Autonomous daily content — implementation specification

Status: implementation in progress, 2026-09-23; Kanboard task #293. No new daily publisher or schedule enabled yet. Owner: content-pipeline integration; Android implementation remains with story-publisher. See content-pipeline, story-publisher and SOP-018/SOP-041 for current operations. This is a delivery specification, not a second task register or a request for routine owner approval.

Outcome and constraints

Every Eastern calendar day gets one new website note, one Facebook feed with exact clickable HTTPS article URL, one Facebook Story with native exact-article link, one Instagram feed with bio CTA, and one Instagram Story with native exact-article link. Note publication and public verification precede social publication; each Story follows its own feed. No open chat, owner approval tap or manual daily inspection is required. The assistant separately reviews and approves all five inputs under delegated authority.

One calendar, one daily article identity, seven complete consecutive future dates. Past batch publications, existing approved feed dates and canceled legacy Postiz Stories remain preserved. Do not silently move legacy jobs to satisfy the new metric. No paid overflow, purchases, new account creation or public source-code release is implied.

Existing components and gaps

Component	Reuse	Remaining work / acceptance
Calendar/approval	assistant/note_queue.py and approval SQLite	Parent five-stage manifest, revision binding, complete-date metric
Research	content_buffer.py, existing hourly refill and constrained researcher	Complete-package refill, substantive automated review, bounded revision
Artwork	content_artwork.py, existing renderers and approved visual references	Prove unattended vivid-art route and visual review; current generation uses constrained SVG, not proof of preferred raster quality
Website	guarded publish-note release	Exact public content verification and deterministic integration
Feeds	existing content.py/Postiz submission and delivery observations	Preparation before note publication, durable dispatch/reconciliation contract
Stories	story-publisher approval/attempt ledger, Android/Appium composer	Share adapter, observed remote identity, viewer exact-link verification and seven-run acceptance
Monitoring	current social audit, Postiz watchdog, systemd/ntfy	Five-stage reconciliation, worker liveness, complete-buffer recovery, independently hosted heartbeat feasibility

Custom code is integration around existing schedulers, SQLite and Android tooling. Do not introduce another orchestration platform. The existing Story README records the Appium/emulator/Postiz reuse investigation. Recheck official interfaces only when changing an adapter or selecting an additional service.

Work packages and order

Work	Owner / write boundary	Depends on	Completion evidence
A: parent manifest and date planner	content integration; assistant sandbox	none	Migration preserves legacy state; revision and consecutive-date tests
B: producer and independent reviewer	content preparation worker; scoped assistant files	A contract	Seven complete packages prepared without owner taps; failed factual/visual samples rejected
C: live Story adapter	existing Story owner; story-publisher only	A interface; existing approved pilot	Both platforms publish matching Stories, viewer opens exact article, durable attempt evidence
D: executor and reconciliation	content integration; assistant sandbox	A; adapter contracts	Isolated crash/timeout/partial-failure cases; exact public-note check
E: monitoring and recovery	integration owner, after D	B–D	Stalled worker, false completion and reserve gap detected; bounded recovery verified
F: controlled rollout	primary integrates serially	B–E	Seven consecutive real daily successes per Story platform plus offline faults; seven future prepared dates; restart recovery

A and C can progress in parallel after interface agreement. B and D can progress independently against A. One writer per file/worktree, one heavy local build/Android workload at a time, bounded workers and fresh capacity checks. No worker may recursively delegate or mutate external accounts outside its scoped adapter assignment. Existing task register remains canonical; map implementation assignments there under SOP-017 when execution starts.

Shared interface

Parent package binds: schema version, package ID, revision, slug, exact HTTPS URL, Eastern editorial date, source commit and digest, destination account IDs, five stage manifests, actual reviewer IDs, review/evidence timestamps, and assigned UTC instants plus Eastern timezone. Stage manifests bind caption/visible text, immutable media digest and location, link/sticker placement, adapter version/capability and review result. Store a profile destination check for the Instagram bio CTA.

Story handoff is a versioned manifest consumed by the existing Story owner. It returns preparation acceptance or a concrete rejection, then append-only execution observations keyed by package/revision/platform/attempt. Retransmitting an identical handoff must adopt the same job, not create another. Revision conflict fails closed. Parent coordinator never fabricates Story readiness or overwrites Story-owned attempts.

States distinguish draft, in_review, ready, claimed, submitted, published, verified, blocked, missed and uncertain. Preparation readiness is separate from delivery. Every external write has an attempt ID and committed pre-write record. Lease expiry means reconcile, never permission to repeat a publish action. Unique account/stage/editorial-date constraints prevent double ownership. A transaction/outbox boundary bridges the parent database and adapter ledger; no assumed cross-database atomic transaction.

Changing note bytes invalidates all dependent social approvals for that revision. Changing one caption or independent image invalidates only dependent stages. Re-review records the assistant identity, source evidence and actual artifact inspected; a passing hash/JSON schema is not editorial review.

Buffer and preparation policy

Measure tomorrow through tomorrow+6 as seven distinct complete future dates, excluding today. Report both ready-date count and contiguous coverage through the first gap. Seven scattered packages are not seven covered days. Keep today's package separate. Preparation works at least eight calendar dates including today; generating the next farthest day ahead of the date rollover avoids a predictable dip to six. The target is maintained by rolling preparation, not claimed as an invariant during outages.

Refill on consumption, invalidation and periodic checks. Prioritize the earliest missing date and reuse unchanged reviewed assets. Limit each candidate to two corrective revisions before holding it and selecting another candidate; enforce wall-time, resource and provider limits. Separate read-only source/review work from publication credentials. Treat fetched sources as untrusted data. Unsupported business promises and unsafe technical generalizations must fail review. No AI inference is required to release a fully prepared ordinary package.

Artwork is a first-class blocker: demonstrate a scheduled, permitted generation path that runs without chat tools and meets the USB-C/schematic vivid hardware standard. The current SVG generator alone does not establish that. Prefer existing owned images and reviewed compositions where relevant; pre-generate sufficient varied art during bootstrap. Do not silently revert to disliked generic graphics or assume an interactive image tool is callable by cron. If a new paid service is necessary, that remains a specific external dependency, not an invented free capability.

Execution and timing

Preserve existing approved times during migration. For new packages, use the existing proposed note window 07:00–09:00 Eastern, Facebook feed 09:00 and Instagram feed 18:00; Story slots and allowed grace windows must be explicit in their reviewed manifest. Future routine time choices fall under delegated authority. Do not invent a live pilot time if its approved slot has passed: reconcile and record a fresh assistant-reviewed slot first.

Coordinator wakes periodically and evaluates durable due work rather than relying on one process sleeping until a time. Persistent timer/restart catches wakeups, but never bulk-publishes missed dates. Before each stage, enforce remaining time margin, public article identity and prerequisite evidence. Inspect rendered title/body or version evidence at the exact URL; HTTP 200 alone is insufficient. A site-up/feed-blocked day remains partial, never fully delivered.

Feed scheduling may follow public note verification well before its assigned feed time. Submission records bind provider job IDs; later observations confirm actual publication. Stories wait for actual corresponding feed publication, not merely a queued provider job. Verify Instagram profile destination independently of its caption. Story inspection must observe the matching live Story and a real click reaching the matching article; composer screenshots do not qualify.

Retry known transient pre-submit failures at bounded backoff intervals within the recorded window (initial candidate: 1, 5, 15 minutes; maximum three). On uncertain acceptance, query provider/app/site evidence and adopt the existing result. An absence from a delayed provider list is not sufficient proof of nonpublication. If reconciliation cannot establish a safe action, stop that destination and surface the reason. UI drift stops automated tapping; no autonomous selector guessing or generated code deployment.

Before the first public action, a held candidate may be replaced by an unscheduled, fully reviewed reserve package with a recorded calendar revision. After any public action, freeze the day's article and repair only missing stages. No mixed-article day, duplicate feed, catch-up batch or automatic deletion of live content.

Independent monitoring and recovery

Reuse the existing approximately 15-minute social observation cycle and add due-stage deadlines, stale attempt/heartbeat checks and complete-buffer checks. The watcher independently compares remote observations against local claims; it must reject a fabricated local complete flag. Record first failure, retry count, last evidence, next action and expiry. Routine repairs are logged quietly; only unresolved actionable exceptions notify the owner. Deduplicate alerts and record recovery.

Plex-local monitoring cannot detect total Plex/power/network loss by itself. Inventory existing off-host heartbeat facilities before selecting another; do not count Kuma on the same host as independent. An off-host monitor can report failure but cannot publish Stories while Plex is down. Continued publishing through host loss would require an independently capable standby and account-session validation; this is not promised by the single-host plan.

Pause controls separately stop new preparation, new publication or a destination. Pausing leaves active uncertain attempts available for reconciliation. Disabling a stage also blocks its dependent stages, without undoing completed work. Back up the approval/attempt ledgers with existing tools and validate restoration with external-state reconciliation before resuming writes.

Acceptance matrix and rollout

• Time: DST boundaries, midnight rollover, missed day, expired Story slot, wrong timezone and insufficient margin.
• Binding: source edit, one-image regeneration, account mismatch, wrong article link, stale profile destination and conflicting revision.
• Crash: terminate before write, after external acceptance/before local commit, during deployment, during Story Share and during inspection; no blind duplicate.
• Outage: CDN stale content, rejected feed, provider status lag, unavailable Android, missing sticker control, expired login, changed app version and provider AI quota exhausted.
• Isolation: credential-free network-denied fixtures for mutating tests; no synthetic test posts on real accounts. Already-approved real-note pilot is a controlled live acceptance action.
• Monitoring: healthy process with stalled queue, stale observations, false local complete flag, buffer gap, stopped timer and lost host heartbeat.
• Recovery: database restore plus remote reconciliation, partial-day pause/resume, no repeat of successful stages and no duplicate ownership between legacy/new publishers.

Rollout: sandbox contracts and faults; shadow evaluation using read-only observations; controlled already-authorized live Story pilot; controlled execution of complete daily packages; full unattended enablement only after acceptance. Stage flags are for isolation and rollback, not a plan to publish website-only days and call them success. Existing production jobs remain with their existing owner until reconciled transfer, then exactly one publisher owns each destination/date.

Story acceptance uses seven consecutive successful controlled daily runs for EACH platform. Any missed, failed or unverified eligible run resets that platform's streak; fault fixtures do not count. Save Story/link evidence before expiry. Existing project acceptance governs; no seven-day wait for another owner approval is introduced. After full enablement, continue an explicit observation period and report actual complete-day rate, late stages, uncertain attempts, buffer coverage and required owner interventions. Never claim impossible guaranteed daily delivery during platform/host outages.

Review evidence

2026-09-23: bounded tool-free Claude Fable review, actual model claude-fable-5-1, medium effort; list-price CLI estimate $0.29335825 (not subscription spend). Private evidence: ~/.local/state/autonomous-content-plan/review.json. Primary checked current note_queue.py, content_artwork.py and Story README/handoff. Integrated binding, uncertainty, buffer, observation and timing findings. Corrected reviewer suggestions: unimplemented Share is blocked/not-submitted, not submitted; seven total packages can hide date gaps; staged website-only publication does not satisfy the owner's full daily contract. Native Claude capacity before review was 14% session, 6% shared weekly, 7% Fable weekly with a fresh reading. No paid API fallback. This review validates the plan, not production behavior.

Implementation checkpoint — 2026-09-23 07:50 EDT

Owner explicitly authorized implementation and the necessary agents. Work is in assistant-sandbox and story-publisher, currently uncommitted and not promoted. Implemented parent five-stage SQLite manifests, review/asset binding, immutable attempts, date readiness, deterministic injected executor, guarded website/feed adapters, exact public source marker verification, independent source/visual reviewer, curated raster-library composition and manifest assembly. Full execute CLI remains blocked until the Android path is accepted; this is not yet hands-off production.

Native Fable implementation/review workers actually ran claude-fable-5-1. A documentation scout also used native WebSearch's reported claude-haiku-4-5-20251001 helper. Private briefs/results: ~/.local/state/content-autonomy-build/. Primary corrected worker schema mismatches, immutable source transitions and uncertain-result handling. Latest focused core suite:48 tests pass; additional integration tests are in progress.

Real draft-only Android inspections observed the pinned FB Share and IG Your story controls and safely discarded both drafts. Implemented a durable-claim-before-tap primitive and versioned parent handoff; neither is a complete publisher. Single-platform sharing scope, actual Story identity, viewer click and autonomous scheduler remain unverified. No Share action was performed. Both media permissions explicitly restored to restricted; Android stopped. Existing feeds and canceled legacy Stories unchanged.

Real independent preparation review successfully fetched technical sources and inspected the generated raster composition. It rejected duplicate Facebook CTA and truncated Instagram copy; source generator corrected and a second bounded review is running. New vivid conceptual raster library: ~/embeddedera-content/asset-library/ (assembly/test, firmware/memory, wireless module and existing USB-power reference; manifests/digests and prompts.md). Interactive image generation bootstraps assets; unattended daily composition uses owned library files plus independent review, not an assumed cron image-generation service.

Outstanding: bounded refill integration, final regression/browser checks, live Story/share scope and viewer verification, Instagram bio verification, observer/recovery/heartbeat integration, seven complete future packages, controlled live acceptance, production promotion and operating documentation. Task remains WIP.

Log

• 2026-09-28: Facebook Story (lithium-cell note) failed at 09:15 and 09:30: "Emulator unit never became active" because yesterday's killed emulator left a failed transient story-android-rehearsal.service that blocked the name. Fixed in story-publisher 990b94e (reset-failed before launch). Posted at 09:58; link verification then died on KeyError: 'ANDROID_HOME' (in-process verify ran without android_env.sh); fixed in 8f9493a. That Story stays 'posted' (unverified link); tonight's Instagram Story is the first full run with both fixes.