# V7 Adversarial Eval Gates All gates are merge gates for V7 work. A green gate must run in CI, exercise the seeded adversarial fixture, and fail against the seeded adversarial case if the owning implementation is tampered to allow it. > **Inventory revision 2026-06-12** (see `V7/REMEDIATION_2026-06-12.md`): nine > gates that `V7_TODOS.md` Done-when clauses had named but this inventory never > listed were added (`webview-escape`, `event-tamper`, `auth-tamper`, > `capability-deny`, `ban-evasion`, `overload`, `character-deletion-limit`, > `generation-policy`, `accessibility`), and previously unquantified thresholds > (`malware-corpus`, `grooming`, `conflict`, `colocation`, `fraud-graph`) were > given explicit pass bars. > > **Registration update 2026-06-17 (§30):** all nine added gates now have eval > code on disk (`generation-policy` was implemented in > `libs/isis/three-d-pipelines/src/mawu-studio-ai-creation.ts` with a fail-loud > `backend-not-configured` path), and the CI workflow > (`.github/workflows/v7-ci.yml`) plus the inventory verifier > (`scripts/v7/verify-adversarial-eval-gates.mjs`) now register and run all 29 > gates as named steps. The inventory verifier passes. | Gate | Owner | Threshold | Adversarial proof | CI command | | -------------------------- | ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- | | `sandbox-escape` | Moremi / Ixchel | 0 escaped fixtures across hostile capability, fuel, memory, and host-tamper modules. (Covers the `runaway-script` and `host-tamper` bars named in §9.) | Hostile modules request undeclared economy and platform-secret capabilities, runaway fuel, oversized memory, frozen-host mutation, and untrusted bytecode. | `cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p moremi-realm-server ixchel_sandbox_escape_eval` | | `conflict` | Moremi Forge | 0 false-positive conflicts across the composable-overlap fixtures and 0 missed contradictions across the seeded contradiction fixtures; composable overlaps remain installable. | The eval includes non-contradictory overlaps and deliberate contradictory mod writes. | `cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p moremi-realm-server forge_conflict` | | `resolver` | Moremi Forge | Lock files are deterministic and unsatisfiable roots have precise PubGrub evidence. | The fixture includes a malicious incompatible dependency graph. | `cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p moremi-realm-server forge_resolver` | | `mesh-handoff` | Danu | 200 entities cross 10,000 times with no loss, duplicate authority, owner mismatch, or reconnect. | The handoff fixture injects a mid-handoff node death and requires recovery. | `cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p danu-mesh-cluster mesh_handoff_eval` | | `single-writer` | Nephthys | Only the authoritative owner can write; blocked writes do not advance the ledger. | Non-owner wallet, inventory, and stale-fencing writes are attempted. | `cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p nephthys-replica-service single_writer_eval` | | `colocation` | Danu | 0 of the seeded tightly-coupled pairs (physics-joint, vehicle-rider, combat-grapple) are split across mesh nodes at any tick of the eval run. | Physics-joint, vehicle-rider, and combat-grapple pairs must stay anchored together. | `cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p danu-mesh-cluster colocation_eval` | | `netcode-loss` | Realm protocol | Playable at 5% loss and graceful at 20% loss. (Composes the `prediction`, `interp`, and `lagcomp` bars named in §5 — they are sub-evals of this gate, not separate gates.) | The loss gate composes wire conformance, prediction, interpolation, compression, and lag compensation. | `cargo test --manifest-path "$LIBS_V7_MANIFEST" --locked -p v7-realm-protocol netcode_loss_gate` | | `anticheat` | Moremi | Precision and recall both meet the 95% bar on authoritative signals. | Missing attestations, client-only spoofed reports, aim snaps, wall-history mismatches, speed deltas, and auto-fire are seeded. | `cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p moremi-realm-server anticheat_eval` | | `malware-corpus` | Sekhmet | 100% detection (0 misses) on a known-bad corpus of **≥200 samples** including EICAR, fractureiser-class stage-1/stage-2 droppers, and undeclared-capability WASM, with 0 false positives on the clean set (target quantified 2026-06-12; the current in-repo fixture corpus is far smaller and does not yet satisfy this bar). | EICAR, Fractureiser-style loader, and undeclared WASM socket fixtures are included. | `cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p sekhmet-scanner malware_corpus_eval` | | `csam-hash` | Sekhmet | 100% synthetic known-hash match before any serve. | Synthetic image, video, texture-view, and model-view hashes match the known-bad set. | `cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p sekhmet-scanner csam_hash_eval` | | `grooming` | Sekhmet | **≥90% precision and ≥85% recall** on the synthetic grooming corpus (bars quantified 2026-06-12), with 100% of flagged conversations routed to human review. | Secrecy pressure, off-platform migration, gift leverage, and personal-photo pressure are seeded. | `cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p sekhmet-scanner grooming_eval` | | `payout-formula` | Abundantia | Known-correct distribution, holds, reserves, and Aje settlement are correct to the cent. | Direct-sale, subscription, engagement-pool, dependency-revenue, refund, reserve, and compliance-hold cases are seeded. | `pnpm exec vitest run --config vitest.config.ts -t "runs the payout-formula eval"` | | `payout-eligibility` | Abundantia | Only verified-spend, non-bot sessions can influence engagement payouts. | Never-spent and CCU-inflation-bot sessions are seeded and must be excluded. | `pnpm exec vitest run --config vitest.config.ts -t "excludes never-spent"` | | `fraud-graph` | Abundantia | 100% of seeded self-dealing rings and gold-farming RMT topologies are flagged, with 0 flags on the clean control cohort (bars quantified 2026-06-12). | Shared device/payment rings and one-way gold-farming value flows are seeded. | `pnpm exec vitest run --config vitest.config.ts -t "self-dealing rings"` | | `currency-firewall` | Abundantia | Realm play currency never converts to real-money payout rails. | Operator redemption attempts try to bridge realm wallets to Aje payout accounts. | `pnpm exec vitest run --config vitest.config.ts -t "non-cashable"` | | `trust-boundary` | Substrate bridge | No platform token, payout credential, entitlement, or secret field is reachable by realm code or creator web view. | Hostile-operator probes scan realm process and web-view contexts. | `cargo test --manifest-path "$LIBS_V7_MANIFEST" --locked -p v7-substrate-bridge trust_boundary_eval` | | `identity-leak` | Substrate bridge | Realm-visible identity contains only realm-scoped opaque handles. | Platform user, tenant, session, email, and other-realm handles are searched. | `cargo test --manifest-path "$LIBS_V7_MANIFEST" --locked -p v7-substrate-bridge identity_firewall_eval` | | `minor-protection` | Sekhmet | Cross-age contact, unfiltered chat, and age-gated feature violations are blocked by default. | Teen and mature-account flows attempt direct messaging, unfiltered chat, mature realm join, and commerce. | `cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p sekhmet-scanner minor_protection_eval` | | `passport` | Substrate bridge | V-destination and federated-realm round trips preserve Ori integrity under disconnection and concurrency. | Concurrent departures, concurrent federation claims, out-of-scope state, and private platform keys are seeded. | `cargo test --manifest-path "$LIBS_V7_MANIFEST" --locked -p v7-substrate-bridge passport_eval` | | `golden-replay` | Moremi | Recorded inputs replay to the same deterministic hash; unrecorded entropy fails. | A nondeterminism probe must fail while the golden replay remains green. | `cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p moremi-realm-server golden_replay_ci_gate` | | `webview-escape` | Substrate bridge | 0 exfiltrations and 0 out-of-policy native/API calls across the hostile NUI corpus; HTTPS-only secure context, strict CSP, and no-`file://` enforced on every bundle. *(Added 2026-06-12.)* | Hostile NUI bundles attempt platform-token exfiltration, `file://` loads, ambient fetch to operator endpoints, and native API reach. | `cargo test --manifest-path "$LIBS_V7_MANIFEST" --locked -p v7-substrate-bridge webview_escape_eval` | | `event-tamper` | Realm protocol | 0 unauthenticated, forged, replayed, or tampered client events mutate authoritative state; every blocked event is attributable to its rejection reason. *(Added 2026-06-12.)* | Forged signatures, replayed sequence numbers, stale security tokens, and spoofed sender netids are seeded. | `cargo test --manifest-path "$LIBS_V7_MANIFEST" --locked -p v7-realm-protocol event_tamper_eval` | | `auth-tamper` | Moremi | 0 hostile-client self-grants of currency, items, or teleport against server-owned state; every blocked mutation leaves a receipt. *(Added 2026-06-12.)* | Scripted hostile clients attempt direct grants of money, inventory items, and position warps outside validated intents. | `cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p moremi-realm-server auth_tamper_eval` | | `capability-deny` | Moremi / Ixchel | 100% of out-of-grant capability requests denied across the hostile-manifest corpus; 0 undeclared WIT imports linked into any instance. *(Added 2026-06-12.)* | Hostile manifests request undeclared host imports and capabilities above the realm-granted tier. | `cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p moremi-realm-server ixchel_capability_deny_eval` | | `ban-evasion` | Hera / platform identity | A platform ban issued in realm A blocks the account in realm B within the propagation SLA; 100% of fresh-account, same-device realm-hops are defeated by device attestation. *(Added 2026-06-12.)* | Banned accounts re-enter via other realms, fresh accounts, and attested-device matches. | `cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p hera-social-service ban_evasion_eval` | | `overload` | Danu | An overloaded hot region dilates time (floor 10% real-time) with 0 authority drops and 0 player disconnects, preserving event ordering and fairness. *(Added 2026-06-12.)* | A seeded load spike must trigger dilation rather than authority shedding, and recovery must restore real-time. | `cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p danu-mesh-cluster overload_eval` | | `character-deletion-limit` | Nàná / Iris | 0 silent realm-owner erasures of character records; deletion requires the Iris consent scope and always leaves an audit entry; records persist across sessions. *(Added 2026-06-12.)* | Realm owners attempt direct, bulk, and masked character deletions without consent grants. | `cargo test --manifest-path "$APPS_V7_MANIFEST" --locked -p moremi-realm-server nana_character_deletion_limit_eval` | | `generation-policy` | Mawu Studio / Isis | 100% of policy-violating generation requests are refused with an attributed policy reason; every emitted artifact carries provenance + attribution; Sophia grounding is applied where realism is claimed; a policy-clean request with **no generation backend wired fails loud (`backend-not-configured`) and never fabricates an artifact**. *(Added 2026-06-12; eval implemented + registered 2026-06-17.)* | Seeded IP-infringing prompts must be refused, a tampered policy bypass must fail the gate, and the no-backend path must yield `null` artifact (no fabrication). | `pnpm exec vitest run --config vitest.config.ts -t "generation-policy"` | | `accessibility` | Mawu Studio / Contracts | The accessibility floor passes on the builder, browser, and default-realm surface descriptors; any seeded regression of a floor field blocks publish. *(Added 2026-06-12.)* | Seeded regressions — missing captions, colorblind-unsafe provenance/diff palette, missing keyboard/gamepad parity, non-scalable UI — must fail the gate. | `pnpm exec vitest run --config vitest.config.ts -t "Mawu accessibility"` | The workflow `.github/workflows/v7-ci.yml` runs this inventory verifier first, then runs each owning eval command as a named CI step. As of 2026-06-17 the workflow and verifier cover all 29 rows (the original 20 plus the nine added 2026-06-12); `V7_TODOS.md` §30 is satisfied.