# Overview, Product Promise & Design Posture ```mermaid mindmap root((Mawu creator republic)) Build Persistent realms Executable UGC Dependency lock files Host Server authority Migration and recovery Cost-aware scale Govern Capability sandbox Community institutions Appeals and audit Sustain Catalog and discovery Creator economics Accessibility and launch gates ``` Mawu is a republic because creation, operation, governance, and sustainability are one product loop. Executable UGC makes the capability sandbox the precondition for all four branches, while server authority and auditable policy keep one realm from becoming platform authority. This is the orientation page for the V7 feature set — the page to read before any of the deeper feature pages, so that when a later page says "the realm composes its lock file before a client joins" or "a forged envelope is rejected with `UnexpectedMessageKind`," the name already lands on something real you can open. V7 is **Mawu** — an open-world _creator republic_ built on **Unreal Engine 5.5** and a fleet of **Rust** services, layered on top of the existing Oshun platform (the V1 trust spine, the V6 Ori identity, the Maya engine-core). It is one coherent product, and crucially **not a single authored game**: where V2–V6 are experiences Oshun builds, V7 is the _substrate that lets players build, host, govern, roleplay in, and monetize their own persistent worlds_ — and the distribution-and-economy republic that carries them. The unit of play is not a level; it is a **realm**: a server-authoritative, persistent, fully-moddable world that one community owns and others inhabit. The single change that defines V7 — and creates its entire engineering problem — is **executable** user-generated content. V5's workshop is data-only; it "cannot ship executable code." V7 lifts that limit and runs creator-authored logic on other players' machines and servers. That one decision makes safety, sandboxing, identity isolation, and supply-chain integrity the load-bearing wall, not an afterthought. Every feature in this set is downstream of getting that right. This page is the **product-side companion** to the architecture thesis. Where the architecture page [../architecture/thesis-trust-boundary-and-topology.md](../architecture/thesis-trust-boundary-and-topology.md) reconciles the two-plane topology against the compiler — the Cargo workspace, the Wasmtime runtime, the determinism invariant, where each name lives on disk — this page reads the same disk from the player-and-creator angle: what V7 promises someone who builds a world or walks into one, the four commitments that fix the design, and where the product glossary's ambition outruns what is shipped today. The single source of truth for completion state remains the backlog (`V7_TODOS.md`); this page is the index, not the checklist. It is the orientation companion to the feature catalogue at [../V7_features.md](../V7_features.md). ## What ships, honestly **Real and on-disk: the Rust realm plane.** The authoritative half of V7 is a genuine Cargo workspace under `apps/v7/` (`unsafe_code = "forbid"`, Rust 1.82, `resolver = "2"`) of six services plus a dev-hygiene helper, each with a typed `ServiceDescriptor` (name, owner, port, capabilities) and its own `main.rs`: | Service | Port | Size (lines / `#[test]`) | What it really does | | -------------------------- | ----- | ------------------------ | ---------------------------------------------------------------------------------- | | `moremi-realm-server` | 47201 | ~14,900 / 69 | Authoritative sim; embeds **Wasmtime** + **PubGrub** (the Ixchel sandbox/resolver) | | `danu-mesh-cluster` | 47202 | ~3,500 / 22 | Authority handoff, area-of-interest culling, density split/merge | | `nephthys-replica-service` | 47203 | ~3,100 / 15 | Event-sourced state store; snapshot checkpoints, ledger-diff rehydrate | | `mawu-gateway` | 47204 | ~3,400 / 16 | Attested client ingress over WebTransport / WebRTC / WebSocket | | `sekhmet-scanner` | 47205 | ~6,000 / 15 | Static malware + CSAM perceptual-hash + grooming-classifier scan gate | | `hera-social-service` | 47206 | ~1,100 / 7 | Crews/guilds, treasuries, cross-realm bans | The anchor, `moremi-realm-server`, is not slideware: it embeds a real **Wasmtime** component runtime (`config.consume_fuel(true)`, `epoch_interruption(true)`, `store.set_fuel(...)`, `StoreLimitsBuilder`, `nan_canonicalization`, AOT `precompile_component` to a `.cwasm`) and a real **PubGrub** dependency resolver (`pubgrub = "0.3.0"` + `semver = "1.0.28"`), so the WASM sandbox and the SAT resolver the feature docs call "Ixchel" actually run inside the realm server. It ticks on a fixed timestep — `MOREMI_COMBAT_TICK_HZ = 60` for combat zones, `MOREMI_OPEN_WORLD_MIN_TICK_HZ = 10` to `..._MAX_TICK_HZ = 30` for the open world — and guards determinism with `MoremiGoldenReplayCiReport`. Three shared Rust crates under `libs/v7/` carry the cross-service vocabulary. **`realm-protocol`** (~4,400 lines, 30 tests) fixes the wire contract literally: `REALM_DELTA_SNAPSHOT_RING_SIZE = 32`, a `REALM_DELTA_PREFRAGMENT_BYTES = 1_400` cap under the 1500 MTU, `baseline_realm_capabilities()` advertising **20** capabilities, and the server-authoritative invariant in code — a `RealmEnvelope` whose `RealmMessageKind` is anything other than a client intent is rejected with `UnexpectedMessageKind`, and even an intent needs a `RealmSecurityToken` bearing the `realm.intent.submit` scope (`REALM_CLIENT_INTENT_REQUIRED_SCOPE`) before it touches authoritative state; a bandwidth profile that scales with population is a hard `PopulationDependentBandwidth` violation. **`nana`** models a persistent character — `NanaCharacterRecord { ori_id, realm_id, display_name, employment, balances }` with realm-scoped `cash_minor` / `bank_minor` / `society_minor` (`i64` minor units) whose `validate()` refuses to let any balance go negative. **`substrate-bridge`** (~2,500 lines) carries the trust boundary as executable code: the `V7IdentityFirewall` projects a platform principal into a `V7RealmScopedIdentity` whose `opaque_handle` never reveals a platform account id, and `run_trust_boundary_eval` probes the JSON a realm can reach for leaked session tokens and payout credentials. The **contract plane** (`libs/v7/contracts`, TypeScript) registers exactly **10 Zod contracts** in `V7_CONTRACT_REGISTRY` — `Realm`, `RealmLock`, `Character`, `ModCollection`, `Listing`, `Payout`, `Governance`, `ScanReport`, `AgeBand`, `Incident` — each with a schema, fixture, route segment, and TypeScript / Rust / C++ / OpenAPI codegen under `generated/`. The content-addressed realm-lock composer (`realm-lock.ts`) is real: `composeV7RealmLockFile` builds a lock file and `hashV7ContentAddressedPayload` SHA-256-hashes its canonical JSON into a `sha256:` digest, so a realm is a reproducible manifest, not a shipped binary. The **Mawu UE5.5 client** (`V7/ue/`) is six real C++ modules — `MawuCore`, `MawuRealm`, `MawuBuilder`, `MawuVoice`, `MawuUI`, plus the `MawuTests` DeveloperTool — across three build targets. `AMawuComposedRealmActor::ApplyLockFile` takes the very lock file the composer produces and reconstructs it into live `UDynamicMeshComponent` / `UStaticMeshComponent` geometry through UE's GeometryScripting plugin; twelve automation specs (`MawuRealmGeometryTests.cpp`, `MawuRealmBootstrapTests.cpp`) assert the resulting geometry and exact flagship placement. The dedicated server is a separate target (`MawuDedicatedRealmServer.Target.cs`, `Type = TargetType.Server`) that strips `CommonUI` / `EnhancedInput` / `WebBrowser`; both player and server targets use project-module `FPSemanticsMode.Precise`, with `/fp:strict /fp:except-` on Win64. Replay hashes, rather than compiler flags alone, govern determinism. **Where the product glossary outruns the disk** (found by reading both): - **The cross-platform substrate bindings are mostly mocked.** `default_substrate_bindings()` in `substrate-bridge` names thirteen boundaries and labels only **two** `Reused` (compiled and exercised): the **V6 Ori event store + Aye Bridge** and the **Maya engine-core**. The other eleven — V1 identity, Aje economy, Lilith/Kuanyin safety, Themis, Iris, Psyche, Isis, Sophia, Yemaya, and the V6 Egbe realtime gateway — are `Mock`: clean, deterministic local stand-ins, not yet wired to live services. This is by design (it is what lets the trust-boundary and Ori-write evals run without a live deployment), but it means the V1-trust and economy claims below rest on mocked seams today. - **The market and governance plane is a separate stack.** Abundantia and Eunomia ship as TS/NestJS services (`apps/v7/abundantia-market-service`, `apps/v7/eunomia-governance-service`, each with a `package.json`) — they exist, but they are _outside_ the Rust realm fleet and are not yet fused into it. - **`libs/maya/forge-*` are early scaffolds.** The standalone resolver / conflict / sandbox / compositor crates are API stubs; the production sandbox and resolver currently live _inside_ `moremi-realm-server`, not in those crates. - **Headline numbers are product targets, not measured-at-scale results.** "1000+ inhabitants," the 40% engagement-pool payout, the 70% creator revenue floor, and the Pheme voice budgets (≤40 audible streams, p95 ≤250 ms) are committed launch budgets and requirements, not figures benchmarked on shipped fleets. Everything below is grounded in those files; where a claim is the glossary's intent rather than shipped code, it is labelled. ## What V7 is V7 productizes a convergence no single existing platform delivers in one stack: FiveM/Cfx.re's **server-authoritative, community-hosted roleplay**, Roblox's **safe-sandboxed UGC economy**, mod.io's **cross-platform distribution**, and Fortnite/UEFN's **engagement-payout creator economy**. The product layers as a small set of feminine-named subsystems, each owning one responsibility: **Mawu** (the product and the UE5.5 client that renders any realm), **Moremi** (the server-authoritative realm framework, `moremi-realm-server`), **Danu** (server meshing for massive population, `danu-mesh-cluster`), **Nephthys** (the decoupled event-sourced persistence layer, `nephthys-replica-service`), **Nàná** (the persistent-character / jobs / economy framework, `libs/v7/nana`), **Ixchel** (the composable modding runtime and WASM sandbox, embedded in Moremi), **Sekhmet** (executable-UGC trust and safety, `sekhmet-scanner`), **Hera** (the cross-realm social graph), **Abundantia** (the creator republic), and **Eunomia** (multi-tier governance). The full glossary, surface map, and the platform-vs-realm trust boundary are treated in [./glossary-surfaces-and-trust-boundary.md](./glossary-surfaces-and-trust-boundary.md). A **realm** is the thing all of this serves. It bundles a base world, an ordered set of composable Ixchel mod layers, a Nàná configuration (which jobs and institutions are active), a membership policy (open / whitelisted / invite / federated), a governance charter, and a hosting binding — and pins them in an immutable, content-addressed lock file so every joining client composes a byte-identical world. Realms run on a continuum — Solo (1 player, offline), Listen (~16), Dedicated (~256, one authoritative node), and Meshed (1000+, a Danu cluster) — and a realm can be _promoted_ along it without rebuild. The realm model and the meshing/persistence path are detailed in [./realm-model-and-danu-population.md](./realm-model-and-danu-population.md). ## The design posture Four commitments fix the design and resolve the tensions inherent in a "community-run, fully-moddable, server-authoritative world platform." Each is visible in code, not just prose. **1. Server-authoritative by default; the realm owns the truth.** Clients send intent; the realm validates against its rules and Nephthys, then replicates results. This is the precondition for both anti-cheat and persistence. The `realm-protocol` crate encodes it literally: non-intent envelopes that try to mutate state are rejected, and intents carry a scoped `RealmSecurityToken`. A tampered client cannot grant itself money or position because the server, not the client, owns those values. **2. Untrusted code is the threat model, not an afterthought.** Every line of creator logic runs in the Wasmtime sandbox inside `moremi-realm-server`, under per-tick fuel/memory/`StoreLimits` budgets and capability-gated engine access, across the six declared tiers (DataOnly → Scripted → Extended → System → Native → Trusted); a realm declares the maximum tier it grants and the compositor refuses to load a resource that demands more. Every uploaded artifact passes the Sekhmet scan gate — static malware signatures, CSAM perceptual-hash ingest, a grooming-classifier path, and realm-pinpoint quarantine — before any other machine can fetch it. The 2023 _fractureiser_ supply-chain attack is the named failure this pipeline is designed never to repeat. **3. Composable layers, never load order.** Mods are composable layers resolved by **intent**, not file precedence: the PubGrub resolver SAT-solves the dependency graph into a reproducible lock file (and emits a human-readable explanation when it cannot, rather than a silent crash), and the compositor applies layers in a fixed priority order with per-field provenance. "Load order" — the fragile file-override war every competitor fights — never enters the player's vocabulary. **4. Creators are paid, communities self-govern.** A platform that asks players to build and write code must let them earn from it and rule it. V7 ships the creator economy (engagement pool + direct sale + dependency-revenue chains, settled through Aje) and five-tier governance (platform → game → realm → server → guild) with Themis adjudicating disputes. _Honest status:_ Abundantia and Eunomia exist as TS/NestJS services, but the Aje settlement binding is a mock today — this commitment is the most spec-forward of the four. Binding all four is a fifth, cross-cutting invariant the architecture treats as load-bearing: **determinism**. Rollback prediction, atomic mesh handoff, and replayable creator plugins all demand a deterministic simulation core, so it is locked down once — fixed timestep, seeded RNG, Wasmtime fuel + NaN canonicalization, strict client floating point, and a golden-replay CI gate that passes only when a recorded input log reproduces the exact authoritative `state_hash` _and_ a perturbed probe fails to. ## The product promise V7's promise is **a world you don't just play — one you build, host, rule, and live a second life inside, safely.** The catalogue states it as a set of commitments; each rests on code, or is labelled where it is still intent: - **Build the world, don't just play it.** Any player authors a realm's terrain, rules, jobs, and laws in Mawu Studio and publishes it. The realm is captured as a content-addressed lock file (`composeV7RealmLockFile`) and rebuilt into live geometry client-side (`ApplyLockFile`) — both real and tested. - **Host your own server, on your own terms.** The hosting continuum from Solo to Meshed is the Moremi/Danu path; Danu's handoff and area-of-interest evals move 200 entities 10,000 times without loss or reconnect and bound 1000-inhabitant working sets — real evals, with "1000+ at a stable frame budget" the launch target. - **Live a second life — a real roleplay.** A character is a `NanaCharacterRecord` backed by a V6 Ori identity, with jobs, realm-scoped balances, and (the feature-doc layer) housing, vehicles, and civic institutions — law/EMS/business as reference resources on the Nàná core. - **Mod everything, without load order.** The composable-layer model, PubGrub resolution, and the reproducible lock file are real in `moremi-realm-server` and `realm-lock.ts`. - **Run untrusted code safely.** The six-tier Wasmtime sandbox and the Sekhmet scan gate are real and on-disk; the engineering goal is that the next _fractureiser_ cannot happen here. - **Get paid for what you make / communities govern themselves / one identity, every world.** Abundantia's three earning paths, Eunomia's five governance tiers, and cross-realm/cross-version character portability via the Ori passport. _Status:_ the services exist; the Aje and V1-identity bindings are mocked, so these are the most spec-forward promises. - **V1 trust at platform scale.** Identity boundaries (Iris), grounded generation (Isis + Sophia), persona and crisis-aware safety (Lilith), guardianship (Kuanyin), and adjudication (Themis) govern every realm — _today via the mock bindings in `substrate-bridge`_, behind a `V7IdentityFirewall` that is itself real and exercised by the trust-boundary eval. A realm sets rules _above_ the platform safety floor, never below it. - **Degrades safely.** If meshing is unavailable a realm falls back to a single authoritative node at a reduced cap; a faulting script is isolated and disabled without crashing the session; an installed realm stays playable offline in Solo. ## Where to read next - The subsystem glossary, the product surfaces, and the platform-vs-realm trust boundary in depth: [./glossary-surfaces-and-trust-boundary.md](./glossary-surfaces-and-trust-boundary.md). - The realm model, the hosting continuum, and Danu meshing / Nephthys persistence as player features: [./realm-model-and-danu-population.md](./realm-model-and-danu-population.md). - The architecture thesis, the two-plane topology, and the determinism invariant — the technical companion to this page: [../architecture/thesis-trust-boundary-and-topology.md](../architecture/thesis-trust-boundary-and-topology.md). - The feature catalogue this page indexes: [../V7_features.md](../V7_features.md).