RedditBot/docs/product-and-safety.md

# Product goals and safety boundaries

## Product purpose

RedditBot helps an operator discover suitable adult Reddit users who have explicitly posted in configured communities, start relevant conversations, prioritize existing replies, and learn which outreach approaches lead to genuine engagement. It is an operator-controlled system, not an unconstrained bulk messenger.

The product has five connected goals:

1. Find candidates from explicitly configured subreddits.
2. Reject unsuitable candidates before expensive AI work or any send.
3. Coordinate multiple accounts without contacting the same person repeatedly.
4. Continue conversations only within configured, bounded automation policies.
5. Make every material decision and outcome visible to the operator.

## What good behavior looks like

- Eligibility is completed before selecting a recipient: already-processed posts, recipient history, self-declared age/gender for chat posts, seller signals, content suitability, and AI safety all have explicit outcomes.
- Existing replies take priority over new outreach. An account with actionable inbound messages is not available for a new candidate.
- Candidate inventory follows near-term outbound capacity and the recent-post window; discovery pauses instead of accumulating an ever-older backlog when accounts cannot keep pace.
- Discovery is global while authentication, rate limits, conversations, and content remain account-owned.
- Recipient deduplication is case-insensitive, durable across restarts, and protected by a live reservation during sends.
- Remote side effects are fail-closed: a send is recorded only after the chat service confirms it; interrupted reply claims reconcile against Matrix history before retrying. A queued reply refreshes Matrix immediately before sending and becomes an auditable superseded claim if a newer inbound event or terminal state appeared while it waited.
- Dry-run prepares and records decisions but never sends.
- Operators can see funnel stages, account state, rate limits, failures, handoffs, and recent activity rather than inferring success from a process-health check.

## Candidate policy

Configured subreddits have a source type:

- `image`: image-led posts are downloaded and analyzed before an opener is generated.
- `chat`: text-led posts require a parseable self-declared gender and adult age, then use the chat-opener prompt.

Seller filtering combines the candidate post with Reddit profile/about and recent activity evidence. The default policy treats Telegram names and links as seller signals alongside paid-content platforms and payment prompts. The configured keyword/domain lists are policy inputs, not a substitute for the surrounding screening flow. A profile lookup failure is not itself proof that a person is a seller; network and rate-limit failures must remain distinguishable from a rejection.

The system must not manufacture personal facts. Generated messages must not claim shared location or proximity, invite an in-person meeting, invent identity/history, or ignore a conversation boundary. The final outbound safety check is intentionally separate from prompt wording.

## Conversation policy modes

Each subreddit snapshots a policy into a conversation when automation first handles it:

| Mode | Meaning |
| --- | --- |
| `manual` | Never auto-reply; surface a human handoff. |
| `legacy` | At most one optional autonomous media request, counting a request already present in the opener, followed by human handoff. |
| `r4r` | Bounded rapport-style replies with autonomous safety checks. |
| `r4r-media` | Rapport first, one bounded media ask, then a handoff/terminal boundary. |

The snapshot matters: changing configuration later must not silently rewrite the rules for an active conversation. Automation stops for seller/upsell evidence, an image received, a detected boundary, unsafe content, an exhausted turn budget, a repeated media request, or a manual policy. Short refusals are interpreted in sequence: phrases such as “I’m good” become media boundaries only when they answer a media request.

## Operator exchange media

The exchange library contains only operator-uploaded images. Upload requires confirmation that every depicted adult consented to storage and bot delivery. Received conversation media is account-owned evidence and can never be promoted into this shared library.

The bot may continue to ask another person for an optional photo under the configured conversation policy, but it must never mention, advertise, or offer an exchange-library image proactively. A library send requires a direct or indirect inbound image request. Exact anatomy requests match the operator-reviewed tags `penis`, `chest`, `selfie`, `topless`, or `feet`; the bot does not substitute a different anatomy when a match is unavailable.

Nonspecific requests broaden progressively within one conversation. The first selects a random unused SFW asset, a later request may include topless/NSFW assets, and further requests may select from the full library. An asset is never selected twice in the same conversation, including after an uncertain send. After Matrix confirms the image event, the bot asks the other person to reciprocate without pressure. Missing inventory, failed delivery, changed conversation state, or an unconfirmed reciprocal message becomes an operator handoff.

Reddit candidate eligibility remains the product's adult-entry assumption; this feature adds no separate verification workflow. Existing deterministic underage disclosures and conversation boundaries still stop automation before a library send.

The conversation dashboard may let an operator choose the specific library asset, but it does not waive these rules. The picker exposes only enabled, unused assets that match the latest inbound request and its current safety tier. A manual choice is revalidated after rate-limit waiting, requires explicit send confirmation, and moves the conversation to operator-owned state after a confirmed delivery.

## Success and analytics

Do not collapse all progress into “messages sent.” Useful states include:

- candidates discovered, screened, ready, leased, retrying, rejected, expired, and sent;
- sends awaiting a mature response window versus mature sends;
- replies, declined/boundary/upsell outcomes, and images received;
- model usage, fallback behavior, strategy/sample size, and account ownership.

Learning examples mature only after the conversation policy is no longer active. Full recipient history is reclassified on sync; a later decline or boundary overrides earlier reciprocal activity and removes any previously promoted example.

Fetched listing size is not an eligibility count. Logs and UI should quantify rejection and deferral reasons so a dry funnel can be diagnosed without guessing.

## Operational authority

The following require explicit user authorization because they can affect real accounts or production state:

- starting or resuming bot processing;
- sending a message or triggering a send-capable workflow;
- importing/replacing account sessions;
- restarting or deploying the production service;
- changing live configuration;
- deleting/resetting databases, volumes, media, or account state.

Read-only inspection, builds, tests, and documentation work do not grant any of those permissions. If a request is only diagnostic, inspect and explain before editing or operating.

## Privacy and secrets

Treat these as sensitive: `.env`, Reddit cookies, exported session JSON, Matrix access tokens, dashboard/agent tokens, the SQLite database, browser profiles, conversation text, usernames, received private media, operator exchange media, and logs that may contain request metadata.

Never commit or reproduce them in documentation, fixtures, logs, issue text, or tool output. Prefer redacted structural evidence. Production backups contain account and private conversation data and need the same protection as the live volume.