# V7 Features — Mawu: The Open World & Creator Republic (Unreal Engine 5 + Maya) Status: V7 feature inventory Source: **originating design document for V7.** Like V6 — and unlike V1–V5, whose feature maps were derived from a pre-existing implementation backlog — V7 begins from this document. `V7_TODOS.md` is derived from the scope defined here, and thereafter the backlog checklist becomes the source of truth for completion state. V7 productizes the **Maya** engine domain's planned modding framework (`DOMAINS/maya/features.md` § "Universal Modding Framework (Maya Forge)"), extends the **V5** open-world online backbone (`V5/V5_features.md` § "Online Services & Multiplayer Infrastructure"), and reuses the **V6** Ori portable identity (`V6/V6_features.md` § "The Ori — Portable Identity and Destiny"). Audience: product, design, engineering, AI/agents, art, audio, generative-AI, netcode, security, trust-and-safety, live-service, rights, and research leads scoping V7. Inspired by the live-design footprint of GTA Online, FiveM / RedM (Cfx.re) and the ESX / QBCore / Qbox / ox framework lineage, Star Citizen's server meshing, Roblox Studio + Luau, Unreal Editor for Fortnite + Verse, mod.io, Nexus Mods + Vortex Collections, Wabbajack + Mod Organizer 2, Steam Workshop, Bethesda's Creation Kit + Creations, ArmA Reforger's Enfusion + mod.io console pipeline, and Garry's Mod / s&box. Date derived: 2026-05-29 Naming note: every V7 subsystem is named for a goddess, consistent with the Oshun monorepo convention, and each name was checked against the existing `libs/`, `apps/`, and `DOMAINS/` registries to avoid collision. The Maya engine domain's own package identifiers (`forge-resolver`, `forge-conflict`, `forge-sandbox`, `forge-compositor`, and the planned `Loom` / `Variants` / `Crucible`) are cited as that domain's API, attributed to Maya, and folded under the feminine-named V7 subsystems rather than re-introduced as new names. > **This feature map has been decomposed into focused pages under > [`features/`](./features/README.md).** This file remains the canonical hub — > it preserves every section heading (so existing `features§"…"` and > `V7_features.md#…` anchors keep resolving); the in-depth, code-grounded > companion pages live under [`features/`](./features/README.md). Start at the > [features page index](./features/README.md). The runtime/package architecture > is in [`V7_ARCHITECTURE.md`](./V7_ARCHITECTURE.md) / > [`architecture/`](./architecture/README.md). ## Purpose This document is the **feature map for V7**. It describes what V7 ships across community-run persistent worlds (Mawu realms), the server-authoritative roleplay framework, the massively-multiplayer meshing and persistence layer, proximity voice, the persistent player social graph, the productized Maya modding stack, the cross-platform creator-distribution and creator-economy republic, and the executable-UGC trust-and-safety regime that makes all of it safe. It is product-shaped: it states what the player and the creator experience and what each subsystem owns. `V7_TODOS.md` carries the numbered execution backlog and agent execution order; `V7_ARCHITECTURE.md` carries the technical design; `V7_DEPENDENCIES.md` carries the dependency graph. V7 is **one coherent product — a community-run open-world roleplay-and-creation platform — not a single authored game.** Where V2–V6 are authored experiences Oshun builds, V7 is the **substrate that lets players build, host, govern, roleplay in, and monetize their own persistent worlds**, and the creator republic that distributes them. It is the Oshun answer to the convergence the industry is racing toward: FiveM's server-authoritative roleplay + Roblox's safe-scripting UGC economy + mod.io's cross-platform distribution + Fortnite's engagement-payout creator economy — none of which any single existing platform delivers in one stack. The strongest GTA 6 signal (the unconfirmed, datamined "Project ROME" — a rumored first-party Rockstar RP/modding platform, consistent with Rockstar's August 2023 acquisition of the FiveM/Cfx.re team) points the AAA leader at exactly this layer. V7 is Oshun's bet on it, built natively rather than acquired. The product layers as: - **Mawu** — the Fon/Dahomey **creator goddess**, the world-maker. The product, and the unit of play: a persistent, community-owned, fully-moddable world that one player or a community hosts and others inhabit. Mawu is to V7 what Orun is to V6 — the world — except no two Mawu realms are the same, because each is built and ruled by its community. - **The Realm** — a single running Mawu world instance. A realm is server-authoritative, scriptable end-to-end, persists its own state, runs its own ruleset and economy, sets its own membership policy (open / whitelisted), and may federate with other realms. Realms run on a hosting continuum from a Solo private save through a player-hosted Listen server to an Oshun-orchestrated Dedicated fleet, up to a **meshed** realm spanning many server nodes for thousands of concurrent inhabitants. - **The Ori (extended)** — V6's portable identity, deepened for roleplay. In V7 the Ori carries not only an agent's biography but a **player's persistent roleplay characters** — a citizen of a realm with a name, a job, a home, a criminal record, relationships, and a bank balance that survive across sessions and (with realm consent) across realms. The Ori passport carries a character into V2–V6 exactly as V6 defined; V7 adds character portability _between community realms_. - **Ixchel** — the Maya goddess of weaving and creation. V7's creation/modding framework, which finally ships the Maya domain's planned 12-domain modding stack: composable mod layers (no load-order), SAT-resolved dependencies, semantic conflict resolution, the six-tier WASM safe-scripting sandbox, hot-reload into live sessions, git-like world forking, world genomes, and AI balance verification. Ixchel productizes the Maya `forge-*` packages. - **Abundantia** — the Roman goddess of abundance and prosperity. The creator republic: the cross-platform, console-authorized distribution network, the in-game realm/mod browser, reproducible mod collections, and the creator economy that pays makers — by engagement, by sale, and by dependency-revenue chains — at platform scale. V7's promise is **a world you don't just play — one you build, host, rule, and live a second life inside, safely.** The player is a citizen, a roleplayer, a builder, a server owner, and a self-governing community member. V1's consent posture, identity boundaries, grounded generation, and crisis-aware safety (Lilith), plus V5's anti-cheat and moderation backbone and Kuanyin's guardianship, are not bolted on — for a platform that runs **untrusted player code on other players' machines and servers**, they are the load-bearing wall. ## Design Posture Four commitments fix the design and resolve the tensions inherent in a "community-run, fully-moddable, server-authoritative world platform." Every feature below is downstream of them. **1. Server-authoritative by default; the realm owns the truth.** Unlike GTA Online's peer-to-peer model — whose structural weaknesses (the MTU-throttle to force empty lobbies, in-game reports defeatable by client-side scripts) are the textbook case for moving on — every V7 realm has a single authoritative server process (or meshed cluster) that validates all state. Clients send intent; the realm decides. This is the precondition for both anti-cheat and persistence. Player-hosted Listen servers are supported for small bounded co-op, but the canonical RP and massively-multiplayer path is dedicated and authoritative. **2. Untrusted code is the threat model, not an afterthought.** V5's workshop is explicitly **data-only — it "cannot ship executable code."** V7 lifts that limit: realms run creator-authored executable logic. That single change is the entire security problem. Every line of creator code runs in the six-tier Ixchel WASM sandbox with per-frame CPU / memory / disk / GPU budgets and capability-gated engine access; every uploaded artifact is malware-scanned before it can be fetched by another machine; every realm declares the maximum sandbox tier it will grant. The 2023 _fractureiser_ supply-chain attack on CurseForge/Minecraft modpacks (an infostealer injected into packs with millions of downloads) is the canonical failure V7's pipeline is designed never to repeat. **3. Composable layers, never load order.** Every competitor's modding model — Bethesda's `.esp` plugin order, the Forge/Fabric loader split, MO2's virtual file system — fights the same fragile war over _which file wins_. V7 ships the Maya composable-layer model instead: mods are **composable layers** resolved by intent (rules compose algebraically; world mods partition space; code mods order hooks with disjoint-state detection; audio mods get independent buses), dependency graphs are SAT-resolved into a reproducible lock file, and only true semantic contradictions surface to the community for resolution. "Load order" never appears in the player's vocabulary. **4. Creators are paid, communities self-govern.** A platform that asks players to build worlds and write code must let them earn from it and rule it. V7 ships the creator economy (engagement payouts + direct sale + dependency-revenue chains, cashed out through Aje) and multi-tier governance (Eunomia: platform → game → realm → server → guild), with Themis adjudicating cross-party disputes. Monetization and governance are first-class subsystems, not a Year-2 afterthought — because the Roblox DevEx (>$1.5B/yr to creators) and Fortnite engagement-pool (40% of eligible revenue) models prove the flywheel only spins when payout and self-rule ship on day one. What V7 borrows, and from where: **FiveM/RedM (Cfx.re)** for the server-authoritative, custom-scripted, community-hosted persistent-world model that is the actual state of the art for emergent online roleplay, and its **ESX / QBCore / Qbox / ox** framework lineage for the jobs/economy/inventory/ institutions pattern; **Star Citizen** for server meshing and a replication layer that decouples persistent state from simulation; **Roblox (Luau) and UEFN (Verse)** for safe sandboxed scripting at population scale and for the engagement-and-cash-out creator economy; **mod.io** for cross-platform, console-authorized distribution with an in-game browser and pre-publish moderation; **Nexus Mods Collections** and **Wabbajack** for reproducible, shareable, one-click modlists; **Steam Workshop** for frictionless subscribe/auto-sync; **Bethesda Creations** for a first-party paid-mods storefront (and its recurring controversies, studied so V7 avoids them); and **Garry's Mod / s&box** for the "a sandbox engine becomes a platform when the community ships the games" lesson. ## Subsystem Glossary This glossary fixes vocabulary used throughout the V7 docs. Each entry names a subsystem and the responsibility it owns. Implementation packages live under `apps/v7/`, `libs/v7/`, `libs/maya/` (the Maya `forge-*` family, finally implemented under Ixchel), `V7/ue/`, and shared `libs/oshun/` extensions. **Platform substrates (V7)** | Name | Goddess / meaning | Responsibility | | -------------- | -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Mawu** | Fon/Dahomey creator goddess; the world-maker | The product and the canonical UE5.5 LTS / Maya client (`V7/ue/`) — renders any realm regardless of its mod layers; the platform brand. | | **Moremi** | Yoruba heroine-queen who founded/defended Ile-Ife | The realm server framework (Rust): the server-authoritative simulation host, the executable-resource runtime, persistent realm state, hot-reload. | | **Danu** | Primordial mother-goddess from whom all flows | Server meshing + high-population entity replication and interest-managed culling — many nodes as one seamless world (1000+ inhabitants). | | **Nephthys** | Egyptian keeper who preserves and restores | The decoupled persistence/replication layer (Rust): the authoritative store of realm and character state, crash-resilient, independent of sim nodes. | | **Pheme** | Greek goddess of the carrying, spreading voice | Positional/proximity voice with distance attenuation and radio sub-channels, built on the V3/V6 voice SFU and gateway. | | **Nàná** | Nana Buluku, creator-grandmother of life & lineage | The roleplay framework: persistent player characters (extending the Ori), jobs, economy, housing, inventory, vehicles, and civic institutions. | | **Hera** | Goddess of alliance and organized society | The persistent player social graph: crews, guilds, gangs, posses, organizations — cross-realm and cross-version, with roles, treasuries, reputation. | | **Ixchel** | Maya goddess of weaving and creation | The modding/creation framework: composable layers, SAT deps (`forge-resolver`), semantic conflict (`forge-conflict`), six-tier WASM sandbox (`forge-sandbox`), compositor, genomes, forking, balance. | | **Abundantia** | Roman goddess of abundance and prosperity | The creator republic: cross-platform / console-authorized distribution, the in-game realm-and-mod browser, reproducible Collections, and the creator economy. | | **Eunomia** | Greek goddess of good order; daughter of Themis | Multi-tier community governance: platform → game → realm → server → guild, with a proposal lifecycle and plural voting models. | | **Sekhmet** | Fierce Egyptian protector who wards off threats | Executable-UGC trust & safety: static + dynamic malware scanning, sandbox-tier policy enforcement, supply-chain integrity, incident response. | **Cross-domain support (carried from V1 / V3 / V5 / V6, deepened in V7)** | Name | Role in V7 | | ----------- | ----------------------------------------------------------------------------------------------------------------------- | | **Ori** | Portable identity (V6), extended to carry persistent roleplay characters across realms and into V2–V6 via the passport. | | **Maya** | The engine domain: ECS, world streaming, rendering, physics, audio, and the `forge-*` family Ixchel productizes. | | **Aje** | Commerce substrate: creator payouts (engagement, sale, dependency-revenue), realm-economy settlement, KYC/tax/reserve. | | **Lilith** | Safety and persona policy: crisis-aware behavior, abuse response, persona boundaries inside roleplay. | | **Kuanyin** | Guardianship and moderation: content moderation queues, minor protection, the human-review backbone for UGC. | | **Themis** | Adjudication: cross-realm disputes, attribution/IP claims, governance appeals, anti-cheat appeals. | | **Isis** | Governed generation: AI-assisted creation (text-to-3D/texture/world), generation policy on creator AI tools. | | **Sophia** | Grounding: factual grounding for AI-generated world and NPC content where realism is claimed. | | **Iris** | Memory and identity boundaries: character memory, consent, and deletion limits inside the Ori. | | **Psyche** | Real-time text/voice/avatar runtime for live NPC dialogue and in-realm agent presence. | | **Yemaya** | Non-real-time media: realm trailers, creator showreels, Collection cover art, governance-record archival. | **Surfaces** | Surface | Package / Path | | ------------------------------------- | ------------------------------------------------------------------------------------------- | | **Mawu UE5 client (canonical)** | `V7/ue/` — single UE5.5 LTS / Maya project, all premium surfaces | | Web entry via UE Pixel Streaming | UE5 server-rendered frames over WebRTC; thin player at `apps/v7/mawu-web/` | | Tier-2 lightweight web fallback | `apps/v7/mawu-web-fallback/` (three.js + WebGPU) — spectate/browse, limited play | | Moremi realm server framework | `apps/v7/moremi-realm-server/` (Rust + tokio + QUIC) — authoritative sim + resource host | | Danu meshing fleet | `apps/v7/danu-mesh-cluster/` (Rust) — node orchestration, interest management | | Nephthys persistence layer | `apps/v7/nephthys-replica-service/` (Rust) — decoupled authoritative state store | | Mawu gateway + Pheme voice SFU | `apps/v7/mawu-gateway/` (WebTransport / WebRTC + Pheme positional voice SFU) | | Ixchel runtime (sandbox + compositor) | `libs/maya/forge-*` (Rust + WASM) — resolver, conflict, sandbox, compositor under Ixchel | | Nàná RP framework | `libs/v7/nana/` (TS + Rust) — characters, jobs, economy, housing, institutions | | Hera social-graph service | `apps/v7/hera-social-service/` (Rust) — crews/guilds/orgs, treasuries, reputation | | Abundantia distribution + economy | `apps/v7/abundantia-market-service/` (TS/NestJS) — catalog, browser, Collections, payouts | | Eunomia governance service | `apps/v7/eunomia-governance-service/` (TS/NestJS) — proposals, voting, multi-tier execution | | Sekhmet trust-and-safety scanner | `apps/v7/sekhmet-scanner/` (Rust) — static/dynamic scan, integrity, incident response | | Mawu Studio (creator tools) | `apps/oshun/web/src/app/mawu-studio/` + UE Editor + in-realm builder authoring widgets | | Mawu Companion App | `apps/oshun/mobile` subroute — realm browse, character status, crew management, comms | | Mawu Operator Console | `apps/oshun/admin/src/app/mawu/` — moderation, scan queue, payout audits, realm registry | ## Cross-Reference Convention Throughout the V7 docs, **bare `§N` and `§N.M` references resolve to `V7_TODOS.md`** (the only V7 doc with numbered section ids used as hyperlinks). Explicit doc prefixes are used where ambiguity matters: - `§30` → `V7_TODOS.md` §30. - `deps§3` → `V7_DEPENDENCIES.md` §3. - `arch§""` → `V7_ARCHITECTURE.md` by section anchor. - `features§""` → this document, by section anchor. - `maya§""` → `DOMAINS/maya/features.md` by section anchor. - `v5§N` → `V5/V5_TODOS.md` §N; `v5features§""` → `V5/V5_features.md`. - `v6§N` → `V6/V6_TODOS.md` §N; `v6features§""` → `V6/V6_features.md`. V7 deliberately reuses prior architecture rather than duplicating it: the V1 platform (BFF, contracts, persistence, identity, audit, residency, Isis generation control, the Iris memory stack), the V3 metaverse substrate (UE5 client, world server, presence, avatars, spatial audio, Pixel Streaming), the V5 online backbone (matchmaking, anti-cheat, crossplay, server browser, workshop moderation pipeline), the V6 Ori identity and Aye Bridge incarnation, and the Maya engine and its planned `forge-*` family. Cross-references make the reuse explicit. **V7's net-new surface is the executable, server-authoritative, massively-multiplayer, community-governed, creator-monetized layer** that none of those prior versions ships. ## Table of Contents - [V7 Product Promise](#v7-product-promise) - [Product Surfaces](#product-surfaces) - [The Trust Boundary — Platform vs. Realm](#the-trust-boundary--platform-vs-realm) - [The Realm Model](#the-realm-model) - [What a Realm Is](#what-a-realm-is) - [The Hosting Continuum](#the-hosting-continuum) - [Realm Lifecycle and Registry](#realm-lifecycle-and-registry) - [Membership: Open, Whitelisted, Federated](#membership-open-whitelisted-federated) - [Persistence and the Replication Layer](#persistence-and-the-replication-layer) - [Danu — Server Meshing and Massive Population](#danu--server-meshing-and-massive-population) - [Why Meshing](#why-meshing) - [Node Topology and Authority Handoff](#node-topology-and-authority-handoff) - [Interest Management and Entity Culling](#interest-management-and-entity-culling) - [Dynamic Split and Merge](#dynamic-split-and-merge) - [Population Targets and Degradation](#population-targets-and-degradation) - [Moremi — The Server-Authoritative Roleplay Framework](#moremi--the-server-authoritative-roleplay-framework) - [The Resource Model](#the-resource-model) - [Server-Authoritative Netcode](#server-authoritative-netcode) - [Nàná — Persistent Characters](#nàná--persistent-characters) - [Jobs, Economy, and Property](#jobs-economy-and-property) - [Civic Institutions](#civic-institutions) - [Whitelisting and Realm Moderation](#whitelisting-and-realm-moderation) - [Executable Safe Scripting — The Ixchel Sandbox](#executable-safe-scripting--the-ixchel-sandbox) - [The Six Sandbox Tiers](#the-six-sandbox-tiers) - [The Scripting Surface](#the-scripting-surface) - [Capability Gating and Budgets](#capability-gating-and-budgets) - [Hot-Reload Into Live Sessions](#hot-reload-into-live-sessions) - [Pheme — Proximity and Radio Voice](#pheme--proximity-and-radio-voice) - [Hera — Crews, Guilds, and the Persistent Social Graph](#hera--crews-guilds-and-the-persistent-social-graph) - [Ixchel — Productizing Maya's Modding Framework](#ixchel--productizing-mayas-modding-framework) - [Composable Layers, Not Load Order](#composable-layers-not-load-order) - [SAT Dependency Resolution and Lock Files](#sat-dependency-resolution-and-lock-files) - [Semantic Conflict Resolution](#semantic-conflict-resolution) - [Collections — Reproducible Modlists](#collections--reproducible-modlists) - [Git-Like Forking](#git-like-forking) - [World Genomes and Expression Layers](#world-genomes-and-expression-layers) - [AI Balance Verification](#ai-balance-verification) - [Mawu Studio — Creation Tools](#mawu-studio--creation-tools) - [Abundantia — The Creator Republic](#abundantia--the-creator-republic) - [Cross-Platform and Console-Authorized Distribution](#cross-platform-and-console-authorized-distribution) - [The In-Game Realm and Mod Browser](#the-in-game-realm-and-mod-browser) - [The Creator Economy](#the-creator-economy) - [Dependency-Revenue Chains](#dependency-revenue-chains) - [Eunomia — Multi-Tier Community Governance](#eunomia--multi-tier-community-governance) - [Hosting, Orchestration, and Who Pays](#hosting-orchestration-and-who-pays) - [Trust, Safety, and Anti-Abuse for Executable UGC](#trust-safety-and-anti-abuse-for-executable-ugc) - [Sekhmet — Malware Scanning and Supply-Chain Integrity](#sekhmet--malware-scanning-and-supply-chain-integrity) - [Anti-Cheat on Community Servers](#anti-cheat-on-community-servers) - [Content Moderation and Minor Protection](#content-moderation-and-minor-protection) - [Child Safety and Age Assurance](#child-safety-and-age-assurance) - [Incident Response](#incident-response) - [Cross-Version Incarnation and the Ori](#cross-version-incarnation-and-the-ori) - [Streaming, Spectating, and the Creator Loop](#streaming-spectating-and-the-creator-loop) - [Live-Service and Community Programming](#live-service-and-community-programming) - [The Economy Firewall and Anti-Fraud](#the-economy-firewall-and-anti-fraud) - [Commerce and Rights](#commerce-and-rights) - [Accessibility](#accessibility) - [Localization](#localization) - [Telemetry, Analytics, and Eval Sets](#telemetry-analytics-and-eval-sets) - [AI Cost and Fidelity Tiering](#ai-cost-and-fidelity-tiering) - [Performance Budgets](#performance-budgets) - [Asset Budget and Streaming](#asset-budget-and-streaming) - [Cross-Platform and Cross-Progression](#cross-platform-and-cross-progression) - [Region Rollout Strategy](#region-rollout-strategy) - [Launch Readiness](#launch-readiness) - [V7 Exit Criteria](#v7-exit-criteria) ## V7 Product Promise V7 ships as one coherent open-world creator republic for Oshun. The product promise: - **Build the world, don't just play it.** Any player can create a persistent world — author its terrain, rules, jobs, economy, and laws — using Mawu Studio (UE Editor, in-realm builder, visual logic, or TypeScript/WASM scripting), and publish it for others to inhabit. The lesson of Garry's Mod and Roblox: a sandbox becomes a platform the moment the community ships the games. - **Host your own server, on your own terms.** Realms run on a continuum from a private Solo save to a player-hosted Listen server to an Oshun-orchestrated Dedicated fleet — and serious worlds scale to a **meshed** cluster (Danu) carrying 1000+ concurrent inhabitants in one seamless space, the population ceiling that GTA Online's 32-player peer-to-peer lobbies cannot reach. - **Live a second life — a real roleplay.** A player's Ori carries a persistent character: a citizen with a name, a job, a home, a vehicle, a bank balance, a criminal record, and relationships that survive across sessions. Realms run the Nàná framework — jobs, economy, property, and civic institutions (law, EMS, business) — the same systems that made FiveM roleplay the state of the art for emergent online play. - **Mod everything, without load order.** Every aspect of a realm is moddable — assets, rules, worlds, UI, narrative, physics, AI, audio, economy, and total conversions — as composable Ixchel layers, never fragile file-override priority. Dependencies resolve to a reproducible lock file; only true contradictions ever reach the player, and then through the community, not a crash. - **Run untrusted code safely.** Creator logic runs in the six-tier Ixchel WASM sandbox with per-frame CPU/memory/disk/GPU budgets and capability-gated engine access; every artifact is malware-scanned (Sekhmet) before any other machine can fetch it; every realm declares the maximum tier it grants. The platform is engineered so the next _fractureiser_ cannot happen here. - **Get paid for what you make.** Creators earn three ways — an engagement payout from a platform pool, direct sale of worlds/mods/assets, and automatic dependency-revenue chains that flow a share to the makers of what they build on — cashed out through Aje with KYC, tax, and reserve handling. The Roblox (>$1.5B/yr to creators) and Fortnite (40% engagement pool) economies prove the model; V7 ships it on day one (Abundantia). - **Communities govern themselves.** Eunomia runs governance at five tiers (platform → game → realm → server → guild) with a structured proposal lifecycle and plural voting models; Themis adjudicates cross-party disputes. Realm owners set their own sovereign rules within the platform's safety floor. - **One identity, every world and every game.** A character is portable: with realm consent it travels between community realms, and the Ori passport carries it into V2 (fighter), V3 (metaverse citizen), V4 (operator), V5 (open-world companion), and home to V6's Orun — exactly as V6's Aye Bridge defined. - **V1 trust at platform scale.** Identity boundaries (Iris), grounded generation (Isis + Sophia), persona policy and crisis-aware safety (Lilith), guardianship and minor protection (Kuanyin), and adjudication (Themis) govern every realm, every character, every uploaded artifact. A community realm sets its own rules _above_ the platform's safety floor, never below it. - **Degrades safely.** If meshing is unavailable a realm falls back to a single authoritative node at a reduced cap; if a realm's custom scripts fault the sandbox isolates and disables the offending resource without crashing the session; if distribution is unreachable a player keeps any installed realm playable offline (Solo); if voice ASR or the SFU degrades, text and push-to-talk fallbacks remain. (See `V1/features.md` § "V1 Product Promise", `V5/V5_features.md` § "V5 Product Promise", and `V6/V6_features.md` § "V6 Product Promise" for the commitments V7 inherits and extends.) ## Product Surfaces The user-facing entry points are listed in the Subsystem Glossary "Surfaces" table above. This section adds product-shaped detail. - **Mawu UE5 client (canonical).** A single UE5.5 LTS / Maya client renders any realm regardless of which mod layers it applies. The client ships with the in-realm builder, the realm browser, the character-management UI, the Hera crew console, and the Mawu Studio entry point. Console builds run the console-authorized distribution path (see § "Cross-Platform and Console-Authorized Distribution"). - **Web entry via Pixel Streaming** and a **Tier-2 web fallback** (three.js + WebGPU) for spectating, browsing the catalog, and limited play on constrained devices — reusing the V3/V6 streaming fleet. - **Moremi realm server framework.** The Rust authoritative server that any community runs (self-hosted or Oshun-orchestrated). Ships as a documented binary - resource SDK so server owners install, configure, and script their realm. - **Mawu Studio.** The creator suite spanning the UE Editor (premium authoring), the in-realm builder (build while inside a running world), visual logic programming (no-code), and the TypeScript/WASM scripting API (code) — a tiered creation funnel from "make it cooler" to "modify the Rayleigh scattering coefficient." - **Abundantia** (web + in-client). The creator republic storefront and the in-game realm/mod browser: discover realms and mods, install Collections in one click, buy/subscribe, and (for creators) manage listings, versions, and payouts. - **Mawu Companion App** and **Mawu Operator Console** as listed above. ## The Trust Boundary — Platform vs. Realm The most consequential design decision in V7 is **who runs the authoritative server** — and the answer is a deliberate hybrid. FiveM (community-hosted) proves emergent RP but leaves the operator in control of the server, so identity, economy, and safety cannot be trusted to it; Roblox (platform-hosted) eliminates that risk but owns all compute. V7 keeps the best of both: **platform-hosted, inviolable services for identity, the real-money economy, client integrity, and child-safety; community-hosted realm logic only, and only as capability-sandboxed code behind a hardened, attested client an operator cannot patch.** A realm operator is assumed potentially hostile. This boundary is non-negotiable. The following are **never** delegated to a community realm — they live on the platform plane behind the gateway: - **Identity and authentication** — one platform account; a realm sees only an opaque, per-realm pseudonymous handle (defeats spoofing and realm-hopping ban evasion). - **The real-money economy, entitlements, and payouts** — settle through Aje, never touch a realm process. - **Client integrity and anti-tamper** — operators never ship or patch the client. - **Child-safety, CSAM/grooming detection, and age assurance** — central; an operator never runs the age check or sees raw biometric data. - **Cross-realm bans and reputation** — a ban follows the player across realms. - **Asset malware scanning** — every artifact is platform-scanned before any client can fetch it. What a realm **does** own: its world, rules, scripts, content, jobs, in-realm play-currency, and moderation _above_ the platform floor — all running inside the Ixchel sandbox. A malicious realm's worst case is bounded by that sandbox (no filesystem/socket/process access), a locked-down creator web view (HTTPS-only, strict CSP, no platform tokens ever exposed), and server-side validation of every client-originated event ("assume hostile sender"). Technical enforcement is in `V7_ARCHITECTURE.md` arch§"The Trust Boundary — Platform vs. Realm". ## The Realm Model ### What a Realm Is A **realm** is a single running Mawu world: a server-authoritative, persistent, fully-moddable world that a community owns and others inhabit. A realm bundles (a) a **base world** (a Maya world, optionally generated from an Ixchel world genome), (b) an ordered set of **Ixchel mod layers** that define its assets, rules, and logic, (c) a **Nàná configuration** (which jobs/economy/institutions are active), (d) a **membership policy** (open, whitelisted, or invite), (e) a **governance charter** (the Eunomia rules for who can change what), and (f) a **hosting binding** (where it runs). The realm's identity, version, and lock file are recorded in the Abundantia registry so any client can join the exact same composed world. A realm is _not_ a copy of an Oshun-authored game. V5 ships authored cells; V7 ships the framework that lets a community build something V5 never imagined — a 1920s-bootlegger economy, a hospital-sim where every doctor is a player, a city where the only rule is "no rules." The platform supplies the engine, netcode, persistence, safety, distribution, and economy; the community supplies the world. ### The Hosting Continuum Realms run on a continuum, chosen per realm by its owner: | Tier | Authority | Population | Use | | ------------- | ----------------- | ---------- | ------------------------------------------ | | **Solo** | Local client | 1 | Private build/test; offline-capable | | **Listen** | Host client | up to ~16 | Small bounded co-op; sub-2s host migration | | **Dedicated** | Single Rust node | up to ~256 | Standard community realm; authoritative | | **Meshed** | Rust node cluster | 1000+ | Large persistent RP/economy worlds; Danu | Solo and Listen reuse and extend the V5 connection models (`v5features§"Network Quality, LAN, and Server Browser"`). Dedicated and Meshed are the V7 net-new path. A realm can be **promoted** along the continuum without rebuild: the same composed world and lock file run from Solo to Meshed, with persistence migrating to the Nephthys layer as soon as the realm leaves Solo. ### Realm Lifecycle and Registry A realm moves through a lifecycle tracked in the Abundantia registry: `Draft` (authored, unpublished) → `Private` (running, invite-only) → `Listed` (discoverable in the browser) → `Verified` (passed the Ixchel balance pass and the Sekhmet scan, and holds a clean moderation standing) → `Deprecated` / `Archived`. Each published realm pins an immutable **Ixchel lock file** so a joining client composes byte-identical layers; a realm update publishes a new semantic version, and players on a pinned version are flagged (never silently broken), exactly as the V5 workshop subscription model defined (`v5features§"Workshop & Mods"`), extended here from data-only to executable layers. ### Membership: Open, Whitelisted, Federated - **Open** — anyone may join; the platform safety floor applies. - **Whitelisted** — the realm gates entry behind an application/character-backstory review (the FiveM serious-RP norm), managed in the realm's moderation console; Hera and Kuanyin tooling surface applicant history and standing. - **Invite** — closed to a roster; used for private communities and events. - **Federated** — two or more realms agree to share a character corridor and/or an economy bridge so a citizen (and, by treaty, currency or goods) can cross between them under Themis-adjudicated terms. Federation is opt-in on both sides and revocable. ### Persistence and the Replication Layer Realm and character state live in **Nephthys**, a decoupled persistence layer modeled on Star Citizen's replication-layer approach: the authoritative store of the entire realm's state (characters, inventories, properties, vehicles, world mutations, economy ledgers) is **separate from the simulation nodes**, so a sim node crash does not lose the world — a replacement node rehydrates from Nephthys. State is event-sourced (consistent with the V6 Ori model) and snapshot-checkpointed; persistence is the precondition for true roleplay and economy, the same reason VRChat and Fortnite added server-side persistence. ## Danu — Server Meshing and Massive Population ### Why Meshing A single authoritative node has a hard player cap (V5's dedicated hub tops out at 64; a heavy RP realm at ~256). GTA Online's peer-to-peer model caps a public session at 32 and is the textbook case for moving to authoritative servers. Serious persistent worlds need hundreds-to-thousands in one seamless space — FiveM's OneSync Infinity raised entity IDs from 8,192 to 65,535 and supports up to ~2,048 players by culling entities to those near each client; Star Citizen's static server meshing went to 500 players per shard in late 2024 with dynamic meshing in progress. Danu is V7's answer. ### Node Topology and Authority Handoff A meshed realm is partitioned across **simulation nodes**, each authoritative for a region of the world (a spatial cell, a district, or a logical shard such as "the interiors of the casino"). Nephthys holds the persistent truth; nodes own the _live_ authority for their region. When a player crosses a boundary, authority for that player's entities **hands off** between nodes transparently — the client never reconnects, never sees a loading screen, and the handoff is validated against Nephthys so no state is duplicated or lost. ### Interest Management and Entity Culling Every client receives only the entities relevant to it — those within its **area of interest** (proximity, line-of-sight, and subscription to specific realm channels). This is the OneSync-Infinity culling model generalized: the mesh maintains a spatial index per node, and the gateway streams to each client a delta of only the entities entering/leaving its interest set. This is what makes 1000+ inhabitants tractable on commodity client hardware — no client ever simulates or renders the whole realm. ### Dynamic Split and Merge Node assignment is **dynamic**: when population density at a location crosses a threshold (e.g., a crowd gathers for an event), Danu **splits** that region onto an additional node and spins it up; when the crowd disperses, regions **merge** back to free capacity. This mirrors Star Citizen's dynamic-meshing intent (spin up servers when ~200 gather at a location) and FiveM's instance systems for OneSync Infinity. Split/merge is invisible to players except as sustained smoothness under load. ### Population Targets and Degradation - **Targets.** A meshed realm targets 1000+ concurrent inhabitants at a stable per-client frame budget (see § "Performance Budgets"); a non-meshed Dedicated realm targets up to ~256; Listen up to ~16. - **Degradation.** If a node fails, Nephthys rehydrates a replacement and affected players experience a brief authority re-acquire, not a disconnect. If meshing capacity is exhausted, the realm caps new joins with a clear queue state (never a hang). If the mesh control plane is unreachable, the realm degrades to a single authoritative node at the reduced cap and stays playable. ## Moremi — The Server-Authoritative Roleplay Framework ### The Resource Model A realm's behavior is built from **resources** — the FiveM/Cfx.re unit, here hardened and sandboxed. A resource is an Ixchel mod layer that bundles assets, data, and executable scripts (TypeScript compiled to the WASM sandbox, or visual logic compiled to the same target), declares its dependencies and the sandbox tier it requires, exports events/callbacks for other resources to consume, and hot-loads/unloads at runtime. The roleplay frameworks the community builds — the V7 equivalents of ESX, QBCore, Qbox, and the `ox` libraries — are themselves resources: a base framework resource exposes inventory/target/job/economy primitives, and content resources build on it. V7 ships a reference base framework (the Nàná core) so a server owner gets a working RP loop out of the box, then extends it. ### Server-Authoritative Netcode All gameplay state is server-authoritative (Design Posture 1). Clients send intent; the realm validates against the rules and Nephthys, then replicates results to interested clients. This is the structural anti-cheat foundation: a tampered client cannot grant itself money, items, or position because the server, not the client, owns those values. Movement uses lag-compensated, server-reconciled prediction; high-density open-world interactions absorb packet loss through the same lag-compensated validation V5 uses for open-world MP (`v5features§"Network Quality, LAN, and Server Browser"`), validated playable at 5% loss and graceful at 20%. ### Nàná — Persistent Characters A player in a realm plays a **character**, not just an account. A character is an Ori record (V6) extended with roleplay state: legal name and aliases, appearance, licenses and permits, employment, owned property and vehicles, inventory, bank and cash balances, a criminal/medical record, and a relationship graph scoped to the realm. Characters persist in Nephthys across sessions. A realm may allow multiple characters per player, character **permadeath** (a Eunomia-charter choice), and — for federated realms — a **character corridor** that lets a citizen travel between realms carrying a realm-negotiated subset of state. Iris governs character memory, consent, and deletion limits; a character's record cannot be silently erased by a realm owner, consistent with the V6 steward-not-owner and identity-boundary posture. ### Jobs, Economy, and Property The Nàná framework ships the systems that make a realm a functioning society — the pattern QBCore/ESX standardized: - **Jobs** — an extensible job registry (legal and illegal): law enforcement, EMS, mechanic, taxi, business owner, and community-authored jobs, each with grades, duties, and payouts. Jobs are resources, so a community adds its own. - **Economy** — a realm-scoped, server-authoritative currency ledger with cash, bank, and (optionally) crypto/society accounts; payroll, taxes, fines, and business revenue settle through it; the realm owner tunes money sources and sinks. Cross-realm economy bridges exist only under federation treaty and Aje settlement; the **real-money** creator economy (Abundantia) is strictly separate from in-realm play-currency to keep gambling/age/compliance lines clean. - **Property** — ownable housing, businesses, and vehicles with persistent interiors, storage, and access control lists; interiors are meshed shards in a large realm so a building's inside is a handoff target, not a separate instance with a loading screen. ### Civic Institutions Realms can run structured institutions — the "serious RP" layer that turns a sandbox into a society: - **Law** — a police job with a CAD/MDT (Computer-Aided Dispatch / Mobile Data Terminal): records, warrants, dispatch, evidence, and a charge/booking flow. - **EMS / Fire** — medical and fire response with a downed/revive/treatment loop integrated with the character medical record. - **Government / Business** — licensing, permits, business registration, and realm-economy policy levers, exposed through an in-world administrative UI. These ship as reference resources on the Nàná core; a realm enables, disables, or replaces each. Institutions are where proximity voice and radio channels (Pheme) matter most — a dispatcher coordinating units over a radio net is the canonical RP moment. ### Whitelisting and Realm Moderation A realm owner runs their own moderation within the platform safety floor: application/whitelist review, character-backstory approval, in-realm admin tools (spectate, freeze, teleport, kick, ban), an escalation path to Kuanyin human review for platform-policy violations, and an audit log of admin actions. Realm bans are realm-scoped; platform bans (issued by Kuanyin/Themis for safety-floor violations) are global. This two-level model — sovereign realm rules above a non-negotiable platform floor — is the core governance pattern (see § "Eunomia"). ## Executable Safe Scripting — The Ixchel Sandbox This is the single most important security subsystem in V7: it is what lets the platform lift V5's data-only limit and run creator code safely. It productizes the Maya plan's `forge-sandbox` (maya§"Universal Modding Framework (Maya Forge)"). ### The Six Sandbox Tiers Creator code runs in one of six tiers granting progressively wider engine API access. A realm declares the maximum tier it will grant; a resource declares the tier it requires; the compositor refuses to load a resource that demands more than the realm grants. | Tier | Grants | | ------------ | ------------------------------------------------------------------------------------------- | | **DataOnly** | No code execution — data overrides only (the V5 workshop equivalent). | | **Scripted** | Pure logic in WASM; no I/O, no network, no engine mutation beyond declared exports. | | **Extended** | Scripted + scoped engine APIs (spawn/despawn, UI, gameplay events) under capability grants. | | **System** | Extended + realm-system APIs (economy ledger, persistence writes) — server-side only. | | **Native** | Vetted native modules (audited, signed) for performance-critical paths; review-gated. | | **Trusted** | First-party / fully-audited only; not available to community uploads. | Community uploads default to **Scripted/Extended**; **System** is granted to realm-framework authors a realm owner explicitly trusts; **Native/Trusted** are review- and signature-gated. This is the Luau/Verse safety lesson generalized: the language and runtime are constrained _by design_ so untrusted code at scale cannot compromise the host or other players. ### The Scripting Surface Three on-ramps compile to the same WASM sandbox target: - **Visual Logic Programming** — node-based events (player enters zone, time reaches sunset) and actions (spawn, play animation, send network message); the no-code on-ramp. - **TypeScript / JavaScript API** — a documented, typed API surface for advanced creators, compiled to WASM with capability-gated engine access. - **Native modules** — for vetted performance-critical paths only. A documented, versioned API surface and SemVer discipline let resources depend on each other reliably (see § "SAT Dependency Resolution"). ### Capability Gating and Budgets Each tier enforces **per-frame** CPU, memory, disk, and GPU-time budgets per resource, with graceful throttling on overrun (a runaway script is throttled and flagged, never allowed to hang the realm). Engine access is **capability-gated**: a resource receives only the capabilities its tier and its declared manifest grant, and every API call is recorded in an audit log for debugging and abuse detection. A resource that faults is isolated and disabled without crashing the session (the "degrades safely" promise). ### Hot-Reload Into Live Sessions Resources hot-load and unload into a running realm — single-player or multiplayer — without restarting client or server. The Ixchel lifecycle manager handles resource cleanup and state preservation across hot-reloads, so a realm owner ships a fix or a content drop without kicking the population. This is the Maya plan's hot-reload commitment, and the s&box/UEFN live-iteration lesson: iteration speed determines creator throughput. ## Pheme — Proximity and Radio Voice V3 and V6 ship a centralized voice SFU for conversation and squad comms; V7 adds the **positional, proximity-attenuated** voice that immersive roleplay requires — the pma-voice model (FiveM's built-in Mumble/WebRTC voice). Features: - **Proximity voice** — distance-attenuated 3D voice: a player hears only those within hearing range, with realistic falloff and occlusion; whisper/normal/shout ranges are scriptable per realm. - **Radio channels** — dedicated multi-channel radio nets (the police/EMS/dispatch backbone) with push-to-talk, channel membership gated by job/role, and squelch. - **Phone calls** — point-to-point and conference audio independent of proximity, scriptable by realm resources (the in-world "phone" RP staple). - **Compliance and parity** — honors per-platform parental and mute settings (carried from V5's voice posture); full text and visual-indicator parity for accessibility (see § "Accessibility"); per-realm voice policy under the safety floor. Pheme runs on the V6 Egbe-Gateway SFU fleet, extended with a positional mixer and radio-channel routing in the realm server. **Pheme scale budget (adopted 2026-06-12).** Proximity voice at Danu population scale is bounded, not population-proportional: a listener is mixed **at most 40 audible streams** after area-of-interest culling (nearest-N by computed gain); the server-side **mixing CPU budget is ≤2 cores per 256 concurrent speakers per realm node**; radio and phone channels add **≤8 streams per listener** on top of the proximity mix; and **p95 mouth-to-ear latency is ≤250 ms** in a 1,000-inhabitant realm. These are launch budgets — a realm that exceeds them degrades by tightening voice AoI before it degrades simulation. ## Hera — Crews, Guilds, and the Persistent Social Graph V5 has in-fiction factions and heist crews; V7 ships a **persistent player social graph** — the GTA-Crews / RDO-Posses / clan pattern — as a first-class, cross-realm, cross-version subsystem. A **Hera** group (crew/guild/gang/org) has: - **Membership and roles** — owner, officers, members, recruits; role-gated permissions over the group's assets and the realm jobs it controls. - **A treasury and shared assets** — an Aje-backed shared balance and shared property/vehicles/inventory, with role-gated access and an audit ledger. - **Reputation and standing** — a cross-realm reputation that realm owners can read at whitelist time, and that feeds Themis adjudication of inter-group disputes (turf, treaties, raids). - **Cross-version presence** — a Hera group spans realms and travels with its members into V2–V6 via the Ori passport, so a crew formed in one realm can field a team in a V2 tournament or run a V4 operation together. - **Governance hooks** — a Hera group is a governance tier in Eunomia (per-guild), so a crew self-rules its internal policy. ## Ixchel — Productizing Maya's Modding Framework V7 implements the Maya domain's planned modding framework (maya§"Universal Modding Framework (Maya Forge)"), which today has **no code on disk**, under the Ixchel subsystem. This section states what V7 ships. The Maya engine package identifiers (`forge-resolver`, `forge-conflict`, `forge-sandbox`, `forge-compositor`, and the planned `Loom` / `Variants` / `Crucible` capabilities) are cited as Maya's API; Ixchel is the V7 subsystem that productizes them. ### Composable Layers, Not Load Order Every aspect of a realm is independently moddable across the **12 moddable domains** (assets, code, rules, worlds, UI, narrative, physics, AI behavior, audio, economy, social, total conversions). Mods are **composable layers**, applied by the compositor in a fixed priority order (Engine < BaseGame < ContentPack < ServerRealm < CommunityVariant < PersonalOverride), with **per-field provenance** (which layer contributed each value) for debugging. "Load order" — the fragile file-override war every competitor fights — does not exist in the player's model. ### SAT Dependency Resolution and Lock Files `forge-resolver` runs a PubGrub-variant SAT solver over the mod dependency graph with SemVer constraints, optional dependencies, feature gates, and capability-based alternatives, producing a **lock file** for reproducible setups. When resolution fails, it emits a human-readable explanation of exactly which requirements conflict — not a silent crash. The lock file is what a realm pins so every joining client composes a byte-identical world. ### Semantic Conflict Resolution `forge-conflict` resolves overlaps by **intent**, not file precedence: rules mods compose algebraically (additive, multiplicative, min/max); world mods use spatial partitioning; code mods order hooks with disjoint-state detection; audio mods get independent mix buses. Only true semantic contradictions are surfaced — and then to the realm's governance for resolution (Eunomia), not to a load-order tweak. ### Collections — Reproducible Modlists V7 ships **Collections** — the Nexus-Collections / Wabbajack capability: a curator packages a set of mods (plus the resolved lock file and conflict data) as a single shareable artifact a player installs in one click, reproducing the curator's exact setup. A Collection is versioned, attributed, and revenue-shared to its component creators via dependency-revenue chains. This is how a player goes from "thousands of incompatible mods" to "one curated experience" — the discovery and compatibility problem solved together. ### Git-Like Forking Ixchel lets any realm or game be **forked** (Maya's `Variants` capability): the creator gets a full copy of the base layer, diverges it, and publishes a standalone variant that retains attribution and revenue-share links to the parent. When multiple variants exist, the community votes (Eunomia) on the canonical "main branch," and a popular variant can overtake the original. Forks consume assets from the parent's marketplace, so the original's creators benefit economically from popular forks. ### World Genomes and Expression Layers Ixchel ships **world genomes** (Maya's `Loom` capability) — parameterized procedural-generation configs (physics constants, biome algorithms, dimension rules, narrative constraints) — as shareable mods: applying a genome to a base game produces an entirely different experience without forking code. **Runtime expression layers** apply non-destructively on top of a running realm (an "eternal winter" overlay) per player or, with the owner's consent, realm-wide. ### AI Balance Verification Ixchel stress-tests mod combinations before and after deployment (Maya's `Crucible` capability): fleets of AI agents play out corner cases, discover exploits, and verify economic balance, so balance is a continuously-monitored emergent property rather than a static hope. A realm's `Verified` status (§ "Realm Lifecycle and Registry") requires a clean balance pass — catching, for example, an economy mod that combines with a job mod to mint infinite currency. ## Mawu Studio — Creation Tools Mawu Studio is the tiered creation funnel, productizing the Maya plan's creator-tools and AI-assisted-creation sections (maya§"User-Generated Content and Creator Tools"). Every tool emits Ixchel layers and runs the same linter shipping content passes, blocking publish on referential errors — the V5 creator-suite discipline (`v5features§"Content & Creator Tools"`), extended from data to executable layers. - **UE Editor authoring** — premium world, mission, and cinematic authoring on custom Slate panels (the V5 creator-suite path), now emitting Ixchel layers. - **In-realm builder** — build while inside a running world: grab-and-place block/voxel/CSG building (VR and desktop gizmo parity), 3D modeling/sculpting, and UV tools, so creation happens in-context — the Roblox/Dreams lesson that in-engine creation removes the biggest funnel-killer. - **Visual logic + TypeScript scripting** — the no-code → code ladder described in § "The Scripting Surface." - **AI-assisted creation (Isis + Sophia governed)** — text-to-3D mesh, text-to-texture (tileable PBR sets), AI world generation (a paragraph → a biome/ city/population starting point the creator curates), and AI NPC personality creation. All generation runs under Isis generation policy and Sophia grounding, with provenance and attribution tracked on every derivative. - **Asset pipeline** — clean import/export (FBX, glTF, USD, Alembic), photogrammetry/Gaussian-splat import with Nanite-stream auto-optimization and LOD generation, and attribution metadata carried on every asset. ## Abundantia — The Creator Republic Abundantia is the distribution-and-economy layer that turns the engine and Ixchel into a living platform. It extends the V5 workshop (`v5features§"Workshop & Mods"`) from a single-game, data-only, 9-platform catalog into a cross-game, executable, cross-platform creator republic, and implements the Maya plan's mod-economy. ### Cross-Platform and Console-Authorized Distribution Abundantia distributes realms, mods, Collections, and assets across PC, console, and cloud-streamed clients — the **mod.io model**: a single account whose installs sync across platforms, an in-game browser, versioned uploads with dependency metadata and auto-update, and a **pre-publish moderation workflow that satisfies console certification rules** (no crashes, reportable content, file-size limits). Console distribution defaults to require-approval (the in-game-creation console norm); PC supports auto-approve for trusted creators with post-publish moderation. This is the only viable path to mods on console — the hardest UGC barrier — and the spiritual successor to ArmA Reforger's Enfusion + mod.io cross-play-with-mods pipeline. ### The In-Game Realm and Mod Browser A single in-client browser (mirrored on the web and companion app) for both **realms** (join a running world) and **mods/Collections** (install into a realm you host or play). Discovery is by tag, content type, rating, recency, player count, and curator featuring; one-click install resolves the lock file and fetches only Sekhmet-cleared artifacts; a Collection installs its whole set atomically. The publishing lifecycle (`Draft → Submitted → InModeration → Published / Rejected`, semantic versions, no silent deletion of pinned versions) carries from the V5 workshop, extended to executable layers. ### The Creator Economy Creators earn three ways, settled through Aje with KYC, tax interview, refund window, payout, and reserve gates (the V5 paid-mod marketplace compliance spine, `v5features§"Workshop & Mods"`): - **Engagement payouts** — a platform pool funded by **40% of eligible platform net revenue** (committed default 2026-06-12; amendable via the Eunomia governance process) is distributed to creators by an engagement formula — the Fortnite/UEFN model (40% engagement pool; ~$900M cumulative to creators) that decouples income from per-item transaction friction and rewards retention. - **Direct sale / subscription** — creators price worlds, mods, Collections, and assets (free, one-time, subscription, or usage-based) with a platform revenue share (the V5 marketplace shipped 70% to creators; V7 carries that floor). - **Cash-out at scale** — earnings convert to real currency through Aje's developer-exchange path — the Roblox DevEx model (>$1.5B/yr to creators) that proves the cash-out flywheel at hundreds of millions of users. The 2015 Steam paid-mods rollback and the recurring Bethesda Creations controversy are studied explicitly: free distribution is always available, paid listings are opt-in and clearly labeled, and the platform never paywalls a mod a creator chose to release free. ### Dependency-Revenue Chains When a mod, Collection, or realm earns, a share flows automatically to the creators of its declared dependencies (the Maya mod-economy dependency-revenue-chain design): **by default 10% of the item's gross revenue, routed pro-rata to its declared dependencies, operator-configurable from 0–25%, and never reducing the original creator's take below the ≥70% direct-sale floor** (committed default 2026-06-12; amendable via the Eunomia governance process). This is what makes a healthy ecosystem of shared building blocks economically rational: a creator of a popular base framework or asset pack earns from everything built on it, the way the Ixchel lock file already makes those dependencies explicit and reproducible. ## Eunomia — Multi-Tier Community Governance Eunomia runs governance at **five tiers** — platform → game → realm → server → guild — each with a sovereign rule space that a parent tier cannot override without consent, bounded only by the non-negotiable platform safety floor (Lilith/Kuanyin). A proposal moves through a structured lifecycle: drafting → deliberation → voting → execution → appeal (Themis). Voting supports plural models — token-weighted, reputation-based, quadratic (favoring broad participation), conviction (lock commitment for signal), delegated, and time-weighted — chosen per tier by its charter. Realm owners use Eunomia to let their community vote on rule changes, balance, and content; the platform uses it for ecosystem-wide policy where community input is appropriate. Optional on-chain recording (Aje integration) is available where a community wants tamper-evident governance, but governance does not _require_ a chain. Eunomia productizes the Maya plan's `Agora` governance design. ## Hosting, Orchestration, and Who Pays Realms are orchestrated on **self-hosted Agones** (Kubernetes-native) rather than a single managed vendor — a deliberate hedge, since the managed game-hosting market proved unstable (Unity Multiplay shut down in 2025; Hathora in 2026). A realm maps to an Agones Fleet; a buffer autoscaler keeps pre-warmed realms ready so joining a popular world is instant, with no cold-start wait. **Who pays** is a hybrid: - The **platform pays** for the inviolable services (identity, economy, safety) and for a buffered fleet of "official" realms. - **Creators may bring their own compute** for high-volume realms (the GSP model) — but only the sandboxed realm logic, never platform services, and always behind the platform gateway so the realm's origin is never exposed to attack. - **Cost tiering:** stateless/respawnable realm sessions run on cheap preemptible (Spot) compute; persistent-state RP realms run on reserved or owned hardware. This is safe only because Nephthys — not the sim node — holds the truth, so a preempted node loses nothing. DDoS protection lives at the gateway (the sole client ingress), which scrubs and rate-limits upstream of every realm. Technical detail in arch§"Hosting, Orchestration, and the Realm Fleet". ## Trust, Safety, and Anti-Abuse for Executable UGC Running untrusted executable code on other players' machines and servers is the defining risk of V7. Safety is layered: the Ixchel sandbox (prevention), Sekhmet (detection), anti-cheat (integrity), moderation (content), and incident response (recovery). ### Sekhmet — Malware Scanning and Supply-Chain Integrity Every uploaded artifact is **scanned before any other machine can fetch it**: - **Static + dynamic scanning** — signature and heuristic malware scanning (ClamAV-class) plus dynamic analysis of WASM modules for prohibited capability use; the Thunderstore automated-scan model, hardened. - **Supply-chain integrity** — every artifact is content-addressed and signed; the lock file pins exact hashes so a dependency cannot be swapped post-publish; account-takeover defenses (the _fractureiser_ vector was compromised CurseForge/Bukkit accounts injecting infostealers into popular packs) gate re-publishes behind step-up verification. - **Tier policy enforcement** — Sekhmet verifies that an artifact's declared sandbox tier matches its actual capability use and rejects mismatches. ### Anti-Cheat on Community Servers Server-authoritative netcode (Design Posture 1) is the structural foundation. On top of it V7 extends the V5 anti-cheat stack (EAC + server-side ML signals + 3-strike flow, `v5features§"Anti-Cheat"`) to community-hosted realms: server-side signals (impossible-angle, speed-hack via position-delta, wall-hack via LOS mismatch) run on the authoritative node so a tampered client cannot suppress them; realm owners get anti-cheat telemetry and realm-scoped enforcement, while platform-wide bans for confirmed cheating route through Kuanyin/Themis. Anti-cheat governs competitive/anti-exploit surfaces; it does not police roleplay choices. ### Content Moderation and Minor Protection A three-layer pipeline carried from the V5 workshop and deepened: an ML pre-screen on upload (IP-infringement, slurs, NSFW), community report queues, and paid human moderators (Kuanyin) with a DSA-compliant appeal path (Themis). Minor-protection follows the V1/V6 posture: COPPA-path restricted social surfaces for under-13, age-gated realms and economy features, and proximity-voice/text controls that honor parental settings. Realm owners moderate their own communities above the platform floor; the floor itself is non-negotiable. ### Child Safety and Age Assurance Child safety is a **platform-central, legally non-negotiable** system — never realm-delegated. An operator never runs the age check, sees raw biometric data, or is the CSAM-scanning authority. The regime (detail in arch§"Sekhmet — Trust, Safety, and Child-Protection Architecture"): - **CSAM detection** — perceptual-hash matching (PhotoDNA + PDQ) against NCMEC hash databases on every uploaded image/texture, CSAI Match for video, and a Thorn Safer-class classifier for novel/unhashed material. 3D assets are rendered to canonical 2D views and hashed (native 3D-mesh CSAM hashing is an open problem). - **Grooming detection** — a Project-Artemis-class conversation classifier scores chat for grooming patterns; high scores route to human moderators. **Voice** is screened by direct audio analysis, not just transcription — it is the highest-risk channel and is platform-monitored, never realm-delegated. - **Cross-platform signals** — membership in Lantern (Tech Coalition) to catch realm-hopping/platform-hopping predators; StopNCII hash ingestion with a ≤48-hour takedown pipeline (TAKE IT DOWN Act compliance). - **Age assurance** — facial-age-estimation via a vendor that deletes biometrics immediately; users are age-banded, and cross-age contact plus unfiltered chat are restricted by default and gated on the estimate. Built day-one — the UK Online Safety Act / EU DSA / US-state regulatory wave makes retrofitting far costlier (the cautionary tale of platforms forced to bolt this on under litigation). - **Longitudinal detection** — a Sentinel-class detector surfaces early child-endangerment behavior patterns across realms. ### Incident Response A documented response playbook for the inevitable supply-chain or exploit incident, modeled on the CurseForge _fractureiser_ response: immediate suspension of new-file approval, rescan of affected projects, account lockdown, revocation/recall of compromised artifacts via the content-addressed registry, and a public incident report. The lock file and content-addressing make recall surgical — the platform knows exactly which realms pinned a compromised artifact and can quarantine them. ## Cross-Version Incarnation and the Ori V7 reuses the V6 **Aye Bridge** (v6features§"The Meta-Hub — Incarnation in Aye") rather than reinventing cross-game travel. A V7 character is an Ori record, so the Ori passport carries it into V2 (fighter), V3 (metaverse citizen), V4 (operator), V5 (open-world companion), and home to V6's Orun — with per-destination capability mapping and the incarnation journal exactly as V6 defined. V7 adds one new corridor: **realm-to-realm** character travel under federation treaty (§ "Membership: Open, Whitelisted, Federated"), governed by the same passport and Themis adjudication. The Ori remains the truth; the realm — like every Aye destination — is a stage the character is rendered into. ## Streaming, Spectating, and the Creator Loop GTA roleplay became the SOTA of emergent multiplayer largely _through livestreaming_ — so V7 treats streaming as a first-class loop, not an afterthought: - **Streamer mode** — a privacy mode that hides the streamer's exact join code/IP and sensitive account info, with anti-stream-sniping options. - **Spectating** — a delayed spectator path (reusing the realm's interest-managed delta stream, read-only) so communities watch live events without affecting authority, with per-realm spectator policy. - **Replays and clips** — every realm can capture server-side replays (the V5 Replay Theater pattern), used both as **moderation evidence** (attach a clip to a report) and as **creator content** (export a clip, a photo-mode shot, or a short for the social loop). - **Creator analytics** — Roblox/UEFN-class dashboards (DAU, retention, playtime, funnel, revenue, per-mod engagement) so creators iterate toward better, higher-retention realms — which is also what the engagement-payout economy rewards. ## Live-Service and Community Programming V7's live service is largely **community-run**, with Oshun programming the platform-level rhythm: - **Creator spotlights and featured realms** — a weekly curator-selected rotation surfacing standout community realms and Collections (the V5 featured-slots model), feeding the browser and loading rotation. - **Platform events** — synchronous platform-wide moments (the Fortnite live-event lesson) that realms can opt into, plus seasonal creator challenges with engagement-pool boosts. - **Creator programs** — incubation/grants for promising creators (the Roblox Jumpstart / Epic Support-A-Creator model) to sustain content supply, and a verified-creator track with auto-approve distribution and elevated payout visibility. - **Governance cadence** — scheduled Eunomia cycles for platform-level proposals so community input has a predictable venue. ## The Economy Firewall and Anti-Fraud Two firewalls protect the economy; both are mandatory. **The currency firewall.** The real-money platform economy (purchases, payouts, cosmetic ownership) is platform-controlled and **one-directional** — money flows _in_ to entitlements. **In-realm RP play-currency is non-fungible and non-cashable** to real money through any community operator. This is both an anti-RMT measure and a regulatory one: with no real-money cash-out, in-realm casinos and loot mechanics sit far clearer of gambling/lootbox law, and age-gating obligations are cleaner. (Jurisdiction-specific legal counsel confirms the line per market.) **Anti-fraud on creator payouts.** Engagement-based pools attract bot farms, click farms, and self-dealing. V7 borrows the proven levers: - **Verified-spend gating** — engagement counts toward the payout pool only from accounts with prior real-money spend (the single strongest anti-bot lever; farms can't cheaply fake real spend). - **Retention weighting** — payouts weight multi-day retention and new/reactivated paying users over raw concurrency, killing CCU-inflation bots. - **Graph-based detection** — a platform-side graph over account↔realm↔device↔payment flags self-dealing (a creator farming their own realm shows up as anomalous network centrality and same-device/never-spent clusters) and RMT (one-directional "free money" flows). **In-realm economy health.** Realms ship with built-in money sinks (repair/upkeep, taxes, service fees) and an optional auto-balancer that holds inflation within a target band, so a creator can't accidentally build a hyperinflationary economy. Inflation rate, sink coverage, and wealth inequality are first-class realm-health metrics. Detail in arch§"The Economy Firewall and Anti-Fraud". ## Commerce and Rights - **What is sold** — real-money: realms, mods, Collections, assets, and creator subscriptions through Abundantia; cosmetic platform items; optional creator-support tips. In-realm play-currency is strictly separate from real-money commerce. - **What is never sold** — a player's identity, a character's memory, governance outcomes, moderation decisions, or safety-floor exemptions. The platform never paywalls a creator's free release. - **Creator royalties and dependency-revenue** — as in § "The Creator Economy." - **Rights and provenance** — every asset and layer carries attribution and provenance; forks retain revenue-share links to parents; an IP-claim and DMCA path routes through Themis; the known-infringing asset-hash list (V5) blocks re-uploads of source-franchise/trademarked content. - **The Aje substrate** — settlement, payouts, KYC/tax/reserve, and optional on-chain governance recording. ## Accessibility Carries the V5/V6 accessibility commitments and adds UGC-specific coverage: full text and visual-indicator parity for proximity voice and radio (a hearing-impaired player sees who is speaking, at what range, on which channel, with live captions); colorblind-safe provenance/diff visualization in Mawu Studio; full keyboard/gamepad parity for the in-realm builder and visual logic; scalable UI and reduced-motion options in the browser and Studio; and a platform accessibility floor that realm authors are guided (and linted) to preserve. ## Localization The Abundantia catalog, Mawu Studio, governance surfaces, and platform UI localize across the Oshun launch locale set (carried from V5/V6). Creator content is locale-tagged; the browser filters and surfaces by locale; AI-assisted creation and moderation operate per-locale. Governance proposals and incident reports are localized for the affected regions. ## Telemetry, Analytics, and Eval Sets - **Eval sets** — sandbox-escape attempts (must be contained), conflict-resolution correctness (composed state matches the lock file), mesh handoff integrity (no state loss/duplication across authority handoff), anti-cheat signal precision/ recall, malware-scan detection rate against a known-bad corpus, and payout-formula correctness against known-correct ledgers. - **Safety evals** — minor-protection enforcement, moderation precision/recall, and incident-response drill outcomes. - **Platform telemetry** — realm population and retention, creator-economy payout distribution, mesh node utilization and split/merge frequency, sandbox budget-overrun rates, and scan-queue latency. - **Cost telemetry** — per-realm hosting cost, AI-assisted-creation and balance agent-fleet cost, and the cost levers below. ## AI Cost and Fidelity Tiering The primary cost controls are (a) the **meshing tier** (a realm runs as many sim nodes as its population needs, no more), (b) the **balance agent-fleet depth** (Ixchel balance verification scales with a realm's economic complexity and its `Verified` ambition), and (c) **AI-assisted-creation usage** (text-to-3D/world/NPC generation is metered, governed by Isis, and tiered by creator plan). Graceful degradation: a realm under budget pressure runs fewer mesh nodes at a lower cap; AI creation falls back to template/asset-library paths; balance verification runs a reduced corner-case set and flags the reduced coverage rather than silently skipping it. ## Performance Budgets - **Client** — **60 fps target (16.7 ms frame budget) on the reference platform tier, with a 30 fps floor on minimum spec** (adopted 2026-06-12), sustained in a meshed realm at 1000+ inhabitants, achieved through interest-managed culling (a client never renders/simulates the whole realm), Nanite/LOD streaming, and tiered fidelity. - **Server** — per-node sim budget with split/merge triggered before a node saturates; per-resource per-frame sandbox budgets (CPU/memory/disk/GPU) with throttling on overrun. - **Netcode** — playable at 5% packet loss, graceful at 20% (the V5 bar); authority handoff **≤250 ms p99** (adopted 2026-06-12) with no client reconnect. - **Voice (Pheme)** — the scale budget in § "Pheme — Proximity and Radio Voice": ≤40 audible streams per listener post-culling, ≤2 mixing cores per 256 concurrent speakers per node, radio/phone adding ≤8 streams, p95 mouth-to-ear ≤250 ms at 1,000 inhabitants (adopted 2026-06-12). - **Distribution** — one-click Collection install resolves and fetches **p95 ≤120 s for a 5 GB Collection on a 100 Mbit/s connection**; Sekhmet scan-queue **p95 ≤15 min from upload to verdict at launch scale** (adopted 2026-06-12) so publish-to-available is predictable. ## Asset Budget and Streaming Realms stream assets via the Maya world-streaming and Nanite-class pipeline (maya§); creator assets carry runtime LODs (auto-generated on import); the compositor composes only the layers a realm pins; interest management bounds the asset working set per client. A realm declares an asset budget; Mawu Studio's linter warns when a layer pushes a realm past its declared budget. ## Cross-Platform and Cross-Progression A single account ID with per-platform linked credentials (carried from V5); characters, Hera membership, owned mods/Collections, and creator earnings follow the account across platforms. Console crossplay follows the per-surface rules (competitive surfaces may pool by input device, as V5 defines); realm joins are cross-platform by default subject to a realm's own policy. Mod installs sync cross-platform via Abundantia (the mod.io model), within console-certification limits on which tiers a console realm may grant. ## Region Rollout Strategy A staged rollout: (1) **Creator alpha** — invited creators build and host Dedicated realms, exercising Ixchel, Mawu Studio, the sandbox, and the Abundantia publish path; (2) **RP beta** — whitelisted community realms exercise Nàná, Pheme, Hera, and moderation at Dedicated scale; (3) **Meshing beta** — selected realms exercise Danu at 1000+ population; (4) **Economy launch** — engagement payouts and cash-out go live with full KYC/tax/reserve; (5) **General availability** — cross-platform, console-authorized distribution at full scale. Each stage gates on the relevant eval sets and a clean safety/incident-response drill. ## Launch Readiness V7 is launch-ready when: the Ixchel sandbox contains a defined corpus of escape attempts with zero successes; Danu demonstrates a stable 1000+ population with integrity-clean handoffs; Sekhmet detects the known-bad corpus at the target rate and the incident-response playbook passes a live drill; the creator economy settles a test cohort's payouts correctly through Aje with KYC/tax/reserve; the anti-cheat stack meets its precision/recall bar on community servers; moderation and minor-protection meet their safety-eval bars; and the platform safety floor is enforced on every realm regardless of owner configuration. ## V7 Exit Criteria - A creator can author, host, and publish a server-authoritative, fully-moddable realm with executable logic, and a player can discover and join it cross-platform. - Mods compose as Ixchel layers with SAT-resolved dependencies and semantic conflict resolution; "load order" never appears in the player-facing model; Collections install reproducibly in one click. - A meshed realm (Danu) carries 1000+ concurrent inhabitants in one seamless space with integrity-clean authority handoff and dynamic split/merge under load. - Persistent characters (Nàná/Ori), jobs/economy/property, civic institutions, proximity+radio voice (Pheme), and the persistent crew/guild graph (Hera) all function, persist across sessions, and travel under federation treaty. - Untrusted creator code runs only in the six-tier Ixchel sandbox under per-frame budgets and capability gating; every artifact is scanned (Sekhmet) and content-addressed before distribution; the incident-response playbook is proven by drill. - Creators are paid through engagement payouts, direct sale, and dependency-revenue chains, cashed out via Aje (Abundantia); communities self-govern through Eunomia's five tiers with Themis adjudication; the Lilith/Kuanyin safety floor is enforced everywhere. - A character is portable into V2–V6 via the Ori passport and between federated realms, with no loss of the V1 trust guarantees.