# 02 — Global-Level Review

Review of PostSync Pro against **global social publishing / AI content** norms for the planned RAG + Facebook/LinkedIn (profile & pages) product.

---

## 1. Market placement

| Tribe | Examples | PostSync fit |
|-------|----------|--------------|
| Classic schedulers | Buffer, Later, Publer | Partial — slots, weak calendar |
| AI content engines | Predis.ai, Ocoya | **Strong wedge** — context + QA |
| Enterprise suites | Hootsuite, Sprout | Weak — no inbox/teams yet |
| Network specialists | Taplio (LI) | Not competing on growth CRM |

**Recommended narrative:**  
“AI-grounded publisher for brand Pages & LinkedIn — RAG over *your* business data, then auto or manual post.”

---

## 2. Capability scorecard (global bar)

| Capability | Global expectation | PostSync now | After planned build |
|------------|-------------------|--------------|---------------------|
| Grounded brand knowledge | Brand kit + asset library / RAG | Push context only | RAG over project data |
| GPT-4o mini / Claude choice | Common in 2025–26 stacks | Single `AI_PROVIDER` | Split chat vs caption |
| FB Page photo | Table stakes | Yes | Yes |
| FB Page video | Table stakes | No | Yes (planned) |
| FB personal timeline | Rarely offered (API limits) | No | Stay No + clear copy |
| LI profile | Common | Yes | Yes |
| LI Company Page | Table stakes for B2B | No | Yes (planned) |
| Manual publish | Table stakes | Yes | Yes + destinations |
| Auto schedule | Table stakes | Yes | Yes + approval option |
| User media upload | Table stakes | Weak / AI-first | Required for “give photo/video” |
| Calendar UI | Expected | Missing | Later phase |
| Token encryption | Expected | Gap (critical) | Must fix with build |
| Team approvals | Enterprise expected | Partial statuses | Phase 2 |

---

## 3. Global risks specific to this vertical

1. **OAuth token = brand voice** — plaintext tokens are unacceptable at global SaaS bar.  
2. **Company Page posting needs LinkedIn product review** — timeline risk; start App review early.  
3. **Meta App Review** for `pages_manage_posts` — already in path; video may need extra review.  
4. **Hallucination** — RAG without strict prompts reintroduces fake claims; keep validators.  
5. **Auto-post without approval** — competitors offer it, but enterprises demand a gate.  
6. **“Facebook account” wording** — overpromising personal timeline causes support churn.

---

## 4. What to copy from peers (patterns, not clones)

| Peer pattern | Adapt as |
|--------------|----------|
| Buffer “channels” | Destinations: FB Page / LI member / LI org |
| Predis AI templates | Keep banner layouts; add RAG for facts |
| Sprout approvals | Optional `require_approval` on automation |
| Hootsuite media library | Simple upload library per project |
| Later calendar | Phase 2 week view on top of slots |

---

## 5. Engineering review highlights (do not ignore)

From `extras/docs/CODE-REVIEW-KNOWLEDGE-BASE.html`:

- Forgeable session cookies  
- Demo auth open  
- Secrets in example env / `deploy.sh`  
- Tokens in columns named `*_encrypted` but stored raw  
- Cron `?secret=` query param  

**Ship RAG + multi-destination publish only behind real session security.**

---

## 6. Verdict

| Question | Answer |
|----------|--------|
| Is the vertical idea sound? | **Yes** — RAG + Page/Company publishing is a coherent B2B product |
| Is current code a viable base? | **Yes** — generation, Page FB, LI member, cron already exist |
| Biggest product gap? | LinkedIn **Company Pages** + user **media upload** + **RAG** |
| Biggest trust gap? | Auth + token encryption |
| Biggest messaging gap? | Facebook **Page** vs personal **account** |

Proceed with the phased roadmap in [03-IMPLEMENTATION-ROADMAP.md](./03-IMPLEMENTATION-ROADMAP.md).