{
  "version": 2,
  "rationale": "What the curated public GitHub mirror carries (mirror: curated, #1631/#1594). GitLab stays the full private repo; scripts/github-export.mjs builds one snapshot commit holding only paths under 'include', minus every 'exclude' path, and check-owner-leakage.mjs --public-export fails if any other tracked path survives. Each path is an exact file or a directory prefix ending in '/'; no globs. A new top-level path stays private until it is added to 'include'. Version 2 marks the allow-list: an exporter that knows only version 1 (deny-only) refuses this file instead of ignoring 'include'.",
  "include": [
    { "path": ".agents/", "reason": "Agent skill entry points that Codex and other AGENTS-aware installers read from the GitHub repository.", "issue": "#1594" },
    { "path": ".claude-plugin/", "reason": "Claude Code plugin and marketplace manifest; the Claude Code installer reads it from GitHub.", "issue": "#1594" },
    { "path": ".codex-plugin/", "reason": "Codex plugin manifest; the Codex installer reads it from GitHub.", "issue": "#1594" },
    { "path": ".cursor-plugin/", "reason": "Cursor plugin manifest; the Cursor installer reads it from GitHub.", "issue": "#1594" },
    { "path": ".cursor/", "reason": "Cursor rules and hooks shipped with the plugin for Cursor users.", "issue": "#1594" },
    { "path": ".github/", "reason": "GitHub Actions workflows; the GitHub CI security and test jobs run from here.", "issue": "#1594" },
    { "path": ".orchestrator/policy/", "reason": "Shipped runtime policies, including this export policy. The PX check (check-owner-leakage.mjs --public-export) reads this copy from the snapshot; buildGithubExport and verifyExportCommit read it from the source commit.", "issue": "#1594" },
    { "path": ".orchestrator/steering/", "reason": "Product, tech and structure context that the skills inject at session start.", "issue": "#1594" },
    { "path": ".claude/rules/", "reason": "Always-on and path-scoped rules that agents and skills cite by path.", "issue": "#1594" },
    { "path": "agents/", "reason": "Sub-agent definitions; the plugin loader registers every file in this directory.", "issue": "#1594" },
    { "path": "assets/", "reason": "Images and media the README and the site reference.", "issue": "#1594" },
    { "path": "commands/", "reason": "Slash commands the plugin registers.", "issue": "#1594" },
    { "path": "docs/", "reason": "Public documentation; README links and images under docs/img/ resolve here.", "issue": "#1594" },
    { "path": "evals/", "reason": "Eval rubrics and fixtures the shipped eval skill reads.", "issue": "#1594" },
    { "path": "hooks/", "reason": "Plugin hooks every installer wires into the host harness.", "issue": "#1594" },
    { "path": "mods/so-hud/", "reason": "The HUD mod shipped with the plugin.", "issue": "#1594" },
    { "path": "monitors/", "reason": "Monitor definitions the plugin ships.", "issue": "#1594" },
    { "path": "output-styles/", "reason": "Output styles the plugin registers.", "issue": "#1594" },
    { "path": "pi/", "reason": "Pi harness integration shipped with the plugin.", "issue": "#1594" },
    { "path": "rules/", "reason": "Rule templates the bootstrap skill vendors into consumer repositories.", "issue": "#1594" },
    { "path": "scripts/", "reason": "Runtime scripts the skills, hooks and the npm package execute.", "issue": "#1594" },
    { "path": "site/", "reason": "Public website; Vercel deploys site/ from the GitHub main branch.", "issue": "#1594" },
    { "path": "skills/", "reason": "The plugin skills themselves.", "issue": "#1594" },
    { "path": "templates/", "reason": "Templates the bootstrap and setup skills copy into consumer repositories.", "issue": "#1594" },
    { "path": ".claude/loop.md", "reason": "Loop body shipped with the plugin for the /loop command.", "issue": "#1594" },
    { "path": ".mcp.json", "reason": "MCP server declaration the plugin installers read.", "issue": "#1594" },
    { "path": ".npmrc", "reason": "Install settings (ignore-scripts) the GitHub CI jobs install under.", "issue": "#1594" },
    { "path": ".gitattributes", "reason": "Line-ending rules that keep Windows clones of the mirror working.", "issue": "#1594" },
    { "path": ".gitignore", "reason": "Keeps runtime state out of commits made in clones of the mirror.", "issue": "#1594" },
    { "path": ".gitleaks.toml", "reason": "Secret-scan rules the GitHub CI security job reads.", "issue": "#1594" },
    { "path": ".mailmap", "reason": "Author identity mapping for the history GitHub displays.", "issue": "#1594" },
    { "path": "CHANGELOG.md", "reason": "Release notes for plugin and npm users.", "issue": "#1594" },
    { "path": "CONTRIBUTING.md", "reason": "Contribution guide GitHub links from issues and pull requests.", "issue": "#1594" },
    { "path": "LICENSE", "reason": "The license the published code is distributed under.", "issue": "#1594" },
    { "path": "NOTICE", "reason": "Third-party attribution notices the license requires.", "issue": "#1594" },
    { "path": "README.md", "reason": "Front page of the GitHub repository and of the npm package.", "issue": "#1594" },
    { "path": "SECURITY.md", "reason": "Vulnerability disclosure process GitHub links from its security tab.", "issue": "#1594" },
    { "path": "package.json", "reason": "Package manifest the GitHub CI and npm installs read; its files set defines the npm package.", "issue": "#1594" },
    { "path": "package-lock.json", "reason": "Lockfile the GitHub CI installs from with npm ci.", "issue": "#1594" },
    { "path": "vercel.json", "reason": "Vercel configuration for the site deployed from GitHub main.", "issue": "#1594" }
  ],
  "exclude": [
    { "path": "docs/audits/", "reason": "Audit reports may quote third-party and employer material that is not ours to publish.", "issue": "#1631" },
    { "path": ".orchestrator/peers/", "reason": "Per-user peer preference cards; host-local working data, not product source.", "issue": "#1594" },
    { "path": ".vault.yaml", "reason": "Private knowledge-vault registration; meaningful only to the owner's vault tooling.", "issue": "#1594" },
    { "path": ".claude/rules/convention-owner-inbox-erkennt-fertig-antwort-nur-in-den-letzten-600-zeichen-und-liest-uebergaben-im-registry-cwd-4c2a070.md", "reason": "Generated rule that describes internals of the owner's fleet tooling, which is not part of this plugin; no public file cites it.", "issue": "#1594" },
    { "path": "docs/handover/", "reason": "Session handover notes; internal working state.", "issue": "#1594" },
    { "path": "docs/plans/", "reason": "Internal execution plans; working documents, not documentation.", "issue": "#1594" },
    { "path": "docs/proposals/", "reason": "Internal proposals; working documents, not documentation.", "issue": "#1594" },
    { "path": "docs/prd/", "reason": "Internal product requirement documents (plan-default-visibility: internal); they describe private repositories and fleet state.", "issue": "#1631" },
    { "path": "docs/sunset-review/", "reason": "Internal sunset reviews; working documents, not documentation.", "issue": "#1594" },
    { "path": "marketing/", "reason": "Campaign working material; not part of the published plugin.", "issue": "#1594" },
    { "path": "CODEOWNERS", "reason": "GitLab code-owner file; the account it names is a different person on GitHub.", "issue": "#1594" },
    { "path": ".semgrep.yml", "reason": "Semgrep rules for the private GitLab pipeline; nothing on GitHub reads them.", "issue": "#1594" },
    { "path": "assets/marketing/", "reason": "Campaign working material; not part of the plugin and already excluded from the npm package.", "issue": "#1594" },
    { "path": "site/brand/a-leitstand/", "reason": "Logo design studies and their working files; the site and the README use only site/brand/a3-terminalmodule/ and FONT-LICENSE.txt.", "issue": "#1594" },
    { "path": "site/brand/a2-agentenmodule/", "reason": "Logo design studies and their working files; the site and the README use only site/brand/a3-terminalmodule/ and FONT-LICENSE.txt.", "issue": "#1594" },
    { "path": "site/brand/b-offenes-s/", "reason": "Logo design studies and their working files; the site and the README use only site/brand/a3-terminalmodule/ and FONT-LICENSE.txt.", "issue": "#1594" },
    { "path": "site/brand/c-werkbank/", "reason": "Logo design studies and their working files; the site and the README use only site/brand/a3-terminalmodule/ and FONT-LICENSE.txt.", "issue": "#1594" },
    { "path": "site/brand/output/", "reason": "Logo design studies and their working files; the site and the README use only site/brand/a3-terminalmodule/ and FONT-LICENSE.txt.", "issue": "#1594" },
    { "path": "site/brand/index.html", "reason": "Logo design studies and their working files; the site and the README use only site/brand/a3-terminalmodule/ and FONT-LICENSE.txt.", "issue": "#1594" },
    { "path": "site/brand/initial-directions.html", "reason": "Logo design studies and their working files; the site and the README use only site/brand/a3-terminalmodule/ and FONT-LICENSE.txt.", "issue": "#1594" },
    { "path": "site/brand/a-refinement.html", "reason": "Logo design studies and their working files; the site and the README use only site/brand/a3-terminalmodule/ and FONT-LICENSE.txt.", "issue": "#1594" },
    { "path": "site/brand/render.html", "reason": "Logo design studies and their working files; the site and the README use only site/brand/a3-terminalmodule/ and FONT-LICENSE.txt.", "issue": "#1594" },
    { "path": "site/brand/README.md", "reason": "Logo design studies and their working files; the site and the README use only site/brand/a3-terminalmodule/ and FONT-LICENSE.txt.", "issue": "#1594" },
    { "path": "site/brand/geometry.json", "reason": "Logo design studies and their working files; the site and the README use only site/brand/a3-terminalmodule/ and FONT-LICENSE.txt.", "issue": "#1594" },
    { "path": "site/brand/preferred.json", "reason": "Logo design studies and their working files; the site and the README use only site/brand/a3-terminalmodule/ and FONT-LICENSE.txt.", "issue": "#1594" }
  ]
}