feat: deliver AutoBlog 2.0 editorial CMS

[PatrickDev-it]

Outcome

Transforms AutoBlog into a workspace-isolated editorial CMS with real sessions/RBAC, immutable revisions, conflict-safe autosave, review/publication workflow, durable jobs, bounded media, governed AI and a guided recruiter demo.

RFC coverage

• P-01?P-06: one Drizzle/libSQL path, validated domain, Better Auth and five-role server policy.
• P-07?P-09: state machine, append-only history, restore, HTTP 409 conflicts and idempotent publication.
• P-10?P-12: verified bounded media, compensation and explicit metered mock/Gemini suggestions.
• P-13?P-17: legacy deletion, accessible responsive UX, measured budgets and bounded demo reset.
• P-18: independent CI jobs, truthful evidence matrix, actual visual baselines and release runbooks.

Local release evidence

• frozen install; migrations 0000?0003 and seed from empty
• strict typecheck and zero-warning lint
• 19 unit, 25 integration, 10 E2E, 6 accessibility, 5 visual and 2 performance tests
• production build; zero runtime audit findings; current-tree secret scan clean
• measured direct LCP 188/300 ms, CLS 0, interaction 16 ms and JS 141,959/221,420 bytes; Lighthouse performance 0.92/0.91 with all other category scores 1.00

Release blockers

All eleven protected jobs pass, including the automated TruffleHog history-range scan. Manual baseline review identified historical MongoDB, Cloudinary and Gemini values in commit 8f83cec; automated zero-finding does not prove revocation, so owner-confirmed rotation remains mandatory. Public v2 verification also requires remote libSQL/auth/cron configuration and a one-minute scheduler.

This PR must not merge, tag or advertise the old deployment as v2 until every required check and external gate is resolved.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
auto-blog-cms	Ready	Preview, Comment	Jul 22, 2026 9:54am

[PatrickDev-it]

Final candidate 78af05b evidence:

• Required run: https://github.com/PatrickDev-it/AutoBlog-CMS/actions/runs/29884450920
• Frozen install, typecheck, lint, unit, integration, E2E, accessibility, visual, performance and production build pass.
• The security job passes runtime audit and current-tree scanning, then fails only at the required full-history finding documented in SECURITY.md.
• main protection now requires all 11 RFC jobs, strict branch freshness, admin enforcement, no force-push/deletion and resolved conversations.
• Vercel built the candidate, but the preview redirects an anonymous clean session to Vercel login; it is not a public demo.

External owners must rotate/revoke the historical provider credentials, configure durable remote libSQL/auth/cron plus the one-minute scheduler, and expose an approved public URL. The PR remains draft and must not be merged/tagged before those gates pass.

[PatrickDev-it]

Final P-15/P-18 evidence on head 2b4f6f9: run https://github.com/PatrickDev-it/AutoBlog-CMS/actions/runs/29885890517 passes frozen install, typecheck, lint, unit, integration, E2E, accessibility, visual regression, production build and the expanded performance gate. Performance now executes two direct Web Vital/JS budget tests plus six Lighthouse reports and preserves a seven-day 714,871-byte performance-reports artifact. Runtime audit and current-tree secret scan pass; security-audit fails only at the intentionally unsuppressed historical credential finding. Latest Vercel preview built successfully but anonymous root still returns HTTP 302 to Vercel SSO. PR remains draft and blocked pending credential rotation, durable remote runtime/scheduler configuration and public deployment access.