What keeps changing

Every release, what it brings and why. It comes from the same place the bot reads, so it cannot go stale.

Supporting a fair community with quiet participation, autoroles on join, and reaction role panels.

• **Autoroles and Reaction Roles**
• Autoroles assigns default server roles cleanly upon member join, strictly honoring role hierarchy and bot permissions.
• Reaction roles control panel (/reactionroles config) inspired by Strombot with section navigation, dual emoji and button support, and categorized palette.
• **Silent Moderation and Suggestions**
• ATLAS gives every member a private overview of their moderation activity without exposing staff notes or anyone else’s data.
• Members can submit and track suggestions without channel posts, mentions or automatic announcements; result DMs are strictly opt-in.
• Moderators receive one private inbox combining suggestions, reports, appeals and open cases, plus quiet shift handovers.

Responding to an incident without losing control or the server’s previous state.

• Lockdown now takes a complete snapshot of every channel permission overwrite before touching Discord: @everyone, roles and individual members, including every allow and deny bit. Ending it restores the exact list instead of opening channels indiscriminately.
• A repeated lockdown can no longer overwrite the original snapshot. The snapshot is written before the first channel is closed, and failed restores remain pending so they can be retried after fixing the bot’s permissions.
• The private /corp console now includes a Kali-inspired operational terminal backed by the current Ubuntu process: live bot output, deploy history, global search, node and version state, command sync, health checks, deploy and restart through a closed command list.
• Oracle and Railway now elect a single active node, replicate the same configuration and publish heartbeats. The reserve stays ready without answering the same Discord interaction twice.
• Command publishing was separated from the bot heartbeat: the normal catalogue is global, the main guild receives an immediate catalogue, owner-only commands stay private, and a failed sync is retried instead of being recorded as successful.
• Moderation results are readable cards again, with separate member, moderator, reason, severity and status. They now offer case, review, reason editing, appeal, trace and undo actions, and update the original card when its reason changes. Interactions are acknowledged before slow work to prevent Unknown interaction failures.
• /corp remains the private AXIS owner console: every route requires a signed owner-bound session, attempts are rate-limited and access is written to the chained audit log.

Recovering from an attack, and sanctions that no longer expire.

• /backup undo: rebuilds the channels and roles an attack just deleted, permissions included. The structure is saved AT THE MOMENT of deletion, so even things that were in no backup come back — and only what was broken is restored, not the whole server.
• SERIOUS FIX: the automatic backup NEVER ran on a bot that restarts. It was a 6-hour timer that reset on every boot, so a deploy or a crash restarted it before it ever fired. Owners had it switched on and had no backup at all. The date is now worked out from the last saved backup and survives restarts.
• SERIOUS FIX: when recovering a channel, its permissions could be lost in silence and the channel came back OPEN TO EVERYONE — a nuke deletes roles before channels, and permissions were stored by role name. The id is now stored and reassigned to the rebuilt role.
• Anything hanging off a sanction no longer expires: the privacy window erased a banned user’s alt trail, so waiting it out was enough to come back with another account from the same place. The window still applies to anyone without a sanction.
• The /profile card now explains itself: "Trust" became "Credentials", with the five checks in plain sight (Verified, 6+ months, 1+ year, Clean, Vouched for) and saying outright that it measures neither activity nor popularity. And having the verified role now counts as verified, not just going through the flow.
• The front page, in plain language in all four languages: no more going round in circles in the header or the architecture section.

The first feature built for the member, not for the staff.

• /profile: a member’s public card. Verification, veteran standing, BADGES earned on their own — Verified, Veteran, Clean record, Vouched for, Booster, Pioneer, Staff — and a trust bar. It is posted in the channel so it gets seen, and it shows only the good: never moderation data.
• Text prefix (default ".") and EVERY command reachable by prefix too, not just with "/". Each command’s permission lock is respected exactly the same.
• Private-network anchoring: someone verifying on mobile data or a public network is not linked there — strangers share an IP like that. It waits for their home network to link their alts without false positives.
• The leave log became a card: which roles they had, how long they stayed, and what the server dropped to.
• FIXES: a Twitch live card could stay "LIVE" forever if closing it failed once — it now retries; network anchoring fired too often because of soft API labels; and the /admin panel was redesigned from scratch.

No longer asking you to trust: now it can be checked.

• THE RECEIPT. Whoever is sanctioned gets a paper they can verify themselves: what was decided, when and why, with proof that it was already written at that moment. It does not say who moderated — deliberately, so a receipt does not turn into a target.
• The log is signed every hour and the signature is published OUTSIDE this server. Rewriting the past stops depending on having access to the machine: it requires contradicting a signature already sitting on someone else’s disk.
• Merkle tree (RFC 6962): one specific event is proven with sixteen hashes, without showing anybody’s whole log.
• ONYX is the system and AXIS becomes a connector. The second one, the web, already works: any site with accounts can ask "is this visitor the same person I already blocked?" — and the answer NEVER crosses from one tenant to another.
• API v1 with narrow-scope keys, tied to a single server and stored only as a hash.
• Threat model published, including the section on what is NOT covered. Writing it found two real bugs.
• A SERIOUS BUG: each event’s identifier was four random characters after the millisecond. On a spike of events they collided, the row was lost in silence and the chain broke — the log accused itself of tampering because of its own id generator.
• /receipt and /integrity: all that machinery, finally visible from Discord.

Taking away its blind spots: what the bot was not watching.

• A bot marked as trusted was INVISIBLE to the anti-nuke: it was not counted, it did not trigger, and it did not add to the server total. Trust now raises the bar but has a ceiling.
• The threat map only recorded one of the eight kinds of denial. The most serious ones — ban evasion by connection or device — appeared nowhere.
• Bot blacklist, applied on join, on being added, and with a sweep of any already inside.
• Webhook inventory and purge: the only way to cut off a leaked URL.
• Automod repeat-offence ladder, with exceptions per channel and per rank.
• VPN false positives: iCloud Private Relay no longer counts as evasion.
• Encrypted backups (AES-256-GCM), visible from the console.

Back to the start