Publish Ludarium source

2026-09-03 02:08:58 +02:00
commit df869819ce
339 changed files with 46455 additions and 0 deletions
@@ -0,0 +1,31 @@
+# Public source boundary
+
+The canonical Ludarium repository is an operational development record. It contains private release
+evidence, infrastructure topology, historical scan reports and screenshots made against an owned game
+library. Its Git history must therefore remain private even when the application source is published.
+
+Public releases are created as a new, parentless repository from `public-source.allowlist`. The export
+contains the application, tests, safe deployment examples, required asset provenance and one synthetic
+empty-library screenshot. It excludes production workflows, live validation evidence, security scan
+artifacts, SBOM archives, internal plans, agent instructions, operational status records and media made
+from commercial games or firmware.
+
+Run the exporter only from a clean, reviewed revision after a root `LICENSE` has been committed:
+
+```sh
+node scripts/export-public-source.mjs ../ludarium-public
+```
+
+The exporter refuses a dirty tree, a missing license, private infrastructure markers, proprietary game
+or key file extensions outside the small documented synthetic fixture set, oversized files, and any
+tracked file not explicitly allowlisted. It writes a SHA-256 manifest. In the exported directory, run:
+
+```sh
+node scripts/validate-public-source.mjs
+sh deploy/run-managed-validation.sh source
+gitleaks git .
+```
+
+Initialize and publish that directory as a new repository; never push the canonical branch, tags or
+history into the public remote. Changes flow from the private canonical repository through another
+reviewed export, not by merging the two histories.