# Public source boundary

The canonical engineering repository combines product source with private planning, prompt, packaging, and operational evidence. Do not make that history public directly. Create a parentless candidate with `scripts/export-public-source.mjs` and validate that candidate before publication.

A public source set may include reviewed code under `cmd/`, `internal/`, `apps/`, stable configuration schemas, synthetic fixtures, durable user documentation, and reproducible build scripts selected by `public-source.allowlist`.

Exclude from public source/release archives unless individually reviewed:

- `.agents/`, `.codex/`, prompt packs and operator-specific instructions;
- `artifacts/`, generated evidence, checksums and package reports not produced by the tagged release job;
- private deployment configuration, host inventories and telemetry;
- transient planning/state documents and local test output;
- credentials, `.env` files, private keys and production data.

The exporter blocks when `LICENSE` is missing and scans the rendered candidate for private topology, machine-local paths, denied directories, symlinks, and oversized files. It writes a content manifest so the published tree can be reviewed independently of private Git history.

First-party source code selected for the public source set is licensed under **AGPL-3.0-or-later**; see the root `LICENSE`. Third-party components and assets retain their own terms and must remain covered by the repository's dependency and notice documentation.

Before any visibility change, also scan every private ref and object. A clean current export does not sanitize the canonical repository history.