Headline

The written pipeline and the five delivery gates now agree. In v2.2.0 the documented /blog write path could not pass Gate 4: nothing issued the review nonce and nobody saved review.md. v2.3.0 ships one canonical delivery sequence, gates that check what the contract says they check, installers that never overwrite your files, and CI that actually runs the browser tests.

Upgrade notes (read first)

• Install from the new release, not the v2.2.0 tag. The v2.2.0 installer predates the ownership protections; the README explains the safe path.
• Existing installs: the installer refuses to overwrite files it does not own and tells you what to do. --force-adopt (-ForceAdopt on Windows) adopts them after saving a timestamped backup under ~/.claude/claude-blog-backups/.
• Stricter gates. A draft that passed Gate 2 to 5 before can fail now. Each failure names the fix. New checks: stale review (the review must match the exact files delivered), leftover placeholders, hand-edited HTML, hidden text, active content, and basic HTML structure (language, title, one H1, heading order, og tags, image alt text).
• File names. Outputs are named from frontmatter slug, else the markdown file name. If slug differs from the file name you get a warning with the exact rename.
• Consent gates. Image, audio, NotebookLM, Google and taxonomy skills now ask before spending money or writing to a CMS.
• Audio. flash38 (Gemini 3.8 TTS) is the default, --max-chunks caps a run at 12 chunks, legacy aliases still work with a deprecation warning.
• Hero images. Default model is gemini-nano-banana-2.1; the fallback ladder now stops on key, billing or quota errors instead of retrying every model.
• Scoring. A draft with more than 20 of 100 points marked N/A is BLOCKING ("too little draft evidence").

What is new and fixed

Delivery pipeline

• One canonical sequence in skills/blog/references/blog-delivery-contract.md: draft, resolve markers and visuals, render, issue the nonce, review (saved verbatim), strict gates, and re-render plus re-review after any edit.
• The documented minimal frontmatter now works, with a required-keys table. lastUpdated renders as JSON-LD dateModified and a visible "Updated" line.
• The renderer embeds source and body hashes so hand-edited HTML is caught, ships responsive SVG and table CSS, and accepts a UTF-8 BOM.
• Gate 3 checks hidden text and blocks WebSockets and service workers; Gate 4 rejects stale reviews, plural "P0s" and inconsistent category scores; Gate 5 no longer fetches the renderer's own footer link, so a fully local article passes offline.

Security

• Google API keys no longer leak into URLs or error text (PSI and CrUX); keys travel in the x-goog-api-key header and are redacted everywhere.
• SSRF checks use is_global semantics and cover NAT64, 6to4 and site-local addresses; the NLP, YouTube and Search Console scripts got deadlines and quota stops.
• NotebookLM: both Google hosts accepted by exact hostname, state stored 0700/0600, downloads off, answers marked answer_trust: untrusted_notebook_content.
• install.sh validates CLAUDE_BLOG_REPO, CLAUDE_BLOG_REF and CLAUDE_BLOG_URL before git runs.
• Fixed the installer, renderer and hero script for systems where /home is a root-owned alias (Aurora, Silverblue); user-created symlinks are still refused.

Reliability

• Google scripts report an API that is not enabled (accessNotConfigured) instead of a misleading permission error (issue #65).
• Indexing batches stop on quota and need --confirm-eligible.
• quality_gate.py fails closed; the FLOW sync compares upstream bodies; the analyzer uses bounded regexes.

Content

• Stale Google and SEO facts refreshed, unsourced statistics removed, phantom command flags deleted, counts corrected.
• The bundled Brain was re-reviewed on 2026-10-12 against live sources: 83 records (73 confirmed, 7 qualified, 3 corrected). Audit 98/100.

CI and packaging

• CI installs Chromium and fails, not skips, the browser tests; installs all four hash locks on Linux, Windows and macOS; runs Python 3.11 to 3.14; checks uv lock.
• The plugin identifier stays claude-blog. Claude Code 2.1.292 and later flags the claude- prefix as reserved in claude plugin validate; CI tolerates exactly that finding.

Thanks

Contributors credited in docs/CONTRIBUTORS.md: andrewtpham (#83, recursive --batch), joachimBrindeau (#82, hero ladder and non-PNG hero rendering), imong8 (#73, Indonesian profile), Hi-2025-Be (#90, originality floor), and yupeni for reporting #65.

Known limits

• The review nonce stops accidents and casual forgery; a process running as the same user can read the verifier state.
• Redirect targets are validated but not followed, so a redirect to a dead page passes Gate 5.
• Not exercised: live model runs (reviewer agent, image generation), authenticated Google APIs, the NotebookLM browser flow, real Windows junctions.
• The optional image MCP package still exposes retired model names; use the direct API route (the default).
• Image filenames with capitals or underscores are rejected, which can hit existing posts in rewrites.
• A known, unpatched NLTK model-artifact advisory (PYSEC-2026-3740) affects the root dependency lock. The repository's code never imports NLTK; it arrives as a transitive dependency of textstat. No advisory-free claim is made.
• The Brain needs a repeat review by 2026-11-12, or its audit goes stale on 2026-11-13.

Verification

• 1531 tests pass locally (3 environment skips); 1527 on each of Python 3.11, 3.12, 3.13 and 3.14 from a clean export; 182 Brain tests.
• GitHub Actions on PR #91: all 33 checks passed on the public repository, including Python 3.11, 3.12, 3.13 and 3.14, macOS and Windows installers (Windows PowerShell 5.1 and 7), both plugin validators (2.1.218 and 2.1.292), Brain, hash-locked installs on three operating systems, uv lock --check and version coherence. Re-confirm on the merge commit before tagging.
• A golden article passes all five strict gates; a 59-scenario mutation sweep blocks 56 (the others are the control, a by-design warning and the documented same-user limit).