@bongos/core 1.21.175 → 1.21.176

package/scripts/bongos/publish-manifest.js

@@ -0,0 +1,440 @@
+#!/usr/bin/env node
+'use strict';
+
+// scripts/bongos/publish-manifest.js — the Cloud Bongos public-mirror PUBLISH BOUNDARY.
+// GDS-V4 R71 (task 1210), implementing ADR 0065 §4 + ADR 0062 §1. This is the single,
+// machine-readable source of truth for "what is publishable to the open-source mirror
+// vs permanently excluded." The delayed-export pipeline (R72/#1211) CONSUMES
+// isPublishable() to select the subtree it exports; the lineage/no-leak proof
+// (R73/#1212) ASSERTS that nothing the denylist forbids ever reached the mirror.
+//
+// DESIGN — default-deny, two-layer (see ADR 0098):
+//   1. PUBLISH_ALLOWLIST is the PRIMARY gate. A path publishes ONLY if it matches the
+//      allowlist — a file in no allowlisted subtree is silently NOT published. A new,
+//      unclassified top-level surface therefore never leaks by omission.
+//   2. PUBLISH_DENYLIST is a HARD override applied first (defense-in-depth): even a path
+//      that falls inside an allowlisted subtree is dropped if the denylist forbids it.
+//   isPublishable(p)  ==  matchesDeny(p) ? false : matchesAllow(p)
+//
+// REUSE, NEVER RE-TYPE (the task's explicit instruction; the gate-review.js doctrine):
+//   The three canonical sensitive-surface inventories are IMPORTED, never copied —
+//   PROTECTED_GLOBS (write-protection over trust/pipeline/infra code),
+//   HARD_FLOOR_GLOBS (the rank-independent escalate subset), and
+//   SENSITIVE_DOC_GLOBS (read-gating over the security/audit doc corpus).
+//   Critically, PROTECTED_GLOBS is NOT a denylist: ADR 0065 §4 PUBLISHES the
+//   trust-boundary / rank / ship-grade machinery as the open-source methodology core.
+//   Only the *topology* subset of the protected surfaces (prod infra, deploy, CI, the
+//   local gate hooks) is excluded — see PROTECTED_TOPOLOGY_EXCLUDE. tests/publish_manifest.mjs
+//   cross-checks the partition against the live inventory so it cannot silently drift.
+
+// The three canonical sensitive-surface inventories — imported from their homes,
+// NEVER re-typed (the gate-review.js "imported, never hand-retyped" doctrine). All
+// three are pure to require (no DB/network at load; their CLIs are require.main-guarded).
+const { PROTECTED_GLOBS, globToRegExp } = require('../../src/bongos/permission-path-check');
+const { HARD_FLOOR_GLOBS } = require('./gate-review');
+const { SENSITIVE_DOC_GLOBS } = require('./search-ingest-md');
+
+// ---------------------------------------------------------------------------
+// PUBLISH_ALLOWLIST — the portable core + platform (ADR 0065 §4 "Published",
+// ADR 0062 §1 core column). Subtree granularity: 1210 defines the BOUNDARY; R72
+// adds the file-level redaction of instance literals inside these subtrees.
+// ---------------------------------------------------------------------------
+const PUBLISH_ALLOWLIST = [
+  // --- the GDS platform + the instance-model engine ---
+  'src/',                 // platform engine + GDS core (the game residue is denied below)
+  'scripts/',             // build + methodology tooling (deploy is denied below)
+  'bin/',                 // the `cloudbongos`/`bongos` CLI entrypoint
+  // NB: repo-root server.js is the GAME+platform entry (top-level require('colyseus'),
+  // a pruned core dep) — HOST-excluded in CONTENT_EXCLUDE below; the core boots
+  // game-less via src/platform-server.js (package-core sets that as `main`). task 2134.
+  // --- the build system's shared schema + its tests ---
+  'migrations/',
+  'tests/',
+  // --- platform-core feature modules (engine; instance flavor comes from the brand pack) ---
+  'modules/lifecycle/',
+  'modules/grading/',
+  'modules/economy/',
+  'modules/memory/',
+  'modules/onboarding/',
+  'modules/ideas/',
+  'modules/builder-settings/',
+  'modules/sessions/',
+  'modules/autonomy/',
+  'modules/security/',
+  'modules/government/',     // the same machinery under its post-ADR-0174 name (goal 1000068, task 1003003). Added in lockstep with the protected-surfaces.json entry: publish_manifest asserts every PROTECTED_GLOB is either topology-excluded or publishable, so registering the glob as protected WITHOUT this line default-denies the module from the published core — the open-source methodology would silently lose its permission machinery at the next release.
+  'modules/specialities/',  // role sub-specialities (task 1003855, ADR 0296). default:true, so it MUST be here, and the copy-desk asymmetry above applies verbatim: the settings panel ships regardless because modules/hall-ui/ is allowlisted as one subtree, so omitting this line would put a "Your specialities" section in every instance's settings page whose every call 404s.
+  'modules/page-notes/',     // the artist's page feedback docs (task 1004496). default:true, and the same hall asymmetry: page-notes.js and the Artistry palette ship inside modules/hall-ui/, so a core without these routes would put a button in every hall whose every call 404s.
+  'modules/copy-desk/',      // the artist's loop over user-facing TEXT (goal 1000074, ADR 0178). default:true, so it MUST be here — and note the ASYMMETRY that makes omitting it worse than useless: its hall surface ships regardless, because modules/hall-ui/ is allowlisted as one subtree. A released core carrying the page and the nav entry but not the routes behind them puts a tab in every instance's hall whose every call 404s. The module and its page are only ever added or removed together; tests/publish_manifest.mjs holds that pair.
+  'modules/ui-design/',      // the design contract + its adapters/CLIs + the /design playbook (task 1003324, ADR 0197). default:true, so it MUST be here: a released core without it would materialize skills (design, design-sync, figma-design-sync) whose CLIs and adapters do not exist.
+  'modules/design-styles/',  // the thirteen opt-in design-style skills split out of ui-design (task 1004470). default:false, but MUST be here: shipped is not enabled, and a released core without it hands an instance that turns it on an "unknown module" with nothing to materialize. Skill text only.
+  'modules/pixel-art/',      // the five opt-in pixel-art skills (task 1004470), which shipped from .claude/skills/ before this. default:false. SKILL.md text only — never a reference map, a palette or generated art: those are modules/art-pipeline/, which CONTENT_EXCLUDE keeps out below for the copyright reason (ADR 0098).
+  'modules/hall-ui/',
+  'modules/status-ui/',
+  'modules/public-landing/', // the front door (task 1003322, ADR 0218) — the repo-root public-landing/ entry this replaces was always here, and for the same reason: default:true, and it is the only thing an instance serves at its apex root. Omit it and a released core answers the game-less 404 tail on its own home page.
+  'modules/discord/',
+  'modules/provisioning/',   // instance-hosting control plane — CORE (its do-api toolchain is core). Reclassified IN so the core CLI scripts/bongos/provision.js resolves it from the core package post-split, not a MODULE_NOT_FOUND (task 2135). default:false — shipped ≠ enabled.
+  'modules/agents/',         // the declarative agent registry + spawn seam (goal 1000038) — CORE: its own manifest declares maintenance.status 'core-maintained', and it consumes the core `grade` port, so a released core without it cannot run the MAS machinery the methodology describes. default:false — shipped is not enabled (ADR 0083), exactly like provisioning + platform-identity below. Omitted at module-creation time (tasks 1002485/1002486): the omission was invisible until tests/agents_spawn.mjs became the first PUBLISHABLE file to import it and the R89 boundary guard caught it (task 1002489).
+  'modules/npm-release/',    // the deploy page's "where is the work" + version history (task 1002622). default:false — on only in the hall that publishes the core. MUST be here: modules/hall-ui/ ships as one subtree, so a released core without this carries deploy.js's loader and the #nr-work mounts with no routes behind them — the copy-desk asymmetry above.
+  'modules/render-deploy/',  // the deploy page of a project whose app deploys through Render (task 1004270). default:false. MUST be here for the npm-release reason: modules/hall-ui/ ships as one subtree, so a released core without it carries deploy.js's loader for #rd-panel with no routes behind it.
+  'modules/raise/',           // the /raise investor page (task 1004847, ADR 0384) — ships in core, enabled ONLY on the hub, like platform-identity. Owner decision 2026-10-25: the whole page, its copy and starting numbers included, lives in the repo so builders can contribute to it, accepting that it publishes with the core. Secrets never do: the investor password is RAISE_PASSWORD_HASH in the instance env. default:false.
+  'modules/platform-identity/', // hub identity provider (ADR 0141) — ships in core, enabled ONLY on the hub (cloudbongos.com). MUST be here or the hub's enabledModules() throws "unknown module" and provision.js's federation load MODULE_NOT_FOUNDs (task 1002235, same rationale as provisioning above). default:false — shipped ≠ enabled; a vanilla/self-hosted instance never turns it on.
+  // --- neutral (customer-0) config starters + their schemas (the filled-in *.json twins are denied) ---
+  'config/branding.neutral.json',
+  'config/modules.neutral.json',
+  'config/design-tokens.neutral.json',
+  'config/design-tokens.schema.json',  // the design-token contract (generic schema, no instance values)
+  'config/hierarchy.neutral.json',
+  'config/government.neutral.json',     // the starting rank templates a fresh instance inherits (BV1.R96; renamed from governance.neutral.json by ADR 0174)
+  'config/scheduled-routines.json',     // the routine SWITCHBOARD (ADR 0115) — per routine: enabled, cadence, requiresAutonomy. It carries no *.neutral.json twin because it IS the neutral starter: ADR 0115's contract is that "a fresh instance inherits this whole set from the core template", and the operator then opts in/out HERE. PUBLISHES rather than topology-excludes for that reason — a released core without it would hand a new instance an empty scheduler and no record of what the routines under .claude/scheduled-tasks/ are for. It reached this list when task 1002500 registered it as a protected surface, which forces the choice; before that it was default-denied by silence, which is the accident that rule exists to catch.
+  // --- the portable methodology core, governance, and sanitized docs ---
+  'CLAUDE.md',
+  'README.md',
+  'LICENSE',
+  'GOVERNANCE.md',
+  'GOVERNMENT.md',                   // the plain-language guide to a project's own government (task 1004659)
+  'CONTRIBUTING.md',
+  'CODE_OF_CONDUCT.md',
+  'docs/adr/',                       // sanitized — ADR 0065 §4 "docs/ADRs (sanitized)"
+  'docs/recipes/',                   // portable METHODOLOGY recipes only; project-specific ones (art/staging/load-test/standup/decouple) are denied below — task 2153
+  'docs/design/',
+  'docs/research/',
+  'docs/architecture.md',
+  // Served to the hall / advertised by /api/bongos — a standalone that omits these
+  // renders broken onboarding + API-reference pages (task 2078). Redacted like the
+  // rest of this docs section. Only the diagram .mmd SOURCES ship: the .png/.svg are
+  // gitignored (ADR 0122) so the tarball cannot carry them, and `bongos upgrade`
+  // regenerates them on the box via healDocAssets() (upgrade.js, task 1002441).
+  'docs/onboarding/',                // primer.md + drachmae-and-karma.md + diagram sources (/builders/primer · /drachmae · /diagrams)
+  // API artifacts (classification settled, task 2141): CORE-shipped STARTERS so a fresh
+  // hall/docs render before first regen — but per-instance GENERATED. init + `bongos
+  // upgrade` regenerate them INTO the instance. They ship; they are not a monolith-only
+  // artifact. Since task 1004866 they are gitignored in the core repo, so package-core.js
+  // GENERATES them into the tarball from the routes it packs (it does not find them in git).
+  'docs/api/openapi.json',           // the generated OpenAPI 3.1 spec served at /docs/openapi.json
+  'docs/api-reference.md',           // the markdown API reference
+  'docs/modules-contract.md',
+  // The doorway's release ledger (ADR 0203). It USED TO ship inside
+  // src/module-api.js as a comment block, so an instance that installs
+  // @bongos/core has always received it; omitting it here would silently drop
+  // the history from the package at the next release. A module author checking
+  // what a `coreVersion` floor actually buys them reads exactly this file.
+  'docs/module-api-changelog.md',
+  'docs/branding-contract.md',
+  'docs/branding-fill-prompt.md',
+  // RUNTIME DATA that happens to live under docs/, not documentation (ADR 0178).
+  // modules/copy-desk reads the registry on EVERY queue load, and nothing on a
+  // deployed box regenerates it — copy-inventory.js is a commit-it generator run
+  // against a source tree, which an instance does not have. Omit these and a
+  // released instance answers 503 registry_missing forever. They sit under docs/
+  // only because that is where their generator has always written them.
+  'docs/copy-registry.json',
+  'docs/copy-inventory.md',          // the human twin, generated in the same pass
+  // Tweak Mode's two page artifacts (ADR 0341 D1, task 1004316), the same kind
+  // of runtime data: modules/copy-desk/page-data.js reads both on every page
+  // status read, and neither generator can run on a deployed box (the reader
+  // opens a browser against a source tree). Without the inventory an instance
+  // answers 503 page_inventory_missing; without the readings drift reads unknown.
+  'docs/page-inventory.json',
+  'docs/page-readings.json',
+  'docs/file-map.md',
+  'docs/repo-map.md',
+  'docs/handoff-template.md',         // the portable session-handoff format (methodology)
+  // The ROLE PACKS (task 1002990). docs/ is default-deny, and these are not
+  // documentation ABOUT the methodology — they ARE it: since the kernel/pack split
+  // the root CLAUDE.md is role-neutral and everything a craft actually works from
+  // lives here. scripts/bongos/discipline-modes.json ships (scripts/ is allowlisted)
+  // and names these paths, so omitting them would release a core whose every claim
+  // prints a pack path that resolves to nothing on the instance — the exact silent
+  // failure scripts/bongos/role-pack-guard.js exists to make loud. The registry and
+  // this line are only ever added or removed together.
+  'docs/packs/',
+  'docs/canonical-permissions.md',   // the rank-ladder reference IS the methodology (sanitized)
+  'docs/project-context.template.md', // the neutral scaffold `cloudbongos init` fills (NOT the OTB-filled one)
+  '.claude/skills/',                 // the methodology slash-commands (hooks/settings are denied below)
+  // --- container + repo scaffolding (examples only; real secrets are denied) ---
+  'Dockerfile',
+  'docker-compose.yml',
+  'docker-entrypoint.sh',
+  '.dockerignore',
+  '.env.local.example',
+  '.gitignore',
+  '.gitattributes',
+  'package.json',
+  'package-lock.json',
+  // --- served-at-runtime app assets a standalone MUST carry (task 2078) ---
+  // The generated typed API client is served at /lib/bongos-client.js as
+  // window.BongosClient; shell.js + builders.js call it at the TOP of every hall
+  // page, so its absence from the core package threw immediately and blanked the
+  // whole UI. Only the committed files publish — clients/bongos-client/dist/ is
+  // gitignored, so it never enters the git tree package-core reads.
+  'clients/bongos-client/',
+  'public-docs/',                    // the self-hosted API-reference site (/docs): Redoc host page + vendored renderer
+];
+
+// ---------------------------------------------------------------------------
+// PUBLISH_DENYLIST — hard exclusions, applied BEFORE the allowlist. Four rationales.
+// ---------------------------------------------------------------------------
+
+// (1) TOPOLOGY — the subset of the *protected* surfaces that is prod operational infra,
+//     the deploy machinery, CI, and the local gate hooks/settings. The REST of
+//     PROTECTED_GLOBS (auth, permission code, the grader, ship.js, migrations, CLAUDE.md…)
+//     is the trust/rank machinery that ADR 0065 §4 PUBLISHES. Every entry here MUST be a
+//     verbatim member of PROTECTED_GLOBS — tests/publish_manifest.mjs asserts it, so this
+//     list cannot drift out of sync with the live inventory.
+const PROTECTED_TOPOLOGY_EXCLUDE = [
+  'infra/',
+  'scripts/deploy/',
+  'config/deploy.json',
+  '.github/',
+  '.husky/',
+  '.claude/hooks/',
+  '.claude/settings.json',
+];
+
+// (2) READ-SENSITIVE DOCS — the security/audit corpus, derived from SENSITIVE_DOC_GLOBS.
+//     (canonical-permissions.md + the trust-boundary ADRs 0016/0043 are NOT excluded here:
+//      they are the methodology and publish sanitized — they live under the docs allowlist.)
+const SENSITIVE_DOC_EXCLUDE = SENSITIVE_DOC_GLOBS.filter(
+  (g) => g.startsWith('docs/security') || g.startsWith('docs/audits')
+);
+
+// (3) CONTENT / COPYRIGHT — the game and ALL art. art-pipeline carries the 83 ripped
+//     Pokémon FireRed reference maps (modules/art-pipeline/references/), an independent
+//     hard copyright reason to never publish the art subtree under an AGPL mirror.
+//     brand/ holds instance brand packs — including the customer-0 Cloud Bongos pack,
+//     whose publication is DEFERRED to R72/owner (excluded by default until then).
+const CONTENT_EXCLUDE = [
+  'modules/game/',
+  'modules/art-pipeline/',
+  'modules/character-anim/',
+  'art/',
+  'brand/',
+  'public/',                 // the game front-end (Phaser)
+  'src/world/',
+  'src/rooms/',
+  'src/preview-server.js',
+  'server.js',               // repo-root game+platform entry: top-level require('colyseus') (a pruned core dep) → un-runnable in the game-less package; the core boots via src/platform-server.js. Mirrors src/preview-server.js. (task 2134)
+  // the art feature's CLI tooling lives under scripts/ (legacy top-level) but belongs
+  // to the excluded art module — exclude it with the feature it serves.
+  'scripts/art/',
+  'scripts/bongos/art-stage.js', // art sandbox-staging CLI: requires modules/art-pipeline's build_tilesheet.py; excluded with the art feature it serves so a core file never requires an excluded module (task 2135)
+  'scripts/tile-add.js',
+  'scripts/tile-find.js',
+  'scripts/tile-recommend.js',
+  // The art pipeline's operational RECIPE — belongs to the excluded art module; exclude it
+  // with the feature it serves (mirrors scripts/art/ above). docs/recipes/ is allowlisted
+  // wholesale, so this deny is what keeps the game-art recipe out of a non-art core. (task 2153)
+  'docs/recipes/pixel-art-pipeline.md',
+  // Host-feature TESTS that statically import an EXCLUDED module's source. tests/ is
+  // allowlisted (the platform/methodology suite is core), but these cover the game/art
+  // HOST modules and import their source directly — so package-core (which selects via
+  // isPublishable) would ship them WITHOUT the module they need → MODULE_NOT_FOUND when a
+  // core CI/consumer runs them, and the R89 cutover would DELETE OTB's own game/art tests
+  // (they cover kept host modules; they cannot live in core). Exclude each with the feature
+  // it serves — mirrors scripts/bongos/art-stage.js above. The guard in tests/publish_manifest.mjs
+  // derives this set from disk and fails if a new host-module test is added but not listed. (task 2147)
+  'tests/walkability.mjs',     // → modules/game/world
+  'tests/terrain_picker.mjs',  // → modules/game/public/game/world
+  'tests/snapshot_picker.mjs', // → modules/game/public/game/world
+  'tests/sprite_facing.mjs',   // → modules/game/public/game/player
+  'tests/turn_in_place.mjs',   // → modules/game/public/game/player
+  'tests/day_cycle.mjs',       // → modules/game/public/game/fx
+  'tests/art_key.mjs',         // → modules/art-pipeline
+];
+
+// (4) INSTANCE IDENTITY + HISTORY — this host's literals, ops config, build history, and
+//     local secrets. The neutral.* config twins and the *.template docs ARE published.
+const INSTANCE_EXCLUDE = [
+  // filled-in instance config (the *.neutral.* / *.template twins publish)
+  'config/branding.json',
+  'config/modules.json',
+  'config/devbox-app.json',
+  'config/hierarchy.json',
+  'config/government.json',
+  'CODEOWNERS',              // names the owner (a protected surface, excluded as identity)
+  // instance SEED migrations — this host's scope-truth SQL (planning seeds, world data).
+  // ADR 0105: a consumer's core must not carry them; migrate.sh reads instance seeds from
+  // resolveInstanceRoot() (SEED_INSTANCE), so the consumer repo owns them. Core migrations
+  // (migrations/core_NNN_*.sql + bare legacy migrations/NNN_*.sql) still publish. (task 2140)
+  'migrations/instance/',
+  // instance-specific docs + project history
+  'docs/project-context.md',
+  'docs/lore/',
+  'docs/session-logs/',
+  'docs/session-log-index.md',
+  'docs/session-log-archive.md',
+  'docs/handoffs/',
+  'docs/reviews/',
+  'docs/discord/',
+  'docs/google-chat-broadcast.md',
+  'docs/pms-v1-deploy.md',
+  'docs/graphics-stress-test-plan.md',
+  'docs/security-baseline.md',
+  'docs/routes-permissions.md',
+  // instance-specific OPERATIONAL recipes — this host's staging + load-test artifacts, its
+  // specific control-plane / vanity-door standups, and its one-time monolith-decouple runbook.
+  // docs/recipes/ is allowlisted wholesale for the PORTABLE methodology recipes; these teach
+  // nothing a different instance would use, so they stay in this repo and never ship in the
+  // core (mirrors migrations/instance above). Redaction only de-brands them — this stops the
+  // irrelevant-noise at the source. The module-owned RECIPE redesign is deferred (idea 536). (task 2153)
+  'docs/recipes/staging-data.md',
+  'docs/recipes/parallel-load-test.md',
+  'docs/recipes/parallel-load-results-2026-05-30.md',
+  'docs/recipes/claude-gemini-bongos-doors.md',
+  'docs/recipes/cloudbongos-standup.md',
+  'docs/recipes/cloudbongos-staging-gate.md',
+  'docs/recipes/amazonprimea-decouple-r89.md',
+  'docs/recipes/amazonprimea-decouple-rollback-r89.md',
+  // instance-specific GAME-DESIGN specs — this host's pixel-art / level briefs (the container
+  // buildings, its palette, the world-map scroll). docs/design/ is allowlisted wholesale for the
+  // PORTABLE design docs (modular-architecture/*, the vanilla-hall-ui redesign scope); these four
+  // describe THIS instance's game and genericize to nothing, so they stay in this repo and never
+  // ship in the core. Redaction only de-brands NAMES — the world-narrative prose in them is not a
+  // name and survives redaction, so exclude at the source (mirrors the recipe carve-out above). (task 2155)
+  'docs/design/container-exterior.md',
+  'docs/design/container-exterior-tiles.md',
+  'docs/design/container-interior.md',
+  'docs/design/world-map-scroll.md',
+  // instance-specific UI MOCKUPS — iteration snapshots of THIS instance's own hub (hub v1/v2/v3,
+  // the wizard, the projects hub, the world chrome), branded end to end in markup a consumer of
+  // the portable core has no use for: they are our design history, not methodology. Same reason as
+  // the game-design carve-out above, and the same failure mode — redaction de-brands names in DOCS,
+  // but an .html is a FUNCTIONAL file that ships verbatim, so every brand string in the mock markup
+  // reached the published artifact. They were 117 of the 240 remaining leak-scan hits. Excluding the
+  // subtree rather than the six files is deliberate: it is the boundary that holds when someone adds
+  // mockup number seven. (task 1003869)
+  'docs/design/mocks/',
+  // instance-HISTORY ADRs (task 1002219 / audit H5). These record THIS platform-family's own
+  // migration + identity history (the amazonprimea→cloudbongos lift, the standalone reprovision,
+  // the cloudbongos identity hub) — they are inherently full of the prior instance's name/owner and
+  // genericize to nothing (unlike a portable methodology ADR). docs/adr/ is allowlisted wholesale for
+  // the portable decision records; these three stay in this repo and never ship in the core, mirroring
+  // the instance-recipe / game-design carve-outs above. (The portable ADRs + the README index still publish.)
+  // The instance's OWN name + trademark decision. Its prose redacts cleanly, but the FILENAME
+  // carries the brand and the publish manifest lists every path — so the literal shipped in
+  // .bongos-core.json no matter how well the body was redacted. It also genericizes to nothing:
+  // "accepting trademark risk on <our name>" is not a decision another instance inherits.
+  // (task 1003869 — the last literal in the artifact.)
+  'docs/adr/0004-amazonprimea-name-and-trademark-acceptance.md',
+  'docs/adr/0139-platform-history-migration-to-cloudbongos.md',
+  'docs/adr/0140-cloudbongos-standalone-reprovision.md',
+  'docs/adr/0141-cross-site-identity-federated-hub-idp.md',
+  // hall-preview FIXTURES (task 1002219 / audit H5) — the local hall-UI preview harness's sample
+  // data is a snapshot of THIS instance's builders/goals/tasks (owner login, world name, prior
+  // instance name), pure instance identity. The harness code stays portable; only the OTB data is
+  // carved out, so a consumer core never ships customer-zero's directory. (Fixtures remain in-repo
+  // for local dev — this only affects what package-core publishes.)
+  'scripts/hall-preview/fixtures/',
+  'blockers/',
+  'limitations/',
+  'generative-ideas.md',
+  // local secrets / real env (the *.example publishes; the real files never do)
+  '.env',
+  '.env.local',
+  '.env.production',
+  '.claude/settings.local.json',
+  '.claude/worktrees/',
+];
+
+// (5) BUILD ARTIFACTS — generated bundles that live inside an allowlisted subtree.
+//     The committed clients/bongos-client/ files publish (task 2078); its dist/ is a
+//     gitignored rebuild output (so package-core never sees it) — deny it too so the
+//     boundary stays self-consistent if it is ever un-ignored (deny-wins layer).
+const BUILD_ARTIFACT_EXCLUDE = [
+  'clients/bongos-client/dist/',
+];
+
+const PUBLISH_DENYLIST = [
+  ...new Set([
+    ...PROTECTED_TOPOLOGY_EXCLUDE,
+    ...SENSITIVE_DOC_EXCLUDE,
+    ...CONTENT_EXCLUDE,
+    ...INSTANCE_EXCLUDE,
+    ...BUILD_ARTIFACT_EXCLUDE,
+  ]),
+];
+
+// ---------------------------------------------------------------------------
+// Matching — reuse the canonical glob→RegExp from permission-path-check so the publish
+// boundary speaks exactly the same glob dialect as the trust boundary (trailing '/' =
+// subtree, '**' across separators, '*' within a segment, otherwise an anchored literal).
+// ---------------------------------------------------------------------------
+const ALLOW_RE = PUBLISH_ALLOWLIST.map(globToRegExp);
+const DENY_RE = PUBLISH_DENYLIST.map(globToRegExp);
+
+// Normalize a path the way git reports it (forward slashes, no leading './').
+function normalize(p) {
+  return String(p || '').replace(/\\/g, '/').replace(/^\.\//, '').trim();
+}
+
+function matchesAny(relPath, regexes) {
+  const f = normalize(relPath);
+  if (!f) return false;
+  return regexes.some((re) => re.test(f));
+}
+
+const matchesAllow = (relPath) => matchesAny(relPath, ALLOW_RE);
+const matchesDeny = (relPath) => matchesAny(relPath, DENY_RE);
+
+// Is this repo-relative path eligible for the public mirror? Deny wins; default-deny.
+function isPublishable(relPath) {
+  const f = normalize(relPath);
+  if (!f) return false;
+  if (matchesDeny(f)) return false;
+  return matchesAllow(f);
+}
+
+// Split a list of repo-relative paths into { publish, exclude }. The shape R72's export
+// pipeline iterates and R73's proof audits.
+function partitionPaths(relPaths) {
+  const publish = [];
+  const exclude = [];
+  for (const p of relPaths || []) {
+    (isPublishable(p) ? publish : exclude).push(normalize(p));
+  }
+  return { publish, exclude };
+}
+
+module.exports = {
+  PUBLISH_ALLOWLIST,
+  PUBLISH_DENYLIST,
+  PROTECTED_TOPOLOGY_EXCLUDE,
+  SENSITIVE_DOC_EXCLUDE,
+  CONTENT_EXCLUDE,
+  INSTANCE_EXCLUDE,
+  isPublishable,
+  matchesAllow,
+  matchesDeny,
+  partitionPaths,
+  normalize,
+  // re-exported so consumers + the test see the exact inventories this manifest reused
+  PROTECTED_GLOBS,
+  HARD_FLOOR_GLOBS,
+  SENSITIVE_DOC_GLOBS,
+};
+
+// CLI: `node scripts/bongos/publish-manifest.js <path> [<path> …]` prints publish|exclude
+// per path; `--list` prints the allowlist + denylist. A quick human/debug surface; R72
+// imports the functions above rather than shelling out.
+if (require.main === module) {
+  const args = process.argv.slice(2);
+  if (args.length === 0 || args[0] === '--help' || args[0] === '-h') {
+    console.log('usage: node scripts/bongos/publish-manifest.js <repo-relative-path> [...]   # classify paths');
+    console.log('       node scripts/bongos/publish-manifest.js --list                       # print the boundary');
+    process.exit(args.length === 0 ? 2 : 0);
+  }
+  if (args[0] === '--list') {
+    console.log('PUBLISH_ALLOWLIST:');
+    for (const g of PUBLISH_ALLOWLIST) console.log(`  + ${g}`);
+    console.log('\nPUBLISH_DENYLIST:');
+    for (const g of PUBLISH_DENYLIST) console.log(`  - ${g}`);
+    process.exit(0);
+  }
+  let anyExcluded = false;
+  for (const p of args) {
+    const ok = isPublishable(p);
+    if (!ok) anyExcluded = true;
+    console.log(`${ok ? 'publish' : 'exclude'}\t${normalize(p)}`);
+  }
+  process.exit(anyExcluded ? 1 : 0);
+}