Scheduled automation

Pre-approved scope only

Scheduled Headless jobs may Sync or prepare Publish work only after one-time interactive setup by the owner or an approved managed test-account operator. Do not inject account credentials into CI or scheduler commands.

Prerequisites

• Node.js 22+ runner and fixed obsidian-headless installation policy.
• Approved account alias, entitlement, vault/site, local path, include set, schedule, and cost scope.
• Interactive setup completed outside CI with credential-bearing options omitted.
• Recoverable backup, least-privilege OS identity, bounded redacted logs, and a stop/disable procedure.
• Named execution, review, evidence, and rollback owners.

Scheduled Sync

A scheduled job may execute only the previously approved mapping and mode. It must record start/end status and trigger second-device canary readback plus conflict/deletion checks. Continuous Sync requires a supervisor and restart limits. ob sync-status alone is not convergence proof.

Scheduled Publish

1. Bind the exact immutable source commit/hash and approved include set.
2. Run ob publish --dry-run and preserve the reviewable output.
3. Stop for an approval receipt that names the exact site and scope.
4. Publish only within that scope. Broad all-file behavior and confirmation suppression remain blocked unless separately named.
5. Read back the public URL and expected content/hashes.

Failure handling

On identity, entitlement, scope, conflict, deletion, unexpected-file, or public-readback drift: stop the schedule, preserve logs and provider status without secrets, restore the prior approved source under the rollback plan, and require a fresh review.

Sources: Obsidian Headless, Headless Sync, and Headless Publish, retrieved 2026-08-29 EDT.