quorlasocial/HANDOFF.md

Quorla: handoff (21 Oct 2026)

Where things stand and what's next. Live app: https://app.quorlasocial.com (HestiaCP server, ~/APPS/quorlasocial, Docker behind the Hestia nginx proxy on 127.0.0.1:4310). Hosting steps: docs/hosting.html.

Live and working

• Dashboard on the server: team logins, admin can add teammates and reset passwords, scheduler runs there.
• Meta (Facebook + Instagram) through the system user. Infini is Instagram-only (no Facebook Page by choice).
• Connections page with quotas (data/quota.json; YouTube 10,000 units/day Pacific time, rolling 24 h for others).
• TikTok: Sandbox app "Quorla testing" connected (test user @metatron_digitalagency). Domain verified (two DNS TXT records, both must stay). Details: docs/tiktok-app.md.
• Google: connecting works now.
  • YouTube → Cloud project Quorla. GBP → project GMB Audit (gmb-audit-489406, GBP API already approved).
  • Both are in Testing mode. Only test users can connect: dev@metatroncubesolutions.com and metatroncubesoftwaresolutions@gmail.com. Add more under Google Auth Platform → Audience → Test users.
  • Testing-mode tokens expire after 7 days, so reconnect weekly until the app is verified. Details: docs/google-app.md.
• Search Console: quorlasocial.com verified. Legal pages: /privacy and /terms.

Deploy (server, as dev)

cd ~/APPS/quorlasocial && git pull && docker compose up -d --build
# Homepage for quorlasocial.com (replaces Hestia's "Coming Soon" page):
sudo cp -r ~/APPS/quorlasocial/site/. /home/user/web/quorlasocial.com/public_html/   && sudo chown -R user:user /home/user/web/quorlasocial.com/public_html

Google verification and TikTok review both check that quorlasocial.com explains the app and links to the privacy policy. Request-access buttons email support@quorlasocial.com: make sure that mailbox exists (Hestia → Mail).

To do next

1. TikTok, YouTube and Google Business Profile are on the wrong client (C2C Agricorp India). After the next deploy, open Connections → C2C Agricorp India and click Move on each card, then pick MetatronCube Software Solutions Canada. No reconnecting needed. Then choose the Metatroncube location for GBP.
2. First test posts (21 Oct): YouTube (private) and Google Business Profile posted fine. TikTok Direct Post is blocked until TikTok reviews the app (public accounts); use "Send to the TikTok app to finish" in the TikTok options until then (tested, works on the public business account). See docs/tiktok-app.md. LinkedIn: app "Quorla" created and verified; Community Management API requested 21 Oct (watch info@ for Microsoft Vetting Services). Keys are saved in Connections; Connect works once approved.
3. TikTok Production: record the demo video (script in docs/tiktok-app.md), fill in the listing, and submit for review.
4. Google: submit the OAuth app for verification (YouTube also needs its API audit before the quota goes above the default).
5. Still to set up: LinkedIn, Pinterest, Threads (Meta permissions) and Reddit apps (docs/platforms.md).
6. Later: marketing site, Stripe. (The dashboard now uses the Quorla logo and colours; PDF reports keep the agency branding.)
7. Optional: on the server, run git stash drop (left over from the branding CRLF fix).

Rules that don't change

• Nothing publishes without a person approving the exact caption and media.
• White-label: no Metatroncube mention on client posts.
• Keys and secrets live only in .env or the encrypted Connections vault, never in chat, Git, or docs.
• Tests: node --test connector/test/platforms.test.mjs connector/test/quota.test.mjs. On Windows, list the files by name; passing the folder fails.