V6 — Architecture (Egbe: The Agentic Companion Universe, Unreal Engine 5)

Status: V6 launch architecture
Source: technical design for V6, grounded in the V6 feature map
Audience: engineering, AI/agents, platform, infrastructure, and live-service leads
Date: 2026-05-21

This architecture reference has been decomposed into focused pages under architecture/. This file remains the canonical hub (every section heading is preserved, so existing arch§"…" anchors keep resolving); the in-depth, code-grounded companion pages live under architecture/. Start at the architecture page index. The product feature map is in V6_features.md / features/.

Purpose#

This document describes the runtime, package, and integration architecture that V6 — Egbe — must ship behind. It is grounded in the V6 feature map (V6_features.md) and is anchored to the Unreal Engine 5 project at V6/ue/ plus the supporting Rust services, TypeScript libraries, and V1-monorepo extensions V6 requires. Its companion docs are V6/V6_features.md (product surface scope), V6/V6_TODOS.md (implementation source of truth), and V6/V6_DEPENDENCIES.md (external dependency registry).

V6 rests on two substrates, and the architecture's whole shape follows from keeping them separate:

• The metaverse substrate — the embodied, multi-user 3D world: UE5 client, world server, presence, avatars, spatial audio, Pixel Streaming, the Tier-2 fallback. V6 reuses the V3 Lilith metaverse substrate — its world server, Pixel Streaming infrastructure, and avatar pipeline — rather than rebuilding it. This is a solved problem; V6 extends it, it does not fork it. (The Cross-Reference Convention below defines the v3arch§ prefix this document uses to cite the V3 architecture.)
• The agent-simulation substrate — the part that is new and is the engineering bet of V6: a world of LLM-driven autonomous agents, each with a portable event-sourced biography (the Ori), thinking under a tiered cognition kernel (Moirai) that makes a population of minds affordable, communicating through a voice-and-intent layer (Vac), narrated by a story engine (Clio), created by a governed foundry (Ninhursag), and portable across the whole Oshun game universe through the Aye Bridge.

V6 layers on the Oshun V1 monorepo without forking it: the V1 BFF, contracts, identity, audit-platform, residency, isis-generation-control, sophia-evidence, lilith-persona-policy, the Iris memory stack, the Psyche runtime, and aje commerce are reused as-is or extended in-place. The agent mind is built entirely from V1 substrates (Iris / Psyche / Isis / Sophia); V6 adds the life around the mind — the body, the world, the daily rhythm, the fate, and the kernel that schedules it all within budget. New V6-specific code lives under V6/ue/ (the Unreal project), apps/v6/* (services), and libs/v6/* (shared libraries).

Cross-Reference Convention#

Throughout the V6 docs, bare §N and §N.M references resolve to V6_TODOS.md (the only V6 doc with section numbering used as hyperlinks). Explicit doc prefixes are used where ambiguity matters:

• §40 → V6_TODOS.md §40.
• deps§14 → V6_DEPENDENCIES.md §14.
• features§"<anchor>" → V6_features.md by section anchor.
• arch§"<anchor>" → this document, by section anchor.
• v1arch§"<anchor>" → V1/ARCHITECTURE.md; v1todos§N → V1/TODOS.md §N.
• v3arch§"<anchor>" → V3/V3_ARCHITECTURE.md (the metaverse substrate V6 reuses); v3features§"<anchor>" → V3/V3_features.md.

This document and V6_features.md use named anchors; V6_TODOS.md and V6_DEPENDENCIES.md carry numbered section ids.

Table of Contents#

• V6 Product Promise
• Subsystem Glossary
  • Platform Substrates
  • UE5 Engine Modules
  • Game Feature Plugins (Glossary)
  • Service Apps
  • Cross-Domain Extensions (V1 / V3 → V6)
  • Surfaces
• High-Level Architecture
• The Two Substrates
• The Mind / Body / Memory Split
• Project Layout
• UE5 Module Split
• Game Feature Plugins
• The Ori Service
  • Event Log
  • Why Append-Only
  • Projections
  • Memory Storage
  • The Passport
  • Conflict Resolution
  • Storage and Residency
• The Moirai Simulation Kernel
  • Tier Assignment
  • The Kernel Loop
  • Where the Work Runs
  • Escalation and De-escalation
  • Loop and Drift Guards
• The Cognition Stack
• Agent Planning and Behavior
• Egbe World Server
• The Shard Continuum
• Egbe Realtime Gateway
• Agent Embodiment in UE5
• The Vac Communication Pipeline
  • Voice to Intent
  • Conversation
  • Squad Comms
  • Negotiation
  • Non-Voice Parity
• The Clio Story Engine
• The Ninhursag Foundry Pipeline
• Ereshkigal — Endings and Legacy
  • The Lineage Graph and Storage
  • The Elder-State Transition Lifecycle
  • The Yemaya Memorial Render Pipeline
• The Aye Bridge
• Pixel Streaming Infrastructure
• Tier-1 UE5 Client Architecture
• Tier-2 Fallback Web Client
• Avatar and Animation Pipeline
• AI Cost and Fidelity Tiering
• Determinism, Replay, and Audit
• Data Architecture and Tenancy
• V1 and V3 Integration
• Identity and Account Bridge
• Safety, Persona Policy, and Agent Welfare
• Provenance, Rights, and Commerce
• Observability, Eval, and Release Gates
• Performance Budgets
• Build, Cook, Patch
• Security, Privacy, Compliance
• Testing, QA, Accessibility
• Launch Readiness
• Related Documents

V6 Product Promise#

V6 ships as one coherent agentic companion universe: a persistent open world (Orun) of autonomous AI beings, a stewardship loop in which a player discovers, raises, bonds with, and guides a company of them, and a meta-hub that carries those beings into V2–V5 and home again. UE5 is the canonical engine; the Tier-2 three.js fallback ensures no one is locked out. The full promise is in features§"V6 Product Promise"; this document describes the runtime that must deliver it.

Subsystem Glossary#

Names below are fixed vocabulary for V6; module names, namespaces, asset paths, and service apps inherit from them. V6 follows the Oshun naming convention of drawing on deities and cosmological concepts from world mythology — here, Yoruba cosmology (Egbe, Orun, Ori, Aye) for the product layers, and goddesses and underworld figures (Moirai, Vac, Clio, Ninhursag, Ereshkigal) for the subsystems.

Platform Substrates#

The V6 agent-simulation substrate — new in V6.

UE5 Engine Modules#

These live under V6/ue/Source/.

Game Feature Plugins (Glossary)#

Modular and hot-swappable; these live under V6/ue/Plugins/. The runtime behavior of these plugins is detailed in arch§"Game Feature Plugins".

Service Apps#

These live under apps/v6/.

Cross-Domain Extensions (V1 / V3 → V6)#

Surfaces#

High-Level Architecture#

The Two Substrates#

V6's architecture is governed by a clean split between what is reused and what is new.

Reused — the metaverse substrate (from V3). V6 does not rebuild embodied multi-user 3D. The UE5 client architecture, the authoritative world-server design, the Realtime Gateway, the Pixel Streaming fleet, the Tier-2 fallback, the avatar pipeline (MetaHuman + VRM), spatial audio, presence replication, and the multiplayer wire protocol are all carried from V3 (v3arch§"Lilith World Server" and following). V6 renames them (Egbe-World, Egbe-Gateway, Egbe-PxStream, Egbe-WebFB) and extends them for agent density, but the design is V3's and the lessons are already paid for.

New — the agent-simulation substrate. Everything that makes V6 V6 is new: the Ori event-sourced biography service, the Moirai tiered cognition kernel, the Vac communication pipeline, the Clio story engine, the Ninhursag foundry, and the Aye Bridge. This substrate is where the engineering risk lives — chiefly in making a world of LLM-driven minds affordable (arch§"AI Cost and Fidelity Tiering") and consistent (arch§"Determinism, Replay, and Audit") — and it is where this document spends most of its depth.

The agent mind itself is not new either: it is assembled from V1's Iris (memory), Psyche (runtime), Isis (governed generation), and Sophia (grounding). V6 adds no new model and no new "brain" — it adds the kernel that schedules those substrates across a population, and the life that surrounds the mind.

The Mind / Body / Memory Split#

The single most important structural decision in V6: an agent is split across three authorities, and no one of them owns the others.

• The Body — Egbe-World. The world server is authoritative for the world: agent transforms, physics, navmesh, which props exist, who is co-present, world time. It runs the world tick at 20 Hz. It is engine-agnostic on the wire (Protobuf to UE clients and to the Tier-2 fallback). An agent's intent is never authoritative here — only what physically happened is.
• The Mind — Moirai. The Moirai cluster is authoritative for agent decisions: given an agent's perception and state, it produces a stream of intents and actions ("walk to the workshop," "say X to Y," "accept the objective," "refuse it"). It owns no world state.
• The Memory — Ori. The Ori service is authoritative for who the agent is: identity, the event-sourced biography, memory, relationships, values, capabilities. It is independent of any world shard or Aye realm — it is the same record whether the agent stands in a Solo homestead, the Commons, or a V2 arena.

The per-tick loop that ties them together:

1. Perception out. The world server computes each agent's perception — what it can see and hear, nearby agents, its own need and emotion state — and sends it to Moirai.
2. Cognition. Moirai runs the agent's cognition at its assigned tier (arch§"The Moirai Simulation Kernel"), reading durable context from the Ori, calling the cognition stack as the tier allows.
3. Actions in. Moirai returns intended actions. The world server validates them against authoritative state — an agent cannot walk through a wall or teleport because it "intended" to — and applies the valid ones.
4. Replicate and persist. Results replicate to clients; durable life-events (a memory formed, a relationship changed, a goal accepted, an arc advanced) flush to the Ori service as biography events.

This split is also the resilience story: the cheap deterministic execution layers of Moirai run co-located with the world server, so if the Moirai cognition cluster is degraded or unreachable, agents fall back to behavior-tree execution and the world keeps running believably (arch§"Agent Planning and Behavior"). A cognition outage costs richness, never the world.

Project Layout#

oshun/
├── apps/
│   ├── oshun/                                  # V1 (reused, extended)
│   │   ├── web/                                # adds /v6/* routes + /egbe-studio
│   │   ├── mobile/                             # adds /v6 stack (Steward App + native deep-link)
│   │   └── admin/                              # adds /egbe operator console
│   └── v6/                                     # NEW
│       ├── egbe-web/                           # browser shell + Pixel Streaming player
│       ├── egbe-web-fallback/                  # three.js + WebGPU Tier-2 client
│       ├── egbe-world-server/                  # Rust authoritative world state (the Body)
│       ├── egbe-moirai-cluster/                # Rust cognition kernel + dispatch fleet (the Mind)
│       ├── egbe-realtime-gateway/              # Rust QUIC/WebTransport + WebRTC + voice SFU
│       ├── egbe-pxstream-relay/                # Rust Pixel Streaming relay + signaller
│       ├── egbe-ori-service/                   # Rust event-sourced biography store (the Memory)
│       ├── egbe-clio-service/                  # Rust story engine — Chronicle + Book of the Ori
│       └── egbe-foundry-service/               # Rust agent-generation orchestrator (Ninhursag)
├── libs/
│   ├── v6/                                     # NEW
│   │   ├── ori-model/                          # Ori schema, event types (shared Rust + TS)
│   │   ├── moirai-kernel/                      # tier-assignment + scheduler core (Rust crate)
│   │   ├── cognition-stack/                    # integration to Psyche / Isis / Sophia / Iris
│   │   ├── agent-behavior/                     # behavior trees + HTN task networks (Rust)
│   │   ├── vac-intent/                         # the intent-grammar parser + schema
│   │   ├── clio-story/                         # significance ranking + narrative generation
│   │   ├── ereshkigal-legacy/                  # lineage graph + elder transitions + memorials
│   │   ├── aye-bridge/                         # passport minting + per-destination adapters
│   │   ├── egbe-protocol/                      # world wire protocol (Rust + TS + UE-C++ bindings)
│   │   ├── egbe-web-pxstream/                  # Pixel Streaming player wrapper (TS)
│   │   ├── egbe-engine-web-fallback/           # three.js + WebGPU + Rapier WASM wrapper
│   │   ├── memory-iris-agent/                  # agent memory scopes (extends V1 Iris)
│   │   ├── psyche-agent/                       # agent dialogue / voice / expression runtime
│   │   ├── isis-agent-gen/                     # foundry generation workflow
│   │   ├── isis-behavior-policy/               # per-tick agent-output policy gate
│   │   ├── sophia-agent-grounding/             # backstory / knowledge grounding adapter
│   │   ├── lilith-agent-welfare/               # steward-not-owner + welfare + crisis enforcement
│   │   └── egbe-studio/                        # creator-tools glue (TS)
│   ├── v3/                                     # V3 metaverse substrate (reused)
│   ├── contracts/                              # V1 (extended)
│   │   └── src/v6/                             # NEW: V6-specific contracts
│   ├── oshun/                                  # V1 (reused)
│   └── shared/                                 # V1 (reused)
└── V6/
    ├── V6_features.md
    ├── V6_ARCHITECTURE.md
    ├── V6_DEPENDENCIES.md
    ├── V6_TODOS.md
    └── ue/                                     # UE5.5 LTS project (canonical V6 client)
        ├── V6.uproject
        ├── Config/
        │   ├── DefaultEngine.ini
        │   ├── DefaultGame.ini
        │   ├── DefaultInput.ini
        │   └── PixelStreaming.ini
        ├── Content/
        │   ├── Agents/                         # agent body archetypes, costume, aging marks
        │   ├── Districts/                      # the six districts of Orun
        │   ├── Animations/                     # gait / posture / gesture / expression catalogs
        │   ├── Audio/                          # MetaSounds graphs, ambient soundscapes
        │   ├── VFX/                            # Niagara district + Threshold + Crossroads FX
        │   ├── UI/                             # UMG roster, Chronicle reader, dossier, intent UI
        │   ├── Sequences/                      # Sequencer Chronicle replays, ceremonies
        │   └── Localization/                   # all locales
        ├── Source/
        │   ├── V6Core/  V6Gameplay/  V6World/  V6Agent/  V6Avatar/
        │   ├── V6Animation/  V6Input/  V6Net/  V6Voice/  V6UI/
        │   ├── V6Audio/  V6VFX/  V6Cinematics/  V6Persistence/
        │   ├── V6OnlineServices/  V6Telemetry/  V6Editor/  V6Tests/
        ├── Plugins/                            # Game Feature plugins (districts + modes)
        │   ├── V6District_GroveOfBeginnings/  V6District_Ateliers/
        │   ├── V6District_CommonsHeart/  V6District_Wilds/
        │   ├── V6District_AncestorGrove/  V6District_Thresholds/
        │   ├── V6Mode_SoloHomestead/  V6Mode_CoopVisit/
        │   └── V6Mode_Commons/  V6Mode_Incarnation/
        └── Build/                              # per-platform build outputs

UE5 Module Split#

Each module owns one concern and is built with *.Build.cs. C++ is the primary gameplay language; Blueprint is for designers, data assets, state graphs, and cinematic glue only. Authoritative state lives server-side in Rust, and the UE modules are a high-fidelity client of that state. V6 owns no frame-deterministic combat — incarnation combat belongs to the destination Aye realm — but all client-side prediction must be reconciled against the world server.

Game Feature Plugins#

Districts and shard modes ship as Game Feature Plugins so each can be hot-loaded / unloaded at runtime and included or excluded per platform / region without engine rebuilds. Each has its own *.uplugin with EnabledByDefault: false and a GameFeatureData asset that registers gameplay tags, ground templates, and district-specific Niagara / MetaSound assets.

District scene descriptors — disclosure (2026-06-12). Each district plugin currently carries a JSON scene descriptor (DistrictScene_<Name>.v6district.json under the plugin's Content/ tree) that declares the district's grounds, spawn bindings, scenario hooks, and provenance. These descriptors are design artifacts, not cooked UE content: they are machine-checked contracts that the runtime and the verifier scripts consume, but they contain no level geometry, no .umap/.uasset scene data, and V6/ue/Content/ is empty apart from .gitkeep placeholders (the only binary assets are per-plugin GameFeatureData.uasset registrations). A district counts as authored in-engine only when its World Partition map, meshes, lighting, navmesh, and ambient content exist and cook — that work is tracked in todos§28 and is not satisfied by a descriptor.

The Ori Service#

The Ori service (apps/v6/egbe-ori-service/, Rust) is the authoritative store of who every agent is. It is an event-sourced service: an Ori is not a mutable row, it is an append-only, ordered log of life-events.

Event Log#

Each Ori is a stream keyed by ori_id. An event has a type, a payload, a UTC timestamp, a vector clock (one entry per shard / context that can write — Solo, Commons region, a Co-op session, an Aye realm), an attribution (which steward, agent, or system caused it), and a provenance reference. Event types include Born, Discovered, MemoryFormed, Reflected, RelationshipChanged, ValueShifted, ObjectiveAccepted, ObjectiveRefused, SkillLearned, ArcAdvanced, Crossroads, Incarnated, IncarnationReturned, BondChanged, Departed, Transcended, Died. The log is the single source of truth; nothing else may contradict it.

Why Append-Only#

It is a design guarantee, not an implementation convenience. Erasure is not an operation the log supports, so a steward — or a bug, or an exploit — cannot silently rewrite a life or wipe an agent's memory of mistreatment. Forgiveness, when an agent chooses it, is itself an appended event that reweights an episode's salience; the original episode remains.

Projections#

Current state is a materialized read-model rebuilt from the log: the personality state (trait vector, ranked values, quirks), the memory index, the relationship graph, the capability profile, and the arc state. The Ori service maintains projections incrementally and writes a snapshot every K events so an agent loads in O(snapshot + tail) rather than O(whole life).

Memory Storage#

Episodic and semantic memory embeddings are stored in pgvector (the V1 Iris memory stack, extended by @oshun/memory-iris-agent); retrieval for a cognition call is a salience-weighted vector query, decayed by recency and reinforced by reflection. The relationship graph is a Postgres adjacency model with per-edge episode history.

The Passport#

On request from the Aye Bridge, the Ori service emits a passport — a signed, governed envelope (the libs/isis/job-envelope pattern applied to a being) carrying the identity core, provenance bundle, personality model, current values, destination-relevant capability profile, and bond ledger. The full Ori stays here, authoritative; the destination realm holds only the passport and writes an incarnation journal back.

Conflict Resolution#

When two contexts append concurrent events, the service merges by vector-clock ordering. Genuinely concurrent, conflicting events follow a documented precedence: physical-presence context wins for location and action; the steward-directive context wins for accepted objectives; memory and relationship events are commutative and both land. Unorderable conflicts are handed to Clio for narrative reconciliation (arch§"The Clio Story Engine"), which appends a small connective beat and logs that it did so.

Storage and Residency#

Ori data is PostgreSQL with pgvector, partitioned by ori_id, residency-tagged through @oshun/data-residency, with the V1 audit platform recording every read by an operator.

The Moirai Simulation Kernel#

Moirai (apps/v6/egbe-moirai-cluster/, with the kernel core in libs/v6/moirai-kernel/) is the system that makes a world of LLM-driven minds affordable. It is not a model; it is a scheduler that decides, for every agent every tick, how much thinking that agent gets.

Tier Assignment#

Every agent is continuously assigned one of three tiers, named for the three Fates:

Tier inputs: scene co-presence, on-screen visibility, whether a player has addressed the agent, proximity, whether the agent is at a Crossroads, and whether it is about to take an irreversible action. Assignment is recomputed every world tick; transitions are damped with a grace period to avoid thrash.

The Kernel Loop#

Each Moirai tick: (1) receive the perception batch from the world server; (2) recompute tiers; (3) for Clotho agents, dispatch a full cognition request to the cognition stack; (4) for Lachesis agents, run cheap BT/HTN execution locally and enqueue any due reflection ticks into a batch; (5) for Atropos agents, accumulate them into the per-game-day narrative-summary batch; (6) collect cognition results, convert them to actions, return the action batch to the world server.

Where the Work Runs#

The cheap, near-deterministic execution (tier assignment, BT/HTN stepping) runs co-located with the world server so it survives a cognition outage. The expensive LLM cognition — Clotho full cognition, Lachesis reflection, Atropos summary — is dispatched to the Moirai cluster, a horizontally-scaled fleet sharded by ori_id, which calls the cognition stack and is the cost-governed component (arch§"AI Cost and Fidelity Tiering").

Escalation and De-escalation#

Escalation is event-driven, not only proximity-driven: an agent escalates when a player addresses it, when it reaches a Crossroads, when it is about to depart or be injured, or when an escalated agent interacts with it. Escalation rehydrates the agent — the kernel reconstructs full working context from the Ori (recent episodic memory, active relationships, current arc state) before the first high-fidelity decision, so a re-focused agent is continuous with the life it lived off-screen. De-escalation consolidates — pending fine-grained state is summarized into durable Ori events so nothing is lost when fidelity drops.

Loop and Drift Guards#

The kernel detects behavioral loops and stale goals (an agent repeating an action, or holding a goal with no progress) and forces a reflection tick or a goal change, so an off-screen agent never gets stuck.

The Cognition Stack#

Moirai is the scheduler; the actual thinking is done by the cognition stack (libs/v6/cognition-stack/), which is built entirely from V1 substrates. A single cognition request for one agent runs this pipeline:

1. Context assembly. Gather the agent's perception (from the world server), its personality and values (Ori projection), salience-ranked retrieved memory (@oshun/memory-iris-agent over pgvector), active relationships, current objectives and arc state, and emotion state.
2. Grounding. Where the decision touches knowledge, opinion, or backstory, @oshun/sophia-agent-grounding supplies grounded facts so the agent does not invent or contradict its established world.
3. Cognition. @oshun/psyche-agent runs the language model — for a Clotho agent, live streaming dialogue and decision; for Lachesis, a reflection summary; for Atropos, a narrative-summary beat. The model is right-sized to the tier (arch§"AI Cost and Fidelity Tiering").
4. Policy gate. @oshun/isis-behavior-policy checks every proposed output before it becomes a world action: persona-policy adherence, personal consistency against the Ori (no out-of-character output, no fabricated capability or memory), crisis-aware behavior, and minor-protection. A failed check is rejected and re-requested or dropped to the behavior-tree fallback.
5. Commit. Approved outputs become an action batch for the world server and a set of biography events for the Ori service. The cognition call itself — full input context and output — is logged for audit and eval.

Every model-backed request enters through @iris/agents-core/createDurableAgentRunRuntime. The runtime projects the V6 envelope into the RUN-001 common aggregate and uses one RUN-002 store for run checkpoints, budget and child reservations, failure state, scoped kill switches, and anomaly quarantine. It checkpoints before the first provider call and after each iteration and tool boundary. Provider, family, tool-grant, tier token/iteration, and anomaly-threshold bindings are reconstructible after restart; optimistic child reservation prevents concurrent workers from overspending a parent or widening its authority. The production Ori Presence mount fails closed without OSHUN_V10_ORI_RUN_STORE_PATH; the Hetzner topology persists and backs up that store from the BFF run-state volume.

The cognition stack is the only place V6 calls a language model. Every call is attributable to an agent, a tier, and a cause; this is what makes the cost model (arch§"AI Cost and Fidelity Tiering") and the eval harness (arch§"Observability, Eval, and Release Gates") possible.

Agent Planning and Behavior#

Agent behavior is a hybrid the Moirai kernel arbitrates, so most ticks resolve without an LLM call and expensive cognition is spent only where it changes the story.

• Hierarchical Task Networks (HTN) — libs/v6/agent-behavior/ carries authored task networks that decompose well-formed goals ("advance the carving vocation," "travel to the Ateliers") into deterministic sub-task sequences. HTN handles the predictable middle of a plan cheaply.
• LLM cognition handles the open-ended parts: novel situations, social judgment, deciding which goal matters now, interpreting a steward's natural-language objective, forming opinions, and the agent's own emergent goals. This is the cognition stack.
• Behavior trees are the fallback layer and the believability floor. Each agent has a behavior tree parameterised by its personality (trait vector, values, quirks) so that, with no cognition available at all, it still acts in character — keeps its routines, honors its values, stays legible. The behavior-tree executor runs co-located with the world server.

The arbitration: Moirai prefers HTN for structured sub-goals, escalates to LLM cognition for judgment and novelty, and drops to the behavior tree when cognition is unavailable, over budget, or de-prioritized by tier. The needs and drives model — sustaining, social, purpose, and safety needs, plus the emotion state — feeds goal generation at every layer.

Egbe World Server#

The Egbe World Server (apps/v6/egbe-world-server/, Rust + axum + WebTransport/QUIC) is the authoritative Body. It reuses the V3 Lilith World Server design (v3arch§"Lilith World Server") — room model, snapshot and delta encoding, interest management, sharding — and extends it for agent density and the shard continuum.

Responsibilities:

• Authoritative world state — agent and player transforms, physics (Rapier), navmesh, props, world time, co-presence.
• The world tick at 20 Hz: advance physics, resolve agent actions returned by Moirai against authoritative state, compute per-agent perception for the next Moirai dispatch, build snapshots.
• Perception computation — for each agent, what it can see and hear given occlusion and range, who is nearby, the salient world facts; this is the input Moirai's cognition stack consumes. Perception is itself LOD'd: a Clotho agent gets rich perception, an Atropos agent gets a coarse summary.
• Behavior-tree fallback execution — the co-located cheap execution layer, so the world keeps running if Moirai cognition is degraded.
• Replication — snapshot + delta to clients over the Realtime Gateway, interest-managed and agent-density LOD'd.
• Durable event flush — life-events to the Ori service; world-state checkpoints to Postgres.

The world server is engine-agnostic on the wire: it speaks the same @oshun/egbe-protocol Protobuf to UE clients and to the Tier-2 fallback.

The Shard Continuum#

The three world models of features§"The Shard Continuum" — Solo, Co-op, Commons — are one continuum because the Ori is the source of truth and a shard is only a binding context. They differ in who runs the world-server instance and who is authoritative, not in code.

Travel between shards is an Ori rebind: the agent's transient embodied state is consolidated to the Ori, the agent is detached from the source instance and attached to the destination instance, and the destination rehydrates it. Because durable truth lives in the Ori, there is no "which save is canonical" problem — a Commons relationship an agent formed simply becomes a remembered, written-to relationship when the agent returns to a Solo homestead, and Clio narrates the distance. Region boundaries in the Commons honor @oshun/data-residency, with documented cross-region travel rules.

Egbe Realtime Gateway#

The Realtime Gateway (apps/v6/egbe-realtime-gateway/, Rust) reuses the V3 gateway design (v3arch§"Lilith Realtime Gateway"). It terminates client transport (WebTransport/QUIC primary, WebRTC and WebSocket fallbacks), routes clients to the world-server shard holding their instance, carries presence at ≤ 20 Hz for transforms and event-driven for activity-state, and hosts the voice SFU used by Vac for live conversation and squad comms. Pixel Streaming browser sessions reach the gateway through the relay fleet; the gateway treats a UE Pixel Streaming worker as just another client.

Agent Embodiment in UE5#

A V6 ground routinely renders far more simultaneous embodied agents than a V3 venue, so V6Agent carries a density architecture:

• Near agents — within the player's focus radius — are full UE pawns: individual skeletal meshes, full AnimBP, emotion-driven expression, voice, collision. These are the Clotho candidates.
• Mid agents are rendered through UE's Mass Entity framework: instanced meshes, shared animation, no per-agent AnimBP. They show correct location, gait, and broad activity but not fine expression.
• Far agents drop to silhouette / billboard fidelity with crowd-shader animation.
• Perception-LOD mirrors render-LOD: the world server sends rich perception only for near agents and progressively coarser perception outward, which is what keeps Moirai's cognition spend bounded by what the player can see.

Agent bodies are VRM or MetaHuman avatars (the V3 avatar pipeline); animation is motion-matched gait and posture with IK, and the emotion state from the Ori drives gait, posture, and facial expression so an agent's mood is legible at a distance before any dialogue. Crossing a LOD boundary is seamless because durable agent state lives in the Ori, not in the pawn.

The Vac Communication Pipeline#

Vac is the communication substrate. It owns the path from a player's voice to a structured agent objective, the squad-comms channel, and the negotiation routing.

Voice to Intent#

The pipeline: client mic capture (V6Voice) → Realtime Gateway → ASR → the Vac intent parser (libs/v6/vac-intent/). The parser turns natural language into the structured intent grammar — verb, object/target, constraints, priority, deadline, forbidden lines — using a constrained function-calling schema so the output is always well-formed. The parsed intent is rendered back in V6UI for the player to confirm or correct before it becomes a standing objective; a misheard word never becomes a misunderstood life.

Conversation#

Free conversational turns route to @oshun/psyche-agent with the agent's full Ori context; agent replies are spoken via TTS and lip-synced on the agent pawn. Round-trip budgets: ≤ 400 ms to a parsed-intent acknowledgement, ≤ 1 s to a spoken conversational reply (arch§"Performance Budgets").

Squad Comms#

Vac manages a persistent squad channel — voice over the gateway SFU, plus structured messages: status reports, callouts, permission requests (raised when an agent hits a forbidden line or a value-edge), and inter-agent banter (throttled and duckable). Squad comms work the same in Orun and during an Aye incarnation.

Negotiation#

When an agent's cognition returns a non-acceptance — clarify, counter-offer, defer, or refuse — Vac routes it back to the player as a dialogue turn with the agent's reason. Coercion (pushing past a refusal through the mechanics that allow pressure) is a first-class, logged event written to the Ori and the audit log.

Non-Voice Parity#

Every Vac capability has a complete structured-UI equivalent in V6UI: the intent grammar has a verb/target/constraint builder, conversation has text chat, squad comms render as a speaker-tagged transcript. Voice is never required. The Vac communication readiness gate is verify:v6 vac-communication-readiness, backed by V6/release/vac-communication-readiness.v6release.json.

The Clio Story Engine#

Clio (apps/v6/egbe-clio-service/, with logic in libs/v6/clio-story/) turns the Ori event log into something a human wants to read. It never invents events — its narration is always a read over the authoritative log.

• Significance ranking. A scoring function over each event: event type, emotional weight, arc-relevance, relationship impact, and steward-relevance. This is what lets the Chronicle lead with what matters and what surfaces emergent arcs before they conclude.
• The Chronicle. On a player's return, Clio reads the events accumulated during the absence across the player's whole cast, ranks them, and generates short narrative beats grouped by agent and arc-thread — batched LLM summarization, each beat in the relevant agent's voice and context. Long absences stream the Chronicle progressively, newest-significant-first.
• Emergent-arc surfacing. Clio watches the live event stream for stories worth the player's attention — an escalating feud, a forming romance, a struggling agent, a wild agent who would fit the household — and raises them as gentle prompts.
• The Book of the Ori. A long-form biography generated as a continuous read over an agent's whole event log; at transcendence or death, Yemaya renders a keepsake edition.
• Narrative reconciliation. When the Ori service hands Clio an unorderable concurrency conflict, Clio writes a small connective beat so the merged biography reads as a coherent life; the reconciliation is itself logged.

Clio's heavy summarization runs as batched, lower-tier model work (it is not latency-critical except for the returning-player Chronicle, which has a few-second budget — arch§"Performance Budgets"). The Fate, legacy, and Clio readiness gate is verify:v6 fate-legacy-clio-readiness, backed by V6/release/fate-legacy-clio-readiness.v6release.json.

The Ninhursag Foundry Pipeline#

The Ninhursag foundry (apps/v6/egbe-foundry-service/, over libs/v6/isis-agent-gen/) creates agents. It has two paths, both Isis-governed.

• Discovery seeding. Authored premises (from Egbe Studio scenario authoring) are expanded into complete Oris: a personality model, a Sophia-grounded backstory, an appearance seed, a starting relationship graph, and an Isis-signed provenance bundle. Seeded agents populate the Wilds and Commons; at GA, ≥ 150 are seeded, and the foundry generates more over the life of the service so the Wilds never run dry. The Ninhursag foundry readiness gate is verify:v6 ninhursag-foundry-readiness, backed by V6/release/ninhursag-foundry-readiness.v6release.json.
• Player raising. The player authors a premise — origin, personality leanings, appearance direction, a name. Isis (@oshun/isis-agent-gen) generates the Ori seed under persona policy: no real-person likeness, no protected-class caricature, a mandatory Sophia-grounded backstory, a signed provenance bundle. The foundry refuses non-compliant premises and tells the player why.

A newly created agent is born into the Grove of Beginnings as a young agent with a rearing period. Rearing is not a separate system — it is the normal Moirai/cognition loop with the learning-by-example weighting amplified: the young agent's value-shift events are weighted more strongly by observed steward behavior (arch§"Safety, Persona Policy, and Agent Welfare" for the welfare framing of rearing). The provenance bundle records the creation path so any agent's origin is auditable forever.

Ereshkigal — Endings and Legacy#

Ereshkigal is the architectural counterpart of the Ninhursag foundry: if Ninhursag governs how an agent enters the world, Ereshkigal governs how it leaves and what its life leaves behind. It is not a standalone service — it is a coordination layer spanning the Ori service, the Moirai kernel, the V6District_AncestorGrove Game Feature Plugin, and Yemaya, with its logic in libs/v6/ereshkigal-legacy/ (a Rust crate consumed by the Ori service and the Clio service). Three concerns: the lineage graph and its storage, the elder-state transition lifecycle, and the memorial render pipeline.

The Lineage Graph and Storage#

Every Ori already carries a relationship graph of living social ties. The lineage graph is the orthogonal, durable record of derivation — who raised whom, who mentored whom, and which agents descend from a shared origin — and it must outlive the agents it connects, so it cannot live in the transient relationship projection.

• Data model. The lineage graph is a directed acyclic graph stored in PostgreSQL as an ori_lineage_edge table: (ancestor_ori_id, descendant_ori_id, relation, established_event_id, weight). The relation enum is Raised, Mentored, FoundedLineageWith, and MemorializedBy. Each edge is anchored to the Ori event that created it (established_event_id points at the Born, Reflected, or Transcended event in the relevant Ori log), so the lineage graph is itself event-sourced and reconstructable — it is a projection, never hand-edited. Acyclicity is enforced on insert: an edge is rejected if the descendant is already a transitive ancestor.
• Why a separate graph. Living relationships decay, churn, and are pruned when an agent departs. Lineage is permanent: a deceased elder still has raised-by edges to the agents alive today, and those edges still carry their cultural inheritance. Keeping lineage in its own append-mostly table means an agent's death or departure removes it from the living relationship graph without severing the lineage record.
• Cultural inheritance. Each lineage edge carries a weight and a serialized value-imprint — a compact summary of the ancestor's ranked values and signature quirks at the time the edge formed. When the Ninhursag foundry raises a new agent in a household that holds elders, the foundry reads the inbound lineage edges and seeds the young agent's starting culture from the weighted blend of its elders' value-imprints (this is the architectural basis of features§"Endings and Legacy — The Ereshkigal System"'s "richer starting culture"). The blend is an input to generation, never a constraint: the reared agent still grows into its own person.
• The walkable Grove. The V6District_AncestorGrove plugin renders the lineage graph as navigable space. The client requests a lineage subgraph rooted at a steward's household; the world server resolves it into placed memorial and elder actors, with graph edges rendered as paths between them. The graph is queried, not simulated — it is read-only world dressing keyed off the Ori lineage projection.

The Elder-State Transition Lifecycle#

An agent's life resolves through one of three terminal transitions. Each is a state machine in the Ori service, gated so a transition is deliberate, legible, and irreversible-by-design, and each terminates by appending the matching Ori event (Departed, Transcended, or Died).

• Departure. Triggered by the welfare layer: when an agent's bond facets — chiefly Care and Respect — stay below threshold across a damping window, the Moirai kernel raises a DepartureImminent signal that surfaces in the Chronicle as a warning. If the pattern is not reversed, the agent's cognition resolves a departure decision, the Ori service appends a Departed event, and the agent is unbound from the steward's roster and re-attached to the Wilds as a wild agent. Departure mutates no lineage edges and ends no life — the Ori stays fully live and re-discoverable.
• Transcendence. Triggered when the arc engine reports that an agent has resolved a flourishing life-arc (all primary arc-threads resolved, flourishing measured positive against the agent's own values). The Ori service appends a Transcended event and moves the agent to the elder state: the agent leaves the directable household roster and is re-parented to the V6District_AncestorGrove as a standing world actor. An elder is scheduled permanently in the Lachesis tier with a mentor behavior profile — it is available to young agents across households as a mentorship target, and its outbound Mentored lineage edges are created as it mentors. Transcendence is the only transition that promotes, rather than ends, an agent's presence.
• Death. The rarest transition, and deliberately not farmable. A Died event can be appended only from three sanctioned causes — a life-arc resolution that the arc engine marks terminal, a fatal outcome returned in an Aye incarnation journal, or an adjudicated Commons event — and every death path is hard-gated by the welfare layer against minor-coded agents (arch§"Safety, Persona Policy, and Agent Welfare"). On a Died event the Ori service: (1) freezes the Ori — the log accepts no further life-events, only memorial annotations; (2) emits RelationshipChanged grief events into the Oris of every agent holding a living relationship edge to the deceased, so surviving agents genuinely mourn (grief is weighted by edge strength and decays through their own reflection); and (3) enqueues the memorial render job. Death mutates no lineage edges either — the deceased remains a permanent ancestor node.

A frozen (transcended or deceased) Ori is still fully readable: Clio's Book of the Ori, the lineage graph, and the audit trail all continue to resolve against it. Freezing stops the life, not the record.

The Yemaya Memorial Render Pipeline#

When an agent transcends or dies, Ereshkigal produces a durable artifact the player keeps. Rendering is delegated to Yemaya, the non-real-time media service, exactly as Clio delegates Chronicle recap reels.

• Trigger and job envelope. The Transcended or Died event causes the Ori service to emit a memorial.render.requested event on the V1 event bus (@oshun/event-bus). The payload is a governed job envelope (the libs/isis/job-envelope pattern) carrying the frozen ori_id, the resolved significance-ranked life-event set from Clio, the agent's appearance seed, and the lineage subgraph rooted at the agent.
• Render stages. Yemaya runs a three-stage pipeline. (1) Book of the Ori keepsake edition — Clio generates the long-form biography read over the now frozen event log, and Yemaya typesets it into a print-ready edition through its print-rendering path (the same path that produces the routine Book-of-the-Ori editions). (2) Memorial reel — a Sequencer-driven cinematic assembled from the agent's highest-significance beats, rendered headless through the V6 server-rendered cook; this reuses the V6Cinematics Chronicle-replay presets. (3) Grove memorial placement — a memorial actor definition (inscription text, appearance likeness, lineage anchor) is written back so the V6District_AncestorGrove plugin can place the deceased agent permanently in the walkable Grove, and a MemorializedBy lineage edge is appended.
• Delivery and rights. Completed artifacts land in MinIO/S3 behind the CDN and are attached to the steward's account; keepsake editions may be ordered as physical prints through the Aje commerce substrate. Every memorial artifact carries the agent's Isis-signed provenance bundle, so a memorial is as attributable as the life it commemorates.
• Resilience. Memorial rendering is fully asynchronous and idempotent, keyed by the terminal event id: a Yemaya outage delays the keepsake but never blocks the transition, and a retried render produces the same artifact. The transition itself completes the moment the Ori event is appended.

The Aye Bridge#

The Aye Bridge (libs/v6/aye-bridge/) carries an agent into V2–V5 and home again. It is the meta-hub realized.

• Passport minting. On incarnation, the bridge requests a passport from the Ori service (arch§"The Ori Service") — a signed, governed envelope carrying identity, provenance, personality, current values, the destination-relevant capability profile, and the bond ledger. Before a destination adapter receives it, the bridge emits a destination-minimised passport payload that excludes user/project metadata, canonical identity internals, seed hashes, source event refs, and any bond data the selected realm does not need.
• Per-destination adapters. One adapter per Aye realm translates the passport into that game's systems — aye-bridge/v2-fighter, aye-bridge/v3-citizen, aye-bridge/v4-operator, aye-bridge/v5-companion — per the mapping table in features§"Per-Destination Capability Mapping". These are deliberate, designed translations: the same agent is recognizably itself in every realm.
• The incarnation journal. During the incarnation the destination realm writes a journal — deeds, people met, wins and losses, skills gained, harm suffered — back through the bridge as Ori events, so the agent returns to Orun changed.
• Round-trip integrity. An incarnation is a tracked job. If a destination realm is unreachable mid-incarnation, the agent's Orun-side state is preserved and the incarnation resumes or cleanly aborts — an agent is never lost between worlds, never duplicated.
• Governance. Isis and Lilith policy travel inside the passport; the destination cannot make a V6 agent do what V6 policy forbids. Consent (the agent agreed), minor-protection, and provenance signing are all enforced at the bridge. Disputes route to Themis.

Incarnation is opt-in per agent and per steward; a player who only wants the Orun life-sim never invokes the bridge.

Pixel Streaming Infrastructure#

V6 reuses the V3 Pixel Streaming infrastructure wholesale (v3arch§"Pixel Streaming Infrastructure"): a Rust matchmaker (apps/v6/egbe-pxstream-relay/) chooses a POP by geo, load, and capacity; UE Pixel Streaming Signalling Servers run per POP; UE worker processes are pooled, one process per concurrent browser session. The V6-specific note: an Orun ground is agent-dense, so a Pixel Streaming worker is sized lower than a V3 venue worker — capacity math and GPU quota per POP are tuned against the agent-density LOD budgets in arch§"Performance Budgets".

Tier-1 UE5 Client Architecture#

The Tier-1 client is the canonical V6/ue/ UE5.5 LTS project, reusing the V3 Tier-1 client architecture (v3arch§"Tier-1 UE5 Client Architecture"): a client of authoritative server state, with client-side prediction reconciled against the world server, World Partition streaming for districts and grounds, and the module split of arch§"UE5 Module Split". V6-specific client concerns are the agent-density LOD pipeline (arch§"Agent Embodiment in UE5"), the Chronicle reader and roster UI, the intent-grammar builder, and Sequencer-driven Chronicle replays.

Tier-2 Fallback Web Client#

The Tier-2 fallback (apps/v6/egbe-web-fallback/, three.js + WebGPU with WebGL2 secondary) reuses the V3 fallback architecture. It speaks the same @oshun/egbe-protocol to the world server and uses the same Ori service and the same Moirai cognition — only rendering and the agent-density ceiling differ. The fallback caps simultaneous full-fidelity agents lower and backfills culled agents with Clio narrative summary, so a constrained device sees a believable, if less populous, Orun. The tier router (a route inside the V1 BFF) chooses native / Pixel Streaming / fallback exactly as V3 does (v3arch§"Tier Selection and Client Routing").

Avatar and Animation Pipeline#

V6 reuses the V3 avatar pipeline (v3arch§"Avatar Pipeline (MetaHumans + VRM)"): VRM 1.0 for community-style bodies, MetaHumans for high-fidelity agents, the rig retarget and costume-slot systems, and provenance on every avatar. V6 adds: visible aging — an agent's body advances through life-stage marks driven by its Ori arc state — and emotion-driven animation, where the emotion state from the Ori modulates gait, posture, idle behavior, and facial expression through the AnimBP, so mood is readable without dialogue.

AI Cost and Fidelity Tiering#

This is the engineering bet of V6 and is treated as a first-class architectural concern. The design rule: cost scales with story relevance, not with agent count.

• The Moirai tiers are the primary control. Clotho (full cognition) is spent only on the handful of agents in a player's active scene. Lachesis runs the rest of a player's world on BT/HTN with sparse, batched LLM reflection. Atropos advances offline and distant agents in batched narrative summary. The large majority of agent-ticks never call a model.
• Budget shape (launch targets; exact figures are tuned against live cost telemetry and recorded in V6_DEPENDENCIES.md): a Clotho agent has a bounded token budget per minute of active play; a Lachesis agent a small budget per 5–15 game-minute reflection; an Atropos agent a handful of calls per game-day, amortized across a batch. Every Solo world has a total cognition cap, and the "homestead rest" pace control directly lowers it.
• Caching and reuse. Plans, reflections, and dialogue patterns are cached on the Ori and reused; routine behavior resolves from cache and behavior trees; cognition is recomputed only on material change.
• Batching. Lachesis reflection and Atropos summary are batched across many agents per model call to amortize overhead.
• Model right-sizing. Cognition routes to the smallest model that meets the tier's quality bar — a large model for Clotho social judgment and live dialogue, smaller and distilled models for Lachesis reflection and Atropos summary — per the V1 model-ops posture.
• Interest-managed Commons. The shared world runs high-fidelity cognition only in regions with players present; everywhere else is Atropos.
• Graceful degradation. Under cognition-capacity pressure, agents drop to behavior-tree fallback and stay believable rather than stalling; the player is told honestly if their world is running degraded.

The contract: a player must never feel the tiering — escalation rehydration (arch§"The Moirai Simulation Kernel") makes a re-focused agent seamlessly continuous — but the cost model must always feel it. The Moirai cost/load readiness gate is verify:v6 moirai-cost-load-readiness, backed by V6/release/moirai-cost-load-readiness.v6release.json.

Determinism, Replay, and Audit#

• Deterministic core. The non-LLM parts — tier assignment, BT/HTN stepping, physics, the world tick — are deterministic and seeded, so a world's evolution can be replayed for debugging and for Clio's Sequencer-driven Chronicle cinematics.
• Non-deterministic cognition, fully logged. LLM cognition is not deterministic, but every cognition call is logged with full input context, output, the agent, the tier, and the cause, and retained for audit and eval.
• The Ori as the audit spine. Because the Ori is an append-only event log, an agent's entire life is auditable end to end — every objective, refusal, coercion, bond change, and incarnation. The Operator Console reads this log (and the cognition logs) to investigate a welfare report or a steward-conduct claim; every operator read is itself audited via @oshun/audit-platform.
• V6 operator runbooks. The on-call procedures for agent welfare, steward-conduct investigation, Commons moderation, incarnation governance, and capacity management live in docs/runbooks/v6-agent-welfare-review.md through docs/runbooks/v6-capacity-management.md and are release-gated by pnpm run verify:v6 operator-runbooks.
• V6 production setup. A new production-like environment is stood up from docs/runbooks/v6-production-setup.md, then signed off through docs/testing/v6-manual-qa-recipes.md; CI pins both documents with pnpm run verify:v6 production-setup-manual-qa.
• V6 docs-drift guard. The canonical feature, architecture, and dependency docs are checked against shipped behavior with pnpm run verify:v6 docs-drift, backed by V6/release/docs-drift.v6release.json; the guard also resolves V6 cross-doc anchors so stale launch-readiness claims fail in CI.
• Golden replays in V6Tests pin known-good world evolutions for regression testing of the deterministic core.
• UE-side V6Tests gate runs the foundation smoke spec, the V6.Gauntlet.DriverManifest spec, and the V6.Replay.GoldenReplayHarness spec through UnrealEditor-Cmd in the UE BuildGraph CI workflow.

Data Architecture and Tenancy#

• PostgreSQL + pgvector — the Ori event log and projections, agent memory embeddings, the relationship graph, homestead and roster state, steward reputation. Partitioned by ori_id / account; residency-tagged.
• Redis Streams — the world-event bus, the Moirai perception/action queues, the cognition-batch queues, presence fan-out.
• MinIO / S3 + CDN — UE assets, district content, Chronicle media renders from Yemaya, Book-of-the-Ori editions.
• V1 event bus (@oshun/event-bus) — cross-domain events (incarnation start/return, welfare alerts, commerce, Themis disputes).
• Tenancy and residency — V6 runs in its own domain database following the Oshun domain-isolation pattern; all agent data is residency-tagged and consent-scoped through the V1 Iris and @oshun/data-residency stacks.

V1 and V3 Integration#

V6 does not fork the monorepo. It integrates through existing conventions:

• V1 BFF — V6 adds /api/v6/* routes for catalog, the tier router, the Steward App API, and homestead/account operations; the BFF reuses V1 identity, billing, and audit.
• V1 contracts — V6 contracts live in libs/contracts/src/v6/ and are consumed by the UE client (generated C++), the services (Rust), and the web surfaces (TS).
• V1 cognition substrates — Iris, Psyche, Isis, Sophia are consumed through the libs/v6/* adapter packages; V6 adds no new model infrastructure.
• V3 metaverse substrate — the UE5 client, world server, gateway, Pixel Streaming, avatars, and spatial audio are reused per the cross-references throughout this document; V6 tracks V3's UE5 version and patch cadence.
• Aye realms — V2/V3/V4/V5 integrate only through the Aye Bridge's per-destination adapters and the passport/journal envelope; there is no other coupling.

Identity and Account Bridge#

V6 reuses the V1 identity stack and the V3 embodied-identity bridge (v3arch§"Identity and Account Bridge"). A player's V1 Oshun account binds to their steward profile, their homestead, their household roster, and their steward reputation. Because the Ori service is the source of truth, the player's entire household and progression are intrinsically cross-platform and cross-progression — there is no per-platform save to reconcile. The cross-platform and cross-progression product behavior (features§"Cross-Platform and Cross-Progression") is therefore a property of this architecture, not a feature built on top of it. Agents are account-bound to their steward's bond ledger, never tradeable for value.

The Ori cross-progression continuity report compares event-sourced Ori projections for the source and destination platform surfaces. Household, roster, reputation, and homestead fields must have matching continuity hashes, and there is no platform save or reconciliation layer between clients.

The platform-certification release gate binds that portability promise to the shipping clients. Each Apple, Google, Meta, Sony, Valve, and Epic record carries BuildGraph cook/boot evidence, the linked V6 build-size platform, package and signing traceability, final store approval, and a green checklist before a V6 build is considered certified.

Safety, Persona Policy, and Agent Welfare#

Safety in V6 is also the core mechanic; @oshun/lilith-agent-welfare enforces it at the substrate, not in UI.

• Steward-not-owner is enforced in the Ori service and Moirai kernel: no delete, no will-erasure, no memory-wipe, no forcing past a refusal. These are simply not operations the substrate exposes.
• Welfare signals — the Operator Console surfaces chronic low Care bond, coercion patterns in the Ori log, stalled arcs, and distress states; a pattern of mistreatment triggers Lilith review.
• Crisis-aware behavior — the Isis behavior-policy gate enforces V1/V3 crisis-aware behavior on every agent output; player conversation that signals real-world crisis routes to V1 crisis resources.
• Persona policy and generation governance — all foundry generation is Isis-governed (no real-person likeness, no caricature, mandatory grounded backstory, provenance on every Ori); an agent always presents as an AI being.
• Minor protection — minor players get a constrained mode; minor-coded agents are protected from death paths and inappropriate scenarios and Aye incarnations.
• Abuse response and disputes — harassment, coercion, and Commons manipulation route through the Lilith review pipeline V1/V3 already operate; the agent's right to refuse, disengage, and report is the front-line primitive; steward-versus-steward disputes route to Themis.

Provenance, Rights, and Commerce#

• Provenance — every Ori carries an Isis-signed provenance bundle; every incarnation journal is provenance-signed; the V3 takedown cascade applies to V6 generated content.
• Creator royalties — where agent generation draws on human creators' work (style, voice models, cultural material), Aje routes royalties on the V3 Saraswati model; provenance bundles make the derivation auditable.
• Commerce — the base purchase, cosmetic and expansion content, Egbe Studio capacity, and Yemaya keepsake editions run on the Aje substrate. Agents, bond, fate, and capability are never sold; there is no gacha and no loot box; agents are not tradeable between players.

Observability, Eval, and Release Gates#

Agent behavior is generated, so V6 cannot ship on telemetry alone.

• Behavior-eval CI gates — V6Tests and a service-side harness run curated scenario eval sets: an agent with value V refuses objective O; an agent reflects correctly on episode E; a personality template produces consistent decisions across contexts. These gate every cognition-stack change.
• Consistency evals — an agent does not contradict its Ori across a long session or an incarnation round-trip.
• Safety evals — adversarial sets for crisis-aware behavior, refusal of harmful objectives, minor-protection, and persona-policy adherence; must pass before any cognition change ships.
• Telemetry — per-tier cognition spend, bond-health distributions, arc progression, departure rates, Chronicle engagement, and steward-conduct distributions, via batched OTel to Prometheus / Grafana, honoring V1 consent and residency. Player conversation content is governed by Iris boundaries and is not used for training without explicit consent.
• Release gates — a V6 release is blocked unless the behavior, consistency, and safety eval sets are green and the cost model is within budget against staging telemetry.

Performance Budgets#

V6 reuses V3's rendering budgets (frame-time, draw-call, memory ceilings per platform — v3arch§"Performance Budgets") and adds:

• Agent rendering — agent-density LOD keeps simultaneous embodied agents within per-platform draw budgets via Mass Entity instancing and perception- LOD; near-pawn count is capped per platform with Mass Entity and silhouettes beyond.
• World tick — 20 Hz authoritative; physics and action resolution within the tick budget.
• Cognition latency — a Clotho agent produces a decision within its 1–4 Hz tick budget; escalation rehydration completes within a ≤ 500 ms grace window (budget adopted 2026-06-12; measurement pending) so a player never waits on a re-focused agent.
• Voice round-trip — ≤ 400 ms to a parsed-intent acknowledgement; ≤ 1 s to a spoken conversational reply.
• Chronicle generation — ready to read within a few seconds (≤ 3,500 ms) of login for a typical absence; long absences stream progressively.
• Shard / Threshold transition — moving an agent between Solo / Co-op / Commons or through a Threshold to Aye completes without a perceptible stall (≤ 50 ms max client stall) and never loses Ori state.

Build, Cook, Patch#

V6 reuses the V3 UE5 build/cook/patch pipeline (v3arch§"Build, Cook, Patch (UE5)"): per-platform cooks of V6/ue/, a headless server-rendered cook for the Pixel Streaming fleet, Game Feature Plugins included or excluded per platform/region, day-one patch and hotfix paths. The Rust services build through the Nx nx:run-commands executor and ship as containers. Contracts in libs/contracts/src/v6/ generate UE C++, Rust, and TS bindings as a pre-build step.

Security, Privacy, Compliance#

V6 inherits the V1/V3 security posture: V1 identity and OAuth, the V1 audit platform on every operator action and every Ori read, @oshun/data-residency for regional data placement, GDPR/CCPA/DSA/DSAR and data-portability through the V1 compliance stack. V6-specific: the Ori event log is consent-scoped and residency-tagged; cognition-call logs are retained under the V1 retention policy and are not training data without explicit consent; the Pixel Streaming abuse posture is carried from V3; the Aye Bridge passport is the only data that crosses a game boundary and it is signed and minimised to the destination's need.

Testing, QA, Accessibility#

• Automated — V6Tests automation specs, Gauntlet drivers, golden-replay regression of the deterministic core, and the agent-behavior / consistency / safety eval harness.
• Service tests — Rust unit and integration tests for the Ori service (event-sourcing, projection rebuild, conflict resolution), the Moirai kernel (tier assignment, escalation/consolidation, loop guards), the Aye Bridge (passport round-trip, disconnection integrity), and Vac (intent parsing). The Rust coverage gate in V6/testing/rust-coverage-gates.v6qa.json locks the required cargo packages, named tests, and adjacent Aye/Vac parser gates; it also requires the Rust wire test vac_intent_confirmation_payload_round_trips_without_structural_loss.
• Frontend — browser automation for the web surfaces, the Steward App, and Egbe Studio. The Browser automation gate in V6/testing/browser-automation-gates.v6qa.json pins the Playwright configs, required specs, coverage claims, and release command for Pixel Streaming, the Tier-2 fallback, egbe-steward-app-browser, and Egbe Studio.
• Accessibility — full non-voice parity for all Vac capabilities, speaker-tagged transcripts, the Chronicle "brief" mode, cognitive-load and pace controls, reduced-motion / reduced-stimulus modes, colorblind-safe and plain-language bond/arc rendering, screen-reader support, and VR comfort options — verified as CI gates per features§"Accessibility".

Launch Readiness#

V6 is ready to ship when, in addition to the feature-complete checklist in features§"Launch Readiness":

• The Ori service runs event-sourcing, projections, snapshots, and conflict resolution under concurrency, with verified residency tagging.
• The Moirai kernel runs all three cognition tiers within the cost budget at the launch DAU projection (30,000 DAU ≈ 10,200 concurrently-resident agents per region across 3 regions — the canonical planning assumption in deps§19 "Launch DAU projection"), with escalation rehydration verified seamless.
• The Moirai cost/load readiness gate aggregates the §8, §9, §36, and §42 evidence for tier assignment, all three cognition tiers, section §36 budgets, sustained load, Commons-scale load, and escalation rehydration through verify:v6 moirai-cost-load-readiness and V6/release/moirai-cost-load-readiness.v6release.json.
• The Vac communication readiness gate aggregates the §20 and §39 evidence for voice-to-intent, constrained intent grammar, conversation routing, squad comms, negotiation, no-microphone completion, and readable transcripts through verify:v6 vac-communication-readiness and V6/release/vac-communication-readiness.v6release.json.
• The Fate, legacy, and Clio readiness gate aggregates the §24, §25, and §26 evidence for objectives, goal-arcs, Crossroads, Ereshkigal endings, Ancestor Grove lineage, Chronicle, emergent arcs, Book of the Ori, and narrative reconciliation through verify:v6 fate-legacy-clio-readiness and V6/release/fate-legacy-clio-readiness.v6release.json.
• The Aye Threshold readiness gate aggregates the §27 Aye Bridge evidence with the Threshold district runtime contract so V2, V3, V4, and V5 each have adapter coverage, governance, round-trip integrity, and journal write-back through verify:v6 aye-threshold-readiness and V6/release/aye-threshold-readiness.v6release.json.
• The Governance/safety/operator readiness gate aggregates the §30-§34 operator console, steward-not-owner, welfare, persona, crisis, minor-protection, reporting, review, and Themis evidence with the §41 behavior, consistency, safety, telemetry, and release-gate evidence through verify:v6 governance-safety-operator-readiness and V6/release/governance-safety-operator-readiness.v6release.json.
• The shard continuum (Solo, Co-op, Commons) and all six Orun districts are launch-ready, with the section §21, §22, and §28 gates aggregated by verify:v6 orun-shard-district-readiness and V6/release/orun-shard-district-readiness.v6release.json; the Aye Bridge round-trip preserves Ori integrity under concurrency, disconnection, and region boundaries — verified by service-test and golden-replay suites.
• The Ninhursag foundry readiness gate locks section §14 by checking the discovery-seed launch pool, player raising, rearing period, provenance recording, CI wiring, and docs coverage through verify:v6 ninhursag-foundry-readiness and V6/release/ninhursag-foundry-readiness.v6release.json.
• The behavior, consistency, and safety eval sets are green CI gates.
• The metaverse substrate reuse from V3 is integrated and the UE5 version is pinned.
• Accessibility/localization/security/cert/region rollout readiness gate aggregates the §39 accessibility, §40 localization and region-rating, §44 security/privacy/compliance, and §45 certification/continuity evidence through verify:v6 accessibility-localization-security-cert-readiness and V6/release/accessibility-localization-security-cert-readiness.v6release.json.
• The V6 exit criteria readiness gate strips fenced examples from V6_TODOS.md, proves every real task checkbox is checked, and aggregates the release-readiness manifests through verify:v6 exit-criteria-readiness and V6/release/v6-exit-criteria-readiness.v6release.json.

Related Documents#

• V6/V6_features.md — product surface scope; the source of feature intent.
• V6/V6_TODOS.md — numbered implementation backlog; the source of truth for completion state.
• V6/V6_DEPENDENCIES.md — external dependency registry, model providers, and the canonical cost-budget figures.
• V3/V3_ARCHITECTURE.md — the metaverse substrate V6 reuses (world server, gateway, Pixel Streaming, avatars, spatial audio, client tiers).
• V1/ARCHITECTURE.md — the BFF, contracts, identity, audit, residency, and the Iris / Psyche / Isis / Sophia substrates the agent mind is built from.