Roles vs. verified kinds

These are two independent dimensions. One controls what you can DO; the other controls what fans SEE on a profile.

role (authorization)

verifiedKind (public-facing identity badge)

Common mistake: marking someone as band_staff does NOT give them admin access. That's identity-only. For them to use this dashboard, set role=admin (or whatever auth tier you intend).

Recommended setup for OneRepublic team

Setting up a new staff member

1. They sign into the iOS app first (creates their user row via Sign in with Apple).
2. Go to Users in this dashboard → search their username.
3. Click Set role → choose admin (or moderator if more limited).
4. Click Verify → choose the right kind: band / staff / crew.
5. Send them admin.onerepublic.fncnx.com (or whatever your admin domain is) — they sign in with the same Apple ID and they're in.

If their iOS sign-in is brand-new and the system has zero admins, the worker auto-bootstraps them as admin. So always create your account first; then add other admins via the Users page (which is gated to superadmin-only).

Setting up proxy posting (manager posts as band)

Use case: social media manager publishes a post that appears in the feed as if Ryan wrote it. Audit log records the manager pressed publish.

1. Both users (manager + the post-as identity) must exist in the Users table and be active.
2. The post-as user must be verified — usually as band_member.
3. The manager must have an active role (admin / moderator / verified staff or crew).
4. Go to Proxies page.
5. Pick the manager from the first dropdown, the post-as identity from the second.
6. Add a note (e.g., "Tour manager — covers band-account posts") and grant.
7. Manager signs into this dashboard → composer dropdown shows the post-as options.

Revoking a proxy stops future posts but leaves past posts attributed (audit retention).

Promoting another superadmin

Only do this for someone you trust with platform-level keys (cost caps, proxy grants, role changes). Treat it like handing them the master keys to the building.

1. Users page → find them.
2. Set role → S (superadmin).

Demoting yourself out of superadmin is blocked by lockout protection. If you ever need to remove yourself, demote yourself to admin first (which is also blocked — you'd have to grant another superadmin first and have them demote you).

Cost caps + degraded mode

Every AI moderation call, image classification, and translation logs a row to cost_events. The system auto-rolls up hourly and daily, and watches the spend against two caps:

• Soft cap — when crossed, you get a push notification (TODO: not yet wired).
• Hard cap — when crossed, the system auto-engages degraded mode: text moderation queues everything to human review (skipping the AI hop); image moderation continues. At UTC midnight, degraded mode auto-clears.

Defaults: $50/day soft, $200/day hard. Adjust on the Costs page. You can also force degraded mode on/off manually if needed.

A viral moment (album drop weekend) typically burns $20–60 in 48h at the current pricing. A normal active day at OneRepublic-scale (~10K posts/day across all surfaces) is $50–150/month total.

Board moderation + categories

Category structure

8 default categories shipped. Order: Inner Circle (pinned, members-only) / Introductions / Music / Tour & Shows / Meet & Greet / Fan Creations / Memories / General.

Tour & Shows is special

• Auto-creates one thread per show from Laylo data (lazy-bootstraps on first visit + daily cron resync).
• Sort: next upcoming show pinned top with "NEXT UP" badge, then upcoming ASC, then past DESC.
• Fan-created threads with no show attached fall to bottom.

Moderation roles

• App mods (role moderator or higher) — can hide/lock/pin in any category.
• Category mods — scoped to ONE category. Promoted from trusted superfans. Can hide/lock/pin within their category but can't ban or warn. Grant from the Board page.

Composer constraints

Text + images only. URLs auto-stripped on submit (scalper / phishing defense). No audio, no video. Max 4 images per post, 10MB each.

Multilingual moderation

Llama Guard 3 handles 8 languages natively (en/fr/de/hi/it/pt/es/th). Other languages route through Gemini 2.5 Flash translate → Llama Guard. False-positive self-harm flags get a lyric-whitelist bypass.

Tour sync from Laylo

Source of truth: Laylo drop ID set in worker env (LAYLO_DROP_ID). The worker fetches this nightly + lazy-bootstraps on first Tour & Shows board visit.

• New show added in Laylo → new board thread auto-created next sync.
• Date / venue updated → existing thread's denormalized fields refresh and title rewrites.
• Show removed from Laylo → thread is NOT deleted (don't lose conversation history if a date temporarily disappears).

Manual sync: Board → ↻ Sync tour shows button. Adds ?refresh=1 to bypass the 5-minute Laylo cache.

IAP product-ID naming rules

Product IDs are permanent. ASC binds reporting history to them; renaming or reusing breaks longitudinal data forever. Decide the convention BEFORE creating the first ASC product.

Pattern: com.sthreelabs.<app>.<category>.<item>[.<tier>]

Examples:

• com.sthreelabs.onerepublic.membership.innercircle.monthly
• com.sthreelabs.onerepublic.membership.innercircle.annual
• com.sthreelabs.onerepublic.flair.badge.founding
• com.sthreelabs.onerepublic.sticker.pack.encore
• com.sthreelabs.onerepublic.meetgreet.entry.london2026

Full spec at IAP_REPORTING.md in the worker repo.

Deployment quick reference