publish-manifest.txt

# publish-manifest.txt — exclusion list consumed by scripts/publish.sh
#
# One glob/path per line (relative to repo root), matched against the git
# archive staging tree with `rsync --exclude-from` semantics (trailing "/"
# excludes a whole directory; no trailing "/" excludes an exact path or,
# with a leading "*", any basename match). Blank lines and lines starting
# with "#" are ignored.
#
# Every line exists to neutralize one or more scrub-check.sh findings on
# the private tree (105 findings on 2026-08-06: 64 PII + 41 rebrand-in-
# historical-files). Where a file's *content* is needed publicly but its
# PII is not, prefer scripts/publish-transforms.d/ over exclusion — but
# per the transform-drift-risk tradeoff, exclusion wins whenever the file
# is either (a) pure internal history/audit trail, or (b) a personal tool
# whose entire content is specific to this maintainer's machine/directory
# layout and would not be meaningfully reusable even after scrubbing.

# --- Internal audit / working trees — never part of a public artifact ----
audit-reports/
work/

# --- Runtime observation data — regenerated per-machine, never shipped ---
# improvement-ledger.json is the one exception that ships: it carries the
# schema/versioning contract other tooling reads. It contains 300+ dated
# PII/rebrand findings in its historical entries (real names, project
# codenames, absolute machine paths quoted verbatim as evidence in old
# IMP write-ups) that cannot be safely regex-scrubbed without corrupting
# the JSON, so publish-transforms.d/10-ledger-stub.sh replaces it with a
# schema-valid, content-empty stub instead of excluding it outright.
global-observation/*.jsonl
global-observation/token-counter.json
# NOTE: improvement-ledger.json is intentionally NOT excluded here — it
# survives to staging and is then replaced with a schema-valid, content-
# empty stub by publish-transforms.d/10-ledger-stub.sh (see that script's
# header for why it's a transform and not an exclusion).

# --- Personal automation config: machine-specific mount points / usernames
# roots.txt / git-roots.txt are the REAL (gitignored, untracked today)
# config a user generates locally; the *.example siblings are tracked and
# ship literal personal paths (/Users/your-username, /Volumes/YourExternalVolume)
# as "examples" — excluding rather than transforming because a scrubbed
# example is not obviously more useful than no example (the point of an
# .example file is a copy-edit target, not documentation prose).
scheduled-tasks/daily-docs/bin/roots.txt
scheduled-tasks/daily-docs/bin/roots.txt.example
scheduled-tasks/daily-docs/bin/git-roots.txt
scheduled-tasks/daily-docs/bin/git-roots.txt.example
bin/git-roots.txt
bin/roots.txt

# --- Personal meta-intelligence tools — hardcoded to this maintainer's
# specific external-volume layout (COWORK, ~49 named projects, a Notion-
# adjacent ledger tree under /Volumes/YourExternalVolume). Not a generic
# capability once scrubbed — the paths and project registry ARE the tool.
skills/ledger-entry/
skills/meta-intelligence/

# --- Local-only settings / secrets-adjacent config ------------------------
*.local.*
settings.local.json

# --- Plugin install-state — machine-specific absolute cache paths --------
plugins/installed_plugins.json
plugins/known_marketplaces.json

# --- Internal, dated planning docs — not user-facing documentation -------
docs/superpowers/specs/

# --- Agent-to-agent handoff docs — release scaffolding naming real
# identities, machines, and repo internals; never part of a public artifact.
docs/HANDOFF-*

# --- Private IMP history — replaced by a public stub (see transforms) ----
# The full CHANGELOG.md narrates internal improvement-cycle history (IMP-*
# numbers, rebrand-in-progress commentary, the pre-rebrand project's old
# codename used throughout) that predates the public artifact model itself.
# publish-transforms.d/20-changelog.sh generates a minimal public
# CHANGELOG.md pointing at GitHub Releases instead.
CHANGELOG.md