From a4956c2af964de1d72055cc49240bdbebeb89e48 Mon Sep 17 00:00:00 2001
From: NuklearRabbit <145918611+NuklearRabbit@users.noreply.github.com>
Date: Thu, 3 Sep 2026 02:44:49 +0200
Subject: [PATCH] fix: keep public export self-contained

---
 PUBLIC_SOURCE_EXPORT.md     |  2 +-
 PUBLIC_SOURCE_MANIFEST.json |  7 ++-
 public-source.allowlist     | 92 +++++++++++++++++++++++++++++++++++++
 3 files changed, 99 insertions(+), 2 deletions(-)
 create mode 100644 public-source.allowlist

diff --git a/PUBLIC_SOURCE_EXPORT.md b/PUBLIC_SOURCE_EXPORT.md
index e8c8b25..637cfec 100644
--- a/PUBLIC_SOURCE_EXPORT.md
+++ b/PUBLIC_SOURCE_EXPORT.md
@@ -1,5 +1,5 @@
 # Curated public source export
 
-Generated from private canonical revision `63254607a2e701e938a09d6e8f68e5bbc8fe83ac`.
+Generated from private canonical revision `abead7212b6a4120180d53388768a05bac4655b3`.
 
 This parentless candidate excludes private operational history, evidence, planning, prompts, and machine-local agent configuration.
diff --git a/PUBLIC_SOURCE_MANIFEST.json b/PUBLIC_SOURCE_MANIFEST.json
index 7ccbb4d..2e18b94 100644
--- a/PUBLIC_SOURCE_MANIFEST.json
+++ b/PUBLIC_SOURCE_MANIFEST.json
@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "sourceRevision": "63254607a2e701e938a09d6e8f68e5bbc8fe83ac",
+  "sourceRevision": "abead7212b6a4120180d53388768a05bac4655b3",
   "files": [
     {
       "path": ".dockerignore",
@@ -2872,6 +2872,11 @@
       "bytes": 38,
       "sha256": "6a7030c7d39d70711fd0a50f8a08d5a62bfc5e75ee513bb8529d9f153c21673c"
     },
+    {
+      "path": "public-source.allowlist",
+      "bytes": 2458,
+      "sha256": "8deff1dae7aa66b6bfa57500c6d198421ef9ea4a297e76dd2e0beed94d005726"
+    },
     {
       "path": "README.md",
       "bytes": 4690,
diff --git a/public-source.allowlist b/public-source.allowlist
new file mode 100644
index 0000000..b2761fc
--- /dev/null
+++ b/public-source.allowlist
@@ -0,0 +1,92 @@
+# Exact files and directory prefixes for the parentless public source repository.
+.dockerignore
+.editorconfig
+.env.example
+.gitattributes
+.gitea/workflows/public-validation.yml
+.gitignore
+CHANGELOG.md
+CONTRIBUTING.md
+LICENSE
+Makefile
+PACKAGE_VERSION
+README.md
+SECURITY.md
+apps/**
+cmd/**
+config/**
+deploy/agent.Dockerfile
+deploy/api.Dockerfile
+deploy/compose.dev.yaml
+deploy/compose.prod.yaml
+deploy/compose.real-source-smoke.yaml
+deploy/compose.server-smoke.yaml
+deploy/compose.smoke.yaml
+deploy/compose.yaml
+deploy/healthcheck-heartbeat.sh
+deploy/IMAGE_DIGESTS.md
+deploy/migrate.Dockerfile
+deploy/nginx.conf
+deploy/postgres.Dockerfile
+deploy/pulse-entrypoint.sh
+deploy/smoke-fixture.Dockerfile
+deploy/verify-image-digests.sh
+deploy/web.Dockerfile
+deploy/worker.Dockerfile
+docs/PUBLIC_DEPLOYMENT.md
+docs/PUBLIC_SOURCE_BOUNDARY.md
+docs/REPOSITORY_BOUNDARY.md
+docs/architecture/adr/0001-read-only-v1.md
+docs/architecture/adr/0002-go-react-stack.md
+docs/architecture/adr/0003-prometheus-v1-history.md
+docs/architecture/adr/0004-postgresql-domain-state.md
+docs/architecture/adr/0005-docker-access-boundary.md
+docs/architecture/adr/0006-rest-websocket.md
+docs/architecture/adr/0007-localization.md
+docs/architecture/adr/0008-stale-is-unknown.md
+docs/architecture/adr/0009-upstream-dependency-baseline.md
+docs/architecture/ALERTING_AND_INCIDENTS.md
+docs/architecture/API_CONTRACT.md
+docs/architecture/DATA_MODEL.md
+docs/architecture/SECURITY_THREAT_MODEL.md
+docs/architecture/SYSTEM_ARCHITECTURE.md
+docs/architecture/TELEMETRY_AND_QUERY_ENGINE.md
+docs/engineering/**
+docs/operations/BACKUP_RESTORE.md
+docs/operations/DEVELOPMENT_SETUP.md
+docs/operations/OBSERVABILITY_OF_PULSE.md
+docs/operations/WORKER_AGENT_HEALTHCHECK_CONTRACT.md
+docs/product/**
+fixtures/**
+go.mod
+go.sum
+go.work
+go.work.sum
+internal/**
+package.json
+pnpm-lock.yaml
+pnpm-workspace.yaml
+public-source.allowlist
+requirements-dev.txt
+scripts/bootstrap.ps1
+scripts/build.ps1
+scripts/export-public-source.mjs
+scripts/integration-smoke.ps1
+scripts/lint.ps1
+scripts/production-smoke.ps1
+scripts/public-verify.ps1
+scripts/run-trivy-fs-scan.sh
+scripts/test.ps1
+scripts/validate-public-source.mjs
+scripts/wallboard-soak.ps1
+specs/**
+tools/analyze-wallboard-soak.mjs
+tools/check_api_contract.py
+tools/check_secrets.py
+tools/check_wiring.py
+tools/deadman_check.py
+tools/integrationfixture/**
+tools/validate_contracts.py
+tools/wallboard-soak-analysis.mjs
+tools/wallboard-soak.mjs
+tools/wiring_allowlist.json