# Repository and Release Boundary

The canonical private repository contains both product source and intentional engineering context. These categories have different publication and packaging rules.

## Product source

Application code, contracts, migrations, deployment templates, tests and public product documentation may enter a reviewed source release when they contain only generic configuration and redistributable assets.

## Development-only context

`.agents/`, `.codex/`, `planning/`, `MASTER_PROMPT.txt`, detailed audit state and milestone evidence support private development. They remain tracked for continuity but are excluded from `git archive` release output. Machine-local Codex execution policy is not tracked.

## Runtime/private data

Telemetry, host inventories, dashboards, alerts, incidents, backups, credentials, OIDC state, local databases and generated heavy evidence must remain outside source control.

## Licensing

First-party source code in the repository is licensed under **AGPL-3.0-or-later**; see the root `LICENSE`. Third-party components and assets retain their own terms. A future public release must still use the reviewed parentless export and pass its publication gates; the canonical private history is not itself a publication artifact.