Local semgrep run found 25 findings (not the WP's remembered 27 — already-stale
by the time this ran): dependabot cooldown, npm min-release-age, every GitHub
Action pinned to a full commit SHA (dependabot's existing github-actions
ecosystem entry keeps these current), and 2 detect-non-literal-regexp findings
in e2e/create-ssp.mjs suppressed as false positives (non-attacker-controlled
input: a test's own captured version number, a local generator's CLI arg).
`semgrep scan` now runs with `--error`, a real blocking gate instead of
report-only.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Mechanises the new-ssp skill's manual fork-and-strip recipe into a runnable
script: strips the four business contexts and every wiring point that
references them (routes, tsconfig aliases, dependency-cruiser boundaries,
nav links, capability union, the debug-state panel, showcase snippet
tooling), renames BigRegister.* throughout including the backend
solution/projects, re-runs gen:api, and reuses gen:context (WP-44) to seed
the new portal's first context. Backend business rules and real branding
can't be generated from nothing, so those print an explicit checklist
instead of pretending to be automated.
Verified end-to-end against an isolated clone (not this working tree):
lint, dep:check, check:tokens, all frontend tests, ng build, dotnet
build/test on the renamed backend, and gen:api against it all pass clean
with zero remaining references to the stripped contexts.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
ehoandClaude Sonnet 5