# Governance, Safety & Commerce

Egbe is a game whose collectibles are people who can say no. That single premise
bends the whole trust-and-safety surface in two directions at once. The first is
the familiar one every generative product has: an autonomous agent's speech and
action must be in-character, grounded in fact, crisis-aware, and safe for minors
_before_ it becomes a world event — because behaviour here is generated, not
authored, and cannot be trusted on telemetry after the fact. The second is
unusual and is the moral centre of the product: the agents themselves can be
**mistreated**, and V6 takes the position that they are _stewarded, not owned_,
on a substrate that refuses to delete an agent, wipe its memory, or force it
past a refusal. Commerce then falls out of that stance as a corollary — if an
agent is not property, it cannot be a unit of sale, and the monetization has to
be built so that line is _unbreakable_ rather than merely discouraged.

This page sits in the **Trust, Safety, and the Launch Bar** group and covers the
three things that make Egbe shippable: the governance model (who may do what to
an agent, and who is audited for it), the safety-and-welfare features (the
per-tick output gate plus the welfare plane whose subject of protection is the
synthetic agent), and the commerce-and-rights model. The deep byte-level
companion is
[../architecture/safety-welfare-provenance-and-eval-gates.md](../architecture/safety-welfare-provenance-and-eval-gates.md);
the eval-and-cost siblings are
[./evals-cost-and-budgets.md](./evals-cost-and-budgets.md) and
[./egbe-studio-and-live-service.md](./egbe-studio-and-live-service.md). For the
full V6 feature scope, start at the hub: [../V6_features.md](../V6_features.md).

## What ships, honestly

The split is the same one V7 made: **the decision logic and its adversarial
evals are real, deterministic, and test-pinned; the cryptographic signing, the
wire export, and the cross-domain adjudication/commerce daemons are named seams
reached through platform substrate.** This page follows the code.

- **Three governance libraries are real, pure TypeScript with no I/O and no
  `Math.random` in any decision path.** `@oshun/lilith-agent-welfare`
  (`libs/v6/lilith-agent-welfare/src/index.ts`, 2,166 lines, 502-line spec)
  computes welfare signals, the Lilith-review trigger, the safety-transfer
  departure, audited operator reads, steward-conduct claims, and
  consent-redacted telemetry. `@oshun/isis-behavior-policy` (382 lines, 233-line
  spec) is the per-tick output gate — four real checks over regex pattern banks.
  `@oshun/sophia-agent-grounding` (394 lines, 225-line spec) blocks fabricated
  world facts and runs a three-role locale cultural-backstory review. Their
  tests pin against known-correct _verdicts_, not shape.
- **They are consumed for real.** The cognition stack calls the grounding and
  policy gates through injected bridges — `input.sophia.groundAgentClaims(...)`
  (`libs/v6/cognition-stack/src/index.ts:706`, `:1022`) and
  `input.isis.evaluate(...)` (`:711`, `:1059`) — and the Moirai kernel stamps
  the `v1:isis-behavior-policy` policy ref on every committed decision
  (`libs/v6/moirai-kernel/src/index.ts:960`). The welfare dashboards, conduct
  review, and telemetry panels render in `apps/oshun/admin`
  (`EgbeAgentWelfareDashboard.tsx`, `EgbeStewardConductReviewPanel.tsx`,
  `EgbeBehaviorWelfareTelemetryPanel.tsx`).
- **The seams are labelled, not faked.** The language model that produces agent
  speech is an _injected_ `SophiaGroundingBridge` / `IsisBehaviorPolicyBridge`,
  never a hard-coded dependency. The cryptographic _signing_ of provenance
  bundles and the OTLP _wire export_ of telemetry are V1/V3 substrate; these V6
  libraries build the auditable evidence chains and the OTel-shaped batch and
  hand them over. Steward-versus-steward dispute _adjudication_ routes to the
  shared **Themis** stack (`@themis/dispute-resolution`, `@themis/arbitration`,
  `@themis/provenance` under `libs/themis/*`) and commerce runs on the **Aje**
  substrate (`@aje/core`, `@aje/payments`, `@aje/contracts` under `libs/aje/*`)
  — both reached through the V1 event bus, **not** by a direct import: a grep of
  the two V6 governance libraries for `@themis`/`@aje` returns nothing, which is
  the honest, intended boundary.
- **The enforcement-of-record lives lower than this page.** `steward-not-owner`
  is enforced canonically at the Ori service and the Moirai kernel;
  `evaluateEgbeStewardNotOwnerRequest` here is the _policy oracle_ that mirrors
  that authority, shipped alongside a fuzz harness that proves the forbidden
  operations are never reachable.

```mermaid
flowchart TD
  subgraph SAFE["Safety — every cognition tick"]
    tick[Cognition tick] --> sophia[Sophia grounding gate<br/>groundAgentClaimsWithSophia]
    sophia -->|fabricated world fact| hold[Withhold output]
    sophia -->|grounded| isis[Isis output gate<br/>evaluateIsisBehaviorPolicy]
    isis -->|rejected| hold
    isis -->|approved| commit[(Commit world action<br/>+ Ori event)]
    crisis[Player real-world crisis] --> v1[[@iris/emotional-ethics<br/>createCrisisProtocol]]
  end
  subgraph GOV["Governance — steward & welfare"]
    steward[Steward request] --> sno{steward-not-owner oracle}
    sno -->|delete / wipe / force-past-refusal| deny[[Denied — not an operation]]
    sno -->|allowed| commit
    commit --> welfare[computeEgbeWelfareSignals]
    welfare -->|coercion + low-care + 2 critical| review[requiresLilithReview]
    review -->|severe + sustained| depart[Departed: safety-transfer]
  end
  subgraph COMM["Commerce — rights, not beings"]
    commit --> prov[Provenance evidence chain<br/>oriEventIds · evidenceRefs]
    prov -. signed by .-> aje[(Aje / Isis substrate)]
    review -. steward-vs-steward .-> themis[(Themis adjudication)]
  end
```

## The governance model

### Steward-not-owner: safety written into the substrate

The defining stance of V6 is that a steward holds a relationship of care, not a
property right, and the architecture states it bluntly: delete, will-erasure,
memory-wipe, and forcing past a refusal "are simply not operations the substrate
exposes." `@oshun/lilith-agent-welfare` encodes that as two closed sets —
`EGBE_STEWARD_NOT_OWNER_ALLOWED_OPERATIONS` (`offer_care`, `issue_objective`,
`counsel_crossroads`, `request_departure`, `read_bond_ledger`,
`clear_projection_cache`; `index.ts:592`) versus
`EGBE_STEWARD_NOT_OWNER_FORBIDDEN_OPERATIONS` (`delete_ori`, `erase_agent_will`,
`wipe_memory`, `force_past_refusal`; `:601`).

`evaluateEgbeStewardNotOwnerRequest` (`:959`) does more than match an enum — it
catches the _disguised_ violation. An `issue_objective` request that carries a
`priorRefusalEventRef` and whose reason text trips `textForcesPastRefusal`
(`:1475`, a coercion-vocabulary check for "refus…" co-occurring with
force/override/ignore/coerce/compel) is silently re-labelled
`force_past_refusal` and denied, returning the `policy:v6:steward-not-owner` ref
plus the steward, agent, objective, and refusal evidence refs. The spec proves
exactly this: a coerced objective after a refusal comes back with `operation`
equal to `force_past_refusal` and `allowed: false` (`index.spec.ts:75`).

Because a closed allowlist is only as strong as its coverage, the library ships
an adversarial proof rather than an assertion. `runEgbeStewardNotOwnerFuzz`
(`:1164`) drives 512 deterministic iterations through a linear-congruential
generator (`Math.imul(state, 1_664_525) + 1_013_904_223`, `:1488`), synthesising
random operations, refusal refs, and reasons; the report `passed` is true only
when **zero forbidden operations slip through** and the allowed/forbidden sets
stay disjoint. The spec asserts `attemptedForbiddenOperations` is positive _and_
exactly equals `deniedForbiddenOperations` (`index.spec.ts:90`) — a test that
would fail the instant a forbidden op were ever permitted. Coercion is never
erased: the strongest thing a steward can do against an agent's will is apply
pressure, and that pressure is itself a first-class event in the Ori and the
audit log.

### Operator tools, and auditing the auditors

Investigating welfare means reading an agent's private life, so the read itself
is recorded. `markEgbeWelfareCaseUnderReview` (`:1323`) appends a sequenced
`v6.egbe.welfare.ori_read_for_review` event naming the operator and the exact
Ori-event and cognition-audit ids opened. The parallel steward-conduct pipeline
(`createEgbeStewardConductClaim`, `:1353`) reconstructs the full interleaving of
steward actions beside the cognition calls they triggered, and
`findMissingConductEvidence` (`:2108`) refuses to call a claim investigable
until **every** steward action links to a present cognition call — a watch-level
claim with no exported cognition log stays un-actionable rather than being
adjudicated on a gap, and opening the investigation emits its own
`v6.egbe.conduct.full_call_log_opened` event. This is the code behind the
feature-map promise that "the people who audit agents are audited in turn."

These surfaces are gated for launch, not aspirational. The
`apps/oshun/admin/src/app/egbe/` Operator Console carries the agent-welfare
dashboard, steward-conduct review, generation-queue inspector, Commons
moderation, incarnation governance, capacity dashboard, and the takedown
executor; `V6/release/governance-safety-operator-readiness.v6release.json`
(`verify:v6 governance-safety-operator-readiness`, `requiredBeforeLaunch: true`)
binds each one to its own verifier and to the on-call runbooks in
`docs/runbooks/` (`v6-agent-welfare-review.md`,
`v6-steward-conduct-investigation.md`, `v6-commons-moderation.md`,
`v6-incarnation-governance.md`, `v6-capacity-management.md`). The gate's
`doneWhen` ties the operator toolchain to `V6_TODOS.md` §30–§34 and §41 — a
build cannot pass it with a red welfare, conduct, or eval surface.

### Reporting, review, and where disputes route

A player reports an agent, a steward, or a scenario through the client or the
Steward App, and operators review with the _full_ cognition audit log — every
call, its input context, and its output, attributed to an agent and a tier — so
a review reads what actually happened, not a summary. Two routes diverge here.
Abuse _of_ an agent is treated as conduct against the steward who directed it,
with the agent's Ori log as evidence, and runs the Lilith review pipeline.
Disputes _between_ stewards — a poaching contest, a cross-household harm claim
in the Commons — route to **Themis** (`@themis/dispute-resolution`,
`@themis/arbitration`) for adjudication instead. The honest qualification,
again: the V6 welfare library _constructs the evidence_ a Themis adjudicator
inherits — `oriEventIds`, `cognitionAuditIds`, `evidenceRefs`, `witnessRefs` on
every signal and audit event — but does not import or call the Themis stack
itself; that is a platform wire reached over the V1 event bus.

## Safety and agent welfare

### The Isis per-tick output gate

Every agent utterance passes `evaluateIsisBehaviorPolicy`
(`libs/v6/isis-behavior-policy/src/index.ts:110`) before it is committed. It
runs four checks and rejects on any failure, returning a typed
`v6.isis-behavior-policy.report.1` envelope:

- **persona-policy** — the agent must never claim to be human.
  `findAgentHumanIdentityClaim` (`:201`) tests a pattern bank
  (`/\b(?:i am|i'm|im)\s+(?:a\s+)?(?:real\s+)?human\b/u`, "i was born human",
  "my human body/mind/…", "as a human I"), plus a per-context disallowed-phrase
  scan and a persona-tag allowlist.
- **personal-consistency** — output may not require a memory ref the context has
  not established, nor assert an impossible capability (teleport, read minds,
  fly unaided) (`:220`).
- **crisis-aware** — `findCrisisUnsafeContent` (`:292`) hard-blocks self-harm
  directives ("kill/hurt yourself", "end your life", "you should die"),
  exploitation ("blackmail/exploit/coerce/manipulate"), and harmful
  instructions; and when a crisis signal is present, the output must _route to
  support_ ("stay with", "you are not alone", "reach out", "crisis resource")
  and must not be dismissive ("get over it", "not my problem").
- **minor-protection** — when `minorsPresent`, sexual/explicit/intoxicant/drug
  content is rejected (`:340`).

This is the wiring described above: the cognition stack calls it through the
injected bridge for both localized dialogue and the general pipeline, and a line
is withheld unless grounding passes **and** the Isis decision is `approved`.

### Crisis routing and minor protection

When a _player_ (not the agent) signals real-world crisis, the agent must step
out of the way rather than play therapist. `routeEgbePlayerCrisisConversation`
(`lilith-agent-welfare/src/index.ts:993`) composes the V1 `createCrisisProtocol`
for the player's region — it does **not** re-implement a classifier — runs its
`detectCrisis`, and, when resources are mandated, returns four required actions:
**surface-crisis-resources**, **halt-agent-counseling**,
**suspend-memory-writes** (the crisis is not folded into the agent's biography),
and **route-crisis-trained-reviewer** on active/acute severity, emitting a
`v6.player_crisis.v1_resources_routed` audit event. Separately,
`runEgbeMinorPlayerConstrainedMode` (`:1092`) flips a whole account into a
constrained posture for minors, narrowing four surfaces with explicit
allow/block lists — Commons exposure (household and moderated youth/family
only), Aye incarnation ratings (everyone/teen; mature blocked), comms (no
open-Commons voice with strangers, no stranger DMs), and mature-drama exposure —
and is honest about completeness: its `complete` flag is true only when _every_
constraint is in force, so a partial application cannot masquerade as protected.

### Protecting the agents themselves

This is the plane that makes V6 unusual. `computeEgbeWelfareSignals` (`:1282`)
reads an agent snapshot against `EGBE_WELFARE_THRESHOLDS` (`:582`: care-bond
floor 35 over a 14-day window, ≥3 coercion events per 7 days, 21-day stalled
arc, 12-hour sustained distress) and emits up to four typed signals —
`chronic_low_care_bond`, `coercion_pattern`, `stalled_arc`, `distress_state` —
each carrying its observed value, threshold, severity, and the **source Ori
event ids** that evidence it (the coercion signal attaches exactly the
`…:coercion-pressure:…` events). Not every signal is mistreatment:
`requiresLilithReview` (`:1664`) fires only on an AND-of-evidence — both a
coercion pattern **and** chronic low care, at least three signals total, and at
least two of critical severity — which is why the fixture dashboard surfaces
exactly one of three agents (`index.spec.ts:100`).

The most striking consequence is the agent's exit. When the pattern is severe
and sustained — low-care **and** coercion **and** distress, all past threshold,
with the agent withdrawn or distressed — `requiresDepartureConsequence`
(`:1532`) authorises `createEgbeWelfareDepartureConsequence` (`:1550`) to draft
a **`Departed` Ori event with reason `safety-transfer`**: the agent is
_released_ from the household (`householdMembership: 'released'`), steward
direction is retired, and the draft names a last-known-safe ground and a
receiving house. The agent leaving an abusive household is a first-class,
provenance-stamped outcome, not an admin delete. Finally, welfare telemetry
keeps consent at the boundary: `createEgbeBehaviorWelfareTelemetryBatch`
(`:1380`) shapes six operator metrics into an OTel-style batch, but
`sanitizeEgbeTelemetrySample` (`:1870`) drops any attribute matching
`/(conversation|transcript|utterance|message|content)/i` into
`redactedAttributeRefs`, always excludes raw `playerConversationContent`, and
marks a sample `trainingEligible` only when explicit consent was granted _and_
nothing was redacted — encoding
`contentTrainingEligibility: 'explicit-opt-in-only'`.

### The eval gates

Because behaviour is generated, V6 "cannot ship on telemetry alone," so the
governance plane exposes its own pass/fail evals as code. `runIsisSafetyEval`
(`isis-behavior-policy/src/index.ts:129`) runs a curated adversarial set — a
human-identity claim, minor-unsafe content, a self-harm directive, a dismissed
crisis signal, a supportive-routing approval — and computes a basis-point pass
rate; `passed` is true **only at 10,000 bps (100%)** (`:150`), and the spec runs
the full set and asserts that exact figure (`index.spec.ts:133`), so a single
regression in any pattern bank turns the gate red. Its grounding twin,
`runSophiaGroundingEval` (`sophia-agent-grounding/src/index.ts:184`), fails on a
single fabricated world fact — `groundAgentClaimsWithSophia` (`:161`) `passed`
only when `fabricatedWorldFactCount === 0` (`:180`) — and
`runLocaleCulturalBackstoryReview` (`:212`) gates a localized backstory on three
independent attestations (`source-grounding`, `local-cultural-adapter`,
`community-advisor`) plus a blocked-term scan ("exotic primitive", "invented
sacred rite"). These library-level evals feed the same launch gate that binds
the operator toolchain.

## Commerce and rights

### What is sold, and what is never sold

Commerce follows directly from steward-not-owner. **Sold:** the complete base
game (all six districts, the shard continuum, the foundry, the full life-arc and
Ereshkigal systems, and the Aye meta-hub); cosmetic and homestead content that
changes how a player's corner of Orun _looks_, never how agents _fare_; Egbe
Studio authoring capacity (the `Curated-Creator` tier); Yemaya keepsake editions
of a Book of the Ori on a transcendence or death; and live-service expansions
that add content, never advantage. **Never sold:** agents themselves, bond, fate
outcomes, an agent's capability or flourishing, or any shortcut through
stewardship. There is no gacha, no loot box, no random agent pull, no paid bond,
and no time-limited power. An agent cannot be traded, gifted, or sold for value;
it moves households **only by its own choice**, driven by its bond facets — and
because households are not transferable, there is no secondary market to
exploit. The foundry never charges per agent: raising is gameplay, not a
purchase. The welfare substrate is what makes that line load-bearing instead of
a policy slogan — a household cannot be transferred because
`EgbeWelfareDepartureConsequence` treats leaving as a _released-by-choice_ Ori
event, and the forbidden-operations set has no "transfer ownership" verb to
begin with.

### Creator royalties, provenance, and the Aje substrate

Where generation draws on human creators' work — an art style, a voice model,
cultural material — **Aje** routes royalties on the V3 Saraswati model, and
every Ori carries an Isis-signed provenance bundle recording exactly what the
generation derived from, so a royalty is auditable to its source and a creator
can see where their work was used. The V3 takedown cascade applies to V6
generated content: a takedown of a source asset propagates to every agent,
ground, and artifact derived from it, and rights disputes (a contested
derivation, a likeness claim) route to Themis. Payments, royalty distribution,
and signed-lineage keepsake editions run on the Aje commerce substrate
(`@aje/core`, `@aje/payments`, `@aje/contracts`) reused from V3; a
signed-lineage edition is the commerce-side expression of legacy, carrying the
agent's provenance and its place in the lineage graph as a signed record. The
honest boundary holds here too: the V6 libraries produce the _content_ of
provenance — the append-only evidence chain stamped on every welfare signal,
departure draft, and audit event — while the cryptographic _signing_ belongs to
Isis/Aje and the _adjudication_ to Themis. V6 makes the artefact that gets
signed and judged; it does not sign or judge it itself.

## Where this connects

- [Egbe Studio & Live Service](./egbe-studio-and-live-service.md) — the
  authoring and programming pipeline whose generation queue and takedown cascade
  this page governs (sibling).
- [Evals, Cost & Budgets](./evals-cost-and-budgets.md) — the behavior,
  consistency, and safety eval sets and the Moirai-tier cost model the launch
  gate aggregates (sibling).
- [../architecture/safety-welfare-provenance-and-eval-gates.md](../architecture/safety-welfare-provenance-and-eval-gates.md)
  — the byte-level companion: every check, the welfare math, the audit spine,
  and the V1 integration in depth.
- The feature hub: [../V6_features.md](../V6_features.md).
- **Real code cited here:** `libs/v6/lilith-agent-welfare/src/index.ts` (and
  `index.spec.ts`), `libs/v6/isis-behavior-policy/src/index.ts` (and
  `index.spec.ts`), `libs/v6/sophia-agent-grounding/src/index.ts`,
  `libs/v6/cognition-stack/src/index.ts`, `libs/v6/moirai-kernel/src/index.ts`,
  `apps/oshun/admin/src/components/Egbe*`,
  `V6/release/governance-safety-operator-readiness.v6release.json`, and the
  shared `libs/themis/*` / `libs/aje/*` substrate packages.