YGIT

YGIT is an open-source deployment automation platform by Vib Tools.

YGIT helps users deploy supported Git repositories to their own Cloudflare Pages accounts while keeping ownership of the repository, Cloudflare account, domain, code, and infrastructure.

YGIT is not a website builder, hosting company, CMS, or general-purpose control panel.

Core Flow

Paste Repository
        ↓
Analyze Repository
        ↓
Connect Accounts
        ↓
Deploy
        ↓
Website Live

Current Development Status

Status: Update 01 implementation verified; Draft PR documentation gate ready

The MVP architecture and core engines are substantially implemented. Update 01 now provides installation-authenticated GitHub repository acquisition, exact commit pinning, a complete recursive tree snapshot, bounded analysis-critical text input, and Repository Analysis handoff. The default server policy remains disabled; no Cloudflare provider execution was enabled by Update 01.

Engineering estimate:

MVP implementation: approximately 97%
First controlled live deployment path: approximately 98%
Production readiness: not yet reached

These percentages are planning estimates, not release-gate results.

See PROJECT_STATUS.md for the authoritative engineering snapshot.

Architecture

Presentation Layer
        ↓
API Layer
        ↓
Engine Layer
        ↓
Provider Layer
        ↓
Infrastructure

The Dashboard and Admin Panel are clients/surfaces. Business logic remains inside engines and pipelines.

GitHub Integration Architecture Lock

User authentication: Vib ID / Keycloak OIDC
GitHub repository integration: GitHub App
Cloudflare account connection: Cloudflare OAuth

GitHub OAuth client credentials are not part of YGIT. The GitHub App webhook capability is separately controlled and remains default-disabled until an approved receiver exists. The authoritative contract is GITHUB_APP_INTEGRATION.md.

Technology

Backend: Python, FastAPI
Authentication: Keycloak / OIDC
Database: PostgreSQL
Queue/runtime coordination: Redis + Worker Runtime
Source control integration: GitHub App
Deployment provider: Cloudflare Pages
Object storage target: Cloudflare R2

Core Engine Status

Engine or component	Current state
Auth Engine	Implemented with OIDC/session boundaries
Connected Accounts Module	Implemented with GitHub/Cloudflare connection state, credential references, credential acquisition boundary, metadata UI, scopes, last-sync data, and disconnect/reconnect flows
Project Engine	Implemented
Repository Engine	GitHub App installation-authenticated metadata acquisition, exact commit pinning, complete recursive tree snapshot, bounded analysis-text collection, and analyzer-input preparation implemented; AG-002 remains standalone and not runtime-wired
Repository Analysis Engine	Quick Analysis receives a complete commit-pinned snapshot and bounded text evidence; stronger detection, deep worker completion, and recalculation reattachment remain Update 02 work
Deploy Engine	Implemented for validation, queued deployment lifecycle, redeploy, cancel, and reads
Deploy Pipeline	Contracts, build stage, Cloudflare operation plan, concrete Cloudflare Pages gateway, completion result branch, and isolated provider pipeline factory implemented
Deployment History Engine	Pipeline completion/failure persistence, retry-safe intent consumption, logs, and provider-result storage integrated through the public engine boundary
Worker Runtime	Durable jobs, leasing, retry, DB-aware dispatch, checkout/build handoff, credential boundary, provider pipeline binding, trusted server-owned policy resolution, dispatcher handoff, and default-disabled deploy/redeploy integration implemented
Domain Engine	Generated YGIT URL and slug lifecycle implemented; custom domain and Cloudflare DNS automation remain outside current MVP execution path
Audit Engine	Implemented
Platform Engine	Implemented
Notification Engine	Implemented for in-app MVP scope
Dashboard	Implemented, including Connected Accounts metadata and imported-repository reuse UI
Admin Panel	Implemented as a protected operations console
GitHub Provider	Installation-token metadata, default-branch head, commit/tree, recursive inventory, and bounded content acquisition implemented; controlled live API validation remains pending
Cloudflare Provider	OAuth/account foundations and Cloudflare Pages project, artifact, asset upload, hash registration, and deployment primitives implemented

App Gate Foundations

AG-001 — Deploy Provider Gate

AG-001 remains a standalone Deploy Engine extension contract.

build_target missing
        ↓
cloudflare

build_target present
        ↓
injected future resolver
        ↓
selected provider

AG-001 is not runtime-wired. Current Cloudflare deployment behavior remains unchanged.

AG-002 — Repository Provider Gate

AG-002 is a standalone Repository Engine decision contract.

repository provider missing
        ↓
github

repository provider present
        ↓
selected provider

GitHub remains the current default. AG-002 does not call providers, access the database, change repository parsing or metadata acquisition, add routes or migrations, or wire future providers into runtime. GitLab, Bitbucket, Azure DevOps, and other providers remain future work requiring separate architecture approval.

See AG-002 Repository Provider Gate.

Provider Execution Safety State

Implemented:

• Cloudflare provider operation planning.
• Runtime credential acquisition through the Connected Accounts public boundary.
• Secret-wrapped credential handoff.
• Concrete Cloudflare Pages orchestration.
• Provider-error sanitization.
• Runtime-only isolated provider pipeline assembly.
• Trusted server-owned provider execution policy with default disabled and explicit cloudflare modes.
• Worker Runtime policy resolution, dispatcher transport, and deploy/redeploy binding handoff.
• Protection against job-payload-controlled provider enablement.
• Deployment History persistence for pipeline intents, provider summaries, terminal failures, and retry-safe replay handling.
• Secret-safe live-readiness validation for production configuration, PostgreSQL, Redis, deployed API routes, and explicit provider mode.
• Runtime image packaging for the live-readiness script and controlled deployment runbook in both API and worker containers.

The default runtime remains provider-disabled.

Still disabled or incomplete:

• Default production configuration remains provider-disabled until controlled live validation.
• AG-001 runtime integration and future YGIT App resolver integration.
• AG-002 runtime integration and future non-GitHub repository provider adapters.
• Controlled live verification of provider-result/history persistence against PostgreSQL.
• Live Cloudflare API execution from the production worker.
• Controlled end-to-end PostgreSQL, Redis worker, and Cloudflare Pages validation.

Verification Snapshot

Latest verified local and remote-branch run for Update 01:

Implementation branch: feature/github-repository-acquisition-analyzer-input-v1
Implementation commit: cb796401afe8be64eb311a45e566fc315a13a00c
Branch base: d2ad741c0ee48bf3eb3887a3357f6f450825c99a
Changed implementation files: 19
Ruff: 0.15.20 — PASS
Update 01 focused tests: 27 passed
Full suite: 609 passed
Compileall: PASS
Smoke test with database skipped: PASS
Release gate with database skipped: PASS
Remote feature-branch SHA match: PASS
Working tree after push: CLEAN
Draft PR: PENDING DOCUMENTATION COMMIT
Live PostgreSQL: NOT EXECUTED
Live Redis worker loop: NOT EXECUTED
Live GitHub API acquisition: NOT EXECUTED
Cloudflare API integration: NOT EXECUTED
Real Cloudflare Pages deployment: NOT EXECUTED
Provider execution mode: DISABLED

The recurring StarletteDeprecationWarning is non-blocking and relates to the existing test-client dependency combination.

Backend CI State

Backend CI is implemented, PR-verified, merged through PR #1, and push-verified on the resulting main merge commit.

Workflow file: .github/workflows/backend-ci.yml
Workflow: Backend CI
Job: Validate
Stable status: Backend CI / Validate
Pull-request validation: SUCCESS
Workflow commit: 7f383ba6b0c17b92de9a27e0abe4cbeb8adbbac2
Final-head PR run ID: 30096212556
Final-head PR job ID: 89490793519
Merge commit: 6e44866de9ec3a3a745777afc12276f903259709
Post-merge push run ID: 30106115262
Post-merge push job ID: 89523839117
Permissions: contents read
Python: 3.12
MyPy required gate: DEFERRED
Provider execution: DISABLED
Production secrets: NOT USED
Post-merge push validation: SUCCESS
Branch protection: NOT ENABLED

Backend CI is a verification mechanism only. It does not execute providers, contact production infrastructure, modify repository state, deploy YGIT, or replace controlled live validation.

Local Verification

python -m pytest -q
python scripts/smoke_test.py --skip-db
python scripts/release_gate.py --skip-db

Live checks must use the controlled runtime runbook and dedicated test accounts.

Immediate Critical Path

1. Commit this documentation closure, push the feature branch, and open the detailed Draft PR.
2. Require successful Backend CI / Validate on the final PR head and review the exact documentation and implementation scope.
3. Merge only after explicit approval; no production redeploy is part of this documentation patch.
4. After merge, perform controlled live GitHub App validation against an approved private repository.
5. Begin Update 02 for stronger analyzer rules, monorepo/root detection, command/output resolution, environment-reference detection, and Cloudflare readiness.
6. Execute one controlled Cloudflare Pages deployment only after readiness is derived from real repository evidence and provider execution is separately authorized.
7. Keep AG-001 and AG-002 runtime integration deferred until separate architecture approval.

Update 01 Documentation

• Completion Record
• Verification Evidence
• Draft PR Checklist
• Architecture Specification

Documentation Scope

The following files are current project references:

• README.md
• PROJECT_STATUS.md
• VERSION.json
• CONTRACT_MANIFEST.json
• CHANGELOG.md
• AUDIT_REPORT.md
• REPOSITORY_ANALYSIS_CURRENT_STATE_AUDIT.md
• docs/architecture/AG_002_REPOSITORY_PROVIDER_GATE.md
• docs/phase0/PHASE0_COMPLETION_RECORD.md
• docs/ci/BACKEND_CI_SPECIFICATION.md
• docs/ci/BACKEND_CI_IMPLEMENTATION_PLAN.md
• docs/ci/BACKEND_CI_TESTING_AND_ROLLBACK_SPECIFICATION.md
• .github/workflows/backend-ci.yml

The MVP release-gate and live-runtime-smoke-plan documents remain historical versioned artifacts. They should not be interpreted as the complete current implementation snapshot.

---

YGIT UI V2

YGIT UI V2 is currently in the documentation-freeze phase. It will be developed as an isolated React frontend and migrated page by page while the existing dashboard remains available.

• UI V2 documentation index
• Master Architecture
• API Architecture
• Design System Freeze
• Migration Plan
• Testing and Release Gate
• Decision Log

UI V2 implementation has not started. The existing YGIT backend, engines, providers, workers, authentication, and production dashboard remain unchanged.