DevRunbook-Public/docs/PUBLICATION_READINESS.md

Publication readiness

This file separates repository changes that can be verified in source from launch choices that require the repository owner or hosting operator. It is not a substitute for branch protection or a release checklist on the public forge.

Completed in the publication candidate

• The product README describes the implemented platform, user workflows, installation, development, architecture, limitations and security boundary.
• The development Compose stack is loopback-only and no longer ships a shared bootstrap token. The production reference also binds HTTP to loopback and requires an explicit externally visible base URL.
• The unauthenticated first-run setup endpoint enforces a 16 KiB body limit for both declared and streamed requests before JSON parsing.
• Private validation addresses were removed from the current tree.
• Gitea validation runs on main and change branches and includes the actual unit, integration and security suites.
• The repository is MIT-licensed and a redacted history scan found no committed secret.
• SECURITY.md publishes a fixed private reporting address.
• The project icons have an explicit origin and license notice.
• scripts/export-public-source.sh creates a parentless public candidate, removes the private deployment workflow and rejects private deployment markers, forbidden secret files and oversized files.
• Pull requests from public forks cannot run on the self-hosted validation runner.

Owner confirmations before making the repository public

1. Public forge policy — recommended: protect main, require the managed validation job and one approving review, disallow force pushes, and create signed version tags from reviewed commits.
2. Images and Unraid — recommended: choose the public registry/image name, publish immutable multi-platform digests plus an SBOM and provenance, then complete the registry, support and template URLs in unraid/devrunbook.xml.
3. Production deploy approval — recommended: place the external Unraid deploy controller behind a protected environment/manual approval. Its implementation is outside this repository and must independently enforce repository and revision allowlists, backups, health checks and rollback.

The private canonical history must remain private: old commits contain private-network validation addresses and work-domain author metadata. Publish only the parentless export produced from a reviewed commit; do not rewrite the shared private history.

Evidence note

release-evidence.json, evidence/performance-report.json and evidence/security-scan-report.md preserve evidence for earlier release-candidate commits. They must be regenerated for the final tagged commit after managed CI, container scanning, performance validation and a restore drill. Likewise, FILE_INDEX.txt and PACK_MANIFEST.sha256 belong to the historical version 1.2 implementation-contract archive; they are not an inventory of the current Git tree.