.

  2. Verify

    The signature chain and referenced module bytes must match the repository's bundled trust anchors and signed hashes.

  3. Execute

    Matched WebAssembly runs behind a default-deny Scene ABI with bounded handles, budgets, and session silos.

  4. Compose

    Scene output, assets, and bounded child fabrics become renderer-ready records without erasing their trust boundaries.

  5. Render

    Google Filament draws the admitted scene on WebGL2 while host navigation can approach and re-root by precision domain.

Implemented and proven now

A renderer kernel with more than a draw call.

These are current, evidence-backed capability families. Each is deliberately narrower than a claim of broad engine, protocol, or production readiness.

Trust

Fail-closed package admission

Compact JWS and x5c verification, module-hash checks, and a renderability gate refuse invalid input before execution.

Composition

Bounded child fabrics

Nested fabrics compose through explicit graph caps; a parent's trust does not automatically confer trust on a child.

Content

Procedural and glTF paths

Fabric primitives, static meshes, self-contained rigged assets, animation, morphs, and PBR material inputs meet at deliberate seams.

Presentation

Faithful and enhanced modes

One renderer contract supports faithful fabric interpretation plus host-owned lighting and selected post-processing.

Navigation

Orbit, flight, and precision re-root

Host cameras can navigate a fabric and re-root rendering state across precision domains without claiming native session teleport.

Avatar

One portable local session

Engine-neutral locomotion, animation, retargeting, planning, IK, and opt-in collision feed one Filament adapter.

Technology layers

The boundaries are the architecture.

Each layer has one job. Keeping those jobs separate prevents a content package from quietly acquiring network, identity, avatar, environment, or service authority.

Proof layer

Mutation-sensitive trust, capability, visual, structure, and service checks must fail when the claimed seam is removed.

Evidence is scoped to its recorded fixture, browser, machine, and load.

Avatar and world systems

Portable avatar cores publish state and poses; the host owns the Filament adapter and optional deterministic collision provider.

One local avatar session today; no shared-world or multiplayer claim.

Host compositor

The host resolves bytes, records scene output, composes child graphs, owns environment choices, and crosses precision seams once.

Content cannot fetch arbitrary resources or select host chrome.

Signed Fabric trust and lowering

Signature and hash checks precede a bounded Scene ABI; Halogen-style primitives and self-contained glTF become render inputs.

Bundled anchors are not a public-PKI or standards-conformance claim.

Google Filament

The pinned WebGL2 runtime owns the GPU engine, views, cameras, lights, materials, geometry, post-processing, and frames.

Filament is the render runtime, not fabric authority.

What makes it different

Rendering begins with admission control.

Trust precedes pixels. Guest bytes do not get an optimistic path to the scene.

Capabilities are named. The Scene ABI is intentionally smaller than the browser or host.

Precision has domains. Nested spatial fabrics can remain distinct instead of pretending one coordinate frame fits every scale.

Proof must be able to fail. A live API symbol is not accepted as evidence that a feature works.

Honest boundaries

A focused kernel, not an unfinished claim.

Spatial Fabric Viewer is designed to bring one signed fabric to life. It is not presented as a full game engine, a browser, a production-scale service, or automatic conformance with a wider spatial standard.

Planned — not shipped

The next product families stay visible.

Planned work is named here so it is not mistaken for a current capability.

  • Shared world queries and authored collision proxies
  • Terrain and vegetation
  • Multiple avatar sessions and interaction intent
  • Route following and navigation search
  • Facial expressions, visemes, attachments, and reach
  • Moving platforms and externally controlled avatars