Platform Setup Readiness Record

Audit date: 2026-07-08 Implementation remediation date: 2026-07-08

The blocking implementation gaps from the platform setup audit have been remediated or moved out of launch scope. Durable dashboard and production configuration tracking now lives in readiness-checklist.md.

Completed Remediation

Area	Status	Record
Server-owned social OAuth callbacks	Complete	Backend authorize and callback use OAUTH_REDIRECT_BASE_URL + /api/company/social-accounts/callback/{PLATFORM}. Frontend social connect calls no longer send callback URLs.
X/Twitter PKCE and scopes	Complete	PKCE verifier is keyed by verified OAuth state with TTL semantics; initial scopes are tweet.read, tweet.write, users.read, media.write, offline.access.
Bluesky app-password flow	Complete	Bluesky uses a protected handle/app-password endpoint and dedicated UI dialog, not OAuth.
Slack/Discord public callbacks	Complete	Only /api/integrations/channels/callback/:type is public; management routes remain JWT protected.
Meta staged scopes	Complete	Facebook, Instagram, and Threads request publishing-first scopes; Meta webhook readiness requires META_WEBHOOK_VERIFY_TOKEN.
LinkedIn staged scopes	Complete	Profile connect uses member publishing scopes; page connect is separate and gated on Marketing Developer Platform approval.
Google/YouTube launch scopes	Complete	YouTube launch scopes exclude youtubepartner and analytics until a later review decision.
Mastodon instance flow	Complete	Users enter an instance before OAuth; instance URL is persisted through state/callback and account metadata.
Blog platform launch scope	Complete	Medium is out of launch scope; WordPress uses REST/application-password credentials; Ghost uses Admin API keys.

Remaining Manual Work

No implementation-blocking items remain in this file. Provider dashboard confirmation, reviewer recording ownership, and production credential checks are manual release tasks tracked in the readiness checklist.