HECTON-8 Publication Architecture

Control plane for HECTON-8 release engineering - release architecture, export profiles, Git topology separation, secret policies, and automated PowerShell gate validation.

---

Architectural Overview

graph TD
    A[Private Production Repo: C:\hades\Hecton8] --> B[Test-H8PublicationGate.ps1]
    B --> C[Deny Profiles & Source Classification]
    C --> D[New-H8PublicationExport.ps1]
    D --> E[Sanitized Public Export: Hecton8-PublicSDK]
    D --> F[Contributor Sandbox Repo: Hecton8-ContribSandbox]
    D --> G[Scoped Private Slice: Hecton8-PrivateSlice]

Loading

Component Matrix

Component / Directory	Role / Technology	Primary Responsibilities
tools/	PowerShell Automation	Scripts for export generation, gate testing, remote validation, preflight checks
profiles/	Policy & Gate Specs	Allow and deny rules (.allow, .deny, .c2) for target export topologies
templates/	Clean Export Layouts	Sanitized boilerplate trees for Public SDK and Contributor Sandbox exports
*.md Documents	Control Plane Mandates	Export policy, Git topology, secret policy, classification rules, runbooks

---

Original Developer Documentation

HECTON-8 Publication Architecture (Original Documentation)

This repository is a separate control plane for future public release work. It must not contain production source, production assets, vendor packages, baked data, agent logs, or project secrets.

Production project:

• C:\hades\Hecton8
• Read-only input for these tools unless a human explicitly authorizes otherwise.

Publication control repo:

• C:\hades\Hecton8_PublicationArchitecture
• Own Git history.
• Contains release architecture, export profiles, and validation scripts only.

Immediate Rule

Do not make the current production repository public.

The current project tracks vendor assets, vendor code, project settings, baked data, internal specs, agent logs, reports, build artifacts, and raw media. A public release must be generated as a clean export into a new repository with no shared Git history.

Start with:

• SOURCE_CLASSIFICATION.md
• GIT_TOPOLOGY.md
• EXPORT_POLICY.md
• RELEASE_RUNBOOK.md
• CONTRIBUTOR_FLOW.md
• CONTRACTOR_SLICE_RUNBOOK.md
• BRANCH_PROTECTION.md
• DOMAIN_OWNERSHIP.md
• PAYLOAD_POLICY.md
• EXPORT_RECEIPTS.md
• PROFILE_POLICY.md
• BOOTSTRAP_REPOS.md
• HISTORY_POLICY.md
• GIT_INDEX_POLICY.md
• SECRET_POLICY.md
• REFERENCE_POLICY.md
• WORKFLOW_POLICY.md
• LINK_POLICY.md
• PATH_POLICY.md
• CI_SECURITY_POLICY.md
• TEMPLATE_PARITY_POLICY.md

Repository Model

1. Hecton8 private production repo.
2. Hecton8-PublicSDK public sanitized repo.
3. Hecton8-ContribSandbox public or invite-only contributor repo.
4. Optional private domain repos for trusted contractors.

No public repo gets direct production history.

Main Commands

Create a publication workspace with generated repos:

powershell -ExecutionPolicy Bypass -File .\tools\New-H8PublicationWorkspace.ps1 `
  -WorkspaceRoot C:\hades\Hecton8_PublicationWorkspace `
  -Target public-sdk,contributor-sandbox `
  -InitialCommit `
  -Force

Include a scoped private slice in the same workspace:

powershell -ExecutionPolicy Bypass -File .\tools\New-H8PublicationWorkspace.ps1 `
  -WorkspaceRoot C:\hades\Hecton8_PublicationWorkspace `
  -Target public-sdk,contributor-sandbox,private-slice `
  -PrivateSliceOwner marko1olo `
  -PrivateSliceContractor contractor-name `
  -PrivateSliceDomain projectsettings `
  -PrivateSliceWorkOrder "Validate Unity version metadata against public package metadata." `
  -PrivateSliceAllowedPath "ProjectSettings/ProjectVersion.txt" `
  -InitialCommit `
  -Force

Configure remotes after GitHub repos exist:

powershell -ExecutionPolicy Bypass -File .\tools\Set-H8PublicationWorkspaceRemotes.ps1 `
  -WorkspaceRoot C:\hades\Hecton8_PublicationWorkspace `
  -AllowedGitHubOwner OWNER `
  -PublicSdkRemoteUrl https://github.com/OWNER/Hecton8-PublicSDK.git `
  -ContributorSandboxRemoteUrl https://github.com/OWNER/Hecton8-ContribSandbox.git

Remote setup accepts only exact GitHub owner/repo URLs and safe remote names (origin by default). It rejects remote names that Git could parse as options. Bootstrap commands validate each requested RemoteUrl against its AllowedRemoteUrl before creating generated repo folders, so a failed remote configuration cannot leave a half-created repo with the wrong origin.

Dry gate a tree:

powershell -ExecutionPolicy Bypass -File .\tools\Test-H8PublicationGate.ps1 `
  -Root C:\hades\Hecton8 `
  -DenyProfile .\profiles\public-sdk.deny `
  -ReportPath .\out\current-production-gate.json

Create a clean export. Default public SDK copies zero production files and overlays the public template. -TemplateRoot must point inside this control repo's templates\<target> tree; production folders are never valid templates:

powershell -ExecutionPolicy Bypass -File .\tools\New-H8PublicationExport.ps1 `
  -SourceRoot C:\hades\Hecton8 `
  -DestinationRoot C:\hades\Hecton8_PublicSDK_Export `
  -AllowProfile .\profiles\public-sdk.allow `
  -DenyProfile .\profiles\public-sdk.deny `
  -Target public-sdk `
  -TemplateRoot .\templates\public-sdk

Expected result for the current production repo: direct gate fails. That is correct. Only a clean export should pass.

Generate a static manifest:

powershell -ExecutionPolicy Bypass -File .\tools\New-H8PublicationManifest.ps1 `
  -Root C:\hades\Hecton8 `
  -DenyProfile .\profiles\public-sdk.deny `
  -ReportPath .\out\production-manifest.json

All release evidence paths (-ReportPath, preflight report directories, and port bundle output roots) must live outside the repo being scanned or reviewed. In-repo evidence paths are rejected because they create unscanned artifacts after validation.

Classify a candidate tree:

powershell -ExecutionPolicy Bypass -File .\tools\Get-H8PublicationClassification.ps1 `
  -Root C:\hades\Hecton8 `
  -DenyProfile .\profiles\public-sdk.deny `
  -CandidateProfile .\profiles\public-sdk.c2 `
  -ReportPath .\out\production-classification.json

Create a promotion record before adding a reviewed production path to an allowlist. Production Docs/ paths must be rewritten or copied into the publication template instead of selected from production:

powershell -ExecutionPolicy Bypass -File .\tools\New-H8PromotionRecord.ps1 `
  -SourceRoot C:\hades\Hecton8 `
  -Target public-sdk `
  -SourcePath Docs/QUALITY_GATES.md `
  -Owner marko1olo `
  -Reason "review public rewrite candidate"

Check Git remote policy before publishing a clean export:

powershell -ExecutionPolicy Bypass -File .\tools\Test-H8RemotePolicy.ps1 `
  -Root C:\hades\Hecton8_PublicSDK_Export `
  -AllowedRemoteUrl https://github.com/OWNER/Hecton8-PublicSDK.git

Check Git history separation:

powershell -ExecutionPolicy Bypass -File .\tools\Test-H8GitHistoryPolicy.ps1 `
  -Root C:\hades\Hecton8_PublicSDK_Export `
  -ProductionRoot C:\hades\Hecton8

Check generated repo index hygiene:

powershell -ExecutionPolicy Bypass -File .\tools\Test-H8GitIndexPolicy.ps1 `
  -Root C:\hades\Hecton8_PublicSDK_Export

Check required guard files in a generated repo:

powershell -ExecutionPolicy Bypass -File .\tools\Test-H8ExportSurface.ps1 `
  -Root C:\hades\Hecton8_PublicSDK_Export `
  -Target public-sdk

Check workflow gate coverage:

powershell -ExecutionPolicy Bypass -File .\tools\Test-H8WorkflowPolicy.ps1 `
  -Root C:\hades\Hecton8_PublicSDK_Export `
  -Target public-sdk

Check CI token and secrets exposure:

powershell -ExecutionPolicy Bypass -File .\tools\Test-H8CiSecurityPolicy.ps1 `
  -Root C:\hades\Hecton8_PublicSDK_Export `
  -Target public-sdk

Check copied gate parity across templates:

powershell -ExecutionPolicy Bypass -File .\tools\Test-H8TemplateParityPolicy.ps1 `
  -ArchitectureRoot C:\hades\Hecton8_PublicationArchitecture

Check filesystem link policy:

powershell -ExecutionPolicy Bypass -File .\tools\Test-H8LinkPolicy.ps1 `
  -Root C:\hades\Hecton8_PublicSDK_Export

Check path portability:

powershell -ExecutionPolicy Bypass -File .\tools\Test-H8PathPolicy.ps1 `
  -Root C:\hades\Hecton8_PublicSDK_Export

Check explicit ownership of guard files:

powershell -ExecutionPolicy Bypass -File .\tools\Test-H8CodeownersPolicy.ps1 `
  -Root C:\hades\Hecton8_PublicSDK_Export `
  -Target public-sdk

Check binary/large payload policy:

powershell -ExecutionPolicy Bypass -File .\tools\Test-H8PayloadPolicy.ps1 `
  -Root C:\hades\Hecton8_PublicSDK_Export

Check secret policy:

powershell -ExecutionPolicy Bypass -File .\tools\Test-H8SecretPolicy.ps1 `
  -Root C:\hades\Hecton8_PublicSDK_Export

Check private reference policy:

powershell -ExecutionPolicy Bypass -File .\tools\Test-H8ReferencePolicy.ps1 `
  -Root C:\hades\Hecton8_PublicSDK_Export

Generate an exact export receipt:

powershell -ExecutionPolicy Bypass -File .\tools\New-H8ExportReceipt.ps1 `
  -Root C:\hades\Hecton8_PublicSDK_Export `
  -Target public-sdk `
  -ReportPath .\out\public-sdk-export-receipt.json

Check export profile safety:

powershell -ExecutionPolicy Bypass -File .\tools\Test-H8ProfilePolicy.ps1 `
  -AllowProfile .\profiles\public-sdk.allow `
  -DenyProfile .\profiles\public-sdk.deny `
  -Target public-sdk

Run full preflight on a generated repo:

powershell -ExecutionPolicy Bypass -File .\tools\Invoke-H8RepoPreflight.ps1 `
  -Root C:\hades\Hecton8_PublicSDK_Export `
  -Target public-sdk `
  -AllowedRemoteUrl https://github.com/OWNER/Hecton8-PublicSDK.git

Create a generated repo end-to-end:

powershell -ExecutionPolicy Bypass -File .\tools\New-H8GeneratedRepo.ps1 `
  -Target public-sdk `
  -DestinationRoot C:\hades\Hecton8_PublicationWorkspace\Hecton8-PublicSDK `
  -TrustedOutputRoot C:\hades\Hecton8_PublicationWorkspace `
  -InitialCommit `
  -Force

Prepare an already generated repo for publish:

powershell -ExecutionPolicy Bypass -File .\tools\Publish-H8GeneratedRepo.ps1 `
  -Root C:\hades\Hecton8_PublicSDK_Export `
  -Target public-sdk `
  -AllowedRemoteUrl https://github.com/OWNER/Hecton8-PublicSDK.git

Publish targets main by default. -AllowNonMainBranch is restricted to local dry-run/<name> plans and cannot be combined with -Push.

Prepare a full generated workspace for publish:

powershell -ExecutionPolicy Bypass -File .\tools\Publish-H8PublicationWorkspace.ps1 `
  -WorkspaceRoot C:\hades\Hecton8_PublicationWorkspace `
  -Target public-sdk,contributor-sandbox `
  -PublicSdkAllowedRemoteUrl https://github.com/OWNER/Hecton8-PublicSDK.git `
  -ContributorSandboxAllowedRemoteUrl https://github.com/OWNER/Hecton8-ContribSandbox.git

Create a port bundle from a checked-out public PR branch:

powershell -ExecutionPolicy Bypass -File .\tools\New-H8PortBundle.ps1 `
  -PublicRepoRoot C:\hades\Hecton8_PublicationWorkspace\Hecton8-PublicSDK `
  -Target public-sdk `
  -BaseRef main `
  -HeadRef HEAD

Run the full local self-test:

powershell -ExecutionPolicy Bypass -File .\tools\Invoke-H8PublicationSelfTest.ps1

Create a private contractor slice:

powershell -ExecutionPolicy Bypass -File .\tools\New-H8ContractorSlice.ps1 `
  -DestinationRoot C:\hades\Hecton8_PublicationWorkspace\Hecton8-PrivateSlice `
  -Owner marko1olo `
  -Contractor contractor-name `
  -Domain projectsettings `
  -WorkOrder "Validate Unity version metadata against public package metadata." `
  -AllowedPath "ProjectSettings/ProjectVersion.txt" `
  -TrustedOutputRoot C:\hades\Hecton8_PublicationWorkspace `
  -Force

Create a contributor sandbox:

powershell -ExecutionPolicy Bypass -File .\tools\New-H8ContributorSandbox.ps1 `
  -DestinationRoot C:\hades\Hecton8_PublicationWorkspace\Hecton8-ContribSandbox `
  -TrustedOutputRoot C:\hades\Hecton8_PublicationWorkspace `
  -Force

Default contributor sandbox export copies zero production files. It overlays only the sandbox template until paths are explicitly promoted into profiles\contributor-sandbox.allow.

---

RU: Kratkoe opisanie

HECTON-8 Publication Architecture - panel upravleniya publikaciej

Hecton8_PublicationArchitecture - otdelnyy control-plane repositoriy dlya podgotovki i validacii publichnyh relizov HECTON-8. Soderzhit politiki bezopasnosti, profili filtracii i avtomaticheskie skripty PowerShell.

Klyuchevye zadachi:

1. Izolyaciya istorii: privatnyy Hecton8 ne publikuyetsya napryamuyu i ne peredaet sekrety, logi ili vendor assets.
2. Topologiya publikacii: sborka targetov Hecton8-PublicSDK, Hecton8-ContribSandbox, Hecton8-PrivateSlice.
3. Avtomaticheskaya validaciya: PowerShell-proverki sekretov, ssylok, putey, index hygiene i CI-tokenov pered publikaciey.