Guild expressions

Keep emoji and sticker inventory behind its own audit toggle and exact guild allowlist. Project Discord responses immediately to bounded stable metadata and exact creator IDs; never return CDN URLs, image bytes, uploader profiles, or unknown raw fields. Require complete guild, bot-member, role, permission, and inventory evidence before returning a read or plan, and treat missing creator evidence as a blocker whenever ownership is needed.

Keep every create, update, and delete behind the independent change toggle, process-keyed planning, signed interactive confirmation, write-aware host approval, final fresh-plan match, atomic one-shot operation-key reservation, pending content-free activity, one non-retried mutation, and exact metadata or absence readback. Discord requires CREATE_GUILD_EXPRESSIONS for creation. Updating or deleting an expression requires either MANAGE_GUILD_EXPRESSIONS or exact bot ownership together with CREATE_GUILD_EXPRESSIONS; managed emojis are never mutable through this workflow.

Creation must accept only one bounded canonical owned local file under a dedicated expression root. Never accept a remote URL, Discord CDN reference, data URL, base64 payload, arbitrary byte field, stream, directory, multiple files, or runtime-configurable Discord origin. Reject path escapes, symlinks, hardlinks, foreign ownership, unstable reads, unsupported formats, invalid sticker dimensions, excessive animation duration, and files above Discord's byte limits before reservation. Require fresh VERIFIED or PARTNERED guild-feature evidence before planning a Lottie upload. Upload only the reviewed byte snapshot bound into the fresh plan.

Fail closed on absent targets, normalized-name collisions, missing emoji role references, incomplete permissions, local capacity exhaustion, malformed Discord evidence, changed file state, and stale plans. Permanently spend every reserved key after any outcome. A known pre-write Discord 4xx may be failed; transport errors, malformed mutation responses, Discord 5xx responses, and readback failures are uncertain and potentially completed. Never retry, compensate, or roll back automatically.

Serialize guild-expression changes per guild inside one process as defense in depth. The production facade also acquires a durable exact guild expression-collection claim, so connector processes sharing the activity-state root exclude overlapping changes and retain the claim after uncertainty. Never persist names, descriptions, tags, role names, local paths, file metadata, image bytes, content digests, audit reasons, raw operation keys, permission evidence, or raw Discord responses. Activity and operation records may contain only exact guild and expression IDs, expression kind, action, plan digest, operation-key hash, timestamps, fixed verification and outcome values, activity ID, and sanitized error category.

Canonical source: SECURITY.md