V7 Community Data Portability — Realm Export Rights in Writing

Status: V7 trust/policy design. Source: this is the contract artifact behind the "exit rights in writing" commitment of V7/docs/community-migration.md §2.1 and the export-rights carve-out cited by V7/docs/off-platform-monetization-policy.md §5 Stage 4. Grounded in V7/V7_features.md (features§"The Trust Boundary — Platform vs. Realm", features§"The Realm Model", features§"Nàná — Persistent Characters", features§"Hosting, Orchestration, and Who Pays", features§"Eunomia", features§"The Economy Firewall and Anti-Fraud") and the sibling regimes it composes with: V7/docs/operator-data-protection.md (realm-scoped pseudonymous identity, DPA, deletion fan-out), V7/docs/world-state-rollback.md (Nephthys PITR and the ledger), V7/docs/operator-economics.md (tiers and the BYOC services fee), V7/docs/ip-content-matching.md (ripped-asset hygiene). Market context: V7/V7_GAP_ANALYSIS.md Part A/C (the FiveM/Cfx.re revocable-license precedent). Owner: V7 product lead (Mawu) — guarantee and terms; Nephthys lead — export pipeline; Abundantia registry lead — bundle and licensing; DPO — consent mechanics; Kuanyin/Themis — enforcement-scenario interaction. Date: 2026-06-12. Counsel review required before the operator terms ship; assumptions labeled.

1. The Guarantee, in One Paragraph#

A realm operator can take their community's world with them: their own resources and configuration in full, their realm's world and economy state, and — with each player's standing consent — their citizens' character records, in an open, versioned, integrity-hashed format the operator can verify independently. The platform's identity, safety, Ori, and real-money planes are never exportable, because they were never the operator's (features§"The Trust Boundary"). The guarantee lives in the operator terms with a survival clause: changes adverse to export rights take effect no sooner than 24 months after notice (planning assumption adopted 2026-06-12, counsel to confirm enforceability per market).

This is a deliberate competitive wedge. FiveM communities operate under a license Rockstar can revoke at will — the team behind FiveM/RedM was acquired by Rockstar in Aug 2023 (gap§Part A row A1), and the unconfirmed "Project ROME" first-party platform (gap§Part C) is exactly the scenario in which those communities would face a forced migration with zero data rights: no export of their MySQL character tables, no license to their world, no recourse. community-migration.md §2.1 lists "zero IP ownership of the world they built" among flagship operators' standing grievances. V7's counter is not a promise — it is a signed bundle, an open format spec, a public verification tool, and a CI gate that proves round-trip fidelity every release (§8). A platform that structurally cannot hold communities hostage is the platform flagship communities can bet a decade on.

2. What an Operator May Export#

2.1 Their resources and configuration — full, content-addressed#

• Every Ixchel resource (WASM modules, assets, data layers) owned by the operator or their realm's credited creators with export-licensed terms, as content-addressed objects exactly as the registry stores them (arch§"Dependency Resolution and Content-Addressed Storage"), plus the realm's pinned lock file, Nàná configuration, Eunomia charter and governance record, realm settings, and the operator's own admin/moderation audit log.
• Third-party paid resources are not theirs to take. A dependency the operator merely licensed exports as its lock-file entry: content hash, version, and a signed license receipt — proof of what they ran and the right to re-acquire, not the bytes. Every resource carries an exportable flag in Abundantia metadata, set by its rights holder (default: exportable for the operator's own uploads, receipt-only for marketplace purchases). This keeps the export pipeline from becoming the leak channel that Tebex resources suffer (community-migration.md §2.3).

2.2 Realm world and economy state — their realm's ledgers#

The realm's Nephthys aggregates at the export cut: world mutations, property registry, vehicle/item instances with provenance lineage, the realm's double-entry play-currency ledger (the same journal the rollback tooling queries, world-state-rollback.md §3.1), job/institution state, and the realm-health metric history. The export source is a forked shadow materialization at the cut timestamp — the PITR machinery of world-state-rollback.md §2 — so exporting never disturbs the live realm and the cut is a well-defined, replayable point.

2.3 Character data — only with per-player consent#

Characters are players' personal data processed by operators under the operator-data-protection.md regime; they are not the operator's asset. Consent mechanics, concretely:

• Standing export-consent flag per character–realm pair, default off. Stored platform-side as export_consent(character_id, realm_id) ∈ {granted, denied}, default denied. Surfaced in the player's privacy settings and as a skippable, default-deny toggle at character creation. Revocable at any time; revocation takes effect at the next export cut (already-delivered exports are not recalled — stated honestly — but every export records the exact consent snapshot used, so liability is bounded and auditable).
• Coerced consent is a violation. An operator may not condition membership, whitelisting, or any realm benefit on granting export consent (the GDPR Art. 7(4) bundling problem). Doing so is a DPA/terms breach → operator-data-protection.md §6 ladder. Operators cannot send consent prompts; only the platform prompts, and only at defined scenario events (§5).
• With consent: the full Nàná character record as held by that realm — the realm-visible aggregate of operator-data-protection.md §2.2 (name, appearance ref, licenses, employment, inventory, balances, property, RP criminal/medical record), keyed by realm_player_id. Never anything from the platform plane.
• Pseudonymized fallback without consent — realm continuity without the person: ledger entries, property, and inventory are retained (the double-entry books must still balance) but re-keyed to xport:HMAC-SHA256(realm_player_id, K_export) where K_export is generated per export and destroyed after manifest signing — forward-unlinkable even to the platform. Character name, appearance, backstory, licenses, RP records, player-authored free text, and relationship edges are dropped; edges survive only between two consented characters. The realm imports these as narrative tombstones ("a former resident"), matching the "character retired" posture of operator-data-protection.md §7.
• Minors: characters on minor accounts take the pseudonymized path regardless of any flag — export of identified child data is off the table as a child-safety floor matter (features§"Child Safety and Age Assurance").

2.4 Explicitly NOT exportable — ever, for anyone#

Platform account identity (emails, credentials, age data, KYC, device attestation); Ori subjects — an export contains realm-scoped character projections, never the Ori event log, which stays platform-authoritative (V6/docs/ori-schema-evolution.md §3–§4 governs that store's own erasure and extension rules); cross-realm reputation and bans; platform economy state (Aje balances, purchases, entitlements, payout history beyond the operator's own statements); safety telemetry and moderation evidence held by Kuanyin/Sekhmet; any other realm's anything. These are the inviolable-plane items of features§"The Trust Boundary" — the same boundary that makes the guarantee credible is the boundary that limits it.

3. Export Format Spec — realm-export/1#

A zstd-compressed tar of content-addressed objects plus a signed manifest:

realm-export/
  manifest.json          # schemaVersion "realm-export/1"; realm id + registry
                         # lineage; export-cut timestamp + Nephthys sequence;
                         # scenario (voluntary|delisting|termination|sunset);
                         # object index (path → sha256 → bytes → class);
                         # consent census (counts only, no ids);
                         # license-receipt index; platform Ed25519 signature
  objects/sha256/<hash>  # content-addressed store: owned resources, assets
  lockfile.json          # the realm's pinned Ixchel lock file
  state/                 # Nephthys aggregate snapshots at the cut (JSONL,
                         # published Nàná aggregate schemas)
  ledger/                # double-entry economy journal, 24-month window
                         # (the retention of world-state-rollback.md §2)
  governance/            # Eunomia charter, proposal/vote record, admin audit log
  characters/consented/  # full records keyed by realm_player_id
  characters/pseudonymized/  # §2.3 fallback records keyed by xport:<hmac>
  MANIFEST.sha256        # flat digest list for offline verification

• Deterministic: re-running an export at the same cut yields byte-identical objects and manifest (the golden-replay discipline of arch§"Testing, Eval Gates, and Golden Replays"); the §8 gate asserts it.
• Independently verifiable: an open-source CLI, oshun-export-verify (proposed, ships with creator tooling — V7/docs/creator-dx-tooling.md owner), checks digests, the platform signature, and schema conformance with no platform connectivity. Trust artifacts beat trust assertions.
• Sizing and delivery (planning assumptions adopted 2026-06-12): a busy Dedicated-256 realm ≈ 2–10 GB resources + ≈ 25 GB compressed 90-day event history + ledger ≈ 5–50 GB typical; delivered by signed URL, available 14 days per request, re-requestable. SLA: export ready ≤ 72 h from request for Dedicated tiers, ≤ 7 days for Meshed; max one full export per realm per 30 days (abuse/egress cap — incremental manifest-diff exports are uncapped).

4. The Self-Host Story — Where Platform Services Stop#

An export is data + code in open formats, not a turnkey server. Stated honestly, because a portability promise that implies the attested client and the safety stack come along is a lie:

Runs / usable from the bundle: the WASM resources target the published Moremi WIT interface, and state/ uses the published Nàná aggregate schemas — planning assumption adopted 2026-06-12: both specs are published under an open documentation license at GA, so the bundle is exercisable by (a) re-import into the platform (a new or restored realm — round-trip is supported and release-gated, §8), (b) any independent runtime that implements the published interface, or (c) plain data migration (the JSONL aggregates and ledger are self-describing).

Stops at the boundary (the features§"The Trust Boundary" never-delegated list, restated as exit consequences): platform identity (players on a third-party host need new accounts), the attested client and anti-cheat, Aje real-money economy and entitlements, the safety stack (Lilith, Kuanyin, Sekhmet scanning), Pheme voice infrastructure, managed Nephthys persistence, Abundantia distribution/discovery, and the Ori service. A departed realm keeps its world and its books; it does not keep the platform.

Sunset escrow strengthens this (§5): at platform sunset — and only then — the platform commits to releasing a reference headless realm-server build (or licensing it to the escrow agent) so sunset exports are runnable, not merely readable. Planning assumption adopted 2026-06-12; requires business + counsel sign-off before the operator terms promise it, and the terms say exactly what was signed off, no more.

5. Scenarios, Windows, and Notice Periods#

Planning assumptions adopted 2026-06-12 throughout this table.

Two cross-cutting rules: (1) the export pipeline runs the Sekhmet scan and IP-content matching (V7/docs/ip-content-matching.md) over every bundle — matched ripped assets are stripped and listed in the manifest as withheld, with the dispute path; an export must not launder what distribution would block. (2) Every export event (who, scenario, cut, consent census, withheld items) is recorded in the realm's compliance file and visible to the operator in the Operator Console — the same auditability posture as world-state-rollback.md §6.

6. Interaction with Federation and Migration#

• Federated state: aggregates that traveled a character corridor or economy bridge (features§"Membership: Open, Whitelisted, Federated") export only the departing realm's side of the books; the counterparty realm's state is "any other realm's anything" (§2.4). Corridor treaties record this at signing (Themis template clause).
• Inbound migration uses the same spec: the FiveM migration toolkit (community-migration.md §4) emits realm-export/1 bundles as its target format, so import tooling, verification, and the §8 gate are shared — one format, both directions. A community that joins V7 sees, on day one, the same bundle format it could leave with.

7. Why This Is a Wedge, Not a Cost#

The asymmetry: Rockstar cannot offer this for FiveM without unwinding its own acquisition logic (gap§Part A row A1 — the Cfx.re team was acquired Aug 2023 precisely to bring UGC in-house; gap§Part C — Project ROME, if real, is a first-party walled garden), and incumbent UGC platforms (Roblox) hold creator content in proprietary, non-exportable form. V7's trust boundary makes the guarantee nearly free: everything the operator may export was already theirs on the realm plane; everything they may not was never on it. The pitch to a flagship operator weighing a decade of community capital (community-migration.md §2.1): the downside of choosing V7 is bounded by a signed tarball you can verify today — the downside of staying is unbounded and has an Aug 2023 precedent. Sales enablement carries a live demo: export a demo realm, verify it with oshun-export-verify on the operator's own laptop, re-import it, diff the state hashes.

8. Evidence — The realm-export Gate and the Sunset Rehearsal#

What proves the pipeline works, in the V7/ADVERSARIAL_EVAL_GATES.md style (proposed addition to the inventory; owner: Nephthys + Abundantia; CI command pnpm exec vitest run --config vitest.config.ts -t "realm-export round-trip" plus a Rust state-hash harness in nephthys-replica-service):

• Round-trip fidelity: a seeded fixture realm (owned + third-party-paid resources; world state; ledger with 10,000 journal entries; three characters — consented, non-consented, consent-revoked-mid-window) is exported, wiped, re-imported. Pass: re-imported state hash equals the export-cut shadow-projection hash (determinism guard); ledger debits/credits re-sum to the cent; deterministic re-export is byte-identical.
• Consent enforcement: the non-consented and revoked characters appear only under characters/pseudonymized/; seeded personal-data canaries (name, record entry, free-text bio) occur 0 times anywhere in the bundle; the HMAC pseudonym is unlinkable after K_export destruction (linkage attempt must fail).
• Plane isolation: platform-plane canaries seeded in the platform store (platform user id, email, Aje balance, cross-realm reputation field) occur 0 times in any bundle byte.
• Licensing and abuse: third-party paid resource bytes absent, license receipt present and verifiable; a seeded IP-matched asset is stripped and manifest-listed; a seeded CSAM-hash fixture blocks the export entirely and routes to the preservation path.
• Tamper-must-fail: disabling the consent check or the IP/Sekhmet scan in the implementation must turn the gate red (the inventory's standing adversarial-proof requirement).

Operational evidence: export SLA (§3) tracked as an Operator Console metric (target ≥ 99% of exports within SLA, quarterly report); one annual sunset rehearsal — the 90-day machinery run end-to-end against a 10-realm staging cohort on a compressed clock, including the consent broadcast, escrow delivery, third-party verification of every bundle, and one re-import — feeds the incident-response drill gate (features§"Launch Readiness"). First rehearsal is an entry requirement for the rollout stage that opens Verified listing at scale (features§"Region Rollout Strategy"); a failed rehearsal blocks that stage until re-run green, the same fail-closed footing as the other V7 gates.