Set up the Discord application¶

phpbotscout runs as a Discord application you own. This covers registering it, the settings that matter, and the permission set to install it with.

1. Create the application¶

discord.com/developers/applications → New Application → name it phpbotscout. The name is visible to members, in the member list and on every message.

2. General Information¶

Description¶

The description is read by members, so it should say what the bot does and what it will not do — the bot being legible about itself is a stated interaction principle, and the non-autonomy claim is the part people actually care about:

I answer questions about the phpboyscout toolkit from its public docs and
source, and I always cite where the answer came from. If I can't find it
documented, I'll offer to raise a GitLab issue for you — with your say-so,
never silently.

I also flag content for human moderators. I don't act on my own.

I'm a bot, not a person.

Maximum 400 characters. Keep the three claims — cites sources, consent before filing, does not act autonomously — since each maps to a requirement the bot is held to.

App icon¶

The avatar lives at docs/assets/brand/avatar-1024.png — a robot scout in the phpboyscout house palette (petrol-teal, brass-gold, cream, charcoal), riffing on the circuit-backdrop style of the blog avatar so the bot reads as a sibling to its owner rather than a generic app.

It is cropped tight deliberately. Discord shows the avatar large only in the profile popout; everywhere that matters — the member list, beside every message — it renders at roughly 40px in a circle. Compose for the circle and for 40px, not for the square you upload.

avatar-source-1254.png is the uncropped original, kept so a different crop can be pulled later without regenerating.

3. Bot settings¶

The token¶

Reset Token reveals it once. Store it as an environment-variable reference through the credentials chain (R-OPS-6) — never as a literal in config, never committed.

Discord scans public repositories for leaked tokens and invalidates on a hit, so a committed token breaks the bot rather than merely exposing it. .gitleaks.toml is configured to catch it first.

The Application ID and Public Key are not secret and may be committed or shared.

4. Install with the minimal permission set¶

OAuth2 → URL Generator. Scopes: bot and applications.commands — the second is what allows slash commands, and omitting it is easy to do and irritating to diagnose.

Permissions for phases 1–4 (read and answer only):

Do not grant Manage Messages, Timeout Members or Ban Members yet. Permissions are added when an interface element demands one, never pre-emptively (R-MOD-15b). Phase 5 re-invites with the same URL plus the moderation permissions, and the grant updates in place — so starting minimal costs nothing to change, and means a compromised bot before Phase 5 cannot delete anything.

5. Install to the test guild first¶

Create a second Discord server that only you are in, and install the bot there first. It takes seconds and costs nothing.

Through the early phases the bot will connect and disconnect repeatedly, crash mid-thread, post malformed output, have its token reset, and have permissions changed and re-granted. None of that belongs in front of a real community.

Phase 5 makes it non-negotiable. Testing moderation means deliberately posting content that trips the rules to confirm detection fires. That cannot happen in a live server — the content is the harm, whatever the intent. Integration tests likewise create threads, post messages and exercise the enforcement path; pointed at the live server they are indistinguishable from a malfunctioning bot.

What the test guild cannot do is tell you whether the answers are any good. A server with one member produces no real questions. It proves the machinery works; the benchmark corpus and the 30-reviewed-answers gate (R-ANS-18) prove the answers are worth reading. Keep the two apart.

6. Account hygiene¶

• Enable 2FA on the owning Discord account. Some server-management actions require it, and this account will own a bot holding moderation permissions from Phase 5.
• Consider a Team (Developer Portal → Teams) rather than personal ownership. An app owned by a personal account is tied to that account's continued existence and access; transferring later is more friction than creating it under a team now.

What you have at the end¶

An Application ID, a bot token in the credentials store, and the bot sitting silently in the test guild with read-and-post permissions. Nothing connects to it until Phase 1b.