---
title: Virtual Realm Security and Privacy
description: Authority, noninterference, public shells, protected source, hostile manifests, metadata, capabilities, epochs, telemetry, and threat invariants.
audience: security reviewers, network developers, architects, and QA engineers
updated: 2026-08-13
status: approved planning baseline
---

# Virtual Realm Security and Privacy

The Virtual Realm treats privacy as an architectural property rather than a visual effect. Public presence, private truth, capability-refined access, Code Matter, Storylets, and multiplayer each have explicit authority and audience boundaries.

## Core invariants

1. A public Cityform is a complete-looking sanitized representation, not an exact private PC model.
2. Private, public, and refinement artifacts compile independently.
3. Changing private-only state cannot change the public shell while public inputs remain identical.
4. Discovery is not identity.
5. Identity is not authority.
6. Proximity grants nothing.
7. Every bridge direction receives a separate capability intersection.
8. Capabilities are object-bound, action-specific, expiring, and default-deny.
9. Security state changes before the corresponding visual state.
10. Every protected packet and refinement binds a current epoch.
11. Bridge geometry is presentation, not enforcement.
12. Remote visual data is hostile input.
13. Public presence is explicit and rate-limited.
14. Chronicles and telemetry are privacy boundaries.
15. Revocation stops future access but cannot erase data already disclosed.
16. Local operator identity is not sufficient by itself; the Operations View requires a current local authority receipt and positive capability epoch for the exact local Realm.
17. The Operations View and minimap are `owner-private + local-private`, are never published or transported, and admit no connected-Cityform or remote-world record.
18. Camera position, map visibility, selection, picking, and local presentation never grant zone-management authority.

## Local Operations View privacy boundary

The local Operations View is more sensitive than a public Cityform shell because it derives from the authorized private bake. Its input closure is constructed independently before ECS and rendering. It contains only the exact local Realm, current private bake/layout, admitted local cells, local deltas, and current operator authority. It does not load a mixed encounter scene and hide remote objects afterward.

Connected Cityforms, public shells, remote poses, PresenceSessions, RendezvousFrames, bridges, remote Travelers, station destinations, remote routes, and their IDs are structurally impossible in `LocalOperatorViewSnapshotV1` and `LocalCityMinimapSnapshotV1`. The local station building may remain as local geography, but any external connection terminates at a content-free local boundary marker.

The snapshots never leave the local runtime through SecureMesh, public presence, Chronicle sharing, telemetry, crash reporting, or an in-application streaming surface. The renderer, accessibility projection, object-ID buffer, picking system, and minimap all consume the same accepted local-only closure. A hidden remote GPU buffer or pick record is still a privacy failure even if no visible pixel shows it.

The application cannot prevent operating-system screenshots, screen recording, a compromised same-origin context, or human observation of an unlocked owner-private view. It displays a persistent owner-private indicator, minimizes lifetime, tears down resources on exit or revocation, and makes that limitation explicit.

## Threat model

| Threat | Required defense and honest limitation |
| --- | --- |
| Curious unauthenticated peer | Receives only a rate-limited beacon and explicitly public shell data |
| Authenticated peer without consent | May remain a destination-board entry; no Traveler, bridge, or private destination appears |
| Authorized peer exceeding its grant | Object, action, direction, audience, expiry, policy, capability epoch, and bridge epoch checks fail closed |
| Malicious signed public-shell publisher | Signature proves publisher identity only; strict schemas, shipped archetypes, resource quotas, and GPU-safe validation still apply |
| Malicious Storylet package | Data-only exact-key parser, dependency closure, proposal allowlist, powerless action port, and authority receipts prevent execution or escalation |
| Replay or stale reconnect | Nonces, transcript binding, shell revision, expiry, capability epoch, and bridge epoch reject reuse |
| Traffic observer | Encrypted protected content, opaque locators, padded or bucketed public schedules where required, and no plaintext-derived public identifiers |
| Compromised renderer | Cannot create kernel authority; sensitive input is minimized, but a same-origin compromise may still steal already unlocked local content |
| Dishonest local scanner | Coverage and commitments show what the scanner claimed and later byte consistency; they do not prove the scanner was honest |
| GPU or JavaScript memory residue | Bounded lifetime and disposal reduce exposure; browser APIs cannot guarantee secure erasure |
| Screenshot, recording, or human memory | Revocation stops future delivery but cannot retract information already observed |
| Local operator view accidentally joins multiplayer state | Separate local-only projection, exact Realm/owner/bake/layout binding, closed local cell/anchor/zone membership, prohibited network-peer imports, and connected-content exclusion before scene assembly |
| Remote command attempts to open or steer the Operations View | Entry is an explicit local UI action under current local authority; remote, Storylet, station, rendezvous, and bridge inputs have no view-transition port |
| Side-channel through geometry or timing | Independent public compilation and noninterference tests prevent private counts, shapes, adjacency, activity, and timing from changing public output |

## Public noninterference

Public noninterference is the strongest privacy requirement:

> Two radically different private machines with identical declared public inputs must produce byte-identical public manifests and identical canonical public-scene digests.

Public compilation cannot consume private counts, paths, sizes, types, adjacency, hashes, process lists, update timing, glyph patterns, collision, navigation, or hidden eligibility results.

The build fails when public dependency closure reaches a private, unlabeled, refinement-only, or forbidden resource.

## Security boundary versus visual boundary

- The kernel and Realm Shield enforce authority.
- RealmLink establishes authenticated, capability-aware communication.
- WebGPU OS syscalls confine resource access.
- The renderer displays the resulting state.
- A gate, ticket, platform, bridge, glyph veil, or Storylet has no independent security power.

A compromised renderer cannot create authority by drawing an open door. A compromised remote shell cannot execute because shells contain data-only references to shipped safe archetypes.

## Hostile public manifests

Public shell validation rejects:

- Unknown schema or incompatible version.
- Invalid signature, expiry, identity, or content ID.
- Oversized arrays, geometry, textures, glyph sets, bounds, or nesting.
- NaN, Infinity, invalid transforms, or numeric overflow.
- Arbitrary JavaScript, shaders, WASM, workers, or executable expressions.
- External and arbitrary URLs.
- Filesystem paths or native handles.
- Unshipped archetypes.
- Unapproved material features.
- Resource graphs that exceed depth, count, byte, time, or GPU budgets.

Signing a malicious manifest does not bypass schema validation or quotas.

## Identity and consent

- Raw discovery may create an unattributed distant signal.
- A signed identity and valid Realm Passport permit attributed public presence.
- Mutual presence consent permits Traveler arrival.
- Capability negotiation permits specific actions or destinations.
- A shell signature proves publication by an identity. It does not prove correspondence to the private PC.

`meshStatus()` intentionally provides bounded peer metrics and cannot substitute for authenticated Traveler identity. Identity comes from the Realm Passport and RealmLink path.

## Capability and bridge binding

Every docking offer binds:

- Both Realm identities.
- Direction.
- Link and session transcript.
- Source and destination gate IDs.
- Public shell revisions.
- Requested action and object scope.
- Protocol and compiler versions.
- Active PresenceSession ID and epoch.
- Active RendezvousFrame ID and rendezvous epoch.
- A non-reusable offer nonce, an independent proposed bridge-generation nonce, issue time, and expiry.
- The expected previous bridge epoch only when renegotiating an existing generation.

An offer precedes bridge activation and cannot bind or claim a current new bridge epoch. Every grant binds the exact offer and digest, repeats the encounter, transcript, shell, gate, direction, policy, and capability context, binds the proposed generation-nonce digest, and allocates the prospective next bridge epoch. The recipe, both semantic bridge digests, and signed `BridgeEpochV1` activation record bind that same epoch. Protected traffic begins only after activation.

V1 does not allow wildcard grants or hidden-destination enumeration. Unauthorized clients cannot enumerate private gate IDs, district counts, collision, navigation, or refinement availability.

## Protected content addressing

Public shells may use ordinary public content IDs. Protected refinements and source chunks use audience-specific encryption and opaque locators. An unsalted plaintext hash cannot appear publicly because it enables cross-user correlation and dictionary attacks.

## Storylet privacy

Public Storylets consume only public observations. They cannot evaluate a private condition and merely hide the result. The fact that a private trigger fired is itself sensitive.

Storylet telemetry contains definition and instance state, timing buckets, outcome classes, and opaque references. It does not contain private predicates, exact input values, source, paths, capability tokens, or hidden participant data.

Replay disables action ports. Historical Storylets cannot mutate the live OS.

## Chronicle privacy

Chronicle records semantic transitions and stable opaque references. It never stores:

- Exact source.
- Raw filenames or paths outside an authorized local record.
- Private topology.
- Capability secrets or raw grant tokens.
- Encryption keys or nonces.
- Hidden gate IDs.
- Raw network packets.
- Unnecessary precise behavior or timing.

When a digest or local reference suffices, Chronicle does not duplicate the payload.

## Presence timing privacy

Private activity must not change public:

- Beacon timing.
- Manifest digest.
- Packet size.
- Skyline geometry.
- Storylet eligibility.
- Animation timing.
- Public collision or navigation.

These guarantees apply to the dedicated public presence and shell-publication channel. Public updates occur only from explicit public inputs and bucketed publication schedules, using the contract's fixed envelope classes where required.

V1 does not claim network-wide traffic-flow confidentiality. Peer session establishment, keepalives, public route use, disconnects, and congestion can expose documented timing and size classes. Hiding those signals would require separately specified padding, cover traffic, relay policy, and anonymity protections.

## Revocation and cleanup

After revocation completes:

- New protected payloads fail.
- Stale epoch traffic fails.
- New source chunks fail.
- Protected Storylets cancel.
- Refinement loading stops.
- Protected collision, navigation, interaction, geometry, and audio unload.
- Ephemeral keys and accessible caches release within defined bounds.
- A reconnect performs fresh authentication and negotiation.

JavaScript and GPU APIs cannot guarantee secure erasure. The product states that limitation directly.

## Security acceptance criteria

- Seeded secrets never appear in public manifests, traces, logs, telemetry, Chronicle records, GPU labels, crash reports, or public caches.
- Spoofed, expired, replayed, unknown, or downgraded identities create no Traveler, bridge, or protected route.
- An authenticated peer without presence consent remains a board entry.
- Asymmetric capability tests prove A-to-B and B-to-A independence.
- OS permission loss retracts affected authority without trusting presentation state.
- Malformed and resource-exhaustion manifests fail without executing or destabilizing the GPU.
- Version mismatch or bridge-digest disagreement fails closed to station-only presence.
- Private-only changes cannot alter the canonical public semantic scene or public Storylet timeline. Reference-renderer pixels must remain within the frozen regression tolerance profile; cross-GPU byte identity is not claimed.
- Disconnect cleanup removes every protected interactive surface within the declared bound.
- Operations View entry fails without current local owner identity, authority receipt, positive capability epoch, active private bake, layout receipt, or when any independently viewed/foreign Realm reference is attempted; the record can name only `localRealmId`.
- Different connected-Cityform, shell, Traveler, rendezvous, and bridge states produce byte-identical operator snapshots and minimaps for identical declared local input.
- Connected-content IDs appear in no operator CPU record, GPU resource, draw, pick, accessibility output, telemetry, Chronicle, or in-application capture.
- Camera, minimap, selection, focus, and Storylet cues never authorize a zone change; only the generic proposal, authority receipt, authoritative observation, and delta chain may present completion.

## See also

- [Local City Operations View](local-operator-view.md)
- [Contract catalog](contracts.md)
- [Code Matter](code-matter.md)
- [Cityforms and SecureMesh](cityforms-securemesh.md)
- [Storylets](storylets.md)
- [Security and Trust Model](../../concepts/security-model.md)