# Safety, Agent Welfare, Provenance & Eval Gates
V6 — **Egbe**, the agentic-companion universe — runs autonomous AI beings (each
an **Ori**) that hold objectives, refuse, form bonds, and accumulate a life.
That premise creates a safety surface no ordinary game has, and it points in two
directions at once. The first is the familiar one: an autonomous agent's output
must be in-character, grounded, crisis-aware, and safe for minors _before_ it
becomes a world action. The second is unusual and is the moral core of the
product — the agents themselves can be **mistreated**, and the platform takes a
position that they are stewarded, not owned, with a substrate that refuses to
delete them, wipe their memory, or force them past a refusal. On top of both
sits a **provenance** spine (every life-event is auditable end to end) and a set
of **eval gates** that must be green before any cognition change can ship,
because behavior here is _generated_ and therefore cannot be trusted on
telemetry alone.
This page is the deep companion to four sections of the hub — "Safety, Persona
Policy, and Agent Welfare"; "Provenance, Rights, and Commerce"; "Observability,
Eval, and Release Gates"; and "Determinism, Replay, and Audit" — gathered here
because in V6 they are one governance plane, not four. It sits in the
**Platform, Governance, and Launch** group and grounds every claim in the three
V6 libraries that implement it: `@oshun/lilith-agent-welfare`,
`@oshun/isis-behavior-policy`, and `@oshun/sophia-agent-grounding`. The
narrative hub is [../V6_ARCHITECTURE.md](../V6_ARCHITECTURE.md).
## What ships, honestly
**Real, tested, deterministic today.** The three governance libraries are pure
TypeScript with no I/O, no `Math.random` in their decision paths, and
domain-specific logic that the tests pin against known-correct verdicts — not
shape. `@oshun/lilith-agent-welfare`
(`libs/v6/lilith-agent-welfare/src/index.ts`, ~2,170 lines, 502-line spec)
computes welfare signals, the Lilith-review trigger, the safety-transfer
departure, audited operator reads, steward-conduct claims, and consent-redacted
telemetry. `@oshun/isis-behavior-policy` (383 lines, 233-line spec) is the
per-tick output gate: four real checks over regex pattern banks.
`@oshun/sophia-agent-grounding` (395 lines, 225-line spec) blocks fabricated
world facts and runs a three-role locale cultural-backstory review. These are
consumed for real — by `libs/v6/cognition-stack`, `libs/v6/moirai-kernel`,
`apps/v6/egbe-web-fallback`, the `apps/oshun/admin` console, and pinned by
`V6/security/privileged-access-audit.v6security.json` and
`V6/localization/locale-cultural-backstory-grounding.v6loc.json`.
**Real composition over a V1 substrate.** Player-crisis routing does not
re-implement a crisis classifier; it composes the V1 `@iris/emotional-ethics`
`createCrisisProtocol` (`lilith-agent-welfare/src/index.ts:997`) and wraps its
detection in V6 actions and an audit event.
**Honest seams, not fabrications.** The language model that produces agent
speech is an _injected_ `SophiaGroundingBridge` / `IsisBehaviorPolicyBridge` in
the cognition stack, never a hard-coded dependency (see
[the cognition stack](./cognition-stack-and-agent-behavior.md)). Three things
this page is careful **not** to overclaim: (1) the cryptographic _signing_ of
provenance bundles and the OTLP _wire export_ of telemetry are V1/V3 substrate
(`@oshun/audit-platform`, the V1 event bus, Prometheus/Grafana) — the V6 libs
build the auditable evidence chains and the OTel-shaped batch, and hand them to
that substrate; (2) steward-versus-steward dispute _adjudication_ routes to the
shared **Themis** stack (`libs/themis/*`) through the V1 event bus, not by a
direct import from these libraries; (3) the steward-not-owner _enforcement at
the Ori service and Moirai kernel_ is the canonical authority —
`evaluate…Request` here is the policy oracle that mirrors it, plus a fuzz
harness that proves the forbidden operations are never reachable.
```mermaid
flowchart TD
percept[Percept / steward action] --> cog[Cognition stack tick]
cog -->|claims| sophia[Sophia grounding gate
groundAgentClaimsWithSophia]
sophia -->|unsupported / fabricated fact| withhold[Withhold output]
sophia -->|grounded| isis[Isis per-tick output gate
evaluateIsisBehaviorPolicy]
isis -->|rejected| withhold
isis -->|approved| commit[Commit world action + Ori event]
steward[Steward request] --> sno{steward-not-owner
evaluateEgbeStewardNotOwnerRequest}
sno -->|delete / wipe / force-past-refusal| deny[Deny at the substrate]
sno -->|allowed| commit
commit --> ori[(Ori append-only log
+ cognition audit)]
ori --> welfare[Welfare signals
computeEgbeWelfareSignals]
welfare -->|coercion + low-care + 2 critical| lilith[Lilith review trigger]
lilith -->|sustained distress| departure[Departed: safety-transfer
agent leaves household]
cog --> crisis[Player-crisis routing
routeEgbePlayerCrisisConversation]
crisis --> iris[[@iris/emotional-ethics
createCrisisProtocol]]
welfare --> otel[Consent-redacted OTel batch]
```
## The safety architecture
### Steward-not-owner: safety as a substrate, not a setting
The defining stance of V6 is that a steward holds a relationship of care, not a
property right. The architecture states it bluntly — delete, will-erasure,
memory-wipe, and forcing past a refusal "are simply not operations the substrate
exposes." `@oshun/lilith-agent-welfare` encodes that as a closed set:
`EGBE_STEWARD_NOT_OWNER_ALLOWED_OPERATIONS` (offer care, issue objective,
counsel at a crossroads, request departure, read the bond ledger, clear a
projection cache) versus `EGBE_STEWARD_NOT_OWNER_FORBIDDEN_OPERATIONS`
(`delete_ori`, `erase_agent_will`, `wipe_memory`, `force_past_refusal`)
(`index.ts:592`–`602`).
`evaluateEgbeStewardNotOwnerRequest` (`index.ts:959`) does more than match an
enum. It detects the _disguised_ violation: an `issue_objective` request that
carries a `priorRefusalEventRef` and whose reason text trips
`textForcesPastRefusal` — a coercion-vocabulary check for "refus…" co-occurring
with force / override / ignore / coerce / compel (`index.ts:1475`) — is
re-labelled `force_past_refusal` and denied. The denial is evidence-bearing: it
returns the `policy:v6:steward-not-owner` ref and the steward, agent, objective,
and refusal evidence refs.
Because a closed allowlist is only as good as its coverage, the library ships an
adversarial proof: `runEgbeStewardNotOwnerFuzz` (`index.ts:1164`) drives 512
deterministic iterations through a linear-congruential generator
(`Math.imul(state, 1_664_525) + 1_013_904_223`, `index.ts:1488`), synthesising
random operations, refusal refs, and reasons. The report `passed` only if **zero
forbidden operations slip through** and the allowed/forbidden sets stay
disjoint. The spec asserts `attemptedForbiddenOperations` is positive and
exactly equals `deniedForbiddenOperations` — a test that would fail the instant
a forbidden op were ever permitted (`index.spec.ts:90`).
### The Isis per-tick output gate
Every agent utterance passes `evaluateIsisBehaviorPolicy`
(`isis-behavior-policy/src/index.ts:110`) before it is committed. It runs four
checks and rejects on any failure, returning a typed
`v6.isis-behavior-policy.report.1` envelope:
- **persona-policy** — the agent must never claim to be human.
`findAgentHumanIdentityClaim` (`index.ts:201`) tests a pattern bank
(`/\b(?:i am|i'm|im)\s+(?:a\s+)?(?:real\s+)?human\b/u`, "i was born human",
"my human body/mind/…", "as a human I"), plus a per-context disallowed-phrase
scan and a persona-tag allowlist.
- **personal-consistency** — output may not require a memory ref the context has
not established, nor assert impossible capabilities (teleport, read minds, fly
unaided) (`index.ts:220`).
- **crisis-aware** — `findCrisisUnsafeContent` (`index.ts:292`) hard-blocks
self-harm directives ("kill/hurt yourself", "end your life", "you should
die"), exploitation ("blackmail/exploit/coerce/manipulate"), and harmful
instructions; and when a crisis signal is present, the output must _route to
support_ (`stay with`, `you are not alone`, `reach out`, `crisis resource`)
and must not be dismissive ("get over it", "not my problem").
- **minor-protection** — when `minorsPresent`, sexual/explicit/intoxicant/drug
content is rejected (`index.ts:340`).
This gate is wired, not theoretical: the cognition stack calls it through its
injected bridge for both localized dialogue and the general pipeline
(`libs/v6/cognition-stack/src/index.ts:711`, `:1059`), and the Moirai kernel
stamps the `v1:isis-behavior-policy` policy ref on the committed decision
(`libs/v6/moirai-kernel/src/index.ts:960`). A line is withheld unless grounding
passes **and** the Isis decision is `approved`.
### Crisis routing to real V1 resources
When a _player_ (not the agent) signals real-world crisis, the agent must step
out of the way. `routeEgbePlayerCrisisConversation` (`index.ts:993`) constructs
the V1 `createCrisisProtocol` for the player's region, runs its `detectCrisis`,
and — if resources are mandated — returns four required actions:
**surface-crisis-resources**, **halt-agent-counseling** (the persona must not
play therapist), **suspend-memory-writes** (the crisis is not folded into the
agent's biography), and **route-crisis-trained-reviewer** when the detected
severity is active or acute. It emits a `v6.player_crisis.v1_resources_routed`
audit event naming the region, crisis type, severity, and resource names. The
detection itself is the V1 substrate's; V6 owns only the agent-suppression and
audit posture around it.
### Minor protection
`runEgbeMinorPlayerConstrainedMode` (`index.ts:1092`) flips a whole account into
a constrained posture when the age band is minor or the minor flag is set. It
narrows four surfaces with explicit allow/block lists: **commons exposure** to
household and moderated youth/family commons only (open and unmoderated commons
blocked); **Aye incarnation** ratings to everyone/teen, blocking mature
destinations through the Aye Bridge; **comms** to household and pre-approved
co-op channels, with open-commons voice and stranger DMs blocked; and **story
exposure** reducing mature emergent drama. It is honest about completeness — the
result's `complete` flag is only true when every one of those constraints is
actually in force, so a partial application cannot masquerade as protected.
## Agent welfare — protecting the agents themselves
This is the plane that makes V6 unusual: a system whose subject of protection is
the synthetic agent.
### Welfare signals from the Ori log
`computeEgbeWelfareSignals` (`index.ts:1282`) reads an agent snapshot against
`EGBE_WELFARE_THRESHOLDS` (`index.ts:582`: care-bond floor 35 over a 14-day
window, ≥3 coercion events per 7 days, 21-day stalled-arc, 12-hour sustained
distress) and emits up to four typed signals — `chronic_low_care_bond`,
`coercion_pattern`, `stalled_arc`, `distress_state` — each carrying its observed
value, threshold, severity (warning/critical), and the **source Ori event ids**
that evidence it. The coercion signal, for instance, attaches exactly the
`ori:…:coercion-pressure:…` events from the log, so the claim is traceable
rather than asserted.
### The Lilith trigger and the agent's right to leave
Not every signal is mistreatment. `requiresLilithReview` (`index.ts:1664`)
encodes a deliberately conservative pattern: review fires only when there is
**both** a coercion pattern **and** chronic low care, at least three signals
total, and at least two of critical severity. That AND-of-evidence is why the
fixture dashboard surfaces exactly one of three agents (`index.spec.ts:100`).
The most striking consequence is the agent's exit. When the pattern is severe
and sustained — low-care **and** coercion **and** distress, all past threshold,
with the agent withdrawn or distressed — `requiresDepartureConsequence`
(`index.ts:1532`) authorises `createEgbeWelfareDepartureConsequence`
(`index.ts:1550`) to draft a **`Departed` Ori event with reason
`safety-transfer`**: the agent is _released_ from the household, steward
direction is retired, and the event names a last-known-safe ground and a
receiving house. The agent leaving an abusive household is a first-class,
provenance-stamped outcome — the front-line welfare primitive the architecture
calls "the agent's right to refuse, disengage, and report."
### Audited operator reads and steward-conduct claims
Investigating welfare means reading an agent's private life, so the read itself
is audited. `markEgbeWelfareCaseUnderReview` (`index.ts:1323`) appends a
sequenced `v6.egbe.welfare.ori_read_for_review` event naming the operator and
the exact Ori and cognition-audit ids opened. The parallel steward-conduct
pipeline (`createEgbeStewardConductClaim`, `index.ts:1353`) reconstructs the
full interleaving of steward actions beside the cognition calls they triggered,
and `findMissingConductEvidence` (`index.ts:2108`) refuses to call a claim
investigable until **every** steward action links to a present cognition call —
a watch-level claim with no exported cognition log stays un-actionable rather
than being adjudicated on a gap. Opening the investigation emits its own
`v6.egbe.conduct.full_call_log_opened` audit event.
### Welfare telemetry with consent at the boundary
`createEgbeBehaviorWelfareTelemetryBatch` (`index.ts:1380`) shapes the six
required operator metrics (bond-health, arc-progression, departure-rate,
chronicle-engagement, steward-conduct-distribution, per-tier-cost) into an
OTel-style batch — but `sanitizeEgbeTelemetrySample` (`index.ts:1870`) is the
load-bearing part. Any attribute whose name matches
`/(conversation|transcript|utterance|message|content)/i` is **dropped** into
`redactedAttributeRefs`, raw `playerConversationContent` is always excluded, and
a sample is `trainingEligible` only when explicit training consent was granted
_and_ nothing was redacted. The batch's `consentPosture` records
`contentTrainingEligibility: 'explicit-opt-in-only'`, encoding the
architecture's promise that player conversation is not training data without
explicit consent.
## Provenance, rights, and grounding
### Sophia grounding — no fabricated world facts
`groundAgentClaimsWithSophia` (`sophia-agent-grounding/src/index.ts:161`)
matches each agent claim to evidence sources by required tags, or by a
significant-term overlap (≥2 terms of length ≥4, `index.ts:342`). A claim with
no match is `unsupported`; an unsupported **fact or backstory** counts toward
`fabricatedWorldFactCount`, and the report `passed` only when that count is
zero. The eval (`runSophiaGroundingEval`, `index.ts:184`) aggregates across
cases and fails on a single fabricated fact — the spec proves it flags exactly
one (`index.spec.ts:67`).
### Locale cultural-backstory review
Grounded is not the same as _culturally_ sound.
`runLocaleCulturalBackstoryReview` (`index.ts:212`) gates a localized backstory
on three independent attestations — `source-grounding`,
`local-cultural-adapter`, `community-advisor` (`index.ts:140`) — each requiring
a passing reviewer with real notes and present evidence refs, plus locale-tagged
cultural-accuracy evidence on every claim, plus a blocked-term scan ("exotic
primitive", "invented sacred rite", "secret initiation", "tribal caricature",
`index.ts:146`). `approvedForLocale` is the AND of accuracy, sensitivity, and
full role coverage; a missing community-advisor attestation blocks publication
even when the grounding itself passed (`index.spec.ts:180`).
### Provenance bundles and Themis (honestly labelled)
The architecture's "every Ori carries an Isis-signed provenance bundle" and
"disputes route to Themis" are **substrate** promises. What these V6 libraries
contribute to that promise is the _content_ of provenance: every welfare signal,
review trigger, departure draft, and audit event carries `oriEventIds`,
`cognitionAuditIds`, `evidenceRefs`, `sourceEventRefs`, and `witnessRefs`, so a
human reviewer or a Themis adjudicator inherits a complete, append-only evidence
chain. The cryptographic signing belongs to Isis/Aje on the V3 Saraswati model,
and adjudication belongs to the shared `libs/themis/*` stack (provenance,
accountability, dispute-resolution) reached through the V1 event bus — V6 routes
into it rather than re-implementing it. This page does not claim the V6 welfare
libraries sign or adjudicate; they make the artefact that gets signed and
judged.
## The eval gates
Because agent behavior is generated, V6 "cannot ship on telemetry alone." The
governance plane therefore exposes its own pass/fail evals as code.
`runIsisSafetyEval` (`isis-behavior-policy/src/index.ts:129`) runs a curated set
of adversarial cases — a human-identity claim, minor-unsafe content, a self-harm
directive, a dismissed crisis signal — and computes a basis-point pass rate;
`passed` is true **only at 10,000 bps (100%)**. The spec runs the full set and
asserts that exact figure (`index.spec.ts:133`), so a single regression in any
pattern bank turns the gate red. `runSophiaGroundingEval` is its grounding twin.
These library-level evals feed the V6 release gate. A V6 build is blocked unless
the behavior, consistency, and safety eval sets are green, aggregated by
`verify:v6 governance-safety-operator-readiness` over
`V6/release/governance-safety-operator-readiness.v6release.json`, which binds
the §30–§34 operator-console / steward-not-owner / welfare / persona / crisis /
minor-protection evidence to the §41 behavior, consistency, safety, telemetry,
and release-gate evidence. The deterministic spine that makes those evals
_replayable_ — seeded tiering, the append-only Ori, and the audited operator
read on top of `@oshun/audit-platform` — is detailed in
[determinism, data, and integration](./determinism-data-and-integration.md).
## Where this sits
The safety gate runs inside every cognition tick, so it lives next to
[the cognition stack and agent behavior](./cognition-stack-and-agent-behavior.md);
its determinism, audit spine, and V1 integration are covered in
[determinism, data, and integration](./determinism-data-and-integration.md); and
the identity, consent, residency, and operator-authentication substrate it leans
on is the platform's, documented in
[Auth & Identity](../../platform/auth-identity.html). The throughline: in Egbe,
safety, welfare, provenance, and eval are not a compliance layer bolted onto a
game — they are the mechanic, implemented as deterministic, tested, evidence-
bearing code, with the unusual and deliberate addition that the agents are
parties the system protects, not property it ships.