10DLC registration and consent checks before your app texts leads

cd <your app's folder>
claude

Audit this app for the four checks in this guide, read-only:
https://receiptsgroup.com/guides/ai-app-texts-calls

Find every place the app can send a text, place a call, or hand a contact to another system. For each one, tell me:
1. Consent gate: what decides this contact may be texted or called? Does it say no by default? Can an imported or purchased list pass it? Do we store who agreed, when, where, and the exact words they agreed to?
2. 10DLC: are texts sent from a 10-digit number, and is there anything that stops sending until the numbers are registered and attached?
3. STOP: which words opt someone out, is the opt-out checked before every text AND every call, and how fast does it take effect?
4. Test data: can a test or fake contact ever reach a real CRM, a real phone number, or a real customer's account?

Answer as a table: place in the code, check, what it does now, gap, the smallest fix. Don't change any files, don't run anything that sends, calls or posts, and don't print any keys or phone numbers. Then wait for me.

[ ] By checking this box, I agree that <Your Business Name> may call and text me at the
number above about <what you'll contact them about>, including marketing messages sent
using automated technology. Agreeing is not a condition of any purchase. Message
frequency varies. Message and data rates may apply. Reply STOP to opt out, HELP for help.
<link to your privacy policy> <link to your terms>

def may_contact(contact, channel, suppressed):
    """True only when this contact has a recorded, form-given yes and hasn't opted out. Default: no."""
    c = contact.get("consent") or {}
    if contact.get("phone") in suppressed:          # Check 3: STOP wins, on every channel
        return False
    if contact.get("is_test"):                       # Check 4: test data never contacts anyone
        return False
    if c.get("source") != "web_form":               # imports, purchases and CSV columns are not consent
        return False
    return bool(c.get("agreed_at") and c.get("wording_version") and c.get("page")
                and channel in (c.get("channels") or []))

OPT_OUT = {"stop", "quit", "end", "revoke", "opt out", "optout", "cancel", "unsubscribe", "stopall"}

def on_inbound_text(phone, body, suppressed):
    words = body.strip().lower()
    first = words.split()[0] if words else ""
    if words in OPT_OUT or first in OPT_OUT:
        suppressed.add(phone)            # save it to your database, not just memory
        return "You're unsubscribed and won't get more messages from <Your Business Name>."
    if words == "help":
        return "<Your Business Name>: <how to reach you>. Reply STOP to opt out."
    return None

def is_test(contact):
    return bool(contact.get("is_test")) or contact.get("email", "").endswith("@example.com")

def deliver(contact, destination):
    if is_test(contact) and destination.get("production"):
        raise RuntimeError("refused: test contact to a live system")
    ...

Search this codebase for every function, webhook, cron job or script that can send a text, place a call, send an email, or create a contact in another system. List each with its file and line, and whether it calls our consent gate first. Read-only.

For each send path you listed without the consent gate, show me the smallest change that calls may_contact() first and refuses on False. One path at a time, show me the diff, wait for my yes.

Write a test (no real sends; mock the provider) that: texts a test contact, receives "Stop" from that number, then tries to text AND call it again, and asserts both are refused. Run it and show me the result.

Show me what we store when someone checks the consent box: every field, an example row with fake data, and anything missing compared with the list in this guide's Check 1. Read-only.