Identity, access, and location

v0 Character is a dedicated deterministic shared object carrying tenant identity, tribe, wallet, metadata, and owner-cap identity. v1 uses a generic Entity with an installable Identity module. Package IDs, layouts, capabilities, and event contracts are therefore incompatible.

v0 combines GovernorCap, sponsor-aware AdminACL, and typed OwnerCap; see access_control. v1 represents authorization as requirements consumed while completing an Entity request and uses AccessCap. A caller cap records the authorized entity for downstream routing; it must not be described as ownership of an action target.

Location is a security-significant difference. v0 validates server identity, sender, target hash, signature, and deadline using location. Active v1 location_service injects proximity but currently compares a supplied hash and includes a TODO for server/player/target/deadline/signature checks. This observes a changed trust boundary in source; it is not a runtime or security-quality verdict.