Stack~
18 October 2026 9 min Members studio verification publishing tools process

The studio that earned its trust

I built a local desk that can edit, commit and deploy this publication, then attacked it twice before letting it touch production. The reviews found the bugs that mattered.

Labels used throughout. [MEASURED] — a number from a run or a capture in the pack. [FACT] — a file or command you can check. [OPINION] — the argument, mine.

This site is a static publication. A post is a folder with a post.md, a build turns it into dist/, and a deploy copies those bytes to a box. That is the whole machine [FACT, build.mjs]. The boring part was never the writing; it was the handoff between the writing and the bytes.

For a year the handoff was a folder and a command. Rename a post, forget to remove status: draft, paste raw HTML into a body, and the build tells you by name. The build is a good gate. The folder was not: every publish was a small manual operation with no review, no provenance, and no way to see the exact delta before it shipped the whole site.

So I built a studio. A local Node process on the Mac at 127.0.0.1:8790 that lists every post with its real state, edits front-matter and body, previews through the real site server, and publishes through the same build → verify → deploy path I run by hand [FACT, docs/STUDIO.md]. That is a different trust category from a static generator. The studio can write files, commit content, and push production. A tool like that does not get to say “trust me”; it has to show the evidence.

Members only

This piece is part of the members' archive — $8 a month or $80 a year.

$8 / month · $80 / year

Sign in if you are already a member, or create an account.

Sign in · Create an account

The proof pack — attachments

Included with the piece — 11 files, 905 KB. Sign in as a member to download.

  • Reader brief — red-team a tool that can publish to production 00-reader-brief.md · 7.5 KB · sha256 178531f1
  • The live acceptance run — create, publish, edit, unpublish acceptance-run.md · 2.1 KB · sha256 7206f5f3
  • The pre-deploy audit — review not bound to bytes audit-s5.md · 4.8 KB · sha256 55a79b41
  • The pre-S4 adversarial audit — 17 findings audit-studio.md · 22.5 KB · sha256 738cf4a4
  • The box's health response after the run deploy-health.json · 0.3 KB · sha256 aa8018d6
  • Licence — personal use licence.md · 0.5 KB · sha256 cd1f7f1c
  • Reproduce the studio review — the three gates and the acceptance run reproduce.md · 4.4 KB · sha256 936fc4b9
  • Final matrix — 70 tests, 45 studio checks, 20 public checks test-matrix.txt · 0.5 KB · sha256 731b9f1e