Eunomia Governance & Trust/Safety for Executable UGC

A creator republic makes two promises that pull in opposite directions. The first is self-rule: a community that writes the law of its own world — its charter, its economy rules, its content policy — and changes that law by its own vote, not by a platform ticket. The second is safety: V7 (codename Mawu) lets community operators run their own authoritative servers and ship executable UGC — real WASM behaviour, economy logic, whole world genomes — onto machines shared with thousands of strangers. Self-rule without a floor becomes a place where a realm can vote to stop scanning for child-abuse material; a safety regime without self-rule becomes Roblox, where the platform owns every decision and the "republic" is a marketing word. V7's answer to both is sovereignty bounded by an inviolable core: a guild governs its charter but cannot vote away child-safety; a realm renders your character and runs its own rules, but never owns identity, the real-money economy, or the cheater verdict on the node it hosts.

This page is the feature-facing tour of the two subsystems that make that sentence mechanically true. Eunomia is the multi-tier governance kernel — five sovereign rule spaces, six plural-voting models, a strict proposal lifecycle, and a safety floor no quorum can cross. Sekhmet (with the realm server's anti-cheat stack and the gateway's voice tap) is the trust-and-safety plane that stands in front of executable UGC: scan-before-serve, supply-chain integrity, child protection, age assurance, and authoritative-node-only anti-cheat. The two meet at exactly one place — Eunomia's real_money_firewall and csam_blocking floor is Sekhmet's posture rendered as a vote a community cannot win. The byte-level companions are ../architecture/sekhmet-safety-and-anti-cheat.md and ../architecture/eunomia-governance-and-ori-bridge.md; the sandbox that contains the executable UGC this page guards is ./ixchel-sandbox-and-modding.md; the real-money/play-currency firewall the floor governs is ./economy-firewall-commerce-and-rights.md. For the full V7 feature scope, start at the hub: ../V7_features.md.

What ships, honestly#

The honest split is the same on both halves: the decision logic and its adversarial evals are real, deterministic, and green; the live serving daemon and the proprietary vendor models are the named seams. This page follows the code.

• Eunomia is a real, test-backed decision kernel — but a kernel, not yet a live service. apps/v7/eunomia-governance-service/src/service.ts (1,574 lines) is a library of pure, deterministic functions: tier/parent-override validation, safety-floor evaluation, the proposal state machine, six plural-voting tally formulas, Themis appeal routing, localized rendering, and the Maya Variants/Crucible governance surface. Its service.test.ts carries 12 test cases, and the eunomiaGovernanceServiceDescriptor declares port 47302 and 16 capabilities (service.ts:494). The honest qualification: the deployable binary (src/main.ts, 20 lines) is a Node http server that answers exactly one route — /health — returning the descriptor as JSON. There is no Postgres, no live proposal API, and no event bus wired in yet. Treat Eunomia as a verified rule engine awaiting its transport.
• Sekhmet is a real native Rust crate, not a slide. apps/v7/sekhmet-scanner/src/lib.rs is a single ~6,009-line crate whose only dependencies are sha2 = "0.10.9" and hmac = "0.12.1" (Cargo.toml) — so every hash, signature, and lock pin is computed for real. It carries fifteen integration tests covering malware, supply-chain, CSAM hash, novel-CSAM, grooming, NCII, age assurance, minor protection, the Sentinel longitudinal detector, the three-layer moderation pipeline, and an incident-response drill; run directly, all 15 pass. Six evals are wired to CI as named adversarial gates — malware-corpus, csam-hash, grooming, minor-protection, plus sandbox-escape and anticheat from the realm server (scripts/v7/verify-adversarial-eval-gates.mjs).
• Where a defense needs a licensed model, it is a deterministic stand-in with the real seam named — never a faked result. With only sha2/hmac on hand, compute_csam_perceptual_hashes (:1753) derives algorithm-labeled digests standing in for proprietary PhotoDNA/PDQ; the novel-CSAM (:1894) and grooming (:2022) classifiers are signal-weighted scorers standing in for the licensed Thorn Safer / Project Artemis models; the facial-age vendor is an injected input (FacialAgeEstimateInput), not a call Sekhmet fakes. What is real is everything around the model: the block-before-serve decision, the human-review routing, and the precision/recall eval that fails on a regression.
• The shared trust-safety plane exists, and the native crates name its seams. Mawu reuses the platform's Aphrodite/Kuanyin/Themis plane: libs/themis/arbitration (a real decentralized-arbitration court and multi-tier escalation engine), libs/themis/privacy/src/v2-data-subject-rights.ts (GDPR Art. 15/17), and libs/kuanyin/community-harmony/src/raid-defense.ts exist and are implemented. The Rust scanner does not import these TypeScript packages — it routes to the same seams by name: high-risk content to the kuanyin-human-review queue (:59) and contested removals to a themis-dsa-appeal-path (:60), and Eunomia's appeal router emits themisModule: '@themis/arbitration' (service.ts:827). Structurally correct contracts; the live arbitration wire is pending.

Multi-tier community governance — Eunomia#

Five sovereign tiers, and the parent-override consent rule#

Governance is partitioned into five tiers, ordered by scope: EUNOMIA_GOVERNANCE_TIERS = ['platform', 'game', 'realm', 'server', 'guild'] (service.ts:463). Each holds a sovereign rule space a parent cannot silently override. The parent chain is explicit in EUNOMIA_PARENT_TIER (:471) — game→platform, realm→game, server→realm, guild→server — and platform deliberately has no parent. The sovereignty is enforced in executeGovernanceRuleChange() (:577): a rule change with no parentOverride is marked sovereignRuleSpace: true, and a parent may only reach into a child tier when validateParentOverride() (:1243) passes all three conditions — the override names the correct parent tier (parent_override_wrong_tier:* otherwise), the target tier actually consented (parent_override_requires_target_tier_consent), and a non-empty reason is given. Override at platform fails with platform_tier_has_no_parent_override. The test executes a realm charter change in the realm sovereign rule space pins this. For a realm owner this is the concrete feature: your guild rewrites its charter and the realm above cannot quietly reverse you — it must come through the front door, name your tier, and you must have said yes.

The safety floor no vote can cross#

Sovereignty stops at the platform safety floor. EunomiaSafetyFloorPolicy (:13) enumerates five non-negotiables — minor_protection, harassment_abuse, csam_blocking, identity_privacy, and real_money_firewall — and every rule change must ship a non-empty safetyFloorChecks array (absence yields safety_floor_checks_required, :1218). evaluateEunomiaSafetyFloor() (:1181) filters for any check where compliant === false; a single violation flips clean to false and the change cannot execute. No quorum, no token weight, and no parent-consent path can carry a change that fails the floor — the Lilith/Kuanyin posture is structurally above the most powerful vote. The test rejects safety-floor violations at every governance tier runs that assertion across all five tiers. This is the seam where governance and trust-safety are the same object: csam_blocking is Sekhmet's scan-before-serve, and real_money_firewall is the economy firewall rendered as a policy a community is forbidden to repeal.

The proposal lifecycle as a strict state machine#

EUNOMIA_PROPOSAL_LIFECYCLE_ORDER (:477) fixes the only legal path: draft → deliberation → vote → execution → appeal. runProposalLifecycle() (:607) replays a submitted transition list against this order: each transition must carry a non-empty actor, timestamp, and reason; its from must equal the machine's current state; and its to must be exactly the next state from nextProposalLifecycleState() (:1077) — otherwise transition_not_allowed:*. A proposal is complete only when the walk reaches appeal with no accumulated reasons. The machine is therefore append-only and skip-proof: you cannot jump from draft straight to execution, and the report exposes the full statesVisited trail for audit.

Plural voting — six models, six real formulas#

Eunomia does not hard-code one democratic theory. EunomiaPluralVotingModel (:25) offers six, and pluralVotingBallotWeight() (:1137) gives each a distinct, real weight function:

• token → tokenWeight (stake-weighted).
• reputation → reputationScore.
• quadratic → Math.sqrt(quadraticCredits) — the Weyl/Posner square-root that taxes concentration of influence so broad participation beats a whale.
• conviction → convictionStake × convictionAgeHours — time-locked conviction, where a long-held position carries more weight.
• delegated → baseWeight + Σ delegatedWeights — liquid-democracy delegation.
• time_weighted → baseWeight × min(membershipAgeDays, 365) — tenure, capped at one year so longevity cannot become unbounded capture.

tallyPluralVotingModel() (:733) does the honest bookkeeping: it keeps only the latest ballot per voter (latestPluralVotingBallots(), dedup by castAt), rejects any ballot whose computed weight is non-positive (ballot_weight_must_be_positive) and surfaces it with a reason rather than silently dropping it, rounds to six decimals to avoid float drift, and computes passed = quorumMet && winningChoice === 'for' && totals.for > totals.against. The test tallies each plural voting model against known fixtures checks all six against precomputed weights — a real correctness test, not a shape check. A realm charter picks its model per tier; the formula it picks visibly changes who wins.

Appeals route to Themis — and the Verified gate#

A proposal that reaches appeal is escalated by routeProposalAppealToThemis() (:792). It refuses anything not in the appeal state (proposal_not_in_appeal_state) and, on success, emits a typed route naming themisModule: '@themis/arbitration', a deterministic themisCaseId (themis:eunomia:<proposalId>:<appealId>), and an appealRef URI. Honest seam: this constructs the routing contract against the real libs/themis/arbitration package surface. The separate asynchronous dispatchProposalAppealToThemis() path sends that contract to a configured Themis HTTP service and accepts delivery only after an exact identity-bound receipt passes schema validation. The gateway is tested through the real fetch boundary; no credentialed external receipt was captured in this slice. The richest governance surface is the game tier, where communities steward forkable Maya Variants: publishMayaVariantFork() (:834) produces a standalone publication with a full attribution chain and typed revenue links, basis-points-validated against MAX_REVENUE_SHARE_BASIS_POINTS = 10_000 (:462), and resolveCanonicalVariantVote() (:887) reassigns the canonical "main" branch only when a challenger both wins and strictly out-weighs the incumbent past quorum. Before a realm earns Verified status it must survive the Maya Crucible — runMayaCrucibleBalanceVerification() (:1016) simulates a baseline-worker against an exploit-seeker, and detectCrucibleFindings() (:1522) flags excessive-mint, runaway-growth, and infinite-currency-cycle. evaluateMayaRealmVerifiedGate() (:1035) then gates Verified on all three signals being clean: no blocking Crucible findings (crucible_blocking_findings), a clean Sekhmet scan (sekhmet_scan_not_clean), and clean moderation standing (moderation_standing_not_clean). Governance, anti-fraud, and trust-safety are &&-ed together in one function. Proposals are launch-localized: EUNOMIA_LAUNCH_LOCALES (:34) covers eight locales including RTL ar/he, and renderLocalizedGovernanceProposalForRegion() (:666) maps five regions to default locales, requiring an approved moderation status before a translated proposal renders.

Trust, safety, and anti-abuse for executable UGC#

Running untrusted executable code on other players' machines and authoritative servers is the defining risk of V7. Safety is layered — the Ixchel sandbox (prevention), Sekhmet (detection), anti-cheat (integrity), moderation (content), and incident response (recovery) — and every layer here is platform-central, never realm-delegated.

The ingest gate: scan before any serve, and supply-chain integrity#

Nothing reaches a client unscanned. scan_artifact (:3461) classifies an uploaded artifact into a ScanVerdict, and evaluate_distribution_gate (:3536) refuses to emit a fetchable decision for anything but a clean scan — the order itself is the property. run_malware_corpus_eval (:3491) drives a hostile corpus and reports a detection rate, the body of the malware-corpus CI gate. Supply-chain integrity is the second half, and it is the same content-addressing primitive the Ixchel store uses, lifted to the publish path: build_content_addressed_artifact (:1275) hashes content plus its full dependency closure; build_pinned_lock_file (:1364) freezes it; sign_artifact_manifest/verify_signed_artifact_manifest (:1404/:1426) sign and check with real HMAC-SHA256; and evaluate_supply_chain_publish (:1452) requires an AccountStepUpReceipt (:266) on re-publish — the fractureiser defense, where a compromised maintainer account cannot silently swap a trusted dependency. When something slips, run_incident_response_drill (:1647) quarantines the exact realms pinning a flagged artifact by content hash, recalls, and reports — surgical recall, because the lock file knows precisely who pinned what.

Child protection — the highest bar#

Child safety is where Sekhmet is most fully built out, and it is the bar a platform holder refuses to ship without. A realm operator is never the CSAM-scanning authority. compute_csam_perceptual_hashes (:1753) renders the right hash family per asset kind — PhotoDNA + PDQ for images, CSAI Match for video, and, for the 3D-native problem, rendered-2D views of textures and meshes; scan_csam_hash_ingest (:1806) returns Blocked with serve_allowed = false the instant any hash matches an NCMEC-class set — stopped before a fetch, never after — and classify_novel_csam (:1894) is the Thorn-Safer-class scorer for un-hashed material. classify_grooming_conversation (:2022) weights real grooming signals (secrecy pressure, off-platform migration, isolation, gift leverage) and routes hits to kuanyin-human-review; voice — the highest-risk channel — is screened at the gateway by MawuVoiceSafetyPolicy (mawu-gateway/src/lib.rs:648), which yields RoutedToReview (:682) rather than trusting a transcript. Above single conversations, run_sentinel_child_endangerment_eval (:3283) surfaces a seeded cross-realm endangerment pattern that any per-realm view would miss, and share_lantern_signal (:2950) emits the Tech-Coalition Lantern cross-platform signal. Age assurance keeps the biometric off the platform entirely: evaluate_facial_age_estimate (:3075) treats the vendor as an injected estimate and enforces privacy-minimization in code — the biometric must be deleted within AGE_ASSURANCE_BIOMETRIC_DELETION_SLA_MS = 60_000 (60 s, :85), confidence must clear AGE_ASSURANCE_MIN_CONFIDENCE_BASIS_POINTS = 7_500 (:86), and any failure forces the safest band, Everyone. evaluate_minor_protection_request (:3142) then restricts cross-age contact and unfiltered chat by default whenever a minor is on either side, and run_minor_protection_eval (:3204) — the minor-protection gate — passes only with zero false-allows. NCII follows the TAKE IT DOWN Act shape: ingest_stopncii_hashes (:2798) takes StopNCII hashes and run_ncii_takedown_pipeline (:2864) drives removal within NCII_TAKEDOWN_SLA_MS = 48 h (:84); contested removals open a Themis DSA appeal bounded by SEKHMET_DSA_APPEAL_SLA_MS = 72 h (:88), and in-world reports need both telemetry and a replay clip before they are actionable (evaluate_sekhmet_contextual_report_flow, :2641).

Anti-cheat on community servers — the operator owns the node#

Anti-cheat in a creator republic has a structural problem FiveM never solved: the operator owns the authoritative node. V7's answer is that detection never trusts that node's client, and enforcement against the platform routes platform-side. The structural floor is server-authoritative netcode: RealmEnvelope::validate_cross_trust (realm-protocol/src/lib.rs:1781) checks sender, signature, security-token MAC, and an HMAC-SHA256 over the payload before apply_client_intent_to_authoritative_state (:1835) mutates anything — and rejects_forged_payload_even_with_valid_token (:3788) and rejects_forged_security_token_even_when_envelope_is_resigned (:3799) prove a tampered intent is dropped even when re-signed. On that floor, moremi-realm-server ships real-physics detectors: moremi_anticheat_impossible_turn_rate (:12027) computes angle/tick against a 720°/s ceiling, moremi_anticheat_speed_delta (:12059) compares a distance/time ratio to max speed, and moremi_anticheat_auto_fire (:12078) flags impossibly tight shot intervals. evaluate_moremi_anti_cheat_signal (:11643) is decisive in its first act: a signal not observed on the authoritative node is ignored (ignored-non-authoritative-client-signal), so a tampered client can neither forge a strike against a rival nor suppress one against itself. Risk rolls Clean → Watch → Strike → BanReview; on the third realm-scoped strike (MOREMI_ANTI_CHEAT_THREE_STRIKE_LIMIT = 3, :252) it issues a realm-scoped ban and routes a platform ban-review with an appeal — never an automatic global ban from one realm. Realm operators get their own moderation tools (moremi_nana_moderation_admin_actions, :6811 — spectate, freeze, teleport, kick, realm-ban) without ever touching the floor: only a RealmBan carries platform_policy_signal: true. An operator runs their conduct rules; they cannot opt out of CSAM scanning, age assurance, or a cross-realm ban.

Where this connects#

• Ixchel: The Sandbox & Executable Modding — the capability sandbox and content-addressed store that contain the executable UGC Sekhmet's ingest gate stands in front of (sibling).
• Economy Firewall, Commerce & Rights — the real-money/play-currency firewall the real_money_firewall floor governs, plus the payout-fraud and Crucible-gated Verified interlock (sibling).
• ../architecture/sekhmet-safety-and-anti-cheat.md — the byte-level trust-safety companion: every eval, the ingest gate, child protection, and the anti-cheat verdict engine in depth.
• ../architecture/eunomia-governance-and-ori-bridge.md — the governance-kernel companion and the Ori cross-version identity bridge.
• The feature hub: ../V7_features.md.
• Real code cited here: apps/v7/eunomia-governance-service/src/service.ts and src/main.ts, apps/v7/sekhmet-scanner/src/lib.rs, apps/v7/moremi-realm-server/src/lib.rs, apps/v7/mawu-gateway/src/lib.rs, libs/v7/realm-protocol/src/lib.rs, libs/v7/substrate-bridge/src/lib.rs, libs/themis/arbitration, libs/themis/privacy, libs/kuanyin/community-harmony, and scripts/v7/verify-adversarial-eval-gates.mjs.