feat: add public promotion guard

scripts/README.md

@@ -0,0 +1,18 @@
+# Scripts
+
+## Public Promotion Guard
+
+Use this from a promotion branch that is based on `public/main` after cherry-picking only OSS-safe commits.
+
+### Run Locally
+
+Python 3.11+ is required for the guard and its regression tests because `check_public_promotion.py` uses `tomllib`.
+
+- Fetch the public base ref if needed:
+  - `git fetch public main`
+- Run the guard:
+  - `scripts/check-public-promotion`
+- Run the guard regression tests:
+  - `python3 -m unittest scripts/tests/test_check_public_promotion.py`
+
+The guard compares the current branch against `public/main`, fails on blocked or non-allowlisted paths, scans added lines for private markers, and checks a few public invariants before you open a public PR.

scripts/check-public-promotion

@@ -0,0 +1,12 @@
+#!/usr/bin/env python3
+from pathlib import Path
+import sys
+
+SCRIPT_DIR = Path(__file__).resolve().parent
+sys.path.insert(0, str(SCRIPT_DIR))
+
+from check_public_promotion import main
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

scripts/check-public-promotion.toml

@@ -0,0 +1,98 @@
+base_ref = "public/main"
+review_warning_file_count = 40
+review_warning_area_count = 4
+
+allowlist = [
+  ".cargo/**",
+  ".github/workflows/ci.yml",
+  "assets/**",
+  "bindings/**",
+  "engine/**",
+  "tui/**",
+  "scripts/check-public-promotion",
+  "scripts/check-public-promotion.toml",
+  "scripts/check_public_promotion.py",
+  "scripts/README.md",
+  "scripts/tests/**",
+  "Cargo.toml",
+  "Cargo.lock",
+  "install.sh",
+  "README.md",
+  "CONTRIBUTING.md",
+  "ARCHITECTURE.md",
+  "LICENSE",
+  "ENGINEERING.md",
+  "TASTE.md",
+  "DOCTRINE.md",
+  "docs/README.md",
+  "docs/SPEC.md",
+  "docs/WASM_SKILLS.md",
+  "docs/assets/**",
+  "docs/architecture/**",
+  "docs/decisions/**",
+  "docs/legal/**",
+  "docs/oss-extraction-checklist.md",
+]
+
+blocklist = [
+  "app/**",
+  "docs/strategy/**",
+  "memory/**",
+  "AGENTS.md",
+  "BOOTSTRAP.md",
+  "SECURITY.md",
+  "SOUL.md",
+  "USER.md",
+  "IDENTITY.md",
+  "WORKFLOW_AUTO.md",
+  "HEARTBEAT.md",
+  ".ci/**",
+  "docs/roadmap.html",
+  "docs/test-results/**",
+  "scripts/build-dmg.sh",
+  "scripts/build-dmg-config.example.sh",
+  "scripts/release.sh",
+  "scripts/imported/**",
+  "scripts/squad/**",
+  ".github/workflows/android-atomic-nightly.yml",
+  ".github/workflows/claude.yml",
+]
+
+author_private_patterns = [
+  "\\bJoe\\b",
+  "\\bJoseph\\b",
+  "\\babbudjoe\\b",
+  "\\bclawdio\\b",
+]
+
+[[markers]]
+name = "private repo reference"
+pattern = "\\babbudjoe/fawx\\b"
+
+[[markers]]
+name = "internal assistant name"
+pattern = "\\bclawdio\\b"
+
+[[markers]]
+name = "Tailscale hostname"
+pattern = "\\b[a-z0-9-]+(?:\\.[a-z0-9-]+)+\\.ts\\.net\\b"
+
+[[markers]]
+name = "Tailscale IPv4"
+pattern = "\\b100\\.(?:6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7])(?:\\.\\d{1,3}){2}\\b"
+
+[[markers]]
+name = "suspicious credential token"
+pattern = "\\b(?:ghp_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|sk-[A-Za-z0-9_-]{12,})\\b"
+
+[[workflow_private_markers]]
+name = "private repo reference"
+pattern = "\\babbudjoe/"
+
+[[workflow_private_markers]]
+name = "private host or tailnet endpoint"
+pattern = "(?:\\.ts\\.net\\b|tailscale_https|wss://[^\\s\"']*\\.ts\\.net\\b)"
+
+[[workflow_private_markers]]
+name = "internal IP address"
+pattern = "\\b(?:10(?:\\.\\d{1,3}){3}|192\\.168(?:\\.\\d{1,3}){2}|172\\.(?:1[6-9]|2[0-9]|3[01])(?:\\.\\d{1,3}){2}|100\\.(?:6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7])(?:\\.\\d{1,3}){2})\\b"