Provider boundaries

Provider synchronization uses official/authorized APIs and embeds. No browser automation, undocumented mobile endpoints, copied cookies, or proxying around provider controls. The separately scoped community product importer can read a user-selected public product page for primary metadata and permission-confirmed photos, with bounded HTTPS fetching, rate limits and a manual fallback; this does not authorize provider crawling or review synchronization.

Instagram, Facebook, LinkedIn, Pinterest, TikTok, Telegram, Tumblr, and X cards currently render customer-supplied outbound links with network brand icons. They are labelled link_only, not official embeds, and do not copy, normalize, or synchronize provider content. The provider-by-provider embed review found later, separate candidates for selected Meta content, Telegram public posts, and standalone Pinterest widgets. LinkedIn, TikTok, Tumblr, and X still need a suitable documented contract or explicit provider authority. Every future embed starts behind a local consent placeholder and runs in a purpose-built provider-isolated response; no generic or cross-provider Social Feed is authorized. Research alone changes no catalog state.

Reviews

DynoStatic now has a provider-neutral connection framework. Production composition includes the reviewed Google Business Profile adapter package, but Google remains non-publishable and credentials_required pending the authorized live-readiness drill. The older catalog models manual/first-party, Google, Tripadvisor, Yelp, Apple App Store, Google Play, eBay, Etsy, G2, DealerRater, Edmunds, Booking.com, Expedia Group, and OpenTable for display eligibility only. Those legacy defaults are not synchronization authority.

All-in-One Reviews initially aggregates only selected, rights-confirmed first-party testimonial sources. Each source and native rating scale is a separate labeled section, and any minimum threshold is converted to a five-point equivalent only for a source whose exact policy permits curation. Page summaries describe only the reviews loaded on that page; DynoStatic never claims a complete-source count from a globally paginated result and never produces a blended provider score. A future connected segment must have an installed, current, durable reviewed adapter whose exact policy permits mixing. The current neutral provider contract has no separate computed-summary or local-reaction capabilities, so connected summaries and Helpful fail closed even when that provider permits curation. Google is independently hard-denied from All-in-One display, selection, queries, and Helpful actions. See All-in-One Reviews for the complete presentation contract.

A reviewed adapter declares a stable key and version, current primary policy sources, access mode, persistence/curation/mixing/attribution capabilities, cache interval, and disconnect retention. That exact non-secret policy snapshot is stored with discovered sources. A later adapter release cannot silently broaden rendering, curation, mixing, or deletion authority; synchronization pauses on a version mismatch, and corrupt or inconsistent disconnect snapshots fail safely to retention.

The website's Review Providers page owns connect, source discovery/selection, manual sync, reconnect guidance, and disconnect. OAuth state has 256 bits of entropy, is stored only as SHA-256, expires after ten minutes, is bound to the administrator and website, uses PKCE, and is consumed before token exchange. Provider credentials are encrypted for their exact website/connection identity and never returned to an administrator view. Root and subfolder installations generate callback addresses through the same public-URL authority.

Discovery and review synchronization run through bounded, idempotent jobs. They retain provider identities, original URLs, attribution, provider create/update time, and local observation time; honor an adapter's Retry-After signal; refresh expiring credentials; and stop when reconnection is required. Operators can run the existing bounded worker opportunistically through normal requests or add cron for more predictable timing. Cron, shell access, Composer, and Node are not base-platform runtime requirements; live use of a temporary-storage provider such as Google additionally requires scheduled PHP execution so a dormant installation can meet its physical-deletion obligation.

Public widgets render only normalized local records and never contact an adapter or provider. Exact source-selection and disconnect retries are inert. Disconnect first destroys that website connection's access/refresh tokens and applies the exact installed retention policy, then attempts best-effort remote revocation. An indeterminate remote result remains a visible manual-remediation state with the provider account link; DynoStatic never calls it complete speculatively. The installation OAuth client stays in protected configuration until the installation owner explicitly forgets it. A complete restore and website deletion refuse to proceed while live provider authority remains. Manual entries must still be first-party or imported under an explicit display right.

The neutral framework and Google package are covered by deterministic in-process/HTTP fixtures; that evidence does not make a live provider readiness claim.

The Google Business Profile package is implemented locally under the reviewed Google policy contract. The conservative self-hosted model uses an installation-operator-owned Google Cloud project that Google has approved for Business Profile API access; DynoStatic supplies no shared project. The operator registers the installation's exact OAuth callback and grants only https://www.googleapis.com/auth/business.manage. Google provides no Business Profile API sandbox, so deterministic fixtures prove implementation behavior while a separate authorized live drill remains mandatory.

Google-derived review content is a secure temporary performance cache only: refresh is scheduled weekly by default, and rows become display-ineligible 28 days after their last successful observation. Public reads always exclude expired rows; review administration and the bounded worker physically delete them. Because traffic cannot clean a dormant installation, live Google use requires the worker to run at least daily. Public Google pages are bounded, provider-isolated, and returned with private, no-store without ETags or stale application-cache entries. Disconnect immediately deletes cached Google content and the website's tokens. Google reviews are not mixed, blended, ranked, curated, rewritten, summarized, exported, backed up, exposed to Automation or local workspaces, placed in portable/static bundles, or used for AI processing. DynoStatic emits visible Google attribution and the available Business Profile link; F6.2b must verify that rendered treatment against current branding rules. Owner replies are exact, explicit manual administrator actions only—never bulk, scheduled, rule-based, or AI-generated—and require the business owner's authorization. The module remains credentials_required until the authorized live drill is complete.

The App Store review remains approval_required. App Store Connect can expose an operator's own-app reviews and reply operations, but off-store display needs content-bound reviewer permission, while local retention also depends on the exact terms accepted by that operator. No Apple review corpus, automatic publication, aggregation, workspace/AI surface, or readiness promotion is authorized by the research.

The Google Play review is deferred. Its API is a recent, comment-bearing customer-support view rather than a documented public-syndication feed; it has incomplete public-lifecycle evidence and no reviewed grant for permanent storage or third-party display. A private support tool would still require a separately approved package, but no Google Play review bytes enter DynoStatic under the present decision.

The eBay seller-feedback review is technically implementable as a later, separately approved adapter. It is limited to feedback received by the authenticated operator as seller, stays in an eBay-only no-store view, becomes display-ineligible 23 hours after observation, and excludes curation, derived ratings, exports, workspaces, AI, and automatic replies. The current eBay card remains unchanged until that adapter passes deterministic Sandbox proof and an authorized production drill.

Amazon, Airbnb, AliExpress, Houzz, Facebook Reviews, and LinkedIn Recommendations remain non-publishable catalog entries because there is no suitable general-purpose authorized review-text feed. Do not work around that boundary with imports presented as live official data.

Other integrations

YouTube uses customer-selected privacy-enhanced embed URLs and Vimeo accepts provider player URLs; these remain official_embed video modules. Facebook Comments is also official_embed: it loads Meta’s Comments Plugin iframe (https://www.facebook.com/plugins/comments.php) through the shared media host with a comments sandbox preset. Configure App ID (optional), page href, width, post count, and color scheme. Host sites must allow frame-src https://www.facebook.com (and related Meta script origins if they add the JS SDK later). RSS/Atom is server-fetched through the hardened client with a 5 MB ceiling and a 30-minute cache. Podcast Player is ready: it reuses that feed cache, extracts HTTPS audio enclosures, and renders an episode list with a local <audio> player (non-HTTPS enclosures are skipped). PDF Embed presents customer-hosted HTTPS PDFs inline via a media object host with a download fallback; File Embed remains link_only download-only for Office and other non-PDF hand-offs. Flipbook loads PDF.js (SRI) for page-by-page presentation and falls back to the same PDF embed/download path when the library cannot load. PayPal is a link_only customer-owned payment hand-off; DynoStatic does not create orders, capture funds, refund, or implement subscriptions. Maps and Store Locator are ready interactive OpenStreetMap embeds (Leaflet tiles loaded in the widget runtime, explicit coordinates, markers, layout presets, and OSM directions links). They do not call a shared Nominatim autocomplete service; operators enter coordinates or location rows in the builder. Weather is ready and fetches current temperature and WMO weather codes from Open-Meteo (api.open-meteo.com) through the outbound HTTPS client with a 30-minute cache; the UI attributes Open-Meteo and shows empty/error states when coordinates or the fetch fail. No scraping or unofficial weather endpoints are used.