From 2c973624b96c66fdd625da6a032a154bce81c5e7 Mon Sep 17 00:00:00 2001 From: wtclaude Date: Fri, 30 Oct 2026 11:31:39 -0500 Subject: [PATCH] docs(safety): record USER_SAFETY step 5, the walk on a local copy of the demo Report, hide and block walked on the web and in the app, Hide for everyone from the queue, and S14, against website main + Module-Rust edge with DEMO_MODE on and the demo's own seed. API 30/30, web and app rows all pass. Walked locally, not on the demo, by the org lead's choice. Records four findings about the demo itself, unchanged: chat is staff-only there (W1), the rig has no chat to report (W2), play-review is an admin (W3), and the demo runs Module-Rust v0.6.3, without this feature (W4). Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY --- website/USER_SAFETY.md | 57 +++++++++++++++++++++++++++++++++++++++++- 1 file changed, 56 insertions(+), 1 deletion(-) diff --git a/website/USER_SAFETY.md b/website/USER_SAFETY.md index 8fc24ff..891b661 100644 --- a/website/USER_SAFETY.md +++ b/website/USER_SAFETY.md @@ -1,7 +1,8 @@ # Report, block and hide — user safety on the website and in the app **Status:** plan of record, 2026-10-29. Steps 2 (core), 3 (Module-Rust, Integration Kit) and 4 -(Android) built 2026-10-30 (§7); the rest not yet. +(Android) built 2026-10-30, and step 5's walk done the same day on a local copy of the demo (§7); +step 6 not yet. Each phase stops for the org lead before the next one starts. Built after account deletion ([`ACCOUNT_DELETION.md`](ACCOUNT_DELETION.md)), which is why it is `MODULE_API` 1.21.0. §4 was amended by S11-S14 (§5) when the core was built. @@ -256,4 +257,58 @@ Play declarations gain "user-generated content: collected". M21 says so. 5. **A walk** on the demo after the next wipe: report, hide and block, each on the web and in the app; *Hide for everyone* from the queue; a blocked Steam ID that later links to an account stays blocked. + + **Walked 2026-10-30 on a local copy of the demo, not on the demo itself** (org lead: check it + locally and leave the demo alone unless it needs something). The copy: website `main` (the + 1.21.0 merge) with `DEMO_MODE=true`, Module-Rust `edge` (#72) in its modules directory, a + throwaway database seeded by `npm run seed:demo` from the demo's own `deploy/demo/seed.json`. The + rig has no players and a Steam ID can only be linked with `/link` in game, so the walk's data was + written into the tables instead (org lead: seed what the walk needs): nine chat lines and a death + on the `demo` server from four stand-in Steam IDs (two unlinked, demo-player's, and a new one + linked to demo-moderator), and that server's presence opened to `public`. S14's link was written + as `/link` writes it, to a player account demo-admin created (creating users is open on the demo). + + - **API**, 30 rows, all passed, over bearer sign-ins as the demo's accounts. None of the routes is + demo-locked. Signed out: every line, no `canBlock`, a report refused 401. demo-player's + `canBlock` was true for the two unlinked speakers and false for its own line and + demo-moderator's. A report reached the queue with its snapshot, and a second report of the line + was refused 409; a death's id was 404. *Hide for me* hid one line for demo-player only. + Blocking an unlinked speaker made a Steam-ID block and took their chat, not their death, out of + demo-player's feed only. Blocking demo-moderator's line was `403 staff`. play-review blocking + demo-player's line made an account block. *Hide for everyone* from the queue actioned the + report and took the line out for members and signed-out readers; staff saw it marked, and the + line's own route showed it again (a player got 403); the activity log has both. A Steam-ID block + whose ID was then linked read back as an account block, and the lines stayed out (S14). + *Unblock* and *Show them again* undid everything. + - **Web**, in Chrome. Signed out, the `⋯` menu said *Sign in to report or block*. As + demo-player: *Report* (sent, "Reported to site staff"), *Hide for me*, *Block player* with its + confirmation; no *Block* on demo-moderator's line or its own. *Account → Blocked* listed the + Steam-ID block and the hidden item, then, after the link, the block as an account block on the + new account (S14). As demo-moderator, the Reports queue showed the line from its snapshot, + *Hide for everyone* actioned it, and the feed showed the line marked *Hidden by staff* with + *Show to everyone again*. No console errors. + - **App**, `edge` debug build on the `Medium_Phone_API_36.1` emulator, its data cleared. Signed + out, a long press offered only *Sign in*, which opened the login screen. As demo-player: + *Report* with a reason and a detail (the row has both, and the snapshot), *Hide for me*, + *Block player* with its confirmation (Ash's chat gone, Rook's death still there); no *Block* + on demo-moderator's line or its own. *Account → Blocked* listed the Steam-ID block, then the + account block after the link (S14), with the speaker's lines still out. As demo-moderator, + *Hide for everyone* dimmed the line and marked it *Hidden by staff*, a signed-out read lost it, + and *Show to everyone again* brought it back; the activity log has `rust.chat.hide` and + `rust.chat.unhide`. + + **What the walk found about the demo itself** (none of it changed; each is the org lead's call): + + - **W1. The demo shows no chat to members.** Its `demo` server inherits the fleet's presence + default, `staff`, so demo-player and a signed-out visitor see no feed at all. Only demo-admin, + demo-moderator and play-review do. + - **W2. There is no chat on the demo to report.** Chat lines come only from players on the rig, + and nobody plays there, so even the staff accounts have nothing to long-press. The walk's + lines were written into the tables. + - **W3. play-review is an admin**, so a Play reviewer is staff. They get *Hide for everyone* in + the menu and see staff-hidden lines, and the block refusal and *Not applied* (S8) do not apply + to them. They can still report, hide and block. + - **W4. The demo runs Module-Rust v0.6.3**, the newest release, which has neither this feature + nor account deletion's unlink (#70, #72 are on `edge`). The edge → `main` cutover was held so + the demo is not changed by its next wipe. 6. Then `android/PLAN.md` M8's cutover (S5). -- 2.49.1