Ten Gates or It Doesn't Post: The Autonomous Engagement Engine

Module 00: The Thesis

This class builds an autonomous social engagement engine that discovers relevant posts on X, Bluesky, and LinkedIn, drafts replies using Gemini or a local Ollama model, runs every draft through a ten-point fail-closed safety gate, and posts only what passes with zero violations. The whole pipeline runs on a solo architect's workstation.

Two failure modes make an engagement agent dangerous. The first is sounding wrong. If the agent uses emoji, hashtags, hype words, canned slogans, or bot intro phrases like "great post" or "thanks for sharing," the reply advertises itself as automated. The brand takes a credibility hit on every such reply. Modules 02 and 06 eliminate this by banning specific phrases at both the gate level and the persona-spec level.

The second failure mode is behaving intrusively. If the automation raises a Chrome window while the architect is typing, the workflow is destroyed. If two runs overlap and interleave writes to the same JSON file, history is corrupted. If the agent posts from the wrong account, the damage is immediate and public. Modules 04 and 05 eliminate these by moving the browser offscreen, locking on PIDs, and verifying account identity before every post.

The rest of the class is the elimination of these two failure modes, piece by piece, with the code that implements each one.

Module 01: Architecture

The system is decoupled by design. Each stage reads a JSON file, does its work, and writes a JSON file. The contract between stages is the file format, not a function call. This means any stage can be re-run with the same input, inspected by opening the JSON in an editor, or replaced with a different implementation. A failure at any stage leaves a clean artifact on disk and nothing posted.

The pipeline starts with engage_discover.js, which scans platform feeds and produces engage_candidates.json containing roughly 150 raw candidates per run (MEASURED). These are filtered for English language and relevance. Of the 150, typically 6 to 12 survive as verified English candidates (MEASURED).

engage_draft.js takes each candidate and calls the LLM. Gemini is the primary model. If Gemini fails, the system falls back to the local Ollama server. The drafter produces a structured JSON response with a relevance score, a decision (reply or skip), a reason, and a draft.

engage_safety_gate.js runs the ten-point audit on every draft. Zero violations required. A failed audit returns the candidate to the drafter for up to 3 re-draft attempts (ASSERTED). If all three attempts fail the gate, the candidate is dropped. Passed drafts move to engage_review_queue.json.

engage_reply.js connects to Chrome over CDP on port 9222, runs AccountGuard to verify identity, moves the window offscreen, and executes the post. After posting, it verifies the DOM, takes a screenshot for proof, and writes the entry to engage_history.json.

Why decoupled: each stage writes a JSON artifact, so any stage can be re-run, inspected, or replaced without touching the others. A failure never leaves a half-posted reply.

Module 02: The Ten Gates

This is the headline module. The function auditDraft() in engage_safety_gate.js implements all ten checks as a fail-closed gate. Fail-closed means: zero violations required. Not "fewer than three." Not "weighted score above a threshold." Zero. A draft with one emoji is rejected the same as a draft with ten violations.

Why fail-closed rather than scored: a threshold lets a bad reply through on a good day. If the gate scores violations and the threshold is 3, then a draft with 2 hype words and 1 bot phrase passes. That draft sounds like a bot. A violation count of zero does not have this failure mode.

A failed audit returns the draft to the drafter for a maximum of 3 re-draft attempts (ASSERTED). If all three fail, the candidate is dropped entirely. No partial-pass path exists.

The ten checks

1. Emoji check. The EMOJI_REGEX covers Unicode ranges U+1F600 through U+1FAFF plus U+2600-26FF and U+2700-27BF. These ranges include smileys, symbols, dingbats, and supplemental pictographs. Any match is a violation.
2. Hashtag check. The regex /#\w+/ catches any word prefixed with a hash. No hashtags in replies, ever.
3. Exclamation point check. A string includes test for the literal character. Zero exclamation points. Use periods instead.
4. Banned hype words. The BANNED_HYPE_WORDS list: game-changer, game changer, insane, unlock, mind-blowing, 10x, huge, revolutionize, secret sauce, paradigm shift. Any match in the lowercased draft is a violation.
5. Canned slogans. The BANNED_CANNED_SLOGANS list: "typing syntax to directing," "directing the system logic," "agents do the rest," "stop being a typist," "become the architect," "shifts from typing to directing," "vibe coding without constraints." These are stock AI-generated phrases that recur across models.
6. Bot intro phrases. The BANNED_BOT_INTRO_PHRASES list: great post, great question, I'd be happy to, as an AI, in today's, fascinating read, thanks for sharing. The single most common tell of a bot reply is opening with "great post."
7. Forbidden tool claims. The FORBIDDEN_TOOL_CLAIMS list: i use cursor, my cursor setup, i run stable diffusion, my midjourney prompt, in comfyui. These are tools the author does not use as a daily driver. Claiming otherwise is a factual error.
8. Character limit. Per-platform: X under 270, Bluesky under 290, LinkedIn under 600 (ASSERTED). The draft length is compared against the platform limit. Over-length is a violation.
9. Link discipline. If the draft contains a URL or "ddsboston.com," the gate checks whether the original post asked for a resource. If it did not, the link is unasked promotion and is a violation.
10. Relevance score. If the model returned a score below 80 out of 100 (ASSERTED), the draft is a violation. The model evaluates relevance; the gate enforces the floor.

The complete auditDraft() function:

Anchor fact: the gate runs in under 5 ms per candidate (MEASURED). It is string includes and regex tests against four constant arrays. No network calls, no model inference. The draft generation step is three orders of magnitude slower.

The central diagram: nine PASS, one REJECT. Gate 07 catches the bot intro phrase "great post." The candidate is dropped.

Module 03: Model Failover

The local Ollama server at http://127.0.0.1:11434 is shared across multiple applications and background services on the workstation. Models are installed, updated, and removed independently. Hardcoding a model name is what makes a local-first system fragile. The model that was installed yesterday may not be installed today.

getBestOllamaModel() queries the Ollama tags API at /api/tags at runtime, retrieves the list of installed models, and walks an eight-model preference list:

1. qwen2.5-coder:14b
2. qwen2.5-coder-14b-32k:latest
3. qwen3-coder:30b
4. qwen2.5:14b
5. deepseek-r1:8b
6. llama3.1:8b
7. mistral-nemo:latest
8. gemma4:latest

The first match is cached for the rest of the run. If none match, the selector falls back to whatever is installed. If the API cannot be reached, the hard default is qwen2.5-coder:14b.

callGemini() tries four model IDs in order: gemini-2.5-pro, gemini-2.5-flash, gemini-1.5-pro, gemini-3.1-pro-preview. The response is requested as structured JSON with a defined schema. If all four fail, it throws and the failover catches it.

callOllama() includes a critical detail: JSON-fence stripping. Local models frequently wrap their JSON output in markdown code fences. The function strips leading ```json and trailing ``` before parsing. Without this, the JSON.parse fails on otherwise correct output.

Anchor facts: Gemini draft latency 1.2 to 2.5 seconds (MEASURED). Local Ollama draft latency 3.8 to 6.2 seconds on an RTX 3060 12GB (MEASURED).

Module 04: Stealth Automation

The engagement agent needs a real browser with real cookies, real sessions, and real logged-in accounts. A headless throwaway instance has none of these. Chrome is launched with --remote-debugging-port=9222 against the user's actual profile directory.

Puppeteer connects over CDP by fetching the webSocketDebuggerUrl from http://127.0.0.1:9222/json/version and calling puppeteer.connect() with defaultViewport: null (MEASURED: this preserves the existing viewport rather than forcing a default resolution).

The focus fix

The problem: an automation that raises a window while the architect is typing destroys the session it was supposed to support. Every Puppeteer connect() brings Chrome to the foreground. Every page navigation can trigger a focus event.

The fix: immediately after connecting, evaluate window.moveTo(-32000, -32000) on the page. The coordinates are negative enough to push the window entirely off every connected monitor. Zero focus displacement (MEASURED).

The window is offscreen but alive. It still loads pages, executes JavaScript, responds to Puppeteer commands, and renders the DOM. You can bring it back with window.moveTo(100, 100) at any time. The negative coordinates are within the Win32 LONG range and are the standard technique for hiding an HWND without minimizing it.

Module 05: AccountGuard and PID Locking

AccountGuard

Identity is verified per platform, each differently:

• X: Reads the logged-in handle and checks it against an allowlist (ddsvibeacademy, ddsboston24). If the wrong account is active, it attempts to switch. If the switch fails, it throws.
• Bluesky: Reads the logged-in handle and asserts exact equality to ddsboston.com. No switch path. Mismatch = throw.
• LinkedIn: Navigates to the profile URL and asserts that the page text contains "Robert McCullock." This is a content assertion, not a handle check, because LinkedIn does not expose the logged-in handle in a predictable DOM location.

On any failure, AccountGuard throws rather than posts. The rule: posting as the wrong account is worse than not posting.

PID Locking

engage_lock.js prevents two failure modes: duplicate concurrent runs, and corrupted JSON history from interleaved writes.

The lock is a JSON file containing the PID and a timestamp. When a second run starts, it reads the lock, calls process.kill(pid, 0) to test whether the owning process is still alive. Signal zero does not terminate anything. If the process exists, the call succeeds silently and the second run exits with a lock collision. If the process is gone, the call throws ESRCH and the lock is treated as orphaned.

A stale timeout of 15 minutes (ASSERTED) reclaims any lock older than that, regardless of PID status. A healthy run completes in under 5 minutes.

Release is wired to both the exit event and SIGINT (Ctrl+C). This ensures the lock file is cleaned up on normal exit, on manual interrupt, and on crash recovery via the stale timeout.

Module 06: The Persona Spec

The system prompt below is the complete, unmodified instruction injected into engage_draft.js. It is reproduced verbatim as a teaching artifact. The twelve rules are the behavioral contract the model must follow. The safety gate enforces most of them mechanically, but rules 1 (accuracy over helpfulness), 5 (diagnostic question over guess), and 6 (default to silence) are judgment calls only the model can make.

The specificity of this prompt is the lesson. "Accuracy over helpfulness" is not a suggestion. "One sharp diagnostic question instead of a guess" is not a style preference. These are architectural constraints that prevent the agent from producing the kind of reply that sounds helpful and is technically wrong.

Module 07: What It Measures

The system replies fourteen times a day at most (6 + 4 + 4) across three platforms, and skips far more than it sends. Of 150 raw discovery candidates per run, 6 to 12 survive the English and relevance filters. The 80/100 score floor drops most of those. The safety gate catches the rest.

That is the design, not a limitation. A system that replies to everything it finds is not autonomous. It is a spam bot with a better vocabulary.

Frequently Asked Questions