# Quorla: handoff (21 Oct 2026)

Where things stand and what's next. Live app: https://app.quorlasocial.com (HestiaCP server, `~/APPS/quorlasocial`,
Docker behind the Hestia nginx proxy on 127.0.0.1:4310). Hosting steps: `docs/hosting.html`.

## Live and working
- Dashboard on the server: team logins, admin can add teammates and reset passwords, scheduler runs there.
- Meta (Facebook + Instagram) through the system user. Infini is Instagram-only (no Facebook Page by choice).
- Connections page with quotas (`data/quota.json`; YouTube 10,000 units/day Pacific time, rolling 24 h for others).
- **TikTok:** Sandbox app "Quorla testing" connected (test user @metatron_digitalagency). Domain verified
  (two DNS TXT records, both must stay). Details: `docs/tiktok-app.md`.
- **Google:** connecting works now.
  - YouTube → Cloud project **Quorla**. GBP → project **GMB Audit** (gmb-audit-489406, GBP API already approved).
  - Both are in Testing mode. Only test users can connect: dev@metatroncubesolutions.com and
    metatroncubesoftwaresolutions@gmail.com. Add more under Google Auth Platform → Audience → Test users.
  - Testing-mode tokens expire after 7 days, so reconnect weekly until the app is verified. Details: `docs/google-app.md`.
- Search Console: quorlasocial.com verified. Legal pages: /privacy and /terms.

## To do next
1. **TikTok, YouTube and Google Business Profile are on the wrong client** (C2C Agricorp India). After the next
   deploy, open Connections → C2C Agricorp India and click **Move** on each card, then pick
   MetatronCube Software Solutions Canada. No reconnecting needed. Then choose the Metatroncube location for GBP.
2. First test posts, as drafts approved by a person before anything publishes:
   - TikTok: private ("Only me"). Needs a short vertical 9:16 video.
   - YouTube: unlisted/private upload with a title.
   - GBP: one update post on the Metatroncube profile.
3. TikTok Production: record the demo video (script in `docs/tiktok-app.md`), fill in the listing, and submit for review.
4. Google: submit the OAuth app for verification (YouTube also needs its API audit before the quota goes above the default).
5. Still to set up: LinkedIn, Pinterest, Threads (Meta permissions) and Reddit apps (`docs/platforms.md`).
6. Later: marketing site, Stripe. (The dashboard now uses the Quorla logo and colours; PDF reports keep the agency branding.)
7. Optional: on the server, run `git stash drop` (left over from the branding CRLF fix).

## Rules that don't change
- Nothing publishes without a person approving the exact caption and media.
- White-label: no Metatroncube mention on client posts.
- Keys and secrets live only in `.env` or the encrypted Connections vault, never in chat, Git, or docs.
- Tests: `node --test connector/test/platforms.test.mjs connector/test/quota.test.mjs`. On Windows, list the files by name;
  passing the folder fails.