gamertan
92a66db3df
Export the reviewed allowlisted snapshot from private source commit 05928cebd01b586cf9e9d4b8c8537a7605a6068c. This records the exact candidate, bounded capacity result, stateful migration scratch requirement, authenticated batch identity proof, and immediate live acceptance evidence. AI-Assisted: OpenAI Codex Signed-off-by: Cole Speelman <crspeelman@gmail.com>
1.4 KiB
Public snapshot boundary
Observatory uses a private development repository and a separate canonical
public source repository. Public history is not a mirror of private history.
Each publication is a reviewed root snapshot of one exact, clean, pushed
private main commit.
scripts/public-snapshot.allow is the complete public file boundary. The
exporter refuses workflow directories, absolute or parent-traversing paths,
missing tracked files, dirty worktrees, and a private HEAD that differs from
origin/main. It archives only the allowlisted paths from the committed Git
tree, byte-compares them with the worktree, scans the result for known private
material, and records the source commit, tree, date, and file count in
PUBLIC-SNAPSHOT.json with a SHA-256 sidecar.
The generated snapshot has no .git directory. Publication tooling creates a
new reviewed public commit; it must never push private refs, tags, workflows,
reflogs, or historical objects. The canonical public Gitea commit and GitHub
discovery commit may have different Git identities, but their exported file
trees and snapshot manifest must be byte-identical.
Before the first preview, the public snapshot, release archive, SBOM, checksums, signature, canonical tag, and installed module must all be traced back to the same reviewed private source commit. A public snapshot does not by itself make an unreleased development build supported.