8 Commits

Author SHA1 Message Date
Angelo B. J. Luidens de3d355c80 Deploy prep: Dockerfiles for admin (Next standalone) + scheduler (Bun)
admin/Dockerfile: 2-stage monorepo Next.js standalone (outputFileTracingRoot added to next.config so the bundle traces workspace deps). scheduler/Dockerfile: single-stage Bun runtime, validated by a local docker build. .dockerignore excludes node_modules/.next/.turbo/.git. Build context = monorepo root; runtime env DATABASE_URL + REDIS_URL.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-03 16:22:15 -04:00
Angelo B. J. Luidens b9be5578f9 X/Twitter structural support + per-package tsconfig scoping
X/Twitter (live posting gated on an X developer app, registered separately):
- schema: add 'twitter' to OutletSchema (sanitize 280-char limit already present).
- packages/twitter-client: X API v2 client (POST /2/tweets, OAuth2 user Bearer),
  injectable fetch, 280-char guard; 4 contract tests.
- apps/scheduler/src/dispatch.ts: makeOutletDispatcher routes by outlet
  (linkedin.* -> linkedin, twitter -> twitter), fail-closed for unconfigured
  outlets; 4 tests. main.ts wires both outlets fail-closed until creds exist.

Monorepo fix: add a local tsconfig.json (extends root, include src) to each
package + non-admin app. Without it, every package's `tsc --noEmit` compiled the
WHOLE repo via the root config (no JSX/DOM) and choked on the admin .tsx — masked
until now by turbo build caching.

Tests: 135 passing + 13 gated across 12 tasks.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-03 16:14:53 -04:00
Angelo B. J. Luidens 1d1494a77c Stage 5: admin dashboard (Next.js App Router) + completes Stage 2.3 handlers
Operator console for the Publishing Engine — cool/forge Nine Laws temperature
(forest + citrus, amber deliberately absent).

- Auth: Authentik forward-auth header parsing (x-authentik-username / -groups ->
  roles) with a dev-stub principal (AUTH_DEV_PRINCIPAL). Pure auth-core is
  unit-tested; getPrincipal binds it to next/headers.
- API route handlers (closes Stage 2.3): /api/content, /api/approvals,
  /api/publications/cancel, /api/feature-flags. Each: Zod parse -> principal ->
  role authz (requireAllowed) -> DB write + append-only audit. handleMutation
  maps errors to 401/403/404/409/422/500 with a correlation id.
- Pages (force-dynamic, DB-backed): /queue (approve/cancel), /publications/[id]
  (detail + metrics), /metrics (AST day x hour heatmap with text+color per WCAG
  1.4.1), /auth/linkedin (OAuth status + per-outlet kill-switch toggle).
- A11y: semantic landmarks, skip-link, scoped table headers, aria-live error
  alerts, heatmap text redundancy.
- Tests: 10 pure (auth-core, heatmap) + 5 gated handler-integration (authz tiers
  + happy paths vs real Postgres). Strict tsc + next build (standalone) green.

Deferred (need a browser/IdP runner): live Authentik binding, axe-core/Playwright
+ NVDA CI, Lighthouse gates (Stage 5.3/5.4).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-03 15:30:16 -04:00
Angelo B. J. Luidens c0dad39d55 Stage 4.1: BullMQ publish worker + Redis/Postgres integration
- apps/scheduler/src/queue.ts: PUBLISH_QUEUE, BullMQ-compatible Redis connection
  factory, queue factory, default retry/backoff job opts.
- apps/scheduler/src/worker.ts: makePublishWorker factory drives the publish-loop
  state machine (queued -> dispatching -> published | failed/dlq) and persists
  each transition to publications. Dispatcher is injected (fake in tests; the
  LinkedIn client swaps in once Gate 0.9 / CMA lands).
- apps/scheduler/src/main.ts: runnable entry; boots the worker; LinkedIn dispatch
  is fail-closed until CMA is approved.
- apps/scheduler/src/worker.integration.test.ts: gated behind INTEGRATION=1;
  verifies enqueue -> consume -> row published within 5s, and failure -> dlq with
  error recorded. Run against real Redis + Postgres.

Closes the Stage 4.1 DoD (enqueue -> worker-consume -> DB row updated within 5s).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-03 15:12:44 -04:00
Angelo B. J. Luidens 339801966e Restore green type-check baseline (117 tests + tsc all pass)
Fixes 3 pre-existing TypeScript errors that vitest did not catch but
tsc --noEmit did:
- apps/mcp-linkedin/src/tools.test.ts: spread TOOL_NAMES before .sort()
  (readonly tuple has no mutating sort)
- packages/sanitize/src/corpus.test.ts: cast through unknown to FixtureMeta
- db/migrations/rehearse.ts: add 'postgres' driver dependency (also needed
  to run the migration itself)

Also: apps/admin test script uses --passWithNoTests (Stage 5 admin app has
no test files yet, vitest exited non-zero on empty).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-03 13:27:15 -04:00
Angelo B. J. Luidens a4e4306fb1 Stage 4 partial: cadence optimizer + publish-loop state machine
Pure-function pieces that need no Redis/DB to verify (11 new tests):
- apps/scheduler/src/cadence.ts: Beta posterior model, propose(history, config)→[Proposal]; threshold gates (≥8 samples, ≥4 weeks, ≥20% ratio, disjoint 95% CIs); never auto-applied (RBR)
- apps/scheduler/src/publish-loop.ts: state-machine transition function for pending→queued→dispatching→published with retry-vs-DLQ branch on failure and cancellation path

What defers to live Redis + Postgres + LinkedIn:
- 4.1 BullMQ queue + Redis enqueue→consume integration test
- 4.2 End-to-end publish loop trace (POST /api/content → DB → BullMQ → LinkedIn fake → publication row)
- 4.3 Chaos test for idempotency on retry

117/117 tests pass cumulative across all packages and apps.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-26 12:59:46 -04:00
Angelo B. J. Luidens 7aa3137a91 Stage 3 partial: LinkedIn MCP server (OAuth, 9 tools, kill-switch, refresh lock)
What ships (testable without live LinkedIn, 27 new tests):
- apps/mcp-linkedin/src/oauth.ts: auth URL builder + HMAC-signed state validation (CSRF + tamper + expiry)
- apps/mcp-linkedin/src/refresh-lock.ts: advisory-lock helper for token rotation (Plan TEA gap 3); concurrency test verifies 4 attempts → 1 succeeds + 3 denied
- apps/mcp-linkedin/src/kill-switch.ts: 30s-cached feature-flag query (Plan Objective 8 + TEA gap 10)
- apps/mcp-linkedin/src/tools.ts: 9 Zod tool schemas matching Plan §3.2 (whoami, auth_status, create_post, create_article, upload_media, create_post_with_media, delete_post, get_post_metrics, get_profile_stats)
- apps/mcp-linkedin/src/server.ts: validateToolCall + outletForAuthorUrn pure helpers

What defers to live-LinkedIn session (gate 0.9):
- 3.1 OAuth round-trip with real auth URL → callback → token row
- 3.4-3.7 Live throwaway test posts + delete-within-5min audit
- 3.9 Fail-safe halt with Telegram webhook
- 3.12 MCP stdio transport wired to @modelcontextprotocol/sdk

106/106 tests pass across all packages and apps.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-26 12:57:00 -04:00
Angelo B. J. Luidens 1dc1a1a07a Stage 0: governance scaffolding + monorepo bootstrap
Phase 1 foundation for the Stargue Publishing Engine (plan v2, BMAD
panel-reviewed 2026-04-19 — 1 APPROVE, 6 REVISE, 0 REJECT; all principles >=3).

- Governance doctrine adopted from DQMS
  (.clinerules/12-foundational-principles.md,
  .claude/hooks/gate-plan-exit.sh, .claude/skills/bmad-plan/SKILL.md)
- Bun workspaces + Turbo; apps/{mcp-linkedin,scheduler,admin};
  packages/{schema,sanitize,linkedin-client,observability}
- Drizzle schema (content, publications, approvals, metrics,
  linkedin_tokens, audit, outlet_feature_flags) with idempotency_key
  UNIQUE and kill-switch table per TEA/dev panel revisions
- LinkedIn API canon: Posts API /rest/posts (not legacy UGC); OAuth
  auth-code without PKCE; secretbox (not sealed-box); Community
  Management API as separate approval gate from MDP
- Frontmatter Zod schema (status, language, outlets[], sanitize,
  scheduled, version)
- Pino observability with PII redaction
- Expand-then-contract migration runbook
- Plan + panel verdicts mirrored to docs/plans/
- Deferred gates logged (Dokploy PaaS verification, LinkedIn Dev
  Portal app registration)

bun install + bun run typecheck both exit 0 across 11 workspaces.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-19 07:22:07 -04:00