Starter context items never reach editors: they install as drafts and editorial roles lack 'Use Published AI Context in AI Features'

Problem/Motivation

The recipe says every Varbase AI agent gets brand, editorial and safety context out of the box. Editors get none.

• Starter items install as drafts. The three items in content/ai_context_item/ (Varbase Brand & Identity Guidelines, Varbase AI Editorial Rules, Varbase AI Safety Guardrails) ship status: true but no moderation_state. Context Control Center puts items under the ai_context_editorial workflow, whose default state is draft, so every revision is created as draft with status = 0. Selection only uses published items, so none reach any AI feature until someone publishes them by hand.
• Editorial roles cannot use published context. AiContextSelector access-checks every item against the current user, and a published item is viewable only with "View AI Context Items in CCC" or "Use Published AI Context in AI Features". Varbase grants neither to Site Admin, SEO Admin, Content Admin or Content editor, so selection returns nothing for them, in agents and every other consumer, while administrators get context.
• The README lists Image Alt as a consumer, but it is not wired. AI Image Alt Text 1.0.2 calls the provider's chat() directly, outside the agent pipeline, so no context reaches alt text. That needs a change in AI Image Alt Text (see #3584838 and #3583859) and is out of scope here.

Checked on Varbase 11 with Context Control Center 1.0.0-beta4 and Varbase AI Context 1.0.0-rc1. The 1.0.x branch and the 1.0.0 tag have the same code.

Steps to reproduce

1. Apply the Varbase AI Context recipe on a Varbase 11 site.
2. Go to Administration > AI > Context > Context items: the three starter items show as Draft.
3. Publish one. As a user with only the Content editor role, run a context-aware AI feature (for example an AI agent): no context is injected. As an administrator, the same item is injected.

Setting a published item back to Draft only adds a pending draft; the published revision stays live.

Proposed resolution

• Ship the starter items published, for example with moderation_state: published in each content YAML or a recipe step that publishes them. Needs a check that the core default content importer honours moderation_state on these entities.
• Grant access published ai context to site_admin, seo_admin, content_admin and content_editor with grantPermissions config actions, as Varbase AI Image Alt and Varbase AI Editor Assistant already do. These roles come from Varbase Users Base, which this recipe does not require yet: require it or guard the actions.
• README: drop Image Alt from the consumer list, or say it needs the AI Image Alt Text change.

Remaining tasks

• ✅ File an issue
• ❌ Addition/Change/Update/Fix
  • ❌ Publish the starter items on apply
  • ❌ Grant the permission to the editorial roles
  • ❌ Correct the README consumer list
• ❌ Testing to ensure no regression
• ➖ Automated unit/functional testing coverage
• ❌ Developer Documentation support
• ➖ User Guide Documentation support
• ➖ UX/UI designer responsibilities
• ➖ Accessibility and Readability
• ❌ Reviewed by a human
• ❌ Code review by maintainers
• ❌ Full testing and approval
• ❌ Credit contributors
• ❌ Review with the product owner
• ✅ Update Release Notes
• ✅ Release Varbase AI Context 1.0.1

User interface changes

• N/A

API changes

• N/A

Data model changes

• N/A

Release notes snippet

• The starter context items are published on install and Varbase editorial roles can now use published AI context, so brand, editorial and safety context reaches AI features for editors, not only administrators.

AI-Generated: Yes