Subsystem Glossary, Surfaces & the Trust Boundary

The trust boundary sits between executable realm code and platform authority. Creator packages may influence their sandboxed realm, but identity, policy, catalog, and settlement stay outside that authority and are reached only through explicit capabilities.

This is the orientation page for the V7 feature set — the page to read before any of the deep feature pages, so that when a later page says "the realm composes a FMawuRealmLockFile," "a character's cash_minor never goes negative," or "the realm server runs moremi-realm-server on port 47201," the name already lands on something real you can open. V7 — codename Mawu — is Oshun's open-world creator republic: a UE5.5 LTS client plus a fleet of Rust services that let community creators author, host, and run their own persistent, server-authoritative realms, with executable user-generated content rather than just data. Its scope is split across a small number of durable surfaces: one Unreal project with three build targets, a Rust workspace of realm-plane services, a Rust workspace of shared crates, a TypeScript contracts plane, two TypeScript market/governance services, and a web Studio tile. Every feature this set documents ultimately resolves to code in one of those surfaces. The job of this page is to give you the map: the subsystem names and where they live in code, the product surfaces and their target paths, and the platform-vs-realm trust boundary that is the single most consequential decision in the design.

It is the product-side companion to the architecture thesis. Where the architecture page ../architecture/thesis-trust-boundary-and-topology.md reconciles the module graph, the determinism contract, and the topology diagram against the compiler, this page reads the same disk from the player-and-creator angle: which named subsystem delivers which advertised capability, and — kept honest throughout — where the glossary's name and the disk's reality diverge. The single source of truth for completion state remains the backlog; this page is the index, not the checklist. It is the foundations companion to the feature catalogue at ../V7_features.md.

What ships, honestly#

Real and on-disk. The realm plane is a Cargo workspace (apps/v7/Cargo.toml, unsafe_code = "forbid") of six Rust services, each with a ServiceDescriptor (name, owner, port, capabilities) and its own main.rs. The anchor is moremi-realm-server (port 47201, 14,883 lines, 69 #[test] blocks): it embeds a genuine Wasmtime 45 runtime (config.consume_fuel(true), nan_canonicalization: true, StoreLimitsBuilder) and a genuine PubGrub resolver (pubgrub = "0.3.0" + semver), so the WASM sandbox and dependency resolver the docs call "Ixchel" are not slideware — they run inside the realm server. Alongside it: danu-mesh-cluster (47202, 22 tests), nephthys-replica-service (47203, 15 tests), mawu-gateway (47204, 16 tests), sekhmet-scanner (47205, 15 tests), and hera-social-service (47206, 7 tests). Three shared crates under libs/v7/ (nana, realm-protocol, substrate-bridge) carry the cross-service vocabulary — realm-protocol alone runs 30 tests over envelopes, prediction, snapshot interpolation, delta compression, and lag compensation. The contracts plane libs/v7/contracts registers 10 Zod contracts (V7_CONTRACT_REGISTRY) and a content-addressed realm-lock composer (realm-lock.ts). The Mawu UE5.5 client (V7/ue/) is six C++ modules across three build targets that compose a realm lock file into live procedural geometry.

Genuinely reused (compiled, not mocked). substrate-bridge's default_substrate_bindings() labels exactly two of thirteen boundaries Reused: the V6 Ori event store + Aye Bridge (apps/v6/egbe-ori-service + libs/v6/aye-bridge) and the Maya engine-core (libs/maya/engine-core/crates/maya-world). These link and execute real upstream code, which is why the trust-boundary and identity-firewall evals run end to end without a live platform deployment.

Where the product glossary and the disk diverge (found by reading both):

• The glossary labels nana "TS + Rust"; the crate is Rust-only. libs/v7/nana/ contains exactly Cargo.toml, project.json, and src/lib.rs — no TypeScript. The "TS" half of Nàná is the Character Zod contract inside libs/v7/contracts, not the crate.
• Abundantia and Eunomia are labelled "TS/NestJS"; on disk they are framework-free TypeScript. apps/v7/abundantia-market-service (4,552-line service.ts) and apps/v7/eunomia-governance-service (1,574-line service.ts) declare no @nestjs/express/fastify dependency at all — their only deps are @types/node, tsx, typescript, vitest. They are real, substantial domain services started with tsx src/main.ts, just not Nest apps.
• Three advertised surfaces do not exist yet. apps/v7/mawu-web (Pixel Streaming player), apps/v7/mawu-web-fallback (three.js/WebGPU spectator), and the apps/oshun/admin/src/app/mawu Operator Console are absent — planned surfaces, not shipped paths.
• libs/maya/forge-* are scaffolds; the production runtime is inside Moremi. All four (forge-resolver, forge-conflict, forge-sandbox, forge-compositor) exist as early API crates, but the resolver and sandbox that actually gate live realms are the PubGrub + Wasmtime code inside moremi-realm-server.

Everything below is grounded in those files; where a claim is the glossary's intent rather than shipped code, it is labelled.

The subsystem glossary, mapped to code#

The product glossary in ../V7_features.md names eleven platform substrates. Here each is resolved to the directory that implements it, with the load-bearing symbols named and the honest caveats kept.

The realm plane — six Rust services#

The five rows the rest of the feature set leans on hardest — Moremi, Danu, Nephthys, the gateway (Pheme's transport), and Hera — are the authoritative backbone, and they are trust-segregated from the platform. Each carries a pub const DESCRIPTOR: ServiceDescriptor fixing its name, owner, and port, and the workspace forbids unsafe. Moremi is the anchor: a dual-tick loop (MOREMI_COMBAT_TICK_HZ = 60 for combat zones, MOREMI_OPEN_WORLD_MIN_TICK_HZ = 10 up to a 30 Hz ceiling, a fixed-timestep baseline of 30) over a deterministic core, with the Wasmtime + PubGrub runtime that makes "run untrusted code safely" literal. Danu hands authority between mesh nodes and splits/merges them under load; Nephthys is the event-sourced store that survives a sim node crashing; the gateway is the single client ingress and therefore the one place interest management and rate limiting are enforced — and the carrier for Pheme positional voice. Hera owns the persistent social graph and the cross-realm ban that the trust boundary requires. The deep treatment is ../architecture/moremi-realm-server-and-netcode.md and its mesh/persistence companion.

The market, governance, and safety plane#

abundantia-market-service and eunomia-governance-service are the market/governance plane — outside the Rust realm fleet by design, because catalog, payouts, proposals, and voting are platform concerns, not realm gameplay. Both are substantial TypeScript domain modules (Abundantia's service.ts models console-authorization status, artifact kinds, and browser sorts across pc/xbox/playstation/switch/cloud), the glossary's "TS/NestJS" label notwithstanding. Sekhmet (sekhmet-scanner, 47205) sits on the platform side of the boundary: nothing reaches a client unscanned. The deep pages are the Abundantia economy-firewall and Eunomia governance architecture companions.

Ixchel — the modding runtime that lives in two places#

Ixchel is the one subsystem whose name maps to two locations, and the split is the most important caveat on this page. The four libs/maya/forge-* crates are the advertised home, and they exist — but they are early API scaffolds (the resolver's own docs say the full V7 resolver "will use PubGrub"). The runtime that actually resolves dependencies and sandboxes creator code for a live realm is the PubGrub + Wasmtime code inside moremi-realm-server. Read the modding runtime as a product feature in ./ixchel-sandbox-and-modding.md; read its engineering in ../architecture/ixchel-modding-runtime-and-wasm-sandbox.md.

The shared vocabulary crates#

Three crates under libs/v7/ and one TS plane carry the cross-service contract, and the rest of the feature set names them constantly:

• nana — the roleplay record. NanaCharacterRecord holds realm-scoped balances (cash_minor, bank_minor, society_minor as i64 minor units) whose validate() refuses to let any go negative. This is the play-currency that is structurally non-fungible with the real-money economy.
• realm-protocol — the wire contract (30 tests). It advertises 20 baseline capabilities (baseline_realm_capabilities()) and fixes the numbers every transport must honor: a 32-snapshot ring (REALM_DELTA_SNAPSHOT_RING_SIZE = 32), a 1,400-byte pre-fragment cap (REALM_DELTA_PREFRAGMENT_BYTES), and the rule that a RealmEnvelope whose RealmMessageKind is anything but a scope-bearing ClientIntent is rejected with UnexpectedMessageKind.
• substrate-bridge — the boundary to the rest of Oshun. Its V7Substrate enum names thirteen upstream boundaries; default_substrate_bindings() marks the V6 Ori/Aye Bridge and Maya engine-core Reused and the other eleven (the V1 platform plus the V6 Egbe gateway) Mock — clean local stand-ins, not fake "fully wired." This crate also holds the V7IdentityFirewall and the trust-boundary evals (below).
• contracts — V7_CONTRACT_REGISTRY (10 Zod contracts: Realm, RealmLock, Character, ModCollection, Listing, Payout, Governance, ScanReport, and two more) with a content-addressed composeV7RealmLockFile whose hashV7ContentAddressedPayload is a sha256: digest over canonical JSON.

Cross-domain substrates (carried from V1/V3/V5/V6)#

The cross-domain names the docs use — Ori (portable identity), Maya (the engine), Aje (commerce/payouts), Lilith (safety/persona), Kuanyin (moderation), Themis (adjudication), Isis (governed generation), Sophia (grounding), Iris (memory boundaries), Psyche (live agent runtime), and Yemaya (non-real-time media) — are exactly the boundaries the V7Substrate enum pins to a concrete package_ref. The honesty already noted is that all but Ori/Aye Bridge and Maya engine-core are Mock today.

Product surfaces#

The user-facing entry points map to target paths as follows; paths are real today except where marked planned:

The canonical client (V7/ue/). Three build targets — Mawu.Target.cs (game), MawuDedicatedRealmServer.Target.cs (Type = TargetType.Server, which strips CommonUI/EnhancedInput/WebBrowser so the headless authority ships no player UI), and MawuEditor.Target.cs — over six modules: MawuCore, MawuRealm, MawuBuilder, MawuVoice, MawuUI, and the MawuTests DeveloperTool. The load-bearing claim is that the client builds worlds from data: AMawuComposedRealmActor::ApplyLockFile(const FMawuRealmLockFile&) takes the very lock file realm-lock.ts composes and reconstructs it into procedural geometry, so a realm is a content-addressed manifest, not a shipped binary level.

Mawu Studio is the one creator surface that is real and reachable today: apps/oshun/web/src/app/mawu-studio/ renders MawuStudioAccessibilityWorkspace from a runV7MawuAccessibilityEval fixture imported from @v7/contracts, so the web Studio is genuinely wired to the contracts plane, not mocked HTML.

The trust boundary — platform vs. realm#

The most consequential design decision in V7 is who runs the authoritative server, and the answer is a deliberate hybrid that splits along trust, not hosting. FiveM is community-hosted and so can never be trusted with identity, economy, or safety; Roblox is platform-hosted and so owns all compute. V7 keeps platform-hosted, inviolable services for identity, the real-money economy, client integrity, and child-safety; community-hosted realm logic only, and only as capability-sandboxed WASM behind a hardened, attested client an operator cannot patch. A realm operator is assumed potentially hostile.

These concerns are never delegated to a realm — they live on the platform plane behind the gateway: platform identity/auth (a realm sees only an opaque per-realm handle), the real-money economy and payouts (settle through Aje, never touch a realm process), client integrity and anti-tamper, child-safety/CSAM/age assurance, cross-realm bans and reputation, and asset malware scanning. What a realm does own: its world, rules, scripts, content, jobs, in-realm play-currency, and moderation above the platform safety floor — all inside the Ixchel sandbox.

What makes this product-side and not aspirational is that the boundary is executable in substrate-bridge. The V7IdentityFirewall::project() projects an authenticated principal into a V7RealmScopedIdentity whose opaque_handle is a real HMAC-SHA256 of (pepper, schema_version, tenant_id, user_id, realm_id) — the realm never sees a platform account id, which defeats both spoofing and realm-hop ban evasion. The run_trust_boundary_eval harness renders the exact JSON a realm process can reach and probes it with a hostile corpus hunting for the session token, payout credential, and the field names that would carry them; the report passes only when no term leaks. The same realm side keeps gameplay in a structurally separated currency: the cash_minor / bank_minor / society_minor balances on NanaCharacterRecord are realm-scoped i64s that a hostile operator can mint or seize inside their own world without ever touching real money or another realm's ledger. The technical enforcement — the webview escape eval, the event-tamper state_hash proof, the determinism contract — is detailed in the architecture companion ../architecture/thesis-trust-boundary-and-topology.md.

Cross-reference conventions#

The whole feature set uses a single citation grammar so a reference is never ambiguous about which document it points into:

• Bare §N / §N.M → V7_TODOS.md — the backlog is the only V7 document with section ids used as hyperlinks.
• deps§N → V7_DEPENDENCIES.md; arch§"<anchor>" → V7_ARCHITECTURE.md by named anchor; features§"<anchor>" → this document set by named anchor.
• maya§"<anchor>" → DOMAINS/maya/features.md; v5§N/v6§N → the respective prior backlogs.

V7_features.md and the architecture pages use named anchors, not numbers, precisely so they never drift from the backlog's numbering scheme.

Where to go next#

• The promise these foundations serve, and the product posture in depth: ./overview-promise-and-posture.md.
• The modding runtime as a creator feature — composable layers, the six-tier WASM sandbox, PubGrub locks, and Collections: ./ixchel-sandbox-and-modding.md.
• The thesis, the executable trust boundary, the topology, and the determinism contract: ../architecture/thesis-trust-boundary-and-topology.md.
• The feature catalogue this page indexes: ../V7_features.md.