Skip to main content

​
Decision

Toorow maintains a private working repository while exporting a strictly allow-listed projection to public repositories. This approach separates core shareable application code from private marketing, design, and product planning workspace assets.

​
Public Application Projection

distribution/public-app.toml is the source of truth, and it is allow-list based: a path is private until it is named there. The tables on this page are checked against that file by a conformance test, so this page cannot quietly fall behind the boundary it describes. Root files: .dockerignore, .env.example, .gitattributes, .gitignore, CHANGELOG.md, CONTRIBUTING.md, LICENSE, Makefile, README.md, pyproject.toml, uv.lock.

​
A public directory does not make everything under it public

Being allow-listed opens a directory, not its whole subtree. docs/ is public because the documentation site is served from it — the internal working papers that happen to live beside those pages are not: Measured 2026-09-06: docs/product-architecture/ was created three days after the previous public export, so it had never been published and no decision had ever been taken to publish it. The first projection after that gap would have carried all of it. What has never been published does not become public as a side effect of a sync — a public push cannot be undone.

​
Private Workspace Projection

Named explicitly in public-app.toml so a boundary review can be read rather than inferred, even though the allow-list already denies every path absent from it:

​
Why an Allow-List Policy?

Deny-list policies risk exposing private files when new directories or temporary local databases are introduced. The allow-list model enforces a default-private security stance: any new path is private unless explicitly reviewed and added to distribution/public-app.toml. Defense-in-depth deny rules further scrub environment files (.env), credentials, local SQLite/DuckDB databases, and scratch data from allowed directories before export.

​
Export & Release Workflow

The public repository is github.com/Toorow/Toorow, and docs.toorow.com is built by Mintlify from the docs/ directory of its default branch. It is never updated by pushing the private monorepo: history is all-or-nothing, so only a clean allow-listed projection is published.
  1. python scripts/export_public_app.py --list — inspect exactly what the allow-list selects.
  2. python scripts/publish_public_app.py — stage that projection into a checkout outside this repository and print the diff. It writes nothing public.
  3. Run a secret scanner over the staged tree, and read the list of added files: an addition is a path that has never been public, which is where the irreversible mistake lives.
  4. Verify LICENSE is present before describing the repository as open-source.
  5. Human approval (Human Gate), then python scripts/publish_public_app.py --push -m "<message>".

​
Next Steps & Cross-References

Security Constraints

Review pre-live security checklists and architectural invariants.

Self-Hosting Guide

Deploy your own instance of toorow.