# V7 Dependencies — Mawu: The Open World & Creator Republic Status: V7 dependency graph and build order Source: derived from `V7/V7_features.md`, `V7/V7_ARCHITECTURE.md`, and `V7/V7_TODOS.md`. This document carries (1) the **build-order DAG** across the V7_TODOS sections, (2) the **cross-version reuse dependencies** (what V7 consumes from V1/V3/V5/V6/Maya), and (3) the **external dependencies** (third-party runtimes, services, and standards) with the trust posture for each. Date derived: 2026-05-30 ## Cross-Reference Convention - `§N` → `V7_TODOS.md` §N. `arch§""` → `V7_ARCHITECTURE.md`. - `features§""` → `V7_features.md`. `maya§` → `DOMAINS/maya/features.md`. ## 1. Build-Order DAG (V7_TODOS sections) Edges mean "must be substantially complete before." Sections not on a critical path can proceed in parallel once their inputs exist. ``` §1 Foundations └─> §2 Contracts ───────────────────────────────────┐ ├─> §3 Trust Boundary ─┐ (build-time invariants;│ bind every section below) ├─> §4 Determinism ────┴─> §5 Realm Protocol ──> §6 Moremi ─┬─> §11 Nàná ──> §13 Hera │ │ │ │ │ ├─> §7 Nephthys ├─> §12 Pheme │ │ └─> §8 Danu │ │ └─> §9 Ixchel Sandbox ─┴─> §14 Mawu Studio │ └─> §10 Resolver/Conflict/Compositor │ └─> §15 Genomes/Forking/Balance ├─> §20 Sekhmet ───┐ (gates ALL distribution; must precede §17 fetch path) ├─> §17 Abundantia ┴─> §19 Eunomia ├─> §22 Anti-Cheat ├─> §23 Moderation+Minor-Protection └─> §25 Incarnation/Federation §16 Hosting, §18 Economy Firewall, §21 Child Safety, §24 Streaming, §26 Live-Service, §27 Commerce, §28 A11y/Loc, §29 Telemetry, §30 Evals, §31 Cross-Platform, §32 Rollout/Launch → cut across; finalize last. ``` (Section numbers re-keyed 2026-06-12 to the current `V7_TODOS.md` numbering — the DAG previously cited the pre-renumbering scheme from before §3 Trust Boundary and §4 Determinism were inserted.) **Critical path (longest chain):** §1 → §2 → §9 Ixchel Sandbox → §10 Compositor → §6 Moremi → §7 Nephthys → §8 Danu → §11 Nàná → launch. The **two long poles** are the **Ixchel WASM sandbox** (§9, the security keystone) and **Danu meshing** (§8, the atomic-authority-handoff problem). Both should start as early as their inputs allow and carry the most schedule risk. **Hard ordering rules (do not violate):** - **§20 Sekhmet gates §17 distribution.** No artifact is fetchable by any client before a clean scan. Build the scan pipeline before the install path goes live. - **§9 Sandbox precedes any executable resource.** No realm runs creator code until the sandbox + capability gating + budgets exist (arch§"The WASM Sandbox"). - **§7 Nephthys precedes §8 Danu.** Meshing's crash recovery and authority handoff depend on the decoupled state store being the source of truth. - **Determinism core (§4) precedes rollback/replay/mesh** (arch§"Determinism"): the fixed-timestep deterministic sim + WASM determinism controls are a prerequisite of netcode rollback (§5), mesh replay recovery (§8), and golden replays (§4, CI-gated in §30). - **The trust boundary (arch§"The Trust Boundary") is a build-time invariant, not a late task:** platform identity/economy/safety services are consumed by, never implemented inside, the realm plane. ## 2. Cross-Version Reuse Dependencies V7 is integration-heavy. Each row is a hard dependency on existing code (real unless marked **planned**). Paths verified against the repo. | V7 consumer | Depends on | Path | Status | | ----------------------------------------------------------- | --------------------------------------- | ------------------------------------------------------------------------ | --------------------------------------- | | Mawu gateway / Pheme (§5, §12) | V6 realtime gateway + voice SFU | `apps/v6/egbe-realtime-gateway/`, `libs/v6/egbe-protocol/` | real | | Moremi (§6) | V6 authoritative world-server pattern | `apps/v6/egbe-world-server/` | real | | Nàná characters (§11), Incarnation (§25) | V6 Ori model + service + Aye Bridge | `libs/v6/ori-model/`, `apps/v6/egbe-ori-service/`, `libs/v6/aye-bridge/` | real | | Netcode (§5), Danu (§8) | V3 multiplayer protocol / interest mgmt | `libs/v3/multiplayer-protocol/` | real | | Pheme (§12) | V3 spatial audio | `libs/v3/spatial-audio/` | real | | Mawu client avatars | V3 avatar pipeline (VRM + MetaHuman) | `libs/v3/avatar-pipeline/` | real | | Abundantia (§17), social (§13) | V5 online services backbone | `apps/v5/` | real | | Anti-cheat (§22) | V5 EAC + ML classifier | `apps/v5/` + `libs/nous/` | real | | Moderation (§23), Abundantia (§17) | V5 workshop/moderation pipeline | `apps/v5/` workshop | real | | Ixchel (§9, §10, §15) | Maya engine ECS/physics/streaming | `libs/maya/engine-core/`, `libs/maya/{physics,scene,server}/` | real | | Ixchel (§9, §10, §15) | Maya `forge-*` design | `DOMAINS/maya/features.md` | **planned (no code) — V7 implements** | | Identity/contracts/persistence/events/queue/residency/audit | V1 platform | `libs/oshun/`, `libs/shared/` | real | | Mawu Studio AI gen (§14) | V1 Isis/Sophia | `libs/isis/`, `libs/sophia/` | real | | Nàná deletion limits (§11), char memory | V1 Iris | `libs/oshun/memory-iris/` | real | | Safety floor (§23), voice safety (§12) | V1 Lilith + Kuanyin | `libs/lilith/`, `libs/kuanyin/` | real | | Payouts/economy settle (§17, §27) | V1 Aje | `libs/aje/` | real | | Disputes/appeals (§19, §25, §27) | V1 Themis | `libs/themis/` | real | | Realm trailers / Collection art (§26) | V1 Yemaya | `libs/yemaya/` | real | | Creator publication education (§17, §20) | V9 Metis released lessons | `libs/v7/metis-creator-education-bridge/`, `libs/metis/` | real; education-only, no gate authority | **Reuse risk:** the only **planned** dependency is the Maya `forge-*` family — which V7 itself builds (§9/§10/§15), so it is owned, not blocked-on-another-team. Everything else is real code; the integration risk is API drift, mitigated by the contracts package (§2) generating typed clients. ## 3. External Dependencies (with trust posture) | External | Used for | V7 component | Trust posture | | ------------------------------------------------ | -------------------------------------------------------- | ---------------------------------------------- | ---------------------------------------------------------------------- | | **Wasmtime** (Bytecode Alliance) | WASM runtime, fuel/epoch metering, Component Model + WIT | Ixchel sandbox (§9) | core; pin version; deterministic config (arch§"The WASM Sandbox") | | **pubgrub-rs** | PubGrub version resolution | `forge-resolver` (§10) | core; vendored/pinned | | **Agones** (self-hosted on K8s) | Realm fleet orchestration | Hosting (§16, arch§"Hosting") | self-hosted to avoid managed-vendor shutdown (Unity Multiplay/Hathora) | | **Easy Anti-Cheat** | Kernel client anti-tamper | Anti-cheat (§22) | reused via V5; platform-owned client only | | **PhotoDNA / PDQ / CSAI Match** | CSAM perceptual-hash matching | Sekhmet (§21) | platform-central, NCMEC-aligned; never realm-delegated | | **Thorn Safer (+ Project Artemis)** | Novel-CSAM classifier + grooming detection | Sekhmet (§21) | platform-central; licensed | | **Lantern** (Tech Coalition) | Cross-platform child-safety signal sharing | Sekhmet (§21) | membership; on Meta ThreatExchange | | **StopNCII** | NCII hash ingestion (≤48h TAKE IT DOWN) | Sekhmet (§21) | platform-central | | **Facial-age-estimation vendor** (Persona-class) | Age assurance | Sekhmet (§21) | third-party that deletes biometrics immediately (PII minimization) | | **ClamAV-class scanner** | Asset malware scan at ingest | Sekhmet (§20) | platform-central, pre-distribution | | **Opus / WebRTC** | Voice codec/transport | Pheme (§12) | via V6 SFU | | **QUIC / WebTransport** | Realm transport | Gateway (§5) | via V6 gateway | | **Content-addressed object store + CDN** | Artifact distribution, dedup, integrity | Abundantia (§17), arch§"Dependency Resolution" | Nix-model addressing; tamper-evident | | **UE5.5 LTS** | Client engine | Mawu client | reused across V3–V6 | **Standards/regulatory dependencies (compliance, not optional):** NCMEC reporting, TAKE IT DOWN Act (US, ≤48h NCII), DSA (EU), COPPA (US under-13), UK Online Safety Act age-assurance duties, GDPR/CCPA DSAR, console certification (Xbox/PS/Switch) constraints on which sandbox tiers a console realm may grant. Jurisdiction-specific **legal counsel** is a dependency for the economy firewall (gambling/lootbox) and age-assurance design (arch§"The Economy Firewall", arch§"Sekhmet"). ## 4. Single Points of Failure / Schedule Risk - **Ixchel WASM sandbox (§9):** the security keystone; a sandbox escape invalidates the whole "run untrusted code" thesis. Highest verification bar (the `sandbox-escape` corpus). Start early, staff with security depth. - **Danu atomic authority handoff (§8):** the meshing hard problem (no two-writer / zero-owner window). Ship static meshing first; dynamic later. - **Sekhmet child-safety (§20–§21):** legally non-negotiable and gates distribution; a miss is an existential/legal failure, not a feature gap. - **Determinism core (§4):** a hidden non-determinism source breaks rollback, mesh recovery, and replays simultaneously — catch it with golden replays in CI from day one (§4, CI gate in §30).