HECTON-8 Publication Architecture

Clean Export Git Topology

Ensures zero direct history leaks between private production and sanitized public targets.

Production (private):
Hecton8 — read-only input

Sanitization gate:
Test-H8PublicationGate.ps1

Public targets:
Hecton8-PublicSDK · Hecton8-ContribSandbox · private slices

PowerShell Gate Simulator

Generate export-gate validation commands for release profiles.

Target export profile

Mandate & Policy Matrix

Strict controls for release export safety and credential protection.

SECRET_POLICY — automated scan for API tokens & credentials
BRANCH_PROTECTION — main branch push restrictions
PATH_POLICY — portability checks across platforms
EXPORT_RECEIPTS — cryptographic manifest logging
HISTORY_POLICY — no shared production Git history
CI_SECURITY_POLICY — pinned actions, least privilege

Quick start

Clone the control plane and run the full local self-test (requires local production tree for isolation checks).

git clone https://github.com/marko1olo/Hecton8_PublicationArchitecture.git
cd Hecton8_PublicationArchitecture

powershell -ExecutionPolicy Bypass -File .\tools\Invoke-H8PublicationSelfTest.ps1

Open on GitHub README (raw)

Core gate script (Test-H8PublicationGate.ps1)

# Test-H8PublicationGate.ps1 - Automated sanitization gate validator
param (
    [Parameter(Mandatory=$true)][string]$Root,
    [Parameter(Mandatory=$true)][string]$DenyProfile,
    [string]$ReportPath
)

$denyRules = Get-Content $DenyProfile | Where-Object { $_ -and -not $_.StartsWith('#') }
$violations = @()

Get-ChildItem -Path $Root -Recurse | ForEach-Object {
    foreach ($rule in $denyRules) {
        if ($_.FullName -match $rule) {
            $violations += $_.FullName
        }
    }
}

if ($violations.Count -gt 0) {
    Write-Error "Gate Refused: Found $($violations.Count) sensitive files."
} else {
    Write-Host "Gate PASS: Clean export validated." -ForegroundColor Green
}