Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

docs/PUBLICATION.md

@@ -29,7 +29,19 @@ manifest. The canonical repository and all of its Git history remain private.
    automatically on persistent private runners. The exporter therefore removes the automatic
    `pull_request` trigger from the public copy of `managed-validation.yml` and leaves only explicit
    owner dispatch. Keep public branch protection independent of private-runner status checks until
-   a public-safe CI runner is configured.
+   a public-safe CI runner is configured on a network segment that cannot reach private
+   infrastructure.
+
+## Current publication state
+
+The parentless public repository is live at `https://git.example.com/Jens/ModelForge-Public`. Its
+protected `main` branch started with one root commit, and annotated tag `v1.2.2` points to that public
+root. Subsequent source snapshots are published from the private canonical branch only after the
+exact public candidate passes server acceptance, manifest validation and secret scanning. The public
+workflow remains owner-dispatch-only: the available server runners share the
+private LAN, so container isolation alone is insufficient for executing arbitrary fork code. A
+future automatic PR runner must also have enforced private-network egress denial; it must never use
+the private validation runner, deploy runner or host Docker socket.
 
 ## License decision