Foundation Moderation

• *rea:*Foundation
• *ath:*foundation/moderation
• *ind:*Content moderation, DMCA, fingerprint (RFC-001)

Role in the stack

koder-moderation powers the reportandstrike + fingerprint side of products/horizontal/play/engine (Koder Play). Reports come in via intake, get triaged into queues, accumulate strike weight on the offending channel, optionally fingerprintmatch against a pertenant Content-ID corpus, and wire into automod policy when classifiers fire above thresholds.

Deployed as koder-moderation-server (axum, default 0.0.0.0:8000); RUST_LOG controls tracing; /metrics exposed for Prometheus.

Substrate

• *ntake* inmemory v0.1; production swap to data/kdb `kdbrecord`. SubmitArgs builder; classifier-signal injection per (targetkind, targetid).
• *trikes* StrikeLedger with 90-day exponential decay; severity per StrikeKind.
• *ingerprint* FingerprintCorpus per tenant; Hamming similarity v0.1.
• *xtractor (MOD010)* FingerprintExtractor trait + StubExtractor (alwayson) + featuregated chromaprint/PDQ wraps (queued MOD012/#013).
• *SH index (MOD010)* LshIndex buckets by 16bit chunks for submillisecond candidate retrieval at millionentry corpus.
• *lassifier bridge (MOD-011)* Classifier trait + LocalRuleClassifier (keyword fallback, conf cap 0.85) + ClassifierCache (24h TTL).
• *utomod* AutoModPolicyTable decides Ignore / ReviewQueue / AutoHide on decide_many(labels).

Key features

• [x] Intake submit with triage in single call (MOD-001/#002).
• [x] Strike ledger with 90day decay (MOD003).
• [x] Automod policy table (MOD-004).
• [x] Fingerprint corpus + similarity scoring (MOD-005).
• [x] HTTP API + Prometheus + tracing (MOD-006#007#008).
• [x] Bench harness with SLO baseline (MOD-009).
• [x] Pluggable fingerprint extractor + LSH index (MOD-010 part A).
• [x] Pluggable classifier bridge + 24h cache (MOD-011 part A).
• [x] Pertenant rate limit on /v1/reports (MOD014).
• [x] Input validation: freetext ≤ 8 KB, evidenceurls ≤ 50 (MOD-015).
• [x] ModerationEventSink trait — Submitted / AutoHidden / StrikeAdded / ReviewerDecision (MOD-017).
• [x] POST /v1/classify wraps Classifier + ClassifierCache (MOD-018).
• [x] #[instrument] on intake.submit + automod.decide_many (MOD-019).
• [x] kdb_mod_intake_seconds + kdb_mod_strikes_active + kdb_moderation_rate_limit_drops_total metrics (MOD-020).
• [ ] chromaprint cgo wrap (MOD012 — blocked on libchromaprintdev).
• [ ] PDQ cgo wrap (MOD013 — blocked on Meta pdqcpp).

SLO targets

• p99 intake.submit ≤ * ms*(non-classifier path).
• Fingerprint match latency ≤ *0 s*for 10-min upload.
• NSFW classification ≥ *5% precision*/ ≥ *0% recall*(MOD-011 production gate).

Bench numbers: intake.submit = *19 ns* fingerprintlookup @ 100k = *0 ms* classifiercache hit = *2 ns* automod.decide_many = *6 ns* See services/foundation/moderation/bench/baseline.json.

Interfaces

• HTTP: POST /v1/intake, POST /v1/fingerprint/match, POST /v1/strikes, GET /healthz, GET /metrics.
• Library: koder_moderation::{IntakeService, StrikeLedger, FingerprintCorpus, AutoModPolicyTable, LocalRuleClassifier, ClassifierCache, StubExtractor, LshIndex}.