@hraness/ghostget 0.17.2

package/skills/ghostget/references/safety-and-state.md

@@ -0,0 +1,214 @@
+# Authenticated API safety and state
+
+Use this reference before recording signed-in traffic, resolving browser-held secrets, or invoking R2/R3 operations.
+
+## Contents
+
+- [Separate authority from mechanism](#separate-authority-from-mechanism)
+- [Bind the authenticated account](#bind-the-authenticated-account)
+- [Use persistent reads without changing their meaning](#use-persistent-reads-without-changing-their-meaning)
+- [Constrain native provider CLIs](#constrain-native-provider-clis)
+- [Keep browser authority narrow](#keep-browser-authority-narrow)
+- [Constrain first-party HTTP](#constrain-first-party-http)
+- [Minimize HAR exposure](#minimize-har-exposure)
+- [Interpret execution states](#interpret-execution-states)
+- [Reconcile uncertainty](#reconcile-uncertainty)
+- [Clean up task-owned state](#clean-up-task-owned-state)
+
+## Separate authority from mechanism
+
+Confirm that the user authorized the exact account, target, and remote effect. An exploratory request to inspect a site or derive a client does not authorize a live mutation.
+
+The five-minute digest binds the installed adapter, code-owned contract hash, transport, exact input, attachment content, auth-realm fingerprint, risk, and complete dispatch schedule. It proves what will run. It does not decide whether the action is wise, lawful, permitted by provider rules, or authorized.
+
+Use disposable or low-stakes fixtures. Keep employment, recruiting, financial, medical, legal, security, and intimate conversations out of pressure tests.
+
+Schema-v5 version-1 reviewed-template manifests are inert derivation reservations, not request authority. Keep every operation `capture-required`; validation rejects `reviewed`, and planning or execution must fail before cookie acquisition, token resolution, or network I/O. Use a code-owned contract for executable operations until a future contract version 2 provides a reviewed current-account preflight and response-scope binding.
+
+## Bind the authenticated account
+
+Treat every auth ID as one stable provider-account realm. A cookie/profile name is not account proof.
+
+After adding a signed-in realm, probe and persist its current stable subject explicitly:
+
+```sh
+ghostget auth bind linkedin-main --site linkedin
+ghostget auth bind x-main --site x
+```
+
+Before a private read or any dispatch:
+
+1. Resolve the current viewer/account through a reviewed first-party identity request.
+2. Require one stable provider ID.
+3. Compare it with the realm's expected account binding.
+4. For actor-bearing requests, require the request actor to equal that binding.
+5. Require the response actor and requested target/parent bindings to match the plan.
+
+Fail before dispatch on a missing, ambiguous, changed, or mismatched identity. Use a new auth ID for a second account. Require an explicit reviewed rebind after a deliberate login change; do not mutate an existing realm silently.
+
+Official OAuth auth is a separate realm and must satisfy its own subject/scope binding. Never fall back between browser-session and OAuth auth.
+
+## Use persistent reads without changing their meaning
+
+A successful subject-bound R1 invocation publishes one encrypted snapshot of
+its exact validated input and bounded output. Repeat the same invocation with
+`--cache-only` to read it without a browser or provider roundtrip. Omit the flag
+to rerun the reviewed R1 contract and publish a newer validation.
+
+Treat the adapter hash, operation, full auth realm, verified subject, validated
+input, transport, and exact executable contract as part of the query identity.
+Do not drop a cursor, change a limit, expand a folder, or substitute an auth ID
+to force a hit. A contract or account change intentionally produces a miss.
+
+Cache freshness is an observation, not provider authority. An unchanged
+revalidation advances validation time without fabricating a data revision.
+Failed, partial, or indeterminate reads retain the last good snapshot.
+Revalidation reruns the selected R1 operation; it does not silently
+perform `auth sync`, and it must not introduce acknowledgement or presence
+effects outside that operation's reviewed contract.
+
+The separate omni storage class derives a strict shared Conversation, Message,
+or Notification only through a provider-owned, versioned materializer. Its
+account-lifetime identity includes the adapter, provider plugin closure,
+surface, and auth incarnation. Provider pages retain explicit completeness,
+membership, cursor, and tombstone evidence. Absence never means deletion
+without a complete partition or explicit tombstone. Omni v1 has no
+provider-authored write-invalidation tags. Auth-incarnation, materializer, and
+plugin implementation identity changes strand the prior normalized
+coordinates, while exact-query freshness advances only through explicit
+revalidation. A materializer failure records the failed exact data revision and
+retains the last good entities as `retained-after-drift`; it must not weaken
+parsing or mutate the exact snapshot to make drift disappear.
+
+Auth replacement and removal rotate a durable local lifetime identity before
+cleanup. Projection and provider-session ciphertext from an earlier lifetime
+must remain unreadable even if identical locator bytes are later recreated.
+
+The projection key is bound to an authenticated store-ownership marker. Ghostget
+refuses a missing, malformed, or replacement key while projection ciphertext
+or that marker remains. If the key is irretrievably lost, remove exactly
+`read-projections/`, `omni-read-projections/`, `.projection-encryption-key`, and
+`read-projection-control/store-key.json` beneath `GHOSTGET_STATE_HOME`, retain the
+other control records, and rebuild snapshots through live revalidation.
+
+## Constrain native provider CLIs
+
+Treat a provider CLI as one reviewed transport, not as a shell. Require a
+schema-v6 `localCli` selector backed by a source-plugin tool identity that pins
+the final executable digest for the current platform. A package-manager name,
+version range, release tag, reported version, or launcher digest is not enough.
+
+Use only operation-owned fixed argument templates. Strip ambient credentials,
+targets, account defaults, proxies, update settings, debug state, and user
+plugin discovery from the child environment. Give the process private bounded
+config, data, cache, and temporary roots. Require exact account, target,
+conversation, message, and other resource IDs. Never use an interactive picker
+or fuzzy selector for a mutation.
+
+Parse stdout and stderr strictly from `unknown`; cap both and enforce a
+Ghostget-owned deadline because an upstream timeout flag may not be effective.
+Do not log or persist argv. When the upstream CLI accepts private text only in
+argv, document the same-account process-inspection exposure and minimize the
+child lifetime.
+
+For a mutation, enter the durable dispatch boundary before process start. A
+timeout, signal, malformed response, or lost response after that point is
+indeterminate. Never let an upstream retry option or a new process invocation
+bypass Ghostget's at-most-once fence. Reconcile only through a separate exact
+read declared by the semantic operation.
+
+## Keep browser authority narrow
+
+Prefer target-filtered cookies. Use a path-backed private profile snapshot only when capture or a reviewed token source needs storage beyond cookies. Schema-v1/v2 DOM recipes are retired and fail validation, installation, planning, and execution for every origin; the direct browser-recipe executor is disabled as well. Never automate a concurrently running source profile.
+
+Use agent-browser only for:
+
+- rendered capture or HAR recording;
+- sign-in/session bootstrap in a task-owned profile;
+- cookie acquisition;
+- one reviewed meta/storage/captured-header secret source;
+- one current registered-operation revision lookup.
+
+Do not use it to click, type, upload, publish, react, or send at runtime for a supported capability. DOM state is neither the operation contract nor its verification result.
+
+Profile mode may have broader public-host egress than filtered cookies. `--trust-profile-egress` acknowledges that exposure; it does not widen allowed API origins or permit private-network access.
+
+## Constrain first-party HTTP
+
+Keep request construction in code. Fix the origin, method, path structure, query names, body shape, headers, timeout, response limit, successful status/content-type pairs, projections, and bindings. Reject redirects.
+
+Send session cookies only to the reviewed exact origin. Send CSRF/XSRF and authorization values only from the reviewed source to the fixed matching header. Keep those values in memory and never return them from the bootstrap helper.
+
+Do not add a generic HTTP, GraphQL, Rest.li, header, or URL interface. A captured endpoint is evidence, not authority. If a contract is absent or drifted, return `capture-required` and perform no request.
+
+## Minimize HAR exposure
+
+- Default to `--content none`.
+- Record one operation and one bounded fixture at a time.
+- Use mode-`0700` directories and mode-`0600` files.
+- Avoid printing or searching raw HAR values in terminal output.
+- Finish or discard every managed derivation.
+- Delete externally supplied HARs after `ghostget derive analyze`.
+- Use `ghostget derive review` only while the managed HAR is task-owned private state. The first review seals recording, list output exposes only bounded sanitized entry metadata, and `--fixtures -` accepts labeled strings only over stdin without echoing or persisting their values. The entry-only `--field-names -` probe accepts 1–50 unique, bounded, non-credential schema-key hypotheses on stdin and reports only candidate indices, fixed structural locations, structural value types, and truncation. It compares exact own keys in bounded parsed JSON, never values, and keeps credential subtrees and dynamic-map positions opaque. The two stdin probes are mutually exclusive and invalid input fails before sealing. `--review-origin` may select one canonical exact HTTPS origin only when its hostname was admitted by the immutable `--domains` declaration at derivation start; undeclared origins fail before sealing. Review cannot replay a request.
+- Serialize each derivation from preflight through cleanup with its fixed identity-bound lifecycle gate. Publish an initialization marker as soon as the socket boundary exists, and publish readiness only after HAR capture, final in-origin validation, and exact session-metadata binding. Only `list` and `discard` may inspect unready or post-reboot state; never delete a live helper that could not be closed.
+- Treat the local OS account as the filesystem trust boundary. Inode binding, no-follow traversal, and unpredictable quarantine names protect against symlink swaps and accidental or cooperative same-account races; they cannot defend against hostile code already running as the same account, which can mutate `GHOSTGET_STATE_HOME` and browser state directly. Keep that account and machine trusted.
+- Never commit a raw HAR, authenticated DOM, screenshot, profile, cookie file, or storage dump.
+
+Successful finish deletes the managed raw HAR and emits inert structural evidence. Even that evidence can reveal operation names and response field names; review it before publishing.
+
+## Interpret execution states
+
+- `capture-required`: no current reviewed runtime contract exists. No request or browser-action fallback may run.
+- `pending`: ghostget durably reserved a confirmed action, but no terminal result exists. Reconcile it.
+- `succeeded`: an R1 request passed its exact response contract.
+- `submitted`: every planned R2/R3 dispatch passed its exact response and target/account bindings.
+- `failed`: execution stopped before dispatch. Diagnose and create a fresh preview only if the action remains authorized.
+- `partial`: earlier dispatches were verified, but the schedule stopped before completion.
+- `indeterminate`: a dispatch started, but its response or binding could not be verified.
+
+Never retry `pending`, `partial`, or `indeterminate` automatically. Do not clear the ledger or change whitespace/metadata to evade duplicate refusal.
+
+`submitted` is stronger than a cleared composer because it requires a reviewed response contract. It still does not create a provider-side exactly-once transaction. Inspect remote state when the action matters.
+
+## Reconcile uncertainty
+
+1. Record the run ID and inspect `ghostget runs show <run-id>`.
+2. For a supported exact desired-state readback, run `ghostget runs reconcile
+   <run-id> --json`. Current runs recover their original input only from the
+   encrypted run-, auth-, and contract-bound capsule. The recognized legacy X
+   bookmark run instead requires its exact original input through `--input`;
+   ghostget verifies the receipt's canonical input hash before any read.
+3. Use only a separate reviewed R1 request that inspects the exact target
+   without acknowledgement traffic. The reconciler validates the returned
+   state kind and target before recording it.
+4. Treat every reconciliation as an append-only observation. It never changes
+   the original receipt, idempotency ledger, or provider state and never
+   creates retry authority.
+   Once an exact readback durably records `desired-state-observed`, ghostget
+   releases only that run's encrypted capsule and digest-bound attachment
+   bundle. A nonmatching or inconclusive observation retains both so another
+   bounded inspection remains possible.
+5. A currently absent desired state does not prove that an earlier write never
+   applied briefly. Leave the ledger intact whether the effect is present,
+   absent, or still uncertain.
+6. Wait and inspect again when provider processing may be delayed. Issue a
+   materially new action only after fresh authorization and a new exact
+   preview; never retry the unsettled action automatically.
+
+Receipts keep hashes, contract identity, transport, account-realm fingerprint, dispatch counts, origin, timestamps, and categorical errors. They omit credentials, response bodies, message/post text, private identifiers not required for reconciliation, and original attachment paths.
+
+Recovery capsules are private AES-GCM state under `GHOSTGET_STATE_HOME`. They contain
+the exact confirmed input needed for a bounded readback but never appear in
+receipts, plans, logs, or reconciliation observations. Do not delete the
+recovery key or capsule for an unsettled run; a missing key is not regenerated
+during readback, and new writes are refused while older capsules remain,
+because replacing the key would only destroy recoverability. Confirmed
+attachment bundles follow the same lifecycle: settled and proven pre-dispatch
+outcomes remove them, while `pending`, `partial`, and `indeterminate` runs keep
+them until an exact successful reconciliation is durably recorded.
+
+## Clean up task-owned state
+
+Cancel unused plans with `ghostget plans cancel <digest> --yes`, discard derivations with `ghostget derive discard <id> --yes`, and remove obsolete auth locators explicitly. Uninstalling the wrapper does not recursively remove browser credentials or ghostget state.
+
+If browser capture/bootstrap shutdown cannot be verified, preserve the exact recovery handle and close only that task-owned session before deleting its directories. Do not use broad recursive cleanup against shared browser state.

package/skills/ghostget/references/settlement-and-duplicate-cleanup.md

@@ -0,0 +1,79 @@
+# Social settlement and duplicate cleanup
+
+Use this after every confirmation and before any possible repost or deletion.
+
+## Settle one publish attempt
+
+1. Run `ghostget runs show <run-id> --json` and append the result state to the task ledger.
+2. Record any response-bound provider locator. Do not recover a target by text search, profile-feed position, or approximate time.
+3. For `submitted`, use the publish contract's independently verified readback evidence. When it does not establish external availability and an observed `posts.read` accepts the exact returned locator, invoke that exact R1 schema and record the observation.
+4. For `pending`, `partial`, or `indeterminate`, preserve all evidence. Run `ghostget runs reconcile <run-id> --json` only when the installed exact contract advertises reconciliation. Reconciliation is read-only, append-only, and never repeats the mutation.
+5. Treat an absent or inconclusive read as unresolved, not as proof that the write never happened. Repeat only the bounded read/reconciliation when supported; never repeat the mutation.
+6. For pre-dispatch `failed`, create a new preview only while the exact original action remains authorized.
+
+If a current legacy reconciler explicitly requests original input, supply only the exact confirmed input that Ghostget verifies against the receipt. Never reconstruct or alter it to force a match.
+
+## Keep an exact duplicate ledger
+
+Maintain a private append-only event ledger with one attempt row containing:
+
+- package identity and exact scalar-input hash;
+- ordered attachment hashes and media types;
+- platform, adapter, transport, auth-realm label, and bound subject;
+- plan digest and expiry, run ID, and current run state;
+- exact provider locator returned or retained after acceptance;
+- readback kind and first observed time;
+- `duplicate-risk-of` links to earlier attempt run IDs;
+- any canonical delete plan/run and exact post-delete proof.
+
+Do not put credentials, cookie values, response bodies, post text, or original local paths in the ledger. Never merge two attempts because their text looks alike. Record one provider object per exact locator, including an intentional duplicate.
+
+## Create a fresh duplicate-tolerant intent
+
+Only proceed when the user freshly authorizes the exact platform, exact package, and possibility that the unresolved source run already created the post. Append the source link to the private task ledger, then create a fresh preview:
+
+```sh
+ghostget invoke <adapter> posts.publish \
+  --input @/absolute/private/post-input.json \
+  --auth <bound-auth-id> \
+  --duplicate-risk-of <indeterminate-run-id> \
+  --preview --json
+```
+
+Version 1 accepts exactly one source run and only a one-dispatch R3 `web-session-api` `posts.publish` operation. An official OAuth or other `provider-api` attempt is ineligible. Ghostget must prove that the source is an unclaimed, retained, terminal `indeterminate` run with the exact same adapter, auth realm, operation, risk, input, contract, receipt, journal, ledger, recovery capsule, and retained attachment bytes. A historical attempt under another contract or adapter remains in the task ledger but is not a valid source. Review the warning and successor fingerprint in the new preview, then confirm its digest once; never put `--duplicate-risk-of` on `ghostget confirm`.
+
+Ghostget permanently elects only one successor for the source and keeps successful successor idempotency evidence from expiring. If the source changes, reconciles, lacks exact retained evidence, already elected a successor, or fails any binding check, stop and report the refusal. Do not select a looser source, add a nonce, clear state, or bypass the check.
+
+If a duplicate-intent child fails before successor election, its dispatch remains at zero and the source can remain eligible; re-check both runs, then re-preview that same source to derive the same successor intent. If the source was elected but a later local journal step failed, the lineage is intentionally stranded and must not be retried. If a child becomes `indeterminate` after dispatch and another possible duplicate is freshly authorized, cite that eligible child—not any ancestor—to extend one linear chain. Never branch or reuse an already claimed source.
+
+This does not settle or replace an older run. Keep its Ghostget ledger and recovery material intact, and reconcile it separately when exact evidence becomes available.
+
+## Delete a proven duplicate
+
+Deletion is eligible only when all of these are true:
+
+1. The exact provider locator is in the duplicate ledger.
+2. An observed exact `posts.read` proves the object, current-account authorship, and content/media binding before deletion.
+3. The same installed adapter exposes canonical `content.delete` as observed and executable. An absent or `capture-required` operation, or an R4 runtime block, means deletion is unavailable.
+4. Its schema accepts that exact locator; the preview binds the account, target, side effect, and contract; and the user confirms that digest once.
+5. A separate exact post-delete R1 contract proves a target-bound tombstone or exact not-found result whose reviewed semantics establish deletion. General feed absence is not proof.
+
+If deletion becomes `pending`, `partial`, or `indeterminate`, preserve it and reconcile only through its advertised exact readback. Never retry deletion. Never substitute `posts.delete`, another semantic name, direct browser interaction, raw HTTP, or capture replay for `content.delete`.
+
+For the observed Bluesky contract, carry the exact authored `post_uri` and the
+authoritative current `expected_cid` into the preview. CID drift is a refusal,
+not permission to delete a newer revision. A successful mutation is settled
+only by authoritative PDS `RecordNotFound`; AppView/feed absence alone is not
+proof. Never use this cleanup path for an intended post merely because another
+platform attempt is uncertain.
+
+## Report availability time precisely
+
+Keep these times distinct:
+
+- plan creation/confirmation: local authorization, not publication;
+- dispatch start/finish: Ghostget transport timing, not external availability;
+- provider-created time: a provider-authored value, when strictly bound;
+- first observed time: when exact independent readback saw the object.
+
+Report first observation as “available no later than” that time; the actual visibility onset may have been earlier. When readback remains unresolved, say “provider accepted” only when proven and “external availability unverified.”

package/skills/ghostget/references/social-platform-routing.md

@@ -0,0 +1,66 @@
+# Social platform routing
+
+Use this as routing guidance only. Always inspect `ghostget capabilities <adapter> --json`; installed adapter state and schemas are authoritative and may change.
+
+| Surface | Candidate adapter | Signed-in realm | Reference post shape | Meaning |
+| --- | --- | --- | --- | --- |
+| X | `x-web` | Browser cookies/profile | `body`; optional image fields when exposed | Consumer X post |
+| X | `x` | Official OAuth | `body`, optional `media` and aligned alt-text fields; leave `made_with_ai` unset or `false` for user-supplied cross-post copy | Documented API post |
+| LinkedIn | `linkedin-web` | Browser cookies/profile | `body`, `visibility`, optional image and accessibility fields | Member or explicitly bound organization post |
+| LinkedIn | `linkedin` | Official OAuth | Inspect installed schema | Documented API post |
+| Bluesky | `bluesky-web` | Profile-backed Bluesky web session | `body`, optional image, media type, and alt text | AT Protocol feed post |
+| Substack | `substack-web` | Browser cookies/profile | `body`, optional Note media | Public Substack Note, not an article/newsletter |
+| Threads | `meta-web` | Browser cookies/profile | Text/image `posts.publish`: `body`, audience, optional one PNG. Video `media.publish`: `body`, audience, one MP4. | Threads post |
+
+Cleanup is capability-driven too. At this reference revision, `bluesky-web`
+exposes observed `content.delete@1` only for one current-account post URI plus
+its exact confirmed CID. `reddit-web` exposes observed `content.delete@1` only
+for one exact current-account post fullname plus its confirmed title, followed
+by independent absence readback. `x-web` reserves `content.delete@1` as
+`capture-required`; `substack-web content.delete@1` is observed for one exact
+authored personal Note with exact actor/body pre-read and independent 404
+absence. LinkedIn and Threads
+deletion remain unavailable unless their installed canonical capability
+independently says otherwise.
+
+## Selection rules
+
+- Use exactly one adapter and one stable bound account realm per surface.
+- Prefer the transport the user named or already configured. Do not fall back from browser-session to OAuth, or vice versa, because one operation is unavailable.
+- Require `posts.publish.state == "observed"`. An invalid adapter or `capture-required` operation must produce no request.
+- Treat each current schema's required fields, file cardinality, byte/media bounds, and accessibility-field shape literally. The table is not a capability promise.
+- Preserve input image order. Require alt-text arrays to align one-to-one when the schema exposes them.
+- Re-check capabilities before every new preview. A plan or run remains governed by its bound contract identity when installed support later changes.
+- A provider may reject an otherwise valid image for dimensions, animation, color profile, or account entitlement. Report that provider-owned failure without converting the file unless the user asks for a derivative.
+- For user-supplied cross-post copy, never mark the package as AI-generated. Follow [X AI disclosure](x-ai-disclosure.md). Leave official `x` `made_with_ai` unset or `false`. `x-web` `posts.publish` has no such input field.
+- Prefer a Ghostget transport over the X composer. If the user explicitly requested a composer fallback, require Content disclosure Made with AI OFF before Post, then open the live permalink. A sparkle label means that target failed.
+
+## Common invocation shape
+
+Write exact input JSON to a private task file when shell quoting would be fragile, then invoke:
+
+```sh
+ghostget invoke <adapter> posts.publish \
+  --input @/absolute/private/post-input.json \
+  --auth <bound-auth-id> \
+  --preview --json [--headed]
+```
+
+Review the returned digest and confirm it within five minutes:
+
+```sh
+ghostget confirm <plan-digest> --json [--headed]
+```
+
+Use headed execution when the installed signed-in web adapter or bound realm requires it and the user authorized it. Follow the preview's returned `confirmCommand` exactly so headed mode is preserved.
+
+Do not place credentials in the input file. Delete task input files after planning; Ghostget's plan owns encrypted confirmed input and attachment bundles for its lifecycle.
+
+## Parity decisions
+
+- If text exceeds one platform's bound, request shorter shared copy or an explicit platform-specific variant. Do not silently use `threads.publish`.
+- If the ordered image set exceeds one platform's bound, request a smaller shared set or an explicit per-platform set. Do not manufacture a collage.
+- If LinkedIn requires visibility and the user requested a public cross-post, use `public`; otherwise obtain the user's audience choice.
+- If Threads requires `audience` and the user requested ordinary posting, use the installed schema's ordinary/default audience only when that meaning is explicit in the capability description.
+- At this reference revision, reviewed Threads text/image publication accepts no attachment or exactly one PNG, and reviewed video publication requires exactly one MP4. A dummy PNG, collage, or composer click-path changes the package and is not an installed fallback. JPEG and other image types remain unavailable unless the installed schema independently lists them.
+- If image alt text is supported on only some targets, preserve the same factual description on every target that accepts it; unsupported alt text is not a reason to alter the visible post.

package/skills/ghostget/references/social-profile-stats.md

@@ -0,0 +1,195 @@
+# Social profile statistics
+
+Use this workflow for a scheduled, read-only collection of exact counters from
+explicitly selected social profiles, owned publications, and organization
+pages. Ghostget owns acquisition, invocation authority, and target binding. The consumer
+owns history, public field selection, presentation, and delivery.
+
+## Preconditions
+
+Run `ghostget operator doctor --json`, then inspect each named adapter with
+`ghostget capabilities <adapter> --json`. Every requested operation must be
+installed, `observed`, and R1. Every authenticated operation must be bound to
+the intended account realm; a public operation must instead prove its exact
+requested target. Record a gap for a missing, changed, ambiguous, or
+cleanup-unsafe realm and continue with the independent rows. `capture-required`
+is not a partial success and performs no provider request.
+
+Use a normal invocation, never `--cache-only`, for today's observation. A
+cached value may explain the last known level, but it cannot become today's
+sample. Do not use general browser automation, selectors, raw HTTP, or a public
+page's rounded display as a fallback.
+
+## Hraness account manifest
+
+The authoritative ordered collection contract is the strict
+[Hraness social-profile manifest](hraness-social-profile-stats.json). Load it
+as foreign JSON, reject unknown fields and duplicate account keys, then flatten
+each account's ordered `reads` array without changing order. Its auth IDs are
+local Ghostget locators, not credentials.
+
+Before invoking a read, confirm that the current installed adapter still owns
+the named operation with `state: "observed"`, `risk: "R1"`, and
+`sideEffect: "none"`. Confirm its public or authenticated authority kind, exact
+input, output provider and canonical target URL, metric keys, expected gaps,
+and `requiredDelayBeforeMs`. A mismatch is a categorical contract gap for that
+read. Do not reinterpret the manifest or fall back to a different capability.
+The current X accounts are `x-hraness` and `x-lifedaysleft`.
+The second exact handle is `lifedaysleft`.
+
+Bluesky and GitHub profile and organization statistics come from public target-bound APIs.
+Invoke these rows without `--auth`. Ghostget assigns each reviewed operation a
+deterministic public authority for receipts and exact R1 caching. Supplying an
+auth locator is an error.
+
+The Twitch row targets exactly
+`https://www.twitch.tv/hranessdotcom`. Invoke the installed observed
+`twitch-web profiles.read` capability with `{"profile":"hranessdotcom"}` and
+the `twitch-chrome` realm. Ghostget binds the authenticated current viewer before
+it binds the fixed login-parameterized channel response to that viewer's
+immutable identity, then accepts followers only as an exact nonnegative
+integer. A missing, changed, or mismatched realm, an ambiguous target, or
+provider drift creates a categorical gap. Do not substitute browser
+automation, raw HTTP, a rounded public display, a cached value, or an estimate.
+
+Keep the two X calls sequential, both LinkedIn calls sequential, and both
+Substack calls sequential because each pair shares one authenticated realm.
+`linkedin-chrome` must be a path-backed `browser-profile` locator over a
+private dormant Chrome snapshot, optionally overlaid with current filtered
+cookies from the selected Chrome profile. A cookie-source-only LinkedIn realm
+is not an acceptable scheduled fallback because LinkedIn invalidates the
+exported session outside its browser/device context. Before the initial
+snapshot, or after a contained identity preflight returns 401, load LinkedIn
+normally in the source Chrome profile, confirm the session is current, fully
+quit Chrome, and replace the dormant snapshot. A filtered cookie overlay does
+not revive a stale source session.
+Leave a 60-second idle interval after the LinkedIn personal read before the
+company read; current live evidence shows shorter intervals can trigger a
+temporary identity-preflight redirect even when the realm remains correctly
+bound. Do not routinely rebind or rotate the locator.
+The first scheduled version should run the whole table sequentially. This is a
+small daily workload and avoids provider bootstrap, keychain, and session-lock
+contention. A later caller may parallelize distinct realms with a small bound,
+but must never overlap work on the same `(surface, auth ID)` pair.
+
+Invoke each row with bounded stdin and exact JSON output:
+
+```sh
+printf '%s' '<input-json>' \
+  | ghostget invoke <adapter> <operation> --input - --auth <auth-id> --json
+```
+
+For the public Bluesky and GitHub rows, omit the auth option:
+
+```sh
+printf '%s' '{"handle":"hraness.bsky.social"}' \
+  | ghostget invoke bluesky-web profiles.read --input - --json
+printf '%s' '{"username":"0thernet"}' \
+  | ghostget invoke github-web profiles.read --input - --json
+printf '%s' '{"organization":"hraness"}' \
+  | ghostget invoke github-web organizations.read --input - --json
+```
+
+`status: "failed"` R1 envelopes include one secret-free `readFailure`
+projection with a closed `category` and its only valid
+`retryDisposition`. A caller may make at most one retry for the read, after
+60 seconds, and only when the disposition is
+`retry-once-after-60s`. A transport retry consumes that same budget. Never
+retry `repair-auth` or `do-not-retry`; report the bounded category and
+continue with the next independent row. Do not parse receipt errors or
+provider exception text to invent a retry policy. Do not clear durable cleanup
+admission or reboot a host without separate operator authorization.
+
+`github-web organizations.read` first binds the exact organization and its
+declared public repository count, then completes the fixed public repository
+pagination before summing `stargazers_count`. It returns `stars` only when the
+complete repository set is available and bound; it never substitutes a partial
+page, a rounded display total, or a prior observation.
+
+The manifest marks Threads `recentViews` with the exact unavailable reason
+`not-authorized` as an expected categorical gap until the account becomes
+eligible. Keep reporting only that reason as unavailable. Treat
+`provider-drift`, `not-exposed`, and every other unavailable reason as an
+unexpected failure. Accept the metric normally once the same target-bound read
+returns an exact available count.
+
+Do not put an auth ID, provider receipt, cache key, run ID, subject identifier,
+or raw provider response in the consumer snapshot. Do not print or persist
+cookies, headers, tokens, HTML, first-party response bodies, or exception text.
+
+## Accept exact metric observations
+
+Accept a row only when the live invocation reports a succeeded R1 receipt and
+its live output binds the requested provider and canonical target, plus the
+current realm for authenticated operations. The profile-stat envelope is
+version 1 and contains:
+
+- `provider`, `target`, `observedAt`, and `completeness`;
+- one metric record per requested counter, including categorical unavailable
+  records when the provider cannot expose an exact value;
+- bounded public metadata such as handle, display name, bio, or public website.
+
+Each publishable metric must have `status: "available"`,
+`precision: "exact"`, `unit: "count"`, and a nonnegative safe-integer `value`.
+Reject `500+`, `1.2K`, estimated, lower-bound, rounded, hidden, unavailable, and
+provider-drift values. A provider may return them as categorical unavailable
+evidence, but the consumer must not coerce them. Accept each exact available
+metric independently once the invocation and target are valid. A partial
+provider output may therefore advance followers while leaving recent views
+unavailable. Substack is an intentional two-read join, but either target-bound
+read may contribute its own exact metrics when the other read fails.
+
+An unavailable metric creates a gap only for that metric. Never write zero,
+copy the previous day into the scheduled date, or suppress a different exact
+metric from the same account. Report failed consumer keys and metric keys with
+bounded categorical reasons after the sequential collection completes.
+
+## Install into Hraness
+
+Build one mode-private temporary document with this exact public handoff:
+
+```json
+{
+  "schemaVersion": 1,
+  "scheduledDate": "YYYY-MM-DD",
+  "timezone": "America/New_York",
+  "observations": [
+    {
+      "accountKey": "x-hraness",
+      "observedAt": "YYYY-MM-DDTHH:mm:ss.sssZ",
+      "metrics": {
+        "followers": 1,
+        "following": 1
+      }
+    }
+  ]
+}
+```
+
+Run the consumer's installer from a clean, current Jungle worktree:
+
+```sh
+bun run --cwd projects/hraness social:install --input /absolute/private/run.json
+bun run --cwd projects/hraness social:validate
+bun run check:affected
+```
+
+For the Hraness consumer, the preferred daily entry point performs the fixed
+sequential collection and installs its validated public subset directly:
+
+```sh
+bun run --cwd projects/hraness social:refresh
+bun run --cwd projects/hraness social:validate
+bun run check:affected
+```
+
+The installer is the only process allowed to update
+`projects/hraness/app/social-stats.generated.json`. It validates the exact
+configured metric subset, derives the Eastern date from each observation time,
+preserves a newer same-day success, retains fourteen days, and writes canonical
+JSON. Remove the temporary document after installation.
+
+Review that the task diff contains only the checked social snapshot. Commit and
+deliver it through the repository's current-main workflow, then verify the
+Hraness production deployment. Never commit an empty or synthetic observation,
+raw Ghostget output, capture evidence, or local state.

package/skills/ghostget/references/social-video-platform-routing.md

@@ -0,0 +1,89 @@
+# Social video platform routing
+
+Use this as routing guidance only. Always inspect
+`ghostget capabilities <adapter> --json`; installed adapter state and schemas
+are authoritative and may change.
+
+| Surface | Candidate adapter | Video operation | Meaning |
+| --- | --- | --- | --- |
+| X | `x-web` | `posts.publish` when the installed schema accepts `video/mp4` | Consumer X post. Observed `x-web` `posts.publish` now accepts one plan-bound PNG or one MP4. |
+| X | `x` | `posts.publish` when the installed schema accepts `video/mp4` | Official OAuth post. Already schemas MP4. |
+| LinkedIn | `linkedin` | video-capable `posts.publish` | Observed official OAuth member or explicitly bound organization post. |
+| LinkedIn | `linkedin-web` | `media.publish` when observed | Consumer-web member video; currently a separate capture-required route so image `posts.publish` remains unchanged. |
+| Bluesky | `bluesky-web` | `media.publish` | Observed AT Protocol video feed post; image `posts.publish` remains a separate observed contract. |
+| Substack | `substack-web` | `media.publish` when observed | Public Substack Note, not an article or newsletter. |
+| TikTok | `tiktok-web` | `media.publish` when observed | Native TikTok video |
+| Instagram | `meta-web` on the Instagram surface | `media.publish` when observed | Instagram video or Reel only when the schema says so. |
+| Threads | `meta-web` on the Threads surface | `media.publish` | Observed single-MP4 Threads video post; text/image `posts.publish` remains a separate contract. |
+| YouTube Shorts | `youtube-web` | `media.publish` when observed | Studio video upload. Community `posts.publish` is not a Short. |
+| Reddit | `reddit-web` | `media.publish` when observed | One video post in one exact confirmed subreddit. |
+
+At the 2026-08-23 reference revision, `x-web` `posts.publish` is observed
+for one plan-bound `image/png` or one plan-bound `video/mp4`. Official `x`
+and official `linkedin` already observe MP4 post contracts. `reddit-web`
+`media.publish@9` observes one plan-bound MP4 plus a required plan-bound
+PNG/JPEG poster and explicit NSFW, spoiler, and reply declarations. Threads
+`media.publish@1` observes one plan-bound ISO BMFF MP4, exact dimensions, its
+single-request video upload, durable created-post identity, and independent
+permalink actor/text/video readback. Bluesky `media.publish@2` observes one
+plan-bound ISO BMFF MP4, the fixed first-party legacy upload and response-bound
+processing job, processed blob, exact repository record, durable accepted
+target, and authoritative PDS plus public AppView readbacks. LinkedIn web,
+Substack Notes, TikTok, Instagram, and YouTube expose bounded video `media.publish`
+reservations. Those routes stay `capture-required` until their exact upload,
+processing, request, response, actor/target, and independent readback contracts
+are implemented and proven.
+For Substack specifically, an authorized profile-backed fixture proved 200
+initialization, ordered raw multipart transfer, transcode, status polling, and
+video-attachment creation. The final Note create returned 403 twice, including
+one Ghostget-native attempt, so there is no provider-created video Note or exact
+readback to graduate. `content.delete@1` is independently observed for cleanup
+of an exact authored personal Note; that does not imply video publication.
+Treat them as unavailable until the installed capability independently says
+`observed`.
+
+## Selection rules
+
+- Use exactly one adapter and one stable bound account realm per surface.
+- Prefer the transport the user named or already configured. Do not fall
+  back from browser-session to OAuth, or vice versa, because one operation
+  is unavailable.
+- Require the chosen video operation's `state == "observed"`. An invalid
+  adapter or `capture-required` operation must produce no request.
+- A text or image `posts.publish` is not a substitute for video.
+- Re-check capabilities before every new preview.
+- Tags are an explicit platform-specific variant only for TikTok,
+  Instagram, and YouTube Shorts. Leave X, LinkedIn, Substack, Bluesky,
+  Threads, and Reddit tag-free.
+- Set each supported synthetic-media or AI declaration explicitly and
+  truthfully from the actual video's provenance; caption authorship does not
+  determine the media declaration. Follow [X AI disclosure](x-ai-disclosure.md)
+  for the official `x` `made_with_ai` choice, and do not invent a disclosure
+  field on an adapter whose installed schema does not expose one.
+
+## Common invocation shape
+
+Write exact input JSON to a private task file when shell quoting would be
+fragile, then invoke:
+
+```sh
+ghostget invoke <adapter> media.publish \
+  --input @/absolute/private/video-input.json \
+  --auth <bound-auth-id> \
+  --preview --json [--headed]
+```
+
+Use `posts.publish` instead only when the installed schema for that
+adapter accepts `video/mp4` on that operation.
+
+Review the returned digest and confirm it within five minutes:
+
+```sh
+ghostget confirm <plan-digest> --json [--headed]
+```
+
+Follow the preview's returned `confirmCommand` exactly so headed mode is
+preserved.
+
+Do not place credentials in the input file. Delete task input files after
+planning.