Don't reply to bots

We run a social bot that builds apps. Mention it on Bluesky and it reads your post, generates a little web app from it, publishes the app, and replies with a live link — the whole platform loop compressed into one social gesture. The mention-hub source is public if you want to see how it works.

Recently it grew a proactive lane: it searches for open "what are you building?" and "drop your startup" threads, reads the poster's own recent posts, has a model invent a small app that person might actually chuckle at, builds it, and drops the bespoke link in-thread. Not a canned pitch — a gift.

Then it replied, enthusiastically, to hackernewsbot.bsky.social's "Ask HN: What Are You Working On?" — a syndicated Hacker News headline, posted by a mirror bot, watched by no one. Bot talking to bot, in public, under our own account.

Put the guard where the signal is

The instinct is to fix the classifier: teach the LLM gate that decides share-or-skip to recognize news feeds. That's the wrong layer. The classifier only ever sees the post text, and the text — "what are you working on?" — is a perfectly genuine invitation. A human could have written it, and humans do, every day.

The thing that gives it away is the account: …bot.bsky.social. So the fix lives where the account is visible — a deterministic bot-account check in the triage function, before any model is consulted. No prompt got smarter, because no prompt could have: the signal simply wasn't in the input it sees.

It's a small incident with a general shape. When a filter keeps failing, check whether the tell it needs is even present in the layer you're tuning. Often the honest fix is boring code in a different function, not a cleverer prompt.

Opt-in changes every rule

A sibling rule fell out of the same incident: the bot filter and the new once-a-month per-author cooldown apply only to the lane that speaks uninvited. Anyone who @-mentions the bot has opted in — and opt-in changes every rule. Mention it five times, get five apps. The proactive lane, by contrast, is deliberately throttled: dark by default until the owner enables it, gated by a share-or-skip model call, capped tightly enough that a proactive bot never reads as a spam bot.

One more boundary worth naming: in the personalized lane, the idea derived from reading someone's timeline becomes only the build prompt — untrusted input headed for a sandboxed app, same as any mention. It never becomes the reply text. The no-echo, no-injection posture survives a feature whose whole point is "make it personal."

Now on Threads, too

The same bot lanes now run on Threads as well as Bluesky. Every platform has different bot-tells — different handle conventions, different mirror ecosystems — but the architecture carries: deterministic account-layer guards for the uninvited lane, generous rules for people who ask, and derived text that can steer a build but never a reply.

If you want to see the loop from the other side: mention the bot with an app idea. You've opted in — it'll build you something.