32 lines
1.6 KiB
Markdown
32 lines
1.6 KiB
Markdown
# Public source boundary
|
|
|
|
The canonical Ludarium repository is an operational development record. It contains private release
|
|
evidence, infrastructure topology, historical scan reports and screenshots made against an owned game
|
|
library. Its Git history must therefore remain private even when the application source is published.
|
|
|
|
Public releases are created as a new, parentless repository from `public-source.allowlist`. The export
|
|
contains the application, tests, safe deployment examples, required asset provenance and one synthetic
|
|
empty-library screenshot. It excludes production workflows, live validation evidence, security scan
|
|
artifacts, SBOM archives, internal plans, agent instructions, operational status records and media made
|
|
from commercial games or firmware.
|
|
|
|
Run the exporter only from a clean, reviewed revision after a root `LICENSE` has been committed:
|
|
|
|
```sh
|
|
node scripts/export-public-source.mjs ../ludarium-public
|
|
```
|
|
|
|
The exporter refuses a dirty tree, a missing license, private infrastructure markers, proprietary game
|
|
or key file extensions outside the small documented synthetic fixture set, oversized files, and any
|
|
tracked file not explicitly allowlisted. It writes a SHA-256 manifest. In the exported directory, run:
|
|
|
|
```sh
|
|
node scripts/validate-public-source.mjs
|
|
sh deploy/run-managed-validation.sh source
|
|
gitleaks git .
|
|
```
|
|
|
|
Initialize and publish that directory as a new repository; never push the canonical branch, tags or
|
|
history into the public remote. Changes flow from the private canonical repository through another
|
|
reviewed export, not by merging the two histories.
|