fix: stop auto-emitting copyright labels, add configurable threshold (#703)

changes:
- remove auto-label emission from _store_scan_result (was creating liability)
- add MODERATION_COPYRIGHT_SCORE_THRESHOLD env var (default: 85)
- remove tests that expected auto-label emission

scanning still runs and stores results internally for future use
when we build the notification + action pipeline.

refs #702

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.5 <[e-mail]>

backend/src/backend/_internal/moderation.py

···
 from typing import Any
 
 import logfire
-from sqlalchemy import select
-from sqlalchemy.orm import joinedload
 
 from backend._internal.moderation_client import get_moderation_client
 from backend.config import settings
-from backend.models import CopyrightScan, Track
+from backend.models import CopyrightScan
 from backend.utilities.database import db_session
 
 logger = logging.getLogger(__name__)
···
             match_count=len(scan.matches),
         )
 
-        # emit ATProto label if flagged
-        if result.is_flagged:
-            track = await db.scalar(
-                select(Track)
-                .options(joinedload(Track.artist))
-                .where(Track.id == track_id)
-            )
-            if track and track.atproto_record_uri:
-                await _emit_copyright_label(
-                    uri=track.atproto_record_uri,
-                    cid=track.atproto_record_cid,
-                    track_id=track_id,
-                    track_title=track.title,
-                    artist_handle=track.artist.handle if track.artist else None,
-                    artist_did=track.artist_did,
-                    highest_score=scan.highest_score,
-                    matches=scan.matches,
-                )
+        # auto-label emission removed - see https://github.com/zzstoatzz/plyr.fm/issues/702
+        # labels will be emitted after user notification + grace period (future work)
 
 
 async def _emit_copyright_label(

backend/tests/test_moderation.py

···
     assert scan.matches[0]["artist"] == "Test Artist"
 
 
-async def test_scan_track_emits_label_when_flagged(
-    db_session: AsyncSession,
-    mock_scan_result: ScanResult,
-) -> None:
-    """test that flagged scan result emits ATProto label."""
-    artist = Artist(
-        did="did:plc:labelertest",
-        handle="labeler.bsky.social",
-        display_name="Labeler Test User",
-    )
-    db_session.add(artist)
-    await db_session.commit()
-
-    track = Track(
-        title="Labeler Test Track",
-        file_id="labeler_test_file",
-        file_type="mp3",
-        artist_did=artist.did,
-        r2_url="https://example.com/audio.mp3",
-        atproto_record_uri="at://did:plc:labelertest/fm.plyr.track/abc123",
-        atproto_record_cid="bafyreiabc123",
-    )
-    db_session.add(track)
-    await db_session.commit()
-
-    with patch("backend._internal.moderation.settings") as mock_settings:
-        mock_settings.moderation.enabled = True
-        mock_settings.moderation.auth_token = "test-token"
-
-        with patch(
-            "backend._internal.moderation.get_moderation_client"
-        ) as mock_get_client:
-            mock_client = AsyncMock()
-            mock_client.scan.return_value = mock_scan_result
-            mock_client.emit_label = AsyncMock()
-            mock_get_client.return_value = mock_client
-
-            assert track.r2_url is not None
-            await scan_track_for_copyright(track.id, track.r2_url)
-
-            # verify label was emitted
-            mock_client.emit_label.assert_called_once()
-            call_kwargs = mock_client.emit_label.call_args.kwargs
-            assert call_kwargs["uri"] == "at://did:plc:labelertest/fm.plyr.track/abc123"
-            assert call_kwargs["cid"] == "bafyreiabc123"
-
-
-async def test_scan_track_no_label_without_atproto_uri(
-    db_session: AsyncSession,
-    mock_scan_result: ScanResult,
-) -> None:
-    """test that flagged scan without ATProto URI skips label emission."""
-    artist = Artist(
-        did="did:plc:nouri",
-        handle="nouri.bsky.social",
-        display_name="No URI User",
-    )
-    db_session.add(artist)
-    await db_session.commit()
-
-    track = Track(
-        title="No URI Track",
-        file_id="nouri_file",
-        file_type="mp3",
-        artist_did=artist.did,
-        r2_url="https://example.com/audio.mp3",
-        # no atproto_record_uri
-    )
-    db_session.add(track)
-    await db_session.commit()
-
-    with patch("backend._internal.moderation.settings") as mock_settings:
-        mock_settings.moderation.enabled = True
-        mock_settings.moderation.auth_token = "test-token"
-
-        with patch(
-            "backend._internal.moderation.get_moderation_client"
-        ) as mock_get_client:
-            mock_client = AsyncMock()
-            mock_client.scan.return_value = mock_scan_result
-            mock_client.emit_label = AsyncMock()
-            mock_get_client.return_value = mock_client
-
-            assert track.r2_url is not None
-            await scan_track_for_copyright(track.id, track.r2_url)
-
-            # label emission should not be called
-            mock_client.emit_label.assert_not_called()
-
-
 async def test_scan_track_stores_clear_result(
     db_session: AsyncSession,
     mock_clear_result: ScanResult,

docs/legal/meetings/2026-01-02-notes.md

···
+# meeting notes - 2026-01-02
+
+## action items
+
+1. ✅ **send docs to lawyer** - sent PDF versions of terms, privacy policy, meeting agenda
+
+2. **LLC formation** (lawyer handling)
+   - lawyer sending survey to collect info needed for filing
+   - he'll handle Secretary of State paperwork
+   - waiting on his end
+
+3. **stop posting public copyright labels** (me)
+   - lawyer says posting "potential violation" labels without acting on them doesn't help anyone
+   - safe harbor requires action when you have knowledge - public labels = knowledge
+   - need to redesign moderation pipeline:
+     - higher confidence threshold before flagging
+     - when flagged → automated user notification (DM or similar)
+     - then takedown
+   - **this is the main outstanding work**
+
+## key takeaway
+
+public labels saying "maybe copyright violation" without follow-through = liability risk. either don't flag it, or flag it and act on it.

docs/legal/meetings/2026-01-03-initial.md

···
+# lawyer meeting agenda
+
+## context
+
+- plyr.fm: music streaming on AT Protocol (decentralized)
+- 38 uploaders, 497 tracks, ~3600 plays (hobby scale)
+- pre-revenue, losing money
+- users upload audio, no enforcement it's their own
+- DMCA agent registered (DMCA-1069186)
+
+## ask 1: terms & privacy review
+
+- are these adequate for a pre-revenue project?
+- anything missing that creates imminent risk?
+- federation caveat sufficient? ("we can only remove from our servers, not other AT Protocol servers")
+
+docs: https://github.com/zzstoatzz/plyr.fm/pull/567
+
+## ask 2: LLC formation
+
+**state:** Delaware vs Illinois vs Wyoming - tradeoffs for solo, pre-revenue?
+
+**formation:** lawyer vs online service vs self-file? cost? timeline?
+
+**ongoing:** operating agreement needed? annual reports? what maintains/pierces liability shield?
+
+**existing stuff:** DMCA registration is personal - transfer to LLC? need separate bank account?
+
+## ask 3: copyright scanning
+
+we run AudD fingerprinting on uploads and publish results as public labels, but don't auto-remove - many results need manual review, confidence varies.
+
+does having public evidence of potential matches we haven't acted on create "red flag knowledge" risk? or is it reasonable given the noise in the data?
+
+## ask 4: image moderation / NCMEC
+
+we scan uploaded images via Claude (NSFW, CSAM, hate symbols, violence). flagged images are blurred, not removed.
+
+REPORT Act (2024) requires reporting CSAM to NCMEC when provider "becomes aware" - since we're scanning, a flag would trigger this. do we need to set up CyberTipline reporting, or is this overkill at hobby scale?
+
+## ask 5: future triggers
+
+when do I need to worry about music licensing, formal moderation policies, different liability posture - scale, revenue, or both?
+
+---
+
+## not asking today
+
+fundraising, employment, international compliance, licensing strategy

moderation/src/audd.rs

···
 
     let matches = extract_matches(&audd_response);
     let highest_score = matches.iter().map(|m| m.score).max().unwrap_or(0);
-    let is_flagged = !matches.is_empty();
+    let is_flagged = highest_score >= state.copyright_score_threshold;
 
     info!(
         match_count = matches.len(),

moderation/src/config.rs

···
     pub claude_api_key: Option<String>,
     /// Claude model to use (default: claude-sonnet-4-5-20250929)
     pub claude_model: String,
+    /// Minimum AuDD score to flag as potential copyright violation (default: 85)
+    pub copyright_score_threshold: i32,
 }
 
 impl Config {
···
             claude_api_key: env::var("ANTHROPIC_API_KEY").ok(),
             claude_model: env::var("MODERATION_CLAUDE_MODEL")
                 .unwrap_or_else(|_| "claude-sonnet-4-5-20250929".to_string()),
+            copyright_score_threshold: env::var("MODERATION_COPYRIGHT_SCORE_THRESHOLD")
+                .ok()
+                .and_then(|v| v.parse().ok())
+                .unwrap_or(85),
         })
     }
 

moderation/src/main.rs

···
         signer: signer.map(Arc::new),
         label_tx,
         claude: claude_client.map(Arc::new),
+        copyright_score_threshold: config.copyright_score_threshold,
     };
 
     let app = Router::new()

moderation/src/state.rs

···
     pub label_tx: Option<broadcast::Sender<(i64, Label)>>,
     /// Claude client for image moderation (if configured)
     pub claude: Option<Arc<ClaudeClient>>,
+    /// Minimum AuDD score to flag as potential copyright violation
+    pub copyright_score_threshold: i32,
 }
 
 /// Application error type.