Instatic
A self-hosted visual CMS candidate and architecture reference: one editable page tree feeds human visual editing, agent tools, and clean static publication. It does not replace Kevin-Wiki's custom Next.js viewer. Source:
CoreBunch/Instaticcommit3af80cc8daa7a6737d2d53801b33ac23f1ee60a5, 2026-08-12
Why it matters
Instatic is unusually aligned with the brain rebuild's non-flat structure. A typed page tree and design tokens remain editable data; visual breakpoint frames, agent operations, templates, loops, forms, and the publisher act as projections over that tree. Publication emits semantic HTML and compact CSS, while dynamic behavior is confined to deliberate runtime holes. Whole-site import previews conflicts and supports a single undo boundary. Source: pinned README and docs index
The repository also demonstrates useful enforcement patterns:
- capabilities gate admin and agent actions, including a separate
editor.codeboundary; - sessions, TOTP, lockout, step-up operations, and an append-only audit log are first-class;
- third-party plugins run in per-plugin QuickJS-WASM sandboxes without filesystem, environment, or network access unless granted;
- architecture invariants—tokens, boundaries, capability checks, secret handling, bundle budgets, and tool schemas—are executable tests rather than prose alone.
These are design inputs for Kevin's editable graph and UI, not a migration directive. The wiki's canonical objects remain Markdown/JSON/skills with deterministic projections; adopting a CMS runtime would require an export/replay proof showing that source ownership, citations, routing, and agent portability survive.
Route and limits
Evaluate Instatic when a project specifically needs a self-hosted visual CMS with agent editing and static output. Keep the existing wiki viewer for Kevin-Wiki. Before a production pilot, pin a release, run the Bun build/test/lint and E2E suites, inspect import/export reversibility, test SQLite/Postgres parity, enumerate plugin permissions, prove backups, and threat-model public/multi-user deployment.
The MIT repository had 7,887 stars, 709 forks, 3,222 blobs, and 730 test files at capture. Its own security policy says the pre-1.0 system is not recommended for hostile multi-user environments without careful operator review. That warning governs adoption regardless of the breadth of its test suite. Source: pinned SECURITY.md; frozen repository evidence
Timeline
- 2026-08-12 | Deep-reviewed the CMS architecture, editor/publisher split, capability gates, plugin sandbox, tests, deployment surface, security policy, and local fit. Retained it as a conditional product capability and a strong graph/UI architecture reference. Source: X bookmark
2084114545690423407; pinned repository evidence