ITWorx-Pulse-Public/docs/PUBLIC_SOURCE_BOUNDARY.md

Public source boundary

The canonical engineering repository combines product source with private planning, prompt, packaging, and operational evidence. Do not make that history public directly. Create a parentless candidate with scripts/export-public-source.mjs and validate that candidate before publication.

A public source set may include reviewed code under cmd/, internal/, apps/, stable configuration schemas, synthetic fixtures, durable user documentation, and reproducible build scripts selected by public-source.allowlist.

Exclude from public source/release archives unless individually reviewed:

• .agents/, .codex/, prompt packs and operator-specific instructions;
• artifacts/, generated evidence, checksums and package reports not produced by the tagged release job;
• private deployment configuration, host inventories and telemetry;
• transient planning/state documents and local test output;
• credentials, .env files, private keys and production data.

The exporter blocks when LICENSE is missing and scans the rendered candidate for private topology, machine-local paths, denied directories, symlinks, and oversized files. It writes a content manifest so the published tree can be reviewed independently of private Git history.

First-party source code selected for the public source set is licensed under AGPL-3.0-or-later; see the root LICENSE. Third-party components and assets retain their own terms and must remain covered by the repository's dependency and notice documentation.

Before any visibility change, also scan every private ref and object. A clean current export does not sanitize the canonical repository history.