Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

scripts/export-public-source.mjs

@@ -24,6 +24,7 @@ if (!outputArgument) fail("Usage: node scripts/export-public-source.mjs --output
 
 const output = path.resolve(outputArgument);
 const reportPath = reportArgument ? path.resolve(reportArgument) : undefined;
+const publicSourceRepository = "https://git.example.com/example/modelforge";
 if (output === root || output.startsWith(`${root}${path.sep}`)) {
   fail("The public export must be outside the canonical repository.");
 }
@@ -55,6 +56,16 @@ const deniedPrefixes = [
   "reports/"
 ];
 
+// This owner-specific inventory collector is used only by the private portfolio audit.
+// It is not part of the product, release archive, or public source contract.
+const privateOnlyPaths = new Set([
+  ".gitea/workflows/public-source-sync.yml",
+  "scripts/portfolio_gitea_snapshot.py",
+  "scripts/portfolio_gitea_repository_ids.json",
+  "backend/tests/test_portfolio_gitea_snapshot.py",
+  "docs/operations/PORTFOLIO_GITEA_SNAPSHOT.md"
+]);
+
 // The canonical source contains useful integration examples and operational tests tied to the
 // private deployment. The public root keeps the behavior while replacing those identifiers with
 // stable documentation-only examples. Transform before scanning and before hashing the export.
@@ -119,7 +130,9 @@ const tracked = execFileSync("git", ["-C", root, "ls-files", "-z"], { encoding:
   .split("\0")
   .filter(Boolean)
   .map((entry) => entry.replaceAll("\\", "/"));
-const files = tracked.filter(selected).sort((left, right) => left.localeCompare(right, "en"));
+const files = tracked
+  .filter((relativePath) => selected(relativePath) && !privateOnlyPaths.has(relativePath))
+  .sort((left, right) => left.localeCompare(right, "en"));
 if (files.length === 0) fail("The allowlist selected no tracked files.");
 
 const findings = [];
@@ -210,5 +223,10 @@ fs.writeFileSync(path.join(output, "PUBLIC_SOURCE_EXPORT.md"),
   "This parentless candidate excludes private operational history and uses synthetic example identifiers.\n",
   "utf8");
 fs.writeFileSync(path.join(output, "PUBLIC_SOURCE_MANIFEST.json"),
-  `${JSON.stringify({ schemaVersion: 1, sourceRevision, files: manifest }, null, 2)}\n`, "utf8");
+  `${JSON.stringify({
+    schemaVersion: 1,
+    sourceRevision,
+    sourceRepository: publicSourceRepository,
+    files: manifest
+  }, null, 2)}\n`, "utf8");
 console.log(`Exported ${files.length} reviewed files to ${output}`);