ORGANVM defaults reusable product code, specifications, examples, and documentation to public open-source repositories. Credentials, personal data, client or partner records, unpublished strategy, runtime state, raw agent/session history, and operational evidence stay in private repositories or restricted stores.
Repository visibility is not a content-classification mechanism. A repository may become public only after its current tree and complete reachable Git history pass the release gate below.
When public product material and private operations share a repository, preserve the existing
repository as <name>-operations-private and publish a sanitized, fresh-history <name>
repository. The public repository owns product code, tests, generic fixtures, public docs,
governance, and release history from the split forward. The private companion owns customer or
partner records, operator notes, deployment state, evidence receipts, incident material, and
pre-split history.
organvm/hospes and organvm/hospes-operations-private are the reference implementation.
| Disposition | Meaning | Permitted transition |
|---|---|---|
completed_split |
Public product and private operations are separated | Maintain both boundaries |
split_required |
Reusable product exists beside private or unreviewed history | Fresh-history public extraction |
public_candidate |
Likely reusable and low-risk, but not yet audited | Public only after the release gate |
keep_private |
Private material is the repository’s purpose | Stay private; extract reusable modules separately |
archived_private |
Private historical or vendor-work artifact | Stay private or delete under a separate retention decision |
Every visibility change or fresh-history publication requires one pull request or evidence record showing all of the following:
Directly changing a private repository to public is allowed only when the complete-history audit passes. Otherwise the required operation is a fresh-history split.
Process split_required repositories in small product-family tranches. Freeze the source commit,
define exclusions, extract a clean tree, validate, publish, then redirect documentation and package
metadata. Do not move private issues, pull requests, discussions, Actions logs, or releases.
Audit empty, skeletal, or clearly reusable repositories. Add the open-source surface and publish only after history review. Empty does not automatically mean safe: repository settings, releases, issues, and deleted history remain separate audit surfaces.
Keep repositories private when their purpose is personal state, relationship or engagement data, application pipelines, browser/runtime/session state, security custody, or raw knowledge stores. Extract genuinely reusable libraries into new public repositories instead of weakening the private boundary.
Archived private repositories remain private by default. Archival, publication, and deletion are separate decisions. A retention review may later delete redundant mirrors or publish a clean derived artifact; neither happens as a side effect of this policy.
Existing public repositories remain public, but are not grandfathered out of secret, provenance, license, and personal-data scanning. Any finding creates an incident response: contain current exposure, rotate affected credentials, remove or replace sensitive material, and document the limits of history rewriting and downstream clones.
The machine-readable starting ledger is
config/repository-exposure.inventory.json.