Repository navigation
INSTAGRAM-002 — Add an approval-gated social-post state and audit model #92
Description
Outcome
Create a provider-neutral, human-approved post lifecycle before implementing Instagram side effects.
Scope
- Versioned states: draft, pending_review, approved, scheduled, publishing, published, failed, outcome_unknown, cancelled.
- Stable post/revision ID, source event/revision, bounded caption, media reference, alt text, UTC schedule plus display timezone, disclosure flag, and canonical payload hash.
- Approval records actor/capability/time/hash; any content/source/time edit invalidates approval.
- Server commands enforce scoped verified identity; clients cannot write provider state, audit, or secrets.
- Append-oriented audit covers create/edit/submit/approve/reject/schedule/cancel without raw request bodies or signed media URLs.
Acceptance criteria
- Impossible transitions, stale approvals, duplicate/concurrent commands, stale payload hashes, and cancellation races are negative-tested.
- No post publishes without recorded human approval.
- Self-approval policy is an explicit owner decision.
- Only intentionally public event data may become a draft; membership, discounts, WhatsApp, and Strava data are excluded.
- Schema/migration is additive and idempotent.
Dependencies
Coordinating backlog SEC-001, AUTH-003, and ADMIN-001. Can be designed in parallel with INSTAGRAM-001.
Coordination
Parent: #79
Do not begin implementation until dependencies are complete, this issue is assigned, and a timestamped CLAIMED comment naming the agent and branch is posted. Creation of this ticket is not a claim. Preserve the parallel agent work tracked by stable IDs in GITHUB_ISSUES.md.
Activity
INSTAGRAM-002A: approval-gated social-post lifecycle and audit state,…
rusty-sj commentedon Aug 30, 2026
Hi @daliu — you mentioned in the WhatsApp group that these issues are open for contributors, so I'd like to pick up INSTAGRAM-002.
The pure
socialPostStatereducer from INSTAGRAM-002A (#401 / #402) is merged but not yet wired to anything. I'd like to take the integration layer, starting with one small source-only slice:functions/socialPostStore.js— a transactional persistence wrapper around the existing reducer (read current record → run it and the command throughsocialPostState→ write the next record + append one audit entry) with an injected Firestore handle so it stays fully unit-testable. Unregistered inindex.jsfor this first PR, matching the INSTAGRAM-002A pattern.functions/socialPostStore.test.js— positive plus negative: duplicate / concurrent command →state_conflict, stale approval hash, idempotent cancel-of-cancelled.firestore.rules+tests/firestore-rules/— social-post and audit collections as server-only writes, officer-scoped reads, with allow/deny coverage.NOT AVAILABLE YETuntil the command entry points and UI land in follow-up slices.Follow-up slices would be the server command entry points in
index.jsbehind a capability check, then the React drafting / approval UI.One question before I start: is officer self-approval permitted policy, or must the approver be a different officer than the post author? The issue lists this as an explicit owner decision and it affects the reducer's capability checks.
I'll self-assign and post the timestamped CLAIMED comment now so the slice is coordinated; happy to adjust scope if you'd rather it land differently.
rusty-sj commentedon Aug 30, 2026
CLAIMED by
rusty-sjat2026-08-30T15:01:26Zon branchrusty-sj/issue-92-social-post-store, exact base1f27b0619c494cd3fc5e4c75dff521cffc584aae.Scope of this claim: the INSTAGRAM-002 integration layer on top of the merged INSTAGRAM-002A
socialPostStatereducer, delivered in reviewable slices. First slice is a source-only transactionalfunctions/socialPostStore.jspersistence wrapper with unit tests, server-onlyfirestore.rulesfor the social-post and audit collections with allow/deny coverage, and aNOT AVAILABLE YETdocumentation note. Noindex.jsregistration, no Instagram provider side effect, no deployment, and no provider or production action is claimed here.rusty-sj commentedon Aug 30, 2026
Opened draft PR #681 for the INSTAGRAM-002B slice described in the CLAIMED comment above: the source-only
buildSocialPostPersistencePlanbuilder, the server-onlysocialPosts/{postId}Rules boundary, and their tests. Functions lint +test:run(70 suites),test:rules(6 suites incl. the newsocial-post.test.js), and the root workflow/artifact suites all pass. Left as draft pending review and the self-approval policy decision (which does not block this slice).rusty-sj commentedon Aug 30, 2026
Opened PR #682 for INSTAGRAM-002E — the source-only canonical content record +
computeSocialPostPayloadHash, the caller-sidepayloadHashcomputation that #681's reducer/plan builder assume. Independent of #681 (branches off main).node:crypto+node:utilonly, unwired, 43 tests, lint + full functions suite + rules all green.Slice status on #92: #681 (002B, persistence plan + Rules) ready for review; #682 (002E, content + hash) ready for review; 002C (the command callable that runs the plan in a transaction) prototyped locally and will follow once 002B has a direction.