V3 Legal Docs Publication Gate — Lilith Metaverse

Manifest version: v3-legal-docs-publication.v1

Verifier: pnpm verify:v3 legal-docs-publication (proposed)

Evidence artifact: V3/legal/legal-docs-publication-evidence.json (proposed)

Owner: Legal owner, joint with Lilith-Privacy lead; release-captain sign-off required at the GA release-readiness decision

V3 must not GA in a region where its user-facing legal documents are not published in that region's launch locale. This gate enumerates the required documents per wave-1 region, defines the evidence shape, and fails closed. The wave-1 region list is the signed-off set in V3/REGION_ROLLOUT_COMPLIANCE.md and V3/docs/regions/: us-ca, de, gb, in, br.

Required Documents#

Five core documents, each published at a stable URL under https://oshun.example/legal/<locale>/<doc>, linked from the V3 landing footer, the signup flow (acceptance checkboxes for ToS/EULA/privacy), and the store listings where the platform requires it:

Doc id	Document	Acceptance point
`tos`	Terms of Service	Signup, blocking checkbox
`eula`	End-User License Agreement (native clients)	First launch of any native client
`privacy-policy`	Privacy Policy	Signup, blocking checkbox; store listing URL field
`refund-policy`	Refund Policy	Linked at every purchase confirmation
`community-guidelines`	Community Guidelines	Signup; linked from every report/moderation surface

Locale × Region Matrix#

Launch locales follow the localization sign-offs in the region dossiers. Every cell below is required; a missing cell fails the gate for that region (the region drops to the regional waitlist, not silently to English).

Doc	`us-ca` (en-US)	`de` (de-DE)	`gb` (en-GB)	`in` (en-IN)	`br` (pt-BR)
`tos`	required	required	required	required	required
`eula`	required	required	required	required	required
`privacy-policy`	required	required	required	required	required
`refund-policy`	required	required	required	required	required
`community-guidelines`	required	required	required	required	required

Notes on locale choice: the in dossier signs off English launch strings with Hindi support macros, so en-IN is the binding legal locale for India at GA; the br dossier signs off Brazilian Portuguese, so pt-BR is binding for Brazil — an English-only document set fails the br column.

Region-Specific Supplements#

Beyond the five core documents, these region-mandated supplements are part of the same gate:

Region	Supplement	Requirement source
`de`	Impressum (provider identification) reachable within two clicks of every page; Widerrufsbelehrung (14-day withdrawal instruction) in the purchase flow	§5 TMG/DDG; EU consumer-rights directive
`us-ca`	Notice at Collection + "Do Not Sell or Share My Personal Information" link in the footer	CCPA/CPRA
`in`	Grievance Officer name and contact published, complaint acknowledgment within 24 h and resolution within 15 days stated	IT (Intermediary Guidelines) Rules 2021
`br`	LGPD controller identification and DPO (encarregado) contact in the pt-BR privacy policy	LGPD Art. 41
`gb`	UK GDPR controller/representative identification in the en-GB privacy policy; consumer cancellation rights in the refund policy	UK GDPR; Consumer Contracts Regulations 2013

Refund-policy content must agree with the payment-provider sign-offs in each region dossier (Stripe Connect refund evidence, VAT for gb, tax evidence for us-ca/in/br) — a refund policy that contradicts the dossier's refund-evidence model fails the gate.

Evidence Shape#

V3/legal/legal-docs-publication-evidence.json carries one record per (doc, locale) cell plus one per supplement:

json

{
  "docId": "privacy-policy",
  "locale": "de-DE",
  "region": "de",
  "url": "https://oshun.example/legal/de-DE/privacy-policy",
  "version": "1.0.0-ga",
  "sourcePath": "V3/legal/source/de-DE/privacy-policy.md",
  "sourceSha256": "<sha256 of the canonical source file>",
  "publishedSha256": "<sha256 of the rendered page main-content block>",
  "retrievedAt": "2026-06-12T00:00:00Z",
  "counselSignoff": { "by": "legal-owner", "at": "2026-06-10T00:00:00Z" },
  "acceptanceWiring": "signup-checkbox"
}

sourceSha256 pins the counsel-approved text; publishedSha256 is taken from a live fetch of the URL's main-content block, so the gate detects a published page that drifted from the approved source.
Store-listing cross-check: the privacy-policy URL submitted in V3/public-web/app-store-listings.json for each platform must byte-match the corresponding evidence-record URL.
Version changes after counsel sign-off require a new record; the verifier rejects evidence whose sourceSha256 does not match the file at sourcePath at verification time.

Fail-Closed Criteria#

The gate fails closed — and the affected region is excluded from GA wave-1 routing (sent to the regional waitlist via the existing tier: regional-waitlist machinery) — when any of the following holds:

any (doc, locale) cell in the matrix has no evidence record;
any region-specific supplement has no evidence record;
a live fetch of any url returns non-200, or its main-content hash does not equal publishedSha256;
sourceSha256 does not match the canonical source file (drift between approved text and repo);
any record lacks counsel sign-off, or sign-off predates the latest source change;
the signup flow does not block on ToS/EULA/privacy acceptance for the user's region locale (verified by the signup Playwright spec asserting the locale-correct document URL is the one linked);
a store listing's privacy-policy URL disagrees with the evidence record;
the refund policy for a region contradicts that region's dossier payment-provider sign-off.

Partial-region failure degrades only that region; it does not block GA for regions whose columns are complete. Full-matrix verification runs in CI daily during launch week, because published pages can break after the one-time check.