# Architectural Thesis, the Trust Boundary & Topology V7 — codename **Mawu** — is Oshun's open-world _creator republic_: a UE5.5 client and a fleet of Rust services that let community creators author, host, and run their own persistent, server-authoritative realms — with **executable** user-generated content, not just data — while never being trusted with the things that must not be delegated. The entire design follows from a single question the product asks before any other: **who runs the authoritative server?** FiveM answers "the community operator" and pays for it with an un-trustable identity/economy/safety story; Roblox answers "the platform" and pays for it by owning every server's compute. V7 takes the defensible hybrid — platform-hosted **inviolable** central services (identity, real-money economy, client integrity, child-safety, cross-realm bans) sitting above community-hosted **realm logic that runs only as capability-sandboxed WASM**, behind a hardened, attested client the operator can never patch. Everything else in the architecture — the netcode, the server mesh, the persistence layer, the modding runtime, the payout rails — is a consequence of getting that one boundary right and making the simulation underneath it deterministic. This page is the orientation hub for that thesis; the full section index lives at [../V7_ARCHITECTURE.md](../V7_ARCHITECTURE.md). ## What ships, honestly V7 is **mostly real Rust and real UE C++**, with the cross-domain _bindings_ to the older platform planes deliberately and visibly stubbed at one seam. Telling the two apart is the point of this section — honest "mocked at the binding" beats fake "fully wired." **Real and tested today.** The realm plane is a Cargo workspace of six Rust services (`apps/v7/Cargo.toml`, `unsafe_code = "forbid"`), each with a `ServiceDescriptor` (name, owner, port, capabilities) and its own `main.rs`. The anchor is **`moremi-realm-server`** (port 47201, ~14.9k lines, 69 `#[test]` blocks): it embeds a genuine **Wasmtime** runtime — `config.consume_fuel(true)`, `config.epoch_interruption(true)`, `store.set_fuel(...)`, `StoreLimitsBuilder`, and AOT `precompile_component` to a `.cwasm` — and a genuine **PubGrub** dependency resolver (`pubgrub` + `semver` crates), so the WASM sandbox and the resolver the architecture calls "Ixchel" are not slideware; they run inside the realm server. Alongside it: `danu-mesh-cluster` (47202, 22 tests), `nephthys-replica-service` (47203, 15 tests), `mawu-gateway` (47204, 16 tests), `sekhmet-scanner` (47205, 15 tests), and `hera-social-service` (47206, 7 tests). Three shared Rust crates under `libs/v7/` (`Cargo.toml` members `nana`, `realm-protocol`, `substrate-bridge`) carry the cross-service vocabulary — `realm-protocol` alone has 30 tests covering envelopes, prediction, snapshot interpolation, delta compression, lag compensation, and a netcode-loss gate. The contract plane `libs/v7/contracts` registers **10 Zod contracts** (`V7_CONTRACT_REGISTRY`) with TypeScript/Rust/C++ codegen and a content-addressed realm-lock composer (`realm-lock.ts`, 13 tests). The **Mawu UE5.5 client** (`V7/ue/Mawu.uproject`) is six real C++ modules that compose a realm _lock file_ into live procedural geometry, with Gauntlet-style automation that asserts the built triangles exist. **Genuinely reused (compiled, not mocked).** The V7 substrate bridge actually links and exercises two upstream substrates: the **V6 Ori event store + Aye Bridge** (`substrate-bridge` imports `egbe_ori_service::{...}` and `ori_model::{...}`, writing a Nana character memory through `PartitionedPostgresOriEventStore` and reading it back via the audited operator-read path) and the **Maya engine-core** (`maya_runtime_probe()` builds a real `maya_world::WorldConfig`). `default_substrate_bindings()` labels exactly these two `V7SubstrateBindingMode::Reused`. **Honestly mocked at the binding seam.** That same function labels the V1 substrates (identity, Aje economy, Lilith/Kuanyin safety, Themis, Iris, Psyche, Isis, Sophia, Yemaya) and the V6 Egbe realtime gateway `Mock` — clean, deterministic, local stand-ins, not yet wired to the live services. The standalone `libs/maya/forge-*` crates (resolver/conflict/sandbox/compositor) are early API scaffolds (the resolver's own docs say "the full V7 resolver will use PubGrub"); the production sandbox and resolver currently live _inside_ `moremi-realm-server`. The TS/NestJS `abundantia-market-service` and `eunomia-governance-service` exist but are the market/governance plane, outside the Rust realm fleet. Where a claim below rests on a mocked binding, it says so. ## The thesis: a defensible hybrid, not a side to pick The two industry reference points fail in opposite directions. FiveM is community-hosted, so a malicious _resource_ on the server host has near-total power over that host, and identity/economy/safety can never be trusted to the operator. Roblox is platform-hosted, which fixes operator-trust but makes the platform own all compute. V7 splits the difference along the only axis that matters — **trust**, not hosting: - **Platform-hosted, inviolable services** own identity/auth, the real-money economy and payouts, client integrity/anti-tamper, child-safety and age assurance, cross-realm ban/reputation, and asset malware scanning. - **Community-hosted realm logic** owns gameplay — but only as **capability-sandboxed WASM** (never raw native code), behind a signed, attested client an operator can neither ship nor patch. Three invariants bind everything else and must be designed in at the core, not retrofitted: (1) **the trust boundary** — certain concerns are never delegated to a realm; (2) **determinism** — rollback prediction, atomic mesh authority handoff, and replayable creator plugins all demand a deterministic simulation core, so it is locked down once and inherited everywhere; (3) **server-authoritative-by-default** — clients send intent, the realm decides, the platform owns the truth above the realm. The realm-protocol crate encodes invariant (3) literally: a `RealmEnvelope` carrying a `RealmMessageKind` other than `ClientIntent` that tries to mutate state is rejected with `UnexpectedMessageKind`, and even a client intent needs a platform `RealmSecurityToken` bearing `realm.intent.submit` scope before it touches authoritative state. ## The trust boundary — platform vs. realm The boundary assumes a **potentially hostile operator** (data theft, RCE on players via malicious resources, currency/cosmetic theft, ban evasion, PII/voice harvesting). What stays platform-owned and why: | Concern | Owner | Why never delegated | | --------------------------------------------- | ------------ | --------------------------------------------------------------------------------------------------------- | | Platform identity / auth | **Platform** | Realms receive only an opaque, per-realm pseudonymous handle; defeats spoofing and realm-hop ban evasion. | | Real-money economy, payouts, entitlements | **Platform** | Settle through Aje, never touch a realm process. | | Client integrity / anti-tamper | **Platform** | The client is signed + attested; operators never ship or patch it. | | Child-safety, CSAM/grooming, age assurance | **Platform** | Sekhmet scans centrally; an operator must never be the age-check or CSAM authority. | | Cross-realm ban / reputation | **Platform** | A ban follows the player across realms (Hera, 5 s SLA). | | Asset malware scanning | **Platform** | Nothing is served to a client unscanned (Sekhmet). | | Realm gameplay state, rules, scripts, content | **Realm** | Safe to delegate — but only inside the WASM sandbox and the platform safety floor. | This boundary is _executable_, not aspirational. The **`V7IdentityFirewall`** (`substrate-bridge`) projects an authenticated platform principal into a `V7RealmScopedIdentity` whose `opaque_handle` is an HMAC of `(pepper, principal, realm_id)` — the realm never sees a platform account id. The **`run_trust_boundary_eval`** harness then renders the exact JSON a realm process and a creator web view can reach and probes it with `default_trust_boundary_hostile_operator_corpus` — eight hostile probes hunting for the platform session token, payout credential, real-money entitlement, and the field names that would carry them (`Authorization`, `bearerToken`, `payoutCredential`). The report passes only when `leaks` is empty. For the creator UI, **`V7CreatorWebViewPolicy::locked_down`** forces an HTTPS secure context, a strict CSP, an allowlisted `fetch` origin set, and `NativeApiPolicy::Disabled`; `run_webview_escape_eval` then throws a hostile NUI corpus (a `file://` loader, an operator-endpoint exfiltration bundle, arbitrary `window.oshunNative.spawnProcess` calls, a `data:`-URL inline script) at it and requires every one blocked. And the **event-tamper eval** in `realm-protocol` proves order-of-operations: it captures the SHA-256 `state_hash` of `RealmAuthoritativeState` before and after a batch of forged envelopes and asserts `hostile_state_hash == baseline_state_hash` — validation provably precedes mutation. The realm side of the boundary owns gameplay state, but in a structurally separated currency. A character is a `NanaCharacterRecord` (`libs/v7/nana`) whose balances — `cash_minor`, `bank_minor`, `society_minor` — are realm-scoped `i64` minor units that the record's `validate()` refuses to let go negative. This is the play-currency that is _non-fungible_ with the platform's real-money economy: it lives in realm state behind the boundary, never in Aje, so a hostile operator can mint or seize it inside their own world without ever touching real money, payouts, or another realm's ledger. ## High-level topology and the substrates V7 reuses Two planes meet at the gateway, which is the _only_ client ingress and therefore the single enforcement point for interest management, rate limiting, and DDoS scrubbing. ```mermaid flowchart TD subgraph PLATFORM["PLATFORM PLANE — inviolable (platform-hosted)"] ID["Identity / Aje economy / payouts
(V1 · mocked binding)"] SAFE["Sekhmet scanner :47205
malware · CSAM · grooming"] SOC["Hera social :47206
crews · cross-realm bans (5s SLA)"] MKT["Abundantia market + Eunomia gov
(TS/NestJS)"] ORI["V6 Ori store + Aye Bridge
(reused · compiled)"] end subgraph CLIENT["Mawu UE5.5 client — attested, sandboxed web view"] UE["MawuCore · MawuRealm · MawuBuilder
MawuVoice · MawuUI"] end GW["mawu-gateway :47204
attested ingress · WebTransport/WebRTC/WS"] subgraph REALM["REALM PLANE — sandboxed (community- or platform-hosted)"] MOREMI["moremi-realm-server :47201
authoritative sim + Wasmtime + PubGrub"] DANU["danu-mesh-cluster :47202
authority handoff · split/merge"] NEPH["nephthys-replica-service :47203
event-sourced source of truth"] end UE -- "intent (HTTPS / realm wire)" --> GW UE -. "catalog / identity / payout" .-> PLATFORM GW -- "session routing · interest-managed delta" --> MOREMI MOREMI --> DANU MOREMI --> NEPH DANU --> NEPH MOREMI -. "trust-boundary secret isolation" .-> PLATFORM MOREMI -- "character memory" --> ORI ``` The wire that crosses the gateway is itself a measured contract. The `realm-protocol` crate advertises **20 baseline capabilities** (`baseline_realm_capabilities()`) and fixes the numeric envelope every transport must honor: an ack-relative **32-snapshot ring** (`REALM_DELTA_SNAPSHOT_RING_SIZE`), a **1400-byte** pre-fragment cap under the 1500 MTU (`REALM_DELTA_PREFRAGMENT_BYTES`), a per-client replication budget of **64–256 kbit/s** that must stay _independent of total realm population_ (`PopulationDependentBandwidth` is a hard violation), client prediction that must converge with zero rubber-banding at an 80 ms RTT, snapshot interpolation that must stay jitter-free at 5% loss and ±2 frames, and a lag-compensation rewind capped at 200–250 ms so favor-the-shooter cannot become a rewind exploit. Each of these is a `passed()` predicate on a typed report, and the netcode-loss gate composes them: 5% loss must be _playable_, 20% must degrade _gracefully_. The same frames travel transport-neutrally over WebTransport, WebRTC, and WebSocket (`RealmGatewayTransport`), with a wire-conformance harness that proves reliable-ordered control/intent channels survive reordering while unreliable state deltas may drop. V7 is mostly integration: it reuses the V6 realtime-gateway/voice pattern, the V6 Ori identity + Aye Bridge incarnation model, the V3 multiplayer protocol and spatial-audio primitives, the V5 online-services/anti-cheat/workshop spine, the Maya engine-core (ECS, world partition, physics), and the V1 identity/contracts/ persistence/safety/commerce libraries. The `V7Substrate` enum in `substrate-bridge` names thirteen such boundaries and pins each to a concrete `package_ref`; the honesty already noted is that all but the V6 Ori/Aye Bridge and Maya engine-core bindings are `Mock` today, which is exactly why the trust-boundary, identity-firewall, and Ori-write evals run end-to-end without a live platform deployment. ## Project layout The repository mirrors the two planes plus the client: ``` V7/ue/ # UE5.5 LTS client (Mawu) — one project, 3 targets Mawu.Target.cs # Game; MawuDedicatedRealmServer.Target.cs; MawuEditor.Target.cs Source/MawuCore # game mode, pawn, account/attestation hooks Source/MawuRealm # AMawuComposedRealmActor.ApplyLockFile → procedural geometry Source/MawuBuilder # in-realm builder placement → Geometry Script ops Source/MawuVoice Source/MawuUI # Pheme client; browser/console UI Source/MawuTests # DeveloperTool — realm bootstrap + geometry automation apps/v7/ (Rust workspace) # moremi · danu · nephthys · mawu-gateway · sekhmet · hera · dev-hygiene abundantia-market-service/ # TS/NestJS — catalog, payouts eunomia-governance-service/ # TS/NestJS — proposals, voting libs/v7/ (Rust workspace) # nana · realm-protocol · substrate-bridge contracts/ # TS Zod + Rust/C++/OpenAPI codegen, realm-lock composer libs/maya/forge-* # Ixchel scaffolds (resolver/conflict/sandbox/compositor) ``` Two things are worth reading closely. First, the **dedicated realm server is a separate UE target** (`MawuDedicatedRealmServer.Target.cs`, `Type = TargetType.Server`) that disables `CommonUI`, `EnhancedInput`, `ModelViewViewModel`, and `WebBrowser` — the headless authority shares code with the player client but ships none of its UI surface. Second, the **client builds worlds from data**: `AMawuComposedRealmActor::ApplyLockFile(const FMawuRealmLockFile&)` takes the very lock file the `realm-lock.ts` composer produces and reconstructs it into `UStaticMeshComponent` and `UDynamicMeshComponent` geometry via UE's GeometryScripting plugin — so a realm is a content-addressed manifest, not a shipped binary level, and `MawuRealmGeometryTests.cpp` asserts the resulting triangle/vertex counts and watertightness for real. ## Determinism — the cross-cutting invariant Rollback prediction (netcode), replay-based crash recovery (the mesh), and replayable creator plugins (Ixchel) all demand one thing: a **deterministic simulation core**. V7 enforces it at every layer, in code: - **Fixed-timestep simulation.** `moremi-realm-server` runs a dual tick loop — `MOREMI_COMBAT_TICK_HZ = 60` for instanced/combat zones, `MOREMI_OPEN_WORLD_MIN_TICK_HZ = 10` to `..._MAX_TICK_HZ = 30` for persistent open world, with a fixed `MOREMI_FIXED_TIMESTEP_HZ` baseline. A realm carries an explicit per-realm `seed`, so gameplay never reads wall-clock or unseeded RNG. - **WASM determinism controls.** For gameplay-affecting plugins the Wasmtime config enables **fuel** metering (`consume_fuel(true)`, `set_fuel(...)` per tick) so a plugin traps at the exact same instruction every replay, plus **NaN canonicalization** (`nan_canonicalization: true`) and per-plugin `StoreLimits`. Cheaper **epoch** metering (`epoch_interruption(true)`) is reserved for cosmetic/UI scripts that do not feed the deterministic state. - **Controlled floating point in the client.** All project-owned UE modules inherit `V7ModuleRules`, which selects `FPSemanticsMode.Precise` (including disabled contraction under Clang); Win64 targets additionally select `/fp:strict /fp:except-`. This constrains compiler transformations, while golden replay hashes—not an unsupported cross-architecture bit-identity claim—remain the determinism authority. - **Golden replays as the CI guard.** Moremi's `MoremiGoldenReplayCiReport::passed()` returns true only when the recorded input log reproduces the exact expected authoritative `state_hash` **and** a deliberately perturbed "nondeterminism probe" _fails_ to reproduce it — the gate proves both that determinism holds and that the test could detect its absence. The authoritative `state_hash` itself is a SHA-256 over the schema version, realm id, mutation count, and the ordered per-actor positions (`RealmAuthoritativeState::state_hash`), so the same gate underwrites netcode reconciliation, mesh handoff, and the trust-boundary tamper eval. Determinism is therefore not a feature of one subsystem; it is the shared contract that lets a client predict, a mesh node hand off authority atomically, and a creator's plugin replay identically — which is precisely why it is locked down once at the core and inherited by all the rest. ## Where to read next - [./moremi-realm-server-and-netcode.md](./moremi-realm-server-and-netcode.md) — the authoritative sim loop, the resource model, prediction/reconciliation, delta compression, lag compensation, and the Danu/Nephthys mesh. - [./ixchel-modding-runtime-and-wasm-sandbox.md](./ixchel-modding-runtime-and-wasm-sandbox.md) — the capability-typed WASM sandbox, fuel vs. epoch tiers, PubGrub resolution, and the content-addressed realm lock file. - [../../platform/overview.html](../../platform/overview.html) — the shared Oshun substrates (identity, Aje, safety, Ori/Aye Bridge, Maya engine-core) that V7 reuses rather than re-implements. ## Related - Section hub: [../V7_ARCHITECTURE.md](../V7_ARCHITECTURE.md) - Real code cited here: `apps/v7/moremi-realm-server/src/lib.rs`, `libs/v7/realm-protocol/src/lib.rs`, `libs/v7/substrate-bridge/src/lib.rs`, `libs/v7/contracts/src/realm-lock.ts`, `V7/ue/Source/Mawu.Target.cs`, and `V7/ue/Source/MawuRealm/Public/MawuComposedRealmActor.h`.