1.6 KiB
Public source boundary
The canonical Ludarium repository is an operational development record. It contains private release evidence, infrastructure topology, historical scan reports and screenshots made against an owned game library. Its Git history must therefore remain private even when the application source is published.
Public releases are created as a new, parentless repository from public-source.allowlist. The export
contains the application, tests, safe deployment examples, required asset provenance and one synthetic
empty-library screenshot. It excludes production workflows, live validation evidence, security scan
artifacts, SBOM archives, internal plans, agent instructions, operational status records and media made
from commercial games or firmware.
Run the exporter only from a clean, reviewed revision after a root LICENSE has been committed:
node scripts/export-public-source.mjs ../ludarium-public
The exporter refuses a dirty tree, a missing license, private infrastructure markers, proprietary game or key file extensions outside the small documented synthetic fixture set, oversized files, and any tracked file not explicitly allowlisted. It writes a SHA-256 manifest. In the exported directory, run:
node scripts/validate-public-source.mjs
sh deploy/run-managed-validation.sh source
gitleaks git .
Initialize and publish that directory as a new repository; never push the canonical branch, tags or history into the public remote. Changes flow from the private canonical repository through another reviewed export, not by merging the two histories.