# Mod Review Pipeline

Task: `TODOS.phase-72.72.14.2.5`

The V2 mod review pipeline queues submitted mods for automated scanning before
they can become publicly available. `FV2ModReviewPlan` records review cases,
scan jobs, scan results, approval decisions, human-review escalation, and public
release blockers.

## Policy

`BuildDefaultModReviewPolicy` enables:

- submitted-mod queueing
- malware scanning
- prohibited-content scanning
- performance-impact scanning
- automatic malware rejection
- human review for prohibited content and performance failures
- public release blocking until approval

The default automated queue is `ModReview.Automated`; human escalations route to
`ModReview.Human` with a 24-hour SLA.

## Queueing

`FV2ModReviewSubmission` captures the mod id, provider, provider submission id,
author account, package hash, package size, submission timestamp, and whether
the package must remain private until approval.

`QueueModReviewSubmissions` validates submitted mods and package hashes,
enforces queue capacity, creates a stable review id, and queues automated scan
jobs for:

- `Malware`
- `ProhibitedContent`
- `PerformanceImpact`

Each `FV2ModReviewScanJob` is automated, approval-blocking, and assigned to the
configured review queue.

## Decisions

`ApplyModReviewScanResults` applies automated scan evidence back to the queued
review cases. Clean malware, content, and performance results approve the mod
and clear the public release gate. Malware detection rejects the case before
public release. Prohibited content and performance-impact failures block release
and route the case to human review.

Performance scans compare measured frame-time and memory estimates against the
policy budgets (`MaxEstimatedFrameTimeMs` and `MaxEstimatedMemoryMiB`) even when
the scan result reports success.

## Verification

Run:

```bash
python3 V2/ue/Tools/check-v2-mod-review-pipeline.py
python3 -m json.tool V2/ue/Content/V2/Modding/ModReviewPipeline_V2_Contract.json
```

The focused checker verifies runtime types, queueing, malware scanning,
prohibited-content scanning, performance-impact scanning, human-review
escalation, public release gates, automation assertions, docs, CI/Horde wiring,
and TODO evidence for `72.14.2.5`.