Import the public repository

Traceability

• Spec ID: public-repository-import
• Status: Implemented

Intent

Create a public-ready Better Harness repository snapshot without inheriting the private repository history. The new local repository must contain the reviewed current product tree, omit ignored and private workspace state, and expose only one root commit with public project authorship.

Acceptance Scenarios

• AC-1: The import contains exactly the source repository's tracked snapshot plus the reviewed public-import spec and explicit sanitization edits; ignored files, the source .git directory, caches, build output, and local IDE state are absent.
• AC-2: Public content contains no personal absolute workspace path, private Git remote or registry, internal email address, private key, or live access token. Security-test fixtures remain recognizably synthetic.
• AC-3: The imported project passes the documentation-link, secret-scan, complete test, and package-verification gates from the new repository.
• AC-4: The new repository uses main, has https://github.com/QoderAI/better-harness.git as origin, and contains exactly one commit authored with the public project identity.
• AC-5: The source repository remains unchanged, and no remote push occurs as part of the local import.

Non-goals

• Publishing an npm release or configuring npm trusted publishing.
• Pushing the initial commit, changing GitHub visibility, or configuring branch protection and repository settings.
• Rewriting or sanitizing the private repository's existing Git history.
• Broad product refactors unrelated to removing current-tree publication risk.

Plan and Tasks

1. Export only tracked files from the clean source tree into an ignored staging directory; never copy the source .git directory or ignored files. (AC-1)
2. Scan text and media metadata for credentials, private paths, internal infrastructure, and non-public author identities; make narrow redactions in the staged snapshot. (AC-2)
3. Run focused documentation and secret checks, then the complete test and package-verification gates against the staged snapshot. (AC-3)
4. Copy the verified snapshot to the adjacent target, initialize main, set repository-local public author metadata and origin, and create the sole initial commit. (AC-4)
5. Re-run repository-history, tree, remote, status, and source-diff checks after the commit. Do not push. (AC-4, AC-5)

Test and Review Evidence

• AC-1/AC-2: compare the staged manifest with git ls-files; scan the staged tree for private paths, internal domains, secret formats, archives, symlinks, and unexpected large files.
• AC-3: run node --test test/doc-link-graph.test.mjs, the project secret scanner, npm test, npm run pack:verify, and git diff --check.
• AC-4: verify git rev-list --count HEAD is 1, the sole commit has no parent, its author/committer use the public identity, the branch is main, and origin is the intended GitHub URL.
• AC-5: compare source git status --porcelain=v1 before and after the import, and confirm no push command was executed.
• Risk: synthetic credential fixtures can resemble secrets. Keep them only when they are necessary to test redaction behavior and ensure the project scanner recognizes them as fixtures rather than live credentials.
• Risk: public tests may intentionally model company-specific tooling. Remove identifying infrastructure and email details without weakening the behavior the fixtures cover.

Implementation Evidence

• Exported 409 source-tracked files from a clean source tree and added only this import spec. The source .git, all 1,680 ignored files, build artifacts, caches, and IDE state were excluded.
• Replaced one personal absolute workspace path, private repository-specific smoke-test names and topology, and three internal fixture email addresses. The public scan found no remaining private Git remote, internal registry, personal path, or internal email marker.
• node scripts/agent-guardrails/secret-scan.mjs . --json --fail-on high reported 0 Critical and 0 High findings. The remaining 14 Medium findings are synthetic security fixtures or identifier-shaped false positives.
• node --test test/doc-link-graph.test.mjs passed 5 tests, and npm test passed all 824 tests in a loopback-capable environment. The initial sandboxed run passed 821 tests and failed only the three preview listeners with listen EPERM.
• NPM_CONFIG_CACHE=/private/tmp/better-harness-public-npm-cache npm run pack:verify passed with 294 npm entries and 328 runtime-zip entries. The isolated cache avoided a pre-existing ownership problem in the user npm cache without modifying global state.
• The local repository uses main, the public Qoder <dev@qoder.com> identity, the intended GitHub origin, and one parentless root commit. No push was performed.