Skip to content

Publish Loop

Deterministic finalize → package → dry-run → publish flow used by the Publishing Agent.

Pre-conditions

  • Content is finalized (Documentation generation loop step 6).
  • A venue adapter is selected and registered.
  • Adapter has agent-scoped credential injected at runtime (SPB-02).
  • Publishing-policy approvals collected.

Steps

  1. Adapter selection.
  2. Match content type and content classification against adapter's supported_content_types and policy.

  3. Reject if classification not permitted at the venue (e.g., private_sensitive → public venue: deny per SPB-10).

  4. Preflight validation.

  5. Adapter preflight: required fields present, payload size within limits, policy check passes.
  6. Editorial policy re-applied against the venue-packaged form.

  7. Duplicate-publish prevention: hash check against recent publishes for the same logical artifact.

  8. Approval collection.

  9. All approvers per publishing-policy.yaml recorded with timestamp.

  10. JIT publish token issued (SPB-06) bound to this content.

  11. Dry-run.

  12. Adapter executes its no-side-effect dry run.
  13. Output (rendered/packaged artifact) inspected by the agent and made available to the user.

  14. Audit event: publish_dry_run.

  15. Publish.

  16. Only after dry-run succeeds and JIT token is valid.
  17. Adapter performs the publish action.
  18. On success: capture venue-side identifier, URL, timestamp.
  19. On failure: log, retry per adapter retry policy, then escalate.

  20. Audit events: publish_attempted, publish_succeeded or publish_failed.

  21. Post-publish confirmation.

  22. Adapter retrieves the published item (where supported) to confirm the upload matches sent payload.

  23. Discrepancies trigger investigation; do not assume success.

  24. Logging and lineage.

  25. Append a content-lineage record: source pins → finalized artifact → venue identifier → approvers → timestamps.
  26. Conform to governance/docs-publish/audit/publish-audit-log-spec.md.

Rollback / unpublish

  • Triggered by: editorial issue surfaced post-publish, security finding, owner request.
  • Adapter unpublish capability invoked; record unpublish_attempted and result.
  • If venue does not support unpublish: file an explicit acceptance with rationale and update the audit trail.

Audit events

  • publish_dry_run, publish_attempted, publish_succeeded, publish_failed, unpublish_attempted, unpublish_succeeded, approval_recorded.