Cross-World Bans

Status: Design Date: 2026-04-05

World operators share ban information via one-way subscriptions. Receiving admins always review and decide — no automatic bans. Moons of banned ships are auto-flagged.

Trust Model

Whitelist-based, one-way subscriptions.

• World B subscribes to World A’s ban feed
• World A does not need to subscribe back
• World B’s admin sees ban advisories on their dashboard
• Admin manually imports bans they agree with, or ignores them
• No automatic bans — the receiving admin always decides

This fits Urbit’s sovereignty model. Your world, your rules. Trust is just “I want to see what you ban.”

Ban Feed

Each world publishes a ban feed as a Gall subscription path. Other worlds subscribe via Ames.

Publishing

When a world admin bans a ship, the ban is added to the local banned-ships set AND published to the ban feed:

/ban-feed

Subscribers receive a JSON update:

{
  "type": "ban",
  "ship": "~bad-player",
  "reason": "Exploiting combat bug",
  "world": "~host-ship",
  "world-name": "The Shattered Covenant",
  "timestamp": 1234567890
}

When a ban is lifted, an unban is published:

{
  "type": "unban",
  "ship": "~bad-player",
  "world": "~host-ship",
  "timestamp": 1234567890
}

Subscribing

A world admin adds a trusted world:

admin-trust ~host-ship

This causes %mud-world to subscribe to ~host-ship’s /ban-feed path via Ames. Incoming ban events are stored as advisories.

To remove trust:

admin-untrust ~host-ship

Unsubscribes from the feed. Existing advisories remain until dismissed.

Ban Advisories

Incoming bans from trusted worlds are stored as advisories, not applied automatically.

+$  ban-advisory
  $:  ship=@p
      reason=@t
      source-world=@p
      source-name=@t
      received=@da
      status=?(%pending %imported %dismissed)
  ==

State

trusted-ban-sources=(set @p)
ban-advisories=(list ban-advisory)

Admin Dashboard

A new “Ban Advisories” section shows pending advisories:

Import — adds the ship to local banned-ships, kicks them if online, sets status to %imported.

Dismiss — sets status to %dismissed. The advisory stays in the list (greyed out) so the admin remembers they saw it.

Moon Handling

When a ban advisory is received for ~ship, all moons of that ship are auto-flagged. Urbit moons have the pattern ~moon-name-parent-ship — the parent is derivable from the @p.

When an admin imports a ban, the import also bans all moons of the banned ship that are currently known (have ever connected to the world). Future moon connections are checked against a “banned parents” set.

banned-parents=(set @p)

On citizen login, if the connecting ship’s parent is in banned-parents, block with “Your parent ship is banned from this world.”

Moon derivation: (sein:title our.bowl now.bowl ship) returns the parent of a moon.

Commands

Dashboard actions (HTTP):

• POST /mud/api/admin/import-ban — import an advisory as a local ban
• POST /mud/api/admin/dismiss-ban — dismiss an advisory

Protocol

Outbound (publishing)

In on-watch:

[%ban-feed ~]
::  only allow authenticated remote ships
`this

On ban, produce a %fact on /ban-feed:

[%give %fact ~[/ban-feed] %json !>(ban-json)]

Inbound (subscribing)

In on-agent, wire [%ban-feed ~host-ship]:

%fact
::  parse ban JSON, store as advisory

Subscribe via:

[%pass /ban-feed/(scot %p target) %agent [target %mud-world] %watch /ban-feed]

Impact on Existing Systems

Not Included

• Automatic ban propagation. All bans require manual admin review.
• Ban evidence/proof. Only ship + reason. No chat logs or screenshots.
• Reputation scoring. No trust levels or weighted sources.
• Federation/voting. No group consensus mechanisms.
• Ban appeals. Handled out-of-band (direct message to admin).
• Ban expiry. Advisories persist until dismissed. Local bans are permanent until lifted.