Request a governed autonomous publish

Ask for a draft to be published through the autonomy gate stack, as opposed to the direct POST /cms/posts/{id}/publish. Requires the write:content scope and a user-scoped credential — an organization-only key has no actor to stamp on the audit trail and gets a 422. Nothing is published inline: the route validates organization-scoped context and emits the same cms/autonomous-publish-requested event the in-app agent uses, so the existing trigger runs the policy dispatcher (action allowlist, site ownership, CMS feature, autonomy level, paused state, approval circuit-breaker, consent, quality verdict, feature flag and organization allowlist, then a credit reserve) inside its own step. With autonomy or its feature flag off — the steady state — the dispatcher denies and the draft is routed to the human review queue instead; that is still a 202, never a 500 and never an ungoverned publish. FraseCMS only: a site that publishes to a connected CMS (WordPress, Webflow) is refused with 409 destination_not_frase_cms, because every outcome this endpoint lets you observe is a FraseCMS one. A site sitting in Trash is refused with 409 site_deleted. A post with no linked content row is a 422 — use the direct publish endpoint for it. Because the response is 202 and asynchronous, subscribe to the cms.post.published and cms.post.review_requested webhooks to learn the outcome. Idempotency is surface- and draft-scoped: the request is keyed on the post's content id, the api surface, and a digest of the draft body (returned as draft_revision). Re-requesting the same unchanged draft within 24 hours is deduplicated and does not run again; editing the draft produces a new revision and is evaluated afresh. An API request is never suppressed by a prior in-app agent request. A draft already waiting in the review queue is re-evaluated but denied pending_review — approve or reject it there.