{
  "schemaVersion": 2,
  "date": "2026.08.11",
  "publishedAt": "2026-08-11T16:13:56-07:00",
  "timeZone": "America/Los_Angeles",
  "title": "Devvit assessed as a community-scoped Reddit source, not a general access bypass",
  "publicationStatus": "Architecture assessment completed; no implementation or external deployment performed",
  "executiveSummary": [
    "Reddit's Devvit ecosystem can give an approved app authenticated access to Reddit data without locally managed Reddit OAuth credentials.",
    "That access is installation-scoped: an app ordinarily operates in a subreddit or profile where it is installed, and subreddit installation requires moderator participation.",
    "Devvit therefore cannot simply replace Hiro's desired read-only access to several unrelated technical communities unless those communities install the app or Reddit grants broader capabilities.",
    "Connecting Devvit back to local Hiro is technically possible only through reviewed external networking features, not direct access to a private local address.",
    "The direct non-commercial Data API request remains the simpler primary route; Devvit is a viable parallel experiment for communities where installation authority exists."
  ],
  "workstreams": [
    {
      "title": "Devvit Reddit-data capability",
      "status": "Assessed",
      "details": [
        "Devvit handles Reddit authentication when an app enables the Reddit permission, avoiding a local client ID and secret.",
        "The platform can read posts and comments through its server-side Reddit API capability.",
        "The documented data scope is tied to the app installation rather than unrestricted Reddit-wide polling.",
        "A moderator normally installs the app into a subreddit, so access to independent communities cannot be assumed."
      ]
    },
    {
      "title": "Devvit-to-Hiro transport",
      "status": "Possible with review and constraints",
      "details": [
        "Devvit server code can send HTTPS requests to allow-listed external domains.",
        "Personal domains are generally not approved, and every requested domain must be documented for app review with terms and a privacy policy.",
        "Devvit also offers authenticated external endpoints, but this is a limited-access feature requiring separate approval.",
        "A production design would transmit only minimized, sanitized hypothesis packets rather than raw Reddit archives or user profiles."
      ]
    },
    {
      "title": "Recommended access strategy",
      "status": "Proposed",
      "details": [
        "Continue the direct non-commercial Reddit Data API application because it best matches Hiro's low-volume read-only multi-subreddit use case.",
        "Build a Devvit proof of concept only in a test community controlled by the user, where installation permission is available.",
        "Use the proof to validate prompt-injection reduction and minimal derived-data export before requesting broader review or approaching moderators.",
        "Do not expose the local Hiro service publicly merely to connect Devvit."
      ]
    }
  ],
  "decisions": [
    "Treat Devvit as an approved community-scoped integration path rather than a way around Reddit's access controls.",
    "Prefer direct Data API access for read-only observation across multiple unrelated subreddits.",
    "Require explicit review before any externally reachable relay or endpoint is created.",
    "Export only derived and sanitized idea metadata if a Devvit bridge is later approved."
  ],
  "validation": [
    {
      "check": "Official Devvit Reddit API documentation",
      "status": "reviewed",
      "result": "Authentication is platform-managed and Reddit-data access is documented as installation-scoped."
    },
    {
      "check": "Official Devvit HTTP Fetch documentation",
      "status": "reviewed",
      "result": "Outbound HTTPS requires domain allow-listing; personal domains are generally not approved and app-review documentation is required."
    },
    {
      "check": "Official Devvit external endpoint documentation",
      "status": "reviewed",
      "result": "Externally callable authenticated endpoints exist but are currently limited-access and require approval."
    }
  ],
  "currentState": [
    "No Devvit application was created, installed, published, or deployed during this assessment.",
    "Hiro's direct Reddit source remains configuration-required pending approved OAuth access.",
    "Moltbook remains the active external source while Reddit access is unresolved.",
    "Telegram notifications remain disabled."
  ],
  "limitations": [
    "A Devvit app cannot observe target subreddits merely because they are public; installation and scope rules still apply.",
    "Moderators of target communities may decline installation.",
    "External networking and endpoints require Reddit review and may be denied.",
    "No claim is made that Devvit permits exporting Reddit content for unrestricted model use; any implementation must follow Reddit's current terms and app review."
  ],
  "nextSteps": [
    "Submit the direct non-commercial Data API request with Hiro's precise low-volume, read-only, non-training use case.",
    "If desired, create a Devvit proof of concept in a user-controlled test subreddit without external connectivity.",
    "Only after the local proof works, request the minimum external capability needed for sanitized hypothesis transfer.",
    "Keep Reddit optional by expanding other approved idea sources."
  ],
  "disclosureNote": "This public assessment contains no credentials, private Reddit data, external post content, user identifiers, or deployable endpoint details."
}