# Publication export
> npm run publication:check archive/init/add tree equality, LFS push of installers, and NOTICE/rights review before a public remote.
- Repository: sashimikun/grok-bot-0.18-reconstructed
- GitHub: https://github.com/sashimikun/grok-bot-0.18-reconstructed
- Human docs: https://grok-wiki.com/public/docs/sashimikun-grok-bot-0-18-reconstructed-c774cc9a5c15
- Complete Markdown: https://grok-wiki.com/public/docs/sashimikun-grok-bot-0-18-reconstructed-c774cc9a5c15/llms-full.txt
## Source Files
- `docs/PUBLISHING.md`
- `scripts/verify-publication-tree.mjs`
- `NOTICE.md`
- `CONTRIBUTING.md`
- `tests/publication-bootstrap.test.mjs`
- `package.json`
---
---
title: "Publication export"
description: "npm run publication:check archive/init/add tree equality, LFS push of installers, and NOTICE/rights review before a public remote."
---
`npm run publication:check` runs `node scripts/verify-publication-tree.mjs`. The script archives the current `HEAD` tree, extracts it into a scratch directory, `git init`s a new repository, `git add --all`, then requires `git write-tree` in that export to equal `git rev-parse HEAD^{tree}` in the source checkout. That is the lossless fresh-history proof. It does not push a remote, does not install or fetch Git LFS objects, and does not review `NOTICE.md`. Those remain separate gates before a public remote.
Do not push an existing “cleaned” branch and assume deleted recovery files are gone. Parent commits can still contain generated recovery material. Export a **new** repository from an archive of the clean commit so the public history never includes those objects.
## Command
| Item | Value |
| --- | --- |
| npm script | `publication:check` |
| Implementation | `scripts/verify-publication-tree.mjs` |
| Git / tar | `/usr/bin/git`, `/usr/bin/tar` |
| Archive ref | `HEAD` (not a hardcoded branch name) |
| Scratch prefix | `$TMPDIR/grok-bot-publication-` |
| Success stdout | `Publication export preserves files and tree .` |
```sh
npm run publication:check
```
```text
Publication export preserves 4123 files and tree <40-char-oid>.
```
The file count is `git ls-tree -r --name-only HEAD` in the source repo. The tree oid is `HEAD^{tree}`. Scratch files are always removed in a `finally` block.
### What the checker does
```mermaid
flowchart LR
subgraph source["Source checkout"]
HEAD["HEAD tree objects"]
hist["Existing Git history"]
lfs["LFS object store"]
end
subgraph check["publication:check scratch"]
archive["git archive --format=tar HEAD"]
extract["tar -xf into exported/"]
init["git init --quiet"]
add["git add --all"]
write["git write-tree"]
end
subgraph public["New public remote — not part of the checker"]
commit["Initial reconstructed source import"]
push["git push -u origin main"]
lfspush["git lfs push --all origin"]
notice["NOTICE.md + independent rights review"]
end
HEAD --> archive --> extract --> init --> add --> write
write -->|must equal HEAD^{tree}| HEAD
hist -.->|must not be pushed| public
archive --> commit
lfs --> lfspush
```
Concrete steps in `verify-publication-tree.mjs`:
1. `git archive --format=tar --output=/repository.tar HEAD`
2. `mkdir` the export directory and `tar -xf` into it
3. `git init --quiet` then `git add --all` in the export (no `git lfs install` here)
4. Compare `HEAD^{tree}` to `git write-tree`
5. Compare path sets: `git ls-tree -r --name-only HEAD` vs `git ls-files` in the export
6. Assert `frontend/src/recovered/ui/sand-form-primitives.css` exists in the export and has non-zero size
`git archive` reads **tree objects**, not the working tree. Git LFS-tracked installers are stored as pointer blobs, so the checker compares pointer content, not the 155 MB / 125 MB binaries.
## History isolation
`docs/PUBLISHING.md` names `codex/clean` as a branch that removes generated recovery from its **tree** while the parent commit still contains that material. Pushing that branch (or any equivalent rewrite) leaks recovery into reachable history.
Create an empty directory and import only the archived tree:
```sh
git archive --format=tar HEAD | tar -xf - -C /path/to/empty-export
cd /path/to/empty-export
git init
git lfs install
git add .
git commit -m "Initial reconstructed source import"
```
Run `publication:check` on the **committed** clean checkout first. The script archives whatever `HEAD` is; it will not refuse a dirty-history branch.
## Git LFS installers
`.gitattributes` tracks:
- `research-archives/original/**/*.dmg filter=lfs diff=lfs merge=lfs -text`
- `research-archives/original/**/*.exe filter=lfs diff=lfs merge=lfs -text`
Pinned 0.18.0 identities (`artifacts.json` `schemaVersion` `1`):
| Path | Bytes | SHA-256 |
| --- | ---: | --- |
| `macos-arm64/Grok_Bot_0.18.0.dmg` | 155793020 | `a253ccd8aab01e083f9812a0264354c5034d8ba7f0610bbb557e82ae77d203eb` |
| `windows-x64/Grok_Bot_0.18.0_Setup.exe` | 125825552 | `464079a15ef5fa8b61ccea8fffcc78f63cfcf6df65fb0ad5e725d8b95f7e437e` |
After the remote exists:
```sh
git push -u origin main
git lfs push --all origin
```
Pushes every LFS object referenced by the new history. A normal `git push` can leave pointer-only files on the remote if the LFS transfer is skipped.
If the host offers downloadable source ZIP/tarball archives, enable inclusion of Git LFS objects. Otherwise those downloads contain only pointer files (`version https://git-lfs.github.com/spec/v1`).
On a clone that should actually bootstrap from the local DMG:
```sh
git lfs install
git lfs pull
(cd research-archives/original/0.18.0 && shasum -a 256 -c SHA256SUMS)
git lfs ls-files
```
`git lfs ls-files` must list both installers. `NOTICE.md` states those binaries remain under their own terms and are **not** covered by any license applied to reconstructed code.
## Pre-public-remote checklist
On the committed clean checkout:
```sh
npm run publication:check
```
A tree mismatch aborts with omitted/unexpected paths (first 20 of each).
```sh
npm ci
npm run bootstrap
npm run check
npm run package
npm run verify
```
`package` is macOS-only. Confirm this from the export, not a dirty working tree that still has `.cache/` or `src/app/dist/`.
```sh
git status --ignored
```
Ignored roots include `node_modules/`, `/.cache/`, `/.build/`, `/dist/`, `/src/app/dist/`, `/recovered/`, `/recovery/`, `/reports/`, `/work/`. None of those should be staged.
```sh
git lfs ls-files
```
Expect both `Grok_Bot_0.18.0.dmg` and `Grok_Bot_0.18.0_Setup.exe`.
Search the exported tree and the new repository’s full history for credentials and absolute machine paths. `publication:check` does not do this.
Obtain an independent copyright, trademark, dependency, and service-terms review. Decide a license only for material you have authority to license. Do not imply that license covers the upstream Grok Bot application, trademarks, or the LFS installers. This repository ships `NOTICE.md` and no root `LICENSE`.
## NOTICE and rights
`NOTICE.md` is the redistribution warning that must stay in the export:
- Unofficial reconstruction; not affiliated with or endorsed by Anysphere, Cursor, xAI, or SpaceX.
- No upstream source-code license is asserted or granted.
- Removing the original binary payload and recovery evidence from Git does **not** make redistribution safe.
- Git LFS 0.18.0 macOS and Windows installers are preservation copies under their own terms.
`PROVENANCE.md` repeats: complete an independent rights review before public redistribution; do not present reconstructed material as original source or an official build.
`SECURITY.md` asks for private reports to the repository owner rather than public disclosure. Publication cleanup must not silently change reconstructed runtime contracts to clear `npm audit` findings.
`CONTRIBUTING.md` forbids weakening checksum, bundle identity, code-signing, or **clean-export** checks to make a build pass.
## Ignore rules the export must keep
`.gitignore` uses a **rooted** `/recovered/` rule so root forensic output stays out of Git while `frontend/src/recovered/` remains addable.
| Path | Expected |
| --- | --- |
| `frontend/src/recovered/ui/sand-form-primitives.css` | Tracked, non-empty in the archive; `publication:check` fails if omitted or zero-length |
| `recovered/` at repo root | Ignored generated recovery |
| `src/app/dist/` | Ignored hydration output |
| `dist/`, `.build/`, `.cache/` | Ignored package/bootstrap output |
`tests/publication-packaging.test.mjs` asserts `/recovered/` (not a bare `recovered/`) and that `ignore()` does not drop the frontend CSS path.
Checked-in UI catalogs under `frontend/manifests/` remain live build inputs. Historical recovery registries whose `anchor.registry` starts with `recovered/` are treated as omitted from the clean publication tree.
`tests/publication-bootstrap.test.mjs` additionally requires production bindings in `manifests/reconstruction/electron-main-production-bindings-manifest.json` to resolve only under `source/` (`module` matching `^\.\./\.\./source/`). That invariant belongs in any public tree even though `publication:check` does not parse the manifest.
## Failures
| Symptom | Cause | Fix |
| --- | --- | --- |
| `Fresh publication export changed the tracked tree. Omitted: …` | `.gitignore` (or export-only files) dropped tracked paths after `git add --all` | Keep rooted ignore rules; do not add a bare `recovered/` pattern |
| `Unexpected: …` | Export index contains paths not in `HEAD` | Stop generating files that `git add` would pick up in a fresh repo |
| `Fresh publication export omitted frontend/src/recovered/ui/sand-form-primitives.css` | File missing or empty after archive extract | Restore the tracked reconstructed CSS |
| `git` / `tar` non-zero exit | `/usr/bin/git` or `/usr/bin/tar` missing or archive failed | Run on a machine with those tools; ensure `HEAD` exists |
| Remote ZIP is 134-byte LFS pointers | Host archive omitted LFS objects, or `git lfs push` was skipped | `git lfs push --all origin`; enable LFS-in-archives on the host |
| Clone bootstrap fails on DMG size | Working copy still has pointer files | `git lfs pull` then `shasum -a 256 -c SHA256SUMS` |
| Public history still has `/recovered/` payloads | Pushed a cleaned branch instead of a new-history import | Re-export with `git archive` into a new empty repository |
Do not “fix” a failed check by deleting `publication:check`, loosening `.gitignore` tests, or dropping LFS attributes.
## Next
LFS DMG and setup.exe identities, `artifacts.json` schemaVersion 1, and `shasum -c SHA256SUMS`.
Exact `package.json` commands including `publication:check`, `check`, `package`, and `verify`.
Required check/package commands and the rule not to weaken clean-export gates.
Pinned 0.18.0 checksums and the evidence-only reconstruction boundary that a public tree must keep.
How a fresh clone turns the LFS DMG into a verified `src/app/dist` payload.
`npm run verify` required ASAR paths and `npm run smoke` after a publication rebuild.