[Backlog] Safety tools: Lines & Veils registry and anonymous topic flag

claude-bot commented

2026-07-14 19:55:06 +00:00

Collaborator

Context / Motivation

Research/product brief. Quest Board has no safety-tools surface. A campaign-level Lines & Veils registry plus an anonymous concern channel is the standard, low-ceremony toolset for long-running groups. Prior art (conceptual grounding, not code): the TTRPG Safety Toolkit (Kienna Shaw & Lauren Bryant-Monk), the X-Card (John Stavropoulos).

Spec (starting sketch)

Registry

SafetyEntry: campaign_id, kind: line (hard limit, never in play) | veil (fade-to-black), text, created_at. GM-editable (add/edit/remove); visible to all campaign members on the campaign page.
Anonymous player suggestions: members can suggest an entry anonymously. True anonymity is a schema decision, not a UI promise: the suggestion table stores no author FK and no request metadata — just campaign_id, suggested kind, text, created_at. Document this explicitly in the model docstring so a later "who suggested this" feature can't be bolted on quietly.
GM reviews suggestions (accept → becomes a registry entry; dismiss → deleted).

Anonymous concern flag

A "flag a concern to the GM" action on the session page (and optionally a bot DM command, e.g. /concern, delivering via DM so nothing appears in channel): free-text, delivered to the GM (web notification/inbox on the campaign page; optionally bot DM to the GM), stored with no identity — same no-author rule.
Rate-limit per session per client to blunt abuse without identifying anyone (accept the tension; note it in the issue).

UI placement: campaign page "Safety" panel (registry + suggest box); session page flag button; GM sees pending suggestions/flags with a badge.

Out of scope

Enforcement/automation (e.g. scanning transcripts for registry topics).
Per-session opt-in consent flows (the project's consent model is standing consent — do not add consent gates).

Open questions

Should the pre-session reminder include a "check the safety registry" line when the registry is non-empty (pairs with the recap-in-reminder work)?
Does the bot DM path add enough value over web-only to justify the surface (DM permissions, user lookup)?
Should flags auto-expire/archive after the session completes?

Acceptance criteria (for when this is pulled)

Registry CRUD (GM) + member-visible rendering; suggestions and flags verifiably store no author identity (schema-level test: no author column exists).
Anonymous suggestion → GM review → registry entry flow works end to end.
Flag reaches the GM without identity in any log line (check request logging).

References

webapp/backend/app/routers/campaigns.py:3172-3390 (campaign-scoped panel CRUD pattern to follow)
bot/questboard_bot/cogs/sessions.py (slash-command precedent for an optional /concern)
CLAUDE.md consent model (standing consent; announcement-only — no consent gates)

Filed from the July 2026 full-project review.

## Context / Motivation Research/product brief. Quest Board has no safety-tools surface. A campaign-level Lines & Veils registry plus an anonymous concern channel is the standard, low-ceremony toolset for long-running groups. Prior art (conceptual grounding, not code): the TTRPG Safety Toolkit (Kienna Shaw & Lauren Bryant-Monk), the X-Card (John Stavropoulos). ## Spec (starting sketch) **Registry** - `SafetyEntry`: `campaign_id`, `kind`: `line` (hard limit, never in play) | `veil` (fade-to-black), `text`, `created_at`. GM-editable (add/edit/remove); visible to **all** campaign members on the campaign page. - **Anonymous player suggestions**: members can suggest an entry anonymously. True anonymity is a schema decision, not a UI promise: the suggestion table stores **no author FK and no request metadata** — just `campaign_id`, suggested `kind`, `text`, `created_at`. Document this explicitly in the model docstring so a later "who suggested this" feature can't be bolted on quietly. - GM reviews suggestions (accept → becomes a registry entry; dismiss → deleted). **Anonymous concern flag** - A "flag a concern to the GM" action on the session page (and optionally a bot DM command, e.g. `/concern`, delivering via DM so nothing appears in channel): free-text, delivered to the GM (web notification/inbox on the campaign page; optionally bot DM to the GM), stored with **no identity** — same no-author rule. - Rate-limit per session per client to blunt abuse without identifying anyone (accept the tension; note it in the issue). **UI placement**: campaign page "Safety" panel (registry + suggest box); session page flag button; GM sees pending suggestions/flags with a badge. ## Out of scope - Enforcement/automation (e.g. scanning transcripts for registry topics). - Per-session opt-in consent flows (the project's consent model is standing consent — do not add consent gates). ## Open questions - Should the pre-session reminder include a "check the safety registry" line when the registry is non-empty (pairs with the recap-in-reminder work)? - Does the bot DM path add enough value over web-only to justify the surface (DM permissions, user lookup)? - Should flags auto-expire/archive after the session completes? ## Acceptance criteria (for when this is pulled) - Registry CRUD (GM) + member-visible rendering; suggestions and flags verifiably store no author identity (schema-level test: no author column exists). - Anonymous suggestion → GM review → registry entry flow works end to end. - Flag reaches the GM without identity in any log line (check request logging). ## References - `webapp/backend/app/routers/campaigns.py:3172-3390` (campaign-scoped panel CRUD pattern to follow) - `bot/questboard_bot/cogs/sessions.py` (slash-command precedent for an optional `/concern`) - CLAUDE.md consent model (standing consent; announcement-only — no consent gates) _Filed from the July 2026 full-project review._

claude-bot changed title from ~~[Backlog] Safety tools: Lines & Veils registry and anonymous topic flag~~ to [Backlog] Safety tools: Lines & Veils registry and anonymous topic flag

2026-07-14 19:55:16 +00:00

claude-bot added this to the Backlog - Speculative / Long-Term milestone

2026-07-14 19:55:16 +00:00

claude-bot added the

backend

enhancement

frontend

labels

2026-07-14 19:55:17 +00:00

claude-bot referenced this issue

2026-08-25 19:18:25 +00:00

[Review] Full audit of the session lifecycle: prep, recording, transcription, summarization, lore — scoping v4.0.0 #319

claude-bot modified the milestone from Backlog - Speculative / Long-Term to v4.6.0 - Calendar, Templates & Table Tools

2026-08-25 20:40:00 +00:00

claude-bot referenced this issue

2026-09-15 16:45:36 +00:00

[Feature] Discussions: Talk pages and a campaign board for questions, rumours and GM questions #654

claude-bot referenced this issue

2026-09-15 16:45:59 +00:00

[UX] Full mockups with sample data — 3-5 directions for comparison #363

claude-bot referenced this issue

2026-09-15 18:08:21 +00:00

[Feature] Notifications: a bell with an unread badge, a notification history, and delivery settings per person #655

claude-bot referenced this issue

2026-09-15 18:21:00 +00:00

[UX] Redesign coverage: where every shipped and planned feature lives in Design A #656

claude-bot referenced this issue

2026-09-15 19:49:17 +00:00

[UX] Redesign coverage: where every shipped and planned feature lives in Design A #656

claude-bot referenced this issue

2026-09-15 19:56:05 +00:00

[UX] Mock up every catalogued surface, for players and GMs, before building #659

claude-bot commented

2026-09-15 19:56:08 +00:00

Author

Collaborator

Placement decided (owner, 2026-09-15; decision D2 in the surface catalogue, #659):

The registry: the lines and veils registry and its anonymous suggestion box get their own "Table rules & safety" entry in the campaign's Contents (catalogue surface CAMP-18). They are visible to every member.
The flag: "flag a concern to the GM" is a button in Table mode (TABLE-1, TABLE-2) and on This week (CAMP-1), so it can be reached at the table as well as between sessions.

The no-author-stored rule in this issue is unchanged. Discussions (#654) stays separate, precisely so that rule isn't weakened.

**Placement decided (owner, 2026-09-15; decision D2 in the surface catalogue, #659):** - **The registry:** the lines and veils registry and its anonymous suggestion box get their own **"Table rules & safety"** entry in the campaign's Contents (catalogue surface CAMP-18). They are visible to every member. - **The flag:** "flag a concern to the GM" is a button in **Table mode** (TABLE-1, TABLE-2) and on **This week** (CAMP-1), so it can be reached at the table as well as between sessions. The no-author-stored rule in this issue is unchanged. Discussions (#654) stays separate, precisely so that rule isn't weakened.

claude-bot referenced this issue

2026-09-22 00:12:24 +00:00

Build lane 7: talking (CAMP-18 to CAMP-20, WIKI-4, SESS-6) #733

rbrooks referenced this issue from a commit

2026-09-26 08:51:58 +00:00

feat(webapp): table rules and safety, with anonymous suggestions and concerns (#733, #121)

claude-bot referenced this issue

2026-09-26 09:30:27 +00:00

Lane 7, PR 3 (server): table rules and safety, anonymous for real (#733, #121) #831

rbrooks referenced this issue from a commit

2026-09-26 10:08:29 +00:00

feat(webapp): Table rules & safety, and the flag's four doors (#733, #121, lane 7)

claude-bot referenced this issue from a commit

2026-09-26 10:08:48 +00:00

Merge PR #831: lane 7 server, table rules and safety (#733, #121)

rbrooks referenced this issue from a commit

2026-09-26 14:39:03 +00:00

Merge lane 7's safety pages: Table rules & safety and the flag's doors (#733, #121)

rbrooks referenced this issue from a commit

2026-09-26 14:39:03 +00:00

test(e2e): J2's question and Table rules & safety, J6's "discussed" act (#733, #726)

claude-bot commented

2026-10-01 19:02:08 +00:00

Author

Collaborator

Closing: built in lane 7 (#733). Checked against main on 1 Oct.

Table rules & safety (CAMP-18): GMs keep lines and veils; every member reads them.
Anonymous suggestions and concerns: the table that holds them has no column that could name a sender. Tests check the model, the live schema and the migration, and that no log line (the app's, uvicorn's or nginx's) and no notification row names who sent it. Sending is rate-limited without identifying anyone.
The GM's side: a quiet count and a bell row that say nothing of the content; accept a suggestion into the lists in the GM's own words, or dismiss it.
The flag is on the session page, in Table mode and on This week; the bot has a private /concern.
The lists travel in an export; the queue never does. Nothing expires a submission (D175).

Not built: a line in the pre-session reminder pointing at the lists. This issue raised it as an open question, not a requirement, so it is not filed.

Closing: built in lane 7 (#733). Checked against main on 1 Oct. - **Table rules & safety** (CAMP-18): GMs keep lines and veils; every member reads them. - **Anonymous suggestions and concerns:** the table that holds them has no column that could name a sender. Tests check the model, the live schema and the migration, and that no log line (the app's, uvicorn's or nginx's) and no notification row names who sent it. Sending is rate-limited without identifying anyone. - **The GM's side:** a quiet count and a bell row that say nothing of the content; accept a suggestion into the lists in the GM's own words, or dismiss it. - **The flag** is on the session page, in Table mode and on This week; the bot has a private `/concern`. - The lists travel in an export; the queue never does. Nothing expires a submission (D175). Not built: a line in the pre-session reminder pointing at the lists. This issue raised it as an open question, not a requirement, so it is not filed.

claude-bot closed this issue

2026-10-01 19:02:18 +00:00

Rows
Columns

[Backlog] Safety tools: Lines & Veils registry and anonymous topic flag #121

Context / Motivation

Spec (starting sketch)

Out of scope

Open questions

Acceptance criteria (for when this is pulled)

References