# V7 Discovery Integrity — Anti-Gaming for the Realm Browser Status: V7 trust-and-safety / discovery design. Source: fills the planning gap identified in `V1_V7_PLAN_SET_AUDIT_2026-06-12.md` §6.2 (no anti-gaming design for realm discovery). Grounded in `V7/V7_features.md` (features§"The In-Game Realm and Mod Browser", features§"Realm Lifecycle and Registry", features§"The Economy Firewall and Anti-Fraud") and `V7/V7_ARCHITECTURE.md` (arch§"The Economy Firewall and Anti-Fraud" — the verified-spend/retention/graph levers, arch§"Observability and Live Operations", arch§"The Trust Boundary — Platform vs. Realm"). The eval-gate format follows `V7/ADVERSARIAL_EVAL_GATES.md`. Owner: Abundantia discovery lead (ranking), anti-fraud team (detection), Kuanyin (penalties). Date: 2026-06-12. ## 1. The Plague Being Designed Against FiveM's server browser is the cautionary tale: fake-population servers (idle bots and spoofed player counts) crowd the top of a list sorted by raw player count, because raw count is both the ranking input and operator-reportable. New players join "full" servers that are empty of humans; honest servers are buried; trust in the browser dies and discovery migrates to streamers and Discord — exactly the funnel V7's realm browser must own (features§"The In-Game Realm and Mod Browser"). Every mechanism below follows one principle: **rank on what the platform itself verified, weight what bots cannot cheaply fake.** ## 2. Population Attestation — Platform-Verified Presence Only - **Realms never self-report population.** The displayed and ranked count is computed platform-side from gateway session records: the gateway is the sole client ingress (arch§"High-Level Topology"), so every genuine presence is an authenticated, attested-client session the platform observed itself. A realm process has no API to assert a count; the browser reads only the gateway's number. (This kills count-spoofing structurally, not by policy.) - **"Present" is stricter than "connected."** A session counts toward the *displayed* population when: authenticated platform account + attested client (arch§"Anti-Cheat and Client Integrity") + session age ≥10 minutes + input liveness over the last 15 minutes (intent-stream entropy above the idle floor — the server already consumes the full intent stream, features§"Server-Authoritative Netcode"). Spectators (read-only delta stream, features§"Streaming, Spectating, and the Creator Loop") display as a separate spectator count, never in population. Planning assumption adopted 2026-06-12 on the thresholds; tuned against the false-idle rate (genuine RP includes long stillness — see §3.1 mitigations). - **Anti-inflation cap**: sessions from accounts that fail §3 screening are excluded from displayed population retroactively and silently (no signal to the botter about which accounts were caught). ## 3. Fake-Player Detection Runs platform-side in the anti-fraud pipeline, sharing the account↔realm↔device↔payment graph of arch§"The Economy Firewall and Anti-Fraud" — population fraud and payout fraud are the same actor with the same toolkit, detected once. ### 3.1 Idle-bot signatures - Input-entropy profiling per session: bots exhibit looped/scripted intent (periodic micro-movement, identical input cadence). The deterministic sim consumes sequenced intent (arch§"Netcode"), so cadence/entropy features are cheap per-session computations. - RP-aware mitigation: legitimate roleplay includes AFK-adjacent behavior (sitting in a hospital bed, manning a store). Liveness therefore weights *interaction* events (chat/voice activity windows, zone interactions, economy events) over raw movement, with a 45-minute grace for sessions embedded in social context (proximity to other live sessions with mutual interaction history). Planning assumption adopted 2026-06-12. - Behavioral ML: the V5 server-side ML anti-cheat pipeline (features§"Anti-Cheat on Community Servers") gets a bot-classifier head; precision target ≥95% before automated exclusion (below that, human review), matching the anti-cheat bar (`anticheat` gate). ### 3.2 Connection-pattern and fleet analysis - Same-subnet / same-ASN session clusters joining one realm (hosting-provider ASNs weighted heavily — residential players don't connect from datacenter ranges), device-attestation fingerprint reuse across "different" accounts, and synchronized join/leave waves. - **Same-payment-method fleets**: accounts sharing payment instruments or KYC-adjacent signals form cliques in the existing graph; a clique of 30 accounts populating one realm nightly is the canonical purchased-bot-fleet topology (same centrality anomaly as the self-dealing detection, arch§"The Economy Firewall"). - Never-spent clusters: the verified-spend lever already gates payouts; discovery applies it as **weight**, not exclusion (new players genuinely haven't spent) — see §5. ### 3.3 Cost asymmetry, stated Attested clients + platform accounts + liveness means a convincing fake player costs the attacker a real attested client session with humanlike behavior over weeks (retention-weighted ranking, §5). The design goal is not "impossible" but "more expensive than buying ads" (planning assumption adopted 2026-06-12: target attacker cost ≥$0.50 per fake verified-player-day, re-estimated annually by red-team exercise, §7). ## 4. Listing-Boost Abuse - **Review brigading** (up and down): reviews/ratings (features§"The In-Game Realm and Mod Browser" discovery dimensions) are eligible only from accounts with ≥3 hours verified presence in the rated realm; rating weight scales with reviewer diversity (device/payment/social- graph independence); burst detection flags rating waves uncorrelated with a population/content event; coordinated negative campaigns against competitors are penalized on the *attacking* accounts and any realm whose operator staff are graph-linked to the campaign. - **Keyword stuffing / metadata spam**: the listing linter (publish-time) enforces tag count limits (≤8), rejects tag-irrelevance (tags must map to realm-config evidence: a "law-rp" tag requires the CAD/MDT institutions enabled — features§"Civic Institutions"), and bans trademark/brand-name baiting in titles (shares the IP-matching text corpus, `V7/docs/ip-content-matching.md`). Repeated relist-after-reject is a §6 ladder input. - **Featured-slot integrity**: curator-selected rotations (features§"Live-Service and Community Programming") publish their selection criteria, and curators are conflict-of-interest screened (no featuring realms they hold a revenue stake in — dependency-revenue links make stakes machine-checkable from the lock file). ## 5. Ranking Design — Resistant by Construction The default browser sort ("Recommended") is **verified-engagement-weighted**, not raw count: ``` realm_score = log(1 + verified_unique_players_28d) × median_session_minutes_28d^α (α≈0.5) × week4_return_rate^β (β≈1.0) × health_factor (uptime/degradation from gateway health — a degraded realm is flagged, never surfaced as healthy: arch§"Observability") × integrity_factor (1.0 clean; <1.0 under §6) ``` - **verified** = §2 presence-qualified sessions from §3-clean accounts; weight per player scales with account trust (verified-spend accounts weigh 2×, aged accounts with cross-realm history 1.5×, fresh accounts 0.5× — planning assumption adopted 2026-06-12, exact weights are anti-fraud-team tunables and deliberately unpublished). - **Median (not mean) session length × week-4 return rate** is the core: bots can fake presence, but faking *retention* of diverse, trusted accounts for four weeks costs more than the ranking is worth — the identical logic the payout formula uses (arch§"The Economy Firewall": retention weighting kills CCU-inflation bots), applied to discovery so the two systems can't be arbitraged against each other. - **Raw concurrent count appears in the UI** (players want it) but is a display field and an *optional explicit sort*, never the recommended-rank driver; the explicit sort still uses attested counts only. - **Cold-start fairness**: new realms get a `discovery_probe` allocation (a small share of browser impressions reserved for low-data realms, ε-greedy style) so the rich-get-richer loop doesn't freeze the market; probe performance (session length/return of probe-delivered players) feeds their initial score. Planning assumption adopted 2026-06-12: 10% of Recommended impressions to probe inventory. - **Anti-overfitting cadence**: weights (α, β, trust multipliers) are re-tuned quarterly against holdout cohorts; the *structure* (median × retention × verified) is the commitment, the constants are not. ## 6. Penalties Ladder Owner: Kuanyin enforcement on anti-fraud findings; Themis appeals; consistent with the `V7/docs/off-platform-monetization-policy.md` §5 pattern. | Stage | Trigger | Action | | ----- | ------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | | 0 | Detected bot/ineligible sessions (any realm, continuous) | Silent exclusion from counts and ranking inputs; no operator notice (don't teach the attacker) | | 1 | First confirmed operator-attributable inflation/brigading | Written finding; `integrity_factor` 0.5 for 30 days; Verified badge suspended | | 2 | Second offense in 12 months, or evasion of Stage 1 | Delisting from discovery 90 days (joinable by direct invite only); engagement-payout eligibility for the realm frozen pending review (the two systems share evidence) | | 3 | Industrial-scale fraud (purchased fleets, ranking-as-a-service), or fraud combined with payout claims | Realm termination per registry lifecycle; operator account action via Kuanyin/Themis; payout clawback through the Aje reserve mechanism | Attribution rule: Stage 1+ requires evidence the operator procured or directed the manipulation (payments to bot services, staff-account involvement, config evidence); third-party sabotage (botting a rival to get them punished) is the known false-flag risk — sabotage-pattern review is mandatory before Stage 1+, and unexplained bot traffic alone never exceeds Stage 0. ## 7. Integrity Eval Gate In the `V7/ADVERSARIAL_EVAL_GATES.md` format — to be added to that inventory and `.github/workflows/v7-ci.yml` when the discovery service test rig lands (owner: Abundantia discovery lead): | Gate | Owner | Threshold | Adversarial proof | CI command | | --------------------- | ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------- | | `discovery-integrity` | Abundantia | Seeded fake-population fleets shift the target realm's Recommended rank by <1 position and displayed verified count by 0; self-report attempts are unreachable (no API); brigaded ratings move weighted rating <2%; honest fixture realms' relative order is unchanged | Fixtures seed: (a) a 50-session same-ASN idle-bot fleet with scripted input loops, (b) a 30-account same-payment-method fleet with 10-min churn sessions, (c) a 40-account rating brigade from fresh accounts, (d) a realm attempting population self-report via realm-plane messages, (e) an honest control realm set. The gate must fail if ranking is tampered to read raw concurrency or realm-reported counts. | `pnpm exec vitest run --config vitest.config.ts -t "discovery integrity gate"` | Measurable operational criteria (telemetry suite, features§"Telemetry, Analytics, and Eval Sets"; targets are planning assumptions adopted 2026-06-12): - Bot-session share of displayed population: <1% (estimated via honeypot + labeled-cohort extrapolation). - Bot-classifier precision ≥95% / recall ≥80% on the labeled corpus, refreshed quarterly. - Median detection-to-exclusion latency for a new fleet: ≤48 h. - Rank-manipulation half-life: a seeded red-team fleet (run twice yearly by the anti-fraud team against production with synthetic accounts) must fail to hold a top-50 Recommended position for >7 days. - Discovery trust survey ("the browser shows me real, healthy realms"): ≥70% agree among new-player cohorts at GA. - False-positive harm: confirmed wrongful Stage 1+ actions <5% of actions (Themis reversal rate), and zero honest-realm exclusions in the Stage-0 silent path above 0.5% of sessions (audited by sampling).