---
title: Virtual Realm Local City Operations View
description: Owner-private isometric and eagle-eye operations, local minimap projection, zone management proposals, and connected-Cityform exclusion.
audience: product architects, runtime developers, security reviewers, RealmForge authors, and QA engineers
updated: 2026-08-13
status: approved planning baseline
---

# Virtual Realm Local City Operations View

The Virtual Realm has exactly two approved presentation modes:

1. **Grounded Traveler mode** is the ordinary first-person world. Exploration, visitors, multiplayer encounters, bridge traversal, Code Matter inspection, and Chronicle replay remain first person.
2. **Local City Operations View** is an explicitly entered, owner-private management projection for exactly the local operator's own Cityform. It provides bounded isometric and eagle-eye framing and may also supply a local minimap while the operator remains in first person.

The Operations View is not third-person Traveler play. It does not follow an avatar, create another traversal controller, expose a free camera, or provide a way to survey another user's Cityform.

## Non-negotiable boundary

An Operations View exists only when all of these conditions hold:

- The current WebGPU OS identity is authenticated as a local operator for the viewed Realm.
- An active, nonzero, local operator capability epoch and authority receipt permit the view.
- The only representable Realm reference is `localRealmId`; there is no separate viewed-Realm field that could name another Cityform.
- The audience is exactly `owner-private` and disclosure is exactly `local-private`.
- The active private bake, spatial-layout receipt, policy revision, loaded-cell set, and dynamic revision all verify.
- Entry is an explicit local user action. A Storylet, remote message, station event, link, or proximity event cannot enter the mode.

Expiry, revocation, owner-identity change, active-bake replacement, policy mismatch, device loss, or invalid projection tears down the view and restores a collision-safe first-person anchor.

## Structural connected-Cityform exclusion

Connected content is excluded before ECS, HLOD, culling, picking, object-ID, draw-list, minimap, accessibility, or telemetry assembly. The filter admits no:

- Remote or connected Cityform ID.
- `PublicRealmShell` resource or revision.
- Remote `RealmPose` or Cityform transform.
- `PresenceSession`, RendezvousFrame, or bridge resource or epoch.
- Remote Traveler identity, appearance, presence grant, pose, or marker.
- Remote district, route, destination, topology, collision, navigation, glyph, text, audio, or Storylet record.

The local SecureMesh Exchange remains part of the owner's city. Its local building, platforms, and gates may appear as local landmarks. A platform may show a content-free local boundary status such as idle, occupied, degraded, or closed, but the Operations View does not show the connected City's identity, shell, location, geometry, route beyond the local socket, or destination board. Detailed encounter and network presentation remains in grounded first person.

An exclusion receipt reports zero **included** connected Cityforms, remote shells, rendezvous frames, bridges, and Travelers. Those zeros do not report how many remote objects actually exist; they prove that none entered this projection.

```mermaid
flowchart LR
  privateBake["Verified local PrivateRealmBake"] --> localFilter["Owner-private local-Realm filter"]
  localDelta["Authorized local RealmDynamicStore"] --> localFilter
  loadedCells["Verified loaded local cells"] --> localFilter
  authority["Current local operator authority"] --> localFilter

  remoteShells["Remote shells and Cityforms"] -. "structurally rejected" .-> localFilter
  rendezvous["Presence, rendezvous, bridges, Travelers"] -. "structurally rejected" .-> localFilter

  localFilter --> viewSnapshot["LocalOperatorViewSnapshotV1"]
  localFilter --> minimap["LocalCityMinimapSnapshotV1"]
  viewSnapshot --> camera["Bounded local operations camera"]
  minimap --> mapFrame["Owner-private minimap"]

  pick["Stable local zone pick"] --> proposal["LocalZoneManagementProposalV1"]
  proposal --> adapter["LocalZoneManagementActionAdapter"]
  adapter --> generic["RealmActionProposalV1"]
  generic --> kernel["Owning authority"]
  kernel --> observation["Authority receipt and authoritative observation"]

  camera -. "never grants authority" .-> none["No reverse authority edge"]
  mapFrame -. "never grants authority" .-> none
```

## Camera behavior

The local operations camera is independently authored Realm code. It does not reuse or adapt a Playground, editor, orbit, director, debug, or free-flight camera.

- Isometric mode uses a policy-bounded pitch, altitude, zoom, and local Cityform framing volume.
- Eagle-eye mode uses the same local bounds with a steeper policy-bounded pitch.
- Pan and zoom clamp to the verified local Cityform bounds and loaded-cell policy.
- Heading changes, if enabled, snap only to policy-approved orientations; continuous orbit is not a release input.
- The camera never crosses a local Realm boundary, follows a Traveler, enters a remote shell, or reveals content by changing angle or LOD.
- Entering Operations View stores the current first-person anchor. Exiting restores that anchor when still compatible or uses the collision-safe Root Spine fallback.
- The first-person controller remains the sole traversal controller and receives no movement input while the Operations View is active.

Camera state is presentation state. It cannot change a bake, capability, disclosure class, collision result, navigation graph, zone state, or authoritative observation.

## Local minimap

The minimap is a second rendering of `LocalCityMinimapSnapshotV1`, not a scan, graph query, or remote-world view. It may appear as a visor element in first-person mode or as part of the Operations View.

It contains only bounded, canonically ordered local records:

- Local zones and their local anchors and cells.
- Local roads and routes whose endpoints both resolve inside the admitted local map.
- Local landmarks such as the Root Spine and SecureMesh Exchange.
- Current local availability, alert, and loaded-cell presentation state.

It contains no readable source, private path text, process arguments, packet data, remote identity, destination, bridge geometry, or remote topology. It uses the same safe-text, semantic-state, and accessibility rules as the world. Panning the map never triggers a filesystem scan, protected source read, public-shell fetch, rendezvous query, or network discovery.

## Zone selection and management

`select-zone` and `focus-zone` change local presentation only. They select stable local zone IDs and frame them without changing world truth.

V1 defines three management proposal classes:

- `set-zone-visibility` requests an owner-private visible, dimmed, or hidden presentation policy.
- `set-zone-alert-threshold` requests a bounded metric threshold using `RealmMetricValueV1` units and quality rules.
- `request-zone-rebake` requests that the independent RealmForge bake application consider a named source generation and canonical local anchor set.

The Operations View cannot directly apply any of them. `LocalZoneManagementActionAdapter` first verifies the current policy, view snapshot, local Realm, local target zone, bake, layout, target revision, lifetime, and idempotency key. The view-session capability and the `manage-local-zone` capability are separate grants with independent nonzero epochs; possessing the former never implies the latter. A rebake request additionally proves every requested anchor is owned, loaded, and visible in the accepted local snapshot. The adapter then creates the corresponding generic `RealmActionProposalV1`. The owning WebGPU OS or RealmForge authority may allow, deny, expire, reject, or supersede it. Completed presentation waits for the existing authority receipt and authoritative observation chain.

No generic arbitrary zone mutation, script execution, filesystem write, permission bypass, network control, bridge control, remote-city management, or direct RealmForge document edit exists.

## Flat contracts and peers

M0 freezes four additional independently owned contracts:

| Contract | Purpose |
| --- | --- |
| `LocalOperatorViewPolicyV1` | Exact local Realm, owner, allowed modes, camera bounds, minimap limits, zone actions, and no-authority interaction rules |
| `LocalOperatorViewSnapshotV1` | Current authority-bound local view, private bake/layout and content-bound local-operations lookup binding, bounded camera, admitted local cells/anchors/zones, and exclusion receipt |
| `LocalCityMinimapSnapshotV1` | Referentially closed local zones, routes, landmarks, bounds, cells, exact trusted lookup projection, and exclusion receipt |
| `LocalZoneManagementProposalV1` | Powerless local-zone request with exact action parameters, revisions, authority precondition, lifetime, and idempotency |

Runtime implementation remains flat. `VirtualRealmEntry` injects:

- `LocalOperatorViewPolicyStore`
- `LocalOperatorViewProjector`
- `LocalOperatorCameraController`
- `LocalCityMinimapProjector`
- `LocalZoneSelectionStore`
- `LocalZoneManagementActionAdapter`

No peer constructs or imports another concrete peer. The first-person and operations controllers share no mutable camera object; the composition root transfers an immutable transition record at a frame barrier.

## RealmForge relationship

RealmForge M1 compiles a bounded local zone, anchor, cell, landmark, and route lookup resource into the `PrivateRealmBake`. The Operations View and minimap derive only from that verified private resource plus authorized local deltas. They are not new bake audiences, public shells, or access refinements, and they never influence the public bake.

The local map derivative has its own content ID and dependency closure. It includes no plaintext source bytes. Exact Code Matter reveal remains a close-range first-person inspection operation under a local reveal lease.

## Accessibility and privacy

- Keyboard, mouse, gamepad, screen-reader semantics, high contrast, and non-color alerts cover every required operation.
- Reduced motion replaces animated ascent/descent with a bounded fade and spatial orientation summary.
- The minimap has a DOM semantic equivalent with local zones, local routes, selection, alerts, and scale.
- A visible owner-private indicator remains present for the entire Operations View.
- In-application streaming, remote-control, public screenshot publication, and Chronicle sharing do not accept Operations View frames or snapshots.
- The browser cannot prevent operating-system screenshots, screen recording, or human observation. The owner-private indicator and documentation state that limitation directly.

## Certification summary

Release requires proof that:

- Exactly the two approved modes exist and only first-person controls traversal.
- Entry requires current local identity, capability, authority receipt, private bake, layout, and policy.
- Foreign Realm, public, refinement, replay, stale, zero-epoch, and expired inputs fail closed.
- Different connected-Cityform populations produce byte-identical local snapshots and minimaps for identical declared local input.
- Connected Cityform IDs and resources are absent from CPU snapshots, GPU resources, object-ID buffers, picks, accessibility output, captures, and telemetry.
- Minimap routes have no dangling or foreign endpoint and every admitted zone, anchor, and landmark resolves through loaded local cells.
- Camera, map, selection, and Storylets cannot grant authority or claim a management result.
- Revocation, policy replacement, bake transition, device loss, and exit dispose operations resources exactly once and safely restore first-person state.

## See also

- [Architecture and ownership](architecture.md)
- [Contract catalog](contracts.md)
- [World projection grammar](world-projection.md)
- [Rendering and experience](rendering-experience.md)
- [Security and privacy](security-privacy.md)
- [Certification plan](certification-plan.md)