The shape of it
One Payload CMS, one media bucket, one Astro frontend, and many school sites rendering from them. Each school keeps its own repository for reviewed content and its own auto-deploy, so one school’s changes can never touch another’s site.
Onboarding is a command
Adding a school to the platform runs as a single operation that provisions the repository, pulls and reviews the content, and sets up the deploy, ending at a live preview URL with the remaining manual steps listed explicitly.
Every step stops once for human review before anything is uploaded. Automation that publishes a client’s site without a pause is a liability, not a feature.
The guard
No secrets and no school content are ever committed to the platform repository. That is enforced twice: as a pre-commit hook on the operator’s machine so a mistake never reaches GitHub, and again in CI so the rule holds for every clone and every contributor.