Docs / Releases and partners
Design-partner pilot
EdgeCMS GTM for the first external deployments is design-partner / enterprise pilot, not PLG. This page points partners and operators at the durable pilot kit (ICP, demo script, success criteria, security talking points, setup checklist, first-call questions).
Canonical kit (project store): ask your EdgeCMS contact for docs/design-partner-pilot-kit.md in the EdgeCMS Project Context, or the mirrored copy maintained with product planning docs.
Tip baseline: saas main @ 00703df (post #54–#64 wave; locale-exact + public ABAC receipt + standards). Marketing trust surfaces show shipped evidence links only — no WIP / In progress / Partial badges; still no fake certifications.
What the pilot proves
One partner site can complete edit → immutable snapshot → locale-exact readiness → channel promote → rollback on the same Worker runtime, with locale provenance on reads and SecOps-visible lifecycle / optional ABAC deny signals — without a platform ticket and without a second preview renderer.
Timed operator script: Partner demo 5-min (includes GET …/demo/synergy + POST …/demo/abac-deny).
SecOps can also complete the 10-minute security walkthrough: invite + role defaults → ABAC deny receipt → audit export / SIEM sink config (security-walkthrough-10min.md).
Operator how-to for the loop
Step-by-step APIs and local wrangler commands for the release loop live in Atomic Edge Promote. Timed partner script + staging dry-run: Partner demo (5 min) (bun run demo:partner:dry-run:staging).
Honest boundaries (do not overclaim on calls)
| Claim carefully | Why |
|---|---|
| ABAC | Admin/demo attribute policies (brand / locale / channel / env) are shipped when attrs are present; partner probe POST …/demo/abac-deny. Public-plane denial receipt is opt-in (host.publicAbac) — off by default; content routes only; assets/GraphQL out of slice. Not a packaged Enterprise SKU gate. |
| Locale-exact | Field localeExact + promote readiness gate (LOCALE_EXACT_NOT_READY) are shipped. Fallible localizable fields still cascade. |
| SIEM | Hookable webhook/batch push (AUDIT_SIEM_WEBHOOK_URL) + JSON/NDJSON export are available for partner SecOps demos. Hosts own the receiver — not a packaged Datadog/Splunk connector. |
| SSO / SAML | Entra/Google social sign-in when configured. Full SAML / enterprise SSO packaging is next — see auth guide. |
| Preview/delivery SLO | Latency is instrumented (join keys + internal ops board/alerts). No customer-facing number in the pilot — publish numeric SLOs at v1 GA only. See latency-slo-ops.md. |
| Compliance evidence | Public SOC 2 / ISO Annex A / SoA / WCAG / GDPR-PDPA / ASVS maps exist. Point at evidence — never invent certificates. Keep evidence dumps off the marketing site. |
| Cloudflare-only | MVP is Workers / KV / D1 / R2. No multi-edge abstraction in year one. |
| Schema | UI/DB is content and schema truth. Git is for app code — not a schema-as-code product bet. |
Related guides
- Security walkthrough (10 min) — invite → role → ABAC receipt → audit/SIEM
- Partner demo 5-min — timed edit → promote → locale-exact → ABAC → rollback
- Auth and access — roles, invites, ABAC, public denial receipt, SSO next
- Operations and security — audit ledger, SIEM webhook/NDJSON sink, privacy export/delete
- Latency SLO ops (internal) — join-key dashboards/alerts; no published numeric SLOs
- Public API — published delivery and cache headers
- Client SDK —
mountVisualEdit/ visual-edit helpers - SOC 2 checklist · ISO 27001 controls · SoA · GDPR/PDPA — evidence only