Overview, Product Promise & Design Posture

Mawu is a republic because creation, operation, governance, and sustainability are one product loop. Executable UGC makes the capability sandbox the precondition for all four branches, while server authority and auditable policy keep one realm from becoming platform authority.

This is the orientation page for the V7 feature set — the page to read before any of the deeper feature pages, so that when a later page says "the realm composes its lock file before a client joins" or "a forged envelope is rejected with UnexpectedMessageKind," the name already lands on something real you can open. V7 is Mawu — an open-world creator republic built on Unreal Engine 5.5 and a fleet of Rust services, layered on top of the existing Oshun platform (the V1 trust spine, the V6 Ori identity, the Maya engine-core). It is one coherent product, and crucially not a single authored game: where V2–V6 are experiences Oshun builds, V7 is the substrate that lets players build, host, govern, roleplay in, and monetize their own persistent worlds — and the distribution-and-economy republic that carries them. The unit of play is not a level; it is a realm: a server-authoritative, persistent, fully-moddable world that one community owns and others inhabit.

The single change that defines V7 — and creates its entire engineering problem — is executable user-generated content. V5's workshop is data-only; it "cannot ship executable code." V7 lifts that limit and runs creator-authored logic on other players' machines and servers. That one decision makes safety, sandboxing, identity isolation, and supply-chain integrity the load-bearing wall, not an afterthought. Every feature in this set is downstream of getting that right.

This page is the product-side companion to the architecture thesis. Where the architecture page ../architecture/thesis-trust-boundary-and-topology.md reconciles the two-plane topology against the compiler — the Cargo workspace, the Wasmtime runtime, the determinism invariant, where each name lives on disk — this page reads the same disk from the player-and-creator angle: what V7 promises someone who builds a world or walks into one, the four commitments that fix the design, and where the product glossary's ambition outruns what is shipped today. The single source of truth for completion state remains the backlog (V7_TODOS.md); this page is the index, not the checklist. It is the orientation companion to the feature catalogue at ../V7_features.md.

What ships, honestly#

Real and on-disk: the Rust realm plane. The authoritative half of V7 is a genuine Cargo workspace under apps/v7/ (unsafe_code = "forbid", Rust 1.82, resolver = "2") of six services plus a dev-hygiene helper, each with a typed ServiceDescriptor (name, owner, port, capabilities) and its own main.rs:

The anchor, moremi-realm-server, is not slideware: it embeds a real Wasmtime component runtime (config.consume_fuel(true), epoch_interruption(true), store.set_fuel(...), StoreLimitsBuilder, nan_canonicalization, AOT precompile_component to a .cwasm) and a real PubGrub dependency resolver (pubgrub = "0.3.0" + semver = "1.0.28"), so the WASM sandbox and the SAT resolver the feature docs call "Ixchel" actually run inside the realm server. It ticks on a fixed timestep — MOREMI_COMBAT_TICK_HZ = 60 for combat zones, MOREMI_OPEN_WORLD_MIN_TICK_HZ = 10 to ..._MAX_TICK_HZ = 30 for the open world — and guards determinism with MoremiGoldenReplayCiReport.

Three shared Rust crates under libs/v7/ carry the cross-service vocabulary. realm-protocol (~4,400 lines, 30 tests) fixes the wire contract literally: REALM_DELTA_SNAPSHOT_RING_SIZE = 32, a REALM_DELTA_PREFRAGMENT_BYTES = 1_400 cap under the 1500 MTU, baseline_realm_capabilities() advertising 20 capabilities, and the server-authoritative invariant in code — a RealmEnvelope whose RealmMessageKind is anything other than a client intent is rejected with UnexpectedMessageKind, and even an intent needs a RealmSecurityToken bearing the realm.intent.submit scope (REALM_CLIENT_INTENT_REQUIRED_SCOPE) before it touches authoritative state; a bandwidth profile that scales with population is a hard PopulationDependentBandwidth violation. nana models a persistent character — NanaCharacterRecord { ori_id, realm_id, display_name, employment, balances } with realm-scoped cash_minor / bank_minor / society_minor (i64 minor units) whose validate() refuses to let any balance go negative. substrate-bridge (~2,500 lines) carries the trust boundary as executable code: the V7IdentityFirewall projects a platform principal into a V7RealmScopedIdentity whose opaque_handle never reveals a platform account id, and run_trust_boundary_eval probes the JSON a realm can reach for leaked session tokens and payout credentials.

The contract plane (libs/v7/contracts, TypeScript) registers exactly 10 Zod contracts in V7_CONTRACT_REGISTRY — Realm, RealmLock, Character, ModCollection, Listing, Payout, Governance, ScanReport, AgeBand, Incident — each with a schema, fixture, route segment, and TypeScript / Rust / C++ / OpenAPI codegen under generated/. The content-addressed realm-lock composer (realm-lock.ts) is real: composeV7RealmLockFile builds a lock file and hashV7ContentAddressedPayload SHA-256-hashes its canonical JSON into a sha256: digest, so a realm is a reproducible manifest, not a shipped binary.

The Mawu UE5.5 client (V7/ue/) is six real C++ modules — MawuCore, MawuRealm, MawuBuilder, MawuVoice, MawuUI, plus the MawuTests DeveloperTool — across three build targets. AMawuComposedRealmActor::ApplyLockFile takes the very lock file the composer produces and reconstructs it into live UDynamicMeshComponent / UStaticMeshComponent geometry through UE's GeometryScripting plugin; twelve automation specs (MawuRealmGeometryTests.cpp, MawuRealmBootstrapTests.cpp) assert the resulting geometry and exact flagship placement. The dedicated server is a separate target (MawuDedicatedRealmServer.Target.cs, Type = TargetType.Server) that strips CommonUI / EnhancedInput / WebBrowser; both player and server targets use project-module FPSemanticsMode.Precise, with /fp:strict /fp:except- on Win64. Replay hashes, rather than compiler flags alone, govern determinism.

Where the product glossary outruns the disk (found by reading both):

• The cross-platform substrate bindings are mostly mocked. default_substrate_bindings() in substrate-bridge names thirteen boundaries and labels only two Reused (compiled and exercised): the V6 Ori event store + Aye Bridge and the Maya engine-core. The other eleven — V1 identity, Aje economy, Lilith/Kuanyin safety, Themis, Iris, Psyche, Isis, Sophia, Yemaya, and the V6 Egbe realtime gateway — are Mock: clean, deterministic local stand-ins, not yet wired to live services. This is by design (it is what lets the trust-boundary and Ori-write evals run without a live deployment), but it means the V1-trust and economy claims below rest on mocked seams today.
• The market and governance plane is a separate stack. Abundantia and Eunomia ship as TS/NestJS services (apps/v7/abundantia-market-service, apps/v7/eunomia-governance-service, each with a package.json) — they exist, but they are outside the Rust realm fleet and are not yet fused into it.
• libs/maya/forge-* are early scaffolds. The standalone resolver / conflict / sandbox / compositor crates are API stubs; the production sandbox and resolver currently live inside moremi-realm-server, not in those crates.
• Headline numbers are product targets, not measured-at-scale results. "1000+ inhabitants," the 40% engagement-pool payout, the 70% creator revenue floor, and the Pheme voice budgets (≤40 audible streams, p95 ≤250 ms) are committed launch budgets and requirements, not figures benchmarked on shipped fleets.

Everything below is grounded in those files; where a claim is the glossary's intent rather than shipped code, it is labelled.

What V7 is#

V7 productizes a convergence no single existing platform delivers in one stack: FiveM/Cfx.re's server-authoritative, community-hosted roleplay, Roblox's safe-sandboxed UGC economy, mod.io's cross-platform distribution, and Fortnite/UEFN's engagement-payout creator economy. The product layers as a small set of feminine-named subsystems, each owning one responsibility: Mawu (the product and the UE5.5 client that renders any realm), Moremi (the server-authoritative realm framework, moremi-realm-server), Danu (server meshing for massive population, danu-mesh-cluster), Nephthys (the decoupled event-sourced persistence layer, nephthys-replica-service), Nàná (the persistent-character / jobs / economy framework, libs/v7/nana), Ixchel (the composable modding runtime and WASM sandbox, embedded in Moremi), Sekhmet (executable-UGC trust and safety, sekhmet-scanner), Hera (the cross-realm social graph), Abundantia (the creator republic), and Eunomia (multi-tier governance). The full glossary, surface map, and the platform-vs-realm trust boundary are treated in ./glossary-surfaces-and-trust-boundary.md.

A realm is the thing all of this serves. It bundles a base world, an ordered set of composable Ixchel mod layers, a Nàná configuration (which jobs and institutions are active), a membership policy (open / whitelisted / invite / federated), a governance charter, and a hosting binding — and pins them in an immutable, content-addressed lock file so every joining client composes a byte-identical world. Realms run on a continuum — Solo (1 player, offline), Listen (~16), Dedicated (~256, one authoritative node), and Meshed (1000+, a Danu cluster) — and a realm can be promoted along it without rebuild. The realm model and the meshing/persistence path are detailed in ./realm-model-and-danu-population.md.

The design posture#

Four commitments fix the design and resolve the tensions inherent in a "community-run, fully-moddable, server-authoritative world platform." Each is visible in code, not just prose.

1. Server-authoritative by default; the realm owns the truth. Clients send intent; the realm validates against its rules and Nephthys, then replicates results. This is the precondition for both anti-cheat and persistence. The realm-protocol crate encodes it literally: non-intent envelopes that try to mutate state are rejected, and intents carry a scoped RealmSecurityToken. A tampered client cannot grant itself money or position because the server, not the client, owns those values.

2. Untrusted code is the threat model, not an afterthought. Every line of creator logic runs in the Wasmtime sandbox inside moremi-realm-server, under per-tick fuel/memory/StoreLimits budgets and capability-gated engine access, across the six declared tiers (DataOnly → Scripted → Extended → System → Native → Trusted); a realm declares the maximum tier it grants and the compositor refuses to load a resource that demands more. Every uploaded artifact passes the Sekhmet scan gate — static malware signatures, CSAM perceptual-hash ingest, a grooming-classifier path, and realm-pinpoint quarantine — before any other machine can fetch it. The 2023 fractureiser supply-chain attack is the named failure this pipeline is designed never to repeat.

3. Composable layers, never load order. Mods are composable layers resolved by intent, not file precedence: the PubGrub resolver SAT-solves the dependency graph into a reproducible lock file (and emits a human-readable explanation when it cannot, rather than a silent crash), and the compositor applies layers in a fixed priority order with per-field provenance. "Load order" — the fragile file-override war every competitor fights — never enters the player's vocabulary.

4. Creators are paid, communities self-govern. A platform that asks players to build and write code must let them earn from it and rule it. V7 ships the creator economy (engagement pool + direct sale + dependency-revenue chains, settled through Aje) and five-tier governance (platform → game → realm → server → guild) with Themis adjudicating disputes. Honest status: Abundantia and Eunomia exist as TS/NestJS services, but the Aje settlement binding is a mock today — this commitment is the most spec-forward of the four.

Binding all four is a fifth, cross-cutting invariant the architecture treats as load-bearing: determinism. Rollback prediction, atomic mesh handoff, and replayable creator plugins all demand a deterministic simulation core, so it is locked down once — fixed timestep, seeded RNG, Wasmtime fuel + NaN canonicalization, strict client floating point, and a golden-replay CI gate that passes only when a recorded input log reproduces the exact authoritative state_hash and a perturbed probe fails to.

The product promise#

V7's promise is a world you don't just play — one you build, host, rule, and live a second life inside, safely. The catalogue states it as a set of commitments; each rests on code, or is labelled where it is still intent:

• Build the world, don't just play it. Any player authors a realm's terrain, rules, jobs, and laws in Mawu Studio and publishes it. The realm is captured as a content-addressed lock file (composeV7RealmLockFile) and rebuilt into live geometry client-side (ApplyLockFile) — both real and tested.
• Host your own server, on your own terms. The hosting continuum from Solo to Meshed is the Moremi/Danu path; Danu's handoff and area-of-interest evals move 200 entities 10,000 times without loss or reconnect and bound 1000-inhabitant working sets — real evals, with "1000+ at a stable frame budget" the launch target.
• Live a second life — a real roleplay. A character is a NanaCharacterRecord backed by a V6 Ori identity, with jobs, realm-scoped balances, and (the feature-doc layer) housing, vehicles, and civic institutions — law/EMS/business as reference resources on the Nàná core.
• Mod everything, without load order. The composable-layer model, PubGrub resolution, and the reproducible lock file are real in moremi-realm-server and realm-lock.ts.
• Run untrusted code safely. The six-tier Wasmtime sandbox and the Sekhmet scan gate are real and on-disk; the engineering goal is that the next fractureiser cannot happen here.
• Get paid for what you make / communities govern themselves / one identity, every world. Abundantia's three earning paths, Eunomia's five governance tiers, and cross-realm/cross-version character portability via the Ori passport. Status: the services exist; the Aje and V1-identity bindings are mocked, so these are the most spec-forward promises.
• V1 trust at platform scale. Identity boundaries (Iris), grounded generation (Isis + Sophia), persona and crisis-aware safety (Lilith), guardianship (Kuanyin), and adjudication (Themis) govern every realm — today via the mock bindings in substrate-bridge, behind a V7IdentityFirewall that is itself real and exercised by the trust-boundary eval. A realm sets rules above the platform safety floor, never below it.
• Degrades safely. If meshing is unavailable a realm falls back to a single authoritative node at a reduced cap; a faulting script is isolated and disabled without crashing the session; an installed realm stays playable offline in Solo.

Where to read next#

• The subsystem glossary, the product surfaces, and the platform-vs-realm trust boundary in depth: ./glossary-surfaces-and-trust-boundary.md.
• The realm model, the hosting continuum, and Danu meshing / Nephthys persistence as player features: ./realm-model-and-danu-population.md.
• The architecture thesis, the two-plane topology, and the determinism invariant — the technical companion to this page: ../architecture/thesis-trust-boundary-and-topology.md.
• The feature catalogue this page indexes: ../V7_features.md.