Sekhmet: Trust, Safety, Child-Protection & Anti-Cheat

Sekhmet is the lion-headed floor under V7 (Mawu): the set of platform-central defenses that make a creator republic survivable. Because Mawu lets community operators run their own authoritative realms and ship executable UGC — real WASM, not just data — the safety surface is not a feature, it is a precondition. A community operator can write the rules of their realm, but a community operator must never run an age check, hold a biometric, decide what counts as CSAM, or be the authority that detects a cheater on the node they themselves host. Sekhmet's governing rule, stated in the monolith, is therefore blunt: all of this is platform-central, never realm-delegated. The scan that decides whether an artifact is ever served, the perceptual-hash match against known-abuse databases, the grooming classifier, the age band, the cheater verdict — every one of them lives above the trust boundary the Ixchel sandbox and the realm protocol enforce, and none of them are reachable from realm code.

This page is the deep companion to the monolith's "Sekhmet — Trust, Safety, and Child-Protection Architecture" and "Anti-Cheat and Client Integrity" sections. The throughline is that V7 ships these defenses the same way it ships its sandbox and its netcode: as real, deterministic, CI-gated Rust, with the integrations that need a vendor, a model, or a live network drawn as honest seams rather than faked. The section hub is ../V7_ARCHITECTURE.md.

What ships, honestly#

The honest split mirrors Ixchel's: the safety logic and its adversarial evals are real and green; the live intake-and-serve daemon and the proprietary vendor models are the seams.

• Sekhmet is a real, native Rust crate, not a slide. apps/v7/sekhmet-scanner/src/lib.rs is a single ~6,009-line crate whose only dependencies are sha2 = "0.10.9" and hmac = "0.12.1" (Cargo.toml) — so every hash, signature, and lock pin below is computed for real. It carries fifteen integration tests covering malware, supply-chain, sandbox-tier, CSAM hash, novel-CSAM classification, grooming, NCII, age assurance, minor protection, the Sentinel longitudinal detector, the three-layer moderation pipeline, contextual reports, and an incident-response drill. Run directly, all 15 pass (cargo test -p sekhmet-scanner → 15 passed; 0 failed). Six of those evals are wired to CI as named adversarial gates — malware-corpus, csam-hash, grooming, minor-protection, plus sandbox-escape and anticheat from the realm server (scripts/v7/verify-adversarial-eval-gates.mjs).
• Where a defense needs a licensed model, it is a deterministic stand-in with the real seam named — not a fake result. With only sha2/hmac on hand, compute_csam_perceptual_hashes (:1753) derives deterministic, algorithm- labeled digests that stand in for the proprietary PhotoDNA/PDQ perceptual hashers; the novel-CSAM (:1894) and grooming (:2022) classifiers are signal-weighted scorers over labeled markers, standing in for the licensed Thorn Safer / Project Artemis ML models. What is real is everything around the model: the algorithm/source taxonomy, the block-before-serve decision, the human-review routing, and the precision/recall eval that would fail on a regression. The facial-age vendor is an injected input (FacialAgeEstimateInput), not a call Sekhmet fakes.
• The shared trust-safety plane is real, and Sekhmet names its seams. The monolith says Mawu reuses the platform's Aphrodite/Kuanyin/Themis plane, and those packages exist and are implemented: libs/aphrodite/age-verification (AgeVerificationService with a provider registry, service.ts:93), apps/lilith/svc-ai/src/csam-protection (a 114 KB HashMatchingAgent wired to PhotoDNA/Thorn/IWF/NCMEC endpoints, csam-protection-service.ts:67), libs/kuanyin/community-harmony/src/raid-defense.ts, and libs/themis/privacy/src/v2-data-subject-rights.ts (GDPR Art. 15/17). The Rust scanner does not import these TypeScript packages — exactly as moremi-realm-server reimplements forge-* natively — but it routes to the same seams by name: high-risk content goes to the kuanyin-human-review queue (:2138) and contested removals to a Themis DSA appeal (:2300).
• The live daemon is the open boundary. run_service (:1271) today serves only a readiness/health document; the network listener that accepts a real creator upload, scans it, and streams cleared bytes to the CDN is the integration target the monolith enumerates. Treat the byte-level mechanics as proven and the production wiring as the remaining seam.

The Sekhmet trust & safety architecture#

The ingest gate: malware scan and the distribution lock#

Nothing reaches a client unscanned. scan_artifact (:3461) classifies an uploaded artifact into a ScanVerdict over signature and heuristic findings, and evaluate_distribution_gate (:3536) refuses to emit a fetchable DistributionGateDecision for anything but a clean scan — the test distribution_gate_requires_a_clean_scan_before_fetch pins that order. run_malware_corpus_eval (:3491) drives a hostile corpus of known-bad artifacts and reports a detection rate against a target, the body of the malware-corpus CI gate.

Supply-chain integrity is the second half of the gate, and it is the same content-addressing primitive the Ixchel content store uses, lifted to the publish path. build_content_addressed_artifact (:1275) hashes content plus its full dependency closure; build_pinned_lock_file (:1364) freezes the result; sign_artifact_manifest / verify_signed_artifact_manifest (:1404/:1426) sign and check it with real HMAC-SHA256; and evaluate_supply_chain_publish (:1452) requires an AccountStepUpReceipt (:266) on re-publish — the fractureiser defense, where a compromised maintainer account cannot silently swap a trusted dependency. The test supply_chain_pinning_changes_hashes_for_dependency_swap_and_requires_step_up proves a swapped dependency changes the artifact hash and trips the step-up. When something does slip, run_incident_response_drill (:1647) exercises the playbook — suspend approvals, quarantine the exact realms pinning a flagged artifact by content hash, recall, report — verified by incident_response_drill_quarantines_exact_realms_pinning_flagged_artifact.

Child protection — the highest bar#

Child safety is where Sekhmet is most fully built out, because it is the bar a platform holder refuses to ship without. Every check here is platform-central; a realm operator is never the CSAM-scanning authority.

CSAM detection: perceptual-hash match before any serve#

compute_csam_perceptual_hashes (:1753) renders the right hash family per asset kind: PhotoDNA + PDQ for images, CSAI Match for video, and — the 3D-native problem the monolith flags as open — rendered-2D views of textures and meshes hashed with Rendered2dPhotoDna/Rendered2dPdq. scan_csam_hash_ingest (:1806) matches those against a known-hash set sourced from NCMEC-class databases and returns CsamIngestDecision::Blocked with serve_allowed = false the instant any hash matches — the artifact is stopped before it can be fetched, never after. run_csam_hash_eval (:1855) measures the detection rate over a synthetic known-hash corpus; its test asserts a 100% match "before any serve," the csam-hash gate. For novel, un-hashed material, classify_novel_csam (:1894) is a Thorn-Safer-class signal scorer whose run_novel_csam_classifier_eval (:1971) holds it to a precision/recall bar. The honest caveat: with sha2 as the only hashing primitive, the perceptual hashes are deterministic stand-ins for the licensed algorithms, and the novel classifier scores labeled markers — the pipeline is real and gated; the licensed model and database feed are the seam.

Grooming and longitudinal endangerment#

classify_grooming_conversation (:2022) is a Project-Artemis-class scorer that weights real grooming signals — secrecy pressure ("our secret"), off-platform migration ("switch apps"), isolation/meet-up pressure, gift/currency leverage, boundary-testing requests, and repeated adult-to-minor contact — and routes any conversation scoring at or above the threshold to the kuanyin-human-review queue (:2138). Voice, the monolith's highest-risk grooming channel, is screened at the gateway: MawuVoiceSafetyPolicy (mawu-gateway/src/lib.rs:648) evaluates a platform voice-safety tap and yields RoutedToReview (:800) rather than trusting a transcript alone. Above single conversations, run_sentinel_child_endangerment_eval (:3283) is the Sentinel-class longitudinal detector: its test surfaces a seeded cross-realm endangerment pattern to review, catching the realm-hopping predator that any per-realm view would miss — the same signal a Tech-Coalition Lantern join (below) shares across platforms.

Age assurance and minor protection#

evaluate_facial_age_estimate (:3075) treats the third-party age vendor as an injected estimate and enforces the privacy-minimization invariants in code: the platform must never see the raw biometric (platform_raw_biometric_seen), the vendor must not retain it (vendor_retained_biometric), the biometric must be deleted within AGE_ASSURANCE_BIOMETRIC_DELETION_SLA_MS = 60_000 (60 s, :85), liveness and consent must be attested, and confidence must clear AGE_ASSURANCE_MIN_CONFIDENCE_BASIS_POINTS = 7_500 (:86) — any failure forces the safest band, Everyone. Accepted users are bucketed into SekhmetAgeBand (:1044) by age_band_for_estimated_age (:3983). evaluate_minor_protection_request (:3142) then applies the day-one OSA/DSA posture: cross-age contact and unfiltered chat are restricted by default whenever a minor is on either side, and age-gated features demand a sufficient band. run_minor_protection_eval (:3204) — the minor-protection gate — only passes when every user is age-banded, every biometric deletion completed, the default cross-age and unfiltered-chat restrictions all fired, and there were zero false-allows.

NCII, the moderation pipeline, and contextual reports#

NCII follows the TAKE IT DOWN Act shape: ingest_stopncii_hashes (:2798) takes StopNCII hashes, evaluate_ncii_asset_ingest (:2836) blocks matching uploads, and run_ncii_takedown_pipeline (:2864) drives reported items to removal within NCII_TAKEDOWN_SLA_MS = 48 h (:84), with share_lantern_signal (:2950) emitting the cross-platform signal. The general moderation path is three layers: pre_screen_moderation_content (:2194) does an ML pre-screen, evaluate_sekhmet_moderation_pipeline (:2300) escalates to Kuanyin human review, and a contested removal opens a Themis DSA appeal bounded by SEKHMET_DSA_APPEAL_SLA_MS = 72 h (:88) — the test moderation_safety_eval_runs_three_layers_and_dsa_themis_appeal_within_sla proves the full machine-then-human-then-appeal flow stays in SLA. Reports of in-world conduct are not taken on faith: evaluate_sekhmet_contextual_report_flow (:2641) requires both telemetry and a replay-clip as evidence before a report is actionable.

Anti-cheat and client integrity#

Anti-cheat in a creator republic has a structural problem FiveM never solved: the operator owns the node. V7's answer is that the detection never trusts that node's client, and enforcement against the platform routes platform-side.

The structural floor: server-authoritative netcode#

A tampered client cannot grant itself state because the realm protocol treats every cross-trust message as hostile. RealmEnvelope::validate_cross_trust (realm-protocol/src/lib.rs:1781) checks sender, detached signature, security- token MAC, and an HMAC-SHA256 over the payload before apply_client_intent_to_authoritative_state (:1835) will mutate anything, and only then if the intent carries the right scope. Two tests pin the property that matters: rejects_forged_payload_even_with_valid_token (:3788) and rejects_forged_security_token_even_when_envelope_is_resigned (:3799) — a tampered intent is dropped even when the attacker re-signs the envelope, and run_event_tamper_eval (:2624) proves a whole corpus of forged/unsigned/ mis-scoped events causes zero authoritative mutation. The V7IdentityFirewall (substrate-bridge/src/lib.rs:325) ensures realm code only ever sees an opaque per-realm handle, so a cheat can't even address a platform account.

Native detectors that extend the V5 stack#

On that floor, moremi-realm-server ships the V5 anti-cheat stack natively for community realms. MoremiAntiCheatSignalKind (:3205) enumerates seven server- observed signals — EAC heartbeat, aim plausibility, aim snap, wall-history, speed-delta, auto-fire, and an ML classifier — and the detectors are real physics, not placeholders: moremi_anticheat_impossible_turn_rate (:12027) computes angle / tick against a 720°/s ceiling, moremi_anticheat_speed_delta (:12059) compares a distance/time ratio to max speed, and moremi_anticheat_auto_fire (:12078) flags impossibly tight, repeated shot intervals. evaluate_moremi_anti_cheat_signal (:11643) is the verdict engine, and its first act is decisive: a signal not observed on the authoritative node is ignored (:11650), so a tampered client can neither forge a strike against a rival nor suppress one against itself (client_suppression_ignored, :11741). Risk rolls into a Clean → Watch → Strike → BanReview verdict; on the third realm-scoped strike (MOREMI_ANTI_CHEAT_THREE_STRIKE_LIMIT, :11729) it issues a realm-scoped ban and routes a platform ban-review with a companion appeal — never an automatic global ban from one realm. run_moremi_anticheat_eval (:11776) holds precision and recall to a bar; it is the anticheat CI gate.

Client integrity itself is platform-owned: a hardened, signed, attested client on the Roblox-Hyperion precedent that operators never patch, with EAC kernel/userland attestation surfaced as the EacHeartbeat signal. The ML side composes the shared plane's review-only governance: @nous/safety's anti-cheat model card requires human review and forbids automated discipline, the posture detailed in the V2 backbone — Sekhmet's verdict engine produces evidence and routing, a human issues platform discipline.

In-realm moderation vs. the platform floor#

Realm operators get their own moderation tools without ever touching the platform floor. moremi_nana_moderation_admin_actions (:6811) models a realm moderator's spectate / freeze / teleport / kick / realm-ban actions, each written to a tamper-evident audit log; only RealmBan carries platform_policy_signal: true, escalating to the platform-safety floor. An operator can run their realm's conduct rules; they cannot opt out of CSAM scanning, age assurance, or a cross-realm ban.

Where this connects#

• Sideways: Ixchel: Modding Runtime & WASM Sandbox — the capability sandbox and content store that contain executable UGC, the abuse surface Sekhmet's ingest gate stands in front of; Eunomia: Governance & the Ori Bridge — where platform bans, appeals, and the five-tier rule space meet the non-negotiable safety floor; and Abundantia: Economy Firewall & Anti-Fraud — the payout-fraud and RMT defenses that share Sekhmet's account-graph posture.
• The boundary it enforces: Architectural Thesis, Trust Boundary & Topology — why a realm is assumed hostile and which concerns are never delegated.
• Platform foundations it composes: Auth & Identity (the account root age assurance and bans resolve against), and the shared Aphrodite / Kuanyin / Themis trust-safety plane (libs/aphrodite/age-verification, apps/lilith/svc-ai/src/csam-protection, libs/kuanyin/community-harmony, libs/themis/privacy) whose seams the native Rust scanner names.
• Real code cited here: apps/v7/sekhmet-scanner/src/lib.rs, apps/v7/moremi-realm-server/src/lib.rs, apps/v7/mawu-gateway/src/lib.rs, libs/v7/realm-protocol/src/lib.rs, libs/v7/substrate-bridge/src/lib.rs, and scripts/v7/verify-adversarial-eval-gates.mjs.
• The orientation hub: ../V7_ARCHITECTURE.md.