EON Worlds Creator — end-to-end specification

Version: 27 September 2026. Scope: turn a simple place idea or a Situation Room library item into a reviewed, playable 3D lesson. This is a product specification and build contract. It describes the intended finished product; the status table below says what works today.

The promise

A teacher types “ship” or chooses a library situation. The product asks plain questions, prepares a believable fictional world, helps the teacher place visible clues, lets them rehearse the lesson, requires the right expert checks, and then produces a shareable version. A world is the place; a mission is the learning story; a clue is something a learner can actually find there. The same mission should work in Show Me (watch), Find Me (practice with help), and Challenge Me (try independently).

A generated image is not a navigable world. A Situation Room title is not evidence that a hazard is visible. AI text is not a safety approval. Those distinctions must stay visible throughout creation and publication.

What works today

The public creator is therefore a useful planning and example-world prototype, not the finished one-word-to-published-world product. The six questions are 100% of the planning questions, not 100% of the product.

Author journey — eight gates

Each gate is a screen with a large question, one obvious next action, Back, a short explanation, and a visible progress indicator. Advanced controls stay behind “More options.” The product saves after every answer. A Guide (?) opens at every gate and deep-links to the exact instructions for that gate.

1. Choose the place

The author types a short phrase such as “LNG ship”, selects one of ten starter plans, picks one of 16 libraries, or selects a single situation card. The system proposes a place name and a fictional training context. It asks whether the lesson is based on a real site or a fictional example and records ownership/rights for any supplied media. Output: an editable brief, source IDs, and a provenance label. Gate: a non-empty place and a selected source status.

2. Describe the world

Show a plain-language scene brief first: what is visible, realistic scale, open central navigation space, distinct stations, comfortable camera distance, and visual style. Optionally reveal the exact generation prompt and reference media controls. Avoid putting fine hazards into the generation prompt as if their location could be trusted. Output: prompt, reference manifest, model choice, estimated cost, and privacy setting. Gate: the author reviews the prompt, rights, cost limit, and fictional/real label.

3. Define the lesson

Ask who learns and what they should be able to do: recognize equipment, notice hazards, or inspect and report. The author chooses a safe observable decision, not an action that requires operating equipment. Suggested Situation Room titles become draft cards. Output: learning objective, audience, draft mission outline, scoring intent. Gate: every card has a purpose and clear draft status.

4. Make or reuse the world

The author can use an included EON world, connect a world they own from their 3D collection, or deliberately request a new private world. A protected server checks the creator role, creation credits, cost ceiling, and idempotency key before a paid request. The UI shows one job and resumes it after reload. On completion, import the permitted world assets into the EON viewer and store the source-world URL, asset revision, scale/frame transform, and source rights. Output: navigable world revision. Gate: full and light assets align; navigation, provenance, and a comfortable start point pass inspection. Recording a URL alone does not pass this gate.

5. Walk through and place clues

The world opens at a clear, central viewpoint. The author visits several stations in the actual 3D environment. For each card they either identify visible evidence, stage a plausible precise prop, or reject the card. They click the target in the world; the editor captures world coordinates, a tight selection shape, label offset, and a wide-to-medium focus view. It must not guess a location from text. The author checks the target from three camera positions and on full/light quality. Output: placed clues tied to a specific world revision. Gate: every answerable clue can be seen and selected without flying into fuzzy splat edges or relying only on inserted props.

6. Rehearse the mission

An author chooses a route that connects the world stations. “Watch the mission” shows the scene, clue, explanation, and response, with cinematic but comfortable camera motion and captions. “Find Me” offers hints. “Challenge Me” withholds the answer until the learner responds. Wrong clicks give clear feedback; right clicks highlight the actual target. Audio can be muted. Output: route and rehearsal report for each mode. Gate: all modes use one approved answer, clicks register, narration/captions agree, controls stay responsive, and the mission works on desktop and phone.

7. Review the truth

A reviewer sees each world clue next to the source evidence, authored text, answer, and safe response. The system separately tracks visual-placement approval, content approval, and asset/source-rights approval. Safety-critical content requires the designated domain expert. Changing the world, target, answer, or response invalidates the relevant approval and sends it back to review. Output: named approvals and immutable content/world revision IDs. Gate: every card is approved; no draft placeholder survives.

8. Publish and measure

The author sees a final checklist and presses Publish approved version. The system creates a versioned share link with the approved world and mission only. Draft changes cannot silently alter that version. The release records author, institution, reviewers, timestamp, source assets, device/performance test, and rollback pointer. Learner results distinguish practice from formal evaluation and follow Genesis/XR Infinite permissions. Output: stable public or institution link, release record, monitoring and rollback. Gate: all previous checks pass; sharing scope is explicit.

Content and data contract

Keep separate IDs for world, worldRevision, mission, missionRevision, target, contentRevision, review, and publication. A target stores a world-space region, focus camera, label position, source evidence, staged/real flag, and the world revision it belongs to. A content revision stores question, possible answers, correct answer, explanation, hints, safe response, source references, and reviewer. The library source card ID is carried as provenance, never as an automatically approved answer.

Draft state moves through new → brief-ready → world-needed → world-ready → placement-needed → rehearsal-needed → review-needed → approved → published. Failed generation is a recoverable state with the original operation ID. Replacing a world invalidates placement checks. Editing safety content invalidates expert approval. Published revisions are immutable; corrections create a new revision.

Service boundaries

The browser may read a public catalog and edit its own draft. It must never receive world-generation or speech-provider credentials. A protected creator service owns paid world generation, operation polling, budget/rate limits, and a durable institution-scoped job ledger. An asset importer resolves permitted generated world assets, validates frame and scale, and stores stable references or copies under rights rules. The mission authoring service stores targets and routes. The review service enforces approval and invalidation. The publication service serves only approved revisions and supports rollback. Use existing @eon/worlds contracts for markers, learning modes, and scoring where they fit; do not mix this module's code with unrelated Genesis products.

Build order and tests

1. A — Connected planning (current): library links, six-question draft, honest source labels, guide, export/import, and matching example-world handoff. Test all 211 card links, 16 library links, ten starter plans, draft preservation, and browser navigation.
2. B — Real world import: protected generation/import, operation reconciliation, credits and cost ceiling, asset provenance, full/light alignment, and mobile start viewpoint. Test with a fake provider first, then one reviewed paid world; never infer success from a URL alone.
3. C — Complete in-world authoring: card-to-target binding, target shape, camera route, labels, evidence checks, safe prop staging, and preview in all modes. Test wrong/right clicks, selection from three viewpoints, splat-edge avoidance, captions and audio, and performance.
4. D — Review and release: authenticated shared drafts, reviewer roles, invalidation rules, rights, accessibility, versioned publication, monitoring, and rollback. Test that an unapproved or changed lesson cannot publish and a published version cannot silently change.

Definition of done

A first-time author can choose a library idea or type ship, build or import a real world, place three plausible clues across that world, run all three modes, obtain expert approval, and share an approved version—without help from a developer. The process passes desktop and phone tests and preserves provenance, privacy, and rollback. Until that is demonstrated end to end, the product must display the incomplete stage honestly.