feat: publish Gamertan Web Foundations preview source

Export the reviewed application-neutral package set through the exact public allowlist. Development history and private application evidence remain outside this canonical source root.

Developed with material AI assistance under maintainer review.

Signed-off-by: Cole Speelman <crspeelman@gmail.com>

scripts/check-licenses.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: AGPL-3.0-only
+set -euo pipefail
+root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+cd "$root"
+failed=0
+while IFS= read -r -d '' file; do
+	case $file in
+		./.git/*|./LICENSES/*|./go.sum) continue ;;
+		./starters/*|./examples/*) expected=0BSD ;;
+		./scripts/*|./.gitea/*|./services/*) expected=AGPL-3.0-only ;;
+		*) expected=MPL-2.0 ;;
+	esac
+	if ! head -n 5 "$file" | grep -Fq "SPDX-License-Identifier: $expected"; then
+		echo "license mismatch: $file expected $expected" >&2; failed=1
+	fi
+done < <(find . -type f -print0)
+exit "$failed"

scripts/export-public.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: AGPL-3.0-only
+set -euo pipefail
+usage(){ echo "Usage: export-public.sh OUTPUT_DIRECTORY" >&2; exit 2; }
+[[ $# -eq 1 ]] || usage
+root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+output=$1
+[[ $output = /* && $output != / && ! -e $output ]] || usage
+cd "$root"
+[[ -z $(git status --porcelain=v1 --untracked-files=all) ]] || { echo "private source must be clean" >&2; exit 1; }
+mapfile -t files < <(grep -Ev '^[[:space:]]*(#|$)' scripts/public-snapshot.allow)
+[[ ${#files[@]} -gt 0 ]] || exit 1
+for file in "${files[@]}"; do
+	[[ $file != /* && $file != *..* && -f $file && ! -L $file ]] || { echo "invalid allowlisted path: $file" >&2; exit 1; }
+	git ls-files --error-unmatch -- "$file" >/dev/null
+done
+mkdir -m 0700 "$output"
+git archive --format=tar HEAD -- "${files[@]}" | tar -x -C "$output"
+find "$output" -type d -exec chmod 0755 {} +
+"$output/scripts/check-licenses.sh"
+echo "exported ${#files[@]} reviewed files"

scripts/public-snapshot.allow

@@ -0,0 +1,56 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+
+.gitattributes
+.gitea/workflows/assurance.yml
+.gitea/workflows/cross-platform.yml
+.gitea/workflows/verify.yml
+.gitignore
+CHANGELOG.md
+CONTRIBUTING.md
+LICENSES.md
+LICENSES/0BSD.txt
+LICENSES/AGPL-3.0-only.txt
+LICENSES/MPL-2.0.txt
+README.md
+SECURITY.md
+abuse/abuse.go
+abuse/abuse_test.go
+analytics/analytics.go
+analytics/analytics_test.go
+analytics/fuzz_test.go
+analytics/geo.go
+auth/auth.go
+auth/context.go
+auth/password.go
+auth/password_test.go
+auth/service_test.go
+authhttp/authhttp.go
+authhttp/authhttp_test.go
+authsqlite/store.go
+authsqlite/store_test.go
+docs/ADOPTION.md
+docs/ARCHITECTURE.md
+docs/DEPENDENCIES.md
+docs/PUBLIC_SNAPSHOT.md
+docs/SERVICES_ROADMAP.md
+docs/THREAT_MODEL.md
+go.mod
+go.sum
+requestlog/jsonl.go
+requestlog/requestlog.go
+requestlog/requestlog_test.go
+requestmeta/fuzz_test.go
+requestmeta/requestmeta.go
+requestmeta/requestmeta_test.go
+scripts/check-licenses.sh
+scripts/export-public.sh
+scripts/public-snapshot.allow
+scripts/test-public-snapshot.sh
+scripts/verify.sh
+scripts/verify.ps1
+starters/basic/.env.example
+starters/basic/README.md
+starters/basic/main.go
+websec/ratelimit.go
+websec/websec.go
+websec/websec_test.go

scripts/test-public-snapshot.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: AGPL-3.0-only
+set -euo pipefail
+root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+cd "$root"
+temporary=$(mktemp -d)
+trap 'rm -rf "$temporary"' EXIT
+./scripts/export-public.sh "$temporary/export"
+(cd "$temporary/export" && find . -type f -printf '%P\n' | sort) >"$temporary/actual"
+grep -Ev '^[[:space:]]*(#|$)' scripts/public-snapshot.allow | sort >"$temporary/expected"
+diff -u "$temporary/expected" "$temporary/actual"
+private_word='PRI''VATE'
+token_word='to''ken'
+private_pattern="BEGIN (RSA|OPENSSH|EC) ${private_word} KEY|Authorization: ${token_word}|/home/"'cole'"|/mnt/c/"'Users'"|"'eqlwiki'"-deploy|"'crspeelman'"@gmail\\.com"
+if rg -n --hidden --glob '!.git/**' "$private_pattern" "$temporary/export"; then
+	echo "private marker escaped into public snapshot" >&2; exit 1
+fi
+test -z "$(git status --porcelain=v1 --untracked-files=all)"

scripts/verify.ps1

@@ -0,0 +1,41 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+$ErrorActionPreference = "Stop"
+$root = (Resolve-Path (Join-Path $PSScriptRoot "..")).Path
+Push-Location $root
+try {
+    $failed = $false
+    Get-ChildItem -Recurse -File | ForEach-Object {
+        $relative = [IO.Path]::GetRelativePath($root, $_.FullName).Replace('\', '/')
+        if ($relative.StartsWith('.git/') -or $relative.StartsWith('LICENSES/') -or $relative -eq 'go.sum') { return }
+        if ($relative.StartsWith('starters/') -or $relative.StartsWith('examples/')) { $expected = '0BSD' }
+        elseif ($relative.StartsWith('scripts/') -or $relative.StartsWith('.gitea/') -or $relative.StartsWith('services/')) { $expected = 'AGPL-3.0-only' }
+        else { $expected = 'MPL-2.0' }
+        $header = (Get-Content -LiteralPath $_.FullName -TotalCount 5) -join "`n"
+        if (-not $header.Contains("SPDX-License-Identifier: $expected")) {
+            Write-Error "license mismatch: $relative expected $expected"
+            $failed = $true
+        }
+    }
+    if ($failed) { throw "license boundary failed" }
+
+    $unformatted = & gofmt -l .
+    if ($LASTEXITCODE -ne 0 -or $unformatted) { throw "gofmt check failed: $unformatted" }
+    & go test ./...
+    if ($LASTEXITCODE -ne 0) { throw "go test failed" }
+    & go test -race ./...
+    if ($LASTEXITCODE -ne 0) { throw "race test failed" }
+    & go vet ./...
+    if ($LASTEXITCODE -ne 0) { throw "go vet failed" }
+    $build = Join-Path ([IO.Path]::GetTempPath()) ("gamertan-web-" + [guid]::NewGuid().ToString('N'))
+    New-Item -ItemType Directory -Path $build | Out-Null
+    try {
+        & go build -trimpath -o (Join-Path $build 'basic.exe') ./starters/basic
+        if ($LASTEXITCODE -ne 0) { throw "starter build failed" }
+    } finally {
+        Remove-Item -LiteralPath $build -Recurse -Force
+    }
+    & git diff --check
+    if ($LASTEXITCODE -ne 0) { throw "git diff check failed" }
+} finally {
+    Pop-Location
+}

scripts/verify.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: AGPL-3.0-only
+set -euo pipefail
+root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+cd "$root"
+./scripts/check-licenses.sh
+test -z "$(gofmt -l .)"
+go test ./...
+go test -race ./...
+go vet ./...
+build_dir=$(mktemp -d)
+trap 'rm -rf "$build_dir"' EXIT
+go build -trimpath -o "$build_dir/basic" ./starters/basic
+git diff --check