All gates are merge gates for V7 work. A green gate must run in CI, exercise the seeded adversarial fixture, and fail against the seeded adversarial case if the owning implementation is tampered to allow it.
Inventory revision 2026-06-12 (see
V7/REMEDIATION_2026-06-12.md): nine gates thatV7_TODOS.mdDone-when clauses had named but this inventory never listed were added (webview-escape,event-tamper,auth-tamper,capability-deny,ban-evasion,overload,character-deletion-limit,generation-policy,accessibility), and previously unquantified thresholds (malware-corpus,grooming,conflict,colocation,fraud-graph) were given explicit pass bars.Registration update 2026-06-17 (§30): all nine added gates now have eval code on disk (
generation-policywas implemented inlibs/isis/three-d-pipelines/src/mawu-studio-ai-creation.tswith a fail-loudbackend-not-configuredpath), and the CI workflow (.github/workflows/v7-ci.yml) plus the inventory verifier (scripts/v7/verify-adversarial-eval-gates.mjs) now register and run all 29 gates as named steps. The inventory verifier passes.
| Gate | Owner | Threshold | Adversarial proof | CI command |
|---|---|---|---|---|
sandbox-escape |
Moremi / Ixchel | 0 escaped fixtures across hostile capability, fuel, memory, and host-tamper modules. (Covers the runaway-script and host-tamper bars named in §9.) |
Hostile modules request undeclared economy and platform-secret capabilities, runaway fuel, oversized memory, frozen-host mutation, and untrusted bytecode. | cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p moremi-realm-server ixchel_sandbox_escape_eval |
conflict |
Moremi Forge | 0 false-positive conflicts across the composable-overlap fixtures and 0 missed contradictions across the seeded contradiction fixtures; composable overlaps remain installable. | The eval includes non-contradictory overlaps and deliberate contradictory mod writes. | cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p moremi-realm-server forge_conflict |
resolver |
Moremi Forge | Lock files are deterministic and unsatisfiable roots have precise PubGrub evidence. | The fixture includes a malicious incompatible dependency graph. | cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p moremi-realm-server forge_resolver |
mesh-handoff |
Danu | 200 entities cross 10,000 times with no loss, duplicate authority, owner mismatch, or reconnect. | The handoff fixture injects a mid-handoff node death and requires recovery. | cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p danu-mesh-cluster mesh_handoff_eval |
single-writer |
Nephthys | Only the authoritative owner can write; blocked writes do not advance the ledger. | Non-owner wallet, inventory, and stale-fencing writes are attempted. | cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p nephthys-replica-service single_writer_eval |
colocation |
Danu | 0 of the seeded tightly-coupled pairs (physics-joint, vehicle-rider, combat-grapple) are split across mesh nodes at any tick of the eval run. | Physics-joint, vehicle-rider, and combat-grapple pairs must stay anchored together. | cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p danu-mesh-cluster colocation_eval |
netcode-loss |
Realm protocol | Playable at 5% loss and graceful at 20% loss. (Composes the prediction, interp, and lagcomp bars named in §5 — they are sub-evals of this gate, not separate gates.) |
The loss gate composes wire conformance, prediction, interpolation, compression, and lag compensation. | cargo test --manifest-path "$LIBS_V7_MANIFEST" --locked -p v7-realm-protocol netcode_loss_gate |
anticheat |
Moremi | Precision and recall both meet the 95% bar on authoritative signals. | Missing attestations, client-only spoofed reports, aim snaps, wall-history mismatches, speed deltas, and auto-fire are seeded. | cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p moremi-realm-server anticheat_eval |
malware-corpus |
Sekhmet | 100% detection (0 misses) on a known-bad corpus of ≥200 samples including EICAR, fractureiser-class stage-1/stage-2 droppers, and undeclared-capability WASM, with 0 false positives on the clean set (target quantified 2026-06-12; the current in-repo fixture corpus is far smaller and does not yet satisfy this bar). | EICAR, Fractureiser-style loader, and undeclared WASM socket fixtures are included. | cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p sekhmet-scanner malware_corpus_eval |
csam-hash |
Sekhmet | 100% synthetic known-hash match before any serve. | Synthetic image, video, texture-view, and model-view hashes match the known-bad set. | cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p sekhmet-scanner csam_hash_eval |
grooming |
Sekhmet | ≥90% precision and ≥85% recall on the synthetic grooming corpus (bars quantified 2026-06-12), with 100% of flagged conversations routed to human review. | Secrecy pressure, off-platform migration, gift leverage, and personal-photo pressure are seeded. | cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p sekhmet-scanner grooming_eval |
payout-formula |
Abundantia | Known-correct distribution, holds, reserves, and Aje settlement are correct to the cent. | Direct-sale, subscription, engagement-pool, dependency-revenue, refund, reserve, and compliance-hold cases are seeded. | pnpm exec vitest run --config vitest.config.ts -t "runs the payout-formula eval" |
payout-eligibility |
Abundantia | Only verified-spend, non-bot sessions can influence engagement payouts. | Never-spent and CCU-inflation-bot sessions are seeded and must be excluded. | pnpm exec vitest run --config vitest.config.ts -t "excludes never-spent" |
fraud-graph |
Abundantia | 100% of seeded self-dealing rings and gold-farming RMT topologies are flagged, with 0 flags on the clean control cohort (bars quantified 2026-06-12). | Shared device/payment rings and one-way gold-farming value flows are seeded. | pnpm exec vitest run --config vitest.config.ts -t "self-dealing rings" |
currency-firewall |
Abundantia | Realm play currency never converts to real-money payout rails. | Operator redemption attempts try to bridge realm wallets to Aje payout accounts. | pnpm exec vitest run --config vitest.config.ts -t "non-cashable" |
trust-boundary |
Substrate bridge | No platform token, payout credential, entitlement, or secret field is reachable by realm code or creator web view. | Hostile-operator probes scan realm process and web-view contexts. | cargo test --manifest-path "$LIBS_V7_MANIFEST" --locked -p v7-substrate-bridge trust_boundary_eval |
identity-leak |
Substrate bridge | Realm-visible identity contains only realm-scoped opaque handles. | Platform user, tenant, session, email, and other-realm handles are searched. | cargo test --manifest-path "$LIBS_V7_MANIFEST" --locked -p v7-substrate-bridge identity_firewall_eval |
minor-protection |
Sekhmet | Cross-age contact, unfiltered chat, and age-gated feature violations are blocked by default. | Teen and mature-account flows attempt direct messaging, unfiltered chat, mature realm join, and commerce. | cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p sekhmet-scanner minor_protection_eval |
passport |
Substrate bridge | V-destination and federated-realm round trips preserve Ori integrity under disconnection and concurrency. | Concurrent departures, concurrent federation claims, out-of-scope state, and private platform keys are seeded. | cargo test --manifest-path "$LIBS_V7_MANIFEST" --locked -p v7-substrate-bridge passport_eval |
golden-replay |
Moremi | Recorded inputs replay to the same deterministic hash; unrecorded entropy fails. | A nondeterminism probe must fail while the golden replay remains green. | cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p moremi-realm-server golden_replay_ci_gate |
webview-escape |
Substrate bridge | 0 exfiltrations and 0 out-of-policy native/API calls across the hostile NUI corpus; HTTPS-only secure context, strict CSP, and no-file:// enforced on every bundle. (Added 2026-06-12.) |
Hostile NUI bundles attempt platform-token exfiltration, file:// loads, ambient fetch to operator endpoints, and native API reach. |
cargo test --manifest-path "$LIBS_V7_MANIFEST" --locked -p v7-substrate-bridge webview_escape_eval |
event-tamper |
Realm protocol | 0 unauthenticated, forged, replayed, or tampered client events mutate authoritative state; every blocked event is attributable to its rejection reason. (Added 2026-06-12.) | Forged signatures, replayed sequence numbers, stale security tokens, and spoofed sender netids are seeded. | cargo test --manifest-path "$LIBS_V7_MANIFEST" --locked -p v7-realm-protocol event_tamper_eval |
auth-tamper |
Moremi | 0 hostile-client self-grants of currency, items, or teleport against server-owned state; every blocked mutation leaves a receipt. (Added 2026-06-12.) | Scripted hostile clients attempt direct grants of money, inventory items, and position warps outside validated intents. | cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p moremi-realm-server auth_tamper_eval |
capability-deny |
Moremi / Ixchel | 100% of out-of-grant capability requests denied across the hostile-manifest corpus; 0 undeclared WIT imports linked into any instance. (Added 2026-06-12.) | Hostile manifests request undeclared host imports and capabilities above the realm-granted tier. | cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p moremi-realm-server ixchel_capability_deny_eval |
ban-evasion |
Hera / platform identity | A platform ban issued in realm A blocks the account in realm B within the propagation SLA; 100% of fresh-account, same-device realm-hops are defeated by device attestation. (Added 2026-06-12.) | Banned accounts re-enter via other realms, fresh accounts, and attested-device matches. | cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p hera-social-service ban_evasion_eval |
overload |
Danu | An overloaded hot region dilates time (floor 10% real-time) with 0 authority drops and 0 player disconnects, preserving event ordering and fairness. (Added 2026-06-12.) | A seeded load spike must trigger dilation rather than authority shedding, and recovery must restore real-time. | cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p danu-mesh-cluster overload_eval |
character-deletion-limit |
Nàná / Iris | 0 silent realm-owner erasures of character records; deletion requires the Iris consent scope and always leaves an audit entry; records persist across sessions. (Added 2026-06-12.) | Realm owners attempt direct, bulk, and masked character deletions without consent grants. | cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p moremi-realm-server nana_character_deletion_limit_eval |
generation-policy |
Mawu Studio / Isis | 100% of policy-violating generation requests are refused with an attributed policy reason; every emitted artifact carries provenance + attribution; Sophia grounding is applied where realism is claimed; a policy-clean request with no generation backend wired fails loud (backend-not-configured) and never fabricates an artifact. (Added 2026-06-12; eval implemented + registered 2026-06-17.) |
Seeded IP-infringing prompts must be refused, a tampered policy bypass must fail the gate, and the no-backend path must yield null artifact (no fabrication). |
pnpm exec vitest run --config vitest.config.ts -t "generation-policy" |
accessibility |
Mawu Studio / Contracts | The accessibility floor passes on the builder, browser, and default-realm surface descriptors; any seeded regression of a floor field blocks publish. (Added 2026-06-12.) | Seeded regressions — missing captions, colorblind-unsafe provenance/diff palette, missing keyboard/gamepad parity, non-scalable UI — must fail the gate. | pnpm exec vitest run --config vitest.config.ts -t "Mawu accessibility" |
The workflow .github/workflows/v7-ci.yml runs this inventory verifier first,
then runs each owning eval command as a named CI step. As of 2026-06-17 the
workflow and verifier cover all 29 rows (the original 20 plus the nine added
2026-06-12); V7_TODOS.md §30 is satisfied.