Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

frontend/nginx.conf

@@ -31,6 +31,14 @@ server {
         add_header Cache-Control "no-store" always;
     }
 
+    # Release/security verification fetches this exact immutable provenance asset from the served
+    # image. Keep every other dotfile denied below; only this generated, non-secret path is public.
+    location = /.well-known/modelforge-build-provenance.json {
+        include /etc/nginx/conf.d/security-headers.inc;
+        add_header Cache-Control "no-store" always;
+        try_files $uri =404;
+    }
+
     location / {
         include /etc/nginx/conf.d/security-headers.inc;
         add_header Cache-Control "no-store" always;