fix defects D1-D12 batch 1, structured envelope, saf gates + ops kill-switches

2026-07-13 12:56:32 +02:00
parent f1578cbd99
commit 6e5abf3d2c
14 changed files with 770 additions and 214 deletions
@@ -0,0 +1,58 @@
+# SPEC-006 — Staff / operator controls
+
+Staff operate the bot from the staff channel without SSH. Runtime
+flags live in memory — a restart resets to config defaults (D-008).
+The staff-alert path is a tested contract: alerts are the
+business-critical feature on the restaurant deployment.
+
+### OPS-01 — Staff commands only work in the staff channel (coverage: test)
+
+`!bot …` commands are honored only when sent in the configured staff
+channel. In any other channel the text is treated as a normal
+message.
+
+### OPS-02 — Pause and resume (coverage: test)
+
+`!bot pause` stops all public replying (messages are ignored, no
+model calls); `!bot resume` restores it and clears quiet mode. Staff
+commands keep working while paused.
+
+### OPS-03 — Image kill-switch (coverage: test)
+
+`!bot images off` drops the picture part of any response before
+generation (answer text still goes out); `!bot images on` restores.
+
+### OPS-04 — Quiet mode with auto-resume (coverage: test)
+
+`!bot quiet <minutes>` silences public replies for N minutes, then
+the bot resumes by itself. Friday-service panic button that cannot be
+forgotten.
+
+### OPS-05 — Status report (coverage: test)
+
+`!bot status` answers in the staff channel with the current flags
+(replies / images / tasks / remaining quiet time).
+
+### OPS-06 — Keyword-forced staff alerts (coverage: test)
+
+When a user message matches any configured `staff-alert-keywords`
+regex and the model set no staff note, a staff alert is forced with
+user + message excerpt. Alerting must not depend solely on the
+model's judgement.
+
+### OPS-07 — Staff alerts are rate-limited (coverage: test)
+
+At most `staff-alert-max-per-hour` (default 10) alerts reach the
+staff channel per rolling hour; excess alerts are logged. An
+injection or a glitch must not be able to flood staff.
+
+### OPS-08 — Lost staff alerts are logged (coverage: test)
+
+When a staff alert cannot be delivered (staff channel unresolved),
+the alert text is written to the error log — never silently dropped.
+
+### OPS-09 — Self-tasking kill-switch (coverage: test)
+
+`!bot tasks off` disables bot-initiated posting (today: the boreness
+loop; later: the FDB-011 scheduler); `!bot tasks on` restores.
+Bot-initiated posts also respect pause/quiet.