# RC.3 My Realm economy and Realm Surf integration audit Date: 2026-07-22 ## Decision The V7 libraries contain real deterministic simulation, commerce, governance, persistence, gateway, and safety-policy code, but they do not currently expose the product authorities required by RC.3. My Realm cannot yet publish an overnight ticker or execute its three writebacks without inventing visitors, sales, and mutation success. Realm Surf remains gated on the already-declared network runtime and vendor-wired safety boundary. The Rail and its existing channels are unaffected. Neither My Realm nor Realm Surf should be registered until the authorities below are runnable. ## What Crucible produces `libs/maya/crucible-core` is a real deterministic headless scenario simulator. Its `SimulationResult` contains: - a match outcome and per-agent combat/objective statistics; - sampled `EconomySnapshot` records with team-keyed resource totals, currency balances, and item inventories; - power-curve samples; - a typed event log; and - a final deterministic state hash. In the present implementation, however, the economy system adds the same `10 + economy.resource_bonus` resource amount to every scenario team each tick and emits one `resource_tick` event targeting `all`. Currency balances and item inventories are part of the result shape but are not mutated by the headless loop. The simulator has no realm identifier, visitor/session event, catalog listing, stock unit, sale transaction, incident, or wall-clock/night window. Its checked-in scenarios are game-balance scenarios, not persistent Mawu realm days. That output can truthfully support Crucible balance analysis. It cannot be renamed into a realm's visitor count, sales total, sell-out, or incident feed. `libs/maya/crucible-live` consumes already-measured win/pick rates, sentiment, drift, anomaly, and meta reports to produce live-operations dashboards, alerts, and evidence-gated hotfix proposals. “Live” here means balance telemetry. It does not connect to a Mawu realm, stream UGC, advance an economy, or persist a creator action. ## Relevant V7 authorities that do exist The audit also traced the adjacent V7 implementations rather than treating the Crucible package names as the whole product: - `apps/v7/moremi-realm-server` contains substantial Nàná ledger, purchase, tax, property, civic, and job evaluation logic. - `apps/v7/nephthys-replica-service` can append realm economy ledger events, checkpoint aggregates, rebuild projections, and byte-verify restart recovery. - `apps/v7/abundantia-market-service` contains catalog publication, direct-sale and subscription payout formulas, dependency revenue, currency firewalls, fraud evaluation, realm health, and creator-program logic. - `apps/v7/eunomia-governance-service` validates and executes governed rule change records with tier and safety-floor checks, plus proposal lifecycle and voting logic. - `apps/v7/mawu-gateway` contains real origin shielding, capability policy, attested-client checks, and platform-owned voice safety decisions. These are useful building blocks, but they are not wired into the requested Rail flow. The Abundantia and Eunomia runnable Node services currently expose only `GET /health`; their production functions operate on caller-supplied records and return calculated reports. There is no authenticated read endpoint for a realm's bounded event window and no write endpoint for a price change, collaboration approval, or governed patch. Nephthys exposes an in-process Rust API, not a Rail-consumable network contract, and its existing economy fixtures do not supply visitor or inventory sell-out semantics. ## Why the My Realm tasks remain open An honest overnight ticker needs a versioned, realm-scoped source record with: - a stable realm and creator identity binding; - a UTC window and source cursor; - deduplicated visitor/session events; - authoritative sale lines with quantity, listing, currency, and inventory effects; - notable simulation/incident events; and - a source state hash or sequence proving the projection belongs to that realm. None of the inspected APIs produces that record today. Compiling fixture purchases or generic Crucible `resource_tick` events into a tile would be a canned demo, not “what actually happened overnight.” The micro-acts likewise require executable, idempotent, authenticated commands: - **approve a collaboration** must advance a real proposal or collaboration state and return its committed version; - **adjust a price** must mutate the authoritative listing with ownership, currency, safety, and optimistic-concurrency checks; and - **greenlight a patch** must traverse Eunomia's actual proposal/safety-floor path and persist the execution, not merely calculate an execution record. No currently runnable service offers those command surfaces. Therefore a Rail adapter cannot prove round-trip writeback and the My Realm tile, drips, acts, and their tests remain unchecked. ## Realm Surf gate `crucible-live` is not a realm broadcast runtime. Mawu's gateway and safety policy code can evaluate traffic and fail-closed platform-tap rules, but the V7 audit still identifies the end-to-end network/client runtime and live vendor dispatches as incomplete. There is no production realm media source contract for the RB.3 video substrate, and no vendor-configured moderation decision in front of executable UGC bytes. Realm Surf must therefore remain unregistered. ## Reopen criteria My Realm implementation can start when V7 provides all of the following: 1. a versioned realm-overnight projection generated from authoritative Moremi/Nephthys/Abundantia event sequences, including visitors, sales, inventory effects, and incidents; 2. authenticated creator ownership/entitlement checks and stable cursor/window reads; 3. idempotent, persisted collaboration, price, and governed-patch command endpoints with optimistic concurrency and auditable receipts; and 4. a test harness that advances a known realm night, reads the projection, executes each command, restarts or rehydrates the authority, and observes the committed changes. Realm Surf additionally requires a real realm media/session source on the shared streaming substrate and vendor-backed platform moderation configured ahead of every executable UGC path. Missing configuration must remain a hard denial.