# Design-partner pilot

EdgeCMS GTM for the first external deployments is **design-partner / enterprise pilot**, not PLG. This page points partners and operators at the durable pilot kit (ICP, demo script, success criteria, security talking points, setup checklist, first-call questions).

**Canonical kit (project store):** ask your EdgeCMS contact for `docs/design-partner-pilot-kit.md` in the EdgeCMS Project Context, or the mirrored copy maintained with product planning docs.

**Tip baseline:** saas `main` @ `00703df` (post #54–#64 wave; locale-exact + public ABAC receipt + standards). Marketing trust surfaces show shipped evidence links only — **no WIP / In progress / Partial badges**; still **no fake certifications**.

## What the pilot proves

One partner site can complete **edit → immutable snapshot → locale-exact readiness → channel promote → rollback** on the same Worker runtime, with locale provenance on reads and SecOps-visible lifecycle / optional ABAC deny signals — without a platform ticket and without a second preview renderer.

Timed operator script: [Partner demo 5-min](partner-demo-5min.md) (includes `GET …/demo/synergy` + `POST …/demo/abac-deny`).

SecOps can also complete the **10-minute security walkthrough**: invite + role defaults → ABAC deny receipt → audit export / SIEM sink config ([security-walkthrough-10min.md](./security-walkthrough-10min.md)).

## Operator how-to for the loop

Step-by-step APIs and local wrangler commands for the release loop live in [Atomic Edge Promote](atomic-edge-promote.md). Timed partner script + staging dry-run: [Partner demo (5 min)](partner-demo-5min.md) (`bun run demo:partner:dry-run:staging`).

## Honest boundaries (do not overclaim on calls)

| Claim carefully | Why |
| --- | --- |
| **ABAC** | Admin/demo attribute policies (brand / locale / channel / env) are shipped when attrs are present; partner probe `POST …/demo/abac-deny`. **Public-plane** denial receipt is **opt-in** (`host.publicAbac`) — off by default; content routes only; assets/GraphQL out of slice. Not a packaged Enterprise SKU gate. |
| **Locale-exact** | Field `localeExact` + promote readiness gate (`LOCALE_EXACT_NOT_READY`) are shipped. Fallible localizable fields still cascade. |
| **SIEM** | Hookable webhook/batch push (`AUDIT_SIEM_WEBHOOK_URL`) + JSON/NDJSON export are available for partner SecOps demos. Hosts own the receiver — not a packaged Datadog/Splunk connector. |
| **SSO / SAML** | Entra/Google social sign-in when configured. Full SAML / enterprise SSO packaging is **next** — see auth guide. |
| **Preview/delivery SLO** | Latency is instrumented (join keys + internal ops board/alerts). No customer-facing number in the pilot — publish numeric SLOs at v1 GA only. See [latency-slo-ops.md](./latency-slo-ops.md). |
| **Compliance evidence** | Public SOC 2 / ISO Annex A / SoA / WCAG / GDPR-PDPA / ASVS maps exist. Point at evidence — never invent certificates. Keep evidence dumps off the marketing site. |
| **Cloudflare-only** | MVP is Workers / KV / D1 / R2. No multi-edge abstraction in year one. |
| **Schema** | UI/DB is content and schema truth. Git is for app code — not a schema-as-code product bet. |

## Related guides

- [Security walkthrough (10 min)](security-walkthrough-10min.md) — invite → role → ABAC receipt → audit/SIEM  
- [Partner demo 5-min](partner-demo-5min.md) — timed edit → promote → locale-exact → ABAC → rollback  
- [Auth and access](auth-and-access.md) — roles, invites, ABAC, public denial receipt, SSO next  
- [Operations and security](operations-security.md) — audit ledger, SIEM webhook/NDJSON sink, privacy export/delete  
- [Latency SLO ops (internal)](latency-slo-ops.md) — join-key dashboards/alerts; no published numeric SLOs  
- [Public API](public-api.md) — published delivery and cache headers  
- [Client SDK](client-sdk.md) — `mountVisualEdit` / visual-edit helpers  
- [SOC 2 checklist](soc2-control-checklist.md) · [ISO 27001 controls](iso-27001-controls.md) · [SoA](soc2-iso-soa.md) · [GDPR/PDPA](gdpr-pdpa.md) — evidence only