# Performance, Build, Security, Testing & Launch V6 — **Egbe, the Agentic Companion Universe** — is one Unreal Engine 5 world whose inhabitants are _generated agents_: each Ori (a companion's append-only biography) drives a three-tier cognition kernel that calls a hosted model, and a single Commons gathering can hold thousands of them while a player watches a hundred and fifty draw on screen. So the question this page answers — _how do you know this build is good enough to ship?_ — has no single answer, only a composition: a per-platform agent-density budget a Steam Deck and a PS5 are held to separately; a 20 Hz authoritative world tick proven by a Rust benchmark; a cost ceiling that keeps three tiers of model spend inside a launch DAU projection; a passport that is signed and _minimised_ before it crosses into another game; a behaviour-eval set that must stay green before any cognition change merges; and a launch gate that refuses to go green while any of those disagrees. This page is the quality spine that ties them together — **performance budgets, build/cook/patch, security and compliance, testing and the eval gates, and launch readiness** — and it is deliberately honest about which parts are running code, which are machine-checked policy, and which are documented obligations no live deployment yet satisfies. The defining posture, shared with V2/V3/V5, is that V6 _invents none of the foundations_ it can compose, and that a gate's green is worth nothing unless it is _unforgeable_. The section hub is [../V6_ARCHITECTURE.md](../V6_ARCHITECTURE.md). ## What ships, honestly The **testing surface is real and engine-integrated.** `V6Tests` (`V6/ue/Source/V6Tests/`) carries **37 `IMPLEMENT_SIMPLE_AUTOMATION_TEST` cases across 20 test-bearing `.cpp` files** (~3,200 lines) under the `V6.*` namespace, and the module links genuine engine subsystems — `MassLOD`/`MassRepresentation`/`PCG`/`Niagara`/`LevelSequence`, plus `StateTreeModule`/`StateTreeEditorModule` editor-only because the agent-behaviour tests _author and compile a StateTree in process_ via `FStateTreeCompiler` (`V6Tests.Build.cs`). The **Rust core is real**: `apps/v6/Cargo.toml` is a workspace of **seven service crates** (`egbe-world-server`, `egbe-moirai-cluster`, `egbe-realtime-gateway`, `egbe-pxstream-relay`, `egbe-ori-service`, `egbe-clio-service`, `egbe-foundry-service`) and four library crates (`ori-model`, `moirai-kernel`, `agent-behavior`, `egbe-protocol`), with `unsafe_code = "forbid"`. The **TS agent stack** (`libs/v6/`) is 19 packages with 22 spec files and ~211 `it`/`test` blocks. The **performance and security gates cross-validate** rather than assert. Two honest qualifications carry through the page. **First**, V6's _observability_ is not the shared `@oshun/metrics`/`@oshun/tracing` spine. The architecture names a `V6Telemetry` C++ module as a "batched OTel emitter" (`V6_ARCHITECTURE.md` §"Subsystem Glossary"), but in-repo `V6/ue/Source/V6Telemetry/` is a **50-line module-contract scaffold** — an `FV6TelemetryModule : IModuleInterface` with `StartupModule`/`ShutdownModule` and nothing instrumented — and a grep for `@oshun/metrics`, `@oshun/tracing`, `opentelemetry`, or a Prometheus `/metrics` endpoint across `libs/v6`, `apps/v6`, and `V6/` returns **nothing**. The shared libraries are real and substantive in the monorepo (`libs/shared/metrics/src/registry.ts` is a prom-client wrapper); V6 has not yet adopted them in-service, and the honest framing of V6 observability today is the **eval / cost / welfare-telemetry contract gates** below, not a per-service RED-metrics family. **Second**, V6 ships **zero binary `.uasset`** — the six Districts of Orun are _procedural UE5 C++ grounds_, not authored levels — so the "content" the launch gate checks is logic, config, and named tests, and the per-platform frame-time numbers are **declared measurements gated against thresholds and cross-validated arithmetic**, not a live GPU profiler readout in CI. With both qualifications named, the **launch gate is honestly green** — and that is the load-bearing difference from V5 and V3, whose gates are correctly red. V6 was driven to completion; the green is real because the machinery makes it unforgeable, and the work that genuinely cannot be done in-repo stays honestly `[~]`. ## Performance budgets ### Agent-density LOD and the draw-unit model The headline budget is _agent density_, because a hundred and fifty embodied companions on a phone and on a console do not share a draw-call reality. `V6/performance/rendering-budgets.v6perf.json` declares **nine platform profiles** (Win64, Mac, Linux, PS5, XSX, iOS, Android, the Pixel Streaming worker, and the Tier-2 web fallback) over a fixed 150-agent ground, each carrying per-platform caps (`maxNearPawns`, `maxMidMassAgents`, `maxAgentDrawUnits`) and a `measurement` block (`sustainedFps`, `p95FrameMs`, `peakResidentMemoryMb`, `estimatedDrawUnits`). The gate that enforces it, `scripts/v6/verify-v6-rendering-budgets.mjs`, does domain-specific verification a renamed-variable stub could not pass. It binds the JSON to the real engine config: it reads `[V6.MassEntity]` from `V6/ue/Config/DefaultEngine.ini` and asserts the cap class for every profile matches (`MaxNearAgentsDesktop=64`, `…Mobile=24`, `MaxAgentDrawUnitsTier2=100`, …). Then it **re-derives the expected LOD counts** — `computeExpectedDensityCounts` walks the 150 agents at `distanceStartCm + index*distanceStepCm`, buckets them into near pawns / mid Mass-instanced / far silhouettes against the radii, and computes `estimatedDrawUnits = near*4 + mid*1 + (far>0 ? 1 : 0)` — and requires the JSON's measured counts to _equal_ that arithmetic. It rejects any profile whose `sustainedFps < targetFps`, `p95FrameMs > maxP95FrameMs`, `peakResidentMemoryMb > maxResidentMemoryMb`, or `estimatedDrawUnits` over cap, and it **self-tests its own fail-closed seam**: it mutates a profile's `p95FrameMs` to over-budget and asserts the verifier would catch it (lines 137–142). Two independent readers must agree with the data — the Python-style arithmetic in the verifier and the `.ini` config — which is how the budget gets _enforced_ rather than documented. The C++ side is genuine Mass Entity logic, not a manifest validator. `FV6AgentDensityLODBudgetTest` (`V6.Agent.DensityLOD.Holds150AgentDrawBudget`, `V6AgentDensityLODTests.cpp:75`) builds 150 `FV6AgentDensityLODInput`s, calls `UV6AgentDensityLODLibrary::PlanDensityLOD`, and asserts near-pawn and mid-Mass caps hold, that far silhouettes use `EMassRepresentationType::StaticMeshInstance`, and that `Summary.bWithinDrawBudget`. A companion test (`HoldsFestivalTierGatheringBudget`, `:236`) pushes a **4,096-agent festival gathering** through the same planner and proves only 150 stay visible while the rest become dormant — so a Commons crowd never blows the draw or the cognition budget. The honest line: the _draw-unit counts_ are recomputed deterministically and cross-checked against config; the _frame-time and memory figures_ are declared measurements held below per-platform thresholds, not a live profiler trace in CI. ### Latency budgets, and one honest "measurement pending" `V6/performance/latency-budgets.v6perf.json` pins the interactive budgets: a **20 Hz / 50 ms** authoritative world tick, a Clotho decision inside its 1–4 Hz planning budget, **≤ 400 ms** voice-to-parsed-intent and **≤ 1 s** to a spoken reply, a **≤ 3,500 ms** Chronicle ready-to-read, and a **≤ 50 ms** Shard / Threshold transition stall. The world-tick assertion is backed by a _real_ test, not a number: `observedMs: 12.8` over `sampleCount: 80` at `agentCount: 150`, sourced from `cargo test -p egbe-world-server world_tick_holds_twenty_hz_with_one_hundred_fifty_agents` with the evidence trail `benchmark_world_tick(150, 80, …)` → `report.held_twenty_hz`. The manifest is candid where it cannot measure: the **escalation-rehydration grace** carries a `budgetNotes` entry stating the 500 ms figure is a _"Target only. Budget adopted 2026-06-12 … no observed measurement exists yet and no assertion below claims one. Measurement pending."_ That is the standard's honest-label posture written into the data — a target named without a fabricated measurement behind it. ### Sustained and Commons-scale load Two load budgets sit at the launch boundary. The **7-day sustained load** run (`sustained-load.v6perf.json`) targets **10,200 agents per region** (10,000 Lachesis + 200 Clotho) across `iad`/`fra`/`sin` with `requiredOriLossCount: 0`, and the **Commons-scale** run replays the 4,096-agent / 150-visible festival with cognition within budget. These are real specifications with verifiers (`verify:v6 sustained-load`, `verify:v6 commons-scale-load`), but executing them at scale needs live regional infrastructure, so the _launch-criteria_ rows that demand a real multi-day run stay honestly `[~]` (see Launch readiness). ## Build, cook, patch V6 reuses V3's UE5 build/cook/patch pipeline rather than inventing one, and the reuse is machine-checked. `V6/ue/Build/validate_v6_cook_matrix.py` parses the BuildGraph (`Build/Build.xml`) and the engine `.ini`s _without executing a cook_ and proves coverage exists for **seven client platforms** (Win64, Mac, Linux, PS5, XSX, iOS, Android) and **two Pixel-Streaming-worker platforms** (Win64, Linux): each must have a `Cook V6 Client

Shipping` node carrying `-build -cook -stage -pak -archive -map=$(PlayableMap)` and a `Boot … Shipping` node running `UE.BootTest`. It also asserts the worker boots headless (`-RenderOffScreen`), that `DefaultGame.ini`'s `[V6.CookMatrix]` lists exactly those platforms and the `V6` / `V6PixelStreamingWorker` targets, that all ten Game Feature roots (the six Districts plus the Solo/Co-op/Commons/Incarnation modes) are in `DirectoriesToAlwaysCook`, and that `PixelStreaming.ini` carries the worker launch flags (`-Unattended`, `-PixelStreamingEncoderCodec=H264`). Cook profiles for the XR targets (`Quest3_OpenXR`, `VisionPro_OpenXR`, `PSVR2_OpenXR`, `SteamVR_OpenXR`) live under `Build/CookProfiles/`. The Rust services build through the Nx `nx:run-commands` executor and ship as containers, and the V6 contracts in `libs/contracts/src/v6/` generate UE C++, Rust, and TS bindings as a pre-build step — one source of truth across the three runtimes. ## Security, privacy, compliance V6 inherits V1's posture wholesale by _composing_ the shared libraries, and the evidence is checked in under `V6/security/`. The **privileged-access audit** (`privileged-access-audit.v6security.json`) is the spine: it pins five V1 OAuth scopes with role floors — `v6:steward:read`/`act` at user, `v6:operator:action` and `v6:ori:read` at admin, `v6:audit:read` at super-admin — and requires every privileged surface to emit a `@oshun/audit-platform` event. Every Egbe operator action (commons moderation, incarnation governance, capacity acknowledgement, takedown) and every privileged Ori read is mapped to a named audit action and a _real runtime function_: `operator_read_ori_stream` and `operator_read_ori_projection` in `apps/v6/egbe-ori-service/src/lib.rs`, each carrying `@oshun/data-residency` metadata and a retention tag, plus a Commons `residency.transfer.memory` event on every cross-region memory move. Operator access requires a verified OAuth session **and** MFA. The tiered-stack additions are principally Pixel Streaming, and they reuse V3's abuse machinery rather than re-deriving it. `pxstream-abuse-passport-minimisation.v6security.json` admits sessions through `/api/v6/pxstream/admission/evaluate` _before_ leasing a GPU worker, honouring V3's idle (90 s prompt / 150 s disconnect), per-user (2), per-network (8), institutional (64), and free-tier (120 min/day) caps, a 90% classifier-precision gate, and a confirmed-bot ban path — implemented in the Rust relay `apps/v6/egbe-pxstream-relay/src/lib.rs`. The one datum that crosses a game boundary, the **Aye passport**, is signed _and minimised_: `minimisePassportForDestination` (`libs/v6/aye-bridge/src/index.ts`) strips eight fields the destination does not need (`metadata.userId`, `identityCore.name.canonical`, `bondLedger.historyRef`, …) and the gate surfaces any _missing required_ destination field before the crossing — minimisation that is tested, not promised. DSAR and data-rights flows are covered by `data-rights-dsar.v6security.json`, and the cognition-call logs are retained under the V1 policy and are **not** training data without explicit consent. ## Testing and the eval gates ### UE automation, the Gauntlet driver, and golden replay The 37 `V6Tests` cases run under the editor automation controller; the headless CI driver runs a curated trio. `V6/ue/Build/Gauntlet/V6TestsGauntletManifest.json` declares the `V6TestsGauntletController`, the unattended invocation (`UnrealEditor-Cmd … -ExecCmds="Automation RunTests V6.Foundation.ProjectDescriptor; … V6.Gauntlet.DriverManifest; … V6.Replay.GoldenReplayHarness; Quit"`), the headless flags (`-nullrhi -NoSound -unattended -nop4 -nosplash`), and a 20-minute timeout, and a UE test (`V6.Gauntlet.DriverManifest`) validates that very contract. The **golden-replay** harness is the determinism dividend: `V6/evals/golden-replay/deterministic-core-golden.json` carries two seeded scenarios — `0x5eedc0de` (10 agents, 8 ticks, `expectedTraceHash: fnv64:d2d9943440615e77`) and `0x0ddba11` (14 agents, 10 ticks, `fnv64:224d215da6802d73`) — each covering tier-assignment, BT/HTN fallback, physics, world-tick, and perception-snapshot, and `V6.Replay.GoldenReplayHarness` asserts those exact hashes so a one-bit change in the deterministic core flips the gate. ### Rust coverage gates `V6/testing/rust-coverage-gates.v6qa.json` locks **five cargo packages** behind `cargo test --locked` and names the exact tests that must exist. The Ori service must prove event-sourcing append/read ordering, concurrent vector-clock appends, projection rebuild from a 10,000-event log equal to the incremental projection, snapshot-plus-tail cold load, and a curated conflict corpus that resolves deterministically (or hands off to Clio). The Moirai kernel must prove `walk_up_escalates_lachesis_to_clotho_within_one_tick`, transition damping, escalation rehydration building context before the first Clotho decision, deescalation that **never loses state**, loop and drift guards, and fleet rebalancing on node loss. The Aye and Vac packages add round-trip integrity and the wire test `vac_intent_confirmation_payload_round_trips_without_structural_loss`. ### Browser automation and the behaviour evals `V6/testing/browser-automation-gates.v6qa.json` pins Playwright across four web surfaces — the Pixel Streaming entry (`egbe-web`), the Tier-2 fallback (WebGPU/WebGL2 with full Vac non-voice parity and a no-microphone a11y route), the Steward App browser route, and Egbe Studio (publishing gated behind Isis provenance) — with the required test titles enumerated per surface. And because agent behaviour is _generated_, V6 cannot ship on telemetry alone: the **governance-safety-operator** readiness manifest aggregates §30–34 and §41, running the agent-behaviour eval suites (value-refusal, continuity, grounding, learning-by-example, negotiation, persona-policy, crisis, minor-protection), the consistency suites (long-session Ori consistency, incarnation round-trip), and the **safety eval as a hard release gate** at `requiredPassRate: 1`. Persona, crisis, and minor-protection each demand a perfect pass rate, and the behaviour-welfare telemetry excludes conversation content without consent. ## Launch readiness (honestly green) The V6 exit-criteria gate (`V6/release/v6-exit-criteria-readiness.v6release.json`, verifier `scripts/v6/verify-v6-exit-criteria-readiness.mjs`) aggregates everything above into a single go/no-go, and unlike V5/V3 it reads **green** — because V6 was driven to completion and the green is wired to be unforgeable. The verifier requires all ten constituent readiness manifests to exist and read `releaseGate.status: "green"` (moirai-cost-load, vac-communication, fate-legacy-clio, aye-threshold, governance-safety-operator, orun-shard-district, ninhursag-foundry, accessibility-localization-security-cert, production-setup manual-QA, docs-drift); it asserts the manifest's own `noUncheckedTaskCheckboxesOutsideExamples` policy; and `validateTodoCompletion` **strips fenced examples** from `V6_TODOS.md` and then fails if a single `- [ ]` survives. Today the backlog is **215 `[x]`, 8 `[~]`, and one `[ ]`** — and that lone `[ ]` is the literal template line `- [ ] Implement . Done when: .` inside a code fence, which the verifier strips before counting. ```mermaid flowchart TB subgraph perf["Performance gates"] rb["verify-v6-rendering-budgets
(re-derives draw units · self-tests fail-closed)"] lb["latency-budgets
(world tick = real cargo bench)"] end subgraph qa["Testing & eval gates"] ue["V6Tests · 37 automation cases
+ Gauntlet trio + golden replay (fnv64)"] rust["rust-coverage · 5 crates · named tests"] evals["behavior / consistency / safety
(safety = hard gate, passRate 1)"] end subgraph sec["Security gates"] audit["privileged-access-audit
(V1 OAuth · audit · residency)"] px["pxstream abuse + passport minimisation"] end perf --> manifests["10 readiness manifests
(status = green)"] qa --> manifests sec --> manifests manifests --> gate{"verify-v6-exit-criteria-readiness
fail-closed · strips fenced examples"} todos["V6_TODOS.md
215 [x] · 8 [~] · 0 real [ ]"] --> gate gate -->|"all green · no real unchecked task"| green["status: green (today)"] gate -.->|"any manifest red OR a real [ ] survives"| red["releaseBlocked"] ``` The eight `[~]` are the honest external boundary, and naming them is the point: the 7-day sustained-load and Commons-scale runs (live regional infra), **platform cert for Apple/Google/Meta/Sony/Valve/Epic** (external certification bodies), the Moirai three-tier cost run against a real DAU projection, the four Aye Thresholds operating cross-game round-trips against shipped V2–V5 destinations, the cross-game **Aye campaigns** (P2), and the region-rollout / region-rating residency posture. None of these can be honestly closed in-repo, so none is marked `[x]`. The green therefore means _every actionable task is implemented and every constituent verifier passes against on-disk evidence_ — logic, config, named tests, and threshold-gated declared measurements — with the live-ops, external-cert, and cross-game-integration boundary held honestly at `[~]`. ## Edge cases and failure modes - **The rendering budget is enforced by recomputation, not assertion.** The verifier re-derives near/mid/far counts and draw units from the `.ini` config and requires the JSON to match, then mutates a frame-time to prove it fails closed — a config that drifts from the budget fails the build. - **Latency budgets carry their evidence, including the absence of it.** The world tick is backed by a real `egbe-world-server` cargo benchmark; the escalation-rehydration grace is labelled "Measurement pending" rather than given a fabricated number. - **Observability is not yet on the shared spine.** `V6Telemetry` is a 50-line module-contract scaffold and no V6 service composes `@oshun/metrics`/ `@oshun/tracing` — a real gap relative to V2/V3, named here rather than papered over; today's observability is the eval/cost/welfare-telemetry gate contract. - **The passport is minimised, and the minimisation is tested.** Only the destination's needed fields cross the Aye Bridge; eight identity/bond fields are stripped and a missing _required_ field is surfaced before the crossing. - **The launch gate's green is unforgeable.** It strips fenced examples, refuses to pass on a surviving real `- [ ]`, and ANDs ten fail-closed readiness manifests — so a hand-edited green fails, and the eight honest `[~]` items keep the live-ops/cert boundary visible. ## Where this connects - **Sideways:** [determinism, data and integration](./determinism-data-and-integration.md) owns the deterministic core, the Ori event-sourcing store, the residency model, and the V1/V3 integration whose golden-replay hashes, Rust coverage tests, and audit/residency evidence this page's gates depend on; [architecture topology and layout](./architecture-topology-and-layout.md) owns the two-substrate split, the UE5 module breakdown, and the Rust service topology whose cook matrix, draw budgets, and per-service security posture this page measures. - **Platform foundations it composes:** the [shared platform](../../platform/overview.html) observability, audit, and residency libraries (`@oshun/metrics`, `@oshun/tracing`, `@oshun/audit-platform`, `@oshun/data-residency`) — real in the monorepo, the spine V6's services have yet to adopt for metrics but already compose for audit and residency. - The section hub: [../V6_ARCHITECTURE.md](../V6_ARCHITECTURE.md).