Skip to content

STAGING: qualify extracted Poly SSG history, replace unsafe workflows and prove BoJ parity #2

New issue
New issue
Open
Open
STAGING: qualify extracted Poly SSG history, replace unsafe workflows and prove BoJ parity#2
Labels
analysischorecicddifficulty:hardhygienepriority:p2scope:repo

Description

@hyperpolymath
hyperpolymath
opened on Nov 3, 2026

Status

This is a private preservation staging repository, NOT an approved replacement for Polystack and NOT a production-ready SSG framework.

The poly-ssg subtree from hyperpolymath/polystack at e1af43bb102106b08cb694402bd1c04b96f1677c was history-extracted (using git subtree split --prefix=poly-ssg under Debian WSL) and imported here at 9302dfcc3aedb7c52edf2867a2fcbf2c735878b4.

GitHub Actions were explicitly disabled on this new staging repository before import to avoid running legacy workflows. They must be deliberately reviewed and re-enabled with real gating before any software release or merger is called complete. Do not quietly leave them disabled on a claimed production repository.

See Polystack preservation blocker #30 and draft inventory PR #31.

Qualification checklist

  • Verify imported Git subtree lineage and compare byte-identical files/tree at frozen source SHA; record case-colliding paths on Windows.
  • Inspect all .github/workflows/ and update to estate-supported, SHA-pinned and actively executed CI gates, checking both positive and negative controls.
  • Inventory root framework code vs embedded satellite copies; isolate sources already in ssg-collection and separate independently maintained engines.
  • Inspect manifests and test corpus; demonstrate one valid source → HTML build using a pinned toolchain, and negative cases, including output correctness.
  • Separate mcp/ and lsp/ migration with explicit upstream contracts; BoJ's ssg-mcp forwards to an external backend (default 127.0.0.1:7742) and its ssg-lsp is still scaffolded.
  • Audit site-building scripts, DNS templates, network/deployment behaviour and outdated cryptography/compliance claims; do not run deployment automatically.
  • Document licenses for embedded engines and origin histories; preserve Git attribution and do not move external source into stuff-of-awe/awesome-ssgs (which is a curation list).
  • Re-enable CI in this new repository once controls are correct and ensure reviews, CodeRabbit/other app feedback, and all required checks pass on the latest SHA.
  • Confirm a release/status decision and public visibility as a separate explicit step; do not automatically mark Polystack's preservation blocker complete.

Disposition

Keeping Polystack available until proven parity is an intentional dependency gate. This repository is a durable source-preservation milestone, not evidence that any SSG or BoJ integration works.

Activity

  1. coderabbitai
    added
    analysis
    difficulty:hard
    scope:repo
    cicd
    hygiene
    chore
    priority:p2
    on Nov 3, 2026

  2. hyperpolymath commented on Nov 3, 2026

    @hyperpolymath
    hyperpolymath
    on Nov 3, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    Verified source-preservation receipt (2026-11-03): git subtree split --prefix=poly-ssg produced extracted commit 9302dfcc3aedb7c52edf2867a2fcbf2c735878b4 from Polystack e1af43bb102106b08cb694402bd1c04b96f1677c. Independent Git object checks match exactly:

    Polystack main:poly-ssg tree    6a8aa93222c8261c3e81b37acd7d1bd59f42bdc4
Extracted commit^{tree}       6a8aa93222c8261c3e81b37acd7d1bd59f42bdc4
GitHub imported commit tree   6a8aa93222c8261c3e81b37acd7d1bd59f42bdc4

    The private staging repo is hyperpolymath/poly-ssg; Actions remain disabled there only, as verified through its Actions permissions API. Windows checkout warned about the case-colliding rats-ssg/{Justfile,justfile}; Git trees (rather than worktree copies) were used for equality.

    This closes only the byte-for-byte Git-source preservation subtask. No build, runtime, CI, deploy or BoJ consumer parity has been qualified. See staging issue #2, staging docs PR #3, Polystack preservation PR #31, and BoJ issue #165.

  3. hyperpolymath commented on Nov 3, 2026

    @hyperpolymath
    hyperpolymath
    on Nov 3, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    Legacy MCP interface inspection: mcp/server.js and mcp/index.js contain a 28-adapter SSG MCP server with generator-specific tools and an ssg_list/ssg_detect discovery surface. This is materially different from BoJ ssg-mcp's five coarse operations forwarded to a separate HTTP backend. The legacy Deno server entry point requests broad allow-run, allow-read, allow-write, allow-env and allow-net privileges; do not launch or expose it unchanged as BoJ's backend. Scope executables, input/output directories, environment and network permissions first; separate preview/deploy authorization. mcp/PROVEN-INTEGRATION.adoc is an unchecked plan, not evidence of SafeTree/SafeSchema/SafeGraph integrations. Record this as implementation/security debt before any runtime parity claim.

  4. hyperpolymath
    added a commit that references this issue on Nov 5, 2026

    fix(preservation): qualify the imported source and retire obsolete ef…

    ddb786b
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    analysischorecicddifficulty:hardhygienepriority:p2scope:repo

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions