The Safe-Editing CMS lets a business change its own website (text, prices, photos, links) while the design stays locked. Every change is checked, versioned and previewed before it goes live. Since October 2026 it publishes a live client website, Pagosa Adventure Rentals.
Live client site Pagosa Adventure RentalsThe business
Static websites are the fastest and most secure thing a small business can run, but the moment the owner needs to change prices, hours, or photos, they're either waiting on a developer or handed a page builder with enough rope to break the layout. Traditional CMS platforms fix editing by putting back the database and the plugin surface the static site existed to avoid.
The real problem
Let a non-technical client edit their own content safely, without being able to break the design, take the site down, delete the wrong thing, or get the business hacked through a plugin. And let the operator hand a site over without becoming a permanent helpdesk for every text change.
My responsibility
The whole system: the editing model, the validation layer, the hosted editor, the publishing pipeline, backups and recovery, and the operational rules for running it on behalf of clients.
What was built
01
When a site is taken on, its layout (navigation, footer, branding, critical buttons) is frozen as structural 'chrome'. Only approved content slots (specific texts, images, links) are editable. A client can change the words; they cannot move, delete, or restyle the page.
02
A deterministic validation layer (not an AI, not a setting) is the only path a change can take. Edits that would inject scripts, empty out required text, or point links somewhere unsafe are rejected with a plain reason. The same rules apply to everyone, including the operator.
03
Owners click a sentence on their own page and type, or change a price in a field list. A short guided tour runs on first sign-in, plain answers cover common questions, and the editor works on a phone. Photos are checked and resized to fit before they upload.
04
Before publishing, the client gets a list of every change with a highlighted before and after on the page itself. If two people edit the same site, each field is protected so one person's change never silently overwrites the other's.
05
Clients sign in through a private link scoped to their own site. They can publish approved content changes to the hosting destination configured by the operator. They cannot access other sites or change that destination; published sites remain plain static files.
06
Every change is versioned, and a single page can be restored without touching the rest. Backups are integrity-checked bundles copied off the host, and recovery is tested by restoring them in isolation and matching every file, not assumed. An append-only audit history records what changed, when, and by whom.
System view
Through a private, site-scoped login: text, price, photo or link in an approved content slot, on desktop or phone.
Deterministic checks accept the change or reject it with a plain-language reason. Structure is untouchable either way.
The client sees every change as a before and after on the page, then publishes their own site; publishing exports the full site as static files.
The static build goes to the site's own hosting. The live site never depends on the CMS being up.
Inspectable proof
Sanitized artifacts show the underlying work without exposing client identities, credentials, private dashboards, or customer data.
A faithful reconstruction of the verified local editor state. Client identities, URLs, credentials, and production account details are excluded.
The actual editor on the live, named Alaska ATV Rentals site (shown with the client's written permission): locked structural chrome, editable content fields, a live preview, and saved version history, all real. The editable phone-number field and disabled AI-assistant input are redacted; the same approved public number remains visible in the locked site header, which clients cannot modify. No credentials or account identities are shown.
Checks recorded for the live release and the latest scheduled recovery copy.
Evidence
Pagosa Adventure Rentals' 14-page website was imported with 27 editable photo controls, and a publish through the client-level role deployed the live site. The CMS has been the site's content publisher since.
Live: in-place editing, the before/after publish review, protection for two people editing at once, photo fitting, phone editing, a guided first sign-in and single-page restore. Reviewed independently before release; 392 of 392 automated tests passed.
Live: a client's private link now always opens that client's own site, even when the browser is still signed in to another one. Two independent reviews passed; 408 of 408 automated tests passed.
Real client content was restored byte for byte in an isolated copy on October 6. Scheduled off-host copies were restored and every file checked against its manifest on October 8, 9 and 22, with the live content unchanged.
A second rental company's 10-page site was set up for the owner and staff to edit themselves and published to a private preview. The CMS render matched the source byte for byte on all 10 pages.
Production hardening, a full operator rehearsal, the hosted editor beta and a real-site pilot on a trilingual school website all completed and passed.
Client staff have started signing in through their private links. There is not yet enough editing history to describe client experience or reliability under sustained use.
A separate demo instance of the editor on a fictional business (Bright Bakery) was built and checked on July 4, 2026. Its public link stays paused until the sandbox runs the current release.
Results & current state
A real business publishes its live website through the CMS.
Pagosa Adventure Rentals, since October 7, 2026: a publish through the client-level role deployed the live site, and the CMS has stayed its content publisher.
Recovery is tested, not assumed.
Real client content restored byte for byte on October 6, 2026, and scheduled off-host copies restored and checked file by file on later dates, with live content unchanged.
The safety model holds under real content.
Structural chrome stays locked, forbidden edits are rejected with a plain reason, and exports contain no internal data (June 2026 real-site pilot).
Describe your setup in a few sentences. You'll get a plain answer about whether and how I can help.
