# Public source boundary

## Publication decision

Do not make this canonical repository public in place. Its history contains real private network
addresses, deployment hostnames, storage paths, integration names and production verification
evidence. Those facts are useful to operators but unnecessary for users and increase disclosure
risk.

Create a new, parentless public repository from `scripts/export-public-source.mjs`. The exporter
selects reviewed source and documentation from `public-source.allowlist`, replaces private example
identifiers with stable synthetic ones, rejects remaining private indicators and writes a content
manifest. The canonical repository and all of its Git history remain private.

## Release checklist

1. Verify the canonical AGPL-3.0 `LICENSE` text and SPDX metadata are present.
2. Confirm `security@itworx.tech` is monitored for private vulnerability reports.
3. Generate the export into a new directory outside this repository.
4. Run `node scripts/validate-public-source.mjs` from the generated directory, then run Gitleaks
   and all component tests there. The validator recomputes every declared SHA-256 digest and byte
   count, rejects undeclared files, links, unsafe paths and case-insensitive path collisions.
5. Dispatch `public-candidate-acceptance.yml` for the exact canonical commit. It renders from the
   clean export, builds and scans all four images, and clean-installs an isolated production-shaped
   Compose project without touching production. See `docs/operations/RC_ACCEPTANCE.md`.
6. Review generated `PUBLIC_SOURCE_MANIFEST.json` and the final diff.
7. Create a new repository with one parentless initial commit; never push canonical refs or tags.
8. Configure protected branches. Pull requests from forks must not receive internal secrets or run
   automatically on persistent private runners. The exporter therefore removes the automatic
   `pull_request` trigger from the public copy of `managed-validation.yml` and leaves only explicit
   owner dispatch. Keep public branch protection independent of private-runner status checks until
   a public-safe CI runner is configured.

## License decision

The owner selected **AGPL-3.0-or-later** on 2026-09-01. ModelForge is a network-accessible,
self-hosted application; the AGPL keeps modifications made available over a network available to
those users and protects the platform from closed hosted forks.

The license covers ModelForge source and distributions. Downloaded model repositories, weights,
datasets and other third-party artifacts retain their own upstream terms. The exporter verifies the
approved canonical license digest before creating a public candidate.