Moderation

Models emit signals. The engine policy maps scores to allow | review | block.

Supported modalities:

• Text: Detoxify (sidecar)
• Images: NudeNet plus Falconsai NSFW classifier (sidecar)

Audio and video are not moderated. They still persist if media config allows them.

When moderation is enabled for a type, the message is stored with moderationStatus=pending. Public status is none | pending | allowed | review | blocked | failed. Pending, held-for-review, blocked, and failed content is redacted from recipients. Decision block records audit rows and emits message.blocked without delivering the body.

The sidecar is a separate deployable. It is not part of @gozwire/core.

Compose defaults to fixture scores so Docker starts without multi-gigabyte PyTorch weights. That is for local wiring. Production inference uses the documented models.

Thresholds live in config.moderation.textPolicy / imagePolicy, never in the demo UI.

gozwire.moderation.list({
  actorId,
  limit?,
  before?,
  status?,
  decision?,
  modality?,
}): Promise<{ jobs: ModerationJobListItem[]; nextCursor: string | null }>;

list requires actorId. There is no OFFSET. Reviewer IDs and review-delivery mode are engine config.