Headless publishing pipeline

Publishing was tied to a single website, so every article was locked to one presentation and one deploy cycle. Drafting, review and publishing lived in different tools, and when an automated run failed it left no trace: the team only noticed because the article never appeared.

The system splits storage by what each part is good at. Article bodies are committed to a Git content repository, so any static site generator can consume them and the history of every edit is free. Everything the admin needs to filter, sort and report on stays in Postgres. Writers work in a rich text editor with inline AI assistance, and images upload straight to object storage through presigned URLs.

The automated path starts from a request form. The request is stored first, then handed to an orchestration workflow that builds the prompt, calls the language model and validates the result against a schema before anything is committed. Invalid output is sent back to the model with the specific validation errors attached, rather than failing silently. The workflow reports its outcome back through an authenticated callback, so a rejected run shows up in the admin with its errors and can be retried from the stored payload.

A separate measurement layer pulls analytics sessions, search performance, first party click events and order data into one dashboard, so editorial decisions are made against real reader behaviour.

Git as the content store was the decision everything else followed from. It decouples content from any one website, gives versioning and review for free, and means a future redesign never has to migrate content. The cost is that updates need the current file hash, which the publisher handles explicitly so two concurrent edits cannot silently overwrite each other.

Schema validation sits between the model and the repository rather than after it. A language model that returns almost valid JSON is the normal case, not the exception, so the retry carries the validation errors back into the prompt. Two attempts, then the run is marked rejected and surfaced for a human. Failing loudly and keeping the payload was worth more than any additional automation.