Publishing Studio — Improvement & Growth Plan

Package: capell-app/publishing-studio · Kind: package · Tier: premium · Product group: Capell Publishing Pro · Bundle: publishing-pro · Status: Complete

1. Snapshot

Publishing Studio is Capell’s flagship editorial-workflow package: copy-on-write workspaces (drafts) over any registered Draftable model, atomic versioned publish, rebase/stale-detection, rollback + entity restore, signed live preview links, an approval chain, a durable scheduler (publish / unpublish / embargo / review-reminder events), an editorial calendar that aggregates contributors (Blog, Campaign Studio, Newsletter, Events), and four admin pages (Workflow command centre, Activity trail, Scheduled publishing, Stale drafts) plus two Filament resources (WorkspaceResource, PreviewLinkResource) and several dashboard widgets/Livewire panels. It is large and mature: 242 src/ PHP files, 132 test files, surfaces ["admin","console"]. Core engine lives in root-namespaced classes (Publisher, Rebaser, Rollback, ReleaseWindowGuard) plus ~45 Actions; data models are Workspace, Version, PublishingRevision, PreviewLink, SchedulerEvent, SchedulerDelivery, SchedulerIcalToken, WorkspaceApproval, WorkspaceFieldComment, WorkspaceReviewAssignment over 12 migrations (workspaces, versions, preview_links, publishing_revisions, publishing_scheduler_events, approvals/comments/assignments, plus workspace_id/shadowed_by_workspace_id columns added to core + external tables). Dependencies: capell-app/{admin,core,html-cache,migration-assistant,navigation} + jfcherng/php-diff. Marketplace summary now leads with the review-first CMS value proposition, and the manifest declares the extension card plus populated editor/reviewer workflow captures. Empty workflow, preview-link, scheduled-publishing, and stale-draft captures were demoted until seeded recapture.

2. Improvements (existing functionality)

Prioritized.

• Closed 2026-06-05: Co-locate publish-check + release-window config defaults inside the package. — Shipped config/publishing-studio.php, merged it as capell.publishing-studio, published it for console installs, and included default publish checks, release-window settings, scheduled publishing, prune schedule, and preview home-route config. — config/publishing-studio.php, src/Providers/PublishingStudioServiceProvider.php — M
• Done/Shipped: Make the manifest health check actually verify something. PublishingStudioHealthCheck now reports real diagnostics for required workflow/revision/scheduler tables and configured publish-readiness checks, with focused health coverage. — src/Health/PublishingStudioHealthCheck.php, tests/Feature/Health/PublishingStudioHealthCheckTest.php — M
• Closed 2026-06-05: Fix the load-testing capability so it works on a real install. LoadTestPublishingStudioCommand now resolves a package-owned fixture model from src/Support/LoadTesting, so the advertised command no longer depends on tests/ autoload. — src/Console/Commands/LoadTestPublishingStudioCommand.php, src/Support/LoadTesting/WorkspaceDraftableFixture.php — S
• Done/Shipped: broken-links is clarified as internal link integrity. The legacy identifier remains broken-links for config compatibility, but the surfaced label and messages now say “Internal link integrity” and explicitly validate only internal Capell URLs against page_urls; external URLs are ignored until a future opt-in HTTP probe exists. — src/Checks/BrokenLinkCheck.php, resources/lang/en/workspace.php, tests/Integration/Checks/IndividualChecksTest.php — M
• Done/Shipped: legacy scheduled-publish job is a durable scheduler shim. PublishScheduledPublishingStudioJob no longer runs a separate Workspace scan-and-publish loop. It delegates to RunDueSchedulerEventsAction::run(includePublish: true), so publish, unpublish, and reminder execution all flow through claimed SchedulerEvent rows and ExecuteSchedulerEventAction. — src/PublishScheduledPublishingStudioJob.php, src/SchedulePublishAction.php, tests/Integration/PublishScheduledPublishingStudioJobTest.php — M
• Done/Shipped: central publish-readiness data boundary. BuildPublishReadinessAction returns PublishReadinessData from the dry-run report, URL collisions, stale conflicts, and publish-check failures. ValidateAction now consumes that typed boundary instead of interpreting DryRunReport directly, and dry runs can respect release-window bypasses for authorized callers. — src/Actions/BuildPublishReadinessAction.php, src/Data/PublishReadinessData.php, src/Publisher.php, src/Filament/Resources/PublishingStudio/Actions/ValidateAction.php, tests/Integration/PublisherDryRunTest.php — M
• Closed 2026-06-05: Populate the CHANGELOG. The changelog now records marketplace value-copy/media expansion, real health diagnostics, manifest settings/table reconciliation, and the production-autoloadable load-test fixture. — CHANGELOG.md — S

3. Missing Features (gaps)

Tied to capabilities[] and editorial-workflow norms.

• Field-level merge / three-way diff resolution (differentiator). Rebaser surfaces conflicting uuids and supports only coarse keep-mine / take-live per record; there is no field-level merge when two editors touch different fields of the same record. Statamic/Sanity-class tools resolve at field granularity. This is the single biggest differentiator available given the diff infrastructure (WorkspaceDiffService, jfcherng/php-diff) already exists. — src/Rebaser.php, src/Services/WorkspaceDiffService.php
• Scheduled-content calendar drag-to-reschedule (table stakes for “editorial calendar”). The calendar (ContentSchedulerCalendarWidget, BuildEditorialCalendarEventsAction) aggregates and displays events but reschedule still goes through SchedulerMetadataAction forms. Inline drag-reschedule is expected of an editorial calendar.
• Approval workflow configurability beyond numeric levels. Workspace::approve() uses settings.requiredApprovalLevels (default 2) — purely a count. Norms include named stages, per-role required approvers, and per-content-type policies. ReviewPolicyResolver/RequiredReviewer exist but the public surface is a bare integer. — src/Models/Workspace.php, src/Approvals/ReviewPolicyResolver.php
• Multi-site / cross-site coordinated publish. Release Workspaces group content for one atomic publish, but siteId() derivation in SyncWorkspaceSchedulerEventsAction picks the first page’s site; there is no first-class “publish this release to sites A+B” concept. Given Capell is multi-site, this is a notable gap. — src/Actions/SyncWorkspaceSchedulerEventsAction.php
• Notifications breadth. Only WorkspaceStateNotification and WorkspaceReviewReminderNotification exist. Editorial teams expect Slack/Teams/webhook fan-out and digest summaries (“3 drafts awaiting your approval”). Could cross-sell into a notifications/automation package.
• Embargo on the public read path. embargo_until blocks publish, but there is no evidence of a public-render guard that hides embargoed-but-scheduled content if a stale cache or preview leaks it. Worth an explicit anonymous-safety test asserting embargoed content never renders to guests.
• Diff/restore for media and layout blocks. MediaDiffService exists, but entity restore (Rollback/EntityRollbackAction) is row-oriented; granular per-asset restore and layout-block-level rollback would round out entity-restore.

4. Issues / Risks

• Closed 2026-06-05: Publish checks may be silently no-op (highest risk). Default config now resolves to the shipped publish checks, and PublishCheckPipelineTest asserts the configured defaults are non-empty, implement PublishCheck, resolve through the container, and return pipeline results. — src/Checks/PublishCheckPipeline.php, tests/Integration/PublishCheckPipelineTest.php
• Closed 2026-06-05: Manifest ↔ code drift. capell.json now declares PublishingStudioSettings, database.settings: true, the package-owned storage table set, the extension card, desktop/mobile hero images, and runner-backed workflow captures. load-testing now resolves a production-autoloadable fixture model. — capell.json, src/Settings/PublishingStudioSettings.php, docs/screenshots.json, src/Support/LoadTesting/WorkspaceDraftableFixture.php
• Done/Shipped: admin query budget is asserted for dashboard and calendar Actions. AdminQueryBudgetTest reads performance.adminQueryBudget from capell.json and profiles the workflow command center, site stats, workspace activity, merge history, scheduler event builder, and editorial calendar builder against the 40-query ceiling. — capell.json, tests/Feature/Performance/AdminQueryBudgetTest.php
• frontendRenderBudgetMs: 0 vs a real frontend surface. The package does serve frontend HTTP (signed preview render path through ResolveWorkspaceContext, plus the exit-preview route), yet surfaces omits "frontend" and the render budget is 0. Preview rendering disables cache (config(['capell-core.disable_cache' => true])) so it is inherently slower than a cached page; document/measure the preview render path rather than declaring 0. — capell.json, src/Http/Middleware/ResolveWorkspaceContext.php
• Concurrency: strong, keep it tested. Publisher row-locks the live Version and re-checks for a shifted live id (throws StaleWorkspaceException); ExecuteSchedulerEventAction claims events via lockForUpdate + a 15-minute stale-claim reclaim; SQLite path is documented as serialised. PublisherConcurrencyTest, PublisherEmbargoTest, PublisherReleaseWindowTest, PublishScheduledPublishingStudioJobTest cover this. Risk is low — preserve these tests on any scheduler refactor.
• Closed 2026-06-05: Public-output safety explicit coverage. Preview is signed (URL::temporarySignedRoute) with a DB-backed revocable token as the authoritative key, signed cms_workspace cookie (hash_equals), userMayResolve() re-checks view policy so revoked users lose context, and workspace responses set Cache-Control: private, no-store. The live frontend test now proves an anonymous request to the live URL keeps rendering published copy while hiding embargoed draft copy, workspace names, preview markers, workspace cookies, and preview-only private/no-store headers. — src/Http/Middleware/ResolveWorkspaceContext.php, src/Actions/GenerateWorkspacePreviewUrlAction.php, src/Http/Controllers/SchedulerIcalFeedController.php, tests/Feature/Page/PageWorkspaceDraftTest.php
• Scheduler siteId heuristic. SyncWorkspaceSchedulerEventsAction::siteId() takes the first workspace-scoped page’s site_id; for a multi-site release workspace this is ambiguous and can misattribute calendar/feed scoping. — src/Actions/SyncWorkspaceSchedulerEventsAction.php
• i18n. Labels are translation-key driven (capell-publishing-studio::*) — good. Confirm scheduler/notification human strings and exception messages (several are hard-coded English in Publisher/Rebaser, e.g. “Workspace #%d must be approved…”) are acceptable as developer-facing only, not user-facing. — src/Publisher.php, src/Rebaser.php
• Test-coverage gaps. Config-default publish-check resolution, embargo/live-path safety, and LoadTestPublishingStudioCommand production-style autoload coverage are now present. Multi-site release scoping remains the notable missing dedicated test. Coverage is otherwise broad.

5. Marketplace & Selling

Critique. The current summary and composer description are accurate but read as a feature list, not a value proposition — they enumerate verbs (preview/compare/approve/schedule/publish/restore/rollback) without naming the pain (publishing directly to live, no review trail, no safe rollback). The composer description (“Editorial workflow package for Capell revisions, scheduling, approvals, and controlled publishing”) is serviceable but generic.

Improved 1-sentence summary.

Publishing Studio turns Capell into a review-first CMS: edit any content in an isolated draft workspace, get sign-off, schedule it, and publish atomically — with one-click rollback when something breaks.

Improved 3–4 sentence description.

Publishing Studio is Capell’s premium editorial workflow. Every change happens in a copy-on-write workspace that stays invisible to visitors until it’s approved and published as a single atomic, versioned release — so the live site is never half-edited. Built-in publish-readiness checks (accessibility, SEO meta, alt text, internal links, URL collisions, stale-draft and release-window guards) stop risky publishes before they ship, while signed, revocable preview links let stakeholders review the exact pending state. When a publish goes wrong, roll back to any prior version or restore individual entities in seconds.

Screenshot / media status. The manifest now exposes the extension card plus the populated editor/reviewer workflow captures. Empty workflow dashboard, preview-link, scheduled-publishing, and stale-draft captures were demoted. The contract still asks for additional route/admin captures for live preview, compare/readiness, approval history, scheduler metadata, activity history, rollback/restore, and preview banner states; a 20-30s capture of the draft-to-approve-to-schedule-to-publish-to-rollback loop would still strengthen the listing.

Pricing / tier / bundle positioning. Correctly premium in the publishing-pro bundle — this is anchor-tenant functionality, not an add-on. Position it as the headline of the Publishing Pro bundle. Natural cross-sell follows the dependency + supports graph: migration-assistant (recovery/import into workspaces), html-cache (publish-time invalidation), and the soft contributors — blog, campaign-studio, newsletter, events — which feed the editorial calendar. Bundle messaging: “buy Publishing Pro, get a governed editorial calendar across every content type you publish.”

Differentiators / value props / target buyer. Differentiators: atomic multi-model release workspaces, durable scheduler with embargo + release windows, signed revocable previews, and true version rollback + entity restore — capabilities usually reserved for Statamic/Sanity/Contentful-tier products. Target buyer: agencies and in-house teams running multi-author, compliance-sensitive, or brand-controlled sites where publishing directly to production is unacceptable.

Keywords/tags (8–12). editorial-workflow, content-approval, draft-publishing, scheduled-publishing, content-versioning, rollback, live-preview, release-windows, publish-readiness, editorial-calendar, content-governance, workspaces.

6. Prioritized Roadmap

Item	Bucket	Effort	Impact	Section ref
Ship package config with publish-check + release-window defaults (mergeConfigFrom)	Done	M	High	§2, §4
Test asserting default config resolves ≥1 publish check (guard against silent no-op)	Done	S	High	§4
Done/Shipped: Reconcile manifest with code: declares settings, package-owned storage tables, expanded screenshots[], and production-autoloadable load-testing fixture	Done	S	High	§4
Done/Shipped: Anonymous-safety test proves guests never see workspace markers or embargoed content on live path	Done	S	High	§4
Done/Shipped: Populate CHANGELOG with real release history	Done	S	Med	§2
Done/Shipped: Give the manifest health check real assertions (tables and checks resolvable)	Done	M	Med	§2
Done/Shipped: Fix load-test fixture to a production-autoloadable model	Done	S	Med	§2, §4
Consolidate legacy publish job onto durable scheduler events	Done	M	Med	§2 — closed 2026-06-08: PublishScheduledPublishingStudioJob delegates to RunDueSchedulerEventsAction::run(includePublish: true), so scheduled publishing now uses durable claimed scheduler events.
Central BuildPublishReadinessAction returning typed Data	Done	M	Med	§2 — closed 2026-06-08: BuildPublishReadinessAction returns PublishReadinessData, and ValidateAction consumes it for failure/warning/success notifications.
Clarify/extend broken-links (rename or add opt-in external probe)	Done	M	Med	§2, §3 — closed 2026-06-08: surfaced copy now says “Internal link integrity”; the legacy broken-links identifier remains for config compatibility, and external URLs are explicitly ignored.
Profile dashboard/calendar Actions against adminQueryBudget: 40; assert query ceiling in tests	Done	M	Med	§4 — closed 2026-06-08: AdminQueryBudgetTest profiles workflow, dashboard, scheduler, and editorial-calendar Actions against the manifest budget.
Recapture populated Publishing Studio workflow, preview-link, scheduled-publishing, and stale-draft screenshots before promoting them as product media	Later	S	Med	§5 — media-only follow-up; implementation scope is complete and promoted screenshots should wait for populated runner captures.
Field-level three-way merge in Rebaser (flagship differentiator)	Later	L	High	§3
Configurable named approval stages / per-role required approvers	Later	L	Med	§3
First-class multi-site coordinated release publish + correct calendar site scoping	Later	L	Med	§3, §4
Calendar drag-to-reschedule + Slack/webhook + digest notifications	Later	L	Med	§3
Granular media/layout-block restore	Later	L	Low	§3