Policy

Publication policy

This is the rulebook this site was built under. Everything on these pages draws only on Hive's always-publishable set — nothing here quotes, links to, or paraphrases registry/private/**, a live INSTANCES row, or an absolute machine path.

Public tip

The canonical public home is github.com/lk-bloom/hive. A private mirror may keep live product registries under hive/registry/private/ — the public tip must never include that folder, and any leak gets scrubbed and, if needed, the history rewritten.

Always publishable

• Orchestration, the roadmap, the glossary, contributing rules, the license, and this policy itself.
• Pattern doctrine and scaffolds — the Build Pattern, Agent Team Pools, and the Persistent Research Kit.
• Doctrine ADRs, house style.
• Distill notes and proposal templates.
• Docs-only smoke instances.
• The publish-guard script itself.

Never publish

• Absolute machine paths.
• Live product INSTANCES rows — private repos, tip SHAs, CP-0 status, absolute checkouts.
• Live hive-map product pins with private detail.
• Secrets, keys, tokens, .env files, PEM material.
• registry/private/**, full stop.

Publish checklist

1. Edit on the private parent, under hive/.
2. Run the publish guard — dry-run by default, fails closed on deny patterns.
3. Only with Steward or Admin sign-off: re-run with the apply flag against a clean public clone, then push normally.
4. Re-scan the public tree after every push.

Contributing

Proposals go through hive/proposals/: copy the template, link evidence (CLOSEOUT digests, audits, instance pain), suggest a bump class — patch, minor, or major — and leave status open until the Steward acts. Human Admin, or a designated Bloom Steward, accepts, parks, or rejects. Agents and external contributors do not self-merge hive doctrine.

Community and security

Hive follows the Contributor Covenant 2.1 for everyone in the project — issues, proposals, and discussion alike. Found a security concern instead of a doctrine gap? Don't file it as a public issue — see SECURITY.md for how to report it privately.