V7 Dependencies — Mawu: The Open World & Creator Republic

Status: V7 dependency graph and build order Source: derived from V7/V7_features.md, V7/V7_ARCHITECTURE.md, and V7/V7_TODOS.md. This document carries (1) the build-order DAG across the V7_TODOS sections, (2) the cross-version reuse dependencies (what V7 consumes from V1/V3/V5/V6/Maya), and (3) the external dependencies (third-party runtimes, services, and standards) with the trust posture for each. Date derived: 2026-05-30

Cross-Reference Convention#

• §N → V7_TODOS.md §N. arch§"<anchor>" → V7_ARCHITECTURE.md.
• features§"<anchor>" → V7_features.md. maya§ → DOMAINS/maya/features.md.

1. Build-Order DAG (V7_TODOS sections)#

Edges mean "must be substantially complete before." Sections not on a critical path can proceed in parallel once their inputs exist.

§1 Foundations
 └─> §2 Contracts ───────────────────────────────────┐
      ├─> §3 Trust Boundary ─┐ (build-time invariants;│ bind every section below)
      ├─> §4 Determinism ────┴─> §5 Realm Protocol ──> §6 Moremi ─┬─> §11 Nàná ──> §13 Hera
      │                                                │          │      │
      │                                                ├─> §7 Nephthys   ├─> §12 Pheme
      │                                                │     └─> §8 Danu │
      │                                                └─> §9 Ixchel Sandbox ─┴─> §14 Mawu Studio
      │                                                       └─> §10 Resolver/Conflict/Compositor
      │                                                             └─> §15 Genomes/Forking/Balance
      ├─> §20 Sekhmet ───┐  (gates ALL distribution; must precede §17 fetch path)
      ├─> §17 Abundantia ┴─> §19 Eunomia
      ├─> §22 Anti-Cheat   ├─> §23 Moderation+Minor-Protection
      └─> §25 Incarnation/Federation

§16 Hosting, §18 Economy Firewall, §21 Child Safety, §24 Streaming,
§26 Live-Service, §27 Commerce, §28 A11y/Loc, §29 Telemetry, §30 Evals,
§31 Cross-Platform, §32 Rollout/Launch  → cut across; finalize last.

(Section numbers re-keyed 2026-06-12 to the current V7_TODOS.md numbering — the DAG previously cited the pre-renumbering scheme from before §3 Trust Boundary and §4 Determinism were inserted.)

Critical path (longest chain): §1 → §2 → §9 Ixchel Sandbox → §10 Compositor → §6 Moremi → §7 Nephthys → §8 Danu → §11 Nàná → launch. The two long poles are the Ixchel WASM sandbox (§9, the security keystone) and Danu meshing (§8, the atomic-authority-handoff problem). Both should start as early as their inputs allow and carry the most schedule risk.

Hard ordering rules (do not violate):

• §20 Sekhmet gates §17 distribution. No artifact is fetchable by any client before a clean scan. Build the scan pipeline before the install path goes live.
• §9 Sandbox precedes any executable resource. No realm runs creator code until the sandbox + capability gating + budgets exist (arch§"The WASM Sandbox").
• §7 Nephthys precedes §8 Danu. Meshing's crash recovery and authority handoff depend on the decoupled state store being the source of truth.
• Determinism core (§4) precedes rollback/replay/mesh (arch§"Determinism"): the fixed-timestep deterministic sim + WASM determinism controls are a prerequisite of netcode rollback (§5), mesh replay recovery (§8), and golden replays (§4, CI-gated in §30).
• The trust boundary (arch§"The Trust Boundary") is a build-time invariant, not a late task: platform identity/economy/safety services are consumed by, never implemented inside, the realm plane.

2. Cross-Version Reuse Dependencies#

V7 is integration-heavy. Each row is a hard dependency on existing code (real unless marked planned). Paths verified against the repo.

Reuse risk: the only planned dependency is the Maya forge-* family — which V7 itself builds (§9/§10/§15), so it is owned, not blocked-on-another-team. Everything else is real code; the integration risk is API drift, mitigated by the contracts package (§2) generating typed clients.

3. External Dependencies (with trust posture)#

Standards/regulatory dependencies (compliance, not optional): NCMEC reporting, TAKE IT DOWN Act (US, ≤48h NCII), DSA (EU), COPPA (US under-13), UK Online Safety Act age-assurance duties, GDPR/CCPA DSAR, console certification (Xbox/PS/Switch) constraints on which sandbox tiers a console realm may grant. Jurisdiction-specific legal counsel is a dependency for the economy firewall (gambling/lootbox) and age-assurance design (arch§"The Economy Firewall", arch§"Sekhmet").

4. Single Points of Failure / Schedule Risk#

• Ixchel WASM sandbox (§9): the security keystone; a sandbox escape invalidates the whole "run untrusted code" thesis. Highest verification bar (the sandbox-escape corpus). Start early, staff with security depth.
• Danu atomic authority handoff (§8): the meshing hard problem (no two-writer / zero-owner window). Ship static meshing first; dynamic later.
• Sekhmet child-safety (§20–§21): legally non-negotiable and gates distribution; a miss is an existential/legal failure, not a feature gap.
• Determinism core (§4): a hidden non-determinism source breaks rollback, mesh recovery, and replays simultaneously — catch it with golden replays in CI from day one (§4, CI gate in §30).