mirror of
https://github.com/garrytan/gstack.git
synced 2026-11-04 15:57:33 +01:00
A repo with a sealed key in .gstack/pregate.json (base branch union the pushed commit, so a push can tighten but never relax) refuses publishing sealed paths, transcripts, quoted answers, seeds or local home paths to a public or unknown destination (SEALED_OUTPUT_REFUSED); private warns. Path rules see every added, renamed or copied path in each published commit (git rev-list <local> --not --remotes=<remote>), text rules each commit's added lines; waivers only from the base branch allow file; a malformed policy fails closed; visibility caches public 24 h, private 1 h. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>