# Subsystem Glossary, Surfaces & the Trust Boundary ```mermaid flowchart LR Creator[Creator Studio] --> Package[Signed realm package] Package --> Resolver[Dependency and lock-file resolver] Resolver --> Sandbox[Fuel-limited WASM sandbox] Sandbox --> Realm[Server-authoritative realm plane] Realm --> Client[UE5 client] Realm --> Platform[Platform control plane] Platform --> Identity[Identity and policy] Platform --> Market[Catalog and settlement] Realm -. no direct authority .-> Market ``` The trust boundary sits between executable realm code and platform authority. Creator packages may influence their sandboxed realm, but identity, policy, catalog, and settlement stay outside that authority and are reached only through explicit capabilities. This is the orientation page for the V7 feature set — the page to read before any of the deep feature pages, so that when a later page says "the realm composes a `FMawuRealmLockFile`," "a character's `cash_minor` never goes negative," or "the realm server runs `moremi-realm-server` on port 47201," the name already lands on something real you can open. V7 — codename **Mawu** — is Oshun's open-world _creator republic_: a UE5.5 LTS client plus a fleet of Rust services that let community creators author, host, and run their own persistent, server-authoritative realms, with **executable** user-generated content rather than just data. Its scope is split across a small number of durable **surfaces**: one Unreal project with three build targets, a Rust workspace of realm-plane services, a Rust workspace of shared crates, a TypeScript contracts plane, two TypeScript market/governance services, and a web Studio tile. Every feature this set documents ultimately resolves to code in one of those surfaces. The job of this page is to give you the map: the subsystem names and where they live in code, the product surfaces and their target paths, and the platform-vs-realm trust boundary that is the single most consequential decision in the design. It is the **product-side companion** to the architecture thesis. Where the architecture page [../architecture/thesis-trust-boundary-and-topology.md](../architecture/thesis-trust-boundary-and-topology.md) reconciles the module graph, the determinism contract, and the topology diagram against the compiler, this page reads the same disk from the player-and-creator angle: which named subsystem delivers which advertised capability, and — kept honest throughout — where the glossary's name and the disk's reality diverge. The single source of truth for completion state remains the backlog; this page is the index, not the checklist. It is the foundations companion to the feature catalogue at [../V7_features.md](../V7_features.md). ## What ships, honestly **Real and on-disk.** The realm plane is a Cargo workspace (`apps/v7/Cargo.toml`, `unsafe_code = "forbid"`) of six Rust services, each with a `ServiceDescriptor` (name, owner, port, capabilities) and its own `main.rs`. The anchor is **`moremi-realm-server`** (port 47201, **14,883 lines, 69 `#[test]` blocks**): it embeds a genuine **Wasmtime 45** runtime (`config.consume_fuel(true)`, `nan_canonicalization: true`, `StoreLimitsBuilder`) and a genuine **PubGrub** resolver (`pubgrub = "0.3.0"` + `semver`), so the WASM sandbox and dependency resolver the docs call "Ixchel" are not slideware — they run inside the realm server. Alongside it: `danu-mesh-cluster` (47202, 22 tests), `nephthys-replica-service` (47203, 15 tests), `mawu-gateway` (47204, 16 tests), `sekhmet-scanner` (47205, 15 tests), and `hera-social-service` (47206, 7 tests). Three shared crates under `libs/v7/` (`nana`, `realm-protocol`, `substrate-bridge`) carry the cross-service vocabulary — `realm-protocol` alone runs **30 tests** over envelopes, prediction, snapshot interpolation, delta compression, and lag compensation. The contracts plane `libs/v7/contracts` registers **10 Zod contracts** (`V7_CONTRACT_REGISTRY`) and a content-addressed realm-lock composer (`realm-lock.ts`). The **Mawu UE5.5 client** (`V7/ue/`) is six C++ modules across three build targets that compose a realm _lock file_ into live procedural geometry. **Genuinely reused (compiled, not mocked).** `substrate-bridge`'s `default_substrate_bindings()` labels exactly **two of thirteen** boundaries `Reused`: the **V6 Ori event store + Aye Bridge** (`apps/v6/egbe-ori-service + libs/v6/aye-bridge`) and the **Maya engine-core** (`libs/maya/engine-core/crates/maya-world`). These link and execute real upstream code, which is why the trust-boundary and identity-firewall evals run end to end without a live platform deployment. **Where the product glossary and the disk diverge** (found by reading both): - **The glossary labels `nana` "TS + Rust"; the crate is Rust-only.** `libs/v7/nana/` contains exactly `Cargo.toml`, `project.json`, and `src/lib.rs` — no TypeScript. The "TS" half of Nàná is the `Character` Zod contract inside `libs/v7/contracts`, not the crate. - **Abundantia and Eunomia are labelled "TS/NestJS"; on disk they are framework-free TypeScript.** `apps/v7/abundantia-market-service` (4,552-line `service.ts`) and `apps/v7/eunomia-governance-service` (1,574-line `service.ts`) declare no `@nestjs`/`express`/`fastify` dependency at all — their only deps are `@types/node`, `tsx`, `typescript`, `vitest`. They are real, substantial domain services started with `tsx src/main.ts`, just not Nest apps. - **Three advertised surfaces do not exist yet.** `apps/v7/mawu-web` (Pixel Streaming player), `apps/v7/mawu-web-fallback` (three.js/WebGPU spectator), and the `apps/oshun/admin/src/app/mawu` Operator Console are **absent** — planned surfaces, not shipped paths. - **`libs/maya/forge-*` are scaffolds; the production runtime is inside Moremi.** All four (`forge-resolver`, `forge-conflict`, `forge-sandbox`, `forge-compositor`) exist as early API crates, but the resolver and sandbox that actually gate live realms are the PubGrub + Wasmtime code _inside_ `moremi-realm-server`. Everything below is grounded in those files; where a claim is the glossary's intent rather than shipped code, it is labelled. ## The subsystem glossary, mapped to code The product glossary in [../V7_features.md](../V7_features.md) names eleven platform substrates. Here each is resolved to the directory that implements it, with the load-bearing symbols named and the honest caveats kept. | Glossary subsystem | On disk | Anchor symbols / files | Notes | | ------------------ | --------------------------------------------- | ------------------------------------------------------------------------------ | ------------------------------------------------------------------------- | | **Mawu** | `V7/ue/` (6 modules, 3 targets) | `Mawu.Target.cs`, `AMawuComposedRealmActor::ApplyLockFile` | The product brand + canonical UE5.5 client; renders any realm | | **Moremi** | `apps/v7/moremi-realm-server/` (47201) | `DESCRIPTOR`, Wasmtime config, `pubgrub` | Authoritative sim; the **real** WASM sandbox + resolver live here | | **Danu** | `apps/v7/danu-mesh-cluster/` (47202) | `DESCRIPTOR`; authority handoff, split/merge | Server meshing for 1000+ inhabitants | | **Nephthys** | `apps/v7/nephthys-replica-service/` (47203) | `DESCRIPTOR`; event-sourced store | Decoupled, crash-resilient source of truth | | **Pheme** | `apps/v7/mawu-gateway/` (47204) + `MawuVoice` | `DESCRIPTOR`; positional voice SFU | Not a standalone service — voice rides the gateway; client is `MawuVoice` | | **Nàná** | `libs/v7/nana/` (Rust) + `Character` contract | `NanaCharacterRecord`, `cash_minor`/`bank_minor`/`society_minor`, `validate()` | Glossary says "TS+Rust"; crate is **Rust-only** | | **Hera** | `apps/v7/hera-social-service/` (47206) | `DESCRIPTOR`; crews, treasuries, cross-realm bans | 5 s ban-propagation SLA | | **Ixchel** | `libs/maya/forge-*` + inside Moremi | `forge-resolver`/`-conflict`/`-sandbox`/`-compositor` | `forge-*` are **scaffolds**; production runtime is in Moremi | | **Abundantia** | `apps/v7/abundantia-market-service/` | `service.ts` (4,552 lines) | Glossary says NestJS; on disk **plain TS** | | **Eunomia** | `apps/v7/eunomia-governance-service/` | `service.ts` (1,574 lines) | Plain TS; proposals + plural voting | | **Sekhmet** | `apps/v7/sekhmet-scanner/` (47205) | `DESCRIPTOR`; static/dynamic scan | Malware, CSAM/grooming, supply-chain integrity | ### The realm plane — six Rust services The five rows the rest of the feature set leans on hardest — Moremi, Danu, Nephthys, the gateway (Pheme's transport), and Hera — are the authoritative backbone, and they are _trust-segregated_ from the platform. Each carries a `pub const DESCRIPTOR: ServiceDescriptor` fixing its `name`, `owner`, and `port`, and the workspace forbids `unsafe`. **Moremi** is the anchor: a dual-tick loop (`MOREMI_COMBAT_TICK_HZ = 60` for combat zones, `MOREMI_OPEN_WORLD_MIN_TICK_HZ = 10` up to a 30 Hz ceiling, a fixed-timestep baseline of 30) over a deterministic core, with the Wasmtime + PubGrub runtime that makes "run untrusted code safely" literal. **Danu** hands authority between mesh nodes and splits/merges them under load; **Nephthys** is the event-sourced store that survives a sim node crashing; the **gateway** is the single client ingress and therefore the one place interest management and rate limiting are enforced — and the carrier for **Pheme** positional voice. **Hera** owns the persistent social graph and the cross-realm ban that the trust boundary requires. The deep treatment is [../architecture/moremi-realm-server-and-netcode.md](../architecture/moremi-realm-server-and-netcode.md) and its mesh/persistence companion. ### The market, governance, and safety plane `abundantia-market-service` and `eunomia-governance-service` are the **market/governance plane** — outside the Rust realm fleet by design, because catalog, payouts, proposals, and voting are platform concerns, not realm gameplay. Both are substantial TypeScript domain modules (Abundantia's `service.ts` models console-authorization status, artifact kinds, and browser sorts across `pc`/`xbox`/`playstation`/`switch`/`cloud`), the glossary's "TS/NestJS" label notwithstanding. **Sekhmet** (`sekhmet-scanner`, 47205) sits on the platform side of the boundary: nothing reaches a client unscanned. The deep pages are the Abundantia economy-firewall and Eunomia governance architecture companions. ### Ixchel — the modding runtime that lives in two places Ixchel is the one subsystem whose name maps to two locations, and the split is the most important caveat on this page. The four `libs/maya/forge-*` crates are the _advertised_ home, and they exist — but they are early API scaffolds (the resolver's own docs say the full V7 resolver "will use PubGrub"). The runtime that actually resolves dependencies and sandboxes creator code for a live realm is the PubGrub + Wasmtime code **inside `moremi-realm-server`**. Read the modding runtime as a product feature in [./ixchel-sandbox-and-modding.md](./ixchel-sandbox-and-modding.md); read its engineering in [../architecture/ixchel-modding-runtime-and-wasm-sandbox.md](../architecture/ixchel-modding-runtime-and-wasm-sandbox.md). ### The shared vocabulary crates Three crates under `libs/v7/` and one TS plane carry the cross-service contract, and the rest of the feature set names them constantly: - **`nana`** — the roleplay record. `NanaCharacterRecord` holds realm-scoped balances (`cash_minor`, `bank_minor`, `society_minor` as `i64` minor units) whose `validate()` refuses to let any go negative. This is the **play-currency** that is structurally non-fungible with the real-money economy. - **`realm-protocol`** — the wire contract (30 tests). It advertises **20 baseline capabilities** (`baseline_realm_capabilities()`) and fixes the numbers every transport must honor: a 32-snapshot ring (`REALM_DELTA_SNAPSHOT_RING_SIZE = 32`), a 1,400-byte pre-fragment cap (`REALM_DELTA_PREFRAGMENT_BYTES`), and the rule that a `RealmEnvelope` whose `RealmMessageKind` is anything but a scope-bearing `ClientIntent` is rejected with `UnexpectedMessageKind`. - **`substrate-bridge`** — the boundary to the rest of Oshun. Its `V7Substrate` enum names **thirteen** upstream boundaries; `default_substrate_bindings()` marks the V6 Ori/Aye Bridge and Maya engine-core `Reused` and the other eleven (the V1 platform plus the V6 Egbe gateway) `Mock` — clean local stand-ins, not fake "fully wired." This crate also holds the `V7IdentityFirewall` and the trust-boundary evals (below). - **`contracts`** — `V7_CONTRACT_REGISTRY` (10 Zod contracts: `Realm`, `RealmLock`, `Character`, `ModCollection`, `Listing`, `Payout`, `Governance`, `ScanReport`, and two more) with a content-addressed `composeV7RealmLockFile` whose `hashV7ContentAddressedPayload` is a `sha256:` digest over canonical JSON. ### Cross-domain substrates (carried from V1/V3/V5/V6) The cross-domain names the docs use — **Ori** (portable identity), **Maya** (the engine), **Aje** (commerce/payouts), **Lilith** (safety/persona), **Kuanyin** (moderation), **Themis** (adjudication), **Isis** (governed generation), **Sophia** (grounding), **Iris** (memory boundaries), **Psyche** (live agent runtime), and **Yemaya** (non-real-time media) — are exactly the boundaries the `V7Substrate` enum pins to a concrete `package_ref`. The honesty already noted is that all but Ori/Aye Bridge and Maya engine-core are `Mock` today. ## Product surfaces The user-facing entry points map to target paths as follows; paths are real today except where marked **planned**: | Surface | Target path | State | | ------------------------------------- | ------------------------------------------------- | --------------------------------------------------------------------------- | | Mawu UE5 client (canonical) | `V7/ue/` | Real — 6 C++ modules, 3 targets | | Web entry via Pixel Streaming | `apps/v7/mawu-web/` | **Planned — not created** | | Tier-2 web fallback (three.js/WebGPU) | `apps/v7/mawu-web-fallback/` | **Planned — not created** | | Moremi realm server framework | `apps/v7/moremi-realm-server/` | Real — Rust, 47201 | | Danu meshing fleet | `apps/v7/danu-mesh-cluster/` | Real — Rust, 47202 | | Nephthys persistence layer | `apps/v7/nephthys-replica-service/` | Real — Rust, 47203 | | Gateway + Pheme voice SFU | `apps/v7/mawu-gateway/` | Real — Rust, 47204 | | Sekhmet trust-and-safety scanner | `apps/v7/sekhmet-scanner/` | Real — Rust, 47205 | | Hera social-graph service | `apps/v7/hera-social-service/` | Real — Rust, 47206 | | Abundantia distribution + economy | `apps/v7/abundantia-market-service/` | Real — plain TS | | Eunomia governance service | `apps/v7/eunomia-governance-service/` | Real — plain TS | | Mawu Studio (creator tools) | `apps/oshun/web/src/app/mawu-studio/` + UE Editor | Real — `accessibility/`, `localization/` subroutes wired to `@v7/contracts` | | Mawu Operator Console | `apps/oshun/admin/src/app/mawu/` | **Planned — not created** | **The canonical client (`V7/ue/`).** Three build targets — `Mawu.Target.cs` (game), `MawuDedicatedRealmServer.Target.cs` (`Type = TargetType.Server`, which strips `CommonUI`/`EnhancedInput`/`WebBrowser` so the headless authority ships no player UI), and `MawuEditor.Target.cs` — over six modules: `MawuCore`, `MawuRealm`, `MawuBuilder`, `MawuVoice`, `MawuUI`, and the `MawuTests` DeveloperTool. The load-bearing claim is that the client **builds worlds from data**: `AMawuComposedRealmActor::ApplyLockFile(const FMawuRealmLockFile&)` takes the very lock file `realm-lock.ts` composes and reconstructs it into procedural geometry, so a realm is a content-addressed manifest, not a shipped binary level. **Mawu Studio** is the one creator surface that is real and reachable today: `apps/oshun/web/src/app/mawu-studio/` renders `MawuStudioAccessibilityWorkspace` from a `runV7MawuAccessibilityEval` fixture imported from `@v7/contracts`, so the web Studio is genuinely wired to the contracts plane, not mocked HTML. ## The trust boundary — platform vs. realm The most consequential design decision in V7 is **who runs the authoritative server**, and the answer is a deliberate hybrid that splits along _trust_, not hosting. FiveM is community-hosted and so can never be trusted with identity, economy, or safety; Roblox is platform-hosted and so owns all compute. V7 keeps **platform-hosted, inviolable services for identity, the real-money economy, client integrity, and child-safety; community-hosted realm logic only, and only as capability-sandboxed WASM behind a hardened, attested client an operator cannot patch.** A realm operator is assumed potentially hostile. These concerns are **never** delegated to a realm — they live on the platform plane behind the gateway: platform identity/auth (a realm sees only an opaque per-realm handle), the real-money economy and payouts (settle through Aje, never touch a realm process), client integrity and anti-tamper, child-safety/CSAM/age assurance, cross-realm bans and reputation, and asset malware scanning. What a realm **does** own: its world, rules, scripts, content, jobs, in-realm play-currency, and moderation _above_ the platform safety floor — all inside the Ixchel sandbox. What makes this product-side and not aspirational is that the boundary is **executable** in `substrate-bridge`. The `V7IdentityFirewall::project()` projects an authenticated principal into a `V7RealmScopedIdentity` whose `opaque_handle` is a real **HMAC-SHA256** of `(pepper, schema_version, tenant_id, user_id, realm_id)` — the realm never sees a platform account id, which defeats both spoofing and realm-hop ban evasion. The `run_trust_boundary_eval` harness renders the exact JSON a realm process can reach and probes it with a hostile corpus hunting for the session token, payout credential, and the field names that would carry them; the report passes only when no term leaks. The same realm side keeps gameplay in a _structurally separated_ currency: the `cash_minor` / `bank_minor` / `society_minor` balances on `NanaCharacterRecord` are realm-scoped `i64`s that a hostile operator can mint or seize inside their own world without ever touching real money or another realm's ledger. The technical enforcement — the webview escape eval, the event-tamper `state_hash` proof, the determinism contract — is detailed in the architecture companion [../architecture/thesis-trust-boundary-and-topology.md](../architecture/thesis-trust-boundary-and-topology.md). ## Cross-reference conventions The whole feature set uses a single citation grammar so a reference is never ambiguous about which document it points into: - **Bare `§N` / `§N.M` → `V7_TODOS.md`** — the backlog is the only V7 document with section ids used as hyperlinks. - **`deps§N` → `V7_DEPENDENCIES.md`**; **`arch§""` → `V7_ARCHITECTURE.md`** by named anchor; **`features§""` → this document set** by named anchor. - **`maya§""` → `DOMAINS/maya/features.md`**; **`v5§N`/`v6§N`** → the respective prior backlogs. `V7_features.md` and the architecture pages use **named anchors, not numbers**, precisely so they never drift from the backlog's numbering scheme. ## Where to go next - The promise these foundations serve, and the product posture in depth: [./overview-promise-and-posture.md](./overview-promise-and-posture.md). - The modding runtime as a creator feature — composable layers, the six-tier WASM sandbox, PubGrub locks, and Collections: [./ixchel-sandbox-and-modding.md](./ixchel-sandbox-and-modding.md). - The thesis, the executable trust boundary, the topology, and the determinism contract: [../architecture/thesis-trust-boundary-and-topology.md](../architecture/thesis-trust-boundary-and-topology.md). - The feature catalogue this page indexes: [../V7_features.md](../V7_features.md).