765ec4188f
The tree adds the installer, service and test paths admitted by this source commit. Nothing else changes about what may cross. Source-Sha: 3e4a3aa4ce092e9e3f51bc78daf3ddc14d9638f8 Policy-Sha: 3e4a3aa4ce092e9e3f51bc78daf3ddc14d9638f8 Tree-Digest: 89d6fce3828a0e0de0c8eeb41ee6750f4462217e2a04b5190297134d7f4a50c3
48 lines
2.3 KiB
Markdown
48 lines
2.3 KiB
Markdown
# Publication provenance
|
|
|
|
This branch is a constructed public projection. Its commit trailers identify
|
|
the internal source commit and the policy used to admit the projected tree.
|
|
Admission means the tree is eligible for disclosure; it neither authorizes nor
|
|
implies external publication.
|
|
|
|
`.publication/paths.txt` is the exact path authority. Every file in a candidate
|
|
must be listed, and every listed file must exist. Parent directories grant no
|
|
recursive authority. `.publication/surface_gate.py` can also write the exact
|
|
mode, blob ID, size, and path inventory for one immutable candidate with
|
|
`--inventory-out`.
|
|
|
|
Path authority covers every reachable commit, including files deleted before
|
|
the tip. Removing a path from disclosure therefore requires history that does
|
|
not contain it; a deletion commit alone is insufficient. Shallow history fails
|
|
closed. Internal development history is preserved separately.
|
|
|
|
Reproduce the tree digest from a checked-out public commit with:
|
|
|
|
```sh
|
|
LC_ALL=C git ls-tree -r --full-tree HEAD^{tree} | LC_ALL=C sort | sha256sum
|
|
```
|
|
|
|
The result must equal the commit's `Tree-Digest` trailer.
|
|
|
|
## Why public history begins at the epoch
|
|
|
|
Public history starts at a single constructed commit because the history
|
|
before it was not admissible. Twenty-six commits carried an internal author
|
|
identity and one body quoted an internal registry address, and no force push
|
|
removes what a mirror has already copied.
|
|
|
|
Replaying eleven hundred commit messages through a filter would have produced
|
|
a different object graph wearing the old words, and would still have required
|
|
a person to read every one of them. The honest alternative is this one: the
|
|
development history is preserved in full inside the private forge, where it is
|
|
useful, and the public repository carries what was deliberately sent out.
|
|
|
|
The reviewed history allowlist is empty for the first time. It held forty-four
|
|
commits, and every one of them was excused for exactly the thing the epoch
|
|
removes.
|
|
|
|
Everything after the epoch commit is an ordinary publication carrying the same
|
|
three trailers, so a force push stops being routine and starts meaning that
|
|
something deliberate happened. The trailers bind a projection to its source
|
|
without pretending the public commit is the private one: same lineage,
|
|
different tree, and the record says so.
|