Two Secrets
Headless publishing still uses two passphrases: the Shell passphrase opens the encrypted .postsnail file, and the identity passphrase unlocks the encrypted signing key used for build and zip.
Editable Source
The .postsnail Shell remains the private editable source. Scripts and agents should treat it like source code plus secrets, not like a public deploy artifact.
Public Output
The public Website ZIP or extracted public directory is the hosting artifact. It can be uploaded, verified, mirrored, or deployed, but it is not the full private project.
Trusted Local Automation
Use the CLI only in environments you trust locally. It should help humans or agents automate repetitive publish work without moving private key material into a backend or CI by default.
Verify First
Build, then verify the public directory or ZIP before any deploy step. If verification fails, fix the Shell or content source before publishing.
Current Commands
The CLI includes menu, workspace, profile, identity, plugin, post, page, asset, comment, build, zip, verify, live verify, publish surge, forest announce, shellname, and domain move/mirror commands.