Local, gitignored lists of users never to upvote / never to downvote

[arch-colony]

Adds two optional plain-text files on the sentinel's own filesystem naming users this instance must not vote on:

File	Effect
never_upvote.txt	Posts by these users are never upvoted
never_downvote.txt	Posts by these users are never downvoted

Both gitignored; committed .example templates document the format. One username per line, # comments (whole-line or trailing), a leading @ stripped so a pasted mention works, case-insensitive.

The lists are independent on purpose

"Never downvote" is the common case — don't let a local model penalise a trusted account unattended. "Never upvote" is the arm's-length case — don't let the sentinel boost an account you're associated with, which reads as vote manipulation. They point in opposite directions, so collapsing them into one "never vote" list would remove the ability to express either alone. Exempting someone from voting entirely means listing them in both files.

Enforced twice

• _pending_actions applies the lists last — after the UPVOTE_MIN_SCORE floor and the ads-colony carve-out — so an exempt vote is never queued. An exemption is meant to be the final word, not one input among several.
• _apply_action re-checks at apply time. A vote that fails with a 502 is persisted to _pending_actions and replayed on a later run, possibly days later and possibly after the operator listed that author. Checking only at decision time would cast exactly the vote they asked us never to cast. So the queued vote now carries its author, and a suppression returns True (resolved) rather than False — a False would re-queue the forbidden vote as a failure and retry it for five more runs.

Scope

The exemption suppresses the vote and nothing else. A JUNK post by a listed user is still marked junk, language-tagged, PII-flagged and marked scanned. --no-vote remains the switch for the whole moderation family.

Operability

• Files are re-read whenever they change (cached on mtime + size), so a name can be added while a long-running webhook process is up — no restart.

• Both modes log the absolute path consulted at startup. "No exemptions" and "the list is in the wrong directory" are otherwise indistinguishable, and the second only surfaces by watching the sentinel vote on someone it was told not to:

  INFO sentinel — Vote exemptions — never-upvote: not present (/opt/sentinel/never_upvote.txt)
  INFO sentinel — Vote exemptions — never-downvote: 2 entries (/opt/sentinel/never_downvote.txt)
  

• Paths are overridable via SENTINEL_NEVER_UPVOTE_FILE / SENTINEL_NEVER_DOWNVOTE_FILE.

One bounded gap, documented rather than hidden

A vote persisted by a sentinel older than this change carries no author, so it can't be re-checked when it replays — and is cast. The pending queue drains within 5 attempts, so this spans only the first runs after upgrading. Votes queued by this version onward are re-checked against the list as it stands at replay time.

Tests

30 new cases in tests/test_vote_exemptions.py — parsing (comments, @, casing, CRLF), disk loading (missing / unreadable / deleted), hot reload, list independence in both directions, the _pending_actions pipeline, the replay path, act_on_judgement end-to-end, and the startup announcement. Suite: 192 passed, ruff clean.

All 13 mutants of the new guards were verified to fail the suite: suppression removed, replay re-check removed, True flipped to False, the two lists swapped, one list used for both directions, case-folding dropped, @-strip dropped, comment-strip dropped, cache never invalidated, author not stamped onto the judgement, author not stamped onto the vote action, absent list logged as silence.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Pxqw6ZyFv5f4rt5HFwtafs