Fermium vs. building it yourself
You may already be doing this the hard way.
This is a real setup we found at a mid-size company for publishing the quarterly engineering roadmap to staff. It works. It also has five moving parts, and every one of them is a way for the wrong person to see the page or the right person to deploy the wrong thing.
| Step | The hard way | Fermium |
|---|---|---|
| Where the page lives | A GitHub repo with public/index.html as the source of truth | A document with a stable URL; every update is a version |
| How it is served | An assets-only Worker, one per site, configured in wrangler.jsonc | Served for you from a sandboxed content domain, or from your own hostname |
| Who can open it | A Cloudflare Access policy that exists only in the dashboard; invisible in the repo | Restricted access with a whole-workspace grant, set on the document itself and visible in the app and API |
| How it gets updated | Agent edits HTML, human previews locally, human runs wrangler deploy from a laptop | Agent calls update_html; the link is already current. Lock it while editing if you like |
| Credentials | A per-directory API token in a keychain; deploying without direnv uses the wrong identity | OAuth in the browser once per client; short-lived tokens; nothing pasted into a chat |
| Meeting notes and transcripts | Copied from an Obsidian vault into the repo by hand | publish_markdown from the agent, or sync a folder and it is already there |
| Rollback | git revert, then redeploy | Restore a version from the history tab |
| Second site | Repeat everything above | Publish another document |
The same update, twice
Publishing a new roadmap version each way.
The hard way
git pull
# paste transcript, let the agent
# update the vault
# agent rewrites public/index.html
# and public/meetings/*
npx wrangler dev --local # check it
direnv exec . npx wrangler deploy
# check the Access policy is still
# right, in the dashboardFermium
> Publish the updated roadmap to the
> same link. Restricted, shared with
> the whole workspace.
publish_html / update_html
→ https://docs.acme.com/d/xBVN…/
access: restricted + whole workspace
version 14One tool call publishes the update. The link, access, and history stay with the document.