Draft Realm Chat legal and conduct contract

[ael-dev3]

Scope

This is PR A only from the staged Realm Chat program: the review-only legal, conduct, privacy, and product contract. Realm Chat remains disabled.

It proposes:

• Alpha Terms revision 2026-08-03-v5;
• Hegemony Social Contract 2026-08-03-HEGEMONY-SOCIAL-CONTRACT-V4;
• entry-agreement bundle 2026-08-03-hegemony-entry-agreement-v5;
• Privacy Notice revision 2026-08-03-v6; and
• disabled policy contract 2026-08-03-realm-chat-policy-v1 for realm:genesis-001.

The visible Terms and Social Contract are bound to new exact SHA-256 digests. V4 becomes retained historical evidence, the per-FID evidence bound increases from five to six, and all production-safety checks retain their fail-closed upper bound.

What this does not ship

This PR adds no chat UI, public route, SpacetimeDB table or reducer, generated binding, production channel seed, database publication, deployment, moderation action, secret, config change, live-player data, or activation claim.

WARPKEEP_REALM_CHAT_CLIENT_ENTRY_ENABLED remains false. Server channel activation must remain authoritative in later work.

Review blockers

Do not merge or activate based on this draft without explicit project-owner and qualified legal review.

The required review must resolve and approve:

• the exact version identifiers and visible wording;
• the age/minor-participation policy (this draft intentionally sets no age threshold);
• persistence, deletion, tombstone, anonymisation, and backup language;
• prohibited-content and contextual-discretion language;
• reporting, moderator notice, evidence handling, and reconsideration;
• privacy purposes, lawful bases, recipients, locations, retention, and rights; and
• a private legal/privacy contact route suitable for production use.

If the proposed bundle is later approved, merged, and deployed as current, every Keeper will need a fresh unchecked acceptance. Earlier evidence cannot satisfy the V5 entry gate.

Contract fixed for later PRs

• one admitted-Realm channel: realm:genesis-001;
• private permanent archive, bounded recent projection (128), and caller-specific history pages (maximum 50);
• server-derived sender FID, profile link, time, sequence, channel, and visibility;
• exact-message reports with private moderation records and no automatic punishment;
• session-only local mute;
• persistent Realm history with explicit moderation/privacy/legal/reset exceptions;
• portrait full-screen mobile and bounded desktop dock;
• candidate abuse limits documented as unapproved until owner review; and
• separate authority, client, QA, operator, and activation PRs.

The authority model follows SpacetimeDB's documented private-table and caller-filtered-view boundaries:
https://spacetimedb.com/docs/tables/access-permissions/
https://spacetimedb.com/docs/functions/views/

Security re-audit

A third-pass audit found and fixed one release-critical rollout mismatch plus several integrity/drift gaps:

• merging this proposal could otherwise auto-deploy a V5 browser while production SpacetimeDB still required V4, denying Realm entry to every player;
• both the Pages deployment validator and canonical SpacetimeDB publisher now fail closed while the bundle is review-only-rollout-blocked; read-only publisher dry runs remain available;
• the exact Privacy Notice visible text is now versioned and SHA-256 pinned alongside the Terms and Social Contract;
• every public legal-document link is restricted to an exact reviewed allowlist and may not use download or ping; and
• migration and local full-stack tooling now import the shared entry-agreement version instead of duplicating literals.

The diff was also rechecked for browser-side identity/sequence authority, public chat storage, exposed secrets, schema or generated-binding changes, unsafe legal-document active content, and accidental chat activation. No additional runtime authority path was found. Chat remains disabled.

Verification

Passed on the rebased head:

• npm run check on Node 22.23.2 — 268 files, 2,972 tests, typecheck, production build, asset/license/file-size checks, production-output exclusions, and Mini App verification;
• pnpm --dir services/auth-bridge run check — 285 unit tests, 11 Workerd tests, and both typecheck passes;
• pnpm --dir spacetimedb run verify — 326 tests and SpacetimeDB 2.6.1 module build;
• npm run stdb:verify-bindings;
• npm run stdb:verify-worker-migration;
• npm run stdb:verify-access-request-migration;
• npm run stdb:verify-additive-migration — complete disposable protocol-v14 proof, with no live database access;
• the aggregate QA agent passed every repository, auth, SpacetimeDB, binding, worker-migration, and additive-migration lane;
• root, auth-bridge, and SpacetimeDB dependency vulnerability audits reported no known vulnerabilities;
• npm registry-signature verification covered 246 packages and 70 attestations; and
• git diff --check plus a range-diff after rebasing onto current main.

Environment-only limitation:

• the aggregate QA agent's final local browser lane failed closed at chrome-attestation because this Mac's Google Chrome executable has two hard links, while the verifier requires exactly one. The executable is also group-writable. Warpkeep correctly refused to launch it. No repository or Chrome changes were made; browser QA must be repeated in a clean reviewed Chrome environment before merge.

Later PR sequence

1. additive SpacetimeDB authority;
2. client portrait/mobile and desktop dock;
3. desktop/accessibility/abuse QA;
4. operator moderation and release integration; and
5. separate, evidence-backed activation record.