Gazebo Simulates Robots Without Governing Their Plans

1. Vendor and Product Reality

Gazebo, originally developed at the University of Southern California in 2002 and stewarded since by Open Robotics (now under the Open Source Robotics Foundation following Intrinsic's stewardship of Open Robotics' commercial arm), is the de facto standard open-source robotics simulator across academia, defense research, agricultural robotics, and a substantial fraction of industrial robotics R&D. The current generation, Gazebo Sim (formerly Ignition Gazebo), is a modular successor to Gazebo Classic, designed for tighter integration with ROS 2 and for distributed simulation at scale. The simulator pairs a high-fidelity physics backend — DART, Bullet, ODE, and TPE among the swappable engines — with sensor plugins covering cameras, depth sensors, lidar, IMUs, GPS, force-torque, and contact arrays, all with configurable noise and bandwidth models that approximate real hardware.

The architectural shape is well-understood throughout the robotics community: Gazebo provides a server that simulates world state and physics; sensor plugins inject simulated measurements onto ROS topics identical to those produced by physical sensors; actuator plugins consume command topics and apply forces, torques, and velocities to simulated bodies; and a transport layer carries this between distributed nodes. Robot software — perception stacks built on ROS perception libraries, planners built on MoveIt 2 or Nav2 or custom search algorithms, controllers built on ros2_control — runs identically against the simulated and the physical robot. This sim-to-real continuity is Gazebo's defining value proposition and the reason it underpins programs from DARPA Subterranean and Robotics Challenges through agricultural autonomy startups, surgical robotics labs, and the broader ROS-Industrial consortium.

Gazebo's strengths are not in question: a deep ecosystem of world models and robot URDFs, mature ROS 2 bridges, a large and active research community contributing plugins and worlds, and a distributed-simulation architecture that scales to multi-robot scenarios with tens of agents. Within its scope — physical-world simulation that is faithful enough to develop and validate robot software — Gazebo is the reference implementation. What it does not do, and structurally was never designed to do, is govern the cognitive processes the simulated robot runs against that physical world.

2. The Architectural Gap

The structural property Gazebo's architecture does not exhibit is governance over the planning processes operating inside the simulated robot. The simulator faithfully validates whether a candidate trajectory is physically executable — does it satisfy joint limits, does it avoid collisions, does it respect contact friction, does it complete within time bounds. It does not classify whether that trajectory is a speculative branch under exploration, a committed strategy ready for execution, a contingency plan held in dormancy, or a risky branch that must be contained behind additional validation. The planning graph that produced the trajectory is opaque to the simulator and, more importantly, is opaque to the robot's own actuator interface, which sees only the trajectory itself.

The gap matters because feasibility is not appropriateness. A physically feasible plan that crosses a body of water of uncertain depth, traverses a slope near tip-over limits, manipulates an object whose mass distribution is poorly modeled, or executes a path through a region with sparse sensor coverage is feasible in the simulator's contact-physics sense and inappropriate in any real-world governance sense. Today this is closed by ad hoc cost functions in motion planners — the planner penalizes risky behavior numerically and hopes the cost surface produces acceptable behavior. That approach collapses speculation, commitment, and contingency into a scalar minimization, eliminating the structural distinction between "this plan is being explored" and "this plan is about to be executed." A regulator, an integrator, or a downstream executive layer asking "show me the speculation lineage that led to this committed action" gets a planner trace, not a governed planning graph.

Gazebo cannot patch this from within its architecture because the simulator is a world-model, not a cognitive-model. Adding telemetry around planner internals produces logs; adding visual debug overlays produces debugging tools; adding cost-function libraries produces still richer scalarization. None of those produces a governed planning graph with credentialed branch classification, executive aggregation across competing branches, or containment boundaries that prevent speculative branches from leaking into actuator commands. The forecasting structure is a property of the cognition, not of the world; a simulator that faithfully models the world cannot, by its construction, govern the cognition that operates over that world.

3. What the AQ Forecasting-Engine Primitive Provides

The Adaptive Query forecasting-engine primitive specifies that planning be carried out within a governed planning graph composed of explicit branches with structural classification, containment, and executive aggregation. Each candidate plan exists as a node in the graph with a credentialed branch classification: exploratory branches are flagged as such and confined behind a containment boundary that structurally prevents their leakage into actuator commands; committed branches are admitted only through executive aggregation that resolves competing objectives across the branch set; contingency branches are held in dormancy with credentialed conditions for their activation. The classification is structural, not annotative — the actuator layer reads the branch class and refuses to execute uncommitted branches by construction.

The containment boundary is the load-bearing element. Speculation inside containment may proceed at high bandwidth — many candidate trajectories, aggressive sampling, novel approach evaluation — without any risk of actuator leakage, because the boundary is a property of the graph, not a discipline of the programmer. Promotion across the boundary is a credentialed governance event with lineage: which observations supported the promotion, which executive policy admitted it, which alternative branches were dominated, what the reversibility profile of the committed plan is, and what the contingency set looks like at the moment of commitment. The primitive structurally distinguishes intent from execution and produces forensic-grade reconstruction of any planning episode.

Executive aggregation composes branches into a governed actuation under a published policy. A faster-but-riskier branch is weighed against a slower-but-validated branch not as a scalar cost minimization but as a governed comparison under credentialed weights — operational risk, mission urgency, reversibility, sensor confidence, jurisdictional policy. The output is a graduated outcome from a defined mode set: commit, defer, request additional observation, refuse. The primitive composes hierarchically; an agent's planning graph is itself a credentialed observation in a fleet-level forecasting engine, which is in turn an observation in mission-level governance. The primitive is technology-neutral with respect to the underlying planner (MoveIt, Nav2, OMPL, behavior trees, classical search, learned policies all admit) and is disclosed under the AQ provisional family as a structural condition for governed robotic and agentic planning.

4. Composition Pathway

Gazebo composes with AQ as the world-model substrate beneath an AQ-governed cognition stack. What stays at Gazebo: the physics engines, the sensor plugins, the actuator plugins, the world models, the URDF ecosystem, the ROS 2 bridges, and the entire research and developer ecosystem that has accreted around Open Robotics for two decades. Gazebo's investment in faithful physical simulation remains its differentiated layer; AQ does not seek to replicate or replace it.

What moves to AQ: the planning graph above the planner, the branch classification, the containment boundary, the executive aggregation, and the lineage record that ties committed actions back through the speculation that produced them. Concretely, the integration adds an AQ-governed planning shell between the application-level mission interface and the existing motion planners. Mission-level intents are admitted as credentialed observations and instantiated as exploratory branches; the underlying planners (MoveIt 2 for manipulation, Nav2 for navigation, custom behavior trees for higher-level policy) are invoked inside containment to materialize candidate trajectories; the trajectories are classified, governed by executive aggregation against credentialed policy, and only committed branches are released to ros2_control and from there to Gazebo's actuator plugins or to physical hardware. The substitution of Gazebo for hardware happens, as today, transparently to the cognition stack.

The integration unlocks new operational territory for Gazebo users. Defense and dual-use programs that today struggle to satisfy DOD AI ethical-principles conformance for autonomous systems gain a structural answer to "how does the system distinguish speculation from commitment." Agricultural and field-robotics deployments where a physically feasible but inappropriate plan would damage equipment or environment gain a containment property that is enforced by the planning architecture rather than by careful cost-tuning. Multi-robot coalitions running distributed Gazebo simulations gain a governance fabric in which each robot's planning graph publishes credentialed branch observations to a coalition-level forecasting engine, enabling coalition-coherent commitment across agents whose individual planners would otherwise commit independently. The new commercial layer is governance-as-substrate for Gazebo-grounded development pipelines through to fielded deployment.

5. Commercial and Licensing Implication

Gazebo itself is open-source under Apache 2.0 and is not a commercial vendor in the SailPoint or Lakera sense; the commercial surfaces are Intrinsic, Open Robotics' service partners, and the integrators and platform vendors that productize Gazebo-based pipelines. The fitting arrangement is therefore a substrate license to those productizers — robot OEMs, autonomous-systems integrators, defense primes, agricultural-robotics platform vendors — embedding the AQ forecasting-engine primitive into their cognition stack and sub-licensing planning-graph governance to their end customers. Pricing aligns with mission-class or per-fleet rather than per-seat, matching how operators of governed autonomous systems actually consume planning governance.

What the integrator gains: a structural answer to autonomy-conformance regimes (DOD 3000.09, EU AI Act high-risk autonomous systems, ISO 22989/8800 functional-AI safety, NIST AI RMF) that increasingly examine the cognitive architecture and not merely the physical-safety envelope; a defensible architectural moat against in-platform planners from hyperscaler robotics offerings (NVIDIA Isaac, AWS RoboMaker, Microsoft Project Bonsai successors) by elevating the floor from "we use a fast planner" to "we govern planning structurally"; and a forward-compatible posture for autonomy procurement programs that are converging on credentialed-lineage requirements. What the operator gains: portable forensic reconstruction of any autonomous decision, cross-vendor planning governance that survives platform migrations, and a single forecasting-engine fabric spanning simulated development through fielded operation under one authority taxonomy. Honest framing — the AQ primitive does not replace Gazebo or the planners that run inside it. It gives the cognition stack the governance graph that planning has always needed and never had.