# Abundantia: The Creator Republic

A platform that asks players to build worlds, write executable code, and host
their own servers has made an implicit promise: that the people who make the
worlds will be paid for them, correctly, and that the money will be defended
from the people trying to farm or launder it. **Abundantia** is V7's answer to
that promise — the distribution-and-economy layer that turns the Mawu engine and
the Ixchel modding runtime into a living _republic_ of creators, where a realm
is a product, a mod is a building block, and a curated Collection is a one-click
experience that pays everyone in its dependency graph. Named for the Roman
goddess of abundance, Abundantia owns the catalog a player browses, the
content-addressed CDN that delivers it, the three revenue rails a creator earns
across, and the payout formula that splits every cent — and then it hands the
actual movement of money to the shared **Aje** payment substrate the rest of
Oshun already runs on.

Abundantia sits exactly on V7's trust boundary. It is where real money meets
community-hosted realms, so the catalog, the payout math, and the economy
firewall are **platform-controlled and never delegated to a realm process**,
while the realm keeps only its own non-fungible play economy. It extends the V5
workshop — a single-game, _data-only_, nine-platform catalog — into a
cross-game, **executable**, cross-platform creator economy modeled on the parts
of mod.io, Roblox DevEx, Fortnite/UEFN, and Nexus Collections that actually
shipped at scale. This page covers what a creator experiences: how content is
distributed, how it earns, how the payout lands in a real bank account, and who
pays for the compute underneath. For the full feature scope this slots into,
start at the hub: [../V7_features.md](../V7_features.md).

## What ships, honestly

The Abundantia market service is **real, tested TypeScript**. The module
`apps/v7/abundantia-market-service/src/service.ts` is a ~4.5 K-line service
whose descriptor (`abundantiaMarketServiceDescriptor`, `service.ts:1030`, port
`47301`) advertises **50 capabilities** and `satisfies V7ServiceDescriptor`; its
sibling `service.test.ts` runs **21 tests** that assert exact computed amounts,
not truthiness. The publish gate, the content-addressed catalog, the
cross-platform install sync, atomic Collection install, the three-rail payout
formula, the verified-spend eligibility weighting, the currency firewall's
reachability check, and the fraud-graph topology detector are all
domain-specific and exercised against known-correct values — a 100-cent
engagement pool splits to `33`/`17`/ `16`/`34` across three creators and a
dependency; a `6_999`-bps direct split (one basis point under the 70% floor) is
`rejected` outright.

The hosting half is **real Rust** too: `apps/v7/danu-mesh-cluster/src/lib.rs`
encodes the Agones fleet model (`DanuAgonesFleetCrd`, `DanuAgonesScheduling`)
and the cost-tier decision (`select_danu_realm_cost_tier`, `lib.rs:736`) that
decides which realm runs on cheap preemptible compute and which gets owned
hardware, with 22 `#[test]` cases.

**Four honest qualifications, stated up front:**

- **Payout _composes_ Aje; it does not move money.** Abundantia computes the
  ledger — splits, holds, compliance gates — and emits a typed
  `AbundantiaAjeSettlementReceipt` carrying deterministic
  `aje:v7:abundantia:<24-hex>` transfer ids (`createAjeTransfer`,
  `service.ts:3589`). It does **not** import `@oshun/payments-bridge` or
  broadcast a transaction. The real Aje plane (`libs/oshun/payments-bridge`) —
  Ed25519 receipt signing, the cross-rail entitlement bus, the cold-spend
  co-signing queue — is the substrate that actually settles. Abundantia decides
  _who gets how much_; Aje decides _how the money moves_.
- **The Nàná in-realm economy crate is deliberately minimal.**
  `libs/v7/nana/src/lib.rs` defines `NanaCharacterRecord`, `NanaBalances`
  (cash/bank/society in minor units), and a `validate()` that rejects negative
  balances; its own doc-comment says it "intentionally starts small." The
  realm-scoped double-entry ledger, faucet/sink primitives, and auto-balancer
  are architecture, not yet code in that crate. (That is fine here — Abundantia
  is the _real-money_ economy; Nàná is the _play_ economy the firewall keeps
  separate.)
- **The Year-1 catalog is operations, not a repo artifact.** Which realms, which
  featured drops, which Collections ship is a schedule the service executes —
  the machinery ships; the merchandise is ops.
- **The learned engagement-quality model is spec.** The eligibility weighting
  and fraud-graph flags are deterministic heuristics that ship and are tested;
  the ML classifier that would score engagement _quality_ is future work,
  labeled as such in the
  [arch companion](../architecture/abundantia-economy-firewall-and-anti-fraud.md).

## The creator-republic model

The thesis of V7 is that a sandbox becomes a platform the moment the community
ships the games — and an _economy_ becomes a republic the moment makers are
paid, governed by their own rules, and free to build on each other's work.
Abundantia is the institutional layer that makes that real. A creator authors a
realm or mod in [Mawu Studio](./mawu-studio-creation-tools.md), every tool of
which emits Ixchel composable layers; Abundantia is where that artifact is
published, discovered, installed, and monetized.

Three principles fix the model:

- **The platform owns the rails; the realm owns its play economy.**
  Distribution, the payout formula, KYC/tax/reserve gates, and both economy
  firewalls are platform-controlled. A realm operator — assumed potentially
  hostile — never touches the real-money path. What a realm owns is its own
  non-fungible, non-cashable in-realm currency, kept physically separate by the
  currency firewall (deep treatment in
  [economy firewall, commerce & rights](./economy-firewall-commerce-and-rights.md)).
- **Free distribution is always available; paid is opt-in and labeled.** The
  2015 Steam paid-mods rollback and the recurring Bethesda Creations controversy
  are studied explicitly: a creator who released something free can never have
  it paywalled later — `runRealMoneyCommerceSurfaceEval` enforces a
  `freeReleasePaywallRejected` rule so a community that adopted free content
  can't be bait-and-switched.
- **Shared building blocks are economically rational.** Because the Ixchel lock
  file already makes a realm's dependencies explicit and reproducible, a share
  of every sale flows automatically to the makers of what it was built on — the
  dependency-revenue chain, below.

A published item moves through a lifecycle recorded in the Abundantia registry —
`Draft → Submitted → InModeration → Published / Rejected`, with semantic
versions and **no silent deletion of pinned versions** — so a player on an older
version is flagged, never silently broken. A realm additionally reaches
`Verified` only after a clean Ixchel balance pass and a Sekhmet scan.

## Distribution — content-addressed catalog, console authorization, one-click install

### Content addressing is the one primitive

Every Abundantia artifact is **content-addressed**, the single id the whole
distribution layer is built on. `computeAbundantiaContentHash`
(`service.ts:1136`) hashes the schema tag, the content bytes, and the **sorted
dependency-closure hashes** into a `sha256:` id, so an artifact's identity
changes the instant any byte of it — or any of its dependencies — changes.
`buildContentAddressedCdnObject` (`service.ts:1153`) turns that hash into a CDN
URL (`ABUNDANTIA_CDN_BASE_URL`) whose integrity field _equals the hash_, so a
swapped dependency is tamper-evident at fetch time. This is the same Nix-style
content addressing the Ixchel resolver uses for its lock file — distribution and
dependency resolution agree on one id, which is what later makes incident recall
surgical.

### The publish gate and console authorization

`publishCrossPlatformCatalogArtifact` (`service.ts:1174`) is the gate. It
requires a `sha256:`-addressed hash, an **attested rights claim**, and a Sekhmet
review of status `approved` before any record is produced — and it computes
**per-platform availability separately**. PC publishes immediately for a trusted
creator, while console targets (`xbox`/`playstation`/`switch`) stay
`requires_console_approval` until a matching `AbundantiaConsoleAuthorization`
with a passed cert checklist is supplied. This is the mod.io console-authorized
model, and it is the only viable path to mods on console — the hardest UGC
barrier. Console defaults to require-approval; PC supports auto-approve for
trusted/verified creators with post-publish moderation.

### One account, every device; one browser, no surprises

A single account's installs sync across platforms
(`installCatalogRecordForAccount`, `service.ts:1243`) — the "one account, every
device" model. The in-game browser (`queryInGameCatalogBrowser`,
`service.ts:1370`) mirrors to web and the companion app, filters by tag, kind,
locale, and player count — and crucially **refuses to surface anything not
Sekhmet-cleared** and **visibly flags degraded realms** (`flagged_degraded`)
rather than presenting them as healthy, consuming the per-realm health signals
(`AbundantiaRealmHealthSignal`) the gateway emits. A player never one-clicks
into a broken or quarantined world unaware.

### Atomic Collection install

The headline flow is **atomic Collection install** — the Nexus-Collections /
Wabbajack capability. `installCollectionAtomically` (`service.ts:1574`) resolves
a root listing's full dependency closure, verifies _every_ artifact in it is
Sekhmet-cleared, computes a lock-file hash, and only then fetches. The test
"aborts Collection install atomically before fetching an uncleared dependency"
proves the all-or-nothing property: one uncleared dependency anywhere in the
closure fails the whole install with **zero artifacts fetched**, so a player
never ends up with a half-installed Collection straddling a quarantined mod.

## Monetization and payout — three rails, settled through Aje

Abundantia pays creators across **three rails**, all reconciled by one formula,
`evaluateAbundantiaPayoutFormula` (`service.ts:1741`): the **engagement pool**
(a platform-funded pot, default 40% of eligible net revenue, distributed by
weighted engagement — the UEFN model), **direct sale / subscription** (with a
hard ≥70% creator floor — the V5 marketplace floor carried forward), and
**dependency-revenue chains** (a configured share routed to the makers of an
artifact's declared dependencies). The pool size and the dependency-share
percent are governance-set inputs amendable via Eunomia; the 70% floor is the
one rate hard-coded as an invariant — `validatePayoutFormulaInput`
(`service.ts:3258`) rejects any line whose `creatorShareBasisPoints < 7_000`.

```mermaid
flowchart TD
    AUTH["Creator authors in Mawu Studio<br/>(emits Ixchel layers)"] --> PUB["publishCrossPlatformCatalogArtifact<br/>content-hash · rights claim · Sekhmet approved"]
    PUB --> CDN["content-addressed CDN<br/>integrity = sha256 hash"]
    CDN --> INSTALL["one-click / atomic Collection install<br/>Sekhmet-cleared closure only"]
    INSTALL --> PLAY["players engage · buy · subscribe"]
    PLAY --> ELIG["runPayoutEligibilityEval<br/>verified-spend + retention weighting"]
    FRAUD["runFraudGraphEval<br/>self-dealing + RMT topology"] -. blocks .-> ELIG
    ELIG --> FORMULA["evaluateAbundantiaPayoutFormula<br/>engagement · direct sale · dependency carve"]
    FORMULA --> GATES["compliance gates<br/>KYC · tax · reserve · refund window"]
    GATES --> RCPT["AjeSettlementReceipt<br/>aje:v7:abundantia:… transfers"]
    RCPT -->|typed seam| AJE["shared @oshun/payments-bridge<br/>Ed25519 · entitlement bus"]
    AJE --> PAYOUT["creator payout account"]
```

### Who counts: verified-spend, retention-weighted eligibility

Before a cent enters the engagement pool, `runPayoutEligibilityEval`
(`service.ts:1951`) decides which play counts — the anti-bot lever made
concrete. A session is **excluded** if the account has never spent real money
(`verified_spend_required`, the single strongest anti-farm lever) or is a
flagged CCU-inflation bot (`ccu_inflation_bot`). Surviving sessions are weighted
by `buildPayoutEligibilityWeightedSession` (`service.ts:3022`) as
`engagementMinutes × (retentionMultiplier + cohortBonus) / 10_000`, where each
retained active day adds 1_000 bps (capped at 7) and a new/reactivated payer
gets a 2_500-bps bonus. The test pins it: a 40-minute session from a
4-day-retained new payer weights to exactly
`floor(40 × (14_000 + 2_500) / 10_000) = 66`, while a 200-minute never-spent
session and a 999-minute bot both weight to **zero** — raw concurrency buys
nothing.

### The split and dependency-revenue chains

For each direct-revenue line the formula computes `net = gross − tax − refund`,
takes the platform cut, and carves the creator pool at
`creatorShareBasisPoints`; it allocates the engagement pool across eligible
signals by weight (`allocateCentsByWeight`, a largest-remainder method so cents
always sum exactly); and `splitCreatorAndDependencyRevenue` (`service.ts:3378`)
carves each creator's amount into their own route plus pro-rata
**dependency-revenue** routes. Critically,
`computeDependencyRevenueSharesFromLockFile` (`service.ts:1805`) derives the
dependency set straight from a realm's resolved lock file — the same
content-addressed closure the Ixchel resolver pins — so the people whose mods a
realm builds on are paid **by construction from the dependency graph**, not by
manual declaration. The default is 10% of gross routed to dependencies,
operator-configurable 0–25%, and never dropping the original creator below the
70% floor. The worked test exercises it all at once: Ada's `10_000`-cent sale
(net `8_000`, 70% share, 25% dependency carve) yields a `4_200` creator route
and a `1_400` dependency route to Cy.

### Compliance gates, held vs. cashable, and the Aje seam

A computed route is not a cashable payout. `buildCreatorPayoutSettlements`
(`service.ts:3448`) walks each route through `complianceGateReasons`
(`service.ts:3560`): missing KYC, an incomplete tax interview, an unverified
payout method, a reserve hold, or an unmet minimum each **hold the entire
payable amount**. In the worked case Ada clears (cashout `3_733` after a `500`
reserve hold) and Cy clears (`1_416`), but Bea is gated `payout_method_required`
and Dia `kyc_required, tax_interview_required` — both cash out **zero**, and a
subscription still inside its refund window is computed but fully held
(`refund_window_open`). `payoutSettlementStatus` (`service.ts:3662`) reports
this honestly: `partially_held` whenever anything is held, `rejected` (with no
transfers) on validation failure, `settled` only when every cent is clear; the
batch reconciles to `creatorEarningsCents: 9_700`,
`platformRevenueCents: 3_400`, `heldCents: 4_551`.

Every clear settlement becomes an `AbundantiaAjeTransfer` with a deterministic
`aje:v7:abundantia:<24-hex>` id and a per-rail breakdown, wrapped in an
`AbundantiaAjeSettlementReceipt` carrying a `sha256:` ledger hash. That receipt
is the typed contract handed to the shared Aje plane: `@oshun/payments-bridge`,
whose entitlement bus normalizes four fiat adapters and fourteen crypto rails
into one `payment.invoice.settled` envelope (`entitlement-bus/topics.ts`) and
whose receipt-signer signs each payout with Ed25519 (`@noble/curves/ed25519`).
The cash-out itself rides Aje's developer-exchange path — the Roblox DevEx model
that proves the flywheel at hundreds of millions of users.

## Hosting, orchestration, and who pays

Realms are orchestrated on **self-hosted Agones** (Kubernetes-native) rather
than a single managed vendor — a deliberate hedge, since the managed
game-hosting market proved unstable (Unity Multiplay shut down in 2025; Hathora
in 2026). A realm maps to an Agones Fleet (`DanuAgonesFleetCrd`,
`apps/v7/danu-mesh-cluster`) with a packed or distributed scheduling profile and
a buffer autoscaler that keeps pre-warmed realms ready, so joining a popular
world is instant with no cold-start wait.

**Who pays is a hybrid:**

- The **platform pays** for the inviolable services (identity, the real-money
  economy, safety) and for a buffered fleet of "official" realms.
- **Creators may bring their own compute** for high-volume realms (the GSP
  model) — but only the sandboxed realm logic, never platform services, and
  always behind the platform gateway, which is the sole client ingress and
  scrubs/rate-limits DDoS upstream of every realm so a realm's origin is never
  exposed.
- **Cost tiering follows persistence, and it is real code.**
  `select_danu_realm_cost_tier` (`danu-mesh-cluster/src/lib.rs:736`) decides: a
  **stateless, respawnable** session that is Nephthys-backed runs on **Spot**
  (preemptible, 120-second reclaim notice); a **persistent RP** realm runs on
  on-demand or **owned hardware** (never preemptible); and a stateless realm
  with _no_ Nephthys checkpointing is refused Spot ("cannot-use-spot"). This is
  only safe because **Nephthys — not the sim node — holds the truth**, proven by
  `run_danu_spot_reclaim_reallocation_eval`: a preempted Spot node reallocates
  from a Nephthys checkpoint with `player_visible_state_loss: false`. A
  preempted node loses nothing.

The platform absorbs the inviolable and the buffer; cheap compute carries the
ephemeral; durable RP worlds get the hardware they need — and the persistence
layer is what makes that arbitrage safe.

## Where this connects

- [Mawu Studio — Creation Tools](./mawu-studio-creation-tools.md) — the tiered
  creation funnel whose every tool emits the Ixchel layers Abundantia publishes,
  versions, and monetizes.
- [Economy Firewall, Commerce & Rights](./economy-firewall-commerce-and-rights.md)
  — the currency firewall that keeps in-realm play-currency non-cashable, the
  fraud graph, and the rights/DMCA/provenance path that Abundantia composes.
- [../architecture/abundantia-economy-firewall-and-anti-fraud.md](../architecture/abundantia-economy-firewall-and-anti-fraud.md)
  — the engineering companion: every cited function, the reachability-search
  firewall, the topology detectors, and the exact seam to the shared
  `@oshun/payments-bridge` Aje plane that executes settlement.
- The feature hub: [../V7_features.md](../V7_features.md).