# ============================================================
# MAREF OSS 发布排除清单（closed-source exclude list）
# ------------------------------------------------------------
# 用途: oss-publish.sh 裁剪公开仓 + oss-check.sh/pre-push 门禁
# 规则: 每行一个路径（支持 glob）。'#' 开头为注释。空行忽略。
# 原则: 开源有钩子(协议/标准/单Agent治理)，闭源挖深护城河(王炸层)。
#       本清单列出的路径绝不允许出现在公开分支(main/oss-release)的 tree 中。
# 维护: 新增深水区实现时同步追加本节条目，否则 pre-push 不会自动识别。
# ============================================================

# ---------- [secrets] 密钥与凭证（双保险，.gitignore 已兜底） ----------
# 注意: .env.example 是公开模板，保留公开。
.env

# ---------- [pollution-guard] 污染文件防回潮（2026-08-09 审计修复） ----------
# 个人模型路由知识库（含火山订阅套餐/价格表/endpoint，非 MAREF 框架代码）
src/research/model_registry.py
**/model_registry.py
# 编辑器/工具备份残留（*.bak-* 为时间戳备份）
*.bak
*.bak-*
# 营销分发资产（2026-08-09 决策：移出公开仓库 main，公开分支禁止含营销分发文档）
docs/marketing/**
.env.local
.env.maref
.maraf_hmac_key
.gaas_api_key
athena-governance.jsonc
credentials/**
*.key
*.pem
*.secret

# ---------- [data-runtime] 数据/运行时/审计（绝密数据层） ----------
*.db
*.sqlite
*_audit.jsonl
governance_audit*.jsonl
recursive_governance_audit.jsonl
.evolution_vault/**
policy_versions/**
.data
:memory:*
# 内部数据层（运行时/缓存/日志/运营洞察，含聚合审计数据）
data/**
data-original/**

# ---------- [nested-guard] 嵌套内部目录守卫（任意层级） ----------
# 下述内部目录无论出现在哪个层级（deep/.missions/ 等）一律排除；
# data 系为通用模块名（src/maref/data 属公开代码），仅根级排除。
**/.missions/**
**/.openclaw/**
**/.trae/**
**/.opencode/**
**/.maref/**
**/.governance/**
**/.maref_backups/**
**/experiments/**
**/reports/**
**/research_output/**
**/knowledge-library/**
**/cache/**
**/logs/**
**/.evolution_vault/**
**/policy_versions/**
**/credentials/**

# ---------- [closed-source] 闭源实现（现网，技术清单见 openclaw 内部深水区登记表） ----------
# 2026-08-12 泄漏事件（track-a-pr-creator 借道公开仓 PR 泄漏 llm_router/phone/verifier）
# 后追加：纯闭源目录整目录拦截 + 混合目录精确文件拦截（宪法第十一条 11.4 落地）。
#
# [纯闭源目录] public 树中无同名合法模块，整目录拦截（创建即阻断）：
phone/**
verifier/**
flywheel/**
browser/**
promotion/**
primitives/**
scrapling/**
infra/**
# [LLM 路由层] openclaw 专有模块（public/maref 不包含）
src/research/llm_router.py
src/research/llm_quality.py
src/research/llm_router_example.py
src/research/llm_cache.py
# [混合目录] loop/recursive/context 在 public 有合法公开文件，
# 目录级 glob 会误伤，故仅拦截 openclaw 专属文件（精确路径）：
src/maref/loop/agent_adapter.py
src/maref/loop/aitoearn_agent_adapter.py
src/maref/loop/audit_bridge.py
src/maref/loop/auditor.py
src/maref/loop/code_agent_loop.py
src/maref/loop/engine.py
src/maref/loop/github_agent_loop.py
src/maref/loop/governed.py
src/maref/loop/halting.py
src/maref/loop/oss_growth_loop.py
src/maref/loop/policy.py
src/maref/loop/skill_recursion.py
src/maref/loop/social_agent_loop.py
src/maref/loop/state.py
src/maref/loop/tracking.py
src/maref/loop/verification.py
src/maref/recursive/README.md
src/maref/recursive/agent_gossip.py
src/maref/recursive/agent_message.py
src/maref/recursive/agent_state_view.py
src/maref/recursive/alert_manager.py
src/maref/recursive/autonomy_metrics.py
src/maref/recursive/behavior_learner.py
src/maref/recursive/chaos_daemon.py
src/maref/recursive/convergence_verifier.py
src/maref/recursive/daemon_watchdog.py
src/maref/recursive/distributed_crdt.py
src/maref/recursive/entropy_injector.py
src/maref/recursive/governance_agent_scheduler.py
src/maref/recursive/live_migration.py
src/maref/recursive/milestone_scheduler.py
src/maref/recursive/p2p_regression_gate.py
src/maref/recursive/patrol_agent.py
src/maref/recursive/phase0_runner.py
src/maref/recursive/recursive_self_pipeline.py
src/maref/recursive/stuck_task_detector.py
src/maref/recursive/system_healer.py
src/maref/recursive/system_maintainer.py
src/maref/recursive/system_snapshot.py
src/maref/recursive/tech_debt_ledger.py
src/maref/recursive/topology.py
src/maref/context/__init__.py
src/maref/context/repo_context.py
# 深水区对应的公开仓坏测试（import 已被剔除的模块，避免公开仓测试失败）
tests/recursive/test_r46_distributed_crdt.py
tests/recursive/test_r35_live_migration.py
# coverage 运行时副本（含完整源码，全仓泄露风险；仅排除清单兜底，建议后续从仓库清理）
*,cover

# ---------- [closed-source] 闭源深水区：未来实现守卫 ----------
# 下述目录一旦创建即自动触发门禁阻断，须经策略评审后才能发布（登记表见 docs/oss-deepwater-registry.md）
# 注意: 清单为第一道防线（glob PATTERNS），可靠拦截依赖 scripts/oss-check.sh 的 SENSITIVE_PREFIXES
#       硬编码前缀（第二道防线）。新增王炸路径须同步修改两处。
src/maref/federation/tla_engine/**
src/maref/trustgnn/**
src/maref/cost_scheduler/**
src/maref/multimodal_guard/**
data/attack_1m/**
# Agent PKI 私有信任根（26号战略 §13.2 王炸层补登，2026-08-14 审计 R2）
src/maref/security/trust_root/**
src/maref/security/agent_pki/**
# 26号战略 §13.2 王炸层——深度实现/基因数据/自愈引擎（登记表 docs/oss-deepwater-registry.md）
src/maref/supply_chain/deep/**
src/maref/edge/self_heal/**
src/maref/immunity/gene_vault/**
src/maref/attack_patterns/**

# ---------- [internal-workspaces] 内部工作区/知识/工具配置 ----------
.missions/**
.openclaw/**
.trae/**
.opencode/**
.maref/**
.governance/**
.maref_backups/**
experiments/**
knowledge-library/**
reports/**
research_output/**
cache/**
logs/**
results/experiments/**
.mypy_cache/**
.ruff_cache/**
.pytest_cache/**
.coverage
coverage.json
coverage_full.json

# ---------- [closed-source-sync] 自动补全（check-exclude-list-sync.sh --repair, 2026-08-12） ----------
apps/athena-android/app/src/main/java/com/athena/partner/agent/loop/AgentLoopEngine.kt
apps/athena-android/app/src/main/java/com/athena/partner/agent/loop/CycleState.kt
src/maref/tools/github_email_listener.py
src/maref/tools/github_email_parser.py
src/maref/tools/github_email_responder.py
src/maref/tools/cookie_manager.py
src/maref/marketplace/discovery.py
src/maref/marketplace/skill_bridge.py
src/maref/opc/telemetry_exporter.py
src/maref/opc/sanitizer.py
src/maref/_paths.py
src/maref/mailer.py
src/maref/desktop/mcp_client.py
src/maref/desktop/scrcpy_executor.py
src/maref/desktop/screen_analyzer.py
src/maref/governance/federated_audit.py
src/maref/governance/review_surface.py
src/maref/learning/bridge.py
src/maref/tools/batch_browser.py
src/maref/knowledge/visibility.py
src/maref/knowledge/project_inferer.py
