Approved posts may carry mediaAssetIds and altTexts since the repository
gate was lifted, but the scheduler built connectors without an asset
loader, so Mastodon and Telegram rejected every post with media as
INVALID_POST and alt texts never reached them.
- media.ts: loadAsset reads media_assets inside the execution's tenant
(app.workspace_id, RLS forced); openAsset fetches the sealed object,
opens the SPENC1 frame with S3_KEK and checks the content hash.
Read-only; bytes go worker to provider and never through the API.
- preparePostForDispatch maps positional altTexts onto
providerMetadata.altText keyed by asset id.
- Instagram joins the scheduler registry so its posts fail with an
explicit connector error instead of UnknownProviderError.
Self-hosted multi-platform broadcast newsroom for activist collectives:
publishing pipeline with group approval and DST-proof scheduling, TweetDeck-style
column wall with hostile-content-safe rendering, live control room with Auto
Director, bridged chat governance with polls and quorum, distributed sandboxed
transcode workers, encrypted content-addressed archive, monthly analytics.
MIT licensed. See README.md and docs/.
