765ec4188f
The tree adds the installer, service and test paths admitted by this source commit. Nothing else changes about what may cross. Source-Sha: 3e4a3aa4ce092e9e3f51bc78daf3ddc14d9638f8 Policy-Sha: 3e4a3aa4ce092e9e3f51bc78daf3ddc14d9638f8 Tree-Digest: 89d6fce3828a0e0de0c8eeb41ee6750f4462217e2a04b5190297134d7f4a50c3
2.3 KiB
Publication provenance
This branch is a constructed public projection. Its commit trailers identify the internal source commit and the policy used to admit the projected tree. Admission means the tree is eligible for disclosure; it neither authorizes nor implies external publication.
.publication/paths.txt is the exact path authority. Every file in a candidate
must be listed, and every listed file must exist. Parent directories grant no
recursive authority. .publication/surface_gate.py can also write the exact
mode, blob ID, size, and path inventory for one immutable candidate with
--inventory-out.
Path authority covers every reachable commit, including files deleted before the tip. Removing a path from disclosure therefore requires history that does not contain it; a deletion commit alone is insufficient. Shallow history fails closed. Internal development history is preserved separately.
Reproduce the tree digest from a checked-out public commit with:
LC_ALL=C git ls-tree -r --full-tree HEAD^{tree} | LC_ALL=C sort | sha256sum
The result must equal the commit's Tree-Digest trailer.
Why public history begins at the epoch
Public history starts at a single constructed commit because the history before it was not admissible. Twenty-six commits carried an internal author identity and one body quoted an internal registry address, and no force push removes what a mirror has already copied.
Replaying eleven hundred commit messages through a filter would have produced a different object graph wearing the old words, and would still have required a person to read every one of them. The honest alternative is this one: the development history is preserved in full inside the private forge, where it is useful, and the public repository carries what was deliberately sent out.
The reviewed history allowlist is empty for the first time. It held forty-four commits, and every one of them was excused for exactly the thing the epoch removes.
Everything after the epoch commit is an ordinary publication carrying the same three trailers, so a force push stops being routine and starts meaning that something deliberate happened. The trailers bind a projection to its source without pretending the public commit is the private one: same lineage, different tree, and the record says so.