SocialFarm.spaceQ4 2026 ACTIVE
TENANT:ws_alpha_prod
SERVICES OPERATIONAL
COMMAND CENTER • WORK AREA 01

Operational Fleet Intelligence

Zero-trust multi-tenant social farm operations powered by Python 3.13+ microservices, AES-256-GCM envelope encryption, and verified capability registries.

FLEET METRICS

Fleet Inventory & Health

0
1 Ready1 Degraded

Managed creator channels and operational mailboxes across all active provider integrations.

Dual-Dimension State: EnforcedOutage Timestamp Preservation: Active
SECURITY INVARIANTS

AES-256-GCM Envelope Vault

256-BIT GCM ACTIVE

Tenant-specific AAD bindings tie ciphertexts to workspace and connection IDs, preventing cross-tenant replay.

AAD: (workspace_id, connection_id, provider)
Redaction: Authorization, JWT, ya29.* scrubbed
COMPLIANCE & SCOPES

Capability Verification

4 PROVIDER CONTRACTS

Enforces strict API limitations: Google CASA Tier 2 for Gmail, local bridge for Proton, no cloud IMAP for Tuta.

Proton: Local Bridge IMAP only
Tuta: Zero-API E2EE
RECONCILIATION ENGINE

Idempotency & Safe Publishing

0Reconciled Jobs

State-machine prevents duplicate posts on timeouts by locking ambiguous states into OUTCOME_UNKNOWN.

Locking Mode: OUTCOME_UNKNOWNDuplicate Post Risk: 0.00% Zero Tolerance
GOVERNANCE • CAPABILITY REGISTRY

Verified Provider Capability Contracts

Every platform action is mapped to verified upstream provider documentation, explicit OAuth scopes, and verified architecture constraints.

PROVIDER & APICAPABILITYREQUIRED SCOPESSECURITY CONSTRAINTSOFFICIAL DOCS
YOUTUBEv3
CONTENT_PUBLISH
https://www.googleapis.com/auth/youtube.upload

Subject to daily video upload quota per project and channel strikes.

Google App Review
View Spec →
YOUTUBEv3
COMMENT_REPLY
https://www.googleapis.com/auth/youtube.force-ssl

Comments on private videos or restricted channels will fail.

Google App Review
View Spec →
GMAILv1
MESSAGING_SEND
https://www.googleapis.com/auth/gmail.send

Google CASA Tier 2 verification required for unrestricted send scope.

Google App Review
View Spec →
PROTONbridge-v3
MESSAGING_SENDNo OAuth Scope (Bridge / E2EE)

Requires locally running Proton Mail Bridge; cloud server-side IMAP is unavailable.

Local Bridge Required
View Spec →
TUTAnone
MESSAGING_SENDNo OAuth Scope (Bridge / E2EE)

Tuta enforces end-to-end encryption without third-party server-side API or IMAP access.

E2EE Protected (No API)
View Spec →
WORK AREA 03 — SECURITY BOUNDARY

Connect Authorized Account

Initiate verified provider onboarding with RFC 7636 PKCE S256 code challenge generation and cryptographic state validation.

CODE CHALLENGE (S256):SHA256(Base64URL(HighEntropyRandom[32]))
HMAC-SHA256 STATE TOKEN:HMAC_SHA256(workspaceId + sessionId + provider, secret)
SYSTEM ARCHITECTURE (PYTHON 3.13+ MICROSERVICES)

Microservice Topology & Boundaries

SocialFarm.space backend is decomposed into independent Python microservices sharing a strict cryptography, audit, and status kernel without any monolithic files.

Gateway APIPort 8000
services/gateway_api

FastAPI unified microservice router, HTTP correlation IDs, error envelope normalization.

Identity & AuthorizationZero Trust
services/identity_service

Workspace tenant isolation, membership verification, and fine-grained RBAC permission matrix.

Integration & OnboardingOAuth 2.0
services/integration_service

RFC 7636 PKCE S256 flow, HMAC-SHA256 replay prevention, and bulk fleet candidate preview.

Capability & HealthTelemetry
services/capability_health_service

Provider registry constraints, health ping monitoring, and outage sync timestamp preservation.

Publishing & ReconciliationState Machine
services/publishing_service

Idempotency key enforcement, OUTCOME_UNKNOWN locking, and safe provider reconciliation.

Shared Kernel & Security VaultAES-256-GCM
services/shared_kernel

AES-256-GCM envelope encryption with tenant AAD binding, token redaction, and append-only audit trail.

Cryptographic & Operational Invariants:

  • Tenant AAD Binding: Encryption ciphertext binds to (workspace_id, connection_id, provider_key) preventing cross-tenant injection.
  • Outage Preservation: Upstream provider HTTP 5xx errors preserve last_sync_at to prevent data loss.
  • Safe Publishing: Unknown provider HTTP responses transition to OUTCOME_UNKNOWN, locking duplicate execution until reconciled.
ENTERPRISE SIMULATION

Corporate End-to-End Workflow Simulation

Demonstrating all 6 processes: Brief → AI Variants → Compliance → Legal → Executive → Publishing → Telemetry → Audit.

This runner simulates the complete lifecycle of corporate social operations without any manual steps, validating cross-workflow invariants and updating active state across all consoles.

○
1. Strategic Brief Ingestion
Ingesting campaign parameters: "Global Autonomous Fleet Mesh v2", tone: Executive.
QUEUED
○
2. AI Multi-Channel Variant Generation
Generating channel-tailored variants for Twitter (280 chars), LinkedIn, YouTube, Instagram.
QUEUED
○
3. Brand Safety & Compliance Screening
Scanning text against NDA/confidential pattern database and checking character bounds. Score: 100%.
QUEUED
○
4. Legal & Regulatory Sign-off (Stage 02)
General Counsel verifies disclaimers and grants compliance approval.
QUEUED
○
5. Executive Brand Director Sign-off (Stage 03)
VP of Marketing grants final publishing authorization -> Stage: APPROVED.
QUEUED
○
6. Durable Publishing Queue & Atomic Lease
Idempotency key generated; worker acquires exclusive 60s lease token.
QUEUED
○
7. Provider Dispatch & Receipt Verification
Official API responds with HTTP 200 and external transaction receipt; verified live.
QUEUED
○
8. Real-time Telemetry & Tamper-Evident Audit Stamping
Performance counters updated and immutable audit event committed with correlation ID.
QUEUED