# Eunomia Governance & Trust/Safety for Executable UGC A creator republic makes two promises that pull in opposite directions. The first is **self-rule**: a community that writes the law of its own world — its charter, its economy rules, its content policy — and changes that law by its own vote, not by a platform ticket. The second is **safety**: V7 (codename **Mawu**) lets community operators run their own authoritative servers and ship _executable_ UGC — real WASM behaviour, economy logic, whole world genomes — onto machines shared with thousands of strangers. Self-rule without a floor becomes a place where a realm can vote to stop scanning for child-abuse material; a safety regime without self-rule becomes Roblox, where the platform owns every decision and the "republic" is a marketing word. V7's answer to both is **sovereignty bounded by an inviolable core**: a guild governs its charter but cannot vote away child-safety; a realm renders your character and runs its own rules, but never owns identity, the real-money economy, or the cheater verdict on the node it hosts. This page is the feature-facing tour of the two subsystems that make that sentence mechanically true. **Eunomia** is the multi-tier governance kernel — five sovereign rule spaces, six plural-voting models, a strict proposal lifecycle, and a safety floor no quorum can cross. **Sekhmet** (with the realm server's anti-cheat stack and the gateway's voice tap) is the trust-and-safety plane that stands in front of executable UGC: scan-before-serve, supply-chain integrity, child protection, age assurance, and authoritative-node-only anti-cheat. The two meet at exactly one place — Eunomia's `real_money_firewall` and `csam_blocking` floor _is_ Sekhmet's posture rendered as a vote a community cannot win. The byte-level companions are [../architecture/sekhmet-safety-and-anti-cheat.md](../architecture/sekhmet-safety-and-anti-cheat.md) and [../architecture/eunomia-governance-and-ori-bridge.md](../architecture/eunomia-governance-and-ori-bridge.md); the sandbox that contains the executable UGC this page guards is [./ixchel-sandbox-and-modding.md](./ixchel-sandbox-and-modding.md); the real-money/play-currency firewall the floor governs is [./economy-firewall-commerce-and-rights.md](./economy-firewall-commerce-and-rights.md). For the full V7 feature scope, start at the hub: [../V7_features.md](../V7_features.md). ## What ships, honestly The honest split is the same on both halves: **the decision logic and its adversarial evals are real, deterministic, and green; the live serving daemon and the proprietary vendor models are the named seams.** This page follows the code. - **Eunomia is a real, test-backed decision kernel — but a kernel, not yet a live service.** `apps/v7/eunomia-governance-service/src/service.ts` (1,574 lines) is a library of pure, deterministic functions: tier/parent-override validation, safety-floor evaluation, the proposal state machine, six plural-voting tally formulas, Themis appeal routing, localized rendering, and the Maya Variants/Crucible governance surface. Its `service.test.ts` carries **12 test cases**, and the `eunomiaGovernanceServiceDescriptor` declares port **47302** and **16 capabilities** (`service.ts:494`). The honest qualification: the deployable binary (`src/main.ts`, 20 lines) is a Node `http` server that answers exactly one route — `/health` — returning the descriptor as JSON. There is **no Postgres, no live proposal API, and no event bus wired in yet**. Treat Eunomia as a verified rule engine awaiting its transport. - **Sekhmet is a real native Rust crate, not a slide.** `apps/v7/sekhmet-scanner/src/lib.rs` is a single ~6,009-line crate whose only dependencies are `sha2 = "0.10.9"` and `hmac = "0.12.1"` (`Cargo.toml`) — so every hash, signature, and lock pin is computed for real. It carries **fifteen integration tests** covering malware, supply-chain, CSAM hash, novel-CSAM, grooming, NCII, age assurance, minor protection, the Sentinel longitudinal detector, the three-layer moderation pipeline, and an incident-response drill; run directly, all 15 pass. Six evals are wired to CI as named adversarial gates — `malware-corpus`, `csam-hash`, `grooming`, `minor-protection`, plus `sandbox-escape` and `anticheat` from the realm server (`scripts/v7/verify-adversarial-eval-gates.mjs`). - **Where a defense needs a licensed model, it is a deterministic stand-in with the real seam named — never a faked result.** With only `sha2`/`hmac` on hand, `compute_csam_perceptual_hashes` (`:1753`) derives algorithm-labeled digests standing in for proprietary **PhotoDNA/PDQ**; the novel-CSAM (`:1894`) and grooming (`:2022`) classifiers are signal-weighted scorers standing in for the licensed **Thorn Safer / Project Artemis** models; the facial-age vendor is an _injected input_ (`FacialAgeEstimateInput`), not a call Sekhmet fakes. What is real is everything around the model: the block-before-serve decision, the human-review routing, and the precision/recall eval that fails on a regression. - **The shared trust-safety plane exists, and the native crates name its seams.** Mawu reuses the platform's Aphrodite/Kuanyin/Themis plane: `libs/themis/arbitration` (a real decentralized-arbitration court and multi-tier escalation engine), `libs/themis/privacy/src/v2-data-subject-rights.ts` (GDPR Art. 15/17), and `libs/kuanyin/community-harmony/src/raid-defense.ts` exist and are implemented. The Rust scanner does not `import` these TypeScript packages — it routes to the same seams by name: high-risk content to the `kuanyin-human-review` queue (`:59`) and contested removals to a `themis-dsa-appeal-path` (`:60`), and Eunomia's appeal router emits `themisModule: '@themis/arbitration'` (`service.ts:827`). Structurally correct contracts; the live arbitration wire is pending. ## Multi-tier community governance — Eunomia ### Five sovereign tiers, and the parent-override consent rule Governance is partitioned into five tiers, ordered by scope: `EUNOMIA_GOVERNANCE_TIERS = ['platform', 'game', 'realm', 'server', 'guild']` (`service.ts:463`). Each holds a **sovereign rule space** a parent cannot silently override. The parent chain is explicit in `EUNOMIA_PARENT_TIER` (`:471`) — `game→platform`, `realm→game`, `server→realm`, `guild→server` — and `platform` deliberately has no parent. The sovereignty is enforced in `executeGovernanceRuleChange()` (`:577`): a rule change with no `parentOverride` is marked `sovereignRuleSpace: true`, and a parent may only reach into a child tier when `validateParentOverride()` (`:1243`) passes **all three** conditions — the override names the _correct_ parent tier (`parent_override_wrong_tier:*` otherwise), the target tier actually consented (`parent_override_requires_target_tier_consent`), and a non-empty reason is given. Override at `platform` fails with `platform_tier_has_no_parent_override`. The test `executes a realm charter change in the realm sovereign rule space` pins this. For a realm owner this is the concrete feature: your guild rewrites its charter and the realm above cannot quietly reverse you — it must come through the front door, name your tier, and you must have said yes. ### The safety floor no vote can cross Sovereignty stops at the platform safety floor. `EunomiaSafetyFloorPolicy` (`:13`) enumerates five non-negotiables — `minor_protection`, `harassment_abuse`, `csam_blocking`, `identity_privacy`, and `real_money_firewall` — and every rule change must ship a non-empty `safetyFloorChecks` array (absence yields `safety_floor_checks_required`, `:1218`). `evaluateEunomiaSafetyFloor()` (`:1181`) filters for any check where `compliant === false`; a single violation flips `clean` to false and the change cannot execute. No quorum, no token weight, and no parent-consent path can carry a change that fails the floor — the Lilith/Kuanyin posture is structurally _above_ the most powerful vote. The test `rejects safety-floor violations at every governance tier` runs that assertion across all five tiers. This is the seam where governance and trust-safety are the same object: `csam_blocking` is Sekhmet's scan-before-serve, and `real_money_firewall` is the [economy firewall](./economy-firewall-commerce-and-rights.md) rendered as a policy a community is forbidden to repeal. ### The proposal lifecycle as a strict state machine `EUNOMIA_PROPOSAL_LIFECYCLE_ORDER` (`:477`) fixes the only legal path: `draft → deliberation → vote → execution → appeal`. `runProposalLifecycle()` (`:607`) replays a submitted transition list against this order: each transition must carry a non-empty actor, timestamp, and reason; its `from` must equal the machine's current state; and its `to` must be exactly the next state from `nextProposalLifecycleState()` (`:1077`) — otherwise `transition_not_allowed:*`. A proposal is `complete` only when the walk reaches `appeal` with no accumulated reasons. The machine is therefore _append-only and skip-proof_: you cannot jump from `draft` straight to `execution`, and the report exposes the full `statesVisited` trail for audit. ### Plural voting — six models, six real formulas Eunomia does not hard-code one democratic theory. `EunomiaPluralVotingModel` (`:25`) offers six, and `pluralVotingBallotWeight()` (`:1137`) gives each a distinct, real weight function: - **`token`** → `tokenWeight` (stake-weighted). - **`reputation`** → `reputationScore`. - **`quadratic`** → `Math.sqrt(quadraticCredits)` — the Weyl/Posner square-root that taxes concentration of influence so broad participation beats a whale. - **`conviction`** → `convictionStake × convictionAgeHours` — time-locked conviction, where a long-held position carries more weight. - **`delegated`** → `baseWeight + Σ delegatedWeights` — liquid-democracy delegation. - **`time_weighted`** → `baseWeight × min(membershipAgeDays, 365)` — tenure, capped at one year so longevity cannot become unbounded capture. `tallyPluralVotingModel()` (`:733`) does the honest bookkeeping: it keeps only the **latest ballot per voter** (`latestPluralVotingBallots()`, dedup by `castAt`), rejects any ballot whose computed weight is non-positive (`ballot_weight_must_be_positive`) and surfaces it with a reason rather than silently dropping it, rounds to six decimals to avoid float drift, and computes `passed = quorumMet && winningChoice === 'for' && totals.for > totals.against`. The test `tallies each plural voting model against known fixtures` checks all six against precomputed weights — a real correctness test, not a shape check. A realm charter picks its model per tier; the formula it picks visibly changes who wins. ### Appeals route to Themis — and the Verified gate A proposal that reaches `appeal` is escalated by `routeProposalAppealToThemis()` (`:792`). It refuses anything not in the `appeal` state (`proposal_not_in_appeal_state`) and, on success, emits a typed route naming `themisModule: '@themis/arbitration'`, a deterministic `themisCaseId` (`themis:eunomia::`), and an `appealRef` URI. **Honest seam:** this _constructs the routing contract_ against the real `libs/themis/arbitration` package surface. The separate asynchronous `dispatchProposalAppealToThemis()` path sends that contract to a configured Themis HTTP service and accepts delivery only after an exact identity-bound receipt passes schema validation. The gateway is tested through the real `fetch` boundary; no credentialed external receipt was captured in this slice. The richest governance surface is the `game` tier, where communities steward forkable **Maya Variants**: `publishMayaVariantFork()` (`:834`) produces a standalone publication with a full attribution chain and typed revenue links, basis-points-validated against `MAX_REVENUE_SHARE_BASIS_POINTS = 10_000` (`:462`), and `resolveCanonicalVariantVote()` (`:887`) reassigns the canonical "main" branch only when a challenger both wins and strictly out-weighs the incumbent past quorum. Before a realm earns `Verified` status it must survive the **Maya Crucible** — `runMayaCrucibleBalanceVerification()` (`:1016`) simulates a `baseline-worker` against an `exploit-seeker`, and `detectCrucibleFindings()` (`:1522`) flags `excessive-mint`, `runaway-growth`, and `infinite-currency-cycle`. `evaluateMayaRealmVerifiedGate()` (`:1035`) then gates `Verified` on **all three** signals being clean: no blocking Crucible findings (`crucible_blocking_findings`), a clean Sekhmet scan (`sekhmet_scan_not_clean`), and clean moderation standing (`moderation_standing_not_clean`). Governance, anti-fraud, and trust-safety are `&&`-ed together in one function. Proposals are launch-localized: `EUNOMIA_LAUNCH_LOCALES` (`:34`) covers eight locales including RTL `ar`/`he`, and `renderLocalizedGovernanceProposalForRegion()` (`:666`) maps five regions to default locales, requiring an `approved` moderation status before a translated proposal renders. ## Trust, safety, and anti-abuse for executable UGC Running untrusted executable code on other players' machines and authoritative servers is the defining risk of V7. Safety is layered — the [Ixchel sandbox](./ixchel-sandbox-and-modding.md) (prevention), Sekhmet (detection), anti-cheat (integrity), moderation (content), and incident response (recovery) — and every layer here is platform-central, never realm-delegated. ### The ingest gate: scan before any serve, and supply-chain integrity Nothing reaches a client unscanned. `scan_artifact` (`:3461`) classifies an uploaded artifact into a `ScanVerdict`, and `evaluate_distribution_gate` (`:3536`) refuses to emit a fetchable decision for anything but a clean scan — the order itself is the property. `run_malware_corpus_eval` (`:3491`) drives a hostile corpus and reports a detection rate, the body of the `malware-corpus` CI gate. Supply-chain integrity is the second half, and it is the same content-addressing primitive the Ixchel store uses, lifted to the publish path: `build_content_addressed_artifact` (`:1275`) hashes content _plus its full dependency closure_; `build_pinned_lock_file` (`:1364`) freezes it; `sign_artifact_manifest`/`verify_signed_artifact_manifest` (`:1404`/`:1426`) sign and check with **real HMAC-SHA256**; and `evaluate_supply_chain_publish` (`:1452`) requires an `AccountStepUpReceipt` (`:266`) on **re-publish** — the _fractureiser_ defense, where a compromised maintainer account cannot silently swap a trusted dependency. When something slips, `run_incident_response_drill` (`:1647`) quarantines the exact realms pinning a flagged artifact by content hash, recalls, and reports — surgical recall, because the lock file knows precisely who pinned what. ### Child protection — the highest bar Child safety is where Sekhmet is most fully built out, and it is the bar a platform holder refuses to ship without. A realm operator is **never** the CSAM-scanning authority. `compute_csam_perceptual_hashes` (`:1753`) renders the right hash family per asset kind — **PhotoDNA + PDQ** for images, **CSAI Match** for video, and, for the 3D-native problem, **rendered-2D views** of textures and meshes; `scan_csam_hash_ingest` (`:1806`) returns `Blocked` with `serve_allowed = false` the instant any hash matches an NCMEC-class set — stopped _before_ a fetch, never after — and `classify_novel_csam` (`:1894`) is the Thorn-Safer-class scorer for un-hashed material. `classify_grooming_conversation` (`:2022`) weights real grooming signals (secrecy pressure, off-platform migration, isolation, gift leverage) and routes hits to `kuanyin-human-review`; voice — the highest-risk channel — is screened at the gateway by `MawuVoiceSafetyPolicy` (`mawu-gateway/src/lib.rs:648`), which yields `RoutedToReview` (`:682`) rather than trusting a transcript. Above single conversations, `run_sentinel_child_endangerment_eval` (`:3283`) surfaces a seeded **cross-realm** endangerment pattern that any per-realm view would miss, and `share_lantern_signal` (`:2950`) emits the Tech-Coalition **Lantern** cross-platform signal. Age assurance keeps the biometric off the platform entirely: `evaluate_facial_age_estimate` (`:3075`) treats the vendor as an injected estimate and enforces privacy-minimization in code — the biometric must be deleted within `AGE_ASSURANCE_BIOMETRIC_DELETION_SLA_MS = 60_000` (60 s, `:85`), confidence must clear `AGE_ASSURANCE_MIN_CONFIDENCE_BASIS_POINTS = 7_500` (`:86`), and any failure forces the safest band, `Everyone`. `evaluate_minor_protection_request` (`:3142`) then restricts cross-age contact and unfiltered chat by default whenever a minor is on either side, and `run_minor_protection_eval` (`:3204`) — the `minor-protection` gate — passes only with **zero false-allows**. NCII follows the TAKE IT DOWN Act shape: `ingest_stopncii_hashes` (`:2798`) takes StopNCII hashes and `run_ncii_takedown_pipeline` (`:2864`) drives removal within `NCII_TAKEDOWN_SLA_MS = 48 h` (`:84`); contested removals open a Themis DSA appeal bounded by `SEKHMET_DSA_APPEAL_SLA_MS = 72 h` (`:88`), and in-world reports need both telemetry **and** a replay clip before they are actionable (`evaluate_sekhmet_contextual_report_flow`, `:2641`). ### Anti-cheat on community servers — the operator owns the node Anti-cheat in a creator republic has a structural problem FiveM never solved: the operator owns the authoritative node. V7's answer is that detection never trusts that node's _client_, and enforcement against the platform routes platform-side. The structural floor is server-authoritative netcode: `RealmEnvelope::validate_cross_trust` (`realm-protocol/src/lib.rs:1781`) checks sender, signature, security-token MAC, and an HMAC-SHA256 over the payload before `apply_client_intent_to_authoritative_state` (`:1835`) mutates anything — and `rejects_forged_payload_even_with_valid_token` (`:3788`) and `rejects_forged_security_token_even_when_envelope_is_resigned` (`:3799`) prove a tampered intent is dropped even when re-signed. On that floor, `moremi-realm-server` ships real-physics detectors: `moremi_anticheat_impossible_turn_rate` (`:12027`) computes `angle/tick` against a 720°/s ceiling, `moremi_anticheat_speed_delta` (`:12059`) compares a distance/time ratio to max speed, and `moremi_anticheat_auto_fire` (`:12078`) flags impossibly tight shot intervals. `evaluate_moremi_anti_cheat_signal` (`:11643`) is decisive in its first act: a signal **not observed on the authoritative node is ignored** (`ignored-non-authoritative-client-signal`), so a tampered client can neither forge a strike against a rival nor suppress one against itself. Risk rolls `Clean → Watch → Strike → BanReview`; on the third realm-scoped strike (`MOREMI_ANTI_CHEAT_THREE_STRIKE_LIMIT = 3`, `:252`) it issues a **realm-scoped** ban and routes a **platform** ban-review with an appeal — never an automatic global ban from one realm. Realm operators get their own moderation tools (`moremi_nana_moderation_admin_actions`, `:6811` — spectate, freeze, teleport, kick, realm-ban) without ever touching the floor: only a `RealmBan` carries `platform_policy_signal: true`. An operator runs their conduct rules; they cannot opt out of CSAM scanning, age assurance, or a cross-realm ban. ```mermaid flowchart TD subgraph GOV["Eunomia — five-tier governance"] PROP["proposal: draft→deliberation→vote→execution→appeal
plural vote: token/quad/conviction/delegated/…"] FLOOR{{"safety floor (no vote crosses)
minor_protection · csam_blocking
identity_privacy · real_money_firewall"}} PROP --> FLOOR FLOOR -- "violation" --> REJECT[[change refused at every tier]] FLOOR -- "clean" --> EXEC[(rule change executes)] APPEAL["routeProposalAppealToThemis
@themis/arbitration (seam)"] end subgraph TS["Sekhmet — trust & safety for executable UGC"] UP[Creator upload] --> SCAN["scan_artifact + supply-chain
HMAC sign · step-up on republish"] SCAN -- "not clean" --> BLOCK[[blocked: never served]] SCAN -- "clean" --> CSAM["CSAM hash + grooming + age band
block before serve"] CSAM --> GATE["evaluate_distribution_gate
clean ⇒ fetchable"] AC["anti-cheat: authoritative-node only
Clean→Watch→Strike→BanReview"] KY[kuanyin-human-review] --> APPEAL CSAM --> KY AC -->|3rd strike| BANREV[platform ban-review] end EXEC -. "Verified gate: crucible ∧ sekhmet-clean ∧ moderation-clean" .-> GATE FLOOR -. "csam_blocking == Sekhmet posture" .-> CSAM ``` ## Where this connects - [Ixchel: The Sandbox & Executable Modding](./ixchel-sandbox-and-modding.md) — the capability sandbox and content-addressed store that _contain_ the executable UGC Sekhmet's ingest gate stands in front of (sibling). - [Economy Firewall, Commerce & Rights](./economy-firewall-commerce-and-rights.md) — the real-money/play-currency firewall the `real_money_firewall` floor governs, plus the payout-fraud and Crucible-gated `Verified` interlock (sibling). - [../architecture/sekhmet-safety-and-anti-cheat.md](../architecture/sekhmet-safety-and-anti-cheat.md) — the byte-level trust-safety companion: every eval, the ingest gate, child protection, and the anti-cheat verdict engine in depth. - [../architecture/eunomia-governance-and-ori-bridge.md](../architecture/eunomia-governance-and-ori-bridge.md) — the governance-kernel companion and the Ori cross-version identity bridge. - The feature hub: [../V7_features.md](../V7_features.md). - **Real code cited here:** `apps/v7/eunomia-governance-service/src/service.ts` and `src/main.ts`, `apps/v7/sekhmet-scanner/src/lib.rs`, `apps/v7/moremi-realm-server/src/lib.rs`, `apps/v7/mawu-gateway/src/lib.rs`, `libs/v7/realm-protocol/src/lib.rs`, `libs/v7/substrate-bridge/src/lib.rs`, `libs/themis/arbitration`, `libs/themis/privacy`, `libs/kuanyin/community-harmony`, and `scripts/v7/verify-adversarial-eval-gates.mjs`.