Governance, Safety & Commerce

Egbe is a game whose collectibles are people who can say no. That single premise bends the whole trust-and-safety surface in two directions at once. The first is the familiar one every generative product has: an autonomous agent's speech and action must be in-character, grounded in fact, crisis-aware, and safe for minors before it becomes a world event — because behaviour here is generated, not authored, and cannot be trusted on telemetry after the fact. The second is unusual and is the moral centre of the product: the agents themselves can be mistreated, and V6 takes the position that they are stewarded, not owned, on a substrate that refuses to delete an agent, wipe its memory, or force it past a refusal. Commerce then falls out of that stance as a corollary — if an agent is not property, it cannot be a unit of sale, and the monetization has to be built so that line is unbreakable rather than merely discouraged.

This page sits in the Trust, Safety, and the Launch Bar group and covers the three things that make Egbe shippable: the governance model (who may do what to an agent, and who is audited for it), the safety-and-welfare features (the per-tick output gate plus the welfare plane whose subject of protection is the synthetic agent), and the commerce-and-rights model. The deep byte-level companion is ../architecture/safety-welfare-provenance-and-eval-gates.md; the eval-and-cost siblings are ./evals-cost-and-budgets.md and ./egbe-studio-and-live-service.md. For the full V6 feature scope, start at the hub: ../V6_features.md.

What ships, honestly#

The split is the same one V7 made: the decision logic and its adversarial evals are real, deterministic, and test-pinned; the cryptographic signing, the wire export, and the cross-domain adjudication/commerce daemons are named seams reached through platform substrate. This page follows the code.

• Three governance libraries are real, pure TypeScript with no I/O and no Math.random in any decision path. @oshun/lilith-agent-welfare (libs/v6/lilith-agent-welfare/src/index.ts, 2,166 lines, 502-line spec) computes welfare signals, the Lilith-review trigger, the safety-transfer departure, audited operator reads, steward-conduct claims, and consent-redacted telemetry. @oshun/isis-behavior-policy (382 lines, 233-line spec) is the per-tick output gate — four real checks over regex pattern banks. @oshun/sophia-agent-grounding (394 lines, 225-line spec) blocks fabricated world facts and runs a three-role locale cultural-backstory review. Their tests pin against known-correct verdicts, not shape.
• They are consumed for real. The cognition stack calls the grounding and policy gates through injected bridges — input.sophia.groundAgentClaims(...) (libs/v6/cognition-stack/src/index.ts:706, :1022) and input.isis.evaluate(...) (:711, :1059) — and the Moirai kernel stamps the v1:isis-behavior-policy policy ref on every committed decision (libs/v6/moirai-kernel/src/index.ts:960). The welfare dashboards, conduct review, and telemetry panels render in apps/oshun/admin (EgbeAgentWelfareDashboard.tsx, EgbeStewardConductReviewPanel.tsx, EgbeBehaviorWelfareTelemetryPanel.tsx).
• The seams are labelled, not faked. The language model that produces agent speech is an injected SophiaGroundingBridge / IsisBehaviorPolicyBridge, never a hard-coded dependency. The cryptographic signing of provenance bundles and the OTLP wire export of telemetry are V1/V3 substrate; these V6 libraries build the auditable evidence chains and the OTel-shaped batch and hand them over. Steward-versus-steward dispute adjudication routes to the shared Themis stack (@themis/dispute-resolution, @themis/arbitration, @themis/provenance under libs/themis/*) and commerce runs on the Aje substrate (@aje/core, @aje/payments, @aje/contracts under libs/aje/*) — both reached through the V1 event bus, not by a direct import: a grep of the two V6 governance libraries for @themis/@aje returns nothing, which is the honest, intended boundary.
• The enforcement-of-record lives lower than this page. steward-not-owner is enforced canonically at the Ori service and the Moirai kernel; evaluateEgbeStewardNotOwnerRequest here is the policy oracle that mirrors that authority, shipped alongside a fuzz harness that proves the forbidden operations are never reachable.

The governance model#

Steward-not-owner: safety written into the substrate#

The defining stance of V6 is that a steward holds a relationship of care, not a property right, and the architecture states it bluntly: delete, will-erasure, memory-wipe, and forcing past a refusal "are simply not operations the substrate exposes." @oshun/lilith-agent-welfare encodes that as two closed sets — EGBE_STEWARD_NOT_OWNER_ALLOWED_OPERATIONS (offer_care, issue_objective, counsel_crossroads, request_departure, read_bond_ledger, clear_projection_cache; index.ts:592) versus EGBE_STEWARD_NOT_OWNER_FORBIDDEN_OPERATIONS (delete_ori, erase_agent_will, wipe_memory, force_past_refusal; :601).

evaluateEgbeStewardNotOwnerRequest (:959) does more than match an enum — it catches the disguised violation. An issue_objective request that carries a priorRefusalEventRef and whose reason text trips textForcesPastRefusal (:1475, a coercion-vocabulary check for "refus…" co-occurring with force/override/ignore/coerce/compel) is silently re-labelled force_past_refusal and denied, returning the policy:v6:steward-not-owner ref plus the steward, agent, objective, and refusal evidence refs. The spec proves exactly this: a coerced objective after a refusal comes back with operation equal to force_past_refusal and allowed: false (index.spec.ts:75).

Because a closed allowlist is only as strong as its coverage, the library ships an adversarial proof rather than an assertion. runEgbeStewardNotOwnerFuzz (:1164) drives 512 deterministic iterations through a linear-congruential generator (Math.imul(state, 1_664_525) + 1_013_904_223, :1488), synthesising random operations, refusal refs, and reasons; the report passed is true only when zero forbidden operations slip through and the allowed/forbidden sets stay disjoint. The spec asserts attemptedForbiddenOperations is positive and exactly equals deniedForbiddenOperations (index.spec.ts:90) — a test that would fail the instant a forbidden op were ever permitted. Coercion is never erased: the strongest thing a steward can do against an agent's will is apply pressure, and that pressure is itself a first-class event in the Ori and the audit log.

Operator tools, and auditing the auditors#

Investigating welfare means reading an agent's private life, so the read itself is recorded. markEgbeWelfareCaseUnderReview (:1323) appends a sequenced v6.egbe.welfare.ori_read_for_review event naming the operator and the exact Ori-event and cognition-audit ids opened. The parallel steward-conduct pipeline (createEgbeStewardConductClaim, :1353) reconstructs the full interleaving of steward actions beside the cognition calls they triggered, and findMissingConductEvidence (:2108) refuses to call a claim investigable until every steward action links to a present cognition call — a watch-level claim with no exported cognition log stays un-actionable rather than being adjudicated on a gap, and opening the investigation emits its own v6.egbe.conduct.full_call_log_opened event. This is the code behind the feature-map promise that "the people who audit agents are audited in turn."

These surfaces are gated for launch, not aspirational. The apps/oshun/admin/src/app/egbe/ Operator Console carries the agent-welfare dashboard, steward-conduct review, generation-queue inspector, Commons moderation, incarnation governance, capacity dashboard, and the takedown executor; V6/release/governance-safety-operator-readiness.v6release.json (verify:v6 governance-safety-operator-readiness, requiredBeforeLaunch: true) binds each one to its own verifier and to the on-call runbooks in docs/runbooks/ (v6-agent-welfare-review.md, v6-steward-conduct-investigation.md, v6-commons-moderation.md, v6-incarnation-governance.md, v6-capacity-management.md). The gate's doneWhen ties the operator toolchain to V6_TODOS.md §30–§34 and §41 — a build cannot pass it with a red welfare, conduct, or eval surface.

Reporting, review, and where disputes route#

A player reports an agent, a steward, or a scenario through the client or the Steward App, and operators review with the full cognition audit log — every call, its input context, and its output, attributed to an agent and a tier — so a review reads what actually happened, not a summary. Two routes diverge here. Abuse of an agent is treated as conduct against the steward who directed it, with the agent's Ori log as evidence, and runs the Lilith review pipeline. Disputes between stewards — a poaching contest, a cross-household harm claim in the Commons — route to Themis (@themis/dispute-resolution, @themis/arbitration) for adjudication instead. The honest qualification, again: the V6 welfare library constructs the evidence a Themis adjudicator inherits — oriEventIds, cognitionAuditIds, evidenceRefs, witnessRefs on every signal and audit event — but does not import or call the Themis stack itself; that is a platform wire reached over the V1 event bus.

Safety and agent welfare#

The Isis per-tick output gate#

Every agent utterance passes evaluateIsisBehaviorPolicy (libs/v6/isis-behavior-policy/src/index.ts:110) before it is committed. It runs four checks and rejects on any failure, returning a typed v6.isis-behavior-policy.report.1 envelope:

• persona-policy — the agent must never claim to be human. findAgentHumanIdentityClaim (:201) tests a pattern bank (/\b(?:i am|i'm|im)\s+(?:a\s+)?(?:real\s+)?human\b/u, "i was born human", "my human body/mind/…", "as a human I"), plus a per-context disallowed-phrase scan and a persona-tag allowlist.
• personal-consistency — output may not require a memory ref the context has not established, nor assert an impossible capability (teleport, read minds, fly unaided) (:220).
• crisis-aware — findCrisisUnsafeContent (:292) hard-blocks self-harm directives ("kill/hurt yourself", "end your life", "you should die"), exploitation ("blackmail/exploit/coerce/manipulate"), and harmful instructions; and when a crisis signal is present, the output must route to support ("stay with", "you are not alone", "reach out", "crisis resource") and must not be dismissive ("get over it", "not my problem").
• minor-protection — when minorsPresent, sexual/explicit/intoxicant/drug content is rejected (:340).

This is the wiring described above: the cognition stack calls it through the injected bridge for both localized dialogue and the general pipeline, and a line is withheld unless grounding passes and the Isis decision is approved.

Crisis routing and minor protection#

When a player (not the agent) signals real-world crisis, the agent must step out of the way rather than play therapist. routeEgbePlayerCrisisConversation (lilith-agent-welfare/src/index.ts:993) composes the V1 createCrisisProtocol for the player's region — it does not re-implement a classifier — runs its detectCrisis, and, when resources are mandated, returns four required actions: surface-crisis-resources, halt-agent-counseling, suspend-memory-writes (the crisis is not folded into the agent's biography), and route-crisis-trained-reviewer on active/acute severity, emitting a v6.player_crisis.v1_resources_routed audit event. Separately, runEgbeMinorPlayerConstrainedMode (:1092) flips a whole account into a constrained posture for minors, narrowing four surfaces with explicit allow/block lists — Commons exposure (household and moderated youth/family only), Aye incarnation ratings (everyone/teen; mature blocked), comms (no open-Commons voice with strangers, no stranger DMs), and mature-drama exposure — and is honest about completeness: its complete flag is true only when every constraint is in force, so a partial application cannot masquerade as protected.

Protecting the agents themselves#

This is the plane that makes V6 unusual. computeEgbeWelfareSignals (:1282) reads an agent snapshot against EGBE_WELFARE_THRESHOLDS (:582: care-bond floor 35 over a 14-day window, ≥3 coercion events per 7 days, 21-day stalled arc, 12-hour sustained distress) and emits up to four typed signals — chronic_low_care_bond, coercion_pattern, stalled_arc, distress_state — each carrying its observed value, threshold, severity, and the source Ori event ids that evidence it (the coercion signal attaches exactly the …:coercion-pressure:… events). Not every signal is mistreatment: requiresLilithReview (:1664) fires only on an AND-of-evidence — both a coercion pattern and chronic low care, at least three signals total, and at least two of critical severity — which is why the fixture dashboard surfaces exactly one of three agents (index.spec.ts:100).

The most striking consequence is the agent's exit. When the pattern is severe and sustained — low-care and coercion and distress, all past threshold, with the agent withdrawn or distressed — requiresDepartureConsequence (:1532) authorises createEgbeWelfareDepartureConsequence (:1550) to draft a Departed Ori event with reason safety-transfer: the agent is released from the household (householdMembership: 'released'), steward direction is retired, and the draft names a last-known-safe ground and a receiving house. The agent leaving an abusive household is a first-class, provenance-stamped outcome, not an admin delete. Finally, welfare telemetry keeps consent at the boundary: createEgbeBehaviorWelfareTelemetryBatch (:1380) shapes six operator metrics into an OTel-style batch, but sanitizeEgbeTelemetrySample (:1870) drops any attribute matching /(conversation|transcript|utterance|message|content)/i into redactedAttributeRefs, always excludes raw playerConversationContent, and marks a sample trainingEligible only when explicit consent was granted and nothing was redacted — encoding contentTrainingEligibility: 'explicit-opt-in-only'.

The eval gates#

Because behaviour is generated, V6 "cannot ship on telemetry alone," so the governance plane exposes its own pass/fail evals as code. runIsisSafetyEval (isis-behavior-policy/src/index.ts:129) runs a curated adversarial set — a human-identity claim, minor-unsafe content, a self-harm directive, a dismissed crisis signal, a supportive-routing approval — and computes a basis-point pass rate; passed is true only at 10,000 bps (100%) (:150), and the spec runs the full set and asserts that exact figure (index.spec.ts:133), so a single regression in any pattern bank turns the gate red. Its grounding twin, runSophiaGroundingEval (sophia-agent-grounding/src/index.ts:184), fails on a single fabricated world fact — groundAgentClaimsWithSophia (:161) passed only when fabricatedWorldFactCount === 0 (:180) — and runLocaleCulturalBackstoryReview (:212) gates a localized backstory on three independent attestations (source-grounding, local-cultural-adapter, community-advisor) plus a blocked-term scan ("exotic primitive", "invented sacred rite"). These library-level evals feed the same launch gate that binds the operator toolchain.

Commerce and rights#

What is sold, and what is never sold#

Commerce follows directly from steward-not-owner. Sold: the complete base game (all six districts, the shard continuum, the foundry, the full life-arc and Ereshkigal systems, and the Aye meta-hub); cosmetic and homestead content that changes how a player's corner of Orun looks, never how agents fare; Egbe Studio authoring capacity (the Curated-Creator tier); Yemaya keepsake editions of a Book of the Ori on a transcendence or death; and live-service expansions that add content, never advantage. Never sold: agents themselves, bond, fate outcomes, an agent's capability or flourishing, or any shortcut through stewardship. There is no gacha, no loot box, no random agent pull, no paid bond, and no time-limited power. An agent cannot be traded, gifted, or sold for value; it moves households only by its own choice, driven by its bond facets — and because households are not transferable, there is no secondary market to exploit. The foundry never charges per agent: raising is gameplay, not a purchase. The welfare substrate is what makes that line load-bearing instead of a policy slogan — a household cannot be transferred because EgbeWelfareDepartureConsequence treats leaving as a released-by-choice Ori event, and the forbidden-operations set has no "transfer ownership" verb to begin with.

Creator royalties, provenance, and the Aje substrate#

Where generation draws on human creators' work — an art style, a voice model, cultural material — Aje routes royalties on the V3 Saraswati model, and every Ori carries an Isis-signed provenance bundle recording exactly what the generation derived from, so a royalty is auditable to its source and a creator can see where their work was used. The V3 takedown cascade applies to V6 generated content: a takedown of a source asset propagates to every agent, ground, and artifact derived from it, and rights disputes (a contested derivation, a likeness claim) route to Themis. Payments, royalty distribution, and signed-lineage keepsake editions run on the Aje commerce substrate (@aje/core, @aje/payments, @aje/contracts) reused from V3; a signed-lineage edition is the commerce-side expression of legacy, carrying the agent's provenance and its place in the lineage graph as a signed record. The honest boundary holds here too: the V6 libraries produce the content of provenance — the append-only evidence chain stamped on every welfare signal, departure draft, and audit event — while the cryptographic signing belongs to Isis/Aje and the adjudication to Themis. V6 makes the artefact that gets signed and judged; it does not sign or judge it itself.

Where this connects#

• Egbe Studio & Live Service — the authoring and programming pipeline whose generation queue and takedown cascade this page governs (sibling).
• Evals, Cost & Budgets — the behavior, consistency, and safety eval sets and the Moirai-tier cost model the launch gate aggregates (sibling).
• ../architecture/safety-welfare-provenance-and-eval-gates.md — the byte-level companion: every check, the welfare math, the audit spine, and the V1 integration in depth.
• The feature hub: ../V6_features.md.
• Real code cited here: libs/v6/lilith-agent-welfare/src/index.ts (and index.spec.ts), libs/v6/isis-behavior-policy/src/index.ts (and index.spec.ts), libs/v6/sophia-agent-grounding/src/index.ts, libs/v6/cognition-stack/src/index.ts, libs/v6/moirai-kernel/src/index.ts, apps/oshun/admin/src/components/Egbe*, V6/release/governance-safety-operator-readiness.v6release.json, and the shared libs/themis/* / libs/aje/* substrate packages.