Mawu · Release notes

V7 Launch Readiness Review

real realm process or creator web view exists yet to enforce against.

1section2 minread
Markdown source
On this page

Reviewed: 2026-06-02T14:20:32.000Z Revised: 2026-06-12 (adversarial remediation — see V7/REMEDIATION_2026-06-12.md)

Decision: NOT launch-ready — revised 2026-06-12.

Correction (2026-06-12). The original 2026-06-02 review recorded "Decision: launch-ready" three days after the V7 feature spec was written and before any adversarial implementation audit of V7 had ever been run. Every "signoff" below is backed exclusively by in-repo adversarial fixture results (CI eval tests over seeded synthetic fixtures), not by production measurements, staged-rollout execution, operational drills, or real users. The anti-cheat and moderation rows record 10000 bp (100%) precision and recall — a fixture-toy signature (6 true positives, 0 FP, 0 FN on seeded cases) that says nothing about performance against the 95% gate bar on real traffic. The platform's UE client is a ~2.2k-LOC skeleton; no realm fleet, vendor safety integrations (PhotoDNA/Thorn/Lantern/StopNCII/EAC), web surfaces, or staged-rollout stages exist or were executed. The 2026-06-12 re-judgment of V7/V7_TODOS.md (most tasks re-marked [ ]/[~]) is the authoritative completion state.

The canonical machine-readable review is V7/release/launch-readiness-review.json (decision corrected to not-launch-ready). The staged rollout record at V7/release/staged-rollout.json was likewise corrected: its stages were recorded "met" on 2026-06-02 without ever being executed and are now planned.

Signoffs (annotated 2026-06-12: adversarial-fixture results, not production measurements)#

  • Trust boundary (trust-boundary): fixture-passed. The trust-boundary and identity-leak evals probe synthetic contexts built by the same library; no real realm process or creator web view exists yet to enforce against.
  • Ixchel sandbox (ixchel-sandbox): fixture-passed. Zero escapes across a hostile corpus of ~6 fixture modules — a real Wasmtime-based eval, but a small corpus, not the "defined corpus of escape attempts" at launch scale.
  • Danu scale and handoff (danu-scale-handoff): fixture-passed. The 1000-inhabitant AOI eval and 200×10,000-crossing handoff eval run against an in-memory mesh model; no real multi-node cluster has ever been exercised.
  • Sekhmet child safety and IR (sekhmet-child-safety-ir): fixture-passed. CSAM/grooming/malware detection uses local heuristic stand-ins; PhotoDNA, PDQ, CSAI Match, Thorn Safer, Lantern, and StopNCII are NOT integrated. The "five clean incident-response drills" were code-level simulations, not operational drills.
  • Creator economy (creator-economy): fixture-passed. Payout math is verified to the cent against in-service fixtures; "Aje settlement" is an in-service model — no libs/aje integration, KYC, or real cash-out occurred.
  • Anti-cheat (anticheat): fixture-passed. 10000 bp precision/recall over 6 seeded signals; EAC is not integrated and no community realm exists.
  • Moderation and minor protection (moderation-minor-protection): fixture-passed. 10000 bp moderation precision/recall over seeded cases; Kuanyin human review and DSA SLAs were modeled, not operated.
  • Safety floor (safety-floor-all-realms): fixture-passed. Eunomia service tests reject safety-floor violations at all five tiers; no live realm governance has run.

pnpm run verify:v7 launch-readiness asserted the original "launch-ready" decision and now fails against this corrected record — intentionally. It must be reworked to verify the honest state before it is re-enabled as a gate.