first bounded step toward the staging setup: a manual Spindle workflow for locked install, lint, Astro/TypeScript checks, tests and static build. no publishing step or credentials added. manual-only until the repository secret boundary is confirmed; Spindle injects repo secrets into sources it classifies as trusted, including same-repo cases.
this is checks/build foundation, not completed staging previews. docs/CI.md records the artifact-handoff and separate-origin work still required. the release-artifact example needs an owner PDS password, which must not be given to incoming PR code.
validation: YAML parsed locally against the documented shape; clean diff. the trusted main snapshot already built successfully for the Wisp production release. no incoming PR scripts executed locally; this workflow has not run on hosted Spindle yet. no direct main commits, no production or DNS change.
round 2: operator confirmed the repo secret store is empty. enable main-push and pull-request checks in this round, plus manual runs. no secrets added, no production publishing, no direct main commit. rendered preview artifact handoff remains the next phase.
round 3: adds the Wisp pipeline in the SAME PR, using the maintainer's native-v2 integration docs and checksum. publisher is a template for a separate trusted repository, because repo-global Spindle secrets could otherwise reach same-repo PR checks. no secret provisioning or live activation. local YAML parse/diff check passed; hosted execution and rendered preview handoff still pending.
round 4: responding to operator review: round4 adds a manual PR-preview workflow in the SAME PR, based on actual Spindle manual SHA/input semantics and site's root-relative asset paths. it is intentionally disabled by an invalid staging handle, with no credential or domain mutation. production publisher template remains separate because Spindle shares repository secrets with same-repo PR jobs. preview identity risk, subdomain availability/repeat mapping, hosted run and PR/SHA attestation are documented open; not claiming live previews or automatic production deployment.
round 5: round5 corrects the manual PR preview using Wisp's actual first-party preview mode (pr-<sha7>-<claim>.preview.wisp.place) and wispctl@2.0.2. replaces erroneous per-PR claim; keeps check/build and separate trusted production publisher in SAME PR. no credential/domain/deployment change; preview-only identity and hosted end-to-end test remain pending approval/verification.
round 7: source branch on Knot at 510fa854daccf1c39c602bb1bee5ed3b543bc51b; same PR, native Wisp --sha preview under the existing doshi claim using a newly approved CI app password. no production mapping change. hosted preview and root/asset verification pending; main-to-root automatic publishing remains separate work.