glass beadian
aa5e262f3a
Self-hosted multi-platform broadcast newsroom for activist collectives: publishing pipeline with group approval and DST-proof scheduling, TweetDeck-style column wall with hostile-content-safe rendering, live control room with Auto Director, bridged chat governance with polls and quorum, distributed sandboxed transcode workers, encrypted content-addressed archive, monthly analytics. MIT licensed. See README.md and docs/.
1.5 KiB
Publishing execution
The API and scheduler share this built PostgreSQL repository. Callers own the
pg.Pool and its lifecycle. scheduleAttempt and cancelAttempt run inside the
API's existing tenant transaction; other methods establish their own RLS-bound
transaction. Mutation order is workspace, draft, schedule, attempt, audit.
A business attempt gets a positive decimal attempt number and one provider key.
Transport retries, Temporal replay and lease recovery retain that key.
retryLater requires proof that the attempt has no unresolved delivery:
429/refusal of the current request cannot disprove an earlier ambiguous send.
Use retryDeduplicated for that case; it retains dispatch evidence and the
original dedupe deadline. Both settlements are owner/epoch/expiry fenced.
Unknown work cannot get a new key or send automatically.
The SDK around-send hook holds withDispatchGate across the bounded request,
after rate-limiter waits. Provider evidence is appended separately before
finalization, including evidence from stale owners. A current owner can finalize
a receipt after authorization changes; the audit records those changes. Receipt
recovery uses a separate workflow ID and never needs another provider send.
Runtime boot never executes owner DDL. Apply migrations through the API's offline
migrate CLI with an explicit SUPER_DATABASE_URL; API writes and scheduler
startup require completed 019, FORCE RLS, valid indexes and the sp_app role.
018 is retained unchanged because local evidence records its application.