Safety, Agent Welfare, Provenance & Eval Gates

V6 — Egbe, the agentic-companion universe — runs autonomous AI beings (each an Ori) that hold objectives, refuse, form bonds, and accumulate a life. That premise creates a safety surface no ordinary game has, and it points in two directions at once. The first is the familiar one: an autonomous agent's output must be in-character, grounded, crisis-aware, and safe for minors before it becomes a world action. The second is unusual and is the moral core of the product — the agents themselves can be mistreated, and the platform takes a position that they are stewarded, not owned, with a substrate that refuses to delete them, wipe their memory, or force them past a refusal. On top of both sits a provenance spine (every life-event is auditable end to end) and a set of eval gates that must be green before any cognition change can ship, because behavior here is generated and therefore cannot be trusted on telemetry alone.

This page is the deep companion to four sections of the hub — "Safety, Persona Policy, and Agent Welfare"; "Provenance, Rights, and Commerce"; "Observability, Eval, and Release Gates"; and "Determinism, Replay, and Audit" — gathered here because in V6 they are one governance plane, not four. It sits in the Platform, Governance, and Launch group and grounds every claim in the three V6 libraries that implement it: @oshun/lilith-agent-welfare, @oshun/isis-behavior-policy, and @oshun/sophia-agent-grounding. The narrative hub is ../V6_ARCHITECTURE.md.

What ships, honestly#

Real, tested, deterministic today. The three governance libraries are pure TypeScript with no I/O, no Math.random in their decision paths, and domain-specific logic that the tests pin against known-correct verdicts — not shape. @oshun/lilith-agent-welfare (libs/v6/lilith-agent-welfare/src/index.ts, ~2,170 lines, 502-line spec) computes welfare signals, the Lilith-review trigger, the safety-transfer departure, audited operator reads, steward-conduct claims, and consent-redacted telemetry. @oshun/isis-behavior-policy (383 lines, 233-line spec) is the per-tick output gate: four real checks over regex pattern banks. @oshun/sophia-agent-grounding (395 lines, 225-line spec) blocks fabricated world facts and runs a three-role locale cultural-backstory review. These are consumed for real — by libs/v6/cognition-stack, libs/v6/moirai-kernel, apps/v6/egbe-web-fallback, the apps/oshun/admin console, and pinned by V6/security/privileged-access-audit.v6security.json and V6/localization/locale-cultural-backstory-grounding.v6loc.json.

Real composition over a V1 substrate. Player-crisis routing does not re-implement a crisis classifier; it composes the V1 @iris/emotional-ethics createCrisisProtocol (lilith-agent-welfare/src/index.ts:997) and wraps its detection in V6 actions and an audit event.

Honest seams, not fabrications. The language model that produces agent speech is an injected SophiaGroundingBridge / IsisBehaviorPolicyBridge in the cognition stack, never a hard-coded dependency (see the cognition stack). Three things this page is careful not to overclaim: (1) the cryptographic signing of provenance bundles and the OTLP wire export of telemetry are V1/V3 substrate (@oshun/audit-platform, the V1 event bus, Prometheus/Grafana) — the V6 libs build the auditable evidence chains and the OTel-shaped batch, and hand them to that substrate; (2) steward-versus-steward dispute adjudication routes to the shared Themis stack (libs/themis/*) through the V1 event bus, not by a direct import from these libraries; (3) the steward-not-owner enforcement at the Ori service and Moirai kernel is the canonical authority — evaluate…Request here is the policy oracle that mirrors it, plus a fuzz harness that proves the forbidden operations are never reachable.

The safety architecture#

Steward-not-owner: safety as a substrate, not a setting#

The defining stance of V6 is that a steward holds a relationship of care, not a property right. The architecture states it bluntly — delete, will-erasure, memory-wipe, and forcing past a refusal "are simply not operations the substrate exposes." @oshun/lilith-agent-welfare encodes that as a closed set: EGBE_STEWARD_NOT_OWNER_ALLOWED_OPERATIONS (offer care, issue objective, counsel at a crossroads, request departure, read the bond ledger, clear a projection cache) versus EGBE_STEWARD_NOT_OWNER_FORBIDDEN_OPERATIONS (delete_ori, erase_agent_will, wipe_memory, force_past_refusal) (index.ts:592–602).

evaluateEgbeStewardNotOwnerRequest (index.ts:959) does more than match an enum. It detects the disguised violation: an issue_objective request that carries a priorRefusalEventRef and whose reason text trips textForcesPastRefusal — a coercion-vocabulary check for "refus…" co-occurring with force / override / ignore / coerce / compel (index.ts:1475) — is re-labelled force_past_refusal and denied. The denial is evidence-bearing: it returns the policy:v6:steward-not-owner ref and the steward, agent, objective, and refusal evidence refs.

Because a closed allowlist is only as good as its coverage, the library ships an adversarial proof: runEgbeStewardNotOwnerFuzz (index.ts:1164) drives 512 deterministic iterations through a linear-congruential generator (Math.imul(state, 1_664_525) + 1_013_904_223, index.ts:1488), synthesising random operations, refusal refs, and reasons. The report passed only if zero forbidden operations slip through and the allowed/forbidden sets stay disjoint. The spec asserts attemptedForbiddenOperations is positive and exactly equals deniedForbiddenOperations — a test that would fail the instant a forbidden op were ever permitted (index.spec.ts:90).

The Isis per-tick output gate#

Every agent utterance passes evaluateIsisBehaviorPolicy (isis-behavior-policy/src/index.ts:110) before it is committed. It runs four checks and rejects on any failure, returning a typed v6.isis-behavior-policy.report.1 envelope:

• persona-policy — the agent must never claim to be human. findAgentHumanIdentityClaim (index.ts:201) tests a pattern bank (/\b(?:i am|i'm|im)\s+(?:a\s+)?(?:real\s+)?human\b/u, "i was born human", "my human body/mind/…", "as a human I"), plus a per-context disallowed-phrase scan and a persona-tag allowlist.
• personal-consistency — output may not require a memory ref the context has not established, nor assert impossible capabilities (teleport, read minds, fly unaided) (index.ts:220).
• crisis-aware — findCrisisUnsafeContent (index.ts:292) hard-blocks self-harm directives ("kill/hurt yourself", "end your life", "you should die"), exploitation ("blackmail/exploit/coerce/manipulate"), and harmful instructions; and when a crisis signal is present, the output must route to support (stay with, you are not alone, reach out, crisis resource) and must not be dismissive ("get over it", "not my problem").
• minor-protection — when minorsPresent, sexual/explicit/intoxicant/drug content is rejected (index.ts:340).

This gate is wired, not theoretical: the cognition stack calls it through its injected bridge for both localized dialogue and the general pipeline (libs/v6/cognition-stack/src/index.ts:711, :1059), and the Moirai kernel stamps the v1:isis-behavior-policy policy ref on the committed decision (libs/v6/moirai-kernel/src/index.ts:960). A line is withheld unless grounding passes and the Isis decision is approved.

Crisis routing to real V1 resources#

When a player (not the agent) signals real-world crisis, the agent must step out of the way. routeEgbePlayerCrisisConversation (index.ts:993) constructs the V1 createCrisisProtocol for the player's region, runs its detectCrisis, and — if resources are mandated — returns four required actions: surface-crisis-resources, halt-agent-counseling (the persona must not play therapist), suspend-memory-writes (the crisis is not folded into the agent's biography), and route-crisis-trained-reviewer when the detected severity is active or acute. It emits a v6.player_crisis.v1_resources_routed audit event naming the region, crisis type, severity, and resource names. The detection itself is the V1 substrate's; V6 owns only the agent-suppression and audit posture around it.

Minor protection#

runEgbeMinorPlayerConstrainedMode (index.ts:1092) flips a whole account into a constrained posture when the age band is minor or the minor flag is set. It narrows four surfaces with explicit allow/block lists: commons exposure to household and moderated youth/family commons only (open and unmoderated commons blocked); Aye incarnation ratings to everyone/teen, blocking mature destinations through the Aye Bridge; comms to household and pre-approved co-op channels, with open-commons voice and stranger DMs blocked; and story exposure reducing mature emergent drama. It is honest about completeness — the result's complete flag is only true when every one of those constraints is actually in force, so a partial application cannot masquerade as protected.

Agent welfare — protecting the agents themselves#

This is the plane that makes V6 unusual: a system whose subject of protection is the synthetic agent.

Welfare signals from the Ori log#

computeEgbeWelfareSignals (index.ts:1282) reads an agent snapshot against EGBE_WELFARE_THRESHOLDS (index.ts:582: care-bond floor 35 over a 14-day window, ≥3 coercion events per 7 days, 21-day stalled-arc, 12-hour sustained distress) and emits up to four typed signals — chronic_low_care_bond, coercion_pattern, stalled_arc, distress_state — each carrying its observed value, threshold, severity (warning/critical), and the source Ori event ids that evidence it. The coercion signal, for instance, attaches exactly the ori:…:coercion-pressure:… events from the log, so the claim is traceable rather than asserted.

The Lilith trigger and the agent's right to leave#

Not every signal is mistreatment. requiresLilithReview (index.ts:1664) encodes a deliberately conservative pattern: review fires only when there is both a coercion pattern and chronic low care, at least three signals total, and at least two of critical severity. That AND-of-evidence is why the fixture dashboard surfaces exactly one of three agents (index.spec.ts:100).

The most striking consequence is the agent's exit. When the pattern is severe and sustained — low-care and coercion and distress, all past threshold, with the agent withdrawn or distressed — requiresDepartureConsequence (index.ts:1532) authorises createEgbeWelfareDepartureConsequence (index.ts:1550) to draft a Departed Ori event with reason safety-transfer: the agent is released from the household, steward direction is retired, and the event names a last-known-safe ground and a receiving house. The agent leaving an abusive household is a first-class, provenance-stamped outcome — the front-line welfare primitive the architecture calls "the agent's right to refuse, disengage, and report."

Audited operator reads and steward-conduct claims#

Investigating welfare means reading an agent's private life, so the read itself is audited. markEgbeWelfareCaseUnderReview (index.ts:1323) appends a sequenced v6.egbe.welfare.ori_read_for_review event naming the operator and the exact Ori and cognition-audit ids opened. The parallel steward-conduct pipeline (createEgbeStewardConductClaim, index.ts:1353) reconstructs the full interleaving of steward actions beside the cognition calls they triggered, and findMissingConductEvidence (index.ts:2108) refuses to call a claim investigable until every steward action links to a present cognition call — a watch-level claim with no exported cognition log stays un-actionable rather than being adjudicated on a gap. Opening the investigation emits its own v6.egbe.conduct.full_call_log_opened audit event.

Welfare telemetry with consent at the boundary#

createEgbeBehaviorWelfareTelemetryBatch (index.ts:1380) shapes the six required operator metrics (bond-health, arc-progression, departure-rate, chronicle-engagement, steward-conduct-distribution, per-tier-cost) into an OTel-style batch — but sanitizeEgbeTelemetrySample (index.ts:1870) is the load-bearing part. Any attribute whose name matches /(conversation|transcript|utterance|message|content)/i is dropped into redactedAttributeRefs, raw playerConversationContent is always excluded, and a sample is trainingEligible only when explicit training consent was granted and nothing was redacted. The batch's consentPosture records contentTrainingEligibility: 'explicit-opt-in-only', encoding the architecture's promise that player conversation is not training data without explicit consent.

Provenance, rights, and grounding#

Sophia grounding — no fabricated world facts#

groundAgentClaimsWithSophia (sophia-agent-grounding/src/index.ts:161) matches each agent claim to evidence sources by required tags, or by a significant-term overlap (≥2 terms of length ≥4, index.ts:342). A claim with no match is unsupported; an unsupported fact or backstory counts toward fabricatedWorldFactCount, and the report passed only when that count is zero. The eval (runSophiaGroundingEval, index.ts:184) aggregates across cases and fails on a single fabricated fact — the spec proves it flags exactly one (index.spec.ts:67).

Locale cultural-backstory review#

Grounded is not the same as culturally sound. runLocaleCulturalBackstoryReview (index.ts:212) gates a localized backstory on three independent attestations — source-grounding, local-cultural-adapter, community-advisor (index.ts:140) — each requiring a passing reviewer with real notes and present evidence refs, plus locale-tagged cultural-accuracy evidence on every claim, plus a blocked-term scan ("exotic primitive", "invented sacred rite", "secret initiation", "tribal caricature", index.ts:146). approvedForLocale is the AND of accuracy, sensitivity, and full role coverage; a missing community-advisor attestation blocks publication even when the grounding itself passed (index.spec.ts:180).

Provenance bundles and Themis (honestly labelled)#

The architecture's "every Ori carries an Isis-signed provenance bundle" and "disputes route to Themis" are substrate promises. What these V6 libraries contribute to that promise is the content of provenance: every welfare signal, review trigger, departure draft, and audit event carries oriEventIds, cognitionAuditIds, evidenceRefs, sourceEventRefs, and witnessRefs, so a human reviewer or a Themis adjudicator inherits a complete, append-only evidence chain. The cryptographic signing belongs to Isis/Aje on the V3 Saraswati model, and adjudication belongs to the shared libs/themis/* stack (provenance, accountability, dispute-resolution) reached through the V1 event bus — V6 routes into it rather than re-implementing it. This page does not claim the V6 welfare libraries sign or adjudicate; they make the artefact that gets signed and judged.

The eval gates#

Because agent behavior is generated, V6 "cannot ship on telemetry alone." The governance plane therefore exposes its own pass/fail evals as code. runIsisSafetyEval (isis-behavior-policy/src/index.ts:129) runs a curated set of adversarial cases — a human-identity claim, minor-unsafe content, a self-harm directive, a dismissed crisis signal — and computes a basis-point pass rate; passed is true only at 10,000 bps (100%). The spec runs the full set and asserts that exact figure (index.spec.ts:133), so a single regression in any pattern bank turns the gate red. runSophiaGroundingEval is its grounding twin.

These library-level evals feed the V6 release gate. A V6 build is blocked unless the behavior, consistency, and safety eval sets are green, aggregated by verify:v6 governance-safety-operator-readiness over V6/release/governance-safety-operator-readiness.v6release.json, which binds the §30–§34 operator-console / steward-not-owner / welfare / persona / crisis / minor-protection evidence to the §41 behavior, consistency, safety, telemetry, and release-gate evidence. The deterministic spine that makes those evals replayable — seeded tiering, the append-only Ori, and the audited operator read on top of @oshun/audit-platform — is detailed in determinism, data, and integration.

Where this sits#

The safety gate runs inside every cognition tick, so it lives next to the cognition stack and agent behavior; its determinism, audit spine, and V1 integration are covered in determinism, data, and integration; and the identity, consent, residency, and operator-authentication substrate it leans on is the platform's, documented in Auth & Identity. The throughline: in Egbe, safety, welfare, provenance, and eval are not a compliance layer bolted onto a game — they are the mechanic, implemented as deterministic, tested, evidence- bearing code, with the unusual and deliberate addition that the agents are parties the system protects, not property it ships.