# 03 — Implementation Roadmap

Phased plan to deliver **RAG (GPT-4o mini / Claude)** + **auto/manual photo-video publishing** to **Facebook Pages** and **LinkedIn profile + Company Pages** on the current Next.js app.

---

## Phase 0 — Trust & docs (blocker)

**Goal:** Safe foundation before new attack surface (upload + RAG).

- [ ] Rotate secrets; scrub `.env.example` / `.env.production.example` / `deploy.sh` defaults  
- [ ] Signed sessions (replace `postsync_auth=1`)  
- [ ] Encrypt OAuth tokens at rest  
- [ ] Disable demo auth in production  
- [ ] Cron: Bearer header only  

**Exit:** Security checklist from code review P0 items closed.

---

## Phase 1 — Data & RAG MVP

**Goal:** Query current project data via GPT-4o mini / Claude.

- [ ] Migration `rag_chunks`  
- [ ] Adapters for brand, sequence, website-cache, generated posts  
- [ ] OpenAI embeddings + MySQL/memory store  
- [ ] `POST /api/rag/reindex`  
- [ ] `POST /api/rag/query` (`provider`: openai-mini | claude)  
- [ ] Replace `/knowledge-base` stub with Ask UI  
- [ ] Optional: inject top-k into `run-generation`  

**Exit:** Seeded project answers grounded questions with citations.

**Refs:** `docs/rag/*`

---

## Phase 2 — Destinations model

**Goal:** Explicit publish targets.

- [ ] `target_type` on connected accounts (`page` | `member` | `organization`)  
- [ ] UI: list Facebook Pages (multi)  
- [ ] UI: LinkedIn member + Company Page picker  
- [ ] LinkedIn org ACL fetch + `w_organization_social`  
- [ ] Publish orchestrator accepts `destinations[]`  

**Exit:** Manual image post to FB Page + LI member + LI Company Page.

**Refs:** `docs/social/02-FACEBOOK.md`, `docs/social/03-LINKEDIN.md`

---

## Phase 3 — Manual media (photo & video)

**Goal:** “We give the photo/video” then publish.

- [ ] Authenticated `POST /api/media/upload`  
- [ ] Attach asset to draft `GeneratedPost`  
- [ ] Caption assist via RAG + GPT-4o mini / Claude  
- [ ] Quick publish with destination multi-select  
- [ ] Partial success UI  

**Exit:** User uploads image → posts to selected FB/LI destinations.

---

## Phase 4 — Video on Facebook / LinkedIn

**Goal:** Video beyond YouTube-only.

- [ ] Facebook Page video publish  
- [ ] LinkedIn member/org video (API + size limits)  
- [ ] Preflight codec/size validation  
- [ ] Keep FFmpeg slideshow as optional generator  

**Exit:** Manual video to at least Facebook Page; LI video if scopes allow.

---

## Phase 5 — Auto-publish alignment

**Goal:** Same destinations & media rules on cron.

- [ ] Auto path uses destination list  
- [ ] `require_approval_before_auto_publish` flag  
- [ ] Photo auto-post verified; video auto behind flag  
- [ ] Diagnostics show per-destination results  

**Exit:** Slot fires publish image to all connected FB Pages + LI targets without double-post.

---

## Phase 6 — Hardening & global parity

- [ ] Security headers in `next.config.ts`  
- [ ] Rate limits on RAG + upload  
- [ ] Basic smoke tests (auth, rag query, publish mock)  
- [ ] Calendar week view (optional peer parity)  
- [ ] Analytics pull (optional)  

---

## Suggested ownership split

| Area | Owner focus |
|------|-------------|
| RAG ingest/query | AI / backend |
| LinkedIn Company Pages | Social integrations |
| Facebook video | Social integrations |
| Upload + Live Generation UI | Frontend |
| Auth/token encryption | Platform security |
| Docs accuracy | Keep `docs/README.md` index updated |

---

## Milestone demo script

1. Connect Facebook Page + LinkedIn profile + Company Page.  
2. Reindex project → ask “What is our primary service?” (GPT-4o mini).  
3. Upload a photo → generate caption (Claude) → manual publish to all three.  
4. Enable schedule → wait for slot (or run auto-post) → confirm posts live.  
5. Show publish log with permalinks.

---

## Doc maintenance

When a phase ships, update:

- `docs/README.md` status table  
- `docs/architecture/00-OVERVIEW.md` as-is section  
- `extras/docs/VERTICAL-KNOWLEDGE-BASE.html` competitor matrix if capability flips to Present