flowchart TB
Creator[Creator and Mawu Studio] --> Ingest[Package ingest validation and signing]
Ingest --> Registry[(Immutable package registry)]
Registry --> Fleet[Realm fleet orchestrator]
Player[Player client] --> Edge[Identity gateway and admission]
Edge --> Moremi[Moremi authoritative realm server]
Fleet --> Moremi
Moremi --> Ixchel[Ixchel WASM sandbox]
Ixchel --> RealmCode[Untrusted realm code]
RealmCode --> Caps[Declared capability boundary]
Caps --> Platform[Trusted world data social voice economy and storage APIs]
Moremi --> Danu[Danu meshing]
Danu --> Nephthys[(Nephthys durable world state)]
Platform --> Sekhmet[Safety integrity and anti-cheat]
Platform --> Abundantia[Commerce payout and fraud controls]
Platform --> Eunomia[Governance moderation and appeals]
Sekhmet --> Evidence[(Audit telemetry review and incident evidence)]
Abundantia --> Evidence
Eunomia --> Evidence
Untrusted code reaches the platform only through declared, enforced, metered,
and observable capabilities. Signing identifies an immutable package; it does
not make the code, content, rights, or behavior trusted.
sequenceDiagram
actor Player
participant Realm as Realm server
participant Sandbox as Ixchel sandbox
participant Policy as Capability policy
participant Service as Trusted platform service
participant Store as Nephthys state
Player->>Realm: Authenticated gameplay intent
Realm->>Sandbox: Invoke package version with bounded context
Sandbox->>Policy: Request declared capability and quota
alt denied throttled or suspended
Policy-->>Sandbox: Named refusal and audit reason
Sandbox-->>Realm: Safe deterministic failure
else admitted
Policy-->>Sandbox: Scoped capability token
Sandbox->>Service: Versioned idempotent operation
Service->>Store: Authoritative read or write
Store-->>Service: Durable result or conflict
Service-->>Sandbox: Typed receipt and remaining budget
Sandbox-->>Realm: Deterministic realm outcome
end
Realm-->>Player: Authoritative visible result
The realm server owns player authority, the sandbox owns execution isolation,
policy owns capability admission, and platform services own durable effects.
None can be replaced by a cooperative convention inside realm code.
Package, release, dependency, capability, review, realm, snapshot, governance,
rights, and payout identities remain distinct so revocation, appeal, migration,
rollback, and settlement can be reasoned about precisely.
stateDiagram-v2
[*] --> Draft
Draft --> Validated: manifest schema dependencies and quotas pass
Validated --> SandboxTested: production-equivalent execution passes
SandboxTested --> Reviewed: safety rights integrity and quality gates pass
Reviewed --> Signed: immutable package release created
Signed --> Staged: eligible test realm cohort
Staged --> Published: discovery and creator release policy pass
Published --> Active: realm fleet runs version
Active --> Suspended: abuse fraud rights integrity or incident signal
Suspended --> Remediating: creator or operator correction
Remediating --> Reviewed
Active --> RolledBack: prior package and snapshot restored
RolledBack --> Active: recovery evidence passes
Draft --> Rejected: invalid prohibited or abandoned
Rejected --> [*]
Package release and world snapshot rollbacks are coordinated but different.
Suspension must contain active execution and discovery without destroying the
evidence needed for investigation and appeal.
classDiagram
class RealmInvocation {
realmId
packageVersion
actorId
tick
}
class CapabilityManifest {
allowedApis
quotas
dataScopes
}
class SandboxLease {
instanceId
fuelBudget
deadline
}
class PlatformReceipt {
operationId
stateVersion
auditRef
}
class ReviewEnvelope {
packageHash
rightsRefs
verdicts
}
RealmInvocation --> CapabilityManifest : constrained by
CapabilityManifest --> SandboxLease : instantiates
SandboxLease --> PlatformReceipt : may emit
ReviewEnvelope --> CapabilityManifest : approves version
Review approves an immutable hash and manifest. Runtime admission still checks
the current realm, actor, policy, quota, revocation, and operation version.
mindmap
root((Mawu creator republic))
Creation
Realm model and Mawu Studio
Moremi roleplay framework
Ixchel packages dependencies and tooling
Discovery migration and portability
Runtime
Moremi authority and netcode
Danu population and server meshing
Nephthys persistence snapshots and rollback
Fleet hosting data and compliance
Community and economy
Pheme voice and Hera social
Streaming and Ori incarnation
Abundantia distribution payouts and fraud
Rights matching takedown and portability
Governance
Sekhmet safety child protection and integrity
Eunomia governance moderation and appeals
Operator data protection and economics
Observability eval gates rollout and incidents
The map locates canonical ownership. Creator-facing features may compose every
branch, but no realm or creator owns the trusted enforcement plane.
journey
title From V7 realm idea to governed live service
section Build
Author realm package assets and dependencies: 5: Creator
Declare minimal capabilities rights and budgets: 5: Creator
section Prove
Run sandbox determinism security and migration tests: 5: Engineering, QA
Pass safety rights economy and governance review: 5: Trust, Rights
section Publish
Sign version stage realm and verify world state: 4: Release, SRE
Enter eligible discovery and payout scope: 5: Product, Economy
section Operate
Observe abuse fraud cost integrity and capacity: 5: Operators
Suspend appeal migrate or roll back with evidence: 5: Governance, SRE
The journey includes failure and correction paths because executable UGC cannot
be safely operated as a one-time upload approval.
timeline
title V7 release evidence
Contract : Realm package capability dependency and data invariants
: Creator rights economy governance and appeal policy
Runtime : Sandbox enforcement authority meshing persistence and services
: Voice social discovery payouts and operator controls
Verification : Adversarial security migration rollback and load tests
: Safety rights fraud accessibility and regional evidence
Candidate : Signed package staged realm snapshots and incident rehearsal
: Fleet observability discovery and payout reconciliation
Supported : Named versions capabilities realms regions and cohorts
: Current revocation incident appeal and recovery evidence
This is an evidence sequence, not a promise that all realm capabilities launch
together.
Use the landscape and sequence for trust-boundary review, the ER/state diagrams
for versioning and incidents, the class/estate views for API ownership, and the
journey/timeline for publication and release. Continue to the
V7 guide, feature index, and
architecture index.