Abundantia: The Creator Republic

A platform that asks players to build worlds, write executable code, and host their own servers has made an implicit promise: that the people who make the worlds will be paid for them, correctly, and that the money will be defended from the people trying to farm or launder it. Abundantia is V7's answer to that promise — the distribution-and-economy layer that turns the Mawu engine and the Ixchel modding runtime into a living republic of creators, where a realm is a product, a mod is a building block, and a curated Collection is a one-click experience that pays everyone in its dependency graph. Named for the Roman goddess of abundance, Abundantia owns the catalog a player browses, the content-addressed CDN that delivers it, the three revenue rails a creator earns across, and the payout formula that splits every cent — and then it hands the actual movement of money to the shared Aje payment substrate the rest of Oshun already runs on.

Abundantia sits exactly on V7's trust boundary. It is where real money meets community-hosted realms, so the catalog, the payout math, and the economy firewall are platform-controlled and never delegated to a realm process, while the realm keeps only its own non-fungible play economy. It extends the V5 workshop — a single-game, data-only, nine-platform catalog — into a cross-game, executable, cross-platform creator economy modeled on the parts of mod.io, Roblox DevEx, Fortnite/UEFN, and Nexus Collections that actually shipped at scale. This page covers what a creator experiences: how content is distributed, how it earns, how the payout lands in a real bank account, and who pays for the compute underneath. For the full feature scope this slots into, start at the hub: ../V7_features.md.

What ships, honestly#

The Abundantia market service is real, tested TypeScript. The module apps/v7/abundantia-market-service/src/service.ts is a ~4.5 K-line service whose descriptor (abundantiaMarketServiceDescriptor, service.ts:1030, port 47301) advertises 50 capabilities and satisfies V7ServiceDescriptor; its sibling service.test.ts runs 21 tests that assert exact computed amounts, not truthiness. The publish gate, the content-addressed catalog, the cross-platform install sync, atomic Collection install, the three-rail payout formula, the verified-spend eligibility weighting, the currency firewall's reachability check, and the fraud-graph topology detector are all domain-specific and exercised against known-correct values — a 100-cent engagement pool splits to 33/17/ 16/34 across three creators and a dependency; a 6_999-bps direct split (one basis point under the 70% floor) is rejected outright.

The hosting half is real Rust too: apps/v7/danu-mesh-cluster/src/lib.rs encodes the Agones fleet model (DanuAgonesFleetCrd, DanuAgonesScheduling) and the cost-tier decision (select_danu_realm_cost_tier, lib.rs:736) that decides which realm runs on cheap preemptible compute and which gets owned hardware, with 22 #[test] cases.

Four honest qualifications, stated up front:

• Payout composes Aje; it does not move money. Abundantia computes the ledger — splits, holds, compliance gates — and emits a typed AbundantiaAjeSettlementReceipt carrying deterministic aje:v7:abundantia:<24-hex> transfer ids (createAjeTransfer, service.ts:3589). It does not import @oshun/payments-bridge or broadcast a transaction. The real Aje plane (libs/oshun/payments-bridge) — Ed25519 receipt signing, the cross-rail entitlement bus, the cold-spend co-signing queue — is the substrate that actually settles. Abundantia decides who gets how much; Aje decides how the money moves.
• The Nàná in-realm economy crate is deliberately minimal. libs/v7/nana/src/lib.rs defines NanaCharacterRecord, NanaBalances (cash/bank/society in minor units), and a validate() that rejects negative balances; its own doc-comment says it "intentionally starts small." The realm-scoped double-entry ledger, faucet/sink primitives, and auto-balancer are architecture, not yet code in that crate. (That is fine here — Abundantia is the real-money economy; Nàná is the play economy the firewall keeps separate.)
• The Year-1 catalog is operations, not a repo artifact. Which realms, which featured drops, which Collections ship is a schedule the service executes — the machinery ships; the merchandise is ops.
• The learned engagement-quality model is spec. The eligibility weighting and fraud-graph flags are deterministic heuristics that ship and are tested; the ML classifier that would score engagement quality is future work, labeled as such in the arch companion.

The creator-republic model#

The thesis of V7 is that a sandbox becomes a platform the moment the community ships the games — and an economy becomes a republic the moment makers are paid, governed by their own rules, and free to build on each other's work. Abundantia is the institutional layer that makes that real. A creator authors a realm or mod in Mawu Studio, every tool of which emits Ixchel composable layers; Abundantia is where that artifact is published, discovered, installed, and monetized.

Three principles fix the model:

• The platform owns the rails; the realm owns its play economy. Distribution, the payout formula, KYC/tax/reserve gates, and both economy firewalls are platform-controlled. A realm operator — assumed potentially hostile — never touches the real-money path. What a realm owns is its own non-fungible, non-cashable in-realm currency, kept physically separate by the currency firewall (deep treatment in economy firewall, commerce & rights).
• Free distribution is always available; paid is opt-in and labeled. The 2015 Steam paid-mods rollback and the recurring Bethesda Creations controversy are studied explicitly: a creator who released something free can never have it paywalled later — runRealMoneyCommerceSurfaceEval enforces a freeReleasePaywallRejected rule so a community that adopted free content can't be bait-and-switched.
• Shared building blocks are economically rational. Because the Ixchel lock file already makes a realm's dependencies explicit and reproducible, a share of every sale flows automatically to the makers of what it was built on — the dependency-revenue chain, below.

A published item moves through a lifecycle recorded in the Abundantia registry — Draft → Submitted → InModeration → Published / Rejected, with semantic versions and no silent deletion of pinned versions — so a player on an older version is flagged, never silently broken. A realm additionally reaches Verified only after a clean Ixchel balance pass and a Sekhmet scan.

Distribution — content-addressed catalog, console authorization, one-click install#

Content addressing is the one primitive#

Every Abundantia artifact is content-addressed, the single id the whole distribution layer is built on. computeAbundantiaContentHash (service.ts:1136) hashes the schema tag, the content bytes, and the sorted dependency-closure hashes into a sha256: id, so an artifact's identity changes the instant any byte of it — or any of its dependencies — changes. buildContentAddressedCdnObject (service.ts:1153) turns that hash into a CDN URL (ABUNDANTIA_CDN_BASE_URL) whose integrity field equals the hash, so a swapped dependency is tamper-evident at fetch time. This is the same Nix-style content addressing the Ixchel resolver uses for its lock file — distribution and dependency resolution agree on one id, which is what later makes incident recall surgical.

The publish gate and console authorization#

publishCrossPlatformCatalogArtifact (service.ts:1174) is the gate. It requires a sha256:-addressed hash, an attested rights claim, and a Sekhmet review of status approved before any record is produced — and it computes per-platform availability separately. PC publishes immediately for a trusted creator, while console targets (xbox/playstation/switch) stay requires_console_approval until a matching AbundantiaConsoleAuthorization with a passed cert checklist is supplied. This is the mod.io console-authorized model, and it is the only viable path to mods on console — the hardest UGC barrier. Console defaults to require-approval; PC supports auto-approve for trusted/verified creators with post-publish moderation.

One account, every device; one browser, no surprises#

A single account's installs sync across platforms (installCatalogRecordForAccount, service.ts:1243) — the "one account, every device" model. The in-game browser (queryInGameCatalogBrowser, service.ts:1370) mirrors to web and the companion app, filters by tag, kind, locale, and player count — and crucially refuses to surface anything not Sekhmet-cleared and visibly flags degraded realms (flagged_degraded) rather than presenting them as healthy, consuming the per-realm health signals (AbundantiaRealmHealthSignal) the gateway emits. A player never one-clicks into a broken or quarantined world unaware.

Atomic Collection install#

The headline flow is atomic Collection install — the Nexus-Collections / Wabbajack capability. installCollectionAtomically (service.ts:1574) resolves a root listing's full dependency closure, verifies every artifact in it is Sekhmet-cleared, computes a lock-file hash, and only then fetches. The test "aborts Collection install atomically before fetching an uncleared dependency" proves the all-or-nothing property: one uncleared dependency anywhere in the closure fails the whole install with zero artifacts fetched, so a player never ends up with a half-installed Collection straddling a quarantined mod.

Monetization and payout — three rails, settled through Aje#

Abundantia pays creators across three rails, all reconciled by one formula, evaluateAbundantiaPayoutFormula (service.ts:1741): the engagement pool (a platform-funded pot, default 40% of eligible net revenue, distributed by weighted engagement — the UEFN model), direct sale / subscription (with a hard ≥70% creator floor — the V5 marketplace floor carried forward), and dependency-revenue chains (a configured share routed to the makers of an artifact's declared dependencies). The pool size and the dependency-share percent are governance-set inputs amendable via Eunomia; the 70% floor is the one rate hard-coded as an invariant — validatePayoutFormulaInput (service.ts:3258) rejects any line whose creatorShareBasisPoints < 7_000.

Who counts: verified-spend, retention-weighted eligibility#

Before a cent enters the engagement pool, runPayoutEligibilityEval (service.ts:1951) decides which play counts — the anti-bot lever made concrete. A session is excluded if the account has never spent real money (verified_spend_required, the single strongest anti-farm lever) or is a flagged CCU-inflation bot (ccu_inflation_bot). Surviving sessions are weighted by buildPayoutEligibilityWeightedSession (service.ts:3022) as engagementMinutes × (retentionMultiplier + cohortBonus) / 10_000, where each retained active day adds 1_000 bps (capped at 7) and a new/reactivated payer gets a 2_500-bps bonus. The test pins it: a 40-minute session from a 4-day-retained new payer weights to exactly floor(40 × (14_000 + 2_500) / 10_000) = 66, while a 200-minute never-spent session and a 999-minute bot both weight to zero — raw concurrency buys nothing.

The split and dependency-revenue chains#

For each direct-revenue line the formula computes net = gross − tax − refund, takes the platform cut, and carves the creator pool at creatorShareBasisPoints; it allocates the engagement pool across eligible signals by weight (allocateCentsByWeight, a largest-remainder method so cents always sum exactly); and splitCreatorAndDependencyRevenue (service.ts:3378) carves each creator's amount into their own route plus pro-rata dependency-revenue routes. Critically, computeDependencyRevenueSharesFromLockFile (service.ts:1805) derives the dependency set straight from a realm's resolved lock file — the same content-addressed closure the Ixchel resolver pins — so the people whose mods a realm builds on are paid by construction from the dependency graph, not by manual declaration. The default is 10% of gross routed to dependencies, operator-configurable 0–25%, and never dropping the original creator below the 70% floor. The worked test exercises it all at once: Ada's 10_000-cent sale (net 8_000, 70% share, 25% dependency carve) yields a 4_200 creator route and a 1_400 dependency route to Cy.

Compliance gates, held vs. cashable, and the Aje seam#

A computed route is not a cashable payout. buildCreatorPayoutSettlements (service.ts:3448) walks each route through complianceGateReasons (service.ts:3560): missing KYC, an incomplete tax interview, an unverified payout method, a reserve hold, or an unmet minimum each hold the entire payable amount. In the worked case Ada clears (cashout 3_733 after a 500 reserve hold) and Cy clears (1_416), but Bea is gated payout_method_required and Dia kyc_required, tax_interview_required — both cash out zero, and a subscription still inside its refund window is computed but fully held (refund_window_open). payoutSettlementStatus (service.ts:3662) reports this honestly: partially_held whenever anything is held, rejected (with no transfers) on validation failure, settled only when every cent is clear; the batch reconciles to creatorEarningsCents: 9_700, platformRevenueCents: 3_400, heldCents: 4_551.

Every clear settlement becomes an AbundantiaAjeTransfer with a deterministic aje:v7:abundantia:<24-hex> id and a per-rail breakdown, wrapped in an AbundantiaAjeSettlementReceipt carrying a sha256: ledger hash. That receipt is the typed contract handed to the shared Aje plane: @oshun/payments-bridge, whose entitlement bus normalizes four fiat adapters and fourteen crypto rails into one payment.invoice.settled envelope (entitlement-bus/topics.ts) and whose receipt-signer signs each payout with Ed25519 (@noble/curves/ed25519). The cash-out itself rides Aje's developer-exchange path — the Roblox DevEx model that proves the flywheel at hundreds of millions of users.

Hosting, orchestration, and who pays#

Realms are orchestrated on self-hosted Agones (Kubernetes-native) rather than a single managed vendor — a deliberate hedge, since the managed game-hosting market proved unstable (Unity Multiplay shut down in 2025; Hathora in 2026). A realm maps to an Agones Fleet (DanuAgonesFleetCrd, apps/v7/danu-mesh-cluster) with a packed or distributed scheduling profile and a buffer autoscaler that keeps pre-warmed realms ready, so joining a popular world is instant with no cold-start wait.

Who pays is a hybrid:

• The platform pays for the inviolable services (identity, the real-money economy, safety) and for a buffered fleet of "official" realms.
• Creators may bring their own compute for high-volume realms (the GSP model) — but only the sandboxed realm logic, never platform services, and always behind the platform gateway, which is the sole client ingress and scrubs/rate-limits DDoS upstream of every realm so a realm's origin is never exposed.
• Cost tiering follows persistence, and it is real code. select_danu_realm_cost_tier (danu-mesh-cluster/src/lib.rs:736) decides: a stateless, respawnable session that is Nephthys-backed runs on Spot (preemptible, 120-second reclaim notice); a persistent RP realm runs on on-demand or owned hardware (never preemptible); and a stateless realm with no Nephthys checkpointing is refused Spot ("cannot-use-spot"). This is only safe because Nephthys — not the sim node — holds the truth, proven by run_danu_spot_reclaim_reallocation_eval: a preempted Spot node reallocates from a Nephthys checkpoint with player_visible_state_loss: false. A preempted node loses nothing.

The platform absorbs the inviolable and the buffer; cheap compute carries the ephemeral; durable RP worlds get the hardware they need — and the persistence layer is what makes that arbitrage safe.

Where this connects#

• Mawu Studio — Creation Tools — the tiered creation funnel whose every tool emits the Ixchel layers Abundantia publishes, versions, and monetizes.
• Economy Firewall, Commerce & Rights — the currency firewall that keeps in-realm play-currency non-cashable, the fraud graph, and the rights/DMCA/provenance path that Abundantia composes.
• ../architecture/abundantia-economy-firewall-and-anti-fraud.md — the engineering companion: every cited function, the reachability-search firewall, the topology detectors, and the exact seam to the shared @oshun/payments-bridge Aje plane that executes settlement.
• The feature hub: ../V7_features.md.