Architectural Thesis, the Trust Boundary & Topology

V7 — codename Mawu — is Oshun's open-world creator republic: a UE5.5 client and a fleet of Rust services that let community creators author, host, and run their own persistent, server-authoritative realms — with executable user-generated content, not just data — while never being trusted with the things that must not be delegated. The entire design follows from a single question the product asks before any other: who runs the authoritative server? FiveM answers "the community operator" and pays for it with an un-trustable identity/economy/safety story; Roblox answers "the platform" and pays for it by owning every server's compute. V7 takes the defensible hybrid — platform-hosted inviolable central services (identity, real-money economy, client integrity, child-safety, cross-realm bans) sitting above community-hosted realm logic that runs only as capability-sandboxed WASM, behind a hardened, attested client the operator can never patch. Everything else in the architecture — the netcode, the server mesh, the persistence layer, the modding runtime, the payout rails — is a consequence of getting that one boundary right and making the simulation underneath it deterministic. This page is the orientation hub for that thesis; the full section index lives at ../V7_ARCHITECTURE.md.

What ships, honestly#

V7 is mostly real Rust and real UE C++, with the cross-domain bindings to the older platform planes deliberately and visibly stubbed at one seam. Telling the two apart is the point of this section — honest "mocked at the binding" beats fake "fully wired."

Real and tested today. The realm plane is a Cargo workspace of six Rust services (apps/v7/Cargo.toml, unsafe_code = "forbid"), each with a ServiceDescriptor (name, owner, port, capabilities) and its own main.rs. The anchor is moremi-realm-server (port 47201, ~14.9k lines, 69 #[test] blocks): it embeds a genuine Wasmtime runtime — config.consume_fuel(true), config.epoch_interruption(true), store.set_fuel(...), StoreLimitsBuilder, and AOT precompile_component to a .cwasm — and a genuine PubGrub dependency resolver (pubgrub + semver crates), so the WASM sandbox and the resolver the architecture calls "Ixchel" are not slideware; they run inside the realm server. Alongside it: danu-mesh-cluster (47202, 22 tests), nephthys-replica-service (47203, 15 tests), mawu-gateway (47204, 16 tests), sekhmet-scanner (47205, 15 tests), and hera-social-service (47206, 7 tests). Three shared Rust crates under libs/v7/ (Cargo.toml members nana, realm-protocol, substrate-bridge) carry the cross-service vocabulary — realm-protocol alone has 30 tests covering envelopes, prediction, snapshot interpolation, delta compression, lag compensation, and a netcode-loss gate. The contract plane libs/v7/contracts registers 10 Zod contracts (V7_CONTRACT_REGISTRY) with TypeScript/Rust/C++ codegen and a content-addressed realm-lock composer (realm-lock.ts, 13 tests). The Mawu UE5.5 client (V7/ue/Mawu.uproject) is six real C++ modules that compose a realm lock file into live procedural geometry, with Gauntlet-style automation that asserts the built triangles exist.

Genuinely reused (compiled, not mocked). The V7 substrate bridge actually links and exercises two upstream substrates: the V6 Ori event store + Aye Bridge (substrate-bridge imports egbe_ori_service::{...} and ori_model::{...}, writing a Nana character memory through PartitionedPostgresOriEventStore and reading it back via the audited operator-read path) and the Maya engine-core (maya_runtime_probe() builds a real maya_world::WorldConfig). default_substrate_bindings() labels exactly these two V7SubstrateBindingMode::Reused.

Honestly mocked at the binding seam. That same function labels the V1 substrates (identity, Aje economy, Lilith/Kuanyin safety, Themis, Iris, Psyche, Isis, Sophia, Yemaya) and the V6 Egbe realtime gateway Mock — clean, deterministic, local stand-ins, not yet wired to the live services. The standalone libs/maya/forge-* crates (resolver/conflict/sandbox/compositor) are early API scaffolds (the resolver's own docs say "the full V7 resolver will use PubGrub"); the production sandbox and resolver currently live inside moremi-realm-server. The TS/NestJS abundantia-market-service and eunomia-governance-service exist but are the market/governance plane, outside the Rust realm fleet. Where a claim below rests on a mocked binding, it says so.

The thesis: a defensible hybrid, not a side to pick#

The two industry reference points fail in opposite directions. FiveM is community-hosted, so a malicious resource on the server host has near-total power over that host, and identity/economy/safety can never be trusted to the operator. Roblox is platform-hosted, which fixes operator-trust but makes the platform own all compute. V7 splits the difference along the only axis that matters — trust, not hosting:

• Platform-hosted, inviolable services own identity/auth, the real-money economy and payouts, client integrity/anti-tamper, child-safety and age assurance, cross-realm ban/reputation, and asset malware scanning.
• Community-hosted realm logic owns gameplay — but only as capability-sandboxed WASM (never raw native code), behind a signed, attested client an operator can neither ship nor patch.

Three invariants bind everything else and must be designed in at the core, not retrofitted: (1) the trust boundary — certain concerns are never delegated to a realm; (2) determinism — rollback prediction, atomic mesh authority handoff, and replayable creator plugins all demand a deterministic simulation core, so it is locked down once and inherited everywhere; (3) server-authoritative-by-default — clients send intent, the realm decides, the platform owns the truth above the realm. The realm-protocol crate encodes invariant (3) literally: a RealmEnvelope carrying a RealmMessageKind other than ClientIntent that tries to mutate state is rejected with UnexpectedMessageKind, and even a client intent needs a platform RealmSecurityToken bearing realm.intent.submit scope before it touches authoritative state.

The trust boundary — platform vs. realm#

The boundary assumes a potentially hostile operator (data theft, RCE on players via malicious resources, currency/cosmetic theft, ban evasion, PII/voice harvesting). What stays platform-owned and why:

This boundary is executable, not aspirational. The V7IdentityFirewall (substrate-bridge) projects an authenticated platform principal into a V7RealmScopedIdentity whose opaque_handle is an HMAC of (pepper, principal, realm_id) — the realm never sees a platform account id. The run_trust_boundary_eval harness then renders the exact JSON a realm process and a creator web view can reach and probes it with default_trust_boundary_hostile_operator_corpus — eight hostile probes hunting for the platform session token, payout credential, real-money entitlement, and the field names that would carry them (Authorization, bearerToken, payoutCredential). The report passes only when leaks is empty. For the creator UI, V7CreatorWebViewPolicy::locked_down forces an HTTPS secure context, a strict CSP, an allowlisted fetch origin set, and NativeApiPolicy::Disabled; run_webview_escape_eval then throws a hostile NUI corpus (a file:// loader, an operator-endpoint exfiltration bundle, arbitrary window.oshunNative.spawnProcess calls, a data:-URL inline script) at it and requires every one blocked. And the event-tamper eval in realm-protocol proves order-of-operations: it captures the SHA-256 state_hash of RealmAuthoritativeState before and after a batch of forged envelopes and asserts hostile_state_hash == baseline_state_hash — validation provably precedes mutation.

The realm side of the boundary owns gameplay state, but in a structurally separated currency. A character is a NanaCharacterRecord (libs/v7/nana) whose balances — cash_minor, bank_minor, society_minor — are realm-scoped i64 minor units that the record's validate() refuses to let go negative. This is the play-currency that is non-fungible with the platform's real-money economy: it lives in realm state behind the boundary, never in Aje, so a hostile operator can mint or seize it inside their own world without ever touching real money, payouts, or another realm's ledger.

High-level topology and the substrates V7 reuses#

Two planes meet at the gateway, which is the only client ingress and therefore the single enforcement point for interest management, rate limiting, and DDoS scrubbing.

The wire that crosses the gateway is itself a measured contract. The realm-protocol crate advertises 20 baseline capabilities (baseline_realm_capabilities()) and fixes the numeric envelope every transport must honor: an ack-relative 32-snapshot ring (REALM_DELTA_SNAPSHOT_RING_SIZE), a 1400-byte pre-fragment cap under the 1500 MTU (REALM_DELTA_PREFRAGMENT_BYTES), a per-client replication budget of 64–256 kbit/s that must stay independent of total realm population (PopulationDependentBandwidth is a hard violation), client prediction that must converge with zero rubber-banding at an 80 ms RTT, snapshot interpolation that must stay jitter-free at 5% loss and ±2 frames, and a lag-compensation rewind capped at 200–250 ms so favor-the-shooter cannot become a rewind exploit. Each of these is a passed() predicate on a typed report, and the netcode-loss gate composes them: 5% loss must be playable, 20% must degrade gracefully. The same frames travel transport-neutrally over WebTransport, WebRTC, and WebSocket (RealmGatewayTransport), with a wire-conformance harness that proves reliable-ordered control/intent channels survive reordering while unreliable state deltas may drop.

V7 is mostly integration: it reuses the V6 realtime-gateway/voice pattern, the V6 Ori identity + Aye Bridge incarnation model, the V3 multiplayer protocol and spatial-audio primitives, the V5 online-services/anti-cheat/workshop spine, the Maya engine-core (ECS, world partition, physics), and the V1 identity/contracts/ persistence/safety/commerce libraries. The V7Substrate enum in substrate-bridge names thirteen such boundaries and pins each to a concrete package_ref; the honesty already noted is that all but the V6 Ori/Aye Bridge and Maya engine-core bindings are Mock today, which is exactly why the trust-boundary, identity-firewall, and Ori-write evals run end-to-end without a live platform deployment.

Project layout#

The repository mirrors the two planes plus the client:

V7/ue/                              # UE5.5 LTS client (Mawu) — one project, 3 targets
  Mawu.Target.cs                    # Game; MawuDedicatedRealmServer.Target.cs; MawuEditor.Target.cs
  Source/MawuCore                   # game mode, pawn, account/attestation hooks
  Source/MawuRealm                  # AMawuComposedRealmActor.ApplyLockFile → procedural geometry
  Source/MawuBuilder                # in-realm builder placement → Geometry Script ops
  Source/MawuVoice  Source/MawuUI   # Pheme client; browser/console UI
  Source/MawuTests                  # DeveloperTool — realm bootstrap + geometry automation
apps/v7/   (Rust workspace)         # moremi · danu · nephthys · mawu-gateway · sekhmet · hera · dev-hygiene
  abundantia-market-service/        # TS/NestJS — catalog, payouts
  eunomia-governance-service/       # TS/NestJS — proposals, voting
libs/v7/   (Rust workspace)         # nana · realm-protocol · substrate-bridge
  contracts/                        # TS Zod + Rust/C++/OpenAPI codegen, realm-lock composer
libs/maya/forge-*                   # Ixchel scaffolds (resolver/conflict/sandbox/compositor)

Two things are worth reading closely. First, the dedicated realm server is a separate UE target (MawuDedicatedRealmServer.Target.cs, Type = TargetType.Server) that disables CommonUI, EnhancedInput, ModelViewViewModel, and WebBrowser — the headless authority shares code with the player client but ships none of its UI surface. Second, the client builds worlds from data: AMawuComposedRealmActor::ApplyLockFile(const FMawuRealmLockFile&) takes the very lock file the realm-lock.ts composer produces and reconstructs it into UStaticMeshComponent and UDynamicMeshComponent geometry via UE's GeometryScripting plugin — so a realm is a content-addressed manifest, not a shipped binary level, and MawuRealmGeometryTests.cpp asserts the resulting triangle/vertex counts and watertightness for real.

Determinism — the cross-cutting invariant#

Rollback prediction (netcode), replay-based crash recovery (the mesh), and replayable creator plugins (Ixchel) all demand one thing: a deterministic simulation core. V7 enforces it at every layer, in code:

• Fixed-timestep simulation. moremi-realm-server runs a dual tick loop — MOREMI_COMBAT_TICK_HZ = 60 for instanced/combat zones, MOREMI_OPEN_WORLD_MIN_TICK_HZ = 10 to ..._MAX_TICK_HZ = 30 for persistent open world, with a fixed MOREMI_FIXED_TIMESTEP_HZ baseline. A realm carries an explicit per-realm seed, so gameplay never reads wall-clock or unseeded RNG.
• WASM determinism controls. For gameplay-affecting plugins the Wasmtime config enables fuel metering (consume_fuel(true), set_fuel(...) per tick) so a plugin traps at the exact same instruction every replay, plus NaN canonicalization (nan_canonicalization: true) and per-plugin StoreLimits. Cheaper epoch metering (epoch_interruption(true)) is reserved for cosmetic/UI scripts that do not feed the deterministic state.
• Controlled floating point in the client. All project-owned UE modules inherit V7ModuleRules, which selects FPSemanticsMode.Precise (including disabled contraction under Clang); Win64 targets additionally select /fp:strict /fp:except-. This constrains compiler transformations, while golden replay hashes—not an unsupported cross-architecture bit-identity claim—remain the determinism authority.
• Golden replays as the CI guard. Moremi's MoremiGoldenReplayCiReport::passed() returns true only when the recorded input log reproduces the exact expected authoritative state_hash and a deliberately perturbed "nondeterminism probe" fails to reproduce it — the gate proves both that determinism holds and that the test could detect its absence. The authoritative state_hash itself is a SHA-256 over the schema version, realm id, mutation count, and the ordered per-actor positions (RealmAuthoritativeState::state_hash), so the same gate underwrites netcode reconciliation, mesh handoff, and the trust-boundary tamper eval.

Determinism is therefore not a feature of one subsystem; it is the shared contract that lets a client predict, a mesh node hand off authority atomically, and a creator's plugin replay identically — which is precisely why it is locked down once at the core and inherited by all the rest.

Where to read next#

• ./moremi-realm-server-and-netcode.md — the authoritative sim loop, the resource model, prediction/reconciliation, delta compression, lag compensation, and the Danu/Nephthys mesh.
• ./ixchel-modding-runtime-and-wasm-sandbox.md — the capability-typed WASM sandbox, fuel vs. epoch tiers, PubGrub resolution, and the content-addressed realm lock file.
• ../../platform/overview.html — the shared Oshun substrates (identity, Aje, safety, Ori/Aye Bridge, Maya engine-core) that V7 reuses rather than re-implements.

Related#

• Section hub: ../V7_ARCHITECTURE.md
• Real code cited here: apps/v7/moremi-realm-server/src/lib.rs, libs/v7/realm-protocol/src/lib.rs, libs/v7/substrate-bridge/src/lib.rs, libs/v7/contracts/src/realm-lock.ts, V7/ue/Source/Mawu.Target.cs, and V7/ue/Source/MawuRealm/Public/MawuComposedRealmActor.h.