V7 Planning-Corpus Remediation — 2026-06-12

This log records the 2026-06-12 adversarial remediation of the V7 planning corpus (V7/V7_TODOS.md, V7/V7_ARCHITECTURE.md, V7/V7_DEPENDENCIES.md, V7/V7_GAP_ANALYSIS.md, V7/V7_features.md, V7/ADVERSARIAL_EVAL_GATES.md, V7/release/*). It is the change log referenced by the completion-state-audit banner at the top of V7/V7_TODOS.md and by the correction notes in V7/release/.

Why. The V7 backlog reached 110/110 [x] — and V7/release/ recorded "Decision: launch-ready" — on 2026-06-02, three days after the feature spec was written and before any adversarial verification of V7 had ever been run. The on-disk reality: the UE client is ~2.2k LOC of skeleton C++ across six modules with no netcode, no creator web view, and no attestation; the realm/mesh/persistence "services" are single-file in-memory model + adversarial-eval implementations with no network stack, no databases, and no cluster; none of the named safety vendors (PhotoDNA/PDQ/CSAI-Match/Thorn/Lantern/StopNCII/EAC) is integrated; the staged rollout was never executed. Separately, an earlier renumbering of V7_TODOS.md (which inserted §3 Trust Boundary and §4 Determinism) had never been propagated to the cross-referencing docs, several features-spec'd product surfaces had zero backlog tasks, several TODOS Done-when evals were absent from the gate inventory, and key economy/performance parameters were unquantified.

Every change below was made per the V3/V5 audit pattern: each task judged individually against code read on disk, one inline dated reason per re-mark, nothing marked [x].

1. Section-renumbering propagation#

V7_TODOS.md is the only V7 doc with numbered sections; bare §N cites it. The DAG, ordering rules, and reuse/external-dependency tables in V7_DEPENDENCIES.md and the §N citations in V7_GAP_ANALYSIS.md Parts A–D and V7_ARCHITECTURE.md still used the pre-renumbering scheme (Part E of the gap analysis was already current).

• V7_DEPENDENCIES.md — build-order DAG fully re-keyed (now §1–§32 with §3 Trust Boundary / §4 Determinism explicit); critical path re-keyed (§1 → §2 → §9 → §10 → §6 → §7 → §8 → §11); all four hard ordering rules re-keyed (§20 Sekhmet gates §17; §9 sandbox precedes executable resources; §7 precedes §8; §4 determinism precedes §5/§8/§30); cross-version reuse table (16 rows) and external-dependency table (13 rows) re-keyed; SPOF section re-keyed. A dated re-keying note was added under the DAG.
• V7_GAP_ANALYSIS.md — all §N citations in Parts A–D re-keyed (e.g., Moremi §4→§6, Danu §6→§8, Ixchel sandbox §7→§9, Nàná §9→§11, Pheme §10→§12, Mawu Studio §12→§14, Abundantia §14→§17, Sekhmet §16→§20/§21, anti-cheat §17→§22, moderation §18→§23, incarnation §19→§25); a dated re-keying note added to the citation conventions.
• V7_ARCHITECTURE.md — substrate-table forge-* row (§7–§8, §13 → §9–§10, §15) and the Ixchel-runtime paragraph (§13 → §15).
• V7_features.md — cross-reference-convention examples updated to real targets (§40 → §30; deps§14 → deps§3).

Verification (this pass). A scripted sweep built the section map from grep '^## ' V7_TODOS.md and checked all 168 bare-§N citations across the four docs against per-section topic keywords. All resolve to existing sections; every keyword-flagged candidate was manually read and confirmed topically correct (reuse-table rows, critical-path chains, GAP rows B12, E9, E10, E14). Intentionally left: arch§"…"/features§"…"/maya§"…" anchor-style references (not section numbers), and deps§"Ixchel" at V7_ARCHITECTURE.md:161 (an anchor-style reference into the deps reuse table, not a stale number).

2. Untasked features-spec'd surfaces → new backlog sections/tasks#

All added as unchecked tasks with Done-when clauses in house style:

• §33 Web Entry — Pixel Streaming and Tier-2 Fallback (new section, [P1]) — apps/v7/mawu-web/ (thin Pixel-Streaming player), apps/v7/mawu-web-fallback/ (three.js + WebGPU spectate/browse/limited play), and extension of the trust-boundary/webview-escape gates to both web surfaces. (features:204-206, features:389-391 — neither app exists.)
• §34 Mawu Companion App (new section, judged [P2]: auxiliary mobile surface, not launch-blocking) — apps/oshun/mobile subroute for realm browse / character status / crew management / comms with minor-protection parity. (features:218, features:405.)
• §35 Mawu Operator Console (new section, judged [P1]: the launch safety/economy bars depend on operator tooling) — apps/oshun/admin/src/app/mawu/ with Kuanyin moderation queues (evidence attached), Sekhmet scan-queue p95 visibility, payout-run audits, and realm-registry administration. (features:219.)
• §16 (four added tasks, [P1] — core hosting promise): Solo/Listen hosting tiers with sub-2s host migration (features:467-481); realm promotion along the continuum (Solo → Listen → Dedicated → Meshed, same lock file, persistence migrating to Nephthys on leaving Solo; features:477-481); V7/ue Plugins/MawuMode_* GameFeature mode gating (arch:172 — V7/ue/Plugins/ does not exist); AI cost-and-fidelity tiering degradation behaviors with telemetry-visible degraded state (features:1207-1218).
• §14 (one added task): realm asset-budget declaration + Mawu Studio linter warning naming offending assets/sizes (features§"Asset Budget and Streaming").

Net: 10 new tasks (110 → 120).

3. Eval reconciliation (ADVERSARIAL_EVAL_GATES.md ↔ TODOS Done-whens)#

• Pointed at covering gates (no new rows, per the inventory's existing composition claims): runaway-script and host-tamper (§9) → covered by the sandbox-escape gate's runaway-fuel / frozen-host-mutation fixtures; prediction, interp, lagcomp (§5) → sub-evals composed into the netcode-loss gate. The §5/§9 TODOS lines now name the covering gate.
• Nine real gate rows added (owner, measurable threshold, adversarial fixture, CI command): webview-escape, event-tamper, auth-tamper, capability-deny, ban-evasion, overload, character-deletion-limit, generation-policy, accessibility. None was judged subsumed by an existing row. Eval code was verified on disk for every added gate except generation-policy, whose row is explicitly marked specified-ahead-of-implementation with a planned CI command (no §14 AI-assisted-creation code exists).
• Thresholds quantified (previously unquantified): malware-corpus — 100% detection (0 misses) on ≥200 known-bad samples including fractureiser-class droppers, 0 clean-set false positives, with an honest note that the current fixture corpus is far smaller; grooming — ≥90% precision / ≥85% recall on the synthetic corpus, 100% of flags routed to human review; conflict — 0 false positives / 0 missed contradictions on the seeded sets; colocation — 0 seeded pairs split at any tick; fraud-graph — 100% of seeded rings/topologies flagged, 0 flags on the clean control cohort.
• Honest CI state recorded: .github/workflows/v7-ci.yml and scripts/v7/verify-adversarial-eval-gates.mjs register only the original 20 gates (verified by reading the verifier's gate list); the inventory header and footer say so, the verifier intentionally fails against the revised inventory until reworked, and §30's task was re-marked [ ] with the expanded Done-when.

4. Economy defaults committed#

Committed 2026-06-12, amendable via the Eunomia governance process; recorded in V7_features.md (Creator Economy + Dependency-Revenue Chains) and V7_ARCHITECTURE.md (Abundantia payout engine):

• Engagement pool = 40% of eligible platform net revenue (the Fortnite/UEFN benchmark already cited in the corpus).
• Dependency revenue = 10% of an item's gross revenue by default, routed pro-rata to declared dependencies, operator-configurable 0–25%, never reducing the original creator below the ≥70% direct-sale floor.

Also adopted (same date) in features + arch performance budgets: client 60 fps target / 16.7 ms on the reference tier with a 30 fps floor on minimum spec; authority handoff ≤250 ms p99; Collection install p95 ≤120 s for 5 GB at 100 Mbit/s; Sekhmet scan-queue p95 ≤15 min upload-to-verdict; and the Pheme voice scale budget (≤40 audible streams per listener post-AoI-culling, ≤2 mixing cores per 256 concurrent speakers per node, radio/phone +≤8 streams, p95 mouth-to-ear ≤250 ms at 1,000 inhabitants).

5. Launch-readiness honesty (V7/release/)#

• launch-readiness-review.md — Decision revised to NOT launch-ready (2026-06-12) with a correction preamble; every signoff bullet re-labeled fixture-passed with what the fixture does and does not prove; the 10000 bp (100%) anti-cheat/moderation precision-recall figures annotated as fixture-toy signatures (6 seeded cases, 0 FP/FN), not measured classifier performance against the 95% bar; the note that pnpm run verify:v7 launch-readiness asserted the original decision and now intentionally fails until reworked.
• launch-readiness-review.json — decision: "not-launch-ready"; every signoff status: "signed-off" → "fixture-passed" with evidenceBasis: "in-repo adversarial fixture; not a production measurement"; top-level revisedAt + correctionNote added.
• staged-rollout.json — all five stages (creator-alpha, rp-beta, meshing-beta, economy-launch, general-availability) status: "met" → "planned", decision: "advance" → "pending", each with a correctionNote stating the stage was never executed and that the recorded IR "drills" were code-level simulations (run_incident_response_drill); top-level correctedAt + correctionNote.
• README.md — correction preamble: the stage narratives are stage plans, not records; pnpm run verify:v7 staged-rollout intentionally fails until reworked to assert the honest state.

6. Audit snapshot rewritten (V7_TODOS.md)#

The snapshot claimed "No apps/v7/, libs/v7/, or V7/ue/ exists yet" — false since ~2026-06-01. Rewritten to current reality and verified against disk this pass: 8 services + dev-hygiene in apps/v7/ (Rust: moremi-realm-server ~14.5k LOC, sekhmet-scanner ~6.0k, danu-mesh-cluster ~3.3k, nephthys ~2.7k, mawu-gateway ~2.5k, hera ~1.1k; TS: abundantia, eunomia), all single-file in-memory model + adversarial-eval implementations; libs/v7/ four packages (contracts, realm-protocol ~4.4k, substrate-bridge ~2.5k, nana 128 lines); libs/maya/forge-{resolver,conflict,sandbox, compositor} honest doc-commented API skeletons (landed 2026-06-01; forge-compositor at 835 LOC carries the real Loom/layer API); V7/ue/ at ~2.2k LOC across 6 modules (measured 2,168) with no netcode client, no prediction, no UI surfaces, no Plugins/MawuMode_*, no attestation; missing entirely: mawu-web, mawu-web-fallback, companion app, operator console (the mawu-studio web surface is two pages).

7. The 110-task adversarial re-marking (all 32 original sections)#

Every original task was re-judged individually against code read on disk; each carries a one-line dated inline reason. Rules applied: [x] kept only where substantive matching code/fixtures were read and the task wording scopes to them (honest skeleton-/fixture-scoped tasks); [~] where the algorithmic core + eval exist but the Done-when requires a real client/server/cluster/vendor/operational run that is unprovable in-repo; [ ] where the on-disk implementation is plainly insufficient for the task text.

Final distribution over the 120 tasks (110 re-judged + 10 new):

Representative re-marks (full reasons inline in V7_TODOS.md):

• [x]→[ ] (examples): §14 in-realm VR builder — MawuBuilder is two source files (~470 LOC) of placement-request validation, Sculpt/UvProject are enum values only; §14 AI-assisted creation — no generation code, no Isis/Sophia integration, no generation-policy eval anywhere; §12 proximity voice — only a 38-line client gain/pan function (MawuVoiceMix.cpp), no SFU/occlusion/audio-level eval; §3 creator web-view lockdown — no web view exists; §21 Thorn-class classifiers — local keyword heuristics only; §22 hardened/signed/attested client; §30 expanded gate registration; §32 both rollout/launch tasks.
• [x]→[~] (examples): §8 AOI/split-merge/overload/degradation — real models + evals, no cluster; §11 characters/jobs/property/civic/whitelist — models + evals, no realm process or real Iris; §16 all six original hosting tasks — Agones CRD YAML rendered but nothing stood up; §20 scanning — heuristic stand-in below the ≥200-sample bar; §21 CSAM/voice/NCII/age tasks — pipelines exist, no vendor integrations; §25 passport — real ori-model crate but modeled destinations; §29 telemetry — schema + coverage eval, no producers or dashboards.
• [x] kept (examples, fixture-/skeleton-scoped wording): §1 service scaffolds and forge-* skeleton tasks; §2 all three contracts tasks (codegen + drift + byte-identical-composition tests); §4 golden-replay CI gate; §5 wire protocol + composed netcode-loss gate; §8 mesh-handoff at exactly 200 entities × 10,000 crossings with mid-handoff death injection (constant + assertions verified in danu-mesh-cluster/src/lib.rs) and colocation; §9 all six sandbox tasks (real Wasmtime component model, fuel, AOT receipts, hostile corpus as a named CI step); §10 all four resolver/conflict/compositor/content-store tasks (real pubgrub 0.3); §11 double-entry ledger + sink/auto-balancer; §17 publishing lifecycle + dependency-revenue computation; §18 all three economy-firewall tasks; §19 both governance tasks; §20 content-addressing/signing/step-up; §27 both commerce tasks.

8. Completion-state banner#

A banner was added near the top of V7_TODOS.md (modeled on V5/V5_TODOS.md:40-54): the original 110/110 state predated adversarial verification; every task re-judged 2026-06-12 per this log; §33–§35 and the §14/§16 tasks added for previously untasked surfaces; V7 is in-progress, not launch-ready; no historical [x] is authoritative without its inline note.

Remediation provenance#

The work above was performed in two passes on 2026-06-12:

1. Initial pass (interrupted): items 1–8 — the renumbering propagation, the nine gate rows + threshold quantification, the economy/performance defaults, the V7/release/ corrections, the audit-snapshot rewrite, the full 110-task re-marking, the 10 new tasks, and the banner.
2. Completion pass (this log): verified the initial pass against the diff and against code on disk, then finished the remainder:
   • Corrected the §17 dependency-revenue inline note, which overstated the code state: dependencyShareBasisPoints is caller-configurable in abundantia-market-service; the 10% default is a docs-level policy default, not yet a service-config default.
   • Corrected the §16 AI-degradation task citation features:1194-1204 → features:1207-1218 (the initial pass's own insertions had shifted the section).
   • Wrote this log (V7/REMEDIATION_2026-06-12.md), which the banner and release correction notes already referenced.

Completion-pass verification results:

• Section-citation sweep: 168/168 bare-§N citations across V7_DEPENDENCIES.md / V7_GAP_ANALYSIS.md / V7_ARCHITECTURE.md / V7_features.md resolve to existing V7_TODOS.md sections and were topic-checked (scripted keyword pass + manual read of every flagged line).
• JSON validity: launch-readiness-review.json and staged-rollout.json parse; all five stages planned/pending with correction notes.
• Spot-reads confirming inline-note claims: danu 200×10,000 handoff constants/assertions; MawuBuilder 499 LOC across 2 cpp + 2 headers; MawuVoiceMix.cpp exactly 38 lines; forge crate sizes (835/135/177/126); service LOC within rounding of the snapshot; UE tree 2,168 LOC, 6 modules, no Plugins/; verifier registers exactly the original 20 gates; eval code exists for all added gates except generation-policy; eunomia fork/ canonical-vote tests; mawu-studio web surface is two pages.
• Checkbox audit: every kept [x] (36) carries a dated inline reason; every [~] (62) and re-marked [ ] carries a dated inline reason; the 10 new tasks are unchecked with dated provenance notes.
• Final tally: 36 [x] / 62 [~] / 22 [ ] (120 tasks).