fix: keep public export self-contained

PUBLIC_SOURCE_EXPORT.md

@@ -1,5 +1,5 @@
 # Curated public source export
 
-Generated from private canonical revision `63254607a2e701e938a09d6e8f68e5bbc8fe83ac`.
+Generated from private canonical revision `abead7212b6a4120180d53388768a05bac4655b3`.
 
 This parentless candidate excludes private operational history, evidence, planning, prompts, and machine-local agent configuration.

PUBLIC_SOURCE_MANIFEST.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "sourceRevision": "63254607a2e701e938a09d6e8f68e5bbc8fe83ac",
+  "sourceRevision": "abead7212b6a4120180d53388768a05bac4655b3",
   "files": [
     {
       "path": ".dockerignore",
@@ -2872,6 +2872,11 @@
       "bytes": 38,
       "sha256": "6a7030c7d39d70711fd0a50f8a08d5a62bfc5e75ee513bb8529d9f153c21673c"
     },
+    {
+      "path": "public-source.allowlist",
+      "bytes": 2458,
+      "sha256": "8deff1dae7aa66b6bfa57500c6d198421ef9ea4a297e76dd2e0beed94d005726"
+    },
     {
       "path": "README.md",
       "bytes": 4690,

public-source.allowlist

@@ -0,0 +1,92 @@
+# Exact files and directory prefixes for the parentless public source repository.
+.dockerignore
+.editorconfig
+.env.example
+.gitattributes
+.gitea/workflows/public-validation.yml
+.gitignore
+CHANGELOG.md
+CONTRIBUTING.md
+LICENSE
+Makefile
+PACKAGE_VERSION
+README.md
+SECURITY.md
+apps/**
+cmd/**
+config/**
+deploy/agent.Dockerfile
+deploy/api.Dockerfile
+deploy/compose.dev.yaml
+deploy/compose.prod.yaml
+deploy/compose.real-source-smoke.yaml
+deploy/compose.server-smoke.yaml
+deploy/compose.smoke.yaml
+deploy/compose.yaml
+deploy/healthcheck-heartbeat.sh
+deploy/IMAGE_DIGESTS.md
+deploy/migrate.Dockerfile
+deploy/nginx.conf
+deploy/postgres.Dockerfile
+deploy/pulse-entrypoint.sh
+deploy/smoke-fixture.Dockerfile
+deploy/verify-image-digests.sh
+deploy/web.Dockerfile
+deploy/worker.Dockerfile
+docs/PUBLIC_DEPLOYMENT.md
+docs/PUBLIC_SOURCE_BOUNDARY.md
+docs/REPOSITORY_BOUNDARY.md
+docs/architecture/adr/0001-read-only-v1.md
+docs/architecture/adr/0002-go-react-stack.md
+docs/architecture/adr/0003-prometheus-v1-history.md
+docs/architecture/adr/0004-postgresql-domain-state.md
+docs/architecture/adr/0005-docker-access-boundary.md
+docs/architecture/adr/0006-rest-websocket.md
+docs/architecture/adr/0007-localization.md
+docs/architecture/adr/0008-stale-is-unknown.md
+docs/architecture/adr/0009-upstream-dependency-baseline.md
+docs/architecture/ALERTING_AND_INCIDENTS.md
+docs/architecture/API_CONTRACT.md
+docs/architecture/DATA_MODEL.md
+docs/architecture/SECURITY_THREAT_MODEL.md
+docs/architecture/SYSTEM_ARCHITECTURE.md
+docs/architecture/TELEMETRY_AND_QUERY_ENGINE.md
+docs/engineering/**
+docs/operations/BACKUP_RESTORE.md
+docs/operations/DEVELOPMENT_SETUP.md
+docs/operations/OBSERVABILITY_OF_PULSE.md
+docs/operations/WORKER_AGENT_HEALTHCHECK_CONTRACT.md
+docs/product/**
+fixtures/**
+go.mod
+go.sum
+go.work
+go.work.sum
+internal/**
+package.json
+pnpm-lock.yaml
+pnpm-workspace.yaml
+public-source.allowlist
+requirements-dev.txt
+scripts/bootstrap.ps1
+scripts/build.ps1
+scripts/export-public-source.mjs
+scripts/integration-smoke.ps1
+scripts/lint.ps1
+scripts/production-smoke.ps1
+scripts/public-verify.ps1
+scripts/run-trivy-fs-scan.sh
+scripts/test.ps1
+scripts/validate-public-source.mjs
+scripts/wallboard-soak.ps1
+specs/**
+tools/analyze-wallboard-soak.mjs
+tools/check_api_contract.py
+tools/check_secrets.py
+tools/check_wiring.py
+tools/deadman_check.py
+tools/integrationfixture/**
+tools/validate_contracts.py
+tools/wallboard-soak-analysis.mjs
+tools/wallboard-soak.mjs
+tools/wiring_allowlist.json