rsc-universal 0.1.1

package/skills/social-publisher/SKILL.md

@@ -0,0 +1,179 @@
+---
+name: social-publisher
+description: "Use when planning a posting schedule, building a multi-platform content calendar, or reshaping one source asset into channel-native posts across X, LinkedIn, Instagram, Threads, Bluesky, TikTok, Facebook, or YouTube — deciding cadence, best-time slots, per-platform char/format limits, and producing a dated CSV/JSON calendar a scheduler can import. Use when the same caption flopped after being cross-posted everywhere, when reach drops after a posting gap, or when checking API publish caps before programmatic posting. Triggers: 'build me a posting schedule for next week', 'turn this blog into a week of posts', 'give me a CSV calendar I can import into Buffer', 'how often and what time should we post Reels vs LinkedIn', 'I posted the same text on every platform and it tanked', 'planificar el calendario de publicaciones', 'reaprovechar aquest post a tots els canals'. NOT the brand voice the posts speak in (that is brand-voice) and NOT the editorial strategy of what to make (that is content-engine)."
+tags: [social-media, scheduling, repurposing, content-calendar, distribution]
+recommends: [content-engine, brand-voice, video-shorts, newsletter, calendar-scheduling]
+origin: risco
+---
+
+# Social Publisher — The Operator's Desk for Distribution
+
+*Decide the **when, where, how-often, and what-shape** of social distribution, then hand back a dated, schedulable calendar. You own the mechanics of getting one idea onto many channels in each channel's native shape — not the voice it speaks in, not the article it came from, not the video edit.*
+
+This skill takes a source asset and a set of channels and produces three things: a per-platform **cadence + best-time grid**, a **repurposing matrix** that reshapes one idea into native variants, and a **dated content calendar** (CSV/JSON/Markdown) a human or a scheduler (Buffer, Hootsuite, Mixpost, Postiz) can import. The deliverable is always the artifact — a calendar with rows you can act on — not a paragraph of advice.
+
+## When to use / When NOT
+
+Use when:
+
+- Building a weekly or monthly posting schedule across multiple platforms.
+- Deciding posting frequency and best-time slots per platform.
+- Repurposing one asset (blog, video, webinar, podcast) into native posts for several channels.
+- Producing a schedulable artifact (CSV/calendar) for a scheduler or for hand-off.
+- Checking per-platform limits before programmatic publishing (char caps, media specs, API publish/rate limits, approval gates).
+
+Do NOT use when (route to the sibling that owns it):
+
+| You actually want | Go to |
+| --- | --- |
+| The brand's tone-of-voice / verbal identity the posts must sound like | `../brand-voice/SKILL.md` |
+| To write the long-form source article the posts are sliced from | `../article-writing/SKILL.md` |
+| The editorial strategy of *what topics* to make this quarter | `../content-engine/SKILL.md` |
+| To script/edit the Reel or Short (hook, cuts, captions burn-in) | `../video-shorts/SKILL.md` |
+| To reply to comments/DMs, moderate, grow the community | `../community/SKILL.md` |
+| To respond to and manage ratings/reviews | `../review-management/SKILL.md` |
+| To write/send the email newsletter issue itself | `../newsletter/SKILL.md` |
+| Keyword/topic research, getting cited by AI engines | `../seo-geo/SKILL.md` |
+| Paid social ads / boosted promotion | `../ads/SKILL.md` |
+| To generate the images/graphics in the posts | `../ai-media/SKILL.md` |
+
+If a brand voice spec exists, shape every post *in* it — load `../brand-voice/SKILL.md`. This skill schedules and reshapes; it does not invent the voice.
+
+## The distribution mental model
+
+Four rules. Internalize them before you touch a calendar.
+
+1. **One source asset → N native variants, never N copies.** Reshape language, length, hashtags, and format per channel — repurposing is reformatting, not copy-paste. One blog or long video commonly yields 7–10 short clips plus carousels and threads. Source: Buffer "Ultimate Guide to Repurposing Content"; Planable 2026 repurposing guide (accessed 2026-06-02).
+
+2. **Aim for roughly one native-original post per two repurposed.** Repurposed content reportedly drives ~25–35% more engagement than one-off posts, but an all-repurposed feed reads stale — keep a ~1:2 native:repurposed mix so the account still feels alive. Source: InfluenceFlow / Planable 2026 (accessed 2026-06-02).
+
+3. **Consistency beats raw frequency, and gaps are expensive.** A steady schedule outperforms bursts; a ~2-week gap after heavy posting can cut reach 30–50%. Plan a cadence you can actually sustain. Source: Sprout Social / Buffer / Metricool 2026 (accessed 2026-06-02).
+
+4. **The deliverable is a schedulable artifact.** Always end at a dated calendar (rows: date, time, platform, format, body, status) — something a scheduler imports or a person executes. Advice without a calendar is a miss. The schema lives in `references/calendar-schema.md`; `scripts/verify.sh` lints what you emit.
+
+## Cadence & best-time grid
+
+Per-platform 2026 frequency sweet spots and starting best-time slots. Source: Sprout Social / Buffer / Metricool best-time-to-post 2026 (accessed 2026-06-02).
+
+| Platform | Frequency (2026) | Best-time starting hypothesis |
+| --- | --- | --- |
+| Instagram (feed) | 3–5x/week | Tue–Wed 11am–1pm |
+| Instagram Stories | 1–2x/day | spread across the day |
+| Reels | 3–4x/week | best day Tuesday |
+| LinkedIn | 3–5x/week | Tue–Thu 11am–5pm (shifting later, outside office hours) |
+| X (Twitter) | 3–5x/day | ~9pm and Tue–Wed |
+| TikTok | 1–3x/day | test per account; volume tolerant |
+| Facebook | 3–5x/week | weekday mid-morning |
+
+**Caveat, not law:** these slots are starting hypotheses. The only authoritative times are in the account's own analytics — schedule to the table, then move slots toward where *that* audience actually engages. Never present these numbers as guarantees.
+
+## Repurposing matrix
+
+Map source type to per-channel native output. Each cell is a *shape*, not the same text.
+
+| Source | X | LinkedIn | Instagram | Reel/Short/TikTok | Bluesky | Facebook |
+| --- | --- | --- | --- | --- | --- | --- |
+| Blog post | thread of the key claims | narrative post + takeaway | carousel of the steps | talking-head of the hook | short thread | summary + link in first comment |
+| Long video | clip + quote | lesson write-up | carousel of frames | 3–5 vertical cuts | quote post | native upload of one cut |
+| Webinar | live-thread highlights | recap + slides | quote-card carousel | best-moment clips | takeaway post | replay link |
+| Podcast | quote thread | episode notes | audiogram carousel | audiogram Shorts | quote post | episode card |
+
+Reshape the *same idea*, not the same string. Bad→Good:
+
+```text
+Bad  (same caption pasted to all four — flat, off-shape, link breaks IG):
+  "New blog: 5 ways to cut cloud cost. Read here https://ex.co/cloud #cloud #devops"
+
+Good (native per channel):
+  X       thread → "5 ways we cut our cloud bill 38% in a quarter. 🧵"
+                   one tactic per post, link only in the last post.
+  LinkedIn → "We cut our cloud bill 38% last quarter. The boring one
+              that mattered most: rightsizing before reserving. Here's
+              the order we did it in →" (3–5 short paras, no hashtag wall)
+  Instagram → 6-slide carousel, one tactic per slide; link in bio;
+              caption is the hook + 3–5 specific hashtags.
+  Bluesky → short thread, plain link (no UTM-bloat), 1 tag max.
+```
+
+## Channel-native shaping rules
+
+Quick reference; full specs and API reality in `references/platform-limits.md`.
+
+| Platform | Char cap | Hashtags | Links | Native trick |
+| --- | --- | --- | --- | --- |
+| X | 280 (post) | 1–2 | inline, costs reach less than before | thread the long idea; hook in post 1 |
+| LinkedIn | ~3,000 | 0–3 | first comment, not body | "see more" cutoff ~210 chars — front-load the hook |
+| Instagram | 2,200 caption | 3–5 specific | bio / link sticker | first-comment for tags; carousel for depth |
+| Threads | 500 | light | inline ok | conversational, low-hashtag |
+| Bluesky | 300 | 1 max | plain inline | short threads; no algorithmic hashtag game |
+| TikTok | 2,200 caption | 3–5 | bio | hook in first 1–2s; caption supports, video carries |
+| Facebook | ~63k (keep short) | 0–2 | first comment if reach-sensitive | native video > shared link |
+
+Rule with a why: **put links in the first comment on LinkedIn/IG/FB** — link-in-body posts are commonly down-ranked, so keep the body clean and drop the URL below. **Front-load the hook** everywhere — LinkedIn truncates at ~210 chars and X shows post 1 only, so the first line decides the click.
+
+## The content calendar artifact
+
+Every run ends here. Minimum columns:
+
+`date · time · timezone · platform · format · source_asset_id · hook · body · media_ref · link · hashtags · status`
+
+`status` lifecycle: `draft → scheduled → posted`. `source_asset_id` ties all rows derived from one source (the repurposing link), so you can see at a glance that one blog became six native posts.
+
+Markdown example (one source asset, two channels):
+
+```text
+| date       | time  | tz        | platform | format   | source_asset_id | hook                         | status    |
+| 2026-06-09 | 11:30 | Europe/Madrid | linkedin | post     | blog-cloud-001  | We cut our cloud bill 38%…   | scheduled |
+| 2026-06-09 | 21:00 | Europe/Madrid | x        | thread   | blog-cloud-001  | 5 ways we cut cloud cost 🧵   | scheduled |
+```
+
+JSON row (what a scheduler ingests):
+
+```json
+{
+  "date": "2026-06-09",
+  "time": "21:00",
+  "timezone": "Europe/Madrid",
+  "platform": "x",
+  "format": "thread",
+  "source_asset_id": "blog-cloud-001",
+  "hook": "5 ways we cut cloud cost 🧵",
+  "body": "5 ways we cut our cloud bill 38% in a quarter…",
+  "media_ref": null,
+  "link": "https://ex.co/cloud",
+  "hashtags": ["#cloud"],
+  "status": "scheduled"
+}
+```
+
+Full column definitions, the CSV variant, and import notes for Buffer/Hootsuite/Mixpost/Postiz are in `references/calendar-schema.md`. After you write a calendar file, run `scripts/verify.sh path/to/calendar.{csv,json}` to catch over-cap bodies, byte-identical cross-posts, bad status values, and non-future scheduled datetimes.
+
+## Platform limits & API reality
+
+Before promising programmatic publishing, check the 2026 gotchas — they change what is even possible. Full sourced table in `references/platform-limits.md`.
+
+- **Instagram Graph API:** ~25–50 API-published posts per *rolling* 24h per account (sources vary 25/50/100 by account trust); ~200 API requests/hour. The window is rolling, not calendar-day. (Meta IG Platform "Content Publishing Limit"; InstantDM 2026 — accessed 2026-06-02.)
+- **X API:** as of Feb 2026, legacy Free tier is write-restricted (~500 posts/month, no new signups) and **pay-per-use is now default for new developers** (~$0.01/post; URL posts cost more). Programmatic X posting costs money for new apps. (Zernio / Postproxy / Blotato 2026 — accessed 2026-06-02.)
+- **LinkedIn API:** free OAuth = Sign-In + basic profile only; posting (UGC/Share) runs ~100 calls/day/member and Marketing/advanced access starts **~$699+/mo** for approved partners. Plan around the gate. (Phyllo / SociaVault 2026 — accessed 2026-06-02.)
+- **Bluesky AT Protocol:** moved to OAuth (announced 2024-09-25; App Passwords deprecated for new projects; first granular scope `transition:email` shipped 2025-06-12); API is free with a ~5,000-points/hour cap. (Bluesky/AT Protocol docs — accessed 2026-06-02.)
+- **TikTok Content Posting API:** requires a separate audit and forces `SELF_ONLY` (private) posts until approved. (Blotato / PostPeer 2026 — accessed 2026-06-02.)
+
+**Execution-layer decision:** this skill produces the plan; something else publishes it.
+
+- Manual / few channels → a hosted scheduler (Buffer, Hootsuite) — import the CSV.
+- Self-host, own your data → **Mixpost** (Laravel, one-time license, drag-drop calendar, first-comment + dynamic variables) or **Postiz** (Apache-2.0, free, 15+ platforms).
+- Programmatic across many platforms → a unified API (Blotato-style) to dodge per-platform auth pain.
+
+(Mixpost.app; Postiz "Open Source Social Media Scheduler" / GitHub inovector/mixpost — accessed 2026-06-02.)
+
+## Anti-patterns
+
+| Anti-pattern | Why it fails | Do instead |
+| --- | --- | --- |
+| Same caption pasted to every platform | Off-shape, link penalties, reads as spam; this is the #1 reason cross-posts flop | Reshape per channel via the repurposing matrix |
+| Chasing "best time" tables while ignoring own analytics | Generic slots are hypotheses; the audience's real peak is in *their* data | Seed from the grid, then move slots toward the account's analytics |
+| A 2-week burst, then going dark | Gaps can cut reach 30–50% and break the algorithm's trust | Pick a sustainable cadence and hold it |
+| Ignoring per-platform publish caps | IG ~25–50/rolling-24h and member-level LinkedIn limits get you throttled mid-launch | Check `references/platform-limits.md` before scheduling volume |
+| Treating Reels/Shorts/TikTok as "post the same vertical clip" | Each has different specs, hook windows, and caption rules | Cut per-platform; respect each spec |
+| Defining brand voice or picking topics here | Out of scope — produces inconsistent voice and a calendar with no strategy behind it | Route to `../brand-voice/SKILL.md` and `../content-engine/SKILL.md` |
+| Ending at advice with no calendar | The deliverable is a schedulable artifact, not a pep talk | Emit a dated CSV/JSON calendar and verify it |

package/skills/social-publisher/evals/README.md

@@ -0,0 +1,14 @@
+# Evals — social-publisher
+
+These cases are routing + capability checks for a human or an LLM judge; there is no
+automated test runner beyond `scripts/verify.sh` (which lints an emitted calendar
+file, not these prompts). To run them: read `cases.yaml` and confirm the skill's
+`description` would fire on every `should_trigger` prompt (including the non-obvious
+"same caption flopped" symptom and the Catalan "reaprovechar" phrasing), that each
+`should_not_trigger` prompt routes to the named sibling instead (`brand-voice`,
+`video-shorts`, `community`, `content-engine`), and that a calendar generated for the
+`capability` scenario satisfies every line of its `must_include` rubric — native
+per-platform variants, sane 2026 cadence, best-time slots flagged as hypotheses, a
+schedulable table with the required columns, surfaced publish-limit/approval gates,
+and no invented brand voice or topics. To check an actual emitted calendar, point
+`scripts/verify.sh` at the CSV/JSON it produced.

package/skills/social-publisher/evals/cases.yaml

@@ -0,0 +1,55 @@
+skill: social-publisher
+
+# Prompts that MUST load `social-publisher`. The skill owns distribution MECHANICS:
+# cadence, best-time slots, per-platform native reshaping, and a dated schedulable
+# calendar artifact. It does NOT define brand voice (brand-voice), pick topics
+# (content-engine), write the source article (article-writing), or edit the video
+# (video-shorts).
+should_trigger:
+  - prompt: "Build me a posting schedule for next week across LinkedIn, X and Instagram."
+    why: "Core job — a multi-platform cadence + calendar is exactly the deliverable this skill produces."
+
+  - prompt: "Turn this blog post into posts for all our channels."
+    why: "Repurposing one source asset into channel-native variants is the skill's central mechanic."
+
+  - prompt: "Reaprovechar aquest article a Instagram, X i LinkedIn."
+    why: "Catalan for 'repurpose this article to IG, X and LinkedIn' — direct repurposing request in another language."
+
+  - prompt: "I posted the same caption on every platform and it flopped — help."
+    why: "Non-obvious. User names the symptom (identical cross-post) not the skill; the fix is native per-channel reshaping, this skill's signature move."
+
+  - prompt: "How often and what time should we post Reels vs LinkedIn?"
+    why: "Cadence + best-time slots per platform — the cadence-grid section owns this."
+
+  - prompt: "Give me a CSV content calendar I can import into Buffer."
+    why: "Explicit request for the schedulable artifact this skill exists to emit."
+
+should_not_trigger:
+  - prompt: "Define our brand's tone of voice for social so every post sounds like us."
+    route_to: brand-voice
+    why: "Defining the verbal identity the posts must speak in is brand-voice; this skill shapes posts but does not invent the voice."
+
+  - prompt: "Script this Reel — I need the hook and the cut structure."
+    route_to: video-shorts
+    why: "Writing/editing the short-form video itself is video-shorts; social-publisher schedules and reshapes captions, not the edit."
+
+  - prompt: "Reply to and moderate the comments on our last post."
+    route_to: community
+    why: "Engaging, replying, and moderation is community; this skill ends at scheduling, not conversation."
+
+  - prompt: "What topics and themes should our content cover this quarter?"
+    route_to: content-engine
+    why: "The editorial strategy of WHAT to make is content-engine; social-publisher decides when/where/how-often to distribute what already exists."
+
+capability:
+  - scenario: >
+      Given one ~1,200-word blog post plus the brand's handles, produce a one-week
+      multi-platform content calendar (LinkedIn, X, Instagram, Bluesky) that
+      repurposes the post into native variants and is ready to schedule.
+    must_include:
+      - "Per-platform NATIVE variants — not the same text pasted across channels (thread vs narrative post vs carousel vs short thread)."
+      - "A cadence that respects 2026 frequency norms (e.g. LinkedIn 3–5x/week, X 3–5x/day, IG 3–5x/week)."
+      - "Best-time slots provided as starting hypotheses WITH the explicit 'validate against the account's own analytics' caveat."
+      - "A schedulable table/CSV with the required columns (date, time, timezone, platform, format, source_asset_id, hook, body, status) and a draft→scheduled status."
+      - "Flags any platform publish-limit or approval gate that affects the plan (e.g. IG rolling-24h cap, X pay-per-use, LinkedIn partner gate, TikTok audit)."
+      - "Does NOT invent a brand voice — assumes/uses an existing voice or routes to brand-voice; does NOT pick new topics (routes to content-engine)."

package/skills/social-publisher/references/calendar-schema.md

@@ -0,0 +1,97 @@
+# Content calendar artifact — the contract
+
+The calendar is the deliverable. It must be machine-readable enough for a scheduler
+to import and human-readable enough to review. CSV, JSON array, or a Markdown table
+all work — pick what the downstream tool ingests. `scripts/verify.sh` lints both
+CSV and JSON.
+
+## Columns
+
+| Column | Required | Meaning |
+| --- | --- | --- |
+| `date` | yes | publish date, `YYYY-MM-DD` |
+| `time` | yes | publish time, `HH:MM` (24h) |
+| `timezone` | yes | IANA tz, e.g. `Europe/Madrid` — never ambiguous "9am" |
+| `platform` | yes | one of `x`, `linkedin`, `instagram`, `threads`, `bluesky`, `tiktok`, `facebook`, `youtube` |
+| `format` | yes | `post`, `thread`, `carousel`, `reel`, `short`, `story`, `video` |
+| `source_asset_id` | yes | ties all rows derived from one source (the repurposing link) |
+| `hook` | yes | the first line / scroll-stopper |
+| `body` | yes | the post body — must respect the platform char cap |
+| `media_ref` | no | path/URL/id of attached media, or null |
+| `link` | no | destination URL (goes to first comment on LinkedIn/IG/FB) |
+| `hashtags` | no | array/CSV of tags, per-platform convention |
+| `status` | yes | `draft` → `scheduled` → `posted` |
+
+## Status lifecycle
+
+```text
+draft       being written / not yet timed
+scheduled   has a future date+time and is queued (verify.sh requires a future datetime)
+posted      already live (date+time in the past)
+```
+
+A `scheduled` row with a past or malformed datetime is a hard error — fix the time
+or move it to `draft`/`posted`.
+
+## The repurposing link
+
+`source_asset_id` is the glue. One blog post `blog-cloud-001` becomes many rows; all
+of them carry `blog-cloud-001`. This lets you (and `verify.sh`) confirm that one
+source produced *native variants*, not the same string pasted across platforms.
+
+## CSV example
+
+```csv
+date,time,timezone,platform,format,source_asset_id,hook,body,media_ref,link,hashtags,status
+2026-06-09,11:30,Europe/Madrid,linkedin,post,blog-cloud-001,We cut our cloud bill 38%,"We cut our cloud bill 38% last quarter. The boring one that mattered most: rightsizing before reserving. Here's the order we did it in.",,https://ex.co/cloud,#cloud,scheduled
+2026-06-09,21:00,Europe/Madrid,x,thread,blog-cloud-001,5 ways we cut cloud cost,"5 ways we cut our cloud bill 38% in a quarter. A thread.",,,#cloud,scheduled
+2026-06-10,11:00,Europe/Madrid,instagram,carousel,blog-cloud-001,38% off our cloud bill,"Swipe for the 6 moves. Save this one. Link in bio.",carousel-cloud.png,,#cloud #devops #finops,draft
+```
+
+## JSON example
+
+```json
+[
+  {
+    "date": "2026-06-09",
+    "time": "11:30",
+    "timezone": "Europe/Madrid",
+    "platform": "linkedin",
+    "format": "post",
+    "source_asset_id": "blog-cloud-001",
+    "hook": "We cut our cloud bill 38%",
+    "body": "We cut our cloud bill 38% last quarter. The boring one that mattered most: rightsizing before reserving. Here's the order we did it in.",
+    "media_ref": null,
+    "link": "https://ex.co/cloud",
+    "hashtags": ["#cloud"],
+    "status": "scheduled"
+  },
+  {
+    "date": "2026-06-09",
+    "time": "21:00",
+    "timezone": "Europe/Madrid",
+    "platform": "x",
+    "format": "thread",
+    "source_asset_id": "blog-cloud-001",
+    "hook": "5 ways we cut cloud cost",
+    "body": "5 ways we cut our cloud bill 38% in a quarter. A thread.",
+    "media_ref": null,
+    "link": null,
+    "hashtags": ["#cloud"],
+    "status": "scheduled"
+  }
+]
+```
+
+## Importing into a scheduler
+
+- **Buffer / Hootsuite:** import the CSV; map `date`+`time`+`timezone` to the scheduled
+  slot and `body` to the post text. Hashtags and link usually go inline or to a
+  first-comment field where supported.
+- **Mixpost:** create posts per row; use its first-comment + dynamic-variable features
+  for the `link` and per-platform variants.
+- **Postiz:** map rows to its calendar; one `source_asset_id` group = one campaign.
+
+Keep one row per platform per post — never one row meant to fan out to all channels.
+The whole point is per-platform native shaping, and the verifier flags byte-identical
+bodies across platforms for exactly this reason.

package/skills/social-publisher/references/platform-limits.md

@@ -0,0 +1,56 @@
+# Platform limits & API reality (2026)
+
+Every number below carries its source and was **accessed 2026-06-02**. These move
+fast — re-check before promising programmatic publishing. Treat caps as ceilings,
+not targets; treat best-time slots (in SKILL.md) as hypotheses to validate against
+the account's own analytics.
+
+## Per-platform table
+
+| Platform | Char cap | Media spec (headline) | API content-publishing limit | Rate limit | OAuth / approval gate | 2026 cost note |
+| --- | --- | --- | --- | --- | --- | --- |
+| **X (Twitter)** | 280 / post (longer on paid) | image ≤5MB; video ≤512MB, ≤2:20 (longer on paid) | legacy Free ~500 posts/month, no new signups | tier-dependent | OAuth 2.0; new apps default to pay-per-use | **Pay-per-use default for new devs** ~$0.01/post; URL posts cost more |
+| **LinkedIn** | ~3,000 chars; "see more" cutoff ~210 | image ≤5MB; video ≤200MB, 3s–10min | UGC/Share API ~100 calls/day/member | member-level | free OAuth = Sign-In + basic profile only; posting needs approval | Marketing/advanced partner tier from **~$699+/mo** |
+| **Instagram** | 2,200 caption; 30 hashtags max (use 3–5) | image 1080px; Reel ≤90s typical; carousel ≤20 | **~25–50 published posts / rolling 24h** (varies 25/50/100 by trust) | ~200 requests/hour/account | Graph API; Business/Creator account + app review | free; rolling-24h window, not calendar-day |
+| **Threads** | 500 chars | image + short video | via Threads API (limited) | low | OAuth via Meta | free; light-hashtag culture |
+| **Bluesky** | 300 chars | image + short video | AT Protocol create-record | **~5,000 points/hour** | **OAuth** (App Passwords deprecated for new projects; `transition:email` scope shipped 2025-06-12) | free |
+| **TikTok** | 2,200 caption | vertical 9:16; video to several min | Content Posting API; **forces `SELF_ONLY` until audited** | per-app | separate **audit** required before public posts | free; audit gate |
+| **Facebook** | ~63k (keep short) | native video > shared link | Graph API publish | per-app | Page access token + app review | free |
+| **YouTube** | title 100, desc 5,000 | Shorts ≤60s; long-form to hours | Data API upload quota (cost in quota units) | daily quota | Google OAuth + app verification | free within quota; quota-limited |
+
+Sources for the rows above: Meta Instagram Platform docs "Content Publishing Limit";
+InstantDM 2026 IG API rate-limit guide; Zernio / Postproxy / Blotato X API pricing 2026;
+Phyllo / SociaVault LinkedIn API 2026; Bluesky / AT Protocol docs (OAuth announced
+2024-09-25, `transition:email` 2025-06-12); Blotato / PostPeer 2026 platform guides
+(TikTok audit / `SELF_ONLY`). All accessed 2026-06-02.
+
+## The 2026 gotchas, restated
+
+- **Instagram window is rolling.** The ~25–50 cap is measured over the last 24 hours
+  continuously, not reset at midnight. A launch that fires 40 posts at 9am can be
+  throttled at 9am the next day even though it is a "new day".
+- **X now costs money for new apps.** New developers default to pay-per-use; do not
+  promise free programmatic posting on X for a fresh app.
+- **LinkedIn posting is gated.** Free OAuth does not let you post. Posting needs
+  approval, runs ~100 calls/day/member, and the advanced tier is **~$699+/mo**.
+- **TikTok forces private until audited.** Your API posts are `SELF_ONLY` (only the
+  poster can see them) until TikTok approves the app via audit.
+- **Bluesky is OAuth + points-budget.** App Passwords are deprecated for new
+  projects; the ~5,000 points/hour cap is generous but real.
+
+## Execution layer — what actually publishes the calendar
+
+This skill produces the plan; one of these consumes it.
+
+| Option | What it is | When to pick it |
+| --- | --- | --- |
+| **Hosted scheduler** (Buffer, Hootsuite) | SaaS calendar + queue; import CSV | few channels, no infra, manual-ish |
+| **Mixpost** | Laravel, **self-hosted**, one-time license; drag-drop calendar, first-comment, dynamic variables | you want to own data + a paid self-host |
+| **Postiz** | **Apache-2.0, free**, 15+ platforms, self-hostable | open-source self-host, no license fee |
+| **Unified API** (Blotato-style) | one API across many platforms | programmatic posting without per-platform auth pain |
+
+(Mixpost.app; Postiz blog "Open Source Social Media Scheduler 2025" / GitHub
+inovector/mixpost — accessed 2026-06-02.)
+
+The skill's job ends at a calendar these tools can import. Deploying Mixpost/Postiz
+or wiring a unified API is infrastructure work, not part of this skill.

package/skills/social-publisher/scripts/verify.sh

@@ -0,0 +1,232 @@
+#!/usr/bin/env bash
+#
+# verify.sh — structural linter for a social-publisher content calendar.
+#
+# WHAT IT DOES (read-only; never edits or writes the calendar)
+#   Static, network-free checks over ONE calendar file you point it at — a CSV or
+#   a JSON array of post rows (see references/calendar-schema.md):
+#     1. Required columns/keys present: date, time, platform, format, body, status
+#        -> FAIL if any is missing.
+#     2. Per-platform char cap: each row's `body` longer than its platform cap
+#        (x 280, linkedin 3000, instagram 2200, threads 500, bluesky 300,
+#        tiktok 2200, facebook 63206, youtube 5000) -> FAIL.
+#     3. `status` is one of draft|scheduled|posted -> FAIL otherwise.
+#     4. A `scheduled` row whose date+time is unparseable or in the PAST -> FAIL.
+#     5. Two rows byte-identical in `body` across DIFFERENT platforms (the
+#        copy-paste anti-pattern) -> WARN.
+#
+#   Parsing is delegated to python3 (stdlib only: csv, json, datetime). Hard
+#   failures (1-4) exit 1; the identical-body check (5) only warns. A clean OR
+#   empty calendar exits 0 — never a false failure.
+#
+# HOW TO RUN (inside YOUR project, not the skills repo)
+#   ./verify.sh calendar.csv
+#   ./verify.sh calendar.json
+#   ./verify.sh calendar.csv --strict     # treat warnings as failures (CI gate)
+#
+# EXIT CODES
+#   0  clean, warnings only (without --strict), or empty/contentless file
+#   1  a hard failure (missing column, over-cap body, bad status/datetime)
+#      — or any warning under --strict
+#   2  bad usage (no file, file missing, or python3 unavailable)
+#
+# Runs on stock macOS bash 3.2: no mapfile, no associative arrays, no bc.
+
+set -euo pipefail
+
+if [ -t 1 ]; then
+  RED=$'\033[31m'; GREEN=$'\033[32m'; YELLOW=$'\033[33m'; NC=$'\033[0m'
+else
+  RED=''; GREEN=''; YELLOW=''; NC=''
+fi
+
+usage() { sed -n '2,38p' "$0" | sed 's/^# \{0,1\}//'; }
+
+FILE=""
+STRICT=0
+while [ $# -gt 0 ]; do
+  case "$1" in
+    -h|--help) usage; exit 0 ;;
+    --strict) STRICT=1; shift ;;
+    -*) printf '%sunknown option: %s%s\n' "$RED" "$1" "$NC" >&2; usage; exit 2 ;;
+    *) if [ -z "$FILE" ]; then FILE="$1"; fi; shift ;;
+  esac
+done
+
+if [ -z "$FILE" ]; then
+  printf '%sno calendar file given%s\n' "$RED" "$NC" >&2; usage; exit 2
+fi
+if [ ! -f "$FILE" ]; then
+  printf '%sfile not found: %s%s\n' "$RED" "$FILE" "$NC" >&2; exit 2
+fi
+if ! command -v python3 >/dev/null 2>&1; then
+  printf '%spython3 not found — required to parse the calendar%s\n' "$RED" "$NC" >&2; exit 2
+fi
+
+# Empty / whitespace-only file: nothing to check, do not false-fail.
+if [ ! -s "$FILE" ] || ! grep -q '[^[:space:]]' "$FILE" 2>/dev/null; then
+  printf '%s[ ok ]%s empty file — nothing to check\n' "$GREEN" "$NC"
+  exit 0
+fi
+
+printf 'social-publisher verify — %s\n\n' "$FILE"
+
+# All parsing + checking happens in python3 (stdlib only). It prints lines tagged
+# OK:/WARN:/FAIL: and exits 0 (no hard failures) or 1 (>=1 hard failure). The
+# identical-body check emits WARN only. STRICT is applied here in bash.
+PY_OUT="$(STRICT="$STRICT" python3 - "$FILE" <<'PY'
+import csv, json, os, sys
+from datetime import datetime
+
+path = sys.argv[1]
+strict = os.environ.get("STRICT", "0") == "1"
+
+CAPS = {
+    "x": 280, "twitter": 280,
+    "linkedin": 3000,
+    "instagram": 2200, "ig": 2200,
+    "threads": 500,
+    "bluesky": 300,
+    "tiktok": 2200,
+    "facebook": 63206, "fb": 63206,
+    "youtube": 5000,
+}
+REQUIRED = ["date", "time", "platform", "format", "body", "status"]
+STATUSES = {"draft", "scheduled", "posted"}
+
+lines = []
+hard = 0
+warn = 0
+
+def ok(m):   lines.append("OK:" + m)
+def warn_(m):
+    global warn
+    lines.append("WARN:" + m); warn += 1
+def fail(m):
+    global hard
+    lines.append("FAIL:" + m); hard += 1
+
+# --- load rows as a list of dicts ---------------------------------------------
+rows = []
+load_err = None
+try:
+    with open(path, "r", encoding="utf-8") as fh:
+        head = fh.read(1)
+        fh.seek(0)
+        text = fh.read()
+    stripped = text.lstrip()
+    if stripped.startswith("[") or stripped.startswith("{"):
+        data = json.loads(text)
+        if isinstance(data, dict):
+            data = [data]
+        rows = [dict(r) for r in data if isinstance(r, dict)]
+    else:
+        reader = csv.DictReader(text.splitlines())
+        rows = [ {(k or "").strip(): v for k, v in r.items()} for r in reader ]
+except Exception as e:
+    load_err = str(e)
+
+if load_err is not None:
+    fail("could not parse file as CSV or JSON: %s" % load_err)
+    print("\n".join(lines))
+    sys.exit(1)
+
+if not rows:
+    print("OK:no rows — nothing to check")
+    sys.exit(0)
+
+# --- 1. required columns present ----------------------------------------------
+present = set()
+for r in rows:
+    present.update(r.keys())
+missing = [c for c in REQUIRED if c not in present]
+if missing:
+    fail("missing required column(s): %s" % ", ".join(missing))
+else:
+    ok("all required columns present (%s)" % ", ".join(REQUIRED))
+
+# --- per-row checks -----------------------------------------------------------
+bodies = {}  # body text -> set of platforms
+for i, r in enumerate(rows, start=1):
+    plat = (r.get("platform") or "").strip().lower()
+    body = r.get("body")
+    body = "" if body is None else str(body)
+    status = (r.get("status") or "").strip().lower()
+
+    # 2. char cap
+    cap = CAPS.get(plat)
+    if cap is None:
+        if plat:
+            warn_("row %d: unknown platform '%s' — no char cap checked" % (i, plat))
+    elif len(body) > cap:
+        fail("row %d (%s): body is %d chars, over the %d cap" % (i, plat, len(body), cap))
+
+    # 3. status valid
+    if status not in STATUSES:
+        fail("row %d: status '%s' not one of draft|scheduled|posted" % (i, status or "<empty>"))
+
+    # 4. scheduled rows need a parseable future datetime
+    if status == "scheduled":
+        d = (r.get("date") or "").strip()
+        t = (r.get("time") or "").strip()
+        dt = None
+        for fmt in ("%Y-%m-%d %H:%M", "%Y-%m-%d %H:%M:%S"):
+            try:
+                dt = datetime.strptime((d + " " + t).strip(), fmt)
+                break
+            except ValueError:
+                continue
+        if dt is None:
+            fail("row %d: scheduled but date/time '%s %s' is unparseable (want YYYY-MM-DD HH:MM)" % (i, d, t))
+        elif dt <= datetime.now():
+            fail("row %d: scheduled for %s %s which is not in the future" % (i, d, t))
+
+    # 5. collect bodies for the identical-cross-post check
+    key = body.strip()
+    if key:
+        bodies.setdefault(key, set()).add(plat or "<none>")
+
+# --- 5. byte-identical body across different platforms ------------------------
+dupes = [(b, plats) for b, plats in bodies.items() if len(plats) > 1]
+if dupes:
+    for b, plats in dupes:
+        snippet = (b[:48] + "…") if len(b) > 48 else b
+        warn_("identical body across %s — reshape per platform: \"%s\"" %
+              (", ".join(sorted(plats)), snippet.replace("\n", " ")))
+else:
+    ok("no byte-identical bodies across platforms")
+
+print("\n".join(lines))
+sys.exit(1 if hard > 0 else 0)
+PY
+)" && PY_RC=0 || PY_RC=$?
+
+# Render python's tagged output with colors and tally.
+warn_count=0; fail_count=0
+while IFS= read -r line; do
+  [ -z "$line" ] && continue
+  case "$line" in
+    OK:*)   printf '%s[ ok ]%s %s\n' "$GREEN"  "$NC" "${line#OK:}" ;;
+    WARN:*) printf '%s[warn]%s %s\n' "$YELLOW" "$NC" "${line#WARN:}"; warn_count=$((warn_count + 1)) ;;
+    FAIL:*) printf '%s[fail]%s %s\n' "$RED"    "$NC" "${line#FAIL:}"; fail_count=$((fail_count + 1)) ;;
+    *) printf '%s\n' "$line" ;;
+  esac
+done <<EOF
+$PY_OUT
+EOF
+
+printf '\n'
+if [ "$fail_count" -gt 0 ] || [ "$PY_RC" -ne 0 ]; then
+  printf '%s%d hard failure(s), %d warning(s)%s\n' "$RED" "$fail_count" "$warn_count" "$NC"
+  exit 1
+fi
+if [ "$warn_count" -gt 0 ]; then
+  if [ "$STRICT" -eq 1 ]; then
+    printf '%s%d warning(s) — failing under --strict%s\n' "$YELLOW" "$warn_count" "$NC"
+    exit 1
+  fi
+  printf '%s%d warning(s), 0 hard failures%s\n' "$YELLOW" "$warn_count" "$NC"
+  exit 0
+fi
+printf '%sall checks passed%s\n' "$GREEN" "$NC"
+exit 0