Performance, Build, Security, Testing & Launch

V6 — Egbe, the Agentic Companion Universe — is one Unreal Engine 5 world whose inhabitants are generated agents: each Ori (a companion's append-only biography) drives a three-tier cognition kernel that calls a hosted model, and a single Commons gathering can hold thousands of them while a player watches a hundred and fifty draw on screen. So the question this page answers — how do you know this build is good enough to ship? — has no single answer, only a composition: a per-platform agent-density budget a Steam Deck and a PS5 are held to separately; a 20 Hz authoritative world tick proven by a Rust benchmark; a cost ceiling that keeps three tiers of model spend inside a launch DAU projection; a passport that is signed and minimised before it crosses into another game; a behaviour-eval set that must stay green before any cognition change merges; and a launch gate that refuses to go green while any of those disagrees. This page is the quality spine that ties them together — performance budgets, build/cook/patch, security and compliance, testing and the eval gates, and launch readiness — and it is deliberately honest about which parts are running code, which are machine-checked policy, and which are documented obligations no live deployment yet satisfies. The defining posture, shared with V2/V3/V5, is that V6 invents none of the foundations it can compose, and that a gate's green is worth nothing unless it is unforgeable. The section hub is ../V6_ARCHITECTURE.md.

What ships, honestly#

The testing surface is real and engine-integrated. V6Tests (V6/ue/Source/V6Tests/) carries 37 IMPLEMENT_SIMPLE_AUTOMATION_TEST cases across 20 test-bearing .cpp files (~3,200 lines) under the V6.* namespace, and the module links genuine engine subsystems — MassLOD/MassRepresentation/PCG/Niagara/LevelSequence, plus StateTreeModule/StateTreeEditorModule editor-only because the agent-behaviour tests author and compile a StateTree in process via FStateTreeCompiler (V6Tests.Build.cs). The Rust core is real: apps/v6/Cargo.toml is a workspace of seven service crates (egbe-world-server, egbe-moirai-cluster, egbe-realtime-gateway, egbe-pxstream-relay, egbe-ori-service, egbe-clio-service, egbe-foundry-service) and four library crates (ori-model, moirai-kernel, agent-behavior, egbe-protocol), with unsafe_code = "forbid". The TS agent stack (libs/v6/) is 19 packages with 22 spec files and ~211 it/test blocks. The performance and security gates cross-validate rather than assert.

Two honest qualifications carry through the page. First, V6's observability is not the shared @oshun/metrics/@oshun/tracing spine. The architecture names a V6Telemetry C++ module as a "batched OTel emitter" (V6_ARCHITECTURE.md §"Subsystem Glossary"), but in-repo V6/ue/Source/V6Telemetry/ is a 50-line module-contract scaffold — an FV6TelemetryModule : IModuleInterface with StartupModule/ShutdownModule and nothing instrumented — and a grep for @oshun/metrics, @oshun/tracing, opentelemetry, or a Prometheus /metrics endpoint across libs/v6, apps/v6, and V6/ returns nothing. The shared libraries are real and substantive in the monorepo (libs/shared/metrics/src/registry.ts is a prom-client wrapper); V6 has not yet adopted them in-service, and the honest framing of V6 observability today is the eval / cost / welfare-telemetry contract gates below, not a per-service RED-metrics family. Second, V6 ships zero binary .uasset — the six Districts of Orun are procedural UE5 C++ grounds, not authored levels — so the "content" the launch gate checks is logic, config, and named tests, and the per-platform frame-time numbers are declared measurements gated against thresholds and cross-validated arithmetic, not a live GPU profiler readout in CI. With both qualifications named, the launch gate is honestly green — and that is the load-bearing difference from V5 and V3, whose gates are correctly red. V6 was driven to completion; the green is real because the machinery makes it unforgeable, and the work that genuinely cannot be done in-repo stays honestly [~].

Performance budgets#

Agent-density LOD and the draw-unit model#

The headline budget is agent density, because a hundred and fifty embodied companions on a phone and on a console do not share a draw-call reality. V6/performance/rendering-budgets.v6perf.json declares nine platform profiles (Win64, Mac, Linux, PS5, XSX, iOS, Android, the Pixel Streaming worker, and the Tier-2 web fallback) over a fixed 150-agent ground, each carrying per-platform caps (maxNearPawns, maxMidMassAgents, maxAgentDrawUnits) and a measurement block (sustainedFps, p95FrameMs, peakResidentMemoryMb, estimatedDrawUnits).

The gate that enforces it, scripts/v6/verify-v6-rendering-budgets.mjs, does domain-specific verification a renamed-variable stub could not pass. It binds the JSON to the real engine config: it reads [V6.MassEntity] from V6/ue/Config/DefaultEngine.ini and asserts the cap class for every profile matches (MaxNearAgentsDesktop=64, …Mobile=24, MaxAgentDrawUnitsTier2=100, …). Then it re-derives the expected LOD counts — computeExpectedDensityCounts walks the 150 agents at distanceStartCm + index*distanceStepCm, buckets them into near pawns / mid Mass-instanced / far silhouettes against the radii, and computes estimatedDrawUnits = near*4 + mid*1 + (far>0 ? 1 : 0) — and requires the JSON's measured counts to equal that arithmetic. It rejects any profile whose sustainedFps < targetFps, p95FrameMs > maxP95FrameMs, peakResidentMemoryMb > maxResidentMemoryMb, or estimatedDrawUnits over cap, and it self-tests its own fail-closed seam: it mutates a profile's p95FrameMs to over-budget and asserts the verifier would catch it (lines 137–142). Two independent readers must agree with the data — the Python-style arithmetic in the verifier and the .ini config — which is how the budget gets enforced rather than documented.

The C++ side is genuine Mass Entity logic, not a manifest validator. FV6AgentDensityLODBudgetTest (V6.Agent.DensityLOD.Holds150AgentDrawBudget, V6AgentDensityLODTests.cpp:75) builds 150 FV6AgentDensityLODInputs, calls UV6AgentDensityLODLibrary::PlanDensityLOD, and asserts near-pawn and mid-Mass caps hold, that far silhouettes use EMassRepresentationType::StaticMeshInstance, and that Summary.bWithinDrawBudget. A companion test (HoldsFestivalTierGatheringBudget, :236) pushes a 4,096-agent festival gathering through the same planner and proves only 150 stay visible while the rest become dormant — so a Commons crowd never blows the draw or the cognition budget. The honest line: the draw-unit counts are recomputed deterministically and cross-checked against config; the frame-time and memory figures are declared measurements held below per-platform thresholds, not a live profiler trace in CI.

Latency budgets, and one honest "measurement pending"#

V6/performance/latency-budgets.v6perf.json pins the interactive budgets: a 20 Hz / 50 ms authoritative world tick, a Clotho decision inside its 1–4 Hz planning budget, ≤ 400 ms voice-to-parsed-intent and ≤ 1 s to a spoken reply, a ≤ 3,500 ms Chronicle ready-to-read, and a ≤ 50 ms Shard / Threshold transition stall. The world-tick assertion is backed by a real test, not a number: observedMs: 12.8 over sampleCount: 80 at agentCount: 150, sourced from cargo test -p egbe-world-server world_tick_holds_twenty_hz_with_one_hundred_fifty_agents with the evidence trail benchmark_world_tick(150, 80, …) → report.held_twenty_hz. The manifest is candid where it cannot measure: the escalation-rehydration grace carries a budgetNotes entry stating the 500 ms figure is a "Target only. Budget adopted 2026-06-12 … no observed measurement exists yet and no assertion below claims one. Measurement pending." That is the standard's honest-label posture written into the data — a target named without a fabricated measurement behind it.

Sustained and Commons-scale load#

Two load budgets sit at the launch boundary. The 7-day sustained load run (sustained-load.v6perf.json) targets 10,200 agents per region (10,000 Lachesis + 200 Clotho) across iad/fra/sin with requiredOriLossCount: 0, and the Commons-scale run replays the 4,096-agent / 150-visible festival with cognition within budget. These are real specifications with verifiers (verify:v6 sustained-load, verify:v6 commons-scale-load), but executing them at scale needs live regional infrastructure, so the launch-criteria rows that demand a real multi-day run stay honestly [~] (see Launch readiness).

Build, cook, patch#

V6 reuses V3's UE5 build/cook/patch pipeline rather than inventing one, and the reuse is machine-checked. V6/ue/Build/validate_v6_cook_matrix.py parses the BuildGraph (Build/Build.xml) and the engine .inis without executing a cook and proves coverage exists for seven client platforms (Win64, Mac, Linux, PS5, XSX, iOS, Android) and two Pixel-Streaming-worker platforms (Win64, Linux): each must have a Cook V6 Client <P> Shipping node carrying -build -cook -stage -pak -archive -map=$(PlayableMap) and a Boot … Shipping node running UE.BootTest. It also asserts the worker boots headless (-RenderOffScreen), that DefaultGame.ini's [V6.CookMatrix] lists exactly those platforms and the V6 / V6PixelStreamingWorker targets, that all ten Game Feature roots (the six Districts plus the Solo/Co-op/Commons/Incarnation modes) are in DirectoriesToAlwaysCook, and that PixelStreaming.ini carries the worker launch flags (-Unattended, -PixelStreamingEncoderCodec=H264). Cook profiles for the XR targets (Quest3_OpenXR, VisionPro_OpenXR, PSVR2_OpenXR, SteamVR_OpenXR) live under Build/CookProfiles/. The Rust services build through the Nx nx:run-commands executor and ship as containers, and the V6 contracts in libs/contracts/src/v6/ generate UE C++, Rust, and TS bindings as a pre-build step — one source of truth across the three runtimes.

Security, privacy, compliance#

V6 inherits V1's posture wholesale by composing the shared libraries, and the evidence is checked in under V6/security/. The privileged-access audit (privileged-access-audit.v6security.json) is the spine: it pins five V1 OAuth scopes with role floors — v6:steward:read/act at user, v6:operator:action and v6:ori:read at admin, v6:audit:read at super-admin — and requires every privileged surface to emit a @oshun/audit-platform event. Every Egbe operator action (commons moderation, incarnation governance, capacity acknowledgement, takedown) and every privileged Ori read is mapped to a named audit action and a real runtime function: operator_read_ori_stream and operator_read_ori_projection in apps/v6/egbe-ori-service/src/lib.rs, each carrying @oshun/data-residency metadata and a retention tag, plus a Commons residency.transfer.memory event on every cross-region memory move. Operator access requires a verified OAuth session and MFA.

The tiered-stack additions are principally Pixel Streaming, and they reuse V3's abuse machinery rather than re-deriving it. pxstream-abuse-passport-minimisation.v6security.json admits sessions through /api/v6/pxstream/admission/evaluate before leasing a GPU worker, honouring V3's idle (90 s prompt / 150 s disconnect), per-user (2), per-network (8), institutional (64), and free-tier (120 min/day) caps, a 90% classifier-precision gate, and a confirmed-bot ban path — implemented in the Rust relay apps/v6/egbe-pxstream-relay/src/lib.rs. The one datum that crosses a game boundary, the Aye passport, is signed and minimised: minimisePassportForDestination (libs/v6/aye-bridge/src/index.ts) strips eight fields the destination does not need (metadata.userId, identityCore.name.canonical, bondLedger.historyRef, …) and the gate surfaces any missing required destination field before the crossing — minimisation that is tested, not promised. DSAR and data-rights flows are covered by data-rights-dsar.v6security.json, and the cognition-call logs are retained under the V1 policy and are not training data without explicit consent.

Testing and the eval gates#

UE automation, the Gauntlet driver, and golden replay#

The 37 V6Tests cases run under the editor automation controller; the headless CI driver runs a curated trio. V6/ue/Build/Gauntlet/V6TestsGauntletManifest.json declares the V6TestsGauntletController, the unattended invocation (UnrealEditor-Cmd … -ExecCmds="Automation RunTests V6.Foundation.ProjectDescriptor; … V6.Gauntlet.DriverManifest; … V6.Replay.GoldenReplayHarness; Quit"), the headless flags (-nullrhi -NoSound -unattended -nop4 -nosplash), and a 20-minute timeout, and a UE test (V6.Gauntlet.DriverManifest) validates that very contract. The golden-replay harness is the determinism dividend: V6/evals/golden-replay/deterministic-core-golden.json carries two seeded scenarios — 0x5eedc0de (10 agents, 8 ticks, expectedTraceHash: fnv64:d2d9943440615e77) and 0x0ddba11 (14 agents, 10 ticks, fnv64:224d215da6802d73) — each covering tier-assignment, BT/HTN fallback, physics, world-tick, and perception-snapshot, and V6.Replay.GoldenReplayHarness asserts those exact hashes so a one-bit change in the deterministic core flips the gate.

Rust coverage gates#

V6/testing/rust-coverage-gates.v6qa.json locks five cargo packages behind cargo test --locked and names the exact tests that must exist. The Ori service must prove event-sourcing append/read ordering, concurrent vector-clock appends, projection rebuild from a 10,000-event log equal to the incremental projection, snapshot-plus-tail cold load, and a curated conflict corpus that resolves deterministically (or hands off to Clio). The Moirai kernel must prove walk_up_escalates_lachesis_to_clotho_within_one_tick, transition damping, escalation rehydration building context before the first Clotho decision, deescalation that never loses state, loop and drift guards, and fleet rebalancing on node loss. The Aye and Vac packages add round-trip integrity and the wire test vac_intent_confirmation_payload_round_trips_without_structural_loss.

Browser automation and the behaviour evals#

V6/testing/browser-automation-gates.v6qa.json pins Playwright across four web surfaces — the Pixel Streaming entry (egbe-web), the Tier-2 fallback (WebGPU/WebGL2 with full Vac non-voice parity and a no-microphone a11y route), the Steward App browser route, and Egbe Studio (publishing gated behind Isis provenance) — with the required test titles enumerated per surface. And because agent behaviour is generated, V6 cannot ship on telemetry alone: the governance-safety-operator readiness manifest aggregates §30–34 and §41, running the agent-behaviour eval suites (value-refusal, continuity, grounding, learning-by-example, negotiation, persona-policy, crisis, minor-protection), the consistency suites (long-session Ori consistency, incarnation round-trip), and the safety eval as a hard release gate at requiredPassRate: 1. Persona, crisis, and minor-protection each demand a perfect pass rate, and the behaviour-welfare telemetry excludes conversation content without consent.

Launch readiness (honestly green)#

The V6 exit-criteria gate (V6/release/v6-exit-criteria-readiness.v6release.json, verifier scripts/v6/verify-v6-exit-criteria-readiness.mjs) aggregates everything above into a single go/no-go, and unlike V5/V3 it reads green — because V6 was driven to completion and the green is wired to be unforgeable. The verifier requires all ten constituent readiness manifests to exist and read releaseGate.status: "green" (moirai-cost-load, vac-communication, fate-legacy-clio, aye-threshold, governance-safety-operator, orun-shard-district, ninhursag-foundry, accessibility-localization-security-cert, production-setup manual-QA, docs-drift); it asserts the manifest's own noUncheckedTaskCheckboxesOutsideExamples policy; and validateTodoCompletion strips fenced examples from V6_TODOS.md and then fails if a single - [ ] survives. Today the backlog is 215 [x], 8 [~], and one [ ] — and that lone [ ] is the literal template line - [ ] Implement <thing>. Done when: <observable / measurable assertion>. inside a code fence, which the verifier strips before counting.

The eight [~] are the honest external boundary, and naming them is the point: the 7-day sustained-load and Commons-scale runs (live regional infra), platform cert for Apple/Google/Meta/Sony/Valve/Epic (external certification bodies), the Moirai three-tier cost run against a real DAU projection, the four Aye Thresholds operating cross-game round-trips against shipped V2–V5 destinations, the cross-game Aye campaigns (P2), and the region-rollout / region-rating residency posture. None of these can be honestly closed in-repo, so none is marked [x]. The green therefore means every actionable task is implemented and every constituent verifier passes against on-disk evidence — logic, config, named tests, and threshold-gated declared measurements — with the live-ops, external-cert, and cross-game-integration boundary held honestly at [~].

Edge cases and failure modes#

• The rendering budget is enforced by recomputation, not assertion. The verifier re-derives near/mid/far counts and draw units from the .ini config and requires the JSON to match, then mutates a frame-time to prove it fails closed — a config that drifts from the budget fails the build.
• Latency budgets carry their evidence, including the absence of it. The world tick is backed by a real egbe-world-server cargo benchmark; the escalation-rehydration grace is labelled "Measurement pending" rather than given a fabricated number.
• Observability is not yet on the shared spine. V6Telemetry is a 50-line module-contract scaffold and no V6 service composes @oshun/metrics/ @oshun/tracing — a real gap relative to V2/V3, named here rather than papered over; today's observability is the eval/cost/welfare-telemetry gate contract.
• The passport is minimised, and the minimisation is tested. Only the destination's needed fields cross the Aye Bridge; eight identity/bond fields are stripped and a missing required field is surfaced before the crossing.
• The launch gate's green is unforgeable. It strips fenced examples, refuses to pass on a surviving real - [ ], and ANDs ten fail-closed readiness manifests — so a hand-edited green fails, and the eight honest [~] items keep the live-ops/cert boundary visible.

Where this connects#

• Sideways: determinism, data and integration owns the deterministic core, the Ori event-sourcing store, the residency model, and the V1/V3 integration whose golden-replay hashes, Rust coverage tests, and audit/residency evidence this page's gates depend on; architecture topology and layout owns the two-substrate split, the UE5 module breakdown, and the Rust service topology whose cook matrix, draw budgets, and per-service security posture this page measures.
• Platform foundations it composes: the shared platform observability, audit, and residency libraries (@oshun/metrics, @oshun/tracing, @oshun/audit-platform, @oshun/data-residency) — real in the monorepo, the spine V6's services have yet to adopt for metrics but already compose for audit and residency.
• The section hub: ../V6_ARCHITECTURE.md.