# Public Workspace Layout And Content Policy

## Scope Statement

- Classification: `staged closure blueprint`
- In scope:
  - define the target public workspace/distribution layout for `NexusCRM`
  - define what content is allowed in the public workspace
  - define what content must stay private
- Out of scope:
  - exact extraction mechanics
  - final package artifact schema
  - private repo internal structure below top-level zones

## 1. Target Public Workspace Layout

```text
NexusCRM/
  frontend/
  backend/
  shared/

  docs/
    architecture/
    compatibility/
    self-hosting/
    extension-model/
    open-source/

  examples/
    greenfield/
    demo-metadata/

  tools/
    bootstrap/
    verification/
```

The exact extension-module set is owned by the module ownership contract for the
distribution. Root `nexuscrm-*` modules are the in-repo landing shape for code
that has not graduated to an external release repo. Graduated L0 modules such
as `github.com/pingcap-inc/nexuscrm-contract`,
`github.com/pingcap-inc/nexuscrm-api-host`,
`github.com/pingcap-inc/nexuscrm-connectors`, and
`github.com/pingcap-inc/nexuscrm-controlplane` are consumed as pinned external
module dependencies. The layout above records the boundary decision:
public-core may be a public workspace/distribution made from a kernel plus
public extension modules, not a single backend package tree.

## 2. Allowed Content

- generic frontend runtime
- generic backend L0 kernel runtime
- public L0 extension modules for API host/runtime composition,
  control-plane/bootstrap/verify, pack apply/drift, automation, connectors,
  formula, analytics, files, and observability
- shared contracts and generated schema/types
- standard metadata/bootstrap/control-plane assets
- public docs, compatibility docs, self-hosting docs
- generic overlay/import/apply mechanisms
- public-safe examples and demo metadata
- bootstrap and verification tools

## 3. Disallowed Content

- `backend/internal/controlplane/tenants/**`
- tenant-private metadata payload
- PingCAP-branded fixtures and business overlays
- private ops/deploy defaults
- internal-only runbooks
- private migration history
- any content whose meaning depends on current private tenant identity

## 4. Boundary Rules

### 4.0 Public-core boundary is not the kernel boundary

`NexusCRM public-core v1` is a public product/distribution boundary. The L0
kernel is narrower: it owns generic engine read/write paths and narrow
contracts. Public but non-kernel capabilities may live in same-workspace Go
modules or selected public repos as long as the public distribution still builds,
boots, serves, and verifies without private payload.

### 4.1 Generic mechanism may remain public

Generic overlay/runtime mechanisms may remain in public core if they are
tenant-agnostic platform capability.

### 4.2 Tenant payload must stay private

Tenant-private payload under `controlplane/tenants/**` must move to the private
business repo and must not ship in `NexusCRM`.

### 4.3 Transition substrate is not product contract

Current overlay-directory layout, env-var selection, and continuity assembly
paths are transition/runtime mechanisms. They do not define the public product
contract by default.

### 4.4 Required public surfaces may move, not disappear

Setup/bootstrap, control-plane apply/verify, API host/runtime composition, and
public CRM app-pack install/verify are required public-core v1 capabilities.
They may move from `backend/internal/**` into public modules or public repos
only when the replacement self-hosting path is documented and verified before
the old path is removed.

## 5. Current Repo Landing Guidance

### 5.1 Public-core candidates

- `frontend/**`
- `shared/**`
- generic public-safe `backend/**`
- public extension modules and repos named by the active L0 split plan
- public docs and public verification assets

### 5.2 Private-only candidates

- `backend/internal/controlplane/tenants/**`
- private deploy glue
- private ops docs
- private continuity and migration assets

### 5.3 Needs scrub before public workspace assembly

- branded examples/tests/docs
- public-facing docs with internal env assumptions
- mixed runtime paths near private pilot slices

## 6. Repo Evidence Checked

- `backend/internal/controlplane/packspec/standard_objects_spec.json`
  - standard-object baseline exists separately from tenant overlay
- `backend/internal/controlplane/tenantoverlay/pack.go`
  - current overlay mechanism is generic, while payload remains directory-driven
- `backend/internal/controlplane/tenants/pingcap/**`
  - tenant payload is explicitly present and therefore must be excluded from public workspace
- `infra/backend.pingcap.Dockerfile`
  - current repo still contains private-tenant deployment variants that should not define public workspace defaults