switchpost v0.7.0 — the rename, the agent skill, 271 commits of hardening

v0.7.0 — switchpost: the rename, the agent skill, and 271 commits of hardening

This is the first release under the new name. The repo, crate, CLI, and daemon are now switchpost (ex-social-forge; the folder and GitHub repo were renamed 2026-10-26). One Rust binary, 25 platforms, driven by CLI, REST, or MCP — on your own hardware, SQLite-embedded since v0.3.0.

Since v0.3.0 (2026-10-01, 271 commits):

• The rename, finished. social-forge → switchpost across the code surface, tests, and the agent skill; served page, service file (switchpost.service), and installer all carry the new name.
• The agent skill, red-teamed three times and behaviorally evaluated. v0.5.0 rebuilt the skill (two-ID-systems conflation fixed, every workflow covered); v0.6.0 fixed three CLI agent-surface defects; the behavioral eval measured with-skill 100% vs old 79% (8 runs); v0.6.6 added the 20-query trigger-eval set; v0.6.7 deep-validated every eval run (mutation audit: zero platform mutations across all 8 transcripts).
• Browser-OAuth hardening and the mcp-call toolset-reach fixes (v0.4.5); CSRF port-drift guard (v0.4.4); FRONTEND_URL boot warning when it does not cover the serve port (v0.4.3).
• CLI completeness work the interrupted session verified but never committed (v0.4.2), plus four full-suite validation defects fixed (v0.4.0).
• MCP streamable-HTTP on the daemon — POST {APP_URL}/mcp behind the existing auth; tokio features narrowed from full to the nine actually used; DST-correct zone-name day bucketing.
• Frontend: SvelteKit static build embedded via rust-embed.

Upgrade note: SQLite-only since v0.3.0 (Postgres removed). Your existing SQLite file keeps working; stop the daemon, swap the binary, restart.

Build note: built locally on linux/x86_64-musl with cargo-zigbuild (the release workflow's CI legs could not run — GitHub Actions startup failures on this account). The v0.3.0 asset shape is preserved: a single switchpost-linux-x64 binary.

v0.3.0 — SQLite-only (breaking: Postgres removed, fresh DB required)

⚠️ Breaking change: Postgres is gone, SQLite is embedded

Social Forge now stores everything in a single embedded SQLite file. There is no database server to run.

• The Postgres backend, its DATABASE_URL=postgres://… form, and the Postgres-only deployment path are removed, not deprecated.
• DATABASE_URL now expects an SQLite URL: sqlite://data/social-forge.db?mode=rwc
• There is no data migration. This release will not read, convert, or import an existing Postgres database. If you are moving from v0.2.x, export anything you still need and start from a fresh database.
• The schema is created and migrated automatically on first boot against the new file.

Upgrade from v0.2.x

1. Install the new binary (curl -fsSL https://raw.githubusercontent.com/ishan-parihar/social-forge/main/install.sh | bash).
2. Set DATABASE_URL=sqlite://data/social-forge.db?mode=rwc.
3. Run social-forge serve once — the .db file is created and migrated for you.
4. Re-point backups and any external tooling from the Postgres instance to the .db file.

If you need your old Postgres data preserved for reference, leave that instance running. Nothing in v0.3.0 touches it.

What else is in this release

Platform depth (v25 / v26)

• Tier-1 analytics + engagement depth for YouTube, TikTok, Pinterest, LinkedIn, LinkedIn Page, Reddit, Bluesky, Facebook, Instagram, X.
• Tier-1 comments-read, mentions search, and target discovery, plus refresh flags, unified map_error, and verified recent-posts.
• Composer: 12 live platform previews, blocking validation, timezone-aware scheduling, per-row threaded/group scheduling, a custom @mention trigger, and a date-picker popover.
• Platform registry made unconditional and async for publish verification.

Scheduler & publishing

• Single-poller leader election with standby re-election when the leader dies (replaces the Postgres advisory lock).
• Pending-publish lifecycle on SocialProvider, polled to a terminal state, with a sent comment counted as published.
• Posting-gap detection (3h) raised as in-app notifications; async publish verification; idempotency keys on posts + PostContent and on LinkedIn/Reddit/Slack requests.

Media

• Pluggable MediaStorage backend with optional S3/R2 support.
• Uploads stream to disk (or straight to the active storage backend) instead of buffering the whole body; blank S3 env values are treated as unset; POST /api/media exempted from the 10 MB transport cap.

API & platform surface

• /api/v1 read surface with authenticated API keys, plus config reset-password for the single-user WebUI gate.
• Per-client rate limits on login, provider connect, and media upload.
• OAuth scope loss surfaced as 409 with a reconnect hint.
• Analytics honors a real persisted goal_per_day; engagement impressions column, make_interval cast, and post_state text comparison fixed.

Frontend

• Semantic design-token migration (518 Tailwind color replacements, 11 hardcoded hex values, --brand-rgb), kanban drag-to-reorder + sub-states, dashboard sparkline charts, calendar and channels/analytics/media polish, an a11y + responsive + motion pass, and fixes for the first-run calendar 500, the SSR modal guard, and the error boundary.

Agent surface (AXI)

• Installable social-forge skill + session hooks for Claude Code, Codex, and OpenCode.
• TOON output with content truncation, aggregate counts, home view, definitive empty states, and structured AXI errors in place of raw anyhow.

Housekeeping

• 17 compiler-confirmed dead items removed; duplicated helper/decrypt/integration chains collapsed; the toon-helper workspace member inlined; Postgres/Docker deployment path deleted; 14 stale docs purged and the README quick start corrected.

Artifacts

Platform	Target	Artifact
Linux x86-64	x86_64-unknown-linux-musl	social-forge-linux-x64

Static musl binary (59,231,840 bytes, ~57 MiB, fully stripped) — runs on any glibc or musl Linux host with no runtime dependencies. The SvelteKit frontend is embedded in the binary; set SERVE_FRONTEND=false for API-only mode.

linux-arm64, macos-x64, and macos-arm64 are produced by the manual Release workflow (.github/workflows/release.yml) and are not attached to this draft yet.

Verify the download

echo "704ca2f5d90cc104b0ccfecf7c8891e397ebd2f953925cd78c8ec5151645dbf9  social-forge-linux-x64" | sha256sum -c -
./social-forge-linux-x64 --version    # -> social-forge 0.3.0

v0.2.21

• Frontend embedded into binary (rust-embed) — single self-contained binary
• SERVE_FRONTEND=false disables the web UI (API-only mode)
• install.sh: fully path-agnostic, dynamic user/paths, DATABASE_URL port 5433
• social-forge-start.sh: auto-detects install dir, parses DB params from DATABASE_URL
• social-forge.service: user/group/path filled at install time, no hardcoded values
• Built with cargo-zigbuild targeting glibc 2.35 (runs on Debian 12+)