GitHub commit

https://github.com/open-chat-labs/open-chat/commit/b71241b80bac5049c1416cc43e23ad000778e112

Changelog

Description

This release is the first leg of the media hash-scanning rollout (user_index → storage_index → storage_bucket → local_user_index → group_index → community → group → website, versions 2.0.2030–2.0.2037). It adds the control plane for media scanning and strengthens the moderation state machine around re-posted content and suspensions.

To be clear about what this release does and does not do: it does not switch on media scanning. Enabling scanning is a separate, dual-authorized platform-operator action which will only be taken once the full canister train is released. What this release adds on the user_index is: the dual-authorized configuration action itself, hash-match provenance on CSAM reports and alerts, pipeline-stall alerting, and a first-class resolvable report for every blocked attempt to re-post quarantined content — so that blocked attempts get the same human-review treatment as the original detection.

It also tightens two suspension invariants: automated moderation can never lift, downgrade or laterally replace a suspension applied by a human moderator, and a human verdict always supersedes an in-flight automated detection.

Added

• Create a first-class resolvable moderation report, with an authority-report register entry, for every blocked attempt to re-post CSAM content: immediately due for adjudicated content, mirroring the original report's verdict for content pending review (#9162)
• Add the SetMediaScanConfig protected action (dual-authorized) to register media scanner principals and enable media scanning across local user indexes (#9161)
• Record media hash-match provenance (provider, source, match distance, match id) on CSAM reports and moderation alerts (#9161)
• Post a notice to the internal moderation channel when a local index reports the media scan pipeline stalled, and when it recovers (#9161)
• Refuse to enable media scanning while the internal moderation channel is unconfigured - detections would sanction and record reports but every alert surface would be dark (#9161)

Changed

• Automated moderation never lifts, downgrades or laterally replaces a manual moderator suspension; it may only escalate a timed one to indefinite. Enforced in the suspension primitives and re-checked when the suspension is written (#9162)
• A human verdict supersedes an in-flight detection suspension: automated suspension jobs record the report which caused them and refuse to commit once it is resolved (#9162)
• Never send message media to the OpenAI moderation API - classification is text-only (#9149)

Fixed

• Fix detection of when to retry c2c calls (#9106)

Wasm Verification

Verify that the hash of the gzipped WASM matches the proposed hash.

git fetch
git checkout b71241b80bac5049c1416cc43e23ad000778e112
./scripts/verify-release.sh 2.0.2030 0c4154b5e2e7e11df68b41d99d8c0c93ebf1dd83150c195c9d0fcf9efe328d2f

Proposal to execute nervous system function:

Nervous system function:

NervousSystemFunction { id: 9000, name: "Upgrade canister", description: Some( "This will instruct the OpenChatInstaller canister to upgrade the specified canister.", ), function_type: Some( GenericNervousSystemFunction( GenericNervousSystemFunction { target_canister_id: Some( jodzs-iqaaa-aaaar-qamqa-cai, ), target_method_name: Some( "upgrade_canister", ), validator_canister_id: Some( jodzs-iqaaa-aaaar-qamqa-cai, ), validator_method_name: Some( "upgrade_canister_validate", ), topic: Some( DappCanisterManagement, ), }, ), ), }

Payload sha256:

a99093877e6af7d92ac06debd0be058970dd8ca0522e93ea97e092d55c043c11

Payload:

{ "canister_type": "UserIndex", "version": { "major": 2, "minor": 0, "patch": 2030 }, "wasm_hash": "0c4154b5e2e7e11df68b41d99d8c0c93ebf1dd83150c195c9d0fcf9efe328d2f", "filter": null }