Why a pipeline

This portfolio used to pull long-form content straight from a CMS, with slugs derived

from post titles: fragile, and impossible to reason about as a privacy boundary. The

PublicBrain model replaces that with an explicit chain of trust: content lives in a

private single source of truth (SSOT) and is promoted, level by level, until a sanitized

subset reaches the web.

The trust levels

• T0: core private. The raw vault. Never leaves the machine.
• T1/T2: runtime and candidates. Working material and content proposed for publication.
• T3: approved. Human-approved content in PublicBrain/published/ that satisfies the public contract.
• T4: published. What visitors see on johnkegd.com.

How the site works today

The portfolio is a T4 consumer with Prismic as the publication gateway for blog

and work. Editors review drafts in Prismic, preview on production via /api/preview, and

Publish when approved. MDX in content/ is backup and staging, synced with

npm run sync:content, not rendered unless Prismic has no matching document.

Prismic also powers the visual layer: homepage hero, content slices (CTA, quote,

embed, gallery), and cross-links between posts and projects.

The default-deny MDX adapter still applies: anything under content/ with

status: published must pass the full frontmatter contract or it is skipped.

Authoring flow (Obsidian to web)

1. Draft in Obsidian (PublicBrain/drafts/ or linked notes).

2. Promote to PublicBrain/published/{blog|projects}/{locale}/.

3. perso-vault sync-to-portfolio copies approved MDX into this repo's content/.

4. npm run sync:content upserts into Prismic (Migration Release).

5. Review + Publish in Prismic: live on johnkegd.com.

What comes next

• Vault Phase 0: templates, perso-vault CLI, agent path restrictions.
• Optional git export of published MDX after Prismic approval.
• Framework-agnostic content contract so a future Angular site reuses the same pipeline.