# Git Topology

Status: VERIFIED BY LOCAL SELF-TEST

## Repositories

### `Hecton8`

Private production. Contains real game source, real assets, real data, and real history.
Never make this repository public.

### `Hecton8-PublicSDK`

Public. Fresh history. Contains public contracts, placeholder examples, docs, and tests.
Generated from sanitized export plus hand-written public material.

### `Hecton8-ContribSandbox`

Public or invite-only. Fresh history. Runnable placeholder project for external PRs.
No production assets, no production scenes, no production settings.

### Private Contractor Slices

Private. Fresh history. One scoped domain per repo when needed.

## Branches

Production:

- `main`: protected, releasable state only.
- `dev`: integration staging.
- `domain/<name>`: scoped internal work.
- `release/<version>`: release stabilization.

Public SDK:

- `main`: protected public release.
- `next`: pending public changes.
- `contrib/<topic>`: maintainer-owned branches only.

Contributor Sandbox:

- `main`: protected runnable baseline.
- `sample/<topic>`: examples.

## Protections

Required on every collaborative repo:

- no force push to protected branches;
- PR review required;
- status checks required;
- CODEOWNERS once owners exist;
- signed commits optional but preferred for private production;
- secret scanning enabled;
- branch deletion restricted.

## History Rule

Public repos must be initialized from a sanitized folder with `git init`.
Do not push production `.git` history. Do not use `git filter-repo` as the primary
plan for public release; history rewriting is a cleanup tool, not a trust boundary.

Run `tools/Test-H8GitHistoryPolicy.ps1` before first push. A generated repo must
have `sharedCommitCount = 0` against production.
Git alternates, commondir indirection, worktrees, and submodule object stores are
not clean separation.

## Remote Policy

Before pushing a generated repo, run:

```powershell
powershell -ExecutionPolicy Bypass -File .\tools\Test-H8RemotePolicy.ps1 `
  -Root C:\hades\Hecton8_PublicSDK_Export `
  -AllowedRemoteUrl https://github.com/OWNER/Hecton8-PublicSDK.git
```

This blocks the current private production remote and any remote that does not
match the exact approved public repository.
Production remote variants are blocked by canonical GitHub owner/repo, not only
by a literal `.git` URL suffix.
Wildcard `AllowedRemotePattern` checks are legacy diagnostics only. If a repo has
any remote, exact `AllowedRemoteUrl` is required.
Publish/setup tooling only accepts safe remote names (`origin`-style alphanumeric
names with `.`, `_`, `-`). Values that can be parsed as Git options are rejected
before any `git remote` or `git push` call.
Bootstrap tooling validates requested remotes before materializing generated
repo folders. A mistyped owner/repo must fail before `git init` or `git remote
add`, not after preflight.

## Publish Branch Rule

Workspace publish targets `main` only. Per-repo publish plans may use
`-AllowNonMainBranch` only for `dry-run/<name>` branches and only without `-Push`.
Branch names that look like full refs (`refs/...`), tags, options, whitespace, or
raw refspecs are rejected before Git is invoked.

## Integration Direction

```text
public PR -> public review -> maintainer ports by hand -> private branch -> production review
```

There is no bot that auto-merges public code into production.