ModelForge/docs/PUBLICATION.md

Public source boundary

Publication decision

Do not make this canonical repository public in place. Its history contains real private network addresses, deployment hostnames, storage paths, integration names and production verification evidence. Those facts are useful to operators but unnecessary for users and increase disclosure risk.

Create a new, parentless public repository from scripts/export-public-source.mjs. The exporter selects reviewed source and documentation from public-source.allowlist, replaces private example identifiers with stable synthetic ones, rejects remaining private indicators and writes a content manifest. The canonical repository and all of its Git history remain private.

Release checklist

1. Verify the canonical AGPL-3.0 LICENSE text and SPDX metadata are present.
2. Confirm security@itworx.tech is monitored for private vulnerability reports.
3. Generate the export into a new directory outside this repository.
4. Run node scripts/validate-public-source.mjs from the generated directory, then run Gitleaks and all component tests there. The validator recomputes every declared SHA-256 digest and byte count, rejects undeclared files, links, unsafe paths and case-insensitive path collisions.
5. Dispatch public-candidate-acceptance.yml for the exact canonical commit. It renders from the clean export, builds and scans all four images, and clean-installs an isolated production-shaped Compose project without touching production. See docs/operations/RC_ACCEPTANCE.md.
6. Review generated PUBLIC_SOURCE_MANIFEST.json and the final diff.
7. Create a new repository with one parentless initial commit; never push canonical refs or tags.
8. Configure protected branches. Pull requests from forks must not receive internal secrets or run automatically on persistent private runners. The exporter therefore removes the automatic pull_request trigger from the public copy of managed-validation.yml and leaves only explicit owner dispatch. Keep public branch protection independent of private-runner status checks until a public-safe CI runner is configured.

License decision

The owner selected AGPL-3.0-or-later on 2026-09-01. ModelForge is a network-accessible, self-hosted application; the AGPL keeps modifications made available over a network available to those users and protects the platform from closed hosted forks.

The license covers ModelForge source and distributions. Downloaded model repositories, weights, datasets and other third-party artifacts retain their own upstream terms. The exporter verifies the approved canonical license digest before creating a public candidate.